474 lines
24 KiB
Plaintext
474 lines
24 KiB
Plaintext
Computer Viruses - A Protagonist's Point Of View
|
||
-----===] CORRUPTED PROGRAMMING INTERNATIONAL [===-----
|
||
|
||
== CPI Newsletter #1 ==
|
||
[ Article Written By Doctor Dissector ]
|
||
Released : June 27, 1989
|
||
|
||
Call The CPI Headquarters
|
||
619-566-7093
|
||
1200/2400 Baud :: Open 24 Hours
|
||
|
||
|
||
|
||
[1.1] Introduction:
|
||
-------------------
|
||
|
||
Welcome to "Computer Viruses - A Protagonist's Point Of View." This
|
||
letter, perhaps the beginning of a small newsletter. Well, this "letter,"
|
||
is written by one person right now, maybe I'll get some people to send in
|
||
more info, ideas, and examples to CPI. If you would like to contribute,
|
||
please upload text files to CPI Headquarters (see heading for number) and
|
||
leave a note to me telling me you are contributing to our magazine.
|
||
|
||
Well, as an overview, this article will cover a few topics dealing
|
||
with viruses; however, there will be no examples covered as we are short of
|
||
programmers at the moment. That reminds me, if you would like to become a
|
||
member of CPI, fill out the accompanying text file and upload it to CPI HQ
|
||
as an upload to the Sysop, then leave me and the Sysop some mail to tell us
|
||
you registered to become a member. We will get back to you as soon as
|
||
possible.
|
||
|
||
The purpose of this magazine is to expand and broaden the general
|
||
computer user's view and knowledge of the dreadful computer Virus, as well
|
||
as a bit on Trojans (not the hardware, the SOFTWARE!). Then, after the
|
||
knowledge of these computer crackers is better understood, the second
|
||
purpose of this newsletter is to teach both methods of developing and
|
||
executing a better virus/trojan. We, VRI, feel viruses and trojans are a
|
||
vital part of the computer world, and should stand along the trades of
|
||
hacking, phreaking, cracking, pirating, and pyro as an equal, not something
|
||
to be looked down upon (unless you are hit by one...).
|
||
|
||
In the future, we hope CPI will grow and spread, just like a virus,
|
||
and encompass a large domain of the crackers, hackers, and other elite out
|
||
there so that the life of this group will be maintained, and that this
|
||
newsletter, hopefully, won't be the only issue to be released during the
|
||
group's existence.
|
||
|
||
Doctor Dissector
|
||
CPICV Editor/ANE Author
|
||
|
||
|
||
Table Of Contents-
|
||
|
||
Phile Subject Author
|
||
----- ---------------------------------------------------------
|
||
1.1 Introduction & Table Of Contents.........Doctor Dissector
|
||
1.2 Viruses- What, Where, Why, How...........Doctor Dissector
|
||
1.3 Aspects Of Some Known Viruses............Doctor Dissector
|
||
1.4 Ideas For Future Viruses.................Doctor Dissector
|
||
1.5 Suggested Reading........................Doctor Dissector
|
||
1.6 Conclusion...............................Doctor Dissector
|
||
1.7 CPI Application..........................Doctor Dissector
|
||
|
||
Downloaded From P-80 International Information Systems 304-744-2253
|
||
----------------------------------------------------------------------
|
||
|
||
[1.2] Viruses- What, Where, Why, How
|
||
|
||
|
||
If you are a beginner in this field, you may be curious to what
|
||
a virus/trojan is. Perhaps you heard about it through some BBS, or
|
||
known someone who had their system crashed by one. Well, this is for
|
||
you.
|
||
|
||
In the Trojan War, way back when, there existed the Trojan
|
||
Horse, right? Well, nowadays, there is a modern version of the Trojan
|
||
Horse existing is software. The modern, computer, Trojan horse is
|
||
really simple, a psychedelic hacker implants destructive code into a
|
||
normal (or fake) file. This modified/fake file, when executed will
|
||
destroy or remove something from the host computer, usually format
|
||
the hard drive, delete all files, or something similar. In order to
|
||
distribute the corrupt phile, the hacker goes and does one or more of
|
||
various things; depending on how deranged this individual is (hehe).
|
||
These things are covered in the following section.
|
||
|
||
A virus, in normal terms is an organism which spreads malign
|
||
from one host to another, transmitting itself through biological
|
||
lines so that both the previous host and the future host become
|
||
infected with the virus. Today, there are computer viruses, and just
|
||
like biological viruses, they spread from file to file, host to host,
|
||
infecting everything it "sees." These computer viruses can either
|
||
destroy the code it infects immediately, or over a period of time,
|
||
corrupt or damage the host system it thrives upon. For example, a
|
||
virus hidden in a file on a BBS could be downloaded to a host system.
|
||
Then, the user who downloaded it executes the file, which executes
|
||
normally (as seen by the operator), but at the same time, the virus
|
||
attacks other files, and infects them, so that each file owned by the
|
||
user becomes infected with the virus. Then, at a given time or when
|
||
something is fulfilled by the host system, the virus becomes a trojan
|
||
and destroys, encrypts, or damages everything available, infected or
|
||
un-infected. In general, a virus is a timed trojan that duplicates
|
||
itself to other files, which, in effect sustains the virus's life-
|
||
span in the computer world, as more host systems are infiltrated by
|
||
the disease.
|
||
|
||
Now that I've given you a description of the computer virus and
|
||
trojan, we can go onto more complex things... well, not really...
|
||
|
||
Ok, now, let's trace the life of a virus. A virus/trojan is born
|
||
in the mind of some hacker/programmer that decides to develop
|
||
something out of the ordinary, not all viruses/trojans are
|
||
destructive, often, some are amusing! Anyway, the hacker programs the
|
||
code in his/her favorite language; viruses can be developed with
|
||
virtually any language, BASIC, Pascal, C, Assembly, Machine Code,
|
||
Batch files, and many more. Then, when the disease is complete and
|
||
tested, the hacker intentionally infects or implants the code into a
|
||
host file, a file that would be executed by another un-suspecting
|
||
user, somewhere out there. Then, the hacker does one or more of many
|
||
things to distribute his baby. The hacker can upload the infected
|
||
file to a local BBS (or many local/LD BBS's), give the infected file
|
||
to a computer enemy, upload the infected file to his/her workplace
|
||
(if desired...hehe), or execute the phile on spot, on the host
|
||
system. Then, the virus, gets downloaded or executed, it infiltrates
|
||
the host system, and either infects other files, or trashes the
|
||
system instantly. Eventually, the infected system's user gets smart
|
||
and either trashes his system manually and starts fresh, or some mega-
|
||
technical user attempts to recover and remove the virus from all of
|
||
the infected files (a horrendous job). Then, the virus dies, or other
|
||
host systems that were previously infected continue, and accidentally
|
||
upload or hand out infected files, spreading the disease. Isn't that
|
||
neat?
|
||
|
||
Now, to answer your questions; I already explained what a
|
||
virus/trojan is and how they are developed/destroyed. Now, where do
|
||
these suckers come from? Why, some hacker's computer room, of course!
|
||
All viruses and trojans begin at some computer where some maniacal
|
||
hacker programs the code and implants it somewhere. Then, you ask,
|
||
why do they do this? Why hack? Why phreak? Why make stupid pyro piles
|
||
of shit? Think about it... This is an ART! Just like the rest. While
|
||
Hacking delivers theft of services, Phreaking delivers theft of
|
||
services, Cracking/Pirating delivers theft of software and copyright
|
||
law breaks, Pyro delivers unlawful arson/explosives, Viruses and
|
||
Trojans vandalize (yes, legally it is vandalism and destruction of
|
||
property) computer systems and files. Also, these are great to get
|
||
back at arch-computer enemies (for you computer nerds out there), and
|
||
just wreak havoc among your computer community. Yeah, PHUN at it's
|
||
best...
|
||
|
||
----------------------------------------------------------------------
|
||
|
||
Downloaded From P-80 International Information Systems 304-744-2253
|
||
----------------------------------------------------------------------
|
||
|
||
[1.3] Aspects Of Some Known Viruses
|
||
|
||
|
||
Many viruses have been written before and probably after you
|
||
read this article. A few names include the Israeli, Lehigh, Pakistani
|
||
Brain, Alameda, dBase, and Screen. Keep in mind that most viruses
|
||
ONLY infect COM and EXE files, and use the Operating System to spread
|
||
their disease. Also, many viruses execute their own code before the
|
||
host file begins execution, so after the virus completes passive
|
||
execution (without "going off") the program will load and execute
|
||
normally.
|
||
|
||
Israeli - This one is a TSR virus that, once executed, stayed in
|
||
memory and infected both COM and EXE files, affecting both HARD and
|
||
FLOPPY disks. Once executed, the virus finds a place to stay in the
|
||
system's memory and upon each execution of a COM or EXE file, copies
|
||
itself onto the host phile. This one is very clever, before infecting
|
||
the file, it preserves the attributes and date/time stamp on the
|
||
file, modifies the files attributes (removes READ only status so it
|
||
can write on it), and then restores all previous values to the file.
|
||
This virus takes very little space, and increases the host file size
|
||
by approximately 1800 bytes. The trigger of this virus is the date
|
||
Friday the 13th. This trigger will cause the virus to either trash
|
||
the disk/s or delete the files as you execute them, depending on the
|
||
version. Whoever wrote this sure did a nice job....
|
||
|
||
Lehigh - This one infects the COMMAND.COM file, which is always
|
||
run before bootup, so the system is ready for attack at EVERY bootup.
|
||
It hides itself via TSR type and when any disk access is made, the
|
||
TSR checks the COMMAND.COM to see if it is infected. Then if it
|
||
isn't, it infects it, and adds a point to its counter. When the
|
||
counter reaches 4, the virus causes the disk to crash. This one,
|
||
however, can be stopped by making your COMMAND.COM Read-Only, and the
|
||
date/time stamp is not preserved, so if the date/time stamp is
|
||
recent, one could be infected with this virus. This virus is
|
||
transferred via infected floppy disks as well as a clean disk in an
|
||
infected system. It can not infect other hosts via modem, unless the
|
||
COMMAND.COM is the file being transferred.
|
||
|
||
Pakistani Brain - This one infects the boot sector of a floppy
|
||
disk. When booting off of the disk, the virus becomes a TSR program,
|
||
and then marks an unused portion of the disk as "bad sectors." The
|
||
bad sectors, cannot be accessed by DOS. However, a disk directory of
|
||
an infected disk will show the volume label to be @ BRAIN. A CHKDSK
|
||
will find a few bad sectors. When you do a directory of a clean disk
|
||
on an infected system, the disk will become infected. The virus has
|
||
no trigger and immediately begins to mark sectors bad even though
|
||
they are good. Eventually, you will have nothing left except a bunch
|
||
of bad sectors and no disk space. The virus itself has the ASCII
|
||
written into it with the words "Welcome the the Dungeon" as well the
|
||
names of the supposed authors of the virus, and address, telephone
|
||
number, and a few other lame messages. To inoculate your system
|
||
against this virus, just type 1234 at byte offset location 4 on the
|
||
boot track (floppy disks).
|
||
|
||
Alameda - This virus also infects the boot sector of the host
|
||
system. It is very small and inhabits ONE sector. This one only
|
||
damages floppy disks. If you boot from a diseased disk, the virus
|
||
loads itself into HIGH memory and during a warm boot, it remains in
|
||
memory and infects any other clean disks being booted from on the
|
||
infected system. It then replaces the boot track with the virus track
|
||
and replaces the boot track on the last track of the disk, so any
|
||
data located on the last track is corrupted. All floppy disks
|
||
inserted during reboot can catch this virus. This virus only infects
|
||
IBM PC's and XT's, however, it does not infect 286's or 386's.
|
||
|
||
dBase - This one is a TSR virus that works in a manner similar
|
||
to the Israeli virus. It looks for files with a DBF extension, then
|
||
it replicates itself in all DBF files, preserving file size, and all
|
||
attributes. After the first 90 days, the virus destroys your file
|
||
allocation table and corrupts all data in the DBF files. This virus
|
||
creates a hidden file, BUG.DAT that indicates the bytes transposed
|
||
(in order to preserve file specifications). Run a CHKDSK to make sure
|
||
you don't have any extra hidden files or a BUG.DAT in your dBase
|
||
directory. If you create a BUG.DAT file manually in your directory,
|
||
making it read-only, you will be safe from this virus.
|
||
|
||
Screen - This one is another TSR virus that comes on and off
|
||
periodically. When it is on, it examines the screen memory and looks
|
||
for any 4 digits starting at a random place on the screen. Then it
|
||
transposes two of them, this is not a good thing. It infects every
|
||
COM file in your directory, HARD and FLOPPY disks can be infected.
|
||
You can use a ASCII searcher to check if you are infected by
|
||
searching for "InFeCt" in your COM files. If you have this written,
|
||
read the 4 bytes immediately preceding it and overwrite the first 4
|
||
bytes of the program with their value. Then, truncate the program at
|
||
their stored address. You will rid yourself of this virus. Make sure
|
||
you use a clean copy of you editor for this.
|
||
|
||
Other viruses include MAC, AMIGA, and many other environments.
|
||
By the way, other computer systems other than IBM/DOS may become part
|
||
of CPI if you qualify.
|
||
|
||
Anyway, these are a few viruses I have read on and thus passed
|
||
the information to you, I hope you can learn from them and get some
|
||
ideas for some.
|
||
|
||
Downloaded From P-80 International Information Systems 304-744-2253
|
||
----------------------------------------------------------------------
|
||
|
||
[1.4] Ideas For Future Viruses
|
||
|
||
|
||
Since I have covered viruses already in existence, lets talk
|
||
about viruses that can or may exist in the near future. These are not
|
||
even close to half the ideas possible for destruction with
|
||
trojans/viruses available, but will pose as a challenge to you who
|
||
are short of ideas.
|
||
|
||
CSR Virus - A CMOS Stay Resident VIRUS that will implant itself
|
||
in the CMOS memory of the AT (286/386/486?) which will execute upon
|
||
every bootup. This one would be VERY nice.
|
||
|
||
Failsafe Virus - Preserves ALL attributes, Preserves file size,
|
||
remains TSR but hidden to TSR location programs, Modifies attributes
|
||
to get around Read-Only files, Infects ALL files (Not only COM and
|
||
EXE), encrypts all data on trigger (irreversible) but preserves
|
||
original file size/attributes.
|
||
|
||
Format Virus - A virus which is TSR and when a DOS format or any
|
||
other FORMAT type of call is called, will FORMAT every other track,
|
||
but will not allow DOS to notice.
|
||
|
||
Write Virus - A virus that intercepts write to disk, which
|
||
deletes the disk write, and marks sector as bad at write point.
|
||
|
||
ASCII Virus - Virus that would scramble ASCII text in any file
|
||
at trigger.
|
||
|
||
Low Level Format Virus - Virus that low level formats (BAD
|
||
format) HD in background with data still intact. I have seen regular
|
||
background LLF programs, and it keeps data in place, but it does it
|
||
correctly... hmmm...?
|
||
|
||
Hide Virus - A Virus that hides files slowly.
|
||
|
||
Crash Virus - Virus that emulates typical system crashes/freezes
|
||
occasionally. Causes BIOS to freeze and write BIOS ERROR messages on
|
||
screen.
|
||
|
||
Modem Virus - One that remains in boot sector and TSR and
|
||
monitors data from serial ports, puts in "artificial" line-noise.
|
||
NICE!
|
||
|
||
These are just a few I thought up... these could be really
|
||
good... Think of some more and call CPI HQ TODAY!
|
||
|
||
Downloaded From P-80 International Information Systems 304-744-2253
|
||
----------------------------------------------------------------------
|
||
|
||
[1.5] Suggested Reading
|
||
|
||
|
||
The following list is a compiled listing of some material I have
|
||
read as well as other sources you MIGHT find information on
|
||
concerning viruses and trojan horses. Happy trashing....
|
||
|
||
|
||
"Know Thy Viral Enemy" by Ross M. Greenberg
|
||
BYTE Magazine
|
||
June 1989, pg 275-280
|
||
|
||
"Viruses: Assembly, Pascal, BASIC & Batch" by Tesla Coil ][
|
||
Phreakers And Hackers Underground Network Newsletter (PHUN)
|
||
Issue #3, Volume 2, Phile #2
|
||
|
||
"Computer Viruses: A High Tech Disease" by Abacus
|
||
2600 Magazine
|
||
Volume 5, Number 2
|
||
|
||
Downloaded From P-80 International Information Systems 304-744-2253
|
||
----------------------------------------------------------------------
|
||
|
||
[1.6] Conclusion
|
||
|
||
|
||
Thus ends the first issue of CPI's "Computer Viruses: A
|
||
Protagonist's Point Of View." We hope you enjoyed it and we hope it
|
||
was informative and complete (at least about the specific issues).
|
||
|
||
We, VRI, hope that you will share your information and comments
|
||
with us at VRI Headquarters, as this newsletter will require both
|
||
information and an expansion of our current member base. If you feel
|
||
you have what it takes to gather, read, or program for VRI, send us
|
||
an application today.
|
||
|
||
Oh yeah, if this happens to be the only issue of VRICV, oh well,
|
||
and many thanx to those who read it at least once, and enjoyed it (or
|
||
laughed at it). Until our (my?) next issue, have phun and don't get
|
||
toooo wild......
|
||
|
||
|
||
|
||
|
||
=====[ CPI Headquarters * 619-566-7093 * 1200/2400bps * 24Hrs ]=====
|
||
|
||
Downloaded From P-80 International Information Systems 304-744-2253
|
||
[1.7] CPI Application
|
||
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||
|
||
>> CORRUPTED PROGRAMMING INTERNANATIONAL<<
|
||
>> MEMBERSHIP APPLICATION <<
|
||
|
||
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||
|
||
NOTE: The following information is of a totally confidential nature. We must
|
||
question you in depth and thouroughly so that our knowledge and idea
|
||
of you will be quite complete. Remember, it is the fate of our voting
|
||
members who will decide upon your membership, as the result of your
|
||
response to this questionairre. Please answer the following completely
|
||
and to the best of your ability.
|
||
|
||
|
||
PERSONAL INFORMATION:
|
||
-----------------------------------------------------------------------------
|
||
Alias(es) You HAVE Used :
|
||
Alias(es) You Currently Use :
|
||
Your REAL FULL NAME :
|
||
Your Voice Phone Number :(###)###-####
|
||
Your Data Phone Number :(###)###-####
|
||
Your City & State :
|
||
Your Age :
|
||
Occupation/Grade :
|
||
Place Of Employment :
|
||
Work Phone Number :
|
||
Your Interests And Hobbies :
|
||
|
||
Is Your Job IN ANY WAY Related To ANY Governmental/Law Enforcement Agency?
|
||
If So, In What Way? (Such as FBI, Sheriff, Police)
|
||
:
|
||
:
|
||
|
||
|
||
COMPUTER INFORMATION/EXPERIENCE
|
||
-----------------------------------------------------------------------------
|
||
Computer Experience (time) :
|
||
Modeming Experience (time) :
|
||
BBS's You Frequent (Name/#) :
|
||
Elite References :
|
||
Computers You Have Used :
|
||
Computer You Are Using :
|
||
Computer You Prefer :
|
||
Languages You Have Tried :
|
||
Languages You Know Well :
|
||
Your Best Language :
|
||
Have You Ever Phreaked :
|
||
Do You Phreak Alot :
|
||
Have You Ever Hacked :
|
||
Do You Hack Alot :
|
||
Have You Ever Cracked :
|
||
Do You Crack Alot :
|
||
Ever Made A Virus/Trojan :
|
||
Major Accomplishments :
|
||
|
||
|
||
MISC INFORMATION
|
||
-----------------------------------------------------------------------------
|
||
Answer In 4 Lines Or Less:
|
||
|
||
|
||
What do you think Corrupted Programming International is?
|
||
:
|
||
:
|
||
:
|
||
:
|
||
|
||
When did you first hear about CPI?
|
||
:
|
||
:
|
||
:
|
||
:
|
||
|
||
Why do you want to be a member of CPI?
|
||
:
|
||
:
|
||
:
|
||
:
|
||
|
||
Do you know any of the members of CPI? Can you name a few?
|
||
:
|
||
:
|
||
:
|
||
:
|
||
|
||
Have you considered the distribuition of viruses/trojans as a "crime"? Why
|
||
or why not? (Morally speaking?)
|
||
:
|
||
:
|
||
:
|
||
:
|
||
|
||
Have you written any text files? (On any underground type of subject?)
|
||
:
|
||
:
|
||
:
|
||
:
|
||
|
||
Are you a member of any other group(s)? Can you name them and their HQ BBS?
|
||
:
|
||
:
|
||
:
|
||
:
|
||
|
||
Can you contribute to CPI? How?
|
||
:(Do you have access to info concerning virus/trojans)
|
||
:(Exceptional programmer?)
|
||
:(Got connections?)
|
||
:(Anything extraordinary?)
|
||
|
||
|
||
-----------------------------------------------------------------------------
|
||
.Answer Each Question To The Best And Fullest Of Your Ability.
|
||
-----------------------------------------------------------------------------
|
||
|
||
Upload ALL Applications To The CPI Headquarters BBS
|
||
*(619) 566-7093 * 1200/2400 * 24 Hrs*
|
||
|
||
Future CPI Support BBS's Will Be Active - Applications May Be Turned In Then
|
||
|
||
Downloaded From P-80 International Information Systems 304-744-2253
|