>>>>>>>>>------------[ 2 of 2 ]--------------------------->>> 11. how big your collection? -i don't collect virii except my own. i have about 8 of them in my control but only three have i posted in Mikee's World. 12. you have plan to make vck? i'm planning to make a macro source code generator. 13. ppl on VX you like -Cicatrix, Guillermito, Jerk1N, and you of course 14. ppl on VX you dislike? -n-o-n-e 15. how VX move in your country? -great. very great because most of existing systems here are still DOS based, viral infection and spreading is easy. we even have a loyal virus June12 (guess you have heard of it) that plays the national anthem on our independence day (june 12 of course) another one is Possessed which came from one of our universities. 16. are you in VX group? what your position -Yeah. i founded mikee's world. 17. anybody know you in VX (you dad, girl, etc) -close friends and my girl friend 18. what you fav AV (don't answer McAfee!) -i guess, i like tbav the best. i don't call it an AV but rather a virus writer's tool for checking his virus' survivability. 19. How many virus you have been write? what the virus name -4 gens i think. 2 com's, 1 exe, and 1 macro. the rest are just strains. the names? visit my page.. :) 20. write here you URL :) -http://members.xoom.com/virmike 21. okay thats all now write anything you like no space limit -if you (whoever is reading this) write a virus, just make sure it survives. otherwise, trash your project and start on a new one. LONG LIVE VX!!! >>>>>>>>>------------[6]---------------------------------->>> Virus Survival Theory Part - 1 by Mikee - Mikee's World http://members.xoom.com/virmike Article written on - April 29, 1998 There goes the virus programmer. Enjoying enough, looking at his another (or first)succesful virus. So he says, I'm gonna rock the world or at least the neighborhood with this. I'll name it after me so he says... The day came for him to upload his virus in his school. Bold enough to do it, he leaves the computer terminal happy, expecting that in a day or two, his virus would have spread althroughout the local area network system of his school. Day two, there he goes. Listening to the talk around. He heard somebody talking about a new virus appearing in the school. God he was so happy but all happiness vanished when he overheard another student saying, "The programmer was so stupid, TBAV detected it. An antivirus will be released tomorrow by the school's computer programmer". This could be one of the million cases in a virus writer's life. What's the point then? So here comes encryption, mutation, anti-debugging, and anti-heuristics. Of course, they work all well but damn, why do those AV people able to make scanners for this newborn babes and exterminate them before your favorite trigger date? This article does not speak of stealth techniques but rather simple tips to evade detection. Yes, even without those complicated encryption algorithms. Here they go... First of all, as much as possible, keep your virus silent as it goes on its way. A silent virus is not likely to bring up suspicion. Just in case you do so, don't bring up messages on every infection. There's a case of one virus called Catch-Me. The author himself admitted of the virus' stupidity but well, it took some time for me to catch the damn virus when I tried playing with it in my "lab computer". Now, remember that this is not a rule but a tip. So if you want to annoy people as Catch-Me does, by all means do so. You can think of many ways of how to make a virus silent. Lessening disk access is good and rewarding. I did this with my V1 (take note that this is a lamer's COM infector made by me but see it's story later) and as far as I know, it is still alive today (in our school only - to where it was designed to live). Next is to make your virus target specific. Take note a the common belief states "the more files infected, the more chances of survival". True. But what if you infect files that are not commonly used. Yeah, they can be called dormant. Fine, and not able to infect the most common program used. Maybe due to incompability or whatever. So your virus sleeps there nearly forever. You have a 5 out 100 chance of having your virus started again just to infect another program not always used. Be specific. A good virus will infect win.com and command.com before going on infecting others. If you made a SYS infector, be sure to infect those SYS files found in config.sys. This way, you'll have your virus started everytime DOS boots. Third, know your target. I learned this by experience. I released a virus I called A.1. Well, it infected files alright but didn't know how to make sure its own survival. Why, I did not even think of what system was being used by my target. I designed it to infect COM's and it would have survived should it have been uploaded in the right computer. I uploaded A.1 in one of our school's computer and poof. The computer wasn't used from then on because not known to me, the computer was for upgrade. After the upgrade, A.1 was nowhere to be found. It's hard though to be target specific expecially for virii writers who desires to have at least their creation travel worldwide. But you can still think of the most common files being used nowadays and be specific on them as well. Knowing the trend in computer software is knowing your international target. Well, those are the techniques I use in making my babies survive. Now read on and learn from V1. V1 is what I called my "very lame" virus. Lame 'coz it doesn't even infect read-only files. As a matter of fact, it uses the read-only attribute for a marker. Great. What made V1 survive are the three things you've just read. First, V1 was very, very silent. So silent that it wasn't even noticed by our professor who always checks the computers with his latest Anti-Virus. Blame the AV's. First of all, I thought, AV's will have a hard time detecting newvorn babes especially McAfee's. Well, when heuristically challenged, TBAV and F-PROT, other favorites of my professor, did not even raise a single flag. I bet they were looking for encryption algorithms and found none:). Simple code such as: jmp short over mov ah,4ch int 21h over: can fool these guys especially F-PROT if I'm not mistaken. What virus on earth would halt with a terminate program call to DOS? So there goes V1. V1 was designed to take advantage of the fact that my schoolmates often copied files from the hard drive and proud of having their own, used their copies instead of the ones in the HD. I know my target. V1, took advantage of this because it doesn't even search for other drives and directories. It's way of spreading is through being file specific. When launched, V1 first searches (since it is not even memory resident) for win.com (we were using Win3.xx and MS-DOS 6.0 by the time) and command.com in drive C and whatever the current drive is (could be Drive A). If these are not found, other files in current dir and drive are infected. Otherwise, these are infected first. When infecting other files, V1 just checks for the current subdir in the current drive. Back to V1's silence. He was so silent because he couldn't be found in memory and it doesn't access other drives except the current (exemptions are the win.com and command.com search which are hardly noticeable because V1 searches only for it in the HD and HD's are faster than FD's }:-o ). So there it goes. After uploading it, I waited for the target date to come. Just before the scheduled exams. Note that V1 was uploaded 4 months before the trigger date but nothing, even high heuristics detected it. (Secret to overcoming heuristics? - Simple code) Damn the administration 'coz the date of the exams was moved. A week later. Fine though. But my point here is that V1 was able to survive until the trigger date which of course exposed its presence due to its: "V1 Experimental Virus" message every time an infected program is run. Well the point is this, V1 survived not because of complexity but by incorporating simplicity, and the three points I mentioned above. So, as the rest of the VX community say - feel free to do what you want. Just be original! Mikee * do what you want to do * mikee@pworld.net.ph http://members.xoom.com/virmike - Mikee's World HomePage >>>>>>>>>------------[7]---------------------------------->>> vii. Greet and thanx * SlageHammer want say Greet to : Foxz the NoMercy Virus TeAM lEADER VicodinES : to have done me member of The Narkotic Network all 29A people : for giving me news on IRC VirusBuster : u are my partner in virus trading and all the other friend i know * Foxz want say Greet to : Slage : keep contact me :o) Jerk1N : What you comment about NEG Cicatrix : how to change infocourier icon ?? :oP Spooky : heheh, how about my idea? Serialkiller : got Stranger Days ? Reptile/29A : thnk for your Stranger Days :o) Steanly : see you soon on #theresia Mikee : waw, anti HMVS hehehehe CrazyMan : how about your riset?? VD/SLAM : When come #5 :o) >>>>>>>>>------------[8]---------------------------------->>> viii. Send an articles if you wanna send an article just send it to : "foxz@usa.net" or "slagehammer@usa.net" send your original article dont send us stolen article that's all >>>>>>>>>------------[EOF]-------------------------------->>> We move to http://members.xoom.com/NoMercyVirusTeam/index2.html