Little Avers Corner
                             By: Doxtor L / TI
                                 [feb 1999]


comments,complains to doxtorl@hotmail.com



[Introduction]

Imagine the following situation:
You just succeed to write a dos undetectable  virus ...
but in trying to test it ,the virus escapes and infects
exe/com of your hard disk :( and shit u just remember
NO av can detect it .So how can i find the fucking infected files? 




[A usefull mean to detect infected files]


        First this method doesnt work for true polymorphism viruses sorry
folks ;) Do you know this antiviruses called TBAV? I think so. In older
version (version 6 and 7.I have tested that with  version 6.24),in the
A.Vs package was included a little program called Tbgensig.exe. What this
program does is make it possible to add YOUR OWN virus SIGNATURE!

[How you do that?]


Its well explained in tbav doc ,so B.T.W  R.T.F.M ;) No kidding,here is 
what u need to do:
                   a) Create a file called usersig.dat
                   b) Format of the file:

          first line:  name of  virus
         second line:  description
         third  line:  hex string search


        example:

                       virus
                       com exe           
                       a3bbffaab4c9d7

                   c) Put this file in same directory than tbav 
                   d) Run tbgensig.exe 
                   and now scan your hdd  using TBAV !   

[Hint]
            
                  
                   scan string: a32b?3ffeecc  can be used
                    "?3" means: skip 3 bytes


To make a scan string use "debug.exe" instead of "extract option" of tbav

Suppose you have found in using Debug.exe :

 [Hexadecimal]                        [Instructions]

         
 BE 11 0A                             Mov si,0a11         
 B9 44 14                             Mov cx,1444
       2e                             cs:
 80 34 1A                             xor byte ptr [si],1a
       46                             inc si
    E2 F9                             loop 0106

       These instructions can be the beginning of an encrypted virus.

       To make a scan-string you can think its easy i can use:
       BE 11 0A B9 44 14 2E ...
       Its a mistake... in  "mov si,0a11", 0a11 is used only in this
       infected file,in an other file this is will be a different word .
       same thing with "mov cx,1444" and 1a in "xor byte ptr [si],1a
       ...but yes in "E2 F9" ,F9 is surely fixed.

       So use:  BE ?2 B9 ?2 2e 80 34 ?1 46 E2 
       Dont forget to press <enter> when you have written the hexadecimal
       symbols or else Tbavgensig will put on screen a message like this:
       "line 3 exeeds 80 characters"

       [Warning]
      

        One thing to remember : Tbgensig.exe works only with a registered
                                version of TBAV
                                No problem,i join a key to be registered!
                                Use it  and u can be prosecuted for piracy ;)
                                i dont care its not  my business ;)
 
                                and to get a version 6xx of tbav uses
                                ftp-search if u are connected to internet!
                                Alternative way: search in your old commercial
                                cd offered in computer magazines ;)


   [Appendix]

              
;=================Cut-Here===================================    
    section 1 of uuencode 5.22 of file tbav.key    by R.E.M.

begin 644 tbav.key
M5&AU;F1E<F)Y=&4@<F5G:7-T<F%T:6]N(&ME>2X@56YA=71H;W)I>F5D(&1U
M<&QI8V%T:6]N('!R;VAI8FET960N($%L;"!R:6=H=',-"G)E<V5R=F5D+B`H
M0RD@0V]P>7)I9VAT(#$Y.3$M.34L(%1H=6YD97)B>71E($(N5BP@5&AE($YE
M=&AE<FQA;F1S+B!,:6-E;G-E9"!T;SH-"EM425TO34%20T@Y.0``````````
M````````````````````````````````````````````````````````````
M`````````````````````!H``````````````````',B<</?,6_.<`YM3E4X
M>8%.B&-.-]]E5!!<*2#>&]L;W!OI&^H;YQOMI\3C_^<"Z`'H].?SY_;G8(-=
MU%6W58\;@H?*57,1$PW8T;#R)^\G\"?E)^8GXR?D)^DGZB?G)^@GW2?>)]LG
MW"?A)^(GWR?@)]4GUB?3)]0GV2?:)]<GV">-)XXGBR>,)Y$G4M4_Y43T0?8S
MHDWK2.Y-]D_Q!+Q,U3OP/NY+HCSU_O-"[?SZ.O#Z]3KX/^[WY4#Q2:([ZO/T
M<>]IY6;K,.<.B5_':.-L]W'V:_$HB63M!_MIHECC"N=6HE;K;.L?B6;G5O)?
1]!SF^HCY@?B!]X'V@?6!7V2!
`
end

;====================Cut-Here================================