.aiD virus by mort[MATRiX]

description:
   - this virri was written only to show some kind of IPC and EPO and
     wasnt fully tested -> bugs, bugs, bugs,...
   - ring 3 resident, client-server based PE appender
   - using EPO, IPCs, multithreading, registry, Huffman compresion, 
     anti-debugger API :), payload

     EPO - replacing first 5 bytes with jump to virii
     IPC - mutex, mailslot, event, file-mapping
          
behaviour:
   When running first time  virus install  its server to three  directories:
   current, windows, system and add  entries to registry which run it  after
   each reboot.
          
   When server is running it creates three threads. First creates a mailslot
   and wait  until some client  is  executed.  Second wait for event setting
   from  first  thread to scan all HDDs for files to infect. Third wait some
   time and them run a payload.
          
   When an infected file is executed after reboot (= client), it creates one
   thread, restores and get back to host. Thread maps shared file needed for
   infection, coz client carry packed server and itself:). Client search for
   files  in current  direcotry  and send them to server via mailslot.  This
   first client execution will make run the second thread of server. 
   Final infection is done by server.

greetz:
   Anaktos      - your code rulez
   Darkman      - thanx for 'search help'
   Perikles     - thanx for testing
   VirusBuster  - thanx for 'scan files with AV for virii' :)