>>>>>>>>>------------[ 2 of 2 ]--------------------------->>>

       11. how big your collection? 
           -i don't collect virii except my own. i have about 8 of 
            them in my control but only three have i posted in Mikee's
            World. 

       12. you have plan to make vck? 
           i'm planning to make a macro source code generator. 

       13. ppl on VX you like 
           -Cicatrix, Guillermito, Jerk1N, and you of course 

       14. ppl on VX you dislike? 
           -n-o-n-e 

       15. how VX move in your country? 
           -great. very great because most of existing systems here 
            are still DOS based, viral infection and spreading is
            easy. we even have a loyal virus June12 (guess you have 
            heard of it) that plays the national anthem on our
            independence day (june 12 of course) another one is 
            Possessed which came from one of our universities. 

       16. are you in VX group? what your position 
           -Yeah. i founded mikee's world. 

       17. anybody know you in VX (you dad, girl, etc) 
           -close friends and my girl friend 
       18. what you fav AV (don't answer McAfee!) 
           -i guess, i like tbav the best. i don't call it
            an AV but rather a virus writer's tool for checking 
            his virus' survivability. 

       19. How many virus you have been write? what the virus name 
           -4 gens i think. 2 com's, 1 exe, and 1 macro. the rest are
            just strains. the names? visit my page.. :) 
       20. write here you URL :) 
           -http://members.xoom.com/virmike 

       21. okay thats all now write anything you like no space limit 
           -if you (whoever is reading this) write a virus, just make 
            sure it survives. otherwise, trash your project and start
            on a new one. LONG LIVE VX!!! 

>>>>>>>>>------------[6]---------------------------------->>>

Virus Survival Theory Part - 1
by Mikee - Mikee's World
http://members.xoom.com/virmike
Article written on - April 29, 1998

There goes the virus programmer.  Enjoying enough, looking at his another
(or first)succesful virus.  So he says, I'm gonna rock the world or at
least the neighborhood with this.  I'll name it after me so he says...

The day came for him to upload his virus in his school.  Bold enough to do
it, he leaves the computer terminal happy, expecting that in a day or two,
his virus would have spread althroughout the local area network system of
his school.

Day two, there he goes.  Listening to the talk around.  He heard somebody
talking about a new virus appearing in the school.  God he was so happy
but all happiness vanished when he overheard another student saying, "The
programmer was so stupid, TBAV detected it.  An antivirus will be released
tomorrow by the school's computer programmer".

This could be one of the million cases in a virus writer's life.  What's
the point then?  So here comes encryption, mutation, anti-debugging, and
anti-heuristics.  Of course, they work all well but damn, why do those AV
people able to make scanners for this newborn babes and exterminate them
before your favorite trigger date? This article does not speak of stealth
techniques but rather simple tips to evade detection.  Yes, even without
those complicated encryption algorithms.  Here they go...

First of all, as much as possible, keep your virus silent as it goes on
its way.  A silent virus is not likely to bring up suspicion.  Just in
case you do so, don't bring up messages on every infection.  There's a
case of one virus called Catch-Me.  The author himself admitted of the
virus' stupidity but well, it took some time for me to catch the damn
virus when I tried playing with it in my "lab computer".  Now, remember
that this is not a rule but a tip.  So if you want to annoy people as
Catch-Me does, by all means do so.  You can think of many ways of how to
make a virus silent.  Lessening
disk access is good and rewarding.  I did this with my V1 (take note that
this is a lamer's COM infector made by me but see it's story later) and as
far as I know, it is still alive today (in our school only - to where it
was designed to live).

Next is to make your virus target specific.  Take note a the common belief
states "the more files infected, the more chances of survival". 
True.  But what if you infect files that are not commonly used.  Yeah,
they can be called dormant.  Fine, and not able to infect the most common
program used. Maybe due to incompability or whatever.  So your virus
sleeps there nearly forever.  You have a 5 out 100 chance of having your
virus started again just to infect another program not always used.  Be
specific.  A good virus will infect win.com and command.com before going
on infecting others.  If you made a SYS infector, be sure to infect those
SYS files found in config.sys. 
This way, you'll have your virus started everytime DOS boots.

Third, know your target.  I learned this by experience.  I released a
virus I called A.1.  Well, it infected files alright but didn't know how
to make sure its own survival.  Why, I did not even think of what system
was being used by my target.  I designed it to infect COM's and it would
have survived should it have been uploaded in the right computer.  I
uploaded A.1 in one of our school's computer and poof.  The computer
wasn't used from then on because not known to me, the computer was for
upgrade.  After the upgrade, A.1 was nowhere to be found.  It's hard
though to be target specific expecially for virii writers who desires to
have at least their creation travel worldwide.  But you can still think of
the most common files being used nowadays and be specific on them as well.
Knowing the trend in computer software is knowing your international
target.

Well, those are the techniques I use in making my babies survive.  Now
read on and learn from V1.
V1 is what I called my "very lame" virus.  Lame 'coz it doesn't even
infect read-only files.  As a matter of fact, it uses the read-only
attribute for a marker.  Great.  What made V1 survive are the three things
you've just read. First, V1 was very, very silent.  So silent that it
wasn't even noticed by our professor who always checks the computers with
his latest Anti-Virus. Blame the AV's.  First of all, I thought, AV's will
have a hard time detecting newvorn babes especially McAfee's.  Well, when
heuristically challenged, TBAV and F-PROT, other favorites of my
professor, did not even raise a single flag.  I bet they were looking for
encryption algorithms and found none:).  Simple code such as: 
        jmp short over
        mov ah,4ch
        int 21h
        over:
can fool these guys especially F-PROT if I'm not mistaken.  What virus on
earth would halt with a terminate program call to DOS?  So there goes V1.

V1 was designed to take advantage of the fact that my schoolmates often
copied files from the hard drive and proud of having their own, used their
copies instead of the ones in the HD.  I know my target.  V1, took
advantage of this because it doesn't even search for other drives and
directories. It's way of spreading is through being file specific.  When
launched, V1 first searches (since it is not even memory resident) for
win.com (we were using Win3.xx and MS-DOS 6.0 by the time) and command.com
in drive C and whatever the current drive is (could be Drive A).  If these
are not found, other files in current dir and drive are infected.
Otherwise, these are infected first.  When infecting other files, V1 just
checks for the current
subdir in the current drive.  Back to V1's silence.  He was so silent
because he couldn't be found in memory and it doesn't access other drives
except the current (exemptions are the win.com and command.com search
which are hardly noticeable because V1 searches only for it in the HD and
HD's are faster than FD's }:-o ).

So there it goes.  After uploading it, I waited for the target date to
come. Just before the scheduled exams.  Note that V1 was uploaded 4 months
before the trigger date but nothing, even high heuristics detected it.
(Secret to overcoming heuristics? - Simple code)  Damn the administration
'coz the date of the exams was moved.  A week later.  Fine though.   But
my point here is that V1 was able to survive until the trigger date which
of course exposed
its presence due to its: "V1 Experimental Virus"
message every time an infected program is run.

Well the point is this, V1 survived not because of complexity but by
incorporating simplicity, and the three points I mentioned above.

So, as the rest of the VX community say - feel free to do what you want.
Just be original!


Mikee
* do what you want to do *
mikee@pworld.net.ph
http://members.xoom.com/virmike - Mikee's World HomePage

>>>>>>>>>------------[7]---------------------------------->>>

vii. Greet and thanx

      * SlageHammer want say Greet to :

        Foxz the NoMercy Virus TeAM lEADER
        VicodinES      : to have done me member of The Narkotic
Network
        all 29A people : for giving me news on IRC
        VirusBuster    : u are my partner in virus trading
        and all the other friend i know

      * Foxz want say Greet to :

        Slage          : keep contact me :o)
        Jerk1N         : What you comment about NEG
        Cicatrix       : how to change infocourier icon ?? :oP
        Spooky         : heheh, how about my idea?
        Serialkiller   : got Stranger Days ?
        Reptile/29A    : thnk for your Stranger Days :o)
        Steanly        : see you soon on #theresia
        Mikee          : waw, anti HMVS  hehehehe
        CrazyMan       : how about your riset??
        VD/SLAM        : When come #5 :o)

>>>>>>>>>------------[8]---------------------------------->>>

viii. Send an articles
      if you wanna send an article just send it to :
      "foxz@usa.net" or "slagehammer@usa.net"
      send your original article dont send us stolen article
      that's all
>>>>>>>>>------------[EOF]-------------------------------->>>

We move to http://members.xoom.com/NoMercyVirusTeam/index2.html

