]------issue #3 2 of 2 -------[ 4. Virus Trade II ----------------- text written by Slage Hammer \comments from VicodinES are in [* .. *] Well.. In Issue 2 i wrote an article about the Virus Trade and now i want to give you some notes about all other types that i like to collect. As i wrote previously i like to collect every type of virus (i don't just collect viruses but also Virus E-zines, Engines, Utis, and Virus Creation Kits). i have been collecting viruses and virus related programs since early 1996. Around the net there several Web Sites in wich it is possible to find virus e-zines, and VCK's. In my opinion the best site on the Net for thisis Cicatrix' Virus Collection Site. (http://www.cyberstation.net/~cicatrix/) This site is run by my friend Cicatrix. It has every VCK and Virus E-zine and his CCTX update from 1996 are a very complete source. [*Cicatrix runs what is probably the number one site on the net for virus writers and collectors. Those that write viruses send them directly to him and those that collect (including some AV companies) watch his site for updates. Plus VDAT is a one of a kind package!*] I want to explain that i consider macro virii something unique, not just standard viruses. This is because many of people around the VX and AV consider macro virii just like dos, Windows 3.x and Windows 32-95 virii. I consider macro virii something of special because to create macro virii need to know not only a particolas System (like, dos, Win9x and so on) but too like a data spread in a Suite like Microsoft Office 95 and 97 and 97 patched with SR-1. I don't mean that is more easy to create a macro viruses in front of a dos or Win32/NT virus but i think there is a different way to consider what our virus can do. [*well it is 100% easier to write a macro virus - lets not kid ourselves.the only positive things about them is you can do a lot with a little code and they will spread fast*] I have seen several macro viruses for Office 95, and Office 97, but few of them spread them under Office 97 SR-1. There are macro viruses for Word, Excel, and few for Access 97. [*Office 97 patched with SR-1 is a much different env. then regular 97. Many people still blindly write Word and Excel 97 viruses without testing them on an SR-1 patched system, the result of this is that their viruses are out-dated and DO NOT work. It's time that everyone realize that OrganizerCopy and WordBasic.MacroCopy DO NOT WORK ON SR-1 SYSTEMS. SR-1 will allow you to copy into the normal template (or personal.xls) but not OUT!*] I find it interesting that many coders write viruses in asm only for either dos, and or dos and win95, but there are few people that code asm viruses and macro viruses. Considering asm and macro virii, the best production, always in my opinion, is the VicodinES production (VMPCK). My friend VicodinES has done several Win95.Anxiety variants and some Kewl macro viruses for Word 97 and Word 97 SR1 plus some viruses that are capable of spreading from one application (Word) to another (Access) and vice versa. (the virus that has this abilities is Cross.Poppy). [*Reptile and I talked about doing multi-application viruses. He decide to do Excel/Word so I decided that I would do Access/Word. Independently we came to the same conclusion - to do cross-app-infection the virus must carry the other virus in it's body. With Word/Excel Reptile was able to code a virus that had the exact same VBA for both viruses but mine had to have variation between the two since Access gives an error on some Word code. I think he did a great job. If you are interested in how my virus works keep your eyes on www.avp.ch as they have done a 3 page write up on Cross.Poppy.*] Another interesting production with the same capabilities is the Strange Days from Reptile/29A that spread itself from Word to Excel and vice versa. [*Reptile is about the only other person that I can say is trying to do cool stuff with VBA and macro viruses. Look at the other 99.9 percent of VBA macros and you will notice that they are either bad Nightshade rip-offs or bad VBA macro trojans. How many macros can you write that contain "format c: /y" or Kill("command.com") ... a virus spreads, a virus does not act like a bad trojan try and do something new!*] The Narkotic Network Virus Warehouse has some VicodinES viruses [VMPCK is linked there but Cross.Poppy is not] http://users.skynet.be/somnus/virnnvw.html Reptile's Strange Days can be found on the 29A Web Site: http://www.29a.org/ both cross-application macro viruses i spoke about are avaible from our Home, NoMercy Web site at: http://welcome.to/NoMercy.com ------------------------------ [-look for a very in-depth VBA text file from Vic in the next Codebreakers issue-] ]------------------------[ 5. Archive from K-Elektronik ----------------------------- Many thnx for "kecoak elektronik" Indonesia hackers groups that let me translate their archive. Sorry if my English bad, bcos english is not my native lang. And i hope you can understad what i type ;o) Kecoak eleltronik page = http://k-elektronik.org --- begin of Original msg --- From phardera@mindless.com Sun Mar 1 07:49:10 MST 1998 Received: from shaman.lycaeum.org (shaman.lycaeum.org [207.66.171.40]) by mail.uson.mx (8.8.6/8.8.6) with ESMTP id HAA09106 for ; Sun, 1 Mar 1998 07:49:09 -0700 (MST) From: phardera@mindless.com Received: (from root@localhost) by shaman.lycaeum.org (Partyon/dude!) id GAA09733 for rewt@cucaracha.sc.uson.mx; Sun, 1 Mar 1998 06:50:18 -0700 (MST) Date: Sun, 1 Mar 1998 06:50:18 -0700 (MST) Message-Id: <199803011350.GAA09733@shaman.lycaeum.org> Subject: hacker goblok X-Loop: nymserver.com To: chiko@anon.nymserver.com X-List: kecoak@cyberjunkie.com Status: RO X-Status: kecoak bin anjing: ---- below this will translate!! ---- kenape memang kalau gue mau ganggu elu orang? memang ada hak asasi yang melarang gue menanggu orang? bagaimana kok hostnya blom dibuat juga, kagak punya uang atau pasaran gigolo lagi sepi? ayo buat nanti gue bikin yang lebih seru lagi, mengenai hal elu mau ngejebol site-site pemerintah dsb, udah gue laporin oleh pihak yang bersangkutan dan juga cert di indonesia, udah pada tahu semua, bahwa elu mau ngejebolin, sama dari abri dan polri, call gue di batak, katanya gue suruh jagain site mereka, ya gue sih terima, dan mengenai elu mau gunain ip address gue memangnya gue anak kecil, lagian jangan suka ngebocorin, sekarang aparat pemerintah temen-temen gue, elu mau apa? gerakan elu juga udah gue kasih tahu sama mereka, bahwa elu mau buat yang melanggar pemerintah, liat nanti juga kena getahnya. Tapi elu masih gue kasih kesempatan kalau elu mau bertobat dan minta ampun sama gue serta menganggkat gue jadi presiden kecoak, syaratnya: elu harus rela kambing pak haji elu ewe, elu harus disunat, ade elu yang cewek yang lagi, harus gue ewe dulu, trus elu juga harus ganti sama kontol kuda supaya pasaran gigolo naek, dan yang lebih penting elu harus bawa hasil mens emak elu ke gue. Kalau elu bisa ya, udah gue maafin dan nanti k-elektronik.org akan gue kembaliin lagi secara utuh. Perlu elu tahu deh, k-elektronik.org sekarang ada ditangan gue, webcom tidak akan menuruti perintah gue, sekarang semuanya dibawah pengawasan gue, inilah gue Phardera. -Phardera [Kecoak] ------ end of original msg ------ ----- begin translate msg ------- [ header msg not translate ] what wrong if i want distrub you?, there any law that forbid any body to distrub some body else? how about your new home, not finish yet, dont have any money or prostitution market down? cmon make it and then i make it better again, about what you want to do to hack Goverment sites, i has report it to them and CERT too, everybody know that you want hack their site, and from ABRI (military) and Polisi (police), call me to Batak (North Sumatra) they ask me to protect their site, i accept it, about you want use my IP address, you think i a little boy, and now the goverment is my friend, what do you want?, now go verment whatcing your move, just wait you will get piss. But i'm still give you change if you forgive me and let me become Kecoak President, and the rules: you must suck your goat, let i fuck your daughter, [.... cencored.... i cant type bad word ;o) ..] For you know, now k-lelektronik.org in my hand, webcom won't accept my order, now all under my legs, here i'm Phardera. -Pradera [Kecoak] ----- end translate msg ------- ]------------------------[