HPAVC

home *** CD-ROM | disk | FTP | other *** search

/ HPAVC / HPAVC CD-ROM.iso / pc / CRYPT5.ZIP / CRPTLET.TR5 < prev next >

Wrap

Text File | 1992-09-11 | 53.9 KB | 1,030 lines

********************************************** The Crypt Newsletter [mid-Sept.'92]: another in an infrequent series of factual, info-glutted, tongue-in-cheek monographs solely for the enjoyment of the virus programming professional or enthusiast interested in the particulars of electronic mayhem. -*- Edited by URNST KOUCH. ********************************************** This issue's quote: "It's a new hobby, folks." --John Dvorak on virus programming, from the 2nd edition of Dvorak's Telecommunications, Dvorak and Anis (McGraw-Hill). ******************************************************************* IN THIS ISSUE: Local news...viruses for sale...condensed results of NCSA scanner evaluation...viruses as tools of civil disobedience... MacMag Peace virus dropper charged with crime...trojan programming and stomping out the pernicious threat of hard core pornography... Hans Von Braun, enlightened fellow...dummkopf of month award... Nowhere Man's CRYPTCOM 2.0...Pallbearer's KONSUMER KORNER... the CASINO virus...NUKEX...BATCOMPI trojan...the PENIS trojan... CORRUPTO 2 and more. NEWS! NEWS! NEWS! NEWS! NEWS! Frans "Dutch" Hagelaars nee SomethingAndersswhateversomething, Poobah of the Virus echo distributed on the FidoNet, clamped down on the public domain Wizard's Retreat BBS in Allentown, PA, for refusing to delete virus exchange sysop Tim Caton (aka Pallbearer) from its caller base. In order to preserve the transmission of the echo, Wizard Retreat sysop Scott Miller has made the echo 'read-only' for all local callers. He declined to delete user Caton. In related news, Phalcon/SKISM's Night Crawler, the other FidoNet virus echo user excommunicated in "Dutch's" late Summer purge, reappeared in the waning days of August to wish Hagelaars well. "You, my good man, can go to HELL!" commented the SKISM member. In unrelated news: We now reprint a fragment of a recent post from FidoNet Virus echo user and 14-year assembly programmer, Gary Watson. In it Watson protested his being labeled a pampered menial by the Crypt Newsletter for constantly being allowed to flame on topics which usually get 'lesser' users barred. "Why would I want to [pass viruses on FidoNet]? "I make a point of *not* collecting them," claimed Mr. Watson. Interested readers will be amused to find that the same "Nixon" Watson was recently spotted uploading an archive containing live samples and source code to BADBOY 2, DIAMOND, DIR-2, OUTLAND, MURPHY, MG, MIX, HORSE, PINGPONG, 4096, LEECH, AMSTRAD, CRAZYEDDIE, etc., to the DARK COFFIN BBS. The Dark Coffin is hosted by the shunned & hated Caton and, incidentally, seems to be the mailing address of this newsletter. Small world, isn't it, Gary? Not a collector? INDEED. ANYWAY, here at the Crypt newsletter, we reckon the Virus echo and its users would be BETTER served if "Dutch" Hagelaars took the following steps: 1. Discourage trivial posts like those generated by Gyuri "George" K. GK's disjointed messages resemble what can only be described as the distracting chatter of a madman. Hey, try and keep it on the subject, eh? [Oops, hope he's not DAV incognito!] 2. Time to consider instituting separate feeds to all nodes where users persist in posting "SEKRIT" messages in Polish, Danish, Slavonic, Chervonsky, Basque, Martian or whatever. As an Ami Schwein, I speak only de Englise, dammit, and see little value in wading through apocryphal messages which appear to be written in ecthje fiudoaw resstetiii. (See what I mean?) It's quite possible users from nether-Poo-Stink, Central Europe, feel the same way about MY lingua franca. Do something about this. 3. Encourage more exchange of detailed, high value info relevant to virus study, i.e., ripped off copies of Virus Bulletin, news briefs, more posting from Virus - L Digest (the Crypt Newsletter, heh). At this point, the echo is about as informative as the QModem users help group. Rob Slade and Paul Ferguson are two who DON'T continually transmit useless, anecdotal, horrifyingly re-quoted replies to the fragmented discussions of others (see #1 for an example). Many could learn from them. Time to tear the lid off the source code ban, too. The cows have left the barn, boys. Until these steps are taken, the Virus echo will remain trivial. "It's no big loss," said Caton. Res Ipso Loquitur. Down on the Gulf of Mexico in Mission, TX, sysop Zendor of the Other Side BBS has taken matters into his own hands and started charging a small fee for bulk mail delivery of viruses, source code, and related files. For $1.00 cash money, Zendor will supply a catalog; for $10.00, a diskette of the software in his archive. Compared to the $15.00 asking price for "The Little Black Book of Computer Viruses" (American Eagle Publishing, Tucson, AZ) companion diskette, Zendor's terms seem quite fair. Mail him at 1807 Cassandra, Mission, TX 78572, or call The Other Side at 512-618-0154. In related news, The Other Side is a member of the WWIV StormLink net and sponsors the "Infected Files" sub nationwide. In its first week, "Infected Files" posts included the source code for the SARA GORDON virus (mistakenly posted at the MtE) and debug scripts for the FELLOWSHIP and MIMIC2 viruses, among others. Sadly, it didn't take long for someone to cry foul and threaten its closure unless all source codes and hex dump transmissions were curtailed. The punitive action achieved little, since virus exchange sysops continued to freely trade advice and phone numbers at will. Now izzit me, or are all net co-ordinators trained to be morons? What difference is there between posting codes or BBS numbers where codes and live viruses can be freely downloaded? A free no-prize to you if you can explain it to me! Just another case of the Emperor's New Clothes. Symantec has taken the step of uploading a freeware version of the Norton Antivirus's scan utility, NAVSCA.ZIP, to the IBMSYS and VIRUSFORUM SIG's on COMPUSERVE. This is not the first time a colorful commercial outfit has attempted to do battle with the shareware market. Back at the time of the Michelangelo scare, XTREE made available a free version of UNVIRUS, the scanning utility from its VIRUSAFE package. About the only remarkable points about XTREE's program where the amusing cheeping noises it made when searching memory for 'stealth' viruses and the hysterically silly virus descriptions: "Fill in your own virus - This virus is very dangerous and will corrupt all the files on your system, eventually totally destroying the disk!" As for NAVSCAN's efficacy as a brute-force scanner against the new crop of viral programs? We took it into the Crypt virus lab and scooped up a handful of VCL 1.0 variants (DIARRHEA 1 & 2, HEEVAHAVA and RED HERRING), a few direct action infectors designed with VCL 1.0 but optimized to avoid detection by SCAN v95B (MIMIC 1 & 2, DIOGENES) and two weirdos - COMMANDER BOMBER and STARSHIP. The score? No hits. Here at the Crypt Newsletter, we deem these results unsuitable for "optimum consumer confidence." Even if it's free. And now for your further infotainment, a newsbrief culled and cribbed without permission from a post by FidoNet virus echo user Paul Ferguson. Take it away (and thanks anyway), Paul! Reprinted without permission from Federal Computer Week, 17 August 1992 - (page 34) 8<-------- Cut Here --------------- MOST VIRUS-DETECTION PRODUCTS SUCCESSFUL by Richard A. Danca Most PC virus-detection products do an excellent job of finding known viruses on a PC, according to tests run by the National Computer Security Association, Carlisle, Pa. In NCSA's tests, 12 of 16 virus-detection products found more than 90 percent of the 848 viruses or virus variants in NCSA's database. Only two of the products found fewer than 80 percent of the files. NCSA tested all the products it received after announcing it would conduct the tests, said membership director Paul R. Gates. The association will run tests every month, and future tests will probably include other virus detectors, he said. Questions remain, however, about the validity of the tests and the hazards viruses pose. Three products found 100 percent of the 848 viruses NCSA used in the test: Virex-PC from Microcom Inc., Norwood, Mass.; Panscan from Panda Systems, Wilmington, Del.; and Findviru from S&S International, Berkhamsted, Hertfordshire, Britain. NCSA uses the term "infected files" to refer to the viruses it tested because many viruses are variants of others and because there are no agreed-upon naming criteria, Gates said, nor did NCSA distinguish between common and unusual viruses. "The common ones are in there with the rare ones." ONLY DETECTION WAS TESTED NCSA tested only virus detection, not removal. Many viruses make it impossible to re-create programs or data they have infected, so detection is more important than removal, Gates said. "Mostly what people do is restore [files] is not to run the remover capability but to reinstall software" and restore data from backups. "That is the correct way of doing it." One company whose product scored low criticized NCSA's tests and objectivity. Commcrypt Inc., Beltsville, Md., said the Scan Plus portion of its Detect Plus software found 73 percent of 2,201 strains of viruses in a February test NCSA ran. "In a nutshell, we're not privy to the library we're tested against," said Warren Wertz, research director at Commcrypt. It is possible that some of the files in the NCSA database are "naked viruses or benign viruses" that cannot damage data. The NCSA database was available only to members of the Anti-Virus Program Developers consortium who paid a membership fee, said Commcrypt president William H. Landgraf. "If you're willing to pay the money - $2,000 or more a quarter - they'll provide you with the list of viruses." In a certificate it issued to Commcrypt in February, NCSA said, "Nearly all of these [2,201] strains have rarely or never been seen 'in the wild.' Scan Plus detected all common viruses." Commcrypt has many customers in the U.S. Postal Service and the federal courts, Wertz said. "They haven't got any viruses - that we know about - that they couldn't get rid of," he said. NCSA and other experts acknowledge that common viruses are far more likely to cause damage. The most common viruses include strains of Jerusalem, Stoned and Michelangelo, according to both NCSA and Commcrypt. In addition, "some people estimate that 90 to 95 percent of the data lost is because of operator error." Gates said. "I have some question about scan tests of viruses that just exist in the laboratories," said Bryan Seborg, PC and local area network security program director at the Federal Deposit Insurance Corp. Seborg is also a virus researcher and instructor at the University of Maryland. Seborg agreed with NCSA's Gates, however, on the limited value of virus removers. "The ones that do a cleanup are not a good idea." FDIC policy requires users to destroy infected files and reinstall software, For viruses that destroy boot records or hidden MS-DOS files, the FDIC solution is to use DOS' FDISK or SYS commands, Seborg said. AUGUST VIRUS SCANNER TEST RESULTS VENDOR PRODUCT VERSION SCORE Central Point CPAV 1.3* 94 Certus NOVI 1.1D 95 Commcrypt Detect Plus 2.10 60 Fifth Generation UTSCAN 24.00 90 Frisk Software F-PROT 2.04 99 IRIS CURE 20.01 93 Leprechaun Software Virus Buster 3.92 98 McAfee Associates SCAN 93 99 Microcom Inc. Virex-PC 2.2 100 Panda Software Panscan 4.05 100 RG Software Vi Spy 9.0 97 S&S International Findviru 5.60 100 Stiller Research Integrity Master 1.23A 88 Symantec NAV 2.0* 70 Trend Micro Devices PCSCAN 2.0 91 Xtree ViruSafe 4.6 86 * Test was run with the August version of the vendors' virus signature definition file, which is available to their installed base. [ Source: National Computer Security Association ] [Readers of this issue of the Crypt newsletter are invited to comment, no holds barred, on this study and Danca's article. Send comments to The Dark Coffin BBS, 1-215-966-3576 or leave mail for Couch on The Hell Pit.] NEXT UP: THE COMPUTER VIRUS AS A TOOL OF INDIVIDUAL EMPOWERMENT by THE FLIM-FLAM MAN It's time to start thinking in real terms about the computer virus as a tool for individual empowerment. To avoid an overly windy essay, I'm going to focus on two REAL human examples. The first deals with a woman in her mid-40's who works for a small specialty book publishing firm in the Lehigh Valley of eastern PA. (I've kept the descriptions of individuals deliberately vague to protect them from inappropriate attention.) In early 1992 she found herself sexually harassed in the workplace by her boss, a man for whom she felt no attraction. Unable to tell him to bug off, and knowing that in a small business there was no place to turn but the street, she became enraged. So she planned a late night smash-and-grab raid into the office to delete certain key files on his personal computer. This she did. The next day her boss was confused, frustrated and angry over the loss of his precious data. He did not hip to the fact that his work had been sabotaged by the woman quietly smiling in the next room. Given the opportunity to use a computer virus for the job, it is not totally unreasonable to assume this woman would have seriously entertained the idea of using it as a tool of redress. In any case, she was a computer vandal. And not the computer vandal most corporate stiffs like to paint: a maladjusted, teen or disgruntled, shirking whiner. Rather, she was somewhere in between; a reasonable worker pushed deep into a corner. As further food for thought: Do you think that the use of a computer virus, IN THIS INSTANCE, would have been BAD? A second example: mid-level staffers at a large metropolitan corporation in eastern Pennsylvania have had to grapple with the installation of a project implemented on a Macintosh desktop system. The junior technical administrator put in charge of bringing the system online has not proven up to the challenge. After two years of work, the system crashes daily, eats work, locks unpredictably and forces continued overtime on staffers who have to work around its shortcomings. The technical administrator is openly hostile to any suggestions from staffers who are compelled to use the system daily. The administrator's supervisor will not listen to suggestions from underlings that more expert technical help is necessary. The project has become a costly, political hot potato; its failure would mean the rep of the management team that committed to it two years previously. At this point the staffers who must work with the non-functional system daily have begun entertaining the idea of inserting a Mac virus into the already deeply screwy system. The rationale for use is that it could force a system crash which the current technical administrator could not quickly remedy. Such a disaster might break the logjam of upper management arrogance and force the consultation of someone better suited to programming of Macintosh's. They also feel that since viruses are anonymous, the blame would most likely fall on the local administrator's head for allowing it to happen. This is another graphic example of reasonable workers who feel they've been backed into a corner by leaders who seem dumb as stumps. The computer virus is viewed by the victimized as their road to empowerment. These workers are smart enough to realize that there is no guarantee that a bad situation will be made better by a virus. But they do think that throwing a monkey wrench into the system, bringing it to a noisy, ugly halt, might buy some breathing room. As told here, I'm sure most readers WILL feel some empathy for the people above. It's not a stretch to think of someone in the same tight spot. And that is why, as the gap between managers and grunts in a our technological society becomes wider, the computer virus or rogue program will be seen more and more as one of THE tools for empowerment. Anyone who works in the corporate security field should be scared white at this prospect. Because the hardest 'virus-droppers' to fight will be the the honest, determined employees, who become progressively alienated by the cynicism and indifference from an organization they work for. *********************************************** NEWS BREAK! NEWS BREAK! NEWS BREAK! NEWS BREAK! *********************************************** NEWS clip from one of COMPUSERVE's free services: Online Today CANADIAN CHARGED WITH PLANTING ALDUS COMPUTER VIRUS (Aug. 20) Former Canadian computer magazine publisher Richard Brandow, 28, has been accused of planting a computer virus that tainted thousands of copies of Aldus Corp. software in 1988. According to The Associated Press, Brandow, who now writes for "Star Trek," has been charged by prosecutors in King County, Washington with malicious mischief and could face up to 10 years in on if he is convicted. Brandow said he finds the charges surprising. "What are they going to do?" he asked, "It happened four years ago, and I am here in Montreal." He told AP that he arranged for a message to flash briefly on computer screens that wished peace "to all Macintosh users around the s were designed to educate the public to the danger of viruses. Brandow included his name in the message so he could be contacted. The virus made its way eventually to Aldus where it infected a master disk for producing copies of Freehand, an illustration program. After the virus was discovered, Aldus recalled 5,000 copies of Freehand and replaced another 5,000 copies it had in its inventory. The incident cost the firm $7,000. Ivan Orton, King County senior deputy prosecuting attorney, told AP it was the first time the state has brought such criminal charges. He also said he believes the incident was the first time a virus had tainted commercial software. For more news from The Associated Press, consult the Executive News Service.(GO APONLINE). --Cathryn Conroy [URNST KOUCH butts in: In this story, reporter Conroy is refering to the MacMag Peace virus, commissioned by Brandau, then the editor of MacMag magazine. Its trigger date of March 2, 1988, was the first anniversary of the Mac II - at which time the virus displayed the universal peace sign, or something to that effect. After Mar 2, the virus erased itself. Why do the authorities always come up with a charge YEARS later; a day late and a dollar short, so to speak? And by the way, it is spelled "Brandau."] IN SEARCH OF TROJAN PROGRAMMING or CRYPT NEWSLETTER's CAMPAIGN AGAINST THE UNRESTRICTED FLOW OF PC PORNOGRAPHY A good deal of this issue is devoted to helping the reader optimize his planned trojan programs for real world success. Let's face it, trojans which blindly sack the fixed disk and contain unencrypted, embedded ASCI strings like "You're fucked now, lamer!! Ahahahahaha!" don't cut it in the real world. Of course, such trojans will always work against the PC initiate. But admit it, that's about as much good sport as shooting fish in a barrel. No challenge, no style. Far better to just put a ballpeen hammer through the monitor and do some real damage. A good trojan should distract the user. It should, perhaps, display a fine graphic, send a cryptic error message to the monitor, or appear to do . . . nothing. Good trojan programmers never stoop to that old bromide, "You're fucked now, lamer!!" So, to start, you will want to subscribe to Lee Jackson's HACK REPORT, available at too many public electronic archives to count. It's a fine guide and tells you just what's out there; it even chronicles the more successful trojans. It is GOOD FOR IDEAS. For example, in the pd world, many were duped by the XTRATANK trojan, a genuinely clever and twisted set of programs that promised to double a user's disk space free of charge. In reality XTRATANK placed Michelangelo and Stoned virus onto the machine in two discrete steps. XTRATANK batted directly to the average user's weakest spot: The desire to gain something for nothing! Upon installation, a portion of Michelangelo's code was copied to the boot block of the disk. This was not enough to trigger any scanner. After the user realized the program was doing nothing for him, he would uninstall it, probably using the de-installation software. The de-installation software copied the remainder of Michelangelo to the boot block and inserted Stoned into memory. At this point, a scan run reveals something seriously wrong. Many were sucked in by XTRATANK. But maybe you don't have the time or the will to come up with an XTRATANK. Consider making trojans out of pornographic files. It's easy, the trojans are simple to put into the wild and serve a purpose: they burn users whose sexual tastes run to the bizaare. For this purpose, I've included the code to a flashy, but crass, display which writes an animated ANSI of a squirting gland directly to the video page. Then it crushes the drive. The ANSI was converted into code suitable for direct video writes by the most recent version of the LAUGHING DOG screen maker. The utility of this code is that ANSI.SYS does not have to be loaded, the graphic effect will take quite nicely without it. (See the appendix file: PENIS.ASM.) A second trojan is an update of CORRUPTO, something I designed using VCL 1.0. CORRUPTO 2 will display the error message "Cannot open lezbosex.dat/Critical errorlevel=25" when executed and then drop a small proprietary Crypt program which can surgically rewrite the partition onto an executable in the current directory. Include CORRUPTO in an archive with at least one other V-loader of wimmen getting it on with each other or something similar. (The idea here is that Lesbian loaders are a hot download. It's true, they just blow right out the door.) The user runs the first loader in the archive and gets an eyeful. He starts polishing his knob and runs CORRUPTO 2. Nothing but the error. Damn! Some cretin took the .DAT file out of the archive, he thinks! Stupid pirates! (Don't forget to include another dummy .DAT file for the real program, to make the sham filth seem even more real.) In reality, a partition bomb is now installed upon CORRUPTO, the other V-loader, and any other executable in the directory. When any one of these is invoked, the partition table on the C drive of any 80286 and up machine will be silently and quickly rewritten. The results will be somewhat disruptive to the days computing activity, UNLESS the user has a back-up image of the partition saved off disk and the wit to reload it. There are other benefits in creating trojans for porn directories. 1] Victims never squeal. Most Americans are far too neurotic to admit something bad happened to them while they were watching "dirty" sex. Its like confessing to your girlfriend you have a problem with horrible anal itching. It's just not done. So they may not even inform the sysop, giving your trojan longer shelf-life. 2] Such trojans are deceptively simple to upload to 'adult' directories, the bigger the better. Large adult directories aren't well-supervised. Let's face it, even the biggest pervert doesn't have enough time in the day to keep track of all the squamous product he stocks. Do you think he's gonna look at yours closely? Bet against. 3] Such trojans will not show up in The Hack Report. Lee Jackson does not cover this angle, for obvious reasons. 4] It puts you on the Republican side in the war on porn. You can be smug, like them, in knowing that YOU ARE DOING THE RIGHT THING when stomping on those presumed vile by the Moral Majority. Heck, you might even strike a few Republicans anonymously in this manner. 5] Think of the kid who's gonna have to explain to his Dad why the PC in the study room just went down. You could be steering the boy in the right direction by discouraging him from tieing up the phone and blowing valuable online time downloading more filth. But pd trojans have their place, too. To that end, Crypt Newsletter has included the DEBUG script to BATCOMPI.COM, a very effective BAT2EXE trojan. BATCOMPI will, indeed, compile your .BAT files into flawless .COM's. However, don't make a mistake when editing your .BATfile!! BATCOMPI will point out the line number and then punish the drive with a heavy stick. Also included are the convincing, BUT COMPLETELY BOGUS, docs for BATCOMPI, written by "Ned Turnquist." Be sure to include these with BATCOMPI, wherever it goes, to further give it that right patina of legitimacy. (Like XTRATANK, BATCOMPI strikes at the greed of users who wish a "free lunch.") And also for your trojan programmer's toolkit, a DEBUG script of NOWHERE MAN's CRYPTCOM utility. CRYPTCOM serves many purposes. Use it to put an encryption shell over your trojan, in the event that someone might look at it with CHK4BOMB. Use it to put an encryption shell on an old virus that you'd like to get past an initial run by an up-to-date scanner. [Also in this issue, a DEBUG scipt of the CASINO virus. The CASINO virus is a very fine program, but, unfortunately, it scans. If you want to get CASINO past the original round of scanning on any machine, CRYPTCOM it.] CRYPTCOM is merely part of Nowhere Man's Nowhere Utilities 2.0 software package. If you find it helpful, you'll want to dash out and obtain the complete package at places like The Hell Pit or the BBS's listed at the end of The Crypt Newsletter. [For assembly, take the DEBUG script for the appropriate trojan, virus, or utility listed in the newsletter appendices and go to the C:\> prompt. Type, DEBUG <*.scr, where the wildcard is the name of the appropriate script. Then <enter>. If DEBUG is in your path, the CASINO virus, BATCOMPI, CRYPTCOM, or NUKEX should now be assembled and sitting in the current directory, ready for use. NUKEX? "What's that, URNST?" I hear you screech. NUKEX is a bonus trojan! Invoking NUKEX will immediately abolish the directory structure on the C: drive of any machine and along with it, all the files on the disk. NUKEX is heavily cushioned for error and will gracefully exit to DOS if something unforseen occurs. (However, this is unlikely.) NUKEX is completely silent, too. Recommended uses: as a stand-alone rabbit-punching program or for inclusion as a 'dropped' payload, deposited by virus or trojan. NUKEX can be deployed as a subroutine in any virus, too. [NUKEX can easily be configured to erase any drive, but the copy included with the Crypt Newsletter is good ONLY for the C: drive.] I have passed along the source code to Nowhere Man who is reviewing it for inclusion in the VCL 2.0. NUKEX does not format or overwrite the affected drive. It does however, present the user with the unpalatable job of "unerasing" hundreds, if not thousands, of files and directory entries. NUKEX user note: if invoked from a floppy disk, NUKEX will abolish the directory structure on a fixed disk, leaving itself intact. If invoked from anywhere on the fixed drive, NUKEX will erase itself in the process of deleting the entire disk. So make sure you have a backup.] These programs and utilities should prove helpful if you are considering going into the 'trojanizing' business. Remember: The right tools for the right job!! *********************************************** THE FIRST CRYPT NEWSLETTER NATHAN HALE AWARD!!! *********************************************** Goes to Hans Von Braun, chief sysop for the COMSEC BBS in San Francisco. Our hats off to Von Braun, a member of the National Computer Security Association who seems to firmly believe that bulletins like 40HEX magazine should be made freely available to any interested party. Since 40HEX describes in detail tricks of virus development, Von Braun writes in a recent issue of the NCSA NEWS (a reprint of which was passed along to us here at Crypt's editorial bungalow), "We [have been] told that there are only a handful of people in the world that should have this information; they are antivirus program developers." Von Braun writes earlier, "I believe it is better for you to HAVE the information than not to have the information." Now, please go back to the statement "there are only a handful of people in the world that should have this information." Whew! That's a grand claim! It almost makes virus code sound more dangerous than nuclear secrets. Of course, you, the Crypt reader know this to be patent bullshit. And, apparently, in some manner so does Mr. Von Braun. There are two reasons which come to mind when explaining the a-v developers' dumbo rationale for the "eat-your-peas, we know what's best, no virus code for you" rule. They are: 1]. They really DO believe, in some Luddite way, that letting people onto this stuff instigates virus propagation. They DO believe that the average lumpen prole is too irresponsible to handle code correctly. This is very Republican and corporate, and although extremely deluded, easy to grasp. It is soothing balm to many clients' ears. 2]. And the real kicker: This info falls into the realm of "proprietary" secrets. Giving away proprietary information increases your competition, hurts your market advantage, and is, in general, bad for the pocket book because it will spawn users who don't require you to hold their pecker for them when they encounter a virus. So, kudos to Mr. Hans Van Braun for his "interesting" stand. We include his mailing address here so that you might send your opinion to him on this matter: 123 Townsend Street Suite 555 San Francisco, CA 94107 **************************************************************** AND THE CRYPT NEWSLETTER's US NEWS & WORLD REPORT IRAQI COMPUTER VIRUS PRIZE FOR THIS MONTH . . . **************************************************************** Goes to Michael Callahan (alias Dr. FileFinder), editor of SHAREWARE MAGAZINE. Even after a two issue series interviewing John McAfee, Callahan still believes that viruses can permanently damage the hard disk. (Talk about dense.) Now you can argue with me on this one, but show me a user who claims his machine was irrevocably damaged by a virus and I'll show you a user too embarrassed to admit he "Pepsi syndrome'd" himself. And Patricia Hoffman's virus library IS NOT the national computer virus library, Mike. It may be a big library, but it's not the government's, it's not open to private citizens (like national libraries) and it is not similar to the American Type Culture Collection (ATCC) which is the U.S. clearinghouse for real-live microbes of the natural kind. ******************************************** AND THE CRYPT NEWSLETTER VIRUS OF THE MONTH: ******************************************** The CASINO virus - from the island of Malta. The CASINO virus is a memory resident .COM infector. It will infect COMMAND.COM and will infect .COM files on the internal DIR function, DIR function called by any other program and when clean files are opened for any reason. When CASINO is resident, infected files will show only very small increases in file size, although the virus is not true "stealth." The interesting trait of CASINO is its activation: On any January 15, April 15, and Aug. 15, CASINO will display the following message: "DISK DESTROYER * A SOUVENIR OF MALTA I have just destroyed the FAT on YOUR DISK! However, I have a copy in RAM and I'm giving you one last chance to restore your precious data! WARNING: IF YOU RESET NOW ALL YOUR DATA WILL BE LOST - FOREVER! Your data depends on a game of JACKPOT. CASINO DE MALTE JACKPOT" CASINO will then compel the user to play a game of chance. If he loses, the FAT is destroyed. When I described this to Mrs. URNST KOUCH, she said, "That's evil." A DEBUG script of the CASINO virus is included with this issue of the Crypt Newsletter. Enjoy your copy of CASINO virus. PALLBEARER's KONSUMER KORNER: THE TERM PROGRAM FOR VIRUS COLLECTION /********** FACILITATION OF VIRUS COLLECTION I: THE TERM PROGRAM *************/ The entire focus of this small article is intended to save you and your SysOp time and money in the virus trade. This, num- ber one in the series, is designed to help you find the best terminal program for your needs. It reflects solely my opinion, but I am sure you will find it valuable. In the spirit of 'Consumer Reports' and Ralph Nader, I have parked myself in front of the computer during much of my spare time to compile this report (I know, REAL hard work...). So, without further adieu: -*- PALLBEARER'S GUIDE TO "TERM" (Yeah, I know it's a stupid name, but hey, I'm the author, I'm allowed to do stupid things.) -*- First, my old standby: Procomm Plus 2.01 Well, I have been using a version of Procomm Plus since I started collecting virii, and BBSing, for that matter. Many people find ProComm to be clumsy. I, personally, enjoy it. Overall, it has two major flaws: One - it only supports 3 external protocols; two - it does not support AVATAR. Beyond this, I find it very versatile. It DOES support many internal protocols, including ZMODEM, XMODEM-CRC, 1K, and 1K-G; YMODEM and G, plus a host of other "lesser knowns" such as SEAlink, WXMODEM, IMODEM, and, of course, KERMIT, which is run as an external. I find the internal ZMODEM inadequate, thus I retain DSZ as an external protocol, which I have configured for MobyTurbo. HS/Link and Super-Zmodem are also easily supported. On the plus side, PCPlus provides COMPUSERVE B+, the famous information exchange's protocol of choice. And one BIG feature is the pulldown menus from which everything can be configured. With PCPLUS, the only time one must ever make use of the install program is if you desire an easier way to change modem config and COM ports. PCPLUS also supports a Keyboard file for easy user remap, and has a wonderful internal utility that speeds up the keyboard of an AT or above. The whole ball of wax, including colors, is configurable from the menus. Of course, the internal split-screen chat is also accessed this way. The host mode, for you menu fanatics, leaves much to be desired, but works nonetheless; those of you desirous of running BBS through Procomm Plus Host, however, should remove your collective thumb from your ass and get a life. Last, the big question with many PC users today: the SPACE. Well, Procomm requires over a Meg of space BUT I would allocate 2.5 Megs on my drive for it: this includes constant screen captures and little down- loads here and there that seem to be forgotten about. For me, space is no object, but for many users this problem is one that is paramount. -*- Qmodem 5.0 Ahh, the term software that sounds like a transfer protocol. After testing this package, my only compliment is that it supports plenty of external protocols, shrinks out for a DOS shell, supports AVATAR, and is frugal on my hard drive. But my REAL advice to those of you who have a Qmodem archive? Delete it. This is one of the worst and clunkiest terms I have EVER seen. It displays a nice ANSi at startup, and has a colorful install program (sort of reminded me of that of Windows 3.1), but otherwise bites the big one. I was constantly referring to the help screen, since none of the hotkeys from other terms were represented (save for the standard PAGEUP/PAGEDOWN file xfers). A plus: file transfer data screens are very informative. However, this, too, is tainted by a generally hard-to-navigate interface. I will admit I did not spend a lot of time with Qmodem, time I still regret wasting. A final bonus: Qmodem 5.0 features a superior host mode with great menus, etc, but only 2 security levels. Well, what do you expect from a term program's host, anyway? I repeat myself: If you choose a term for its host mode, your thumb smells strangely of shit. -*- COM-AND 2.8 I am surprised to admit I was pleased with this SHAREWARE program. It incorporated many of the keys of the best of the "off-the-shelf" out there. COM-AND also has a hotkey for ASCII download, which will play your session back to you later just like a tape recorder. Nice. Or it can be speeded up with a simple keystroke to simply scroll across the screen. The dialing directory, always an important part of any term, was limited in size to 100 entries, but, then again, who keeps 100 entries in the dialing directory (before you say 'ME!,' look and see when the last time you called some of those BBSes was...)? The directory gave me a feeling of deja vu, too. It is faintly reminiscent of those early releases by DataStorm. The documentation was thorough, and an EXCELLENT help screen could be accessed by striking F10. One major feature found in COM-AND and in many other "bare-bones" terms, is control and configuration almost exclusively by script. All of the major configuration files were written in plain English, and could be easily modified in the internal editor, reached by simple hotkey. Another thing that caught my attention, and it should've caught yours while reading this report, is that EVERYTHING has a simple hotkey. This can be good or bad. The drawback: While you are learn- ing the software you must constantly refer to the helpscreen. This will cost you time, and time is money (Ma Bell does not come cheap). I suggest picking a group of local BBSes and learning COM-AND on those while sticking with another, more familiar term, for LD. I guarantee, however, as you improve with time, you will notice a marked preference for COM-AND while LD calling; you'll be pleased by the ease of use and timesaving brought to you by the hotkeys. COM-AND also features one more perq: Encryption. All of its user script files (logon/logoff, etc) are saved in the .CMD format, which as the docs say, prohibit "casual perusal" from people looking for passwords, etc. This makes it an excellent candidate for use on a multi-user system. All of these are decrypted in memory and may be easily edited in the internal editor. Macro and other files are not automatically encrypted, but may be garbled manually with a hotkey. As for file transfers, COM-AND features all of the major protocols (XMODEM, YMODEM, YMODEM-G, CIS-B and B+ enhanced, and, of course, ZMODEM), but it leaves much to be desired in the fact that it does not (or so it seems) support external protocols. (COM-AND supports external additions through an "accessories" menu. It works well but is not particularly user-friendly. -Ed.) Now, this is easy enough to fix, write yourself batch files and drop to DOS for your file transfers. For those few who find this too difficult (or time consuming for bad typists), then either live with the internals, or COM-AND is not for you. COM-AND also features an internal Kermit server. Overall, I prefer Procomm Plus, thank you very much, because of the fact that COM-AND implements externals poorly. Other- wise, COM-AND is flawless; a wonder in its configurability. Even the nag screen doesn't bother me, all it wants you to do is hit a key, and I have to do that with Procomm after it initializes the modem. I do consider COM-AND good enough to register! It can be picked up from your local pd BBS. -*- Telemate 3.01 Last but not least is another shareware answer to term, in the spirit of Apogee's Trilogies comes Telemate 3.01, which, like Qmodem 4.5 (I tested the registered version, 5.0) and COM-AND, is shareware. Also, along the Apogee lines, Telemate is a superior term program. It supports multiple externals, multiple common and uncommon protocols, and many different emulations including my 'must have', AVATAR. Telemate has one queer feature - it plays music to you. That's right! I sat down for the first time with Telemate (incidentally, I did not receive the data files for the built-in tutorial, so this critique is limited), and did a file transfer, the point of this report. When it was completed, I knew my computer meant business because it began to play the theme from 'Jeopardy' when I didn't press a key fast enough for Telemate's liking. Later, I discovered this song could be changed during installation. Speaking of which, my biggest complaint with Telemate: all of the major settings had to be changed from the config program, which was not available on the fly. Also, the Pulldown bar is always exposed and includes a status bar at the bottom, giving the user only 23 lines. (As far as I could tell, it was simplest to leave it this way.) One unique plus to Telemate is its split-screen and box effects, as though it's being run under Windows. For instance, it is possible to view a text file or the redisplay buffer in one window and have the term in the main window. It is also possible to edit a text or script file in a window with the term in another. I find this a BIG plus to anyone using a term program; it will greatly facilitate your time online. Last, I must comment on the dialing directory. Frankly, it stunk. The default colors were horrible, and editing the entries was a mess. Also, it requires 3 or 4 keystrokes to dial an entry, rather than one stroke needed for most terms. The dialing directory also had annoying habit of coming up as soon as Telemate was called. Thus, if you simply needed to send a string to your modem, you had to wait until after initialization and then exit from the dialing directory - or start dialing a BBS in Europe and not even realize it (and the author of Telemate refuses to pay phone bills incurred in this manner... sheesh, what a pain...). All in all, I found Telemate to be an acceptable term program and would switch in a second, if the dialing directory were improved. Well, there's always next release, for tomorrow is another day (fiddle-dee-dee). -*- {COMMO} 5.3 For all the manly men in the virus collecting community, Fred Brucker's assembly-coded term program could be for you. COMMO's strong points are its raw, unsurpassed speed of operation, extremely small kernel when shelling to DOS and powerful master macro utility which controls all functions in simple, intuitive one-stroke hotkeys. Alt-D - dial! PageUP - upload! Alt-X: BE GONE! COMMO also takes up almost NO space on a hard drive. Hey, even a steroid-gobbling idiot can use COMMO! COMMO's disadvantage (and it's one that weenies will be leary of): It supports only Xmodem and Ymodem internally. The good news: Zmodem, HS/Link and Compuserve B+ are ready for your use. Just drop the programs into the COMMO directory and they are, almost magically, ready for work WITH NO USER CONFIGURATION REQUIRED. As shareware, COMMO is quite reasonably priced: $25 cash money. Shelling out a little more gains a host of COMMO-ready scripts which activate a mini-host and a number of other somewhat useless utilities. /* * Well, I do hope you enjoyed this small romp through this vail of tears, * er, terms. Be on the lookout for next issue's guide to transfer * protocols: and remember, it's good stuff, because I'm not only a * CryPt SysOp, I'm also a member. Acknowledgements to authors and * ordering info for each reviewed program is found below. * * -Pallbearer [CryPt] * */ PROCOMM PLUS 2.01: Copyright (c)1987, 1991, Datastorm Technologies. QMODEM 5.0: Copyright (c)1992, Mustang Software COM-AND 2.8: Copyright (c)1991 CABER software (R. Scott McGinnis). Available through PLINK, GEnie, UNISON, NWI, Delphi, and CompuServe. TELEMATE 3.01: Copyright (c)1988 - 1992, White River Software. CompuServe in IBMCOM forum Library 3/Comm program. FidoNet requestable from 1:2202/1 as 'telemate'. {COMMO} 5.3: Copyright (c)1989, 1992; Fred P. Brucker On CSERVE, go IBMCOM, Library 3/Comm programs. -Hey, you find this boring, but what if you ever WANT to get a copy of one of these? **************************************************************************** ADDITIONAL USER NOTES ON PROGRAMS INCLUDED WITH THIS ISSUE OF THE CRYPT NEWSLETTER - A SERVICE TO THE TERMINALLY STUPID BECAUSE WE CARE The CORRUPTO script will produce CORRUPTO.COM. In 'heuristic' mode, F-PROT 2.05 flags CORRUPTO as containing routines which search for .COM and .EXE files, possibly indicative of a virus. This is true and gives you a good excuse to run CRYPTCOM on CORRUPTO after manufacture and see how it cleans this problem up. In addition, you might want to consider touching up the size (CORRUPTO is less than 1k, hardly convincing as a simple V-loader.) and date/time stamps on the trojan. For those tasks, you'll need the rest of Nowhere Man's Nowhere Utilities 2.0. I'm sure you'll want to get them and see how easy they make these mundane chores for yourself. [On F-PROT 2.05: Fans of this program, and I am one, are probably somewhat bemused by its increasingly skitzy performance, which Skulason duly notes in F-PROT's expanding 'bug reports.' 2.05 is incrediby slow and sometimes hangs when analyzing files heuristically, destroying much of this feature's utility for the average user. And occasionally 2.05 does not appear to scan memory at all on my machine. Geezus.] You can also "tickle the dragon's tail" with CORRUPTO. Place it in a directory by itself and execute it. CORRUPTO will install a drive bomb on itself in a trice, display an error message, beep once and return you gracefully to the DOS prompt. This is just as things will appear to the pigeon. DO NOT RUN CORRUPTO AGAIN!! (Unless you want to replace the partition on your fixed disk, anyway.) Delete the file and prepare your original copy of CORRUPTO (you did make a backup, didn't you?) for its trojan archive. THE NUKEX script will generate NUKEX.COM. NUKEX.COM can be flagged by F-PROT 2.04 as 'suspicious' because it contains a recursive search mechanism. Don't forget to use CRYPTCOM if you want to avoid all possibility of this. For further info on the Nowhere Utiltities CRYPTCOM, see the accompanying appendix, CRYPTCOM.DOC. Meanwhile, see this final ad: ***************************************************************************** The Nowhere Utilities v2.0 are finally out! v2.0 includes several bug fixes and improvements, in addition to three new utilities: o DECRYPT: Decrypts data encrypted with most 8- and 16-bit encryption schemes, usually in under 10 seconds! o FAKEWARE: In just a few minutes, FAKEWARE will generate a totally bogus ware, right down to the ZIP comment and .NFO file by a famous cracking group. Great for distributing new virii and trojans. o USER2TXT: Converts a Telegard v2.5/v2.7 or X-Ot-Icks v3.8 user list to a readable ASCII file. Useful for on-line reference while hacking... Get the Nowhere Utilities today! A fine set of programs to help the corrupted programmer develop and spread his creations. Useful to just about anyone at one time or another. From the author of Virus Creation Laboratory. [NuKE] Release [NuKE] Release [NuKE] Release [NuKE] Release [NuKE] Release ***************************************************************************** -*- Closing quote for the day: "Remember, boys and girls, to put your roller skates away at the TOP of the stairs." --Soupy Sales -*- This issue of the Crypt Newsletter SHOULD contain the following files: CRYPTLET.TR5 - this document PENIS.ASM - MASM/TASM compatible source listing for the PENIS trojan CORRUPTO.SCR - DEBUG script for the CORRUPTO 2 trojan NUKEX.SCR - DEBUG script for the bonus trojan/util, NUKEX CRYPTCOM.SCR - DEBUG script for Nowhere Man's CRYPTCOM trojan/virus toolkit utility, Nuke International Software, Inc. CRYPTCOM.DOC - documentation and user notes for CRYPTCOM CASINO.SCR - DEBUG script for the CASINO virus BATCOMPI.SCR - DEBUG script for BAT2EXE trojan program BATCOMPI.DOC - 'fake' documentation for BATCOMPI trojan program ASM.BAT - ancillary file to accompany BATCOMPI.DOC If any of these files are missing, demand upgrade! As usual, current and complete issues of the Crypt Newsletter can be obtained at the DARK COFFIN BBS. Here at the newsletter, we welcome your comments and contributions, so, until next time . . . I remain your obedient servant, URNST KOUCH ╔════════════════════════════════════════════════════════════════════╗ ║ This V/T info phile brought to you by Çτÿ₧, ║ ║ Makers/Distributors/Info Specialists in Phine Viruses/Trojans. ║ ╠════════════════════════════════════════════════════════════════════╣ ║ Dark Coffin ···················· HQ/Main Support ··· 215.966.3576 ║ ╟────────────────────────────────────────────────────────────────────╢ ║ VIRUS_MAN ······················ Member Support ···· ITS.PRI.VATE ║ ║ Callahan's Crosstime Saloon ···· Southwest HQ ······ 314.939.4113 ║ ║ Nuclear Winter ················· Member Board ······ 215.882.9122 ║ ╚════════════════════════════════════════════════════════════════════╝