 		   ]------issue #3 2 of 2 -------[

4. Virus Trade II
-----------------
   text written by Slage Hammer
   \comments from VicodinES are in [* .. *]

   Well..

   In Issue 2 i wrote an article about the Virus Trade and 
   now i want to give you some notes about all other types 
   that i like to collect.

   As i wrote previously i like to collect every type of 
   virus (i don't just collect viruses but also Virus 
   E-zines, Engines, Utis, and Virus Creation Kits). 
   i have been collecting viruses and virus related 
   programs since early 1996.

   Around the net there several Web Sites in wich it is 
   possible to find virus e-zines, and VCK's. In my 
   opinion the best site on the Net for thisis Cicatrix' 
   Virus Collection Site.
   (http://www.cyberstation.net/~cicatrix/) 
   This site is run by my friend Cicatrix. It has every 
   VCK and Virus E-zine and his CCTX update from 1996 
   are a very complete source.

   [*Cicatrix runs what is probably the number one site 
     on the net for virus writers and collectors. Those 
     that write viruses send them directly to him and 
     those that collect (including some AV companies) 
     watch his site for updates. Plus VDAT is a one of 
     a kind package!*]

   I want to explain that i consider macro virii something
   unique, not just standard viruses. This is because many 
   of people around the VX and AV consider macro virii just
   like dos, Windows 3.x and Windows 32-95 virii.

   I consider macro virii something of special because to 
   create macro virii need to know not only a particolas 
   System (like, dos, Win9x and so on) but too like a data 
   spread in a Suite like Microsoft Office 95 and 97 and
   97 patched with SR-1.

   I don't mean that is more easy to create a macro viruses
   in front of a dos or Win32/NT virus but i think there is 
   a different way to consider what our virus can do.

   [*well it is 100% easier to write a macro virus - lets 
     not kid ourselves.the only positive things about them
     is you can do a lot with a little code and they will 
     spread fast*]

   I have seen several macro viruses for Office 95, and 
   Office 97, but few of them spread them under Office 97 
   SR-1. There are macro viruses for Word, Excel, and few 
   for Access 97.

   [*Office 97 patched with SR-1 is a much different env. 
     then regular 97. Many people still blindly write Word 
     and Excel 97 viruses without testing them on an SR-1 
     patched system, the result of this is that their 
     viruses are out-dated and DO NOT work. It's time that 
     everyone realize that OrganizerCopy and 
     WordBasic.MacroCopy DO NOT WORK ON SR-1 SYSTEMS. 
     SR-1 will allow you to copy into the normal template 
     (or personal.xls) but not OUT!*]

   I find it interesting that many coders write viruses in
   asm only for either dos, and or dos and win95, but there 
   are few people that code asm viruses and macro viruses. 
   Considering asm and macro virii, the best production, 
   always in my opinion, is the VicodinES production (VMPCK).
   My friend VicodinES has done several Win95.Anxiety 
   variants and some Kewl macro viruses for Word 97 and 
   Word 97 SR1 plus some viruses that are capable of 
   spreading from one application (Word) to another (Access)
   and vice versa. (the virus that has this abilities is 
   Cross.Poppy).

   [*Reptile and I talked about doing multi-application 
     viruses. He decide to do Excel/Word so I decided 
     that I would do Access/Word. Independently we came
     to the same conclusion - to do cross-app-infection
     the virus must carry the other virus in it's body. 
     With Word/Excel Reptile was able to code a virus 
     that had the exact same VBA for both viruses but 
     mine had to have variation between the two since 
     Access gives an error on some Word code. I think he 
     did a great job. If you are interested in how my 
     virus works keep your eyes on www.avp.ch as they 
     have done a 3 page write up on Cross.Poppy.*]

   Another interesting production with the same capabilities 
   is the Strange Days from Reptile/29A that spread itself 
   from Word to Excel and vice versa.

   [*Reptile is about the only other person that I can say 
     is trying to do cool stuff with VBA and macro viruses. 
     Look at the other 99.9 percent of VBA macros and you 
     will notice that they are either bad Nightshade rip-offs 
     or bad VBA macro trojans. How many macros can you write 
     that contain "format c: /y" or  Kill("command.com") ... 
     a virus spreads, a virus does not act like a bad trojan 
     try and do something new!*]

   The Narkotic Network Virus Warehouse has some VicodinES 
   viruses
   [VMPCK is linked there but Cross.Poppy is not]
   http://users.skynet.be/somnus/virnnvw.html

   Reptile's Strange Days can be found on the 29A Web Site:
   http://www.29a.org/

   both cross-application macro viruses i spoke about are 
   avaible from our Home, NoMercy Web site at:
   http://welcome.to/NoMercy.com

   ------------------------------
   [-look for a very in-depth VBA text file from Vic in the 
     next Codebreakers issue-]

			]------------------------[

5. Archive from K-Elektronik
-----------------------------
	Many thnx for "kecoak elektronik" Indonesia hackers
   groups that let me translate their archive. Sorry if my
   English bad, bcos english is not my native lang. And i hope
   you can understad what i type ;o)
	Kecoak eleltronik page = http://k-elektronik.org 

--- begin of Original msg ---

From phardera@mindless.com Sun Mar  1 07:49:10 MST 1998
Received: from shaman.lycaeum.org (shaman.lycaeum.org 
	[207.66.171.40]) by mail.uson.mx (8.8.6/8.8.6) 
	with ESMTP id HAA09106 for <chiko@anon.nymserver.com>
	; Sun, 1 Mar 1998 07:49:09 -0700 (MST)
From: phardera@mindless.com
Received: (from root@localhost) by shaman.lycaeum.org (Partyon/dude!) 
	id GAA09733 for rewt@cucaracha.sc.uson.mx; 
	Sun, 1 Mar 1998 06:50:18 -0700 (MST)
Date: Sun, 1 Mar 1998 06:50:18 -0700 (MST)
Message-Id: <199803011350.GAA09733@shaman.lycaeum.org>
Subject: hacker goblok
X-Loop: nymserver.com
To: chiko@anon.nymserver.com
X-List: kecoak@cyberjunkie.com
Status: RO
X-Status: 
kecoak bin anjing:

---- below this will translate!! ----
kenape memang kalau gue mau ganggu elu orang? memang ada hak asasi
yang melarang gue menanggu orang? bagaimana kok hostnya blom dibuat
juga, kagak punya uang atau pasaran gigolo lagi sepi? ayo buat nanti 
gue bikin yang lebih seru lagi, mengenai hal elu mau ngejebol site-site
pemerintah dsb, udah gue laporin oleh pihak yang bersangkutan dan 
juga cert di indonesia, udah pada tahu semua, bahwa elu mau ngejebolin,
sama dari abri dan polri, call gue di batak, katanya gue suruh jagain 
site mereka, ya gue sih terima, dan mengenai elu mau gunain ip address 
gue memangnya gue anak kecil, lagian jangan suka ngebocorin, sekarang 
aparat pemerintah temen-temen gue, elu mau apa? gerakan elu juga udah 
gue kasih tahu sama mereka, bahwa elu mau buat yang melanggar
pemerintah, liat nanti juga kena getahnya. Tapi elu masih gue kasih 
kesempatan kalau elu mau bertobat dan minta ampun sama gue serta 
menganggkat gue jadi presiden kecoak, syaratnya: elu harus rela 
kambing pak haji elu ewe, elu harus disunat, ade elu yang cewek yang
lagi, harus gue ewe dulu, trus elu juga harus ganti sama kontol kuda
supaya pasaran gigolo naek, dan yang lebih penting elu harus bawa 
hasil mens emak elu ke gue. Kalau elu bisa ya, udah gue maafin dan 
nanti k-elektronik.org akan gue kembaliin lagi secara utuh. 
Perlu elu tahu deh, k-elektronik.org sekarang ada ditangan gue,
webcom tidak akan menuruti perintah gue, sekarang semuanya dibawah
pengawasan gue, inilah gue Phardera.

-Phardera [Kecoak]

------ end of original msg ------

----- begin translate msg -------

[ header msg not translate ]

what wrong if i want distrub you?, there any law that forbid any body 
to distrub some body else? how about your new home, not finish yet, 
dont have any money or prostitution market down? cmon make it and then 
i make it better again, about what you want to do to hack Goverment 
sites, i has report it to them and CERT too, everybody know that you 
want hack their site, and from ABRI (military) and Polisi (police), 
call me to Batak (North Sumatra) they ask me to protect their site, 
i accept it, about you want use my IP address, you think i a little 
boy, and now the goverment is my friend, what do you want?, now go
verment whatcing your move, just wait you will get piss.
But i'm still give you change if you forgive me and let me become 
Kecoak President, and the rules: you must suck your goat, let i fuck 
your daughter, [.... cencored.... i cant type bad word ;o) ..]
For you know, now k-lelektronik.org in my hand, webcom won't accept 
my order, now all under my legs, here i'm Phardera.

-Pradera [Kecoak]

----- end translate msg -------

			]------------------------[
