[ JavaScript Generator History ] * version 1.16 - 25.02.2004 Improved the standart code of the JSG-virus, which is included everytime because KAV (Alex) added a simple routine, which was very lame :). Now the first three lines are also encrypted. I also checked the whole program and found some bugs: 6 in IRC spreading (in every IRC part one bug) 1 in BAT dropping 1 in CMD dropping Now every code should work, since I tested all parts of them at least twice. * version 1.15 - 18.02.2004 Added dIRC spreading and encrypted it. Added xIRCon - Hard Way spreading and encrypted it. Added xIRCon - The (more) silence Way spreading and encrypted it. Added a function that encryptes the code after generation, it changes every 1/3 numbers. You can run it 1-50 times. Made the standart encryption much better. Now one sign can be 1 / 6 things: - Normal sign - Normal sign in a variable - Hex Code [unescape("%*")] - Hex Code in a variable - Character Code (String.fromCharCode) - Character Code in a variable I lost the code of the Version 1.14, so I had to use the source of 1.13! But I think, the improvements in this version are much better than the imporvements in version 1.14, and therefor I didn't added the things from 1.14. I just fixed the bug. Now nothing is detected. * version 1.14 - 21.04.2003 I added autorun.inf hooking and tested it at WinXP (it works fine :D ) Also added AV-deleting (This versin there are 7 AV-Programs to delete. I hope, that i'll find some other too) Fixed a bug because of my stupidness: one of two viruses didn't work because the Program-File-Dir-Variable didn't write to the code. I also made the encryption little bit better (just for avoiding the KAV alarm "JS.Spthgen"!) * version 1.13 - 11.04.2003 I rewrote the whole fake-variable parts! I think, it's much better now, and it should be much harder to detect the viruses. I didn't added new freatures, because I have no ideas! If you have some good ideas, pls write me a mail. Much thanks! * version 1.12 - 10.04.2003 I killed once more a very lame KAV detection routine! No more changes, because I had much problems with my computers, and I tried to learn ASM! But i'll make something new in the next versions. * version 1.11 - 03.04.2003 Killed the KAV alarm "JS.Spthgen". KAV needed one month to detect the viruses, and now in such a lame way. Hey, feel shame! What's with you high-tech engines? I hope, you will work harder to detect the viruses in the right way ;)! * version 1.10 - 09.03.2003 I added HTM dropping (and crypt it ;) ) I also improved the IRC Program File Dir. The virus can get the program file dir-path from {Wsh.specialfolder("programs")} too. (Much thanks to Kefi for this!!) * version 1.09 - 04.03.2003 Once more KAV detect my viriis, because of the starting variables Now i added fake-vars and returns to every variable And i also mixed the letter variables. Hope that helps ;) I want, that KAV tries to detect the virus body and not just the start-variables! * version 1.08 - 02.03.2003 Once more, when i thought something is good, the KAV team shows me that I'm not right! :( They detect the first variable declarations! So i crypt them as the same as the other things! One fact is good: I got the idea, and this idea isn't detect ;)! All in all: I put the first variables in a function! I think it's cool! ;) * version 1.07 - 27.02.2003 KAV detected all viriis as "JS.Spthgen". They used a program named "Crypt.JSG" to do this! (I think, that I know something like this ;) [Crypt.BWG in my old Batch times]) I wrote the definitions to the end of the virus in a function! Now, I'm sure, it's much harder to detect something! The KAV team needed 14 days to detect the old encryption. +fg+ * version 1.06 - 23.02.2003 Added 2 new P2Ps: AppleJuice and Overnet! Thanks 2 www.allnews.de for the links ;)! And: @Kefi: seems you didn't found all Peer-to-Peer programs! ;) * version 1.05 - 20.02.2003 Instead of German startup-dir the JSG-viriis are able to copy itself to every startup-dir! And instead of the english startup-dir (because i don't need it any more) the JSG uses Registry-keys! I crypt the registry-part, because it was detect by the KAV heuristic-engine as "Type_script". thanks goes to kefi 4 the suggestion! Also a new thing: eMail spreading: You can use a crypt-vbs file! It's totally crypt! ;) I made it, because I found out, that Norton detected the eMail-part as Bloodhound.VBS.Worm! I also tested all new part: everything work ;) And nothing is detect!!! * version 1.04 - 14.02.2003 34 bugs fixed :( 1 in the eMail-spreading 1 in the vIRC part 1 in CMD dropping 1 in BAT dropping 2 in PIF dropping 4 in the LNK dropping part 9 in the P2P spreadings 15 in the pIRCh part seems like the old vesion was just shit... * version 1.03 - 12.02.2003 I made the encryption better. There are 4 ways to crypt one sign ;) Type 1: a normal string Type 2: a normal string in a variable Type 3: "unescape("%*")" Type 4: "unescape("%*")" in a variable (I hope, I'll find some more for instanze: chr or asc) I've crypt every string in mIRC and pIRCh part, win.ini and system.ini-autostart, vbs, cmd, bat, pif and lnk dropping. (+bg+) And two new thing: I) Instead of "C:\\Windows" the program use "fso.GetSpecialFolder(0)". II) Added VBS dropping. Fixed a bug in the vIRC part, because I forgot the "fso" infront of "FolderExists" I didn't encrypt the path-names, registry-names, special signs and Uppercase-signs this version, but, wait for the next version... Also KAV detect the VCKs as "Constructor.Win32.JSGen.???" <-- that's kewl ;) Now, dear KAV team: Let's start the game ;) * version 1.02 - 10.02.2003 Fixed a bug in the P2Ps! I used "Value=True" instead of "Value=1"! Added 3 new P2Ps! Big thanks goes to Kefi 4 bug report and suggestion! I promised u that i'll crypt the thing... I started with it! I hope u like it! I had not much time these days, but next week are holidays, so I'm going to crypt the other techniques too. Something else: KAV detect the version 1.01 as "Constructor.DOS.JSGen.009". I thing, there are 2 mistakes: Dear KAV team: 1.) It's not DOS, it's a Win32 VCK generating JS-viriis (but i'm sure u know) ;) 2.) "009"???? Hope u'll change it to "101". * version 1.01 - 04.02.2003 Added PIF file dropping Fixed one bug in the eMail spreading part Fixed one bug in the LNK file dropping part And one other major change: Now all variable are randomize! Because of that the 106kB of the constructor-file ;) * version 1.00 - 02.02.2003 I rewrite the program with Visual Basic! No more QBasic (=DOS) ! There are 2 main reasons for this change: 1: It has Windows-style and 2: I try to crypt some codes with QBasic, but it was impossible. pls don't ask me why! I hope, u'll like it! ;) Ohh, yes: Fixed a bug in the eMail-spreading! * version 0.07 - 18.01.2003 Added BAT file dropping Added CMD file dropping Sorry, but I haven't encrypt the whole thing yet. I'll add some other dropping-techniques and some other P2P spreading techniques, then I'm going to crypt the thing. It's much easier for me this way. i hope u can understand me. Ohh... don't be worry, i found 2 string-encrytion techniques and got a full-crypt JS-virus from jackie! :) * version 0.06 - 12.01.2003 Fixed a bug in the mirc-part Made the P2P's better. Added LNK dropping * version 0.05 - 09.01.2003 Fixed a bug in the english startup. Fixed a bug, if you use win.ini AND system.ini startup in one virus, because i used the same variables :| Fixed much bugs in all P2P worms The old version's viriis write a error, if a folder doesn't exist. Now i added a if-command to avoid this error. Made mIRC, pIRCh and vIRC much better than before, cause the virus searchs in 3 folders after the programs. Ones more a big "thank ya" to Kefi for bug report and suggestion! * version 0.04 - 07.01.2003 Fixed a bug in the win.ini part Fixed a bug in the system.ini part Fixed a bug in the mIRC part Fixed two bug in the vIRC part Made the whole code much shorter Added KaZaA spreading Added KaZaA Lite spreading Added Morpheus spreading Added Grokster spreading Added Bear Share spreading A very big thanks goes to Kefi 4 makeing it possible to add this P2P techniques ;) OK, something else: KAV detect the JSG as Constructor.DOS.JSGen.xxx. I don't know if this is better than the old name, because my JSG generates JS-viriis and no DOS viriis ;) * version 0.03 - 01.01.2003 Fixed a bug in the virc-part! Added win.ini autostart Added system.ini autostart Added Thanks and Greets :) * version 0.02 - 30.12.2002 Added pIRCh spreading Added vIRC spreading Added german autostart Added english autostart The VCK has been detect by KAV as Constructor.JS.Spth! I don't know why they took that name, but i hope, they'll rename it to Construstor.JS.JSG.xxx ;) The Viruses are detect as I-Worm.Spth.Jsg. Please forgive me that i didn't kill the viruses in this version. First i try to add as much things as possible, than i'll try to kill all AV-alarms. * version 0.01 - 28.12.2002 Made the main program The viruses are able to spread via eMail and mIRC I had not much time because of that the viruses are not encrypt or varible. But I'm going to work at it. The viruses will also be able to spread via pIRCh and vIRC and maybe via KaZaA in the next version. So visit my HomePage in some days again!