Virus Creation Kits A-M

Name: Access Macro Generator
Creator/Origin: Ultras / Russia
AKA : AMG
Type: Virus Creation Tool

Known versions:

AMG 1.0 - November 1998

Features:
An Access 97 macro virus generator by the creator of the UCK and MUCK kits.

Author's note:

Features:
Message Box        - Shows message
Kill Files on C:   - Deletes all files on disk C:\
Kill Dll           - Deletes DLL files in directory C:\Window\System
Kill Program Files - Destroys Folders C:\Program Files
Kill Files         - Deleting the files in folders
Kill Windoze Files - Destroys Folders C:\Program Files 
Instructions: After you include the constructor choose the options and name of virus. Hereon start access97 and create the module having named by its name of virus put all from generated file with finishing a name of virus.bas and module is ready. Hereon create macros "Autoexex" in which choose the function of start the program and deliver start a module of your virus.
Name: Ade Virus Construction Center
Creator/Origin: Thanathos / Darkness Sons
AKA : AVCC
Type: Virus Creation Tool

Known versions:

AVCC 1.0b - March 1999

Features:

Simple, generic virus creation kit that produces Pascal companion viruses. Several user selectable features are available. A beta of a 32-bit version has been released as AVCC32.

Name: Ade Virus Construction Center 4 Win32
Creator/Origin: Unknown / Italy
AKA : AVCC32
Type: Virus Creation Tool

Known versions:

AVCC32 - December 1999

Features:

AVCC32 is beta release of a 32-bit version of AVCC.

Name: Annihilator Virus Construction Set
Creator/Origin: Unknown / Germany
AKA : AVCS
Type: Virus Creation Tool

Known versions:

AVCS 1.00 - Unknown

Features:

Like a few others this kit asks annoying "virus knowledge" questions as "access control". It looks very similar to AWVCK (it uses the same access control questions and has a similar look) but the differences could indicate that the product is from the same author and probably is not a hack or clone. The demo virus that is distributed with the kit scans as a VCS variant with F-Prot but as AVCS.270 with AVP.

Name: Anti Windows Virus Creation Kit
Creator/Origin: Unknown / Unknown
AKA : AWVCK
Type: Virus Creation Tool

Known versions:

AWVCK 1.01 - March 1994
AWVCK 1.10 - 1994

Features:

Simple, generic virus creation kits that create overwriting viruses.

These are very dangerous nonmemory resident overwriting viruses. They search for .EXE and .INI files, then overwrite them, display the message and return to DOS:

"AWVCK.156": Packed file is corrupted!
"AWVCK.182": This program requires Microsoft Windows

The viruses also contain the text strings:

"AWVCK.156":

NoName
*.ini *.exe
Packed!-Virus [AWVCK 1.10-94]

"AWVCK.182":

Innocent
*.ini *.exe
Frisk is a lamer!-Virus [AWVCK 1.01-94]

Name: Black Knight Macro Virus Construction Kit
Creator/Origin: Black Knight / Philippines
AKA : BKMVCK
Type: Virus Creation Tool

Known versions:

LWMVCK 1.0 - May 2000
BKMVCK 1.0 - June 2000
BKMVCK 2.0 - August 2000

Features:
A macro virus creation kit with many similarities to LiME and other macro generators. Release 1.0 is created as a Word template (written using VBA) and has many user selectable payloads, infection settings, stealth settings, anti-virus techniques, triggers and miscellaneous features. For polymorphism it can use SOPS or APMRS. It creates Word 97 and Word 2000 compatible viruses. An early version is known as the Lucky Warrior Macro Virus Construction Kit (LWMVCK).
Release 2.0 is a major revision of the virus creator, it is written using VB. It is password protected and comes with an online Help feature explaining its functions. In addition to APMRS and SOPS version 2.0 also supports UMP. Like 1.0 it has many user selectable payloads, infection settings, stealth settings, anti-virus techniques, triggers and miscellaneous features. Release 2.0 also supports MIRC, PIRCH and Outlook infections using VBS and it creates Word 97/2000, Excel 97/2000 and Access 97/2000 compatible viruses. It is protected by a username/password combination.
Future versions will support cross and class infection.

Author's Note (version 1.0):

"BKMVCK is a macro virus construction kit for MS Word 97 and MS Word 2000. There's something new with this kit, the ability to change the windows background (8 nude images to choose from) and the ability to to change the mouse cursor (10 good images to choose from). There's also 4 new funny payloads, the ability to hide the start button, taskbar icons/system tray, to put your name in the system tray and to rename the recycle bin."
       Infection settings
       ~~~~~~~~~~~~~~~~~~
       AutoOpen
       AutoExec
       AutoClose
       AutoExit
       Edit|Find
       File|Close
       File|Exit
       File|Print
       File|Save
       File|SaveAs
       Tools|Options
       Tools|Macro
       File|Templates
       View|VBCode
       Print image of a woman to File|Print
       Stealth settings
       ~~~~~~~~~~~~~~~~
       Basic stealth hooks
       Stealth hooks with infection
       Stealth hooks with a payload and an infection routine
       Kill and disable the stealth menu options
       -Tools|Macro
       -Tools|Templates and add-ins...
       -Tools|Customize...
       Add a fake error message to stealth
       Payload trigger settings
       ~~~~~~~~~~~~~~~~~~~~~~~~
       Triggered by invoking a stealth menu
       Triggered by counter
       Stealth hooks/activated
       Triggered by random number
       Triggered by date 
       
       Payload settings
       ~~~~~~~~~~~~~~~~
       Shutdown Windows
       Hide Windows Start Button
       Hide Windows Taskbar Icons / System Tray
       Disable keyboard
       Hide mouse cursor
       Swap mouse button
       Make mouse cursor go wild
       Nail mouse cursor
       Launch internet site
       Insert password
       Disable MS Word menu
       - File
       - Edit
       - View
       - Insert
       - Format
       - Tools
       - Table
       - Window
       - Help
       Replace text
       Insert text while printing
       Encrypt text of active document
       Kill active document
       Quit MS Word
       Polymorphism settings
       ~~~~~~~~~~~~~~~~~~~~~
       APMRS
       SOPS
       Display messages settings
       ~~~~~~~~~~~~~~~~~~~~~~~~~
       Rename recycle bin
       Put name on the taskbar / system tray
       Change volume label
       Change MS Word caption
       Change MS Word status bar
       Insert text to active document
       Add a random message box
       Add a Help|About message box
       change windows username
       Add a MS Word assistant
       Add a Windows nag screen
       Graphics display settings
       ~~~~~~~~~~~~~~~~~~~~~~~~~
       Change Windows background
       - 8 nude images to choose from
       Change Windows mouse cursor
       - 10 images to choose from
       Dangerous payload settings
       ~~~~~~~~~~~~~~~~~~~~~~~~~~
       Format drive c:\
       Delete drive c:\ (include subfolders)
       Delete drive c:\ (w/out subfolders)
       Delete Windows (include subfolders)
       Delete Windows (w/out subfolders)
       Delete system files
       
       Defeat Anti-Virus settings
       ~~~~~~~~~~~~~~~~~~~~~~~~~~
       McAfee
       Dr. Solomon
       Norton
       Anti Virus Pro (AVP)
       PC-Cillin
       F-Prot
       F-Macro
       F-Win
       Quick Heal
       Thunder Byte
       Miscellaneous settings
       ~~~~~~~~~~~~~~~~~~~~~~
       Change document properties
       Change MS Word user information
       Hide Windows Start Menu
       - Favorites
       - Documents 
       - Settings
       - Find
       - Run
       - Log Off
       - Shutdown
       Hide all items on desktop
Name: Bayros Virus Creation Kit
Creator/Origin: Bayros / Unknown
AKA : BVCK
Type: Virus Creation Tool

Known versions:

BVCKIT 1.0 - October 1999
BVCKIT 2.0B - October 1999

Features:

A virus creation kit that is distributed as "shareware", which is a novel idea since viruses can be considered the ultimate in "shareware". The kit asks annoying "virus knowledge" questions as "shareware nags" and "access control".

Name: Batch Virus Generator
Creator/Origin: Wavefunc / USA
AKA : BVGEN
Type: Virus Creation Tool

Known versions:

BVGEN 1.1C - October 1995
BVGEN 1.2A - December 1995

Features:

These batch programs generate a multitude of replicating virus-like batch programs from user-specified parameters. Since they are written using the MS-DOS batch language they are rather easy to find and disable, but at the same time, depending on the payload, they can be just as dangerous as assembly viruses.

See also:

Batch Viruses #2 by Wavefunc
Batch Viruses #3 by Wavefunc

Name: Biological Warfare
Creator/Origin: Mnemonix / USA
AKA : BW
Type: Virus Creation Tool

Known versions:

BW 0.90B - April 1994
BW 1.00 - June 1994

Features:

Biological Warfare is a program that will generate assembly source code for a fully functional virus according to the specifications that the user gives it. When Biological Warfare is run, it will give the user a menu with a list of options pertaining to the virus. The user can manipulate the options as directed to create the virus to his specifications.

Following are the options of version 0.90B :

A) Text - Any text that has to appear within the virus, up to 60 characters.
B) Resident - Specifies whether virus will be resident in memory or not.
C) Infect - Either COM, EXE, or both.
D) Encryption - Specifies if the virus will feature encryption.
E) INT 24 Handler - Specifies if the virus will steal DOS's critical error handler to avoid write protect errors.
F) Anti-Trace - Specifies if the virus will includes routines to thwart trivial debugging or tracing.
G) Maximum Size - If selected, the virus will not infect any .COM file too large for it.
H) Traversal - Specifies if the virus will move upwards in the directory tree.
I) Infections/run - Maximum number of files to infect each run.
J) Avoid COMMAND - Specifies if the virus will infect COMMAND.COM.
K) EXE Marker - Two characters used to indicate an infected .EXE file.
L) Overlay check - Specifies that the virus will not infect .EXE files with internal overlays.
M) DirStealth - Hides the file size increases from a directory listing. All infected files have their seconds field set to the given number. Absence of this number indicates that no directory stealth function will be included. (Resident viruses only)
N) Infect on - Specifies if the virus has to infect when opening a file, executing a file or both.
O) Activate - Virus will include space for an activation routine in the code.
P) More directory stealth - In conjunction with directory stealth this will make the increase in file size invisible from any file managing programs in addition to a DIR command.

Version 1.00 added the following:

- Encryption, both standard and basic polymorphic (via the Biological Warfare Mutation Engine)
- Time stamp - This is used by either directory stealth or polymorphism.
- Biological Warfare Mutation Engine (BWME):

The BWME is a very basic polymorphic encryption engine that will make the virus more difficult to scan. It's size is 609 bytes.

Name: Class Macro Kit
Creator/Origin: jackie twoflower / Austria
AKA : CMK
Type: Virus Creation Tool

Known versions:

CMK 1.0b - August 1999

Features:

A class macro virus generator by the author of LiME, W97MVCK. Version 1.0b offers the option of including the PiE polymorphic engine.

Name: Class.Poppy Construction Kit
Creator/Origin: VicodinES / USA
AKA : CPCK
Type: Virus Creation Tool

Known versions:

CPCK 1.0a - November 1998

Features:

A creation tool specifically aimed at making MS Word for Windows 97 VBA/Class viruses. It allows for integration of several payloads and the use of VSMP, a polymorphic module by the same author (also known for VMPCK, VWIS, VAMP and VVSC.

Name: China Town Macro Word Virus Construction Kit
Creator/Origin: Duke / Russia
AKA : CTMWVCK
Type: Virus Creation Tool

Known versions:

CTMWVCK 0.1 - April 1999
CTMWVCK 0.1a - May 1999
CTMWVCK 0.1b - May 1999

Features:

Another creation tool specifically aimed at making MS Word for Windows .DOC and .DOT macro viruses. Released as a .DOT file it basically is a macro to create macro viruses. Several payloads and triggers conditions are user selectable. Versions 0.1a and 0.1b claim some Word 97 compatibility even though the kit is Word 6.0 based. Created by the author of DPOG, DPVG, SBVM and DVL. A hacked version of this kit is known as DPVCK.

Name: Crazybits Virus Construction Kit
Creator/Origin: CrazyMan / Indonesia
AKA : CVCK
Type: Virus Creation Tool

Known versions:

CVCK 0.1B - April 1997

Features:

Another creation tool specifically aimed at making MS Word for Windows .DOC and .DOT macro viruses. Released as a .DOC file it basically is a macro to create macro viruses. Several payloads and triggers conditions are user selectable. It adds an extra menu called "CrazyVCK v0.1" to the Word menu bar.

Name: CVEX Virus Maker
Creator/Origin: Golden Cicada / Taiwan
AKA : --
Type: Virus Creation Tool

Known versions:

CVEX 1.0 - October 1995

Features:

This virus maker is probably responsible for the large number of CVEX variants floating around. It requires a little more knowledge on programming from its user and is a little less user friendly than for example VCL or PS-MPC.

Name: Dead_Bytes Virus Generator
Creator/Origin: Dead_Byte / Russia
AKA : DBVG
Type: Virus Cloning Tool

Known versions:

DBVG 1.0 (Russian) - June 2000
DBVG 1.1 (Russian) - August 2000
DBVG 1.1 (English) - August 2000

Features:

This generic virus cloning tool creates source codes that can be compiled with Turbo Pascal. It offers Companion, Overwriting and Appending functionality.

Name: Ding Lik's C Virus Generator
Creator/Origin: Ding Lik / Indonesia
AKA : DLCVG
Type: Virus Creation Tool

Known versions:

DLCVG - December 1999

Features:

Author's note:

"Ding Lik's Millenium C Virus Generator, DLCVG for shorten, is a tool for everyone - C programmers specially - to learn how to program a virus in C language. DLCVG will produce a virus template, so you can easily modify it. DLCVG has menus, so you can use it easily.

There are three menus : File, Edit and About. File menu contains Go & Exit menus. Go menu's function is to create a virus. Exit menu's function is to exit from DLCVG. Edit menu contains Author, Vir name & Vir ID menus. Author menu's function is to enter author of the virus. Vir name menu's function is to enter name of the virus. And Vir ID menu's function is to enter signature of the virus. Just fill each edit menus and then File | Go to create a C virus."

Name: DarkByte Macro Virus Generator
Creator/Origin: DarkByte / Philippines
AKA : DMVG
Type: Virus Creation Tool

Known versions:

DMVG 0.9b - February 2000

Features:

Macro virus generator with user selectable features (activation routines, payloads, trigger timing).

Name: DarkChasm's Word 97 Macro Virus Construction Kit
Creator/Origin: DarkChasm / USA?
AKA : DW97MVCK
Type: Virus Creation Tool

Known versions:

DW97MVCK 1.0 - June 1997

Features:

This is the 'next generation' macro virus creator it being specifically made for Word 97 (VBA) macro viruses. The generator itself is, like most other macro virus generators, a big macro. Several options like stealth, retro (severely limited due to target directory selection), payloads, what macros to use etc. are user selectable. To support a polymorphic function the use of Pyro's APMRS is incorporated and is also user selectable.

From the author:

"There are plenty of features DW97MVCK can make viruses with:

Features:

+ 4 Stealth macros to choose from
+ 8 Retro features to choose from
+ Polymorphic (currently only one engine)
+ 7 Payloads to choose from
+ 7 Infection Macros to choose from

Of course you can mix and match any combination, so there are well over 100 combinations."

Name: Dirty Nazi Virus Generator
Creator/Origin: Dirty Nazi / SGWW / Ukraine
AKA : DNVG
Type: Virus Creation Tool

Known versions:

DNVG 1.0B (Russian) - April 1997
DNVG 1.0B (English) - February 1998

Features:

This Ukrainian virus maker was released with Issue #11 of the Infected Voice e-zine. It is operated through a DOS based user interface and produces .PAS source codes. It comes with 1 example virus. A translated version is also available.

Name: Duke's Pascal Overwriting Generator
Creator/Origin: Duke / Russia
AKA : DPOG
Type: Virus Creation Tool

Known versions:

DPOG 0.01 - November 1998
DPOG 0.02 - July 1999

Features:

Version 0.01 of this simple Russian virus maker was released with Issue #2 of the DVL e-zine. It is a CLI operated generator that creates HLLO (overwriting Pascal) viruses through a user configurable .CFG file. It was subsequently followed by DPVG and SBVM of the same author. Version 0.02 of this simple Russian virus maker was released with Issue #8 of the DVL e-zine.

Name: Diesel Power Virus Creation Kit
Creator/Origin: Xarabas / Italy
AKA : DPVCK
Type: Virus Creation Tool

Known versions:

DPVCK 1.0 - April 1999

Features:

This is a hacked version of CTMWVCK by Duke. Some dialogs were changed but remain similar to the original dialogs and the 3 selectable payload viruses were swapped with 3 viruses by members of Darkness Sons.

Name: Duke's Pascal Virus Generator
Creator/Origin: Duke / Russia
AKA : DPVG
Type: Virus Creation Tool

Known versions:

DPVG 0.1 - December 1998
DPVG 0.2 - January 1999

Features:

Version 0.1 of this Russian virus maker was released with Issue #3 and version 0.2 with Issue #4 of the DVL e-zine. It is a CLI operated generator that creates HLLO, HLLW or HLLC viruses through a user configurable .CFG file. It was created by the same author as DPOG, DVL and SBVM.

Name: Digital Hackers' Alliance Randomized Encryption Generator
Creator/Origin: Gothmog / USA
AKA : DREG
Type: Virus Creation Tool

Known versions:

DREG 0.01.0047 - March 1997
DREG 0.01.0049 - March 1997

Features:

From the author's .DOC file:

The Digital Hackers' Alliance Randomized Encryption Generator (DREG) was created primarily as a programming excercise of sorts, to see how difficult it would be to create a program which could make working viruses from a single template which share a minimum of code, and as a result, can not be detected by signature scanning but rather by algorithmic scanning only. This too may prove difficult, for DREG has several unique code- randomization features:

- Randomized instruction sequences - DREG will place register assignments, etc. in random order.

- Anti-heuristic code - most DREG viruses are 100% undetectable by TBAV w/ high heuristics enabled and F-PROT with the /analyse /guru and /paranoid command-line switches enabled. Some are undetectable by AVPLITE v3.0 build 107's heuristics and by Dr. Solomon's FindVirus v7.69, others will trigger generic heuristic alarms. Oh well, so it goes...

- Random register selection - when executing a lea reg16, [bp+address] / call reg16 sequence, for example, a register will be randomly chosen from those not containing data to be saved.

- Complex register assignment code - when mov reg, constant is necessary, DREG will do one of the following: mov reg, constant; mov reg, random number / add reg, constant - random number; mov reg, random number / sub reg, random number - constant; mov reg, constant xor random number / xor reg, random number; mov regHi, constantHi / mov regLo, constantLo; mov regLo, constantLo / mov regHi, constantHi. You get the picture...

- Complex register zeroing - when a register needs to be cleared, DREG will alternately choose between: xor reg, reg; sub reg, reg; mov reg, 0; mov reg, random number / xor reg, random number; mov reg, random number/ sub reg, random number. NOTE: this routine will call the complex reg. assignment code when necessary. Also note - the two complex register routines are recursive; there shouldn't be any real risk of any stack overflows, but keep this fact in mind if the code appears to freeze or proceed slowly during the virus generation phase.

- Multiple encryption keys - Generated viruses can have up to ten random encryption keys. Generated keys will be assigned by calling one of two random number generator routines and by using a different call/pop sequence each time.

- Variable size increase - some generated viruses will arbitrarily and randomly add several extraneous bytes to the end of each infected file to confuse scanners/disinfectors. This is done through a sequence of inc cx instructions or through a single add cx, random number statement.

- Variable heap code offset - Generated viruses will copy the infection routine in memory to a random offset in the heap, different each time.

- Randomly placed data items - Currently, there are 5 separate data items that can be placed into 5 different positions within the code.

- Randomly placed heap data positions - Stored in the heap in a random order, and often with empty "placeholder" spaces, are the file attributes/time/date/size block, and the original code segment and offset of the original interrupt 24 handler.

- Random filemask capitalization - DREG will randomly capitalize '*.COM'; to create, for example, '*.CoM' '*.COM', '*.com', '*.cOM', etc.

- Junk code generation - This feature is one of DREG's best randomization features. Intersperced between the instructions of its generated viruses, DREG will include one or more junk instructions. Currently, the junk instructions DREG supports are: nop; sub reg, 0; add reg, 0; or reg, 0; xor reg, 0; mov reg, reg; inc reg / dec reg; dec reg / inc reg; add reg, random number / sub reg, random number; sub reg, random number / add reg, random number; push reg / pop reg; push reg / mov reg, random number / pop reg; jmp random_address / random_address:; cmc / cmc; cli / sti; int 03h (one- and two-byte opcodes); push ax / lahf / pop ax; xchg reg, reg; neg reg / neg reg; not reg / not reg. NOTE: This routine is recursive; there shouldn't be any real risk of any stack overflows, but keep this fact in mind if the code appears to freeze or proceed slowly during the virus generation phase.

As DREG is coded to illustrate the randomization engine itself, the viruses it creates, while difficult to detect, are rather simple technologically speaking. They are .COM infectors that infect files in the current directory only, hooking interrupt 24 to disable any write-protect messages. Infected files preserve date, time, and attributes. Read-only files CAN be infected. EXE files that are misnamed purposefully or otherwise as COM files are NOT infected. Files that start with a near jmp instruction are not infected; this serves as both an anti-goat file measure and an infection marker. This means as well that DREG viruses will not infect files infected by other DREG viruses without modification. The viruses will be encrypted with a xor encryption loop which will vary with each generated virus; see the featurelist above for more on this. All in all, a simple affair, but then again, this program is only a demonstration of virus engine technology.

See: Interviews (Gothmog)

Name: Dark Slick's Virus Generator
Creator/Origin: Dark Slick / Unknown
AKA : DSVG
Type: Virus Cloning Tool

Known versions:

DSVG 1.0 - July 1996

Features:

Basically this program is just a user shell to compile and generate around 40 older and well known viruses. This program uses three .DAT files that are ASCII collections of ASM listings of those wel known viruses. Most, if not all, of the viruses created by this generator should be found by your average AV tool.

Name: Deinonychus Virus Generator
Creator/Origin: Candyman / Argentina
AKA : DVG
Type: Virus Creation Tool

Known versions:

DVG 1.35 - July 1995
DVG 1.35D - November 1995
DVG 1.35E - November 1995

Features:

Generic VCL-like virus generator from Argentina. It has several selectable payloads. The following is a quote from the .DOC file:

FUCK HDD.(Destruye HDD)
DISPLAY STRING.(Imprime mensaje en pantalla)
FUCK HDD Y DISPLAY STRING.
STOP PC.(Cuelga Pc)
REBOOT.
BEEPS.
FUCK T.P. (Destruye Tabla De Particion )
PRINT SCREEN (Imprime Pantalla Actual <LPT> )
KILL RND SECTOR (Destruye un sector al azar del drive default <new>)
NINGUNA.

It also has several selectable time triggers: day of the month, month of the year, time of the day and day of the week.

The user has the have Borland's TASM.EXE and TLINK.EXE in the path for compiled viruses to be created succesfully.

Name: Duke's Virus Labs
Creator/Origin: Duke / Russia
AKA : DVL
Type: Virus Cloning Tool

Known versions:

DVL 1.0 - June 1998

Features:

Similar to DSVG and Genesis this cloning tool reproduces 14 known viruses from a database of source codes. It needs TASM and TLINK to function. Created by the author of DPOG, DPVG, SBVM and CTMWVCK.

Name: Demolition Kit
Creator/Origin: Nightmare Joker / SLAM / Germany
AKA : --
Type: Virus Creation Tool

Known versions:

Demolition Kit 1.0 - December 1996

Features:

Based on Nightmare Joker's first creation tool, WMVCK, this one was released in 5 different versions (WFW 95 7.0 VGA/SVGA, WFW 95 6.0 VGA/SVGA & WFW 3.1 6.0). Further info to be determined.

Name: Excel Macro Virus Construction Kit
Creator/Origin: Anti-State Tortoise / Unknown
AKA : EMCVK
Type: Virus Creation Tool

Known versions:

EMVCK - September 1999
EMVCK bugfix - December 1999

Features:

Virus generator by the creator of PIAPP that creates macro viruses for Excel 97/2000. It generates .BAS source codes that can be imported into Excel.

Name: Ejecutor Virus Creator
Creator/Origin: El Ejecutor / Argentina
AKA : EVC
Type: Virus Creation Tool

Known versions:

EVC 1.0 - December 1993

Features:

Ejecutor Virus Creator is a very basic virus creation tool only capable of making one basic 161 byte long overwriting virus. The user has the option to enter a text the virus has to display and the date when the virus has display the text.
Only a few viruses produced by EVC are known.
The same author created the EVI virus insertion/dropping tool.

Name: Executioner's Virus Generator
Creator/Origin: Executioner / Canada
AKA : EVG
Type: Virus Creation Tool

Known versions:

EVG 1.00B - December 1995
EVG 1.30B - Unknown
EVG 1.40 - Unknown

Features:

Unknown. Never publicly released, several of its products are known. Discontinued end 1996.

Name: Evil Zone Virus Construction Kit
Creator/Origin: Xabaras & Xander16 / Italy
AKA : EZVCK
Type: Virus Creation Tool

Known versions:

EZVCK - January 2000

Features:

Tool with a bilingual (Italian and English) Windows GUI and capable of producing Assembler or Pascal virus source codes. Possibly an evolution of AVCC32. Several features are unavailable and planned for subsequent releases.

Name: Fake Virus Creation Lab
Creator/Origin: The Bughunter / Germany
AKA : FVCL
Type: Pseudo Virus Creation Tool

Known versions:

FVCL 1.0 - December 1999

Features:

This tool does NOT produce any viruses. It inserts messages in selected .COM files. It has been included for sake of completeness.

Name: G2 (G Squared)
Creator/Origin: P/S / USA/Canada
AKA : G2
Type: Virus Creation Tool

Known versions:

G2 0.70B - January 1993

Features:

It appears that the Dark Angel was not wholly satisfied with the PS-MPC generator he had written, and so he published a program called Phalcon/Skism G2 on the turn of the year 1993. The name derives from its creator's opinion that G2 is a second-generation virus generator.
The functioning of G2 very much resembles that of PS-MPC. They have certain notable differences, however:
G2 will create a different virus every time, even though the values in the configuration file remain unchanged. G2 is also supplied with a smallish file, G2.DAT, which contains the actual intelligence of the program. The Dark Angel has announced that he will supply update versions of this file, which will completely change the functioning methods of the program.
The documentation of G2 tells of its features as follows:

FEATURES

The target audience of G2 includes both novice and advanced programmers alike who wish to learn more about virus programming. A revolutionary tool in virus generation, G2 is both easy to use and unparalleled in performance. As a code generator, it has a number of features including:

o Easy updates via data files.
o Accepts MPC-compliant configuration files.
o Different viruses may be generated from identical configuration files.
o Small executable size, allowing for speed during load and execution.
o Still no IDE - edit the configuration file in your favorite editor and rapidly generate new code; no need for lengthy wait while IDE loads, allowing you to work faster and have results quicker. A definite productivity bonus!
o Rapid generation of code, once again allowing for fast results.
o Low memory requirements.

As a virus creation tool, it has the following features:

o Generates compact, easily modified, fully commented, source code.
o COM/EXE infectors.
o Resident and nonresident viruses.
o Supports multiple, semi-polymorphic encryption routines (full polymorphism coming soon).
o Easily upgraded when improvements are needed.

G2 is one of the most advanced virus code generator available today!. Many viruses made with G2 are known. Anti-virus products today detect most of the G2 products.

Name: Genesis (ASM)
Creator/Origin: Virii God/Stormmaker / Unknown
AKA : --
Type: Virus Cloning Tool

Known versions:

Genesis 1.0 - September 1998
Genesis 2.0 - September 1998
Genesis 3.0 - March 1999

Features:

Generic, batch file based virus compiler/dropper. Version 1.0 comes with eight well known virus source codes, version 2.0 and 3.0 are compiled batch file based compilers of thirty and forty source codes respectively. All versions include the TASM/TLINK files necessary to compile the code.

Author's note (version 1.0):

"Genesis is a simple program that will automatically create viruses. I chose to write it in Batch for two reasons:

I'm one of those OLD folk that actually like Batch ;-)

I'm just getting back into Virus Writing and my assembly is a little rusty.

This Version of GENESIS will create 8 well known viruses automatically using a menu interface. I thought about writing it to create more than 8 viruses but I want to see the reaction I get to Version 1.0 first before I go all out. Personally, I don't condone these type of virus creation programs. I feel that one should learn to write their own viruses. But I also feel that programs like this creator can help beginners in a way by showing them how viruses are put together. It seems like the virus scene has slowed down in terms of original ideas lately, (People using Virus Creators to create old/known viruses) and this is a shame. I encourage people to start learning assembly and writing their own NEW viruses. As I stated, I wrote this program and intended it to be somewhat of an indirect learning model. TAKE apart the Virii it creates. EXAMINE the ASM files. FIGURE OUT how TASM and TLINK work. LEARN!"

Name: Genesis (Batch)
Creator/Origin: PhreakX / Unknown
AKA : --
Type: Virus Creation Tool

Known versions:

Genesis 0.01 - July 1999

Features:

This tool with a Windows GUI (programmed using Visual Basic) will create batch viruses with user selectable features.

Name: GenVir
Creator/Origin: J.Struss/France
AKA : GV
Type: Virus Creation Tool

Known versions:

GV 1.0 - 1991/3
GV 1.5 - 1991/3
GV 1.5 (NuKE) - March 1993
GV 2.0 - June 1993

Features:

GenVir was marketed by a Frenchman called Struss as a tool to evaluate the performance of anti-virus products and its documents included an order form. In 1993 members of NuKE released a cracked version 1.5. Later in 1993 Struss released version 2.0 which boasted MS-DOS 5.0, 6.0 and Doublespace compatibility.
More than 10 viruses produced by GenVir are known.

Name: Incredible Batch Bug Maker
Creator/Origin: Wavefunc / USA
AKA : IBBM
Type: Virus Creation Tool

Known versions:

IBBM - VLAD AF
IBBM - Nightmare Joker
IBBM - bugfixed
JBM - Jany Batch Maker - August 1999

Features:

Initially released in VLAD zine #AF this creator uses a HTML and Java capable browser to create batch file viruses. The initial release had a one byte infection counter bug which would cause the virus to keep infecting an unlimited number of files. Early 1997 this creator evolved into RBM which uses HTML frames.

Jany Batch Maker is a hack of the original tool, created by the_L3D.

Name: IRC Batch Worm Kit
Creator/Origin: GzR / Unknown
AKA : IBWK
Type: Worm Creation Tool

Known versions:

IBWK 1.0 - August 2000

Features:

Generic creation tool that produces batch files with IRC worm functions. By the creator of TPOK.

Name: Immortal EAS Virus Creation Centre
Creator/Origin: Hacking Hell / Netherlands
AKA : IE-VCC
Type: Virus Creation Tool

Known versions:

IE-VCC 0.09B - June 1995
IE-VCC 0.19B - June 1995

Features:

A recent addition to the the virus creation market this package claims:

"Anti-Trace / Anti-TBAV / Anti-MSAV / Encryption / Traversal / Etc."

It was coded by Hacking Hell of Immortal EAS a new and shortlived Dutch virus writing group. More than 25 viruses produced by this tool are known.

Name: Italian Pascal Virus Construction Kit
Creator/Origin: Tex / Darkness Sons
AKA : IPVCK
Type: Virus Creation Tool

Known versions:

IPVCK 1.0 - February 1999

Features:

This simple, generic virus creation kit produces assembler source codes and comes with 1 test virus and TASM/TLINK.

Name: Instant Virus Production Kit
Creator/Origin: YAM / USA
AKA : IVP
Type: Virus Creation Tool

Known versions:

IVP 1.0 - December 1992
IVP 1.7 - January 1993

Features:

YAM (Youngsters Against McAfee), a group founded in the USA, has contributed the Instant Virus Producer, or IVP, to the competition for the best virus generator. IVP has not, however, attracted popularity to speak of.
IVP does not feature the amount of functions VCL and PS-MPC do, it cannot, for example, create memory resident viruses. In the same vein, the encryption algorithms of IVP are really very simple in comparison with, let's say, PS-MPC. To top it all, IVP frequently produces dysfunctional code.
More than 120 viruses produced with IVP are known to exist.

Name: Indonesian Virus Source Creator
Creator/Origin: Henry Yonathan (Sentot) / Indonesia
AKA : IVSC
Type: Virus Creation Tool

Known versions:

IVSC 0.0.1B - 1998
IVSC 0.1.1B - February 1998
IVSC 0.1.1 - March 1998

Features:

A generic virus creator with minimal features.

From the author:

"Welcome to Indonesian Virus Source Creator (IVSC) version 0.1.1�eta. We (RHA PC Club) had created IVSC version 0.0.1�eta for private release. IVSC is a simple generator that create a virus. It has a simple interface, similar to Biologycal Warfare (BW). We created this generator is to make a contribution in Virii's World, specialy in Virus Creation Kit. The other reasons are for the future virii's writer, learning virii programming and learn to make an AV program. The virii's source code produced by IVSC commented in Indonesian (that's what IVSC for). The virus is not programmed to restore the infected file's date and time. Viruses produced by IVSC just a virus template, so you can make it better and better. If your IVSC is orginal, you can find a virus exampled named BITLEZZ.ASM, a virus created by IVSC modified and developed by Ding Lik."

Name: Javascript Virus Dropper
Creator/Origin: Ruzz / Unknown
AKA : JVD
Type: Virus Creation Tool

Known versions:

JVD - July 1999

Features:

Author's note:

"JVD "transports" viruses into the user's system via the web. A file is created on the user's harddisc which contains all the information needed to create and run the virus . The Autoexec.bat and Config.sys are amended to create and run the virus on next bootup. The Win.ini, System.ini, User.dat, Win.com and contents of Autoexec.bat and Config.sys are destroyed. The code then inserts a command to execute the written file on next bootup when Autoexec.bat calls the written file which creates and runs the virus. Because most AV progs load using the Autoexec.bat, the Config.sys, the Win.ini, the System.ini or the Windows registry, they cannot be executed because these files have been modified or destroyed. The Win.ini, System.ini, Win.com and User.dat files have been removed just incase the virus is not run. This guarantees that the user cannot get into Windows to run any AV programs or diagnostic prog to rectify the problem. This forces the user to perform a total rebuild of their system. This will result in a loss of data and time. "

Name: Laboratorio Argentino de Virus
Creator/Origin: Candyman - Popol / Argentina
AKA : LAV
Type: Virus Creation Tool

Known versions:

LAV 1.20 - October 1995

Features:

Virus creation kit from the same author as the Deinonychus Virus Generator (DVG). It creates DOS viruses and has similar features as DVG.

Name: LAboratorio de VIrus
Creator/Origin: Father Mac / Argentina
AKA : LAVI
Type: Virus Creation Tool

Known versions:

LAVI 1.0 - Unknown
LAVI 1.2 - Unknown
LAVI 1.3 - January 1994

Features:

LAboratorio de VIrus is an Argentinian virus creation tool released by someone who calls himself Father Mac. Generally based on Nowhere Man's VCL it also uses destructive routines released by an American called Evil Avatar in his Mass Destruction Library.
More than 40 viruses produced with LAVI are known and most of today's popular anti-virus products detect them.

Name: Liberation of Anarchists Nationwide Macro Virus Generator
Creator/Origin: VEiN / USA
AKA : LANMVG
Type: Virus Creation Tool

Known versions:

LANMVG 1.5b - August 1998
LANMVG 1.5a - August 1998

Features:

A macro virus generation tool that is capable of making viruses using either WordBasic or Visual Basic for Applications. The source code for this generator is heavily based on VicodinES' creator VMPCK. It comes with the W97/Core virus. Release 1.5a is a bugfixed version of 1.5b.

Name: Liberation of Anarchists Nationwide Virus Lab
Creator/Origin: VEiN / USA
AKA : LANVL
Type: Virus Cloning Tool

Known versions:

LANVL 1.1b - July 1998

Features:

A generic virus creation tool that, like a few other programs in this category, drops well known viruses from .DAT files. The viruses that come with this kit are:

Ambulance
Anthrax
AntiCMOS
Cascade
Casino
Earthday
Green Caterpillar
Jerusalem
Pox 2
Tiny-163

From the author:

"This is a program that I wrote a long time ago when I was learning QBasic (THE Ancient Computer Language!!). I found it on my 80386 and decided to finish it. I fixed all of the bugs (I think) and it works very similar to DarkSlick's Virus Creation Kit. It reads data and compiles it to binary code. The shitty part is I didn't have time to put in a routine to delete the *.MAP and *.OBJ files that are produced.

Oh well, I'm only human. Have fun and don't NuKE yourself!! =)"

Name: LineZero Macro Engine
Creator/Origin: jack twoflower / Austria
AKA : LiME
Type: Virus Creation Tool

Known versions:

LiME 1.0 - May 1999
LiME 1.2 - May 1999

Features:

Macro virus creation kit capable of creating viruses for Word, Excel and Access. Many user selectable features (infection techniques, payloads, stealth techniques) are available. The kit creates .BAS VBA source codes that need to imported into one of the three applications to make the final virus. By the author of W97MVCK. In version 1.2 the language used is user selectable (German or English) and the viruses for Word and Excel are produced in both the .BAS source code as the "compiled" product. There are 18 payloads for Word, 12 for Excel and 6 for Access.

Name: Lord Of Navan's Invasion Generator
Creator/Origin: Lord Of Navan / Unknown
AKA : LONIG
Type: Virus Creation Tool

Known versions:

LONIG 1.0 - June 1997

Features:

This generator was released in issue #3 of SLAM magazine. It creates source codes of Pascal viruses and was released with several demo viruses.

From the author:

LoNIG is a VCK that generates Pascal Companion viruses, which are 100% not found by any AV prog at the moment. Anyway, it was coded in Pascal of coz, and I avoided any ASM routines since my project was to write a proggy that generates REAL PAS-viriis and not only parts consisting of Pascal.

You can choose from the payloads:

* Displaying your own messy (random colors)
* Let the compy beep
* Only replicate (no special payload)
* Generate thousands of garbage philes
* Fake autoexec.bat --> endless boot-looping
* Give your virii Retro-abilities

Name: MacrEngine
Creator/Origin: Deviator / Ukraine
AKA : ME
Type: Virus Creation Tool

Known versions:

ME 1.0 - July 1999

Features:

This simple macro virus generator uses the WordBasic (Word 6/95) and was released with DVL #8.

Name: Mass O Shit Code Generator
Creator/Origin: Digital Anarchist / DSD
AKA : MOS
Type: Virus Creation Tool

Known versions:

MOS v.2c - July 1997
MOS v.7c - July 1998
MOS v.7d - July 1998

Features:

Look here for the expanded history/background of this virus generator. The source code to this virus generator and a modified web version was released with Codebreakers Zine #4.

From the author:

It's based on an idea that Unknown/LT and Gothmog/DHA started but never completed. For every section of code there is more than one way to part the cat from it's coat. Or there is more than one way to get the results you desire. This takes some of the more basic section of code and explores a few of the options. v.2c has 5 sections of code with 6 possiblities/section s easy math tells you that this will produce 15,625 variations.

Name: Macro Virus Development Kit
Creator/Origin: Wild W0rker / Russia
AKA : MVDK
Type: Virus Creation Tool

Known versions:

MVDK 1.0B - August 1996
MVDK 1.0 - September 1996

Features:

The first creation tool specifically aimed at making MS Word for Windows .DOC and .DOT macro viruses. Released as a .DOC file it basically is a macro to create macro viruses. The final 1.0 release has several more payload features than the beta version.

Name: Macro Virus SCS 97
Creator/Origin: Alevirus & RickCrazy / Brasil
AKA : MVSCS97
Type: Virus Creation Tool

Known versions:

MVSCS97 1.1 - April 1998

Features:

A Brasilian hack of the Dark Chasm's macro virus generation kit (DMVCK) this template for Word 97 creates Word 97 compatible viruses. Also released the Molotov Class Virus Maker (MCVM).

Name: Mini Ultras Construction Kit
Creator/Origin: Ultras / Russia
AKA : MUCK
Type: Virus Creation Tool

Known versions:

MUCK 1.0 - September 1998

Features:
Word 97 macro virus generation tool by the creator of UCK, AMG and UMP.

Author's note:

This be second my constructor it generates the viruses under Word97 - Word98. I has done its Mini version that it there was suitable. Creates viruses for word97-word98. In this constructors are done forgiven macro viruses. In menu
of constructor you are able to choose any deskside of your virus afterwards in directory of constructor you will find the file with name of your virus import in document word and your virus is ready. If work this constructor
you will find error please report me: ultras2@usa.net. Below I has described all functions of this constructor.
Infection: 	AutoOpen
             AutoClose
             AutoExec
             FileSave
Stealth:     ToolsMacro
             ViewVBCode
             ToolsCustomize
             FileTemplates
Polymorphic: UMP


Payload:     Message Box
             Set Password
             ViriiPrint
             Kill Files
             Assistant
             StatusBar
             Change User
             Cunning Password
             Random Password
             New Caption
KillAV:      Anti Virus Pro (AVP)
             Dr.Solomon
             F-Prot
             Norton AntiVirus
             McAfee
             Quick Heal
             ThunderByte (TBAV)
             ViruSafe
Name: Molotov Class Virus Maker
Creator/Origin: Rick Crazy & Alevirus / Brasil
AKA : MCVM
Type: Virus Creation Tool

Known versions:

MCVM Beta - February 1999

Features:

An initial and limited beta version of an intended Class virus creation kit. The posted version was "infected" with Back Orifice. Also released Macro Virus SCS 97 (MVSCS97).

Name: Magic Macro Virii Creator
Creator/Origin: Rincewind / Austria
AKA : MMVC
Type: Virus Creation Tool

Known versions:

MMVC 1.0a - March 1999

Features:

This kit was created by the author of the LiME VCK using a different handle. The graphics look similar and it is also written in the German language.

Name: Mafia's Shit Creation Center
Creator/Origin: Xarabas / Italy
AKA : MSCC
Type: Virus Creation Tool

Known versions:

MSCC 1.0b - April 1999

Features:

This is a hacked version of release 0.02d of SBVM by Duke. Some dialogs were changed but remain similar to the original dialogs. Like SBVM it creates a batch virus.

Name: Mister Spocks Virus Generator
Creator/Origin: Mister Spock / Germany
AKA : MSVG
Type: Virus Creation Tool

Known versions:

MSVG 1.0 - May 2000

Features:

Word macro virus generator with several user selectable features (infection methods, payloads)

Name: Macro Virus Generator
Creator/Origin: e [ax] / Bosnia Herzegovina
AKA : MVG
Type: Virus Creation Tool

Known versions:

MVG 1.0 beta - July 2000

Features:

One of many this tool generates macro viruses for Microsoft Word. It has many user selectable features but all selections are displayed using the Yugoslav language. The program will support use of OIE, and RCJ.