40Hex Volume 1 Issue 2.1
001...............................How to sneak infected files into past SCAN.
002...............................The safe way to play with viruses.
003...............................Theory Dept. Viruses Slow vs. Fast.
004...............................Interview of the month: Skism One.
005...............................Artical on The Dark Avenger.
006...............................The mother of all viruses - WHALE!
007...............................And now a word from a real dick.
008...............................The Ontario Virus.
009...............................The 1260 Virus.
010...............................The Skism 808 source code.
011...............................Vienna/Violator source code.
40Hex Staff
Hellraiser....................Editor/Programming Consultant ETC...
Nick Haflinger -=PHALCON=-....CO-Editor/Writer/Theory Consultant
Skism One.....................Virus supply/Co-Programming Consultant
The Punisher (Brooklyn).......Virus supply
Garbage Heap..................Main Virus Supply/Overseer
Spell Checker.................Obvoiusly there is none
Call the 40HEX/SKISM Homebase ----- The Landfill BBS (914)-HAK-VMBS
Sysop Garbage Heap.
Home of -=PHALCON=-
40Hex wants YOU - The write articles for this mag. Lets make it world wide!
Send any articles to the 40Hex HQ - The Landfill BBS!
Special shout out to - Sub-Zero (the hard core group), DC Wave, all the
kids at school.
40Hex Volume 1 Issue 2 0001
- HOW TO GET INFECTED FILES INTO LAME BBS's -
Ok, one problem with sending infected files to BBS's is that you never
can tell if they will be detected by SCAN. Or if you are sending bombs
the sysop might use CHK4BOMB to detect code that is data damaging.
I'm gonna tell you how to get around this, what you need is the following-
PKLITE or LZEXE
and
A good hex editor
What you do is this, compress the infected file with Pklite or Lzexe. This
will make change the files checksum and ID strings quite a bit so it can't
be detected by SCAN and damaging data will not be found by CHK4BOMB. The
problem is that now the sysop can use CHK4LITE to detect is the file is
indeed infected. So what you do is this --
Load up the hex editior -
Now look at the file, it will look something like this if you compressed it
with PKLITE.
------------------------------------------------------------------------------
0000 4D 5A 12 01 13 00 00 00-07 00 98 05 4A A4 52 02 MZתתתתתתתתתתJתRת
0010 00 04 00 00 00 01 F0 FF-50 00 00 00 03 01 50 4B תתתתתתתתPתתתתתPK
0020 4C 49 54 45 20 43 6F 70-72 2E 20 31 39 39 30 20 LITE Copr. 1990
0030 50 4B 57 41 52 45 20 49-6E 63 2E 20 41 6C 6C 20 PKWARE Inc. All
0040 52 69 67 68 74 73 20 52-65 73 65 72 76 65 64 00 Rights Reservedת
0050 0A 00 20 00 17 01 48 00-4A 04 4A A4 E2 03 00 40 תת תתתHתJתJתתתת@
0060 00 00 56 11 00 00 1C 00-00 00 00 00 00 00 00 00 תתVתתתתתתתתתתתתת
0070 B8 E3 07 BA 4B 02 8C DB-03 D8 3B 1E 02 00 73 1D תתתתKתתתתת;תתתsת
0080 83 EB 20 FA 8E D3 BC 00-02 FB 83 EB 19 8E C3 53 תת תתתתתתתתתתתתS
0090 B9 C3 00 33 FF 57 BE 48-01 FC F3 A5 CB B4 09 BA תתת3תWתHתתתתתתתת
00A0 36 01 CD 21 CD 20 4E 6F-74 20 65 6E 6F 75 67 68 6תת!ת Not enough
00B0 20 6D 65 6D 6F 72 79 24-FD 8C DB 53 83 C3 2D 03 memory$תתתSתת-ת
00C0 DA BE FE FF 8B FE 8C CD-8B C5 2B EA 8B CA D1 E1 תתתתתתתתתת+תתתתת
------------------------------------------------------------------------------
You see the header? Well what you have to do is overwrite the header with
garbage. Don't write text cause that is to dectectable by a dump program.
Just overwrite the part that says "PKLITE corp....Reserved" with hex bytes.
Also distroy the part of the code that says "Not enough memory", dont kill
the "$" symbol.
This will make the compressed file-
A> Undetectable to virus scanners, and CHK4BOMB type programs
B> Un-Decompressable
C> CHK4LITE wont notice it as a PKLITE file
It's that easy!
Keep in mind however than any file that the virus infects will no longer
be encrypted by PKLITE, so this method is good only on getting your virus
into the front door.
See the article in issue one on making new virus strains.
Forenote
After writing this article SCAN Version 80 came out, It now has the
ability to scan into Pklite compressed files. Just to let you know that
this teqnique still works and SCAN cannot detect the file as being
compressed as PKLITE.
HR
40Hex Volume 1 Issue 2 0002
THE SAFE WAY TO EXPERIMENT WITH VIRUSES
The problem with fooling around with viruses is that you never know
what damage there going to do to your hard disk. I have a couple of
so called viruses that when run, automatically screw up the FAT on
all the disks in the system. Well, theres a way around getting the
shaft from these programs, and also to experiment with legitament
viruses.
The key is the DOS utitlity SUBST, make this batch file, and copy it
to a floppy.
------------------------------------------------------------------------------
@echo off
subst d: a:\
subst c: a:\
------------------------------------------------------------------------------
What this will do is send any access to disks C: and D: (the two
hard disks in my case) to drive A: So the only damage inflicted
will be to the floppy in A:
No programs can access you hard disk when this command is issued. I
use it all the time and as of now it has proved 100% safe.
Oh yeah, if you dont feel like distroying a floppy every time you
mess with a virus, you can do this teqnique from a RAM disk.
Have fun...
HR
40Hex Volume 1 Issue 2 0003
Virus Spreading - Fast Or Slow? By Nick Haflinger -=PHALCON=-
Call The LandFill BBS (914) Hak-Vmbs
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
One of the questions while writing your virus is how quickly you want it
to spread. The easy answer is "As fast as possible" but this is not always the
best answer. If a virus moves slowly, it will take much longer before somebody
notices hard drive space disappearing, he/she will notice fewer changes to the
file dates, and all other symptoms will be lessened. However, this does provide
longer for anti-virus people (pronounced Scum, with a capital S) to discover the
virus. This issue ties directly into the issue of activation, short or long.
Since the issues are virtually identical, I will cover both together, because
they are so closely tied.
The Case For Fast
=================
Viri should spread as quickly as possible. This allows as little time
as possible for the makers of antivirus programs to come up with an antidote
before the virus is widely spread. This should be tied with a short activation
period to cause as many problems as possible before detection is possible.
Because fewer copies are generated before activation, each copy may be larger.
This allows for more extensive anti-anti-viral tactics, which are becoming
increasingly more important as the number of anti-viral products rises. Just
remember, most of these products are shit. So don't worry too much.
The Case For Slow
=================
Viri should spread slowly, because this is less obtrusive, and therefore
users are less likely to notice a change in the system. This should be coupled
with a long activation period as to have maximum penetration before the virus
activates. A slow-spreading virus will circulate to more virus programmers who
will be able to modify the program for specific needs or to adapt to antiviral
tactics. On a purely academic note, slow spreading viri must be smaller, as
more copies must be generated. This means that viri must be programmed better,
which is good for the general community.
The Case Against Fast
=====================
Fast spreading of viri is likely to draw attention. Once a virus has
been caught, in most of the cases, it is dead and useless. A virus should
infect the greatest area in the shortest time before the anti-virus people
inevitably catch up to the virus. However, because of the necessity of a short
activation time, this virus has a lesser range than a slow-spreading virus. The
programmer must rely on either (a) the quick distribution of the virus along at
least a regional level --or-- (b) the ability of other virus programmers to
obtain and modify either the source code or dissassemble and modify the
distributed virus. If possible, the source should be distributed along trusted
channels. There should be as little chance as possible of an antiviral
researcher obtaining a copy of the sourse for your masterpiece.
The Case Against Slow
=====================
A slow spreading virus is much more likely to get caught by antiviral
people prior to its necessarily long pre-activation period. There will be more
defenses out against the virus before it has spread much. However, if the virus
is well-done, it will have spread far before it is caught.
Conclusion
==========
Actually, I lied. There is no conclusion to be drawn from this, as this
is in itself the conclusion of long hours of thought and much brainstorming on
BBSs. If you would like to comment, I can be reached on LandFill BBS, phone
number above. In a future article, I will attempt to cover anti-anti-virus
tactics. I may also respond to some important questions/comments I may recieve.
Start your viri now! And may the best bug win!
NH
40Hex Volume 1 Issue 2 0004
Interview with Skism One - AKA Lord SSS (triple S)
This interview was taken by Hellraiser on July 7, 1991 in Washington
Square Park, Manhatten.
HR: So what got you started in the virus business?
SSS: Well, I used to write graffiti all over and that got sort of
played out, so I needed something else distructive to do. So
I started getting into computers, then the next thing you know
I'm writing viruses.
HR: What was you first experence with viruses?
SSS: Well the first time I heard of them was when that dickhead got
arrested for putting the worm...
HR: You mean Morris?
SSS: Yeah that asshole, it was on the news and all that - so I got
to thinking, that would be a cool thing to do.
HR: What was the first virus you ran across?
SSS: Ha... Some dick gave me a copy of (pause) it think it was
Norton 4.0 when it first came out. So I took it home and put
it on my hard drive. The next thing you know all this weird
shit starts going on. Like programs won't run and this little
box opens up on the bottom of my screen all of a sudden. So I
get a copy of SCAN, then I find out almost all my files are
infected with Jerusalem.
HR: What did you do?
SSS: Well I re-formatted the drive and examined the copy of Jeru for
months. Then one day I used a Hex editor to change the suMSDOs
string to SKISM-1. Then I went to all the computers I could
find and infected them. The next thing you know my friend
shows me this list with my name on it. It was Patti Hoffmans
document. Shit, I thought I was the man back then.
HR: Then what?
SSS: Then - well I got into assembler and dissasembly and I started
to learn how to modify the code and all that. The next thing
you know I had made my own virus from the scraps of Jeru.
HR: Captian Trips, right?
SSS: Yeah, sort of. Then someone I know sent it to all the boards
in town under a trojan name and fucked a lot of peoples shit
up. Oh well. Then I guess I grew out of the scavenger mode
and started writting my own shit, from scratch.
HR: Like what?
SSS: Well they were all called Skism so and so, like Skism 10, Skism
11 and all that. Then I meet people and they started helping
me out and now we got this thing going on.
HR: You mean Smart Kids Into Sick Methods?
SSS: Yeah, you know all thid did did dat.
HR: How do you name your viruses?
SSS: Well depends whats on my mind. Skism was my tag for like four
years, so I thought it would be cool if people saw my name in
the newspaper and all that. I got Captian Trips after reading
The Stand, by Stephen King. 1992 was just what I named it cause
the virus came out to be about 1945 bytes so I jusy padded it out
to next years date. 808 was named after the TR-808, a 'drum
machine' used in hip-hop.
HR: Whats the latest projects?
SSS: You know, you wrote most of the shit.
HR: Tell them. The people.
SSS: Well, we did SKISM 1992, which was funny, then a member of
SKISM, who shall be nameless made 808. Now I'm just taking a
break from viruses and computers for the summer.
HR: You stopped?
SSS: Your crazy, nah - It's got to wait a while, then I'll get back
into it - when school starts again.
HR: What do you think of McAffe?
SSS: He's cool, what the fuck am supposed to say. He does a good
job at spreading my name around. I really like Pat Hoffman,
thanks for the write ups. You got to understand - these people
make us into infamous villians. I can deal with that.
HR: Do you mind them detecting your viruses?
SSS: Nah, fuck it - If my shit can make it from NY to California
without effort, it shows it works. Thats it. Thers a lot more
where that came from. One more thing, I hate that gay bitch
Ross Greenburg author of Flu-Shot. What
a dick. He's just an asshole tring to sell his shit product.
He's got a big mouth and instead of crashing his board, I'd
like to kick his fucken ass. Where's his office? Up one 57th
right? Lets take a walk. Just kiddin' but the guys product
sucks and he's just a greedy asshole. I'm glad I sent a trojan
version of his virus scanner around. Ha you dick!
HR: What virus authors do you look up to?
SSS: Myself - Ha Ha (laughter) Ha Ha. No, I love Whale - that was
clever. I like Dark Avenger, the real one. Its hard to be
original, and these guys were. Hats off you crazy fuckin'
Bulgarian Metal-Head!
HR: What about groups of virus writers?
SSS: I think were the only one. Oh yeah and those Rabid people you
told me about, yeah there just like us - people tring to make
there mark in the world, or should I say dent in the world.
Germans are bugging out too - Shit, they write half the shit out
there these days. More power to them
HR: What is your advise to people who want to write viruses?
SSS: Get a late pass! No as I said more power to you. Just remember
you got to have style and learn to be ORIGINAL.
HR: What next from you?
SSS: I don't really know. I'm waiting to hook up a few more people
to the pack, then we'll get the thing rollin HARD. Till then
'A little at a time...'
At the time this artical was finished, the Skism team was at work on
a new virus code named Bad Brains.
HR
40Hex Volume 1 Issue 2 0005
The Dark Avenger
--- ---- -------
Part I. The Dark Avenger
-------------------------
Introduction:
The following text file was sent directly to Professor
Vesselin Bontchev in a public sent to an anti-viral board
located in Sofia, Bulgaria.
Bontchev is one of the leading anti-viral researchers in
Europe today. A producer of number of effective anti-viral
programs in Bulgaria, his programs are widely used throughout
Europe.
The Dark Avenger is Bulgaria's most dangerous viral code
writer and a heavy metal fanatic - as this message concerning
himself, written by him (often referring to himself in third
person) reveals:
----------------
DARK AVENGER
============
DARK AVENGER is the pseudonym used by a particularly prolific and
malicious Bulgarian virus writer. It is also the name given in the
West to some of his earlier viruses. His viruses include:
DARK AVENGER V651, V1800, V2000 and V2100
NUMBER OF THE BEAST aka 512 (several versions)
ANTHRAX (Infects both files and boot sectors)
V800 and its derivatives: 1226, PROUD, EVIL & PHOENIX
Some other viruses, e.g. NOMENKLATURA & DIAMOND are in his style but
are believed to be the work of others. MURPHY has been strongly
influenced by him but is known to be of different authorship.
CRAZY EDDIE may also be his.
Several 'hacks' are now appearing of V1800, V2100, MURPHY and
DIAMOND.
************* more **********
Eddie is the mascot of the British heavy metal group, Iron Maiden
(hence 'up the irons'). It is a 20 foot high skeleton that appears
on stage with them and is featured on the sleeves of all their
albums.
Anthrax and Damage Inc are other heavy metal groups whose names have
been featured in some Dark Avenger viruses. Iron Maiden numbers have
also been mentioned including 'Somewhere in Time', 'Only the Good Die
Young' and 'Number of the Beast'.
************** more **********
Unusually, this virus writer has also produced a virus removal
program together with a version log of his EDDIE series, as
reproduced below with its original spelling and grammar.
"DOCTOR QUICK! Virus Doctor for the Eddie Virus Version 2.01
10-31-89 Copyright (c) 1988-89 Dark Avenger. All rights reserved.
DOCTOR /? for help
It may be of interest to you to know that Eddie (also known as "Dark
Avenger") is the most widespread virus in Bulgaria for the time
being. However I have information that Eddie is well known in the
USA, West Germany and USSR too.
I started in writing the virus in early September 1988. In those
times there were no any viruses in Bulgaria, so I decided to write
the first Bulgarian virus. There were some different Eddie's
versions:
VERSION 1.1, 16-DEC-1988
In December I've decided to enhance the virus. This version could
infect files during their opening. For that reason, a read buffer
was allocated in high end of memory, rather than using DOS function
48h when needed. The disk was destroyed instead of the infected
files.
VERSION 1.2, 19-DEC-1988
This added a new feature that causes (for example) compiled programs
to be infected at once if the virus is resident. Also, the "Eddie
lives..." message was added (can you guess why exactly "Eddie"?)
VERSION 1.31, 3-JAN-1989
This became the most common version of Eddie. A code was added to
find the INT 13 rom-vector on many popular XT's and AT's. Also,
other messages were added so its length would be exactly 1800 bytes.
There was a subsequent, 1.32 version (19-JAN-1989), which added
self-checksum and other interesting features that was abandoned
because it was extremely buggy.
In early March 1989 version 1.31 was called into existence and
started to live its own life to all engineers' and other suckers'
terror. And, the last
VERSION 1.4, 17-OCT-1989
This was a bugfix for version 1.31, and added some interesting new
features. Support has been added for DOS 2.x and DOS 4.x. For
further information about this (the most terrible) version, and to
learn how to find out a program author by its code, or why
virus-writers are still not dead, contact Mr. Vesselin Bontchev (All
Rights Reserved).
So, never say die! Eddie lives on and on and on... Up the irons!"
NOTE:
Vesselin Bontchev, who the Dark Avenger is trying to discredit, is a
leading virus researcher at the Bulgarian Academy of Sciences.
Post Note:
There is a rumor concerning the fact that RABID now has
the Dark Avenger on their staff of virus writers, and that
the new Dark Avenger variant released by them was, in fact,
written by him. This has yet to be proven.
The more acceptable belief concerning this new strain
is that RABID simply picked up the source code for Dark Avenger,
released last December, and modified it.
Part II - Dark Avenger - Strain A
-----------------------
Vesselin Bontchev reports in May 1990:
The Dark Avenger virus.
======================
- I found two new mutations of this virus. Well, maybe
"mutations" is not the correct word. In the first of them, the
first 16 characters of the string "Eddie lives... somewhere in
time!" were replaced with blanks.
In the second example, all strings (the message above, the
copyright message and the "Diana P." string) were replaced with
blanks. - The author of the Dark Avenger virus (The bastard! I
still cannot determine who he is.) has released the source code
of his virus.
It is full with ironic comments about me. Of course, now we have
to expect lots of new, similar viruses to appear. At least, this
leaded to one good thing - the source helped me very much in
disassembling the V2000 virus. - I received a rather offensive
anonymous letter from this person. In it he claims to be also
the author of both the V2000 (I trust this) and the Number of the
Beast viruses (the latter is unlikely). [See Above]
Information About the Dark Avenger Virus, courtesy of
"Virus Bulletin Ltd," Buckinghamshire, England.
Note:
This information is far more valuable than the standard
Virus Summary by Patricia Hoffman. Her entry concerning DA
fails to go into more depth about the Dark Avenger virus and
apparently she has yet to receive information of the
different versions of DA. Such information is already a year
old, but she has yet to include it.
Entry...............: Dark Avenger
Alias(es)...........: ---
Virus Strain........: Dark Avenger
Virus detected when.: November 1989
where.: USA
Classification......: February 1990
Length of Virus.....: about 1800 Bytes
--------------------- Preconditions -----------------------------------
Operating System(s).: DOS
Version/Release.....:
Computer model(s)...: IBM-compatible
--------------------- Attributes --------------------------------------
Easy Identification.: Two Texts:
"Eddie lives...somewhere in time" at beginning
and
"This Program was written in the City of Sofia
(C) 1988-89 Dark Avenger" near end of file
Type of infection...: Link-virus
COM-files: appends to the program and installs a
short jump
EXE-files: appends to the program at the
beginning of the next paragraph
Infection Trigger...: COM and EXE files are corrupted on any read
attempt even when VIEWING!!!
Storage media affected: Any Drive
Interrupts hooked...: Int 21 DOS-services
Int 27 Terminate and Stay Resident
Damage..............: Overwrites a random sector with bootblock
Damage Trigger......: each 16th infection; counter located in
Bootblock
Particularities.....: -
Similarities........: -
--------------------- Agents ------------------------------------------
Countermeasures.....: NONE! All data can be destroyed !!!!
There is no way in retrieving lost data.
Backups will most probably be destroyed too.
Countermeasures successful: install McAfee's SCANRES.
Standard means......: Good luck! Hopefully the virus did not destroy
too many of your programs and data.
--------------------- Acknowledgement ---------------------------------
Location............: VTC Uni Hamburg
Classification by...: Matthias Jaenichen
Documentation by....: Matthias Jaenichen
Date................: 31.01.1990
Part III - DARK AVENGER 2000
=================
Date: 02 Feb 90 10:49:00 +0700
From: Vesselin Bontchev
This virus is also "made in Bulgaria" and again I am indirectly the
cause of its creation. I am a well known "virus-buster" in Bulgaria
and my antivirus programs are very widely used. Of course, virus
designers didn't like it. So their next creation... causes trouble
to my antivirus programs.
This virus is exactly 2000 bytes long and I think that it was
created by the author of the Eddie (Dark Avenger) virus. The
programming style is the same and there are even pieces of code
which are the same.
The virus acts much like the Eddie one --- it installs resident in
memory by manipulating the memory control blocks; infects
COMMAND.COM at the first run; infects both .COM- and .EXE-files;
infects files when one executes them as well as when one copies
them.
However, there are some extras added. First, the virus is able to
fetch the original INT 13h vector just like the V512 one (by using
the same undocumented function --- tricks spread fast between virus
programmers).
Second, it intercepts the find-first (FCB) and find-next (FCB)
functions --- just like V651 (aka EDDIE II) (and contains the same
bugs), so you won't see the increased file lengths in the listing
displayed by the DIR command.
Third, it contains the string "Copyright (C) 1989 by Vesselin
Bontchev", so people may think that I am the author of this virus.
In fact, the virus searches every program being executed for this
string (the case of the letters does not matter) and if found,
hangs the system. It is not necessary to tell you that all my
antivirus programs contain this string. Of course, now I will have
to use some kind of encryption, just to prevent such tricks.
Vesselin Bontchev reported in May 1990:
The V2000 virus (DARK AVENGER 2000)
===================================
- It turned out that the example of this virus I sent to some of
the antivirus researchers was not the original version. The
original contains the string "Only the Good die young..."
instead of the "Copy me - I want to travel" message. Also a
small piece of code in the original version was patched to
contain the "666" string. (That is, the version you have contains
this string, the original does not.)
- There exists also a small mutation of the version you have.
The only difference is that the `C' character in the word "Copy"
was changed to `Z'.
- When describing the V2000 virus, I stated that it halts the
computer if you run a program which contains the string
"Copyright (c) 1989 by Vesselin Bontchev". This is not quite
correct. In fact, the programs are only checked for the "Vesselin
Bontchev" part of the string.
- I obtained John McAfee's program Clean, version 60. In the
accompanying documentation he states about the V2000 virus that
"The virus is very virulent and has caused system crashes and
lost data, as well as causing some systems to become non-bootable
after infection". This is not very correct, or at least, there
is much more to be said. The virus is exactly as virulent as the
Dark Avenger virus, and for the same reason. It infects files
not only when one executes them, but also when one reads or
copies them. This is achieved exactly in the same manner as in
the Dark Avenger. The systems become non-bootable when the virus
infects the two hidden files of the operating system - it cannot
distinguish them from the regular .COM files. By the way, the
Dark Avenger virus often causes the same effect. And at last,
but not least (:-)), the virus is highly destructive - just as
the Dark Avenger is. It destroys the information on a randomly
selected sector on the disk once in every 16 runs of an infected
program. The random function is exactly the same, and the
counters (0 to 15 and for the last attacked sector) are exactly
the same and on the same offsets in the boot sector as with the
Dark Avenger virus. The main difference is that the destroyed
sector is overwritten not with a part of the virus body, but with
the boot sector instead. This makes a bit more difficult to
discover which files are destroyed - the boot sector is contained
in many "good" programs, such as FORMAT, SYS, NDD. Also, the
nastiest thing - the damage function is not performed via INT 26h
(which can be intercepted). The virus determines the address of
the device driver for the respective disk unit (using an
undocumented DOS function call, of course. I begin to wonder if
Ralf Brown did any good when he made the information in the
INTERxyy file available :-)). Then it performs a direct call to
that address. The device driver in DOS does its work and issues
the appropriate INT 13h. However the virus has scanned the
controllers' ROM space and has determined the original address of
the interrupt handler - just as the Dark Avenger virus does.
Then it has temporary replaced the INT 13h vector with the
address of this handler. The result is that the damage function
cannot be intercepted.
- Also this virus (unlike Dark Avenger) supports PC-DOS version
4.0 and will work (and infect) under it.
- The bytes 84 A8 A0 AD A0 20 8F 2E in the virus body are the
name "Diana P.", this time written in cyrillics.
Unknown Source