Õ-------------------------------¸ | W E L C O M E | | To the VGA Trainer Program | | | By | | | DENTHOR of ASPHYXIA | | | Ô-------------------------------¾ | | --------------------------------Ù | --------------------------------Ù --==[ PART 20 ]==-- Introduction Hi all! It has been a _long_ time since my last trainer (as I am sure many of you have noticed) A lot has happened between now and the last trainer... but for once I won't bore you with the details ;) I do have a full time job though, coding C++ applications. I have taken over the production of the PCGPE from Mark Feldman. He is mailing all the articles written so far, and as...

Õ-------------------------------¸ | W E L C O M E | | To the VGA Trainer Program | | | By | | | DENTHOR of ASPHYXIA | | | Ô-------------------------------¾ | | --------------------------------Ù | --------------------------------Ù --==[ PART 19 ]==-- Introduction Hi there. As promised in Tut 18, this trainer is on assembler. For those people who already know assembler quite well, this tut is also on the flame effect. Okay, here is the total list of ways to get my trainers : http://goth.vironix.co.za/~denthor (WWW) ftp.eng.ufl.edu pub/msdos/demos/code/graph/tutor (FTP) denthor@beastie.cs.und.ac.za Subject : ...

Õ-------------------------------¸ | W E L C O M E | | To the VGA Trainer Program | | | By | | | DENTHOR of ASPHYXIA | | | Ô-------------------------------¾ | | --------------------------------Ù | --------------------------------Ù --==[ PART 18 ]==-- Introduction Welcome back! I know, I know, you all all shocked that this tut is out so soon after the last one, but the reason for this is that I want to have Tut 20 out by the time PCGPE ][ is released. I probably won't get that far, but I'll try! ;) This tut is on file packing, and putting everything into one executeable file. For tut 19, I am thinking of doing a bit more on explain...

Õ-------------------------------¸ | W E L C O M E | | To the VGA Trainer Program | | | By | | | DENTHOR of ASPHYXIA | | | Ô-------------------------------¾ | | --------------------------------Ù | --------------------------------Ù --==[ PART 17 ]==-- Introduction Hi there everybody. It's a new year, but the parties are over and it's time to get coding again! My mailserver died. Various sysadmins decided it was time to upgrade the OS, and wound up nuking the hard drive :-( ... this means that request-list is not working at the moment, and I have probably lost lots of mail. denthor@beastie.cs.und.ac.za is still the account to write ...

HEX-FILES No. 3 File 021 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ HOW TO COMPILE LISTINGS IN HEX-FILES *********************************************************************** * * * HEX-FILES does not carry live virus. However, program listings and * * scripts found in HEX-FILES create first generation viruses, * * infected programs, virus droppers or other virus related programs * * when compiled. This was intentionally done to prevent someone from * * executing these programs without exactly knowing what the programs * * really are. Believe me, there are people stupid enough to do this. * * * * If you...

HEX-FILES No. 4 File 020 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ My profuse apology to all readers who could not read nor understand Pilipino. This open letter is meant for Filipinos, wherever they may be in this world we live in. Isang Paanyaya Mga kapatid, Ang lathalaing ito ay hindi lamang para sa aking sariling gamit kundi pati na rin sa inyo. Ito ay bukas sa inyong lahat at malugod ko kayong inaanyayahang makilahok sa proyektong ito. Kung mayroon kayong likhang bayrus at nais ninyo itong mailathala, ipadala ninyo sa akin ang mga sumusunod: 1. Ang orihinal na programa ng inyong bayrus; 2. Ang unan...

HEX-FILES No. 4 File 019 ---------------------------------------------------------------------------- Date: November 27, 1998 phVX Register This phVX listing is divided into four parts: Part I covers phVX found in the wild a copy of which is in HEX-FILES collection. This is further subdivided into sections. Viruses in Sections A and B are confirmed phVX and the rest are probable phVX. Part II covers phVX published in HEX-FILES. Part III covers viruses found in Filipino virus authors' web sites. Part IV covers viruses mentioned in AVs virus lists and documentations as originating from the Philippines or from indications the virus is from ...

HEX-FILES No. 4 File 018 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ ERRATA: Cara.Standard.1024.A ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Corrections to the source code of Cara.Standard.1024 as it appeared in HEX-FILES No. 1. I would like to state here that the differences were unintentional and typographical in nature. Newer releases of F-Prot identifies a virus as CARA.1025.B. This virus happens to be the one that appeared as debug script in HEX-FILES No. 1. In addition, when the Cara.Standard.1024 source code listed in HEX-FILES No. 1 is compiled, it would be identified by F-Prot as CARA.1025.unknown? There are t...

HEX-FILES No. 4 File 017 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ ERRATA: June12 ~~~~~~~~~~~~~~ Corrections to the source codes of June12.Standard.2660, June12.Standard.2695 and June12.AntiSPCPD.2660 as they appeared in HEX-FILES No. 3. I would like to state here that there were no attempt to create new variants of these viruses. Newer releases of AVs identify the virus created when the source codes of the three June12 variants in HEX-FILES No.3 are compiled as "June12.26xx.unknown" in the case of F-Prot and "This virus is like June12th" or "This virus is like XMarks" in the case of Dr. Solomon. Althou...

HEX-FILES No. 4 File 016 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ Virus Related Mailing Lists from Philippines Do you want to hear on what's the latest on viruses in the Philippines? Then you'll have to subscribe to mailing lists, especially those that are focused on viruses. There are now three such mailing lists. One is pro-VX and the rest are pro-AV. All mailing lists accepts posts by e-mail. 1. Pinoy Virus Writers Mailing List/Discussion Group This mailing list is maintained by Zoom23, the bosing of Pinoy Virus Writers. Posting mainly consists of news about the Pinoy Virus Writers and the going...

HEX-FILES No. 4 File 015 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ Mykah A Word Macro Virus by Lorz lorz@hackerz.zzn.com http://members.tripod.com/~Lorz/ Mykah has the following characteristics: It is stealth. The stealth technique used was derived from information I got from the NoMercyVirusTeam. It deletes Macro from the Tools menu preventing early detection of the virus. However, you could access Macro through ALT-F11. It has retro routine. It deletes data files of AVs on a certain folder. The files deleted are viruscan.dat, fpwm32.dll, scan.dat and tbscan.sig. However, if it could no...

HEX-FILES No. 4 File 014 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ Mary A Word Macro Virus by Lorz lorz@hackerz.zzn.com http://members.tripod.com/~Lorz/ Here's something about Mary: It is polymorphic. It uses random names for its macro names to hide its identity. This would give AV's a thrill of their lives. On January 21st, it disables the cancel button, handy when you closing a document, and displays a message box with: Mary was proudly made by Lorz It is polymorphic. This will give AV's a thrill of their lives. If someone tries to look at the macros, it displays a message box with: Me...

HEX-FILES No. 4 File 013 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ Margaret A Word Macro Virus by Lorz lorz@hackerz.zzn.com http://members.tripod.com/~Lorz/ Get to know Margaret: It is multi-language. It could infect documents created by the Spanish versions of MS-Word 8, in addition to the English version. Documents are saved saved with the DOC extension and not DOT. This minimizes the possibility of early detection. It has a nice payload. There are actually two payloads. First, it changes the cursor at random. And, it encrypts the file on a certain date. ÄÄ MARGARET.UUE STARTS HERE ÄÄÄ...

HEX-FILES No. 4 File 012 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ Name : Wpc_Bats.Lipa.3207 Author : A.R.Jr. Origin : Lipa City, Philippines Resides on top of memory which is allocated through DOS. The memory allocated is 4080 bytes. Recognizes memory by using the dword value at 0000:01FC. If the first 20 bytes pointed to by dword pointer is the same as that of the first 20 bytes of the virus' Int 21h handler means that the virus is resident. Hooks Int 16h (Function 00h), Int 1Ch and Int 21h (Functions 11h, 12h, 3Ch, 3Dh, 3Eh, 3Fh, 4202h, 43h, 4B00h, 4B01h, 4B03h, 4Eh and 6Ch). Uses tunneling technique...

HEX-FILES No. 4 File 011 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ Name : Wpc_Bats.Lipa.2793 Author : A.R.Jr Origin : Lipa City, Philippines Resides at the top of memory which is allocated through DOS. The memory allocated is 3664 bytes. Recognizes memory by using the dword value at 0000:01FC. If the first 20 bytes pointed to by dword pointer is the same as that of the first 20 bytes of the virus' Int 21h handler means that the virus is resident. Hooks Int 1Ch and Int 21h (Functions 11h, 12h, 3Ch, 3Dh, 3Eh, 3Fh, 4202h, 43h, 4B00h, 4B01h, 4B03h, 4Eh and 6Ch). Uses tunneling technique for Int 21h and uses...

HEX-FILES No. 4 File 010 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ Name : Wpc_Bats.Ala-Eh.3161 Author : A.R.Jr Origin : Lipa City, Philippines Resides on top of memory which is allocated through DOS. The memory allocated is 4032 bytes. Recognizes memory by using the dword value at 0000:01FC. If the first 20 bytes pointed to by dword pointer is the same as that of the first 20 bytes of the virus' Int 21h handler means that the virus is resident. Hooks Int 16h (Function 00h), Int 1Ch and Int 21h (Functions 3Ch, 3Dh, 3Eh, 3Fh, 4202h, 4B00h, 4B01h, 4B03h, 4Eh and 6Ch). Uses tunneling technique for Int 21h a...

HEX-FILES No. 4 File 009 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ Name : Wpc_Bats.Ala-Eh.3072 Author : A.R.Jr Origin : Lipa City, Philippines Resides on top of memory which is allocated through DOS. The memory allocated is 3952 bytes. Hooks Int 16h (Function 00h), Int 1Ch and Int 21h (Functions 3Ch, 3Dh, 3Eh, 3Fh, 4202h, 4B00h, 4B01h, 4B03h and 6Ch). Uses tunneling technique for Int 21h and uses DOS to hook the other two interrupts. Recognizes memory by checking the last Int 21h handler it could find for the first 20 bytes its Int 21h handler. Checks also for the presence of the Int 21h handler of Sayh...

HEX-FILES No. 4 File 008 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ Name : Wpc_Bats.Ala-Eh.2279 Author : A.R.Jr Origin : Lipa City, Philippines Resides in memory through DOS TSR function (Int 21h Function 31h). The only known Wpc_Bats variant to do so. The memory allocated is 3216 bytes. Recognizes memory by checking the word value at 0000:0190. Virus places a marker 'AR' here to signify that it is resident. Hooks Int 16h (Function 00h), Int 1Ch and Int 21h (Functions 3Ch, 3Dh, 3Eh, 4B00h, 4B01h and 6Ch). Uses tunneling technique for Int 21h and uses DOS to hook the other two interrupts. Infects com and ...

HEX-FILES No. 4 File 007 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ Wpc_Bats Family And Its Screen Payload Ala-eh is an expression, with no specific meaning, used only in the province of Batangas and by those who grew up in that province. Based on this and texts found in the virus, we could safely assume that the author of this virus is a Batangue¤o, likely from Lipa City. The author is known by his initals, A.R.Jr. From one of the virus' screen payloads, the A in A.R.Jr stands for Alf which could be a shortened Alfredo or Alfred. A.R.Jr professed his love to a girl with the initials S.V.H. which he fond...

HEX-FILES No. 4 File 006 ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ Danao.2869 a disassembly by YeZ yez@rocketmail.com Name : Danao.2869 Author : XED Origin : Cebu, Philippines For a description of the virus, we are giving way to the virus encyclopedia (http://members.xoom.com/phil_av/encyc.htm#Danao) of the Philippine AV Web Site: It installs on top of memory decreasing memory by 5120 bytes. It redirects Int 21h. To determine memory residency, it clears the BX register and loads the AX register with 44FFh on an Int 21h call. The memory resident virus returns the value of the flags regist...