hexfiles issue 2

Published in

· 2 years ago

 ⁄-------------------------------------------------------------¬--------------ø 
 | €€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€ |   Issue No.  | 
 | €  €€  €      €  €€€  €€€€€€      €  €  €€€€€      €      € |              | 
 | €  €€  €  €€€€€€  €  €€€€€€€  €€€€€  €  €€€€€  €€€€€  €€‹‹€ |     ﬂﬂﬂ€     | 
 | €      €     €€€€   €€     €     €€  €  €€€€€     €€      € |        €     | 
 | €  €€  €  €€€€€€  €  €€€€€€€  €€€€€  €  €€€€€  €€€€€ﬂﬂ€€  € |     €ﬂﬂﬂ     | 
 | €  €€  €      €  €€€  €€€€€€  €€€€€  €      €      €      € |     €        | 
 | €€€€€€€€€€€€€€€€€ﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂﬂ€€€€€€€€€€€€€€€€€€ |     €‹‹‹     | 
 | €€€€€€€€€€€€€€€€€ Philippines Virus Zine €€€€€€€€€€€€€€€€€€ |              | 
 | €€€€€€€€€€€€€€€€€‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹‹€€€€€€€€€€€€€€€€€€ |  March 1998  | 
 ¿-------------------------------------------------------------¡--------------Ÿ

Mabuhay!

Before I bore you to sleep with what I have for you in this issue, I have to do something important first...

My heartfelt thanx to the following for carrying HEX-FILES in their web sites.

Cicatrix http://www.cyberstation.net/~cicatrix/
Guillermito http://www.pipo.com/guillermito/darkweb/virus.html
Mikee's World http://www.pworld.net.ph/user/mikee/

Thanx too to those who let me know what they thought about HEX-FILES and what it is all about.

You can get in touch with me at

phvx@hotmail.com

...and now back to regular programming.

In HEX_FILES No. 1, I said that we are going to have some old and new phvx and that the focus would be on virii from Adamson University. For HEX_FILES No. 2, that is exactly what we are going to have.

* Quaint.A *
The virus that is going the rounds of Metropolitan Manila at present. It is not detected by major AVs.

* Possessed *
The first virus to come out of Adamson University. We are going to have six of the eleven or so reported variants. This includes a variant that is not, or not definitely, identified by avp and f-prot.

* Oggo.3813 *
Another virus from Adamson University. A buggy and encrypted virus. It is easily detected by AVs but they seem to be confused by the length of the virus.

* Matthew.3044 *
A virus possibly originating from Adamson University. The original message and the one with the corrupted message are included in this issue.

* Preacher 1.1 and Preacher 1.2 *
A virus from Mikee. Preacher infects COM programs through Int 9. The virus is still in its development stage.

* Philippines *
A series of my virus characterized by multi-level encryption. These were not released in the wild although several copies went to virus collections of friends. Those given out are not necessarily those included here nor the one that appeared last issue. To tell you the truth, I don't exactly know what were those as there are lots of variants.

** Philippines 1 *
This is the first virus I've ever written. I was still studying assembly when I wrote this -- I learn and I write virii at the same time. I used Possessed as a model although I did not clone Possessed. As I wrote and tested this on an 8086, the virus would crash on 286 and newer CPUs.

** Philippines 1A and Philippines 1B *
This is Phlippines 1 fixed to run on new Intel CPUs so that you might be able to have fun with my virus.

** Philippines 3 *
This is the last group of the family -- the multipartite group. This virii has special affections for AVs.

HEX-FILES does not carry live virii. However, program listings and scripts found in HEX-FILES create first generations of virii, infected programs, virii droppers or other virii related programs when compiled. This is intentionally done so that we could avoid someone from executing these programs without exactly knowing what they are doing. Believe me, there are people stupid enough to do this.

If you create an executable program out of those listed in HEX-FILES means that you are fully aware of the nature of these programs and the consequences of using these programs. You also agree that HEX-FILES and/or everybody connected with HEX-FILES in any way are not responsible for any damage that may result from the use or misuse of these programs.

You, being the person who created the executable program and/or executed the program, bears full responsibility for your actions.

Furthermore, you fully agree that these programs would only be used for research and/or educational purposes only. In no way should these programs be used to inflict harm or damage on another person and/or his property.

Content

HEXFILE2.000 ..... This is the page you have your eyes on!
HEXFILE2.001 ..... PhVx Register
HEXFILE2.002 ..... Preacher 1.1
HEXFILE2.003 ..... On Possessed! and Vindicate 1.01 (AV)
HEXFILE2.004 ..... Possessed.2167.B
HEXFILE2.005 ..... Possessed.2367
HEXFILE2.006 ..... Possessed.2438
HEXFILE2.007 ..... Possessed.2443
HEXFILE2.008 ..... Possessed.2446.A
HEXFILE2.009 ..... Possessed.2446.B
HEXFILE2.010 ..... Oggo.3813
HEXFILE2.011 ..... Matthew.3044
HEXFILE2.012 ..... Disassembly of Quaint.A
HEXFILE2.013 ..... Quaint.A Dropper
HEXFILE2.014 ..... Philippines 1
HEXFILE2.015 ..... Philippines 1A and Philippines 1B
HEXFILE2.016 ..... Philippines 3: Kakabakaba
HEXFILE2.017 ..... Invitation to all Filipino virus lovers
HEXFILE2.018 ..... Compiling instructions

This being the centennial of Philippine independence, we will have flag wavers and stuffs like that, for the next issue.

  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 

                     Ika-Isang Daang Taon ng Kalayaan 

                      1898 . Ika-12 ng Hunyo . 1998 

                          Republika ng Pilipinas 

 
                                *   *   * 

 
                       Republic of the Philippines 

                        1898 . 12th of June . 1998 

                      Hundredth Year of Independence 

  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=