Virus Creation Kits N-Z

Name: NoMercy Excel Generator
Creator/Origin: Foxz / Indonesia
AKA : NEG
Type: Virus Creation Tool

Known versions:

NEG 1.0 - January 1998

Features:

Released by the creator of Crazybits Virus Construction Kit (CVCK) this is the world's first Excel Macro Virus creation kit. It features several payload and creates .BAS source files.

Name: NOP Virus Creator
Creator/Origin: Billy Belcebu / Spain
AKA : NOPVC
Type: Virus Creation Tool

Known versions:

NOPVC 0.666 - November 1997
NOPVC 1.666 - December 1997

Features:

Unreleased virus creation tools by some members of DDT. The development of the releases was explained in Billy Belcebu's article on the demise of DDT. Version 0.666 was based on routines from IVP and NRLG with some payloads added. Version 1.666 was similar although the virus engine was based on Wintermute's Apocalyptic virus from 29A#1.

Name: NuKE's Randomic Life Generator
Creator/Origin: Azrael / Argentina
AKA : NRLG
Type: Virus Creation Tool

Known versions:

NRLG 0.66B - June 1994

Features:

NuKE's Randomic Life Generator is an Argentinian virus creation tool released by a NuKE member who calls himself Azrael. Unlike PS-MPC's command line format it uses a user friendly interface similar to VCL and BW. More than 100 viruses produced with NRLG are known and most of them are detected by today's anti-virus products.

Name: Odysseus Macro Virus Construction Kit
Creator/Origin: Dark Shadow / Malaysia
AKA : OMVCK
Type: Virus Creation Tool

Known versions:

OMVCK 1.0 - March 1998

Features:

Generic tool that creates macro virus source codes (Word Basic) for Word For Windows 6 -7.

From the author's documentation:

"This construction kit produces an error free macro virus source code so that persons incapable of programming viruses can compile it into a working macro virus unlike some kits that produce code that cannot be compiled. Anywayz, you can modify the source code if you want to but please do not remove the [Created With Odysseus Version 1.0] marker in the macro virus source code. I spent 3 whole days on the project, at least I could do with some credit."

Name: Overwriting Virus Construction Toolkit
Creator/Origin: Virtual Daemon / SLAM / Unknown
AKA : OVCT
Type: Virus Creation Tool

Known versions:

OVCT 1.0 - April 1997

Features:

From the author's documentation:

"Overwritting Virus Construction Toolkit is a virus source generator program designed for makeing overwritting virii. The program is using a external configuration file (specified as the 1st parameter) for creating a virus. With this program can be created only overwritting virii!"

-overwritting COM infector
-save/restore file time/date/attributes
-change current directory (to '..' for more infections)
-checks for previous infections
-COMMAND.COM infection
-INT24h handler
-Anti-Debugger
-Encryption
-Anti-Anti-Virus
-create a .BAT file to compile fast your virus

Name: Poison In A Pretty Pill
Creator/Origin: Anti-State Tortoise / Unknown
AKA : PIAPP
Type: Virus Creation Tool

Known versions:

PIAPP 1.0a - Unknown

Features:

A macro virus generator with user selectable features by the creator of EMVCK:

Infectious Grooves:

FileSaveAs Infectious

AutoOpen Intectious

FilePrint Infectious

Copy Options:

Use Organizer Copy

Copy via Component Import

Other Fun Stuff

Make HelpAbout Display Message

Replace Words In Active Document

Relabel harddisk

Randomly Knock Windows Down

Name: Powerpoint Macro Generator
Creator/Origin: Knowdeth / USA
AKA : PMG
Type: Virus Creation Tool

Known versions:

PMG 1.1k - June 2000

Features:

A DOS based virus generator for Powerpoint macro viruses. A limited number of user selectable features are available. By the creator of TSWSVK, SABV, WISK and WVSG. It was released with Metaphase Zine #2.

Name: Phalcon-Skism Mass Produced Code Generator
Creator/Origin: P/S / USA/Canada
AKA : PS-MPC
Type: Virus Creation Tool

Known versions:

PS-MPC 0.90B - July 1992
PS-MPC 0.91B - August 1992

Features:

The American virus group competing with NuKE, Phalcon/Skism, quickly answered the challenge of VCL and published its own virus generator, the Phalcon/Skism Mass-Produced Code
Generator or PS-MPC in issue 8 of 40Hex.
PS-MPC has been written by a member of P/S known as the Dark Angel. PS-MPC is considerably more functional than VCL, though not as showy. PS-MPC does not feature a user interface for it is used via an ASCII configuration file.
It is possible to make considerably advanced viruses with the PS-MPC. It is capable of creating memory-resident viruses which infect both COM- and EXE files. Furthermore, the viruses can be provided with a versatile encryption layer, which makes finding them a little more difficult. PS-MPC does not add activation routines to the viruses it creates as a default, but since it produces ready-made, well-documented assembler source code, those can be later added easily by even a novice programmer. On all accounts, PS-MPC is a more functional program than VCL.
Hundreds of viruses created with PS-MPC are known and after Aristotle (former NuKE) released his Metric Buttload of Code Generator which produced hundreds of slightly mutated PS-MPC viruses, the VX-scene was swamped with "variants of PS-MPC".

Name: Primitive Trivial Generator
Creator/Origin: ByteSV / Russia
AKA : PTG
Type: Virus Cloning Tool

Known versions:

PTG 0.02 - February 2000

Features:

Utility that produces varying ASM source codes of the Trivial family viruses.

Name: Random Anarchy HTML Constructor
Creator/Origin: 1nternal / Australia
AKA : RAHC
Type: Virus Creation Tool

Known versions:

RAHC 0.1 - December 1998
RAHC 0.2 - March 1999

Features:

Author's note:

HTML.rahC is an HTML file constructor which will construct HTML files containing VBScript routines in accordance to options chosen in a form displayed in an HTML document. The scripts generated have the capability to duplicate the HTML file they are contained in into other HTML documents in a virus like manner. HTML.rahC therefore, is not a virus, nor a virus constructor, and should not be detected as such, if the HTML files generated have the capability to replicate, this is the users doing, much like a macro written in Visual Basic, and only the generations should be detected as viruses. The engine is written entirely in VBScript and due to the encoding of the script, requires VBScript version 5 to execute. This is available for download from http://msdn.microsoft.com/scripting/. The generations generated are also entirely VBScript. Although it would have been possible to write the engine using VBA, Delphi, C++, JScript or any other language, VBScript was chosen for several reasons:

The interpreter nature of the language allows for plugins to be included and edited without having to re-compile.

VBScript is in my opinion probably the easiest language to use ActiveX controls with and is not as strongly typed. This made it the best choice for generated code, and it seemed more logical to have the generated code in the same language as the engine itself.

The syntax of VBScript seemed easier to generate than that of JavaScript.

The file system routines generated make use of ActiveX which is only available to IE, and IE is also the only browser to support VBScript. Other browsers will ignore the script, as they wouldn't be able to execute it anyway.

However, JavaScript generations may have their use, as they are more universally supported, they would however not be able infect in browsers not supporting ActiveX. They could still however contain 'payloads' with custom triggers that would be able to execute in other browsers. I may, or may not, release a JavaScript version of the engine in the future with the capability to generate JavaScript based code.

Author's note on re-release (0.2):

This a re-release of HTML.rahC, which no longer requires VBScript v5.0 because the encoding is no longer present. All functionality is still present, however this means that the engine will now function under VBScript v3.0 or above. I have also removed the extra items from the package, and the programming reference, because by looking at the source it should no longer be necessary.

Properties Generation Name:
ID Tag:
Generation Seed: (leave blank for random)

Anti-AV Reghacks Disable 'Current User' My Computer Zone
Disable 'Local Machine' My Computer Zone

Execution Probability Only when offline (needed for FSO operations)
Everytime
On day of month
On day of week
Random 1/
Misc {If then}

Code Options Generate Junk Comment Lines
Generate Junk Comments
Random variable names

Infection Probability Only when offline (often not necessary)
No Infection
Everytime
On day of month
On day of week
Random 1/
Misc {If then}

File access method Read Host using CreateTextRange(). (Required for default infect file routine)
Text File
Text Stream
Random

Infection Select at least one
*.HTML
*.HTM
*.HTT
*.HTA
Misc Extension

Infect Folder Routine Default
CustomA (N/A)
CustomB (N/A)

Infect File Routine Default
CustomA (N/A)
CustomB (N/A)

Infect Folder Options* Check if folder exists
Check if file already infected

Traversal Single Directory Only
Parent Directories

Loop Options Do...Loop Until
Do...Loop While
While...Wend (Will endless loop if ActiveX prompt fails)

Infected Check Test String
Readline

Target Directories Infect Current directory
Infect Hard Coded Directories (enter only as many as needed)

PayLoad Trigger Only when offline (often not necessary)
Only Before Infection After Infection
No Payload
Everytime
Trigger on day of month
Trigger on day of week
Random Trigger. 1/
Misc Trigger {If then}

PayLoad Routine Msgbox
StatusBar
Redirect URL
Change Registry Key {RegWrite( )}
Delete File:
Misc Payload (Recommended)
Type here a custom payload.

Name: Replicating Batch Maker
Creator/Origin: Wavefunc / USA
AKA : RBM
Type: Virus Creation Tool

Known versions:

RBM - January 1997

Features:

This creator uses a HTML, Java and frames capable browser to create batch file viruses. It was released as a follow-on to the Incredible Batch Bug maker (IBBM).

Name: Resi Duo
Creator/Origin: Cordoba / Argentina
AKA : --
Type: Virus Creation Tool

Known versions:

Resi Duo - November 1995

Features:

Included and integrated in the Resi Duo VX E-zine, this tool has user selectable anti AV procedures and generates compilable ASM files. Made by Code Rebel and Andromeda.

Name: Satanic Brain
Creator/Origin: Azrael / Argentina
AKA : VCLSAT
Type: Virus Creation Tool

Known versions:

VCLSAT 1.0 - October 1993

Features:

Satanic Brain Virus Toolkit is basically a cracked/hacked and translated version of VCL released by NuKE member Azrael. The following year the author released NuKE's Randomic Life Generator (NRLG).
Most viruses produced with Satanic Brain scan as VCL products.

Name: Super Appending Batch VCK
Creator/Origin: Knowdeth / USA
AKA : SABV
Type: Virus Creation Tool

Known versions:

SABV 1.1k - October 1998

Features:

Like BVGEN, IBBM and RBM this program generates replicating appending batch virus programs from user-specified parameters. By the creator of TSWSVK, PMG, WISK and WVSG

Name: Sensi
Creator/Origin: Del_Armg0 / France
AKA : --
Type: Mirc Worm Creation Tool

Known versions:

Sensi 0.2 - May 1999
Sensi 1.1F(rench) - June 1999
Sensi 1.1E(nglish) - July 1999

Features:

Tool capable of creating trojans, backdoors and worms for Mirc users. Release 1.1 is available in a French and English version.

Name: Simple Batch Virus Maker
Creator/Origin: Duke / Russia
AKA : SBVM
Type: Virus Creation Tool

Known versions:

SBVM 0.01 - January 1999
SBVM 0.02d - April 1999

Features:

Version 0.01of this simple Russian virus maker was released with issue #4 of the DVL e-zine. It is a CLI operated generator that creates batch viruses through a user configurable .CFG file. Version 0.02d was released with issue #6 of the DVL e-zine and is based on a Word 97 template and also creates batch viruses.They were created by the author of DPOG, DPVG, CTMWVCK and DVL. A hacked version of release 0.02d of this kit is known as MSCC.

Name: Simple COM Virus Generator
Creator/Origin: Respawned Evil / Russia
AKA : SCVG
Type: Virus Creation Tool

Known versions:

SCVG - December 1999

Features:

Very unstable (still found no working copy) virus generator that creates COM viruses using a configuration INI file.

Name: SiCem Virus Creation Lab
Creator/Origin: SiC / Unknown
AKA : SICEM
Type: Virus Cloning Tool

Known versions:

SICEM - March 1994

Features:

Very simple generic virus generator that creates viruses that are similar to the viruses created with IVP.

Name: $moothie's Macro Virus Creator 2000
Creator/Origin: $moothie / Unknown
AKA : SMVC2000
Type: Virus Cloning/Creation Tool

Known versions:

SMVC2000 1.0 - July 2000
SMVC2000 2.0 Beta - August 2000
SMVC2000 2.001 - September 2000

Features:

While version 1.0 only has a limited number of user selectable features versions 2.0 offers multiple infection techniques, stealth, polymorphism, retro functions and multiple payloads. Version 1.0 has lengthy graphical startup and shutdown effects (version 2.0 shutdown effects only) and both should produce ASCII source codes on the user's desktop.

Name: Senna Spy Internet Worm Generator
Creator/Origin: Senna Spy / Brasil
AKA : SSIWG
Type: Script Worm Creation Tool

Known versions:

SSWIG 2000 1.0 - February 2000

Features:

Similar to VBS Anthology (Evolution), Windows Scripting Host Virus Generator and The Simple WinScript Virus Kit this kit creates VBS script files. Similar to VBS Anthology (Evolution) these scripts have worm like features and work thru e-mail.

Name: The Simple WinScript Virus Kit
Creator/Origin: Knowdeth / USA
AKA : TSWSVK
Type: Script Virus Creation Tool

Known versions:

TSWSVK 1.1k - June 1999

Features:

This program generates replicating overwriting WinScript viruses from user-specified parameters. By the creator of PMG, SABV, WISK and WVSG

Author's note:

"This is a "Simple" menu drive visual application for creating WinScript virii "Also Know as" VBS virii. This program generates replicating overwriteing Winscript virus programs from user-specified parameters. Basicly "EG. Fill in the Blank and press Make Virus" :-) These Virii are based off the of The modifyed form of VBS.Rabbit virus AS ID by AVP - "plug for _rod_ " ;-) Specail thanks to Lord Natas/CodeBreakers for makeing VBS.Rabbit in the first place and getting the whole VBS thing started! Hopefully some one will get a copy of this and pick up a intrest in a new programing style of HLL."

Name: Skywalker's Virus Creation Laboratory
Creator/Origin: Skywalker / Russia
AKA : SkyVCL
Type: Virus Creation Tool

Known versions:

SkyVCL 1.0 - August 1996

Features:

This generic DOS based virus creator from Russia.has several user selectable payloads and has the option of creating appending COM viruses, encrypted COM viruses or resident EXE viruses. A Russian and English translated version are known.

Translated version.

Name: Sphinx Virus Generator
Creator/Origin: Sir-X / Philippines?
AKA : SVG
Type: Virus Cloning Tool

Known versions:

SVG 1.0 - June 1998

Features:

Like Virugene by the same author this creator is basically a dropper tool that creates viruses in three different (user selectable) variants. It uses datafiles and personalized copies of TASM and TLINK and to decrease chances of detection it uses the Golden Cicade Abnormal Engine (GCAE) and ICE (Compression engine).

Name: SkamWerks Labs Word Concept Construction Kit
Creator/Origin: SkamWerks / Skammy
AKA : --
Type: Virus Creation Tool

Known versions:

Word Concept Construction Kit 1.0a - January 1997
Word Concept Construction Kit 1.0b - January 1997
Word Concept Construction Kit 1.1 - February 1997
Word Concept Construction Kit 1.1b - February 1997

Features:

This 32-bit (Win95/NT) Microsoft Word For Windows macro virus or trojan creator uses the Win95 wizard technology to create viruses or trojans. Many options, like what Auto macros to use, are selectable. A limited number of payloads is provided. For the more advanced user it is possible to use a design shell to create or modify macro viruses. The program can create both source codes or infected documents.

Name: The Macro Access Kit
Creator/Origin: Angelskitten / Unknown
AKA : TMAK
Type: Virus Cloning Tool

Known versions:

TMAK 1.0 - June 2000

Features:

Generic cloning tool that creates/modifies a preset source code for Access 97 viruses by using HTML/Forms coding. It was released with Metaphase Zine #2.

Name: The Pascal Overwriting Kit
Creator/Origin: GzR / Unknown
AKA : TPOK
Type: Virus Cloning Tool

Known versions:

TPOK 1.0 - August 2000

Features:

This simple kit creates varying samples of .PAS source codes of overwriting viruses. Activation day and displayed message text are user selectable. To create a working virus some modification of the code by the user is required. By the creator of IBWK.

Name: Ultras Construction Kit
Creator/Origin: Ultras / Russia
AKA : UCK
Type: Virus Creation Tool

Known versions:

UCK 1.0 - April 1998
UCK 1.0b - May 1998
UCK 2.0 - November 1998

Features:
Virus creation program that creates macro viruses for Word 6.0 - 7.0. It has several user selectable features and payloads. Release 2.0 is a bugfix and adds 2 payloads.

Author's notes:
Here is and my first constructor, it very small but does viruses with
good payload below I their describe.

Infect: AutoOpen - this macros main and its no in menu.
        AutoClose - additional macros.
        AutoNew - additional macros.
        AutoExit - additional macros.
        AutoExec - additional macros.

KillAV: Destroys all popular AntiVirus.

PayLoad: New Icon - changes icons on document.
         Kill Desktop - not display icons on desktop.
         Exit Windows - Exit Windows.
         Document Info - Puts in field of the document.
         Kill Windows95 - deletes vmm32.vxd hereon kill windows95.
         Message Box - Message Box.
         Set Password - puts password on your choice.
         Registers in Word - registers word on your name.
         Random Password - puts free password.
         Kill Windows Files - deletes folders windows.
         Kill Program Files - deletes folders programm files.
         Kill Dll - deletes on mask .dll files in windows\system directory.

Stealth: at openings ToolsMacro or ToolsCustomize or FileTemplates infects system.
Name: Unknown's Virus Creator
Creator/Origin: Executioner / Canada
AKA : UVC
Type: Virus Creation Tool

Known versions:

UVC 1.00 B - January 1997

Features:

This virus generator was incorporated in the second issue of the e-zine "Turmoil" released by Living Turmoil in May 1997.

A quote from the author:

This is a recent product, which is somewhat of a mutation engine for a very simple virus. The idea behind it is, why make a generator that can produce a thousand different types of virus, yet have all of them so simple that they ca be detected by any scanner after they make a few thousand samples? Instead, take one virus, and permute it in such a way that it is extremely difficult to detect generically without writing some sort of advanced heuristic, probably with a code analyser?

So the UVC was born.

There are only a few instructions that are permuted, specifically the following:

MOV register, immmediate operand
MOV memory, immediate operand
XCHG reg, reg
CMP reg, imm
SUB reg, reg
SHR reg, imm
SHL reg, imm
MOVSB

Name: VBS Anthology
Creator/Origin: VBS Guy / Unknown
AKA : --
Type: Script Worm Creation Tool

Known versions:

VBS Evolution 1.0 - May 2000
VBS Anthology 1.0a - May 2000
VBS Anthology 1.21 - May 2000

Features:

Created during the "I Love You" virus/worm hype this kit creates VBS script worms for Windows Scripting Host (WSH). An early version was named "Evolution". This kit is similar to the Windows Scripting Host Virus Generator, The Simple WinScript Virus Kit and Senna Spy Internet Worm Generator 2000 (SSIWG).

Name: VBS Virus Kreator
Creator/Origin: Unknown / Bosnia Herzegovina
AKA : VBSVK
Type: Script Worm Creation Tool

Known versions:

VBSVK 1.0 - August 1999

Features:

Largely unknown. Script worm generator with several replication options all displayed using the Yugoslav language.

Name: VBS Worms Generator
Creator/Origin: [K]Alamar / Argentina
AKA : VBSWG
Type: Script Worm Creation Tool

Known versions:

VBSWG 0.01 - June 2000
VBSWG 0.80 - July 2000
VBSWG 0.90 - July 2000
VBSWG 0.91 - July 2000
VBSWG 0.95 - July 2000
VBSWG 1.00 - July 2000
VBSWG 1.10 - July 2000
VBSWG 1.50 - July 2000
VBSWG 1.50b - August 2000

Features:

Script worm generator with several replication options, primarily aimed at Outlook, Mirc and Pirch.

Author's note(version 1.5):

Features:

Start with windows:
This make the worm be executed every time windows is started, so your worm can try to infect or spread every day.

Worm backup:
It's just for having a copy of the worm in a safe place, so you can be sure that it will not be lost.

Outlook Replication:
Send as attachment: It uses the same function that all the vbs's, js's or any other kind of worm, it sends a message, that you can define, with the worm attached to every person in the user's address list.

Send in html code: The worm is added to the html code of the message, so, when the person views it, they're infected!

Mirc replication:
Search for mirc.ini(what means that the mirc is there) in the most commons folders (programfiles\mirc, c:\mirc, c:\mirc32) and if it is found, the worm create "script.ini" in that folder, that script make the mirc sends the worm to every person that join to a channel. (see "If found Mirc, infect.")

Pirch replication:
Same as mirc, but for pirch (i haven't tested the script cause i haven't got pirch, please someone test it and tell me if this work).

Infect Files:
The worm will search for all the hard drives (and the network drives too, i think) for files with the extencion that you want (in this version only .vbs and vbe are searched) and copy overwrite him with itself.
*If found Mirc, infect:
This will make the worm to search also for mirc.ini, so if it find him, it will infect the folder where mirc is. This method works 100% of the times.

'To do a search for all the computer could take over 5 minutes, depending of the hard drive size.

Payloads:
These are stuff that you can add to the worm to be done.

Message: shows a message box whit the text and the picture that you want.

Open web address: open the web address that you want.

Crash System: Creates 1Mb variables until the system goes down of memory

Crash System 2: Runs notepads until the system crash

When?: with this you can tell the worm when do you want to execute the payloads.

Save as default:
If you click this button in any window, the options selected are going to be the same every time you run the program, i think that it's nice.

Extras:

Anti deletion method: The worm load all his source in memory, and if the worm is deleted is created again. The worm keeps running in memory.

Crypt code: The code of the worm is encrypted and nobody know what it says!.

Download end execute files: Put the address of a file that you want to download to the infected user machine, and that will be put as the startup site for Ie, and if the person downloads it, will be executed The code is taken fro mthe Iloveyou worm, and have some modifycations.

Name: Virus Creation 2000
Creator/Origin: Havoc The Chaos / USA
AKA : VC2000
Type: Virus Creation Tool

Known versions:

VC2000 0.95 - not released
VC2000 0.96 - December 1993
VC2000 0.97 - January 1994

Features:

Author's note:
"The Virus Creation 2000 System (VC2000), is a virus creator designed for complex code generation, great configurability, and ease of use. There is only one file that you need, VC2000.EXE (which is presently under 22k). After asking you a series of questions, it will then create a MASM/TASM compatible assembly source code of your virus, along with a "MAKEVIR.BAT" which helps speed things along a bit. Another great option, is the virus detector, which you can custom configure. This will trap an interrupt, and when the virus calls the interrupt with DX equaling what you set it for, it will warn you and give you an option to halt the program."
Version 0.97 comes with one virus and a VC2000 detector. The produced code does not contain any activation routines.

Name: Virus Creation Laboratory
Creator/Origin: NuKE / USA
AKA : VCL
Type: Virus Creation Tool

Known versions:

VCL 1.0 - July 1992

Features:

Late in summer 1992 the next virus toolkit software was published: the Virus Creation Laboratory or VCL. Behind VCL stands the Nowhere Man, a member of the American group of virus writers, NuKE. VCL is quite a remarkable product: it features a colorful graphical interface of nearly commercial quality with mouse control and drop-down menus, it is installed with a separate installation program and it is supplied with quite accurate and well-written documentation. VCL also contains the ICO and PIF files, with which it can be handily installed in the Windows Program Manager.
It is possible to easily create several different kinds of viruses with VCL. From the menus one can choose between a COM file -infecting, a companion virus or an overwriting one. In addition to those, Trojan Horses and Logical Bombs can also be made with VCL. The Virus Creation Laboratory is an application of considerable versatility. By using it, it is possible to define exact activation conditions for a virus made with it, those being, for example, the date, time of the day, the number of infected files, a computer's country code, the version of DOS or the amount of available RAM.
VCL presents many alternatives for the activation routine of a virus or a Trojan Horse. Selections mentioned on the menu are crashing the computer, a corruption of files, the printing of a freely chosen text on the screen or printer, the overwriting of whole disks and the playing of a music sample that can be freely composed. In addition to this, the user can add routines to the program's menu. When a user has chosen the desired options, VCL creates the assembler-language source code of a virus or a Trojan Horse on the disk. The user can, if he so wishes, edit it still further before compiling it into an executable form.
Despite its great versatility, VCL has not become very popular among virus hobbyists. There are many reasons for this, but the most important probably is that the majority of anti-virus programs were able to find almost all the viruses made by VCL soon after it had been published. In fact, F-PROT recognized most of them even before VCL had been analyzed at all. The functionality of VCL at the hands of virus tinkers is further reduced by the fact that it occasionally makes viruses that do not work at all - most of the source codes it creates cannot even be compiled with an assembler compiler. The Nowhere Man has, however, announced that he is working on a new version of the program - a possible VCL for Windows is also speculated in the documentation of VCL 1.0.
There are many interesting details to be found in the extensive documentation of VCL. Among other things, the Nowhere Man forbids the makers of anti-virus software from extracting search character strings from VCL or the viruses made by it. The initial package came with 8 viruses made with VCL and by now numerous viruses made with VCL are roaming the VX-boards.
In April 1994 Firecracker (then NuKE) released his VCL Mutator intended to make VCL viruses unscannable again.

Name: Virus Construction Set
Creator/Origin: VDV / Germany
AKA : VCS
Type: Virus Creation Tool

Known versions:

VCS English - 1990/91
VCS German - 1990/91

Features:

Virus Construction Set, or VCS, published in 1990, was the first program whose sole purpose was the creation of viruses. VCS is of German make, and its authors have announced themselves as Verband Deutscher Virenliebhaber, which translates as "The German Association of Virus Lovers".
As a program, the VCS is quite simple: the user is asked to give the name of the text file the will be linked into the virus and the number of generations after which the virus should activate. After this, the program creates a file called VIRUS.COM on the disk.

A created virus has a basic construction that is always the same and easily recognizable. The virus infects other COM files and activates after the predefined number of infections. Then it overwrites the files C:\AUTOEXEC.BAT and C:\CONFIG.SYS and prints the text that was linked to it
when it was made.

The viruses created by VCS contain one slightly advanced feature: they check whether an anti-virus program called FluShot Plus is active in memory and will not spread if that is the case.
Both an English and a German version of the Virus Construction Set have been made.
Around 15 variants of viruses made with VCS are known.

Name: Virus Draftion Center
Creator/Origin: Unknown / Unknown
AKA : VDC
Type: Virus Creation Tool

Known versions:

VDC 0.99B - March 1996

Features:

This creator made looks very similar to Mnemonix' virus creator Biological Warfare. It has similar features and routines but is buggy and will not run under Windows 95.

Name: Virus Factory
Creator/Origin: Sirius / Germany
AKA : VF
Type: Virus Cloning Tool

Known versions:

VF 1.0 - October 1994

Features:

Basic user shell to generate the source code to the Ebbelwoi 34 virus by Sirius. When executed the program thru two random virus knowledge questions determines if it should give the user access. It continues by asking for a virus name, an author name and a source file name. It concludes by generating a "personalized" source code.

Name: Virus Generator Tool
Creator/Origin: Andry Christianz / Indonesia
AKA : VGT
Type: Virus Cloning Tool

Known versions:

VGT 1.0B - March 1997

Features:

This very basic DOS based boot sector virus dropper is just a borderline virus creation tool since it drops one and the same boot sector virus (Den-Zuk) to a diskette every time.

Name: Virus Kit
Creator/Origin: Stalker-X / NuKE / RSA
AKA : VKIT
Type: Virus Creation Tool

Known versions:

VKIT 1.0 - August 1995

Features:

Simple generic virus creation tool to create viruses capable of infecting Windows 3.1 .EXE executables. User can input a text string and can set internal infection counter. Later evolved into the Windows Virus Engine (WVE) by the same author.

Name: Virus Laboratory for DOS
Creator/Origin: Damien / Unknown
AKA : VLAB
Type: Virus Creation Tool

Known versions:

VLAB 2.0 - March 1996

Features:

A 1996 addition to the the virus creation market this package creates A86 compatible source codes. It comes with two demo viruses and has several user selectable feautures.

Name: Virus Lab Creations
Creator/Origin: Trixter / USA
AKA : VLC
Type: Virus Creation Tool

Known versions:

VLC 1.1 - March 1995

Features:

A 1995 addition to the the virus creation market this 1Mb package came complete with compiler and linker. The tool was coded by Trixter and White Cracker of HTC '95. No viruses produced with the kit are known.

Name: Virus MaKer Lab
Creator/Origin: Il Tagliaerbe / Italy
AKA : VMK
Type: Virus Creation Tool

Known versions:

VMK 1.0 - 1994/1995

Features:

Very simple, generic virus generator that creates viruses that will infect the first 10 directories of the disk. The user can select some basic payloads, activation dates, a message to display and the file to infect.

Name: Virus Making Laboratory
Creator/Origin: BzZ / Russia
AKA : VML
Type: Virus Creation Tool

Known versions:

VML 1.2b - August 1998

Features:

DOS based virus generator with several user selectable features and payloads.

Name: VicodinES Macro-Poppy Construction Kit
Creator/Origin: VicodinES / USA
AKA : VMPCK
Type: Virus Creation Tool

Known versions:

VMPCK 1.0a - January 1998
VMPCK 1.0b - February 1998
VMPCK 1.0c - July 1998
VMPCK 1.0d - September 1998

Features:
After DW97MVCK this kit is the second Word for Windows 97 Macro Virus construction kit. It has many advanced and user selectable features. Version 1.0b has additional payloads that enable a dropping function for existing Windows 95 viruses and a phone dialer function. Version 1.0c adds SR-1 compatibility.Version 1.0d was released as part of the VicodinES Infection Suite (VWIS) that combines all of VicodinES' macro virus tools.
From the author's documentation:
The options available in this kit (1.0b) are the following

Infection via :

    AutoOpen
    AutoExec
    AutoClose
    AutoExit
    Edit|Find
    File|Close
    File|Exit
    File|Print
    File|Save
    File|SaveAs
    Tools|Options
    Tools|Macro - stealth infection
    File|Templates - stealth infection
    View|VBCode - stealth infection

Stealth options :
    Basic stealth hooks
    Stealth hooks with an infection routine
    Stealth hooks with a payload
    Stealth hooks with a payload and an infection routine
    add a fake error message to the Stealth hook
    delete the Tools|Macro and Files|Templates options from Word

Payload trigger options :

    Triggered by invoking a stealth menu
    Triggered by random number
    Triggered by a time/date

Payload options :

    Kill active document
    Phone Dialer
    Close Windows95
    Endless print loop
    Replace selected words
    Launch a URL
    Drop A File Virus
        -[Anxiety ]
        -[Cabanas ]
        -[Dogpaw  ]
        -[Lizard  ]
        -[Memorial]
        -[Navrhar ]
        -[Red Team]

Extra code :

    IconDisco
    Read-Only Template Remover
    Change The Document Properties
    Help|About message box
    Birthday Greeting message box
    Random message box
    Network Drives Dropper Option
    Agressive Find-Infect Routine
Improvements :
    Code is now Windows NT "aware"
The options available in this kit (1.0c) are the following

Infection via :

        AutoOpen
        AutoExec
        AutoClose
        AutoExit
        Edit|Find
        File|Close
        File|Exit
        File|Print
        File|Save
        File|SaveAs
        Tools|Options
        Tools|Macro - stealth infection
        File|Templates - stealth infection
        View|VBCode - stealth infection

Stealth options :

        Basic stealth hooks
        Stealth hooks with an infection routine
        Stealth hooks with a payload
        Stealth hooks with a payload and an infection routine
        add a fake error message to the Stealth hook
        delete the Tools|Macro and Files|Templates options from Word

Payload trigger options :

        Triggered by invoking a stealth menu
        Triggered by random number
        Triggered by a time/date

Payload options :

        Kill active document
        Phone Dialer
        Close Windows95
        Endless print loop
        Replace selected words
        Launch a URL
        Drop The Earthquake Simulator
Extra code :

        IconDisco
        Read-Only Template Remover
        Change The Document Properties
        Help|About message box
        Birthday Greeting message box
        Random message box
        Change The Hard Drive Label
        Network Drives Dropper Option
        Agressive Find-Infect Routine

Improvements :

        Code is now Windows NT "aware"
        Code is now 100% SR-1 Compatable
Name: Virus Maker Lab TM
Creator/Origin: Gamer / Unknown
AKA : VMT
Type: Virus Creation Tool

Known versions:

VMT 1.0b - July 1999

Features:

Simple, generic virus creation tool. This initial beta version can only produce one virus. It uses debug to compile an internal script.

Name: VicodinES Word Infection Suite
Creator/Origin: VicodinES / USA
AKA : VWIS
Type: Virus Creation Tool

Known versions:

VWIS 1.0 - September 1998.

Features:

This latest tool by VicodinES combines/integrates a new version of VMPCK, VSMP and VVSC

Name: Virus Generator
Creator/Origin: Sir-X / Philippines?
AKA : Virugene
Type: Virus Cloning Tool

Known versions:

Virugene 1.0 - January 1998

Features:

This creator is basically a dropper tool that enables the user to create several existing viruses. It uses datafiles and personalized copies of TASM and TLINK. The in .DAT format enclosed viruses are PS-MPC, Clone, Lite and PSI related. The Sphinx Virus Generator (SVG) by the same author works similarly.

Name: Virus Generator On Line
Creator/Origin: Mad Daemon / Unknown
AKA : VGOL
Type: Virus Creation Tool

Known versions:

VGOL - April-December 1998

Features:

The first online virus creator that uses CGI scripts to create simple DOS viruses. The virus creator presents a HTML form with user selectable virus features. At the end it will compile a VG.GCI file that is a virus.

Author's info: Welcome to the Virus Generator On-Line

Hello! This is the first virus generator on the web. Do you want to have your own virus? Are you too lazy to learn assembler and write virus yourself? Are you afraid of downloading ms-dos virus generators? Never mind. I have created virus generator on the web for you. Just set virus parameters in your web browser and cgi-script on the server makes the virus for you. It's so easy. Then you can execute the virus on machine of somebody you don't like.

VGOL is 100% linux. Cgi script variable QUERY_STRING is first processed with a parser that extracts parameters, the parameters are passed to the processor. The processor chooses which parts of code should be included and which not - the output of the processor is a virus source code. It is assembled with linux assembler AS86.

Look for it here [December 1998]

Name: VisuaLand Word Virus Generator
Creator/Origin: Milky Wahyudi Widjaya / Indonesia
AKA : VLWVG
Type: Virus Creation Tool

Known versions:

VLWVG 1.0 - January 1997

Features:

Unknown. Word for Windows macro virus creation tool. One virus created with the 'tool', Visualand, is known. The existence of this tool is possibly a hoax, the named/quoted creator denies his involvement and will not take credit for it.

Name: Virus Replication Generator
Creator/Origin: Hyperhybrid / Sweden?
AKA : VRG
Type: Virus Creation Tool

Known versions:

VRG 1.1 - July 1996

Features:

This basic DOS based virus generator creates compilable ASM source files or VRG configuration files. It has a limited number of payloads, an activation time/date is user selectable and it claims antiTBAV and FPROT stealth features.

Name: Word 97 Macro Virii Creation Kit
Creator/Origin: jackie twoflower / Austria
AKA : W97MVCK
Type: Virus Creation Tool

Known versions:

W97MVCK1.0 - May 1999

Features:

Released as a tribute to VicodinES' work (VMPCK and VWIS) this is a German/Austrian Word 97 macro virus generator. It is SR-1 compatible, has 10 user selectable payloads and has two polymorphic options (APMRS by Pyro and SPS, an APMRS derivative by jackie twoflower). After installation it adds a new menu called "Word 97 Macro Virii Creation Kit" to Word 97. By the author of LiME.

Name: WolfDEM's Batch Virus Creator
Creator/Origin: WolfDEM / Unknown
AKA : WBVC
Type: Virus Creation Tool

Known versions:

WBVC 1.0 - July 2000

Features:

Generic batch virus creator with a limited number of user selectable features. It needs VBRUN300.DLL to function.

Name: Worm IRC Script Kit
Creator/Origin: Knowdeth / USA
AKA : WISK
Type: Script Worm Creation Tool

Known versions:

WISK 1.1k - July 1999

Features:

Author's Note:

This is a "Simple" menu driven visual application for creating mIRC Worms. This program generates replicating mIRC Worm like programs from user-specified parameters. Basicly "EG. Fill in the Blank and press Make Worm" :-) Hopefully some one will get a copy of this and pick up a interest in programing HLL. New versions of mIRC do not support this type of worm at all only version 5.3x and before which use the same download dir as the mIRC program is located."

It was released with Metaphase Zine #2. By the creator of PMG, TSWSVK, SABV and WVSG .

Name: Word Macro Virus Construction Kit
Creator/Origin: Nightmare Joker / SLAM / Germany
AKA : WMVCK
Type: Virus Creation Tool

Known versions:

WMVCK 1.1 (German) - August 1996
WMVCK 1.1 (English) - December 1996
WMVCK 97 (German) - July 1998

Features:

This is a macro word utility for creating Macro.Word (Word 6 /95) viruses.
It contains the macros: DAT1,DAT2, DAT3, DAT4, DAT5, DAT6, DAT7, DAT8, DAT9, DAT10, DAT11, DAT12, DAT13, DAT14, DAT15, DAT16, DAT17, DAT18, AutoExec, AutoOpen.

Like many Word 6/95 (WordBasic) viruses that were converted to Word 97 (VBA) the Word 97 version of this kit is a conversion of the initial German version and uses the "WordBasic" instruction in the VBA environment.

This constructor can create macro viruses containing the following ten virus droppers:

1 = Casino Virus - Casino.2330
2 = Media Markt Virus - VCL.Markt.1533
3 = MTE.Shocker - MtE.Shocker
4 = Sirius.Alive - Sirius.Alive.4608
5 = SMEG.Queeg - Smeg
6 = Tequila - Tequila
7 = Virogen - VICE.05.Code.3952
8 = Uniform [Boot Virus] - Uniform
9 = Bizatch/Vlad - Win95.Boza.c.(intended)
10 = Tremor - Tremor

The generator generates essentially one and the same virus. The user is allowed only to change the message that gets appended to the printed documents and to select which one of the 10 possible DOS viruses is to be dropped by the macro virus. It generates infected Word documents.

The initial generator works only on the German version of Word (and generates German language specific WordMacro viruses) A later English version was released. In December 1996 the same author released the Demolition Kit, the macro virus generator follow-on.

Both Versions:

Name: Word Macro Virus Hamburger
Creator/Origin: Bie / Taiwan
AKA : WMVH
Type: Virus Creation Tool

Known versions:

WMVH 1.0 - February 1997

Features:

This is the first Macro Virus Generator created in Taiwan and using the Chinese version of MS-Word. It came with one demo virus. It plays the theme of "Mission Impossible".
User selectable payloads are droppers for the following viruses:

Stoned
Taboo
MacGyver
Terror
AntiEXE
Typo

Name: Windows Scripting Host Virus Generator
Creator/Origin: Bumblebee / Spain
AKA : WSHVGEN
Type: Script Virus Creation Tool

Known versions:

WSHVGEN - May 1999

Features:

Similar to IBBM, RAHC. RBM and VGOL this generator allows for online virus creation. The generator creates Windows script viruses and can be found here [May 1999].

Author's note:

"WSHVGen is a small script generator -this version only for VBS- that allows you to make simple viruses that work in WSH. You need a net-browser that supports javascript to use it. WSHVGen is easy to use: Fill the following form to generate a new script. Note than Infection Sign must include only:- @ � # $ % | � � � � * like symbols. The generated virus infects all VBS files in current directory. If not infects at least one file, then shows a payload (a popup message). Too simple, just to learn. "

Name: Windows Virus Engine
Creator/Origin: Stalker-X / NuKE / RSA
AKA : WVE
Type: Virus Creation Tool

Known versions:

WVE 1.0 - August 1995

Features:

Simple generic virus creation tool to create viruses capable of infecting Windows 3.1 .EXE executables. User can include a text string and a predefined bomb/trigger. It is based on VKIT by the same author and it is one of the few Windows oriented virus tools around.

Name: Word97 VBA SR1 Generator
Creator/Origin: Knowdeth / USA
AKA : WVSG
Type: Virus Creation Tool

Known versions:

WVSG 1.1k - June 2000

Features:

A DOS based virus generator for Word97 (SR1 compatible) macro viruses. A limited number of user selectable features are available. By the creator of TSWSVK, SABV, PMG and WISK.

Name: X-Factor Virus Generator
Creator/Origin: Xarabas / Darkness Sons
AKA : XFVG
Type: Virus Cloning Tool

Known versions:

XFVG 1.01 - December 1998

Features:

Very simple, generic virus cloning tool that produces an overwriting virus.

Name: Ye Olde Funky Virus Generator
Creator/Origin: Greyfire / USA
AKA : YOFVG
Type: Virus Creation Tool

Known versions:

YOFVG 1.0 - March 1996

Features:

Author's quote: "YOFVG is a simple virus hacking kit, much like VCS (the very first virus maker) and VKit100 (allows you to make a windows virus). It took about an hour to write, including the virus code, and it was written in quickbasic. :< (Excluding the virus, which was, of course, written in asm.)

Name: ZeMacroKiller98 Macro Virus Construction Kit
Creator/Origin: ZeMacroKiller98 / France
AKA : ZMK98MVCK
Type: Virus Creation Tool

Known versions:

ZMK98MVCK - June 1998

Features:

Simple Word 97 macro virus creator by a French macro virus writer.

Author's note:

"You can use 4 payloads: delete system file, message box, assistant and password You can infect template on AutoOpen, AutoClose, AutoNew and document on AutoOpen, AutoClose, FileSaveAs and FileSave You can choose which macro calls the payload: AutoOpen, AutoClose, AutoNew, AutoExit."

Name: Zweiblum's Macro Virus Terror Kit
Creator/Origin: Zweilblum / Austria
AKA : ZMVTK
Type: Virus Creation Tool

Known versions:

ZMVTK1.0a - Unknown 1999

Features:

This macro virus generator is a predecessor to LiME and has multiple user selectable triggers, payloads and functions. It generates .BAS source codes and supports MS Word and MS Excel.

Properties	Generation Name: ID Tag: Generation Seed: (leave blank for random)
Anti-AV Reghacks	Disable 'Current User' My Computer Zone Disable 'Local Machine' My Computer Zone
Execution Probability	Only when offline (needed for FSO operations) Everytime On day of month On day of week Random 1/ Misc {If then}
Code Options	Generate Junk Comment Lines Generate Junk Comments Random variable names
Infection Probability	Only when offline (often not necessary) No Infection Everytime On day of month On day of week Random 1/ Misc {If then}
File access method	Read Host using CreateTextRange(). (Required for default infect file routine) Text File Text Stream Random
Infection	Select at least one .HTML .HTM .HTT .HTA Misc Extension
Infect Folder Routine	Default CustomA (N/A) CustomB (N/A)
Infect File Routine	Default CustomA (N/A) CustomB (N/A)
Infect Folder Options*	Check if folder exists Check if file already infected
	Traversal	Single Directory Only Parent Directories
	Loop Options	Do...Loop Until Do...Loop While While...Wend (Will endless loop if ActiveX prompt fails)
	Infected Check	Test String Readline
Target Directories	Infect Current directory Infect Hard Coded Directories (enter only as many as needed)
PayLoad Trigger	Only when offline (often not necessary) Only Before Infection After Infection No Payload Everytime Trigger on day of month Trigger on day of week Random Trigger. 1/ Misc Trigger {If then}
PayLoad Routine	Msgbox StatusBar Redirect URL Change Registry Key {RegWrite( )} Delete File: Misc Payload (Recommended) Type here a custom payload.