Virus Brasil nº6:(VIRBR06.888):01/04/2000 << Back To Virus Brasil nº 6
──────────────────────────────────────────────────────────────────────────── __ __ | | |__| |__) | / |__| que | | a' | or |/ ir ? ──────────────────────────────────────────────────────────────────────────── ───────────────────────────── 88888 - O que ha' por vir ? ───────────────────────────── Em nossas futuras edicoes teremos uma grande chance de trabalhar- mos com virus baseados puramente em W95 / 98, para tal, devo salientar que e' necessario que voce aprimore seus conhecimentos em Assembly de verdade, se voce manjava meia boca, ta na hora de ler bastante e virar fera no assunto ... O que ler ? Boa pergunta ! Procure tutoriais de asm para w32 e voce vai ver que nao muda muita coisa assim, uma das mudancas prin- cipais que ira notar e' que dificilmente utilizaremos as chamadas de INT's, como a int 21h (DOS) por exemplo, elas continuarao a funcionar, mais agora utilizaremoa um novo recurso ... o API ou Applications Program Interface que e' o recurso utilizado pelo windows para ter seu ambiente "multitarefa" ... E' meio phoda explicar o que e' o API em palavras, intaum vai um programa de exemplo pra windows95/98 e no caso, ate' um NT acho que rola ! Rola o seguinte, chamamos DLL's e essas conte'm as funcoes que desejamos utilizar, ou alguma coisa assim, to aprendendo tambe'm ... O exemplo e' bem simples e e' dado em qualquer curso de progra- macao em qualquer linguagem que e' o de escrever uma frase na tela ! Veja o exemplo abaixo : ;;;;;;;;;;;;;;;;;;;;;;;; Modelo.asm ;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Ah, nosso compilador tambe'm mudou, agora estamos utilizando o ; TASM 5.0 da Borland ; ; Compile: ; tasm32 /ml modelo ; Linke: ; tlink32 -x /Tpe /c a,a,,import32.lib ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; .386p .model flat, stdcall ; Chamada das funcoes que iremos utilizar extrn MessageBoxA : PROC ; Escrever uma Mensagem extrn ExitProcess : PROC ; Terminar o Programa ; Parametros de saida, nossa mensagem ! .DATA Titulo db 'Virus Brasil nº6',0 Msg db 'Os brasileiros mandando bronca !!!',0Dh,0Ah,,0 ; Inicio do Codigo .CODE Inicio: push 0 ; Estilo da mensagem push offset Titulo ; Titulo do Arqvuivo push offset Msg ; Conteudo da Mensagem push 0 ; call MessageBoxA ; Chama a funcao / Escreve na janela push 0 ; Deixar um botao de ok para fechar a janela ! call ExitProcess ; Fechar o Programa End Inicio ; Fim ;;;;;;;;;;;;;;;;;;;;;;;; Modelo.asm ;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Essa fita ai do import32.lib e' onde se encontram as funcoes e as respectivas DLL's que ele deve puxar, no nosso caso, utilizamos a funcao de mensagem e de saida que estao em duas DLL's, a USER32.dll e a KERNEL32.dll . ──────────────────────────────────────────────────────────────────────────── ___ ___ ___ __ ___ | | | | |__ |\ | | | | | \ |__ |__| |__| |___ | \| |___ |___| |__/ |___ ──────────────────────────────────────────────────────────────────────────── Segue o programa uuencodado se voce nao tiver o TASM32 , vai pegar seu preguic,oso, nao tem na nossa pagina pois e' pirataria e es- tou fora (fui pegar um matlab no pirata e ja' volto), vai para : http://www.coderz.net/vtc O site que hospedava a pagina sofreu um ataque de DoS de algum lammer por ai e foi mudada para pagina acima, todo os sites contidos no virusexchange foram deixados de lado e dificilmente o virusexchange voltara a funcionar ... Parabens a quem fez o programa de ataque por Denay, mas tinha que distribuir ???? Lammer e' phoda, isso e' termo de BBS's e como dizia o MOURA "internet e' bom, mas nao e' como um bbs. " Bom e' isso ai ... ;;;;;;;;;;;;;;;;;;;; Model_32.uue ;;;;;;;;;;;;;;;;;;;;;;;;;;; begin 600 model_32.exe M35I0``(````$``\`__\``+@`````````0``:```````````````````````` M``````````````````````$``+H0``X?M`G-(;@!3,TAD)!%<W-E('!R;V=R M86UA('-O(')O9&$@<V]B<F4@5VEN,S(@+B`-"B0W```````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M`````````````````````````````````````````%!%``!,`00`92@,LP`` M````````X`".@0L!`AD``@````8`````````$````!`````@`````$```!`` M```"```!``````````,`"@```````%`````$`````````P``````$```(``` M```0```0````````$````````````````#```)`````````````````````` M````````````````0```%``````````````````````````````````````` M```````````````````````````````````````````````````````````` M````````````0T]$10``````$````!`````"````!@`````````````````` M(```8$1!5$$``````!`````@`````@````@``````````````````$```,`N M:61A=&$````0````,`````(````*``````````````````!```#`+G)E;&]C M````$````$`````"````#```````````````````0```4``````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M````````:@!H`"!``&@1($``:@#H!P```&H`Z`8```#_)4PP0`#_)50P0``` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M``````````````````````````````!6[7)U<R!"<F%S:6P@;KHV`$]S(&)R M87-I;&5I<F]S(&UA;F1A;F1O(&)R;VYC82`A(2$-"@`````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M`````````````````````````````````````````````````````#PP```` M`````````%PP``!,,```1#``````````````9S```%0P```````````````` M`````````````'0P````````@C````````!T,````````((P````````55-% M4C,R+F1L;`!+15).14PS,BYD;&P```!-97-S86=E0F]X00```$5X:710<F]C M97-S```````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M`````````````````!```!0````#,`@P'#`B,``````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` !`%I0 ` end ;;;;;;;;;;;;;;;;;;;; Model_32.uue ;;;;;;;;;;;;;;;;;;;;;;;;;;; Temos muitos exemplos de virus em W95 / 98 e ainda nao estou man- jando nada da crianca, provavelmente muitos virii makers brasileiros se encontram na mesma situacao que eu (quer dizer nos), vou tentar ler muito sobre o assunto e tentar fazer um virus, seja o mais simples que for , exclusivamente para W95 / 98 e ve se voce faz o mesmo e tenta aprender tambem ! Em relacao a virus de HLL , vamos continuar com os virus do Vecna que nos auxiliou muito nessa parte, e se voce tem ai algum virus em Pascal, mande pra gente, afinal voce nao leu o tutorial do LeBeau à toa e quando tiver um tempo vou dar umas arranhadas tambe'm ! Creio que deve rolar tambe'm alguma coisa em C++ , mas isso e' um futuro, mais do que distante ... Oh, imagina um goma.cpp (massa !!) Deve rolar uns vφrus de macro na fita tambe'm, so que tenho que instalar o Word e Ler um texto de umas 4 paginas que ja vou fazer um ! Creio que fazer um Macro nao deve ser muito dificil, ja li alguns tex- tos sobre mas nunca sentei pra fazer um, to precisando tambe'm... Fora isso tudo que disse acima, deve rolar mais algum virus de DOS (meu, nem creio que vou brincar mais em DOS, mas se pans e tiver uma ideia mirabolante ou tempo, eu faco, e' bom nao perder o costume.) E voce deve ter percebido que a participacπo da galera vem aumen- tando e e' isso que me impulsiona pra continuar escrevendo ja que tem- po nunca foi o meu forte, mas enquanto tiver um neguinho pra ler o que eu estou escrevendo,estarei grato e verei que meu trabalho nao se pas- sou em vao, ou seja, consegui passar alguma informacao... Bom, acho que e' isso ai ! T + ──────────────────────────────────────────────────────────────────────────── Copyright ╕ 2000, Virus Brasil ⌐ ────────────────────────────────────────────────────────────────────────────