*** CHAOS-AD by Sepultura ***
*** South Australia - '95 ***

Polymorphic, Full(ish) Stealth, Retro, Anti-Heuristic, Tunneling, COM+EXE.

*** IMPORTANT ***

This is the OFFICIAL version... due to a bit of a mistake, I sent a few ppl
on #virus the wrong version which has a TINY (one line) bug :P

FEATURES:

Personal Stuff: - My First Polymorphic Virus.
- My First Full Stealth Virus.
- My First EXE infector.

Retro Stuff:    - Deletes CHKLIST.CPS, CHKLIST.MS, ANTI-VIR.DAT files.
- Avoids infecting AV programs.
- Disables VSAFE.
- Avoids VSAFE, and older versions of TBMEM, from reporting
changes to System Memory / Environment.

Anti-Heuristics:- Uses some fairly heav Anti-Heuristic structures throughout.
- TCE generates HUGE, spaced out Decryptors, avoiding # flag.
- TBSCAN 6.50 finds 0 flags on DECRYPTED virus.
- F-PROT( /paranoid) 2.19 finds nothing on DECRYPTED virus.
- AVP 2.2 finds nothing on DECRYPTED virus.
- About 10% of decryptors are flagged by TBSAN HR
(high heuristics).
- No Decryptors (as far as i know) flagged by AVP, F-Prot.

Tunneling:      - Uses a /<-R4D NEW (I think) method to find the original
INT 21 vector.. see the subroutine find_21 for more info..

Polymorphy:     - Polymorphy is provided by TCE-0.4 (The Chaos Engine).

It can generate decryptors of the form:
ADD/SUB/ADC/SBB/XOR [BP/SI/DI/BX(+xx(xx))],reg16

It can move a value to a register as such:
MOV reg,VAL
or LEA reg,[VAL]
or XOR/SUB reg,reg + OR/XOR/ADD reg,VAL
or XOR/SUB reg,reg + SUB reg, negative VAL

It can test for a zero value, using:
OR/AND/TEST reg,reg

It can generate the following looping methods:
JNZ loopstart
or CLC + JA loopstart
or LOOP loopstart
or LOOPNZ loopstart

It can modify the KEY register, using:
ADD/SUB/XOR reg,xxxx

- Although TCE is a stand alone engine, I do not really
expect other people to use it in their virii, mainly
because it sux, and there are many better engines around.

Stealth:        - This is probably the shittiest part of the virus!
- I could not get FULL (disinfect on the fly) type stealth
working with the variable length poly, and size padding,
so for now I am using Disinfect on Open, Infect on Close
type stealth.
- It also Disinfects files loaded by debuggers.
- If an archiver is running, it Infects instead of Disinfect.

Other Stuff:    - Marks files by padding the size up, so that the Least
Significant Byte, of the Size field, is ADh (chaos-AD).
This is reliable, and doesn't cause anything suspicious
looking..
- Has a Cool Activation Routine (see the sub-routine
setup_activator for more info).

Things That Delayed This Viruses Progress:
- Drugs.
- School.
- Stupidity.
- I couldn't stop playing that 'Dont Touch The Sides' game
in VLAD-#3 (and i still cant :P).