TVBSG worm generator : Readme

TVBSGv1.0beta

WARNING

This computer program is protected by copyright law and international treaties. Unauthorized reproduction or distribution of this program, or any portion of it, may result in severe criminal and civil penalties, and will be prosecuted to the maximum extent possible under law. You are allowed to distribute TVBSG in the Internet only if you distribute it in its original package. You must have the author’s written permission to distribute TVBSG in CD-ROM or in any other media than the Internet. E-Mail is acceptable as a written permission.YOU MUST ALSO AGREE THAT TOMOIAGA CRISTIAN IS NOT RESPONSIBLE IN ANT WAY FOR ANY DAMAGE CAUSED BY FILES CREATED WITH THIS PROGRAM TO ANYTHING !!

DISCLAIMER

This product is provided "as is" without any warranty of any kind. To the maximum extent permitted by applicable law, Tomoiaga Cristian further disclaims all warranties, including without limitation any implied or stated warranties of merchantability, fitness for a particularpurpose, and no infringement. The entire risk arising out of the use or performance of this product and documentation remains with recipient. To the maximum extent permitted by applicable law, in no event shall Tomoiaga Cristian or his suppliers be liable for any consequential, incidental, direct, indirect, special, punitive, recursive, or other damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, personal injury, disruption of family life, or other pecuniary loss) arising out of this agreement or the use of or inability to use the product, even if Tomoiaga Cristian have been advised of the possibility of such damages. Because some states/jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to the recipient.

COPYRIGHT NOTICE

Microsoft is a registered trademark of the Microsoft Corporation

All other trademarks belong to their respective owners.

Visual Basic® and VBScript® is are products and a trade marks of Microsoft® Corp.

Table of Contents

Introduction
Files needed
Agreement

About the Features

Backup
Startup
Infection
Network
E-mail
mIRC
Payload
Extras

Introduction

With TVBSG, you can easily create Visual Basic Script worms.

Files you need to run TVBSG

To run this program you need the MSVBVM60.DLL and Windows Scripting host. You can find both on my page.

Agreement

You have to agree to take full responsability

of any damage caused by the files that you could create with this

program.The files created with this program may have the ability of

really fast spreading by email around the world, and that could hang

up some email servers. The worms are just for learning, not for spreading.
This program and the files created with it are for educational purpose only.
You have to agree that Tomoiaga Cristian is not responsable for any damage

caused by the files that you are going to create.

VIRUS CREATION, POSESION OR TRANSMISION MAY BE ILLEGAL IN YOUR COUNTRY, BE CAREFULL WITH WHAT YOU DO.

Backup

Here you set the directory where the worm will be copied.
You have 4 options (Windows,System,Temp and Registry)
The first 3 are aesy to understand ;).
The las one (Registry) is something i added. It works like this:
the worm will copy self to the windows registry (I do not think
anti viruses scan that area) and then will create a file useing
the name and extension specified. The file created will be copyed
to the system directory and will contain this:

"On Error Resume Next" - to avoid any errors
"Set ws=CreateObject("Wscript.Shell")" - needed to read the registry
"Execute(ws.regread("HKLM\SOFTWARE\TVBSG\")) - the location where the worm was copyed

Also you can set the extension of the worms backup and set the attributes(ReadOnly,Hidden,SystemFile).
I added 4 extensions: dll, sys, ocx, and vbs
How can a VBScript run with an extension like "dll" ? I will explain this some other time.
Important: You cannot run the worm with the "dll" extension directly. The file
you generate with TVBSG must have the ".vbs" extension, otherwise will not work.

Note: "ws" and "HKLM\SOFTWARE\TVBSG\" will be diferent, depending on what names you gived to the worm. ALSO I cannot garanty that useing the "Registry" option and/or specifiing extensions like "dll, ocx, sys" will 100% work because I didn't have the time to fully test the worm. If you have any ideas or bugs to report please write me.

Startup

Here you can set the worms startup method.
There is only one for now. The walpaper method will be added soon.

Infection

The infection routine is simple. The worm will search all the HDD(s).
Infect: - all files with the extensions specified will be rewrited with the worm source.
Delete: - all files with the extensions specified will be deleted
Move to trash: - all files with the extensions specified will be moved to the Recyclebin
Infect all shortcuts (*.lnk files): - will make all shortcuts to open the worm.

Note: Adding an extension like "jse" will include the "js" extension.

Network

If this option is enabled, then if the worm will find a network computer, it will try to infect it.

NOTE: This feature should work, but I haven't been able to test this myself. Try it.

E-mail

Enable this option if you whant the worm to spread through e-mail.
Soon I will add options to send e-mail useing mIRC and other programs, not only Outlook

NOTE: This feature should work but I haven't been able to test this myself. Try it.
This function is encrypted by default.

mIRC

This function will search all HDD(s) for mirc and infect it with the soecified script.

Payloads

Here you have 5 options:

Format HDD (win9x only): will format the HDD
Delete Windows Directory: will delete the windows directory
Delete System Directory: will delete the System directory
Make *.exe files unrunable: exe files will not run by 2 clicks any more
Show a message: will display a message

Extras

Change Owner to: - will change the computers owners name
Encrypt the worm: - will encrypt the worms code
Use antideletion: - you whon't be able to delete the worm

Note: I do not recommand useing antideletion

This help file was created by Tomoiaga Cristian