82 lines
4.6 KiB
Plaintext
82 lines
4.6 KiB
Plaintext
*******************************************************************************
|
||
* *
|
||
* / Megadeth's Guide to Virus Researching \ *
|
||
* < Part I > *
|
||
* \ A .ROTing [DeTH] Text File / *
|
||
* *
|
||
********************************************************************************
|
||
|
||
|
||
By: Megadeth
|
||
|
||
I. What you need for virus Research
|
||
^^ ^^^^ ^^^ ^^^^ ^^^ ^^^^^ ^^^^^^^^
|
||
To do any research or testing on viruses it is wise to have the following:
|
||
|
||
þ The Latest Version of VSUM
|
||
þ The Latest Version of F-Prot
|
||
þ Turbo Assembler (MASM will do though)
|
||
þ Central Point Backup
|
||
þ 40Hex Magazine, NukE Infojournals, And other virus publications
|
||
þ Dark Angel's Phunky Virus Writing Guide (for virus writting)
|
||
þ ASSIGN.EXE for MS-DOS 5.0 or SUBST.EXE for DR-DOS 6.0
|
||
þ MIRROR.EXE - for use with trojans.
|
||
þ Norton Utilities
|
||
þ A Virus or Trojan
|
||
þ X-Tree Pro Gold, or other DOS Shell that lets you see and edit Hex
|
||
Code.
|
||
|
||
|
||
Virus Research is vary risky. You can learn alot about programing and
|
||
the behavior of viruses, but you can also trash your system if your not careful.
|
||
here is how to research a virus.
|
||
|
||
][. Researching a Virus
|
||
^^^ ^^^^^^^^^^^ ^ ^^^^^
|
||
The First thing you do with a file thatt you belive is infected with
|
||
a virus is you scan the program with F-Prot. It's good for picking out the
|
||
individual strains of viruses. Use the Secure Scan and then the Heretic Scan
|
||
if the virus is not ideentified. Then after you have the name of the virus
|
||
you can look it up in VSUM. If it's not scaned as a virus then look at the
|
||
virus Hex code with a Hex Viewer. Look for strings in the end of the infected
|
||
file. The are sometimes messages, text with the name and author of the virus,
|
||
a string like *.COM and/or *.EXE. The *.COM and *.EXE are the files it infects.
|
||
If you see *.COM and not *.EXE in the file then you know the file only infects
|
||
.COM files. If you got the virus from a virus board, then there are sometimes
|
||
text files written by the author on what the virus does. If you don't see any
|
||
strings in the virus then there is a good chance that the virus is encrypted.
|
||
You can also see when the virus does when actived. Run ASSIGN.EXE to make
|
||
all calls to your hard drives goto a virus test floppy. make sure you have
|
||
the virus and some *.COM and *.EXE files for the virus to infect. Then run the
|
||
program with the virus. If the virus infects files only when an infected file
|
||
is run, then you know that the virus is not residednt iin memory. If the virus
|
||
infects files everytime an unifected program is run then you know that the virus
|
||
is active in memory. Look for file size changes and changes in the file times.
|
||
If you ever see the Hard Drive Light go on turn off the computer right away.
|
||
don't use CTR-ALT-DEL as it might have been disactivated. After you think other
|
||
files on the disk are infected take out the virus test disk, then turn the
|
||
computer off. This is important since some viruses may llive through a CTR-ALT-
|
||
DEL. Then when your system is booted from the clean hard drive scan the files
|
||
again, and take a look at he hex code and compare them to the origonal
|
||
uninfected files. Format the disk when done.
|
||
That is a quick explination of how to research a virus. There are more
|
||
ways then this and they will be covered in future text files. Another tip
|
||
is to Regularly back up your system and keep multiple backups in case
|
||
a set of backups is infected.
|
||
|
||
IV. In Future Files
|
||
^^^ ^^ ^^^^^^ ^^^^^
|
||
These are topics that will be covered in future text files:
|
||
|
||
þ Researching Trojans.
|
||
þ Researching Boot Sector Viruses.
|
||
þ Recovery from a virus break out.
|
||
þ Tips on how to keep systems from getting infected.
|
||
þ Understanding the behavior of viruses.
|
||
þ Researching Virus Creators like VCL, PS-MPC, and Gý.
|
||
|
||
I can be contacted on many boards in the 708 area code, including the
|
||
Hell Pit. Any suggestions would be vary helpful. Greets to PHALCON/SKISM,
|
||
[NukE], Dark Angel of PHALCON/SKISM and The Nowhere Man of [NukE], and the
|
||
Dark Avenger, who are, in my opinion, the most talented virus writer's around.
|
||
|