Interview with Benny
by *Zine
[Summer 1999]

29A is one of the todays most active groups and Benny/29A is one of their most active members, producing many W32-based viruses in a short periods. We offer you and interview with this czech programmer:

Who are you, where are you from and other personal stuff ...

Hmm, Ok, lets start. I'm Benny from Czech Republic (the middle of the Europe) and I'm member of 29A. Nowadays (summer 1999), I'm 17, I study computers on highschool and writin' viruses, engines and tutorials for/about Win32 platformz.

Benny, how did you get into computers?

I always wanted have a computer becoz many of my friends had their own computer. I became owner of my own PC, when I was 13. That was great time. I can remember, that all friends were playin' games, but only I was interested in programmin' and operatin' system itself.

Why did you start to be interested in viruses?

When I had my own PC, I heard about some weird things, such as PC viruses. But to hear wasn't enough for me and I wanted to know, how is it coded. I was fanatic to AVs descriptions and I wanted to code my own virus. I bought many boox, but nowhere was explained, how to code that. Then I found one perfect book, where I found source codes of PS/MPC viruses and Aragon boot virus. Great moment. I don't know, if I would be there, where I am without that book.

Was your PC infected by any virus (besides your own)?

Yeah, many times. My first computer was full of viruses. Then my friend borowed me one great antivirus. It was AVG 3.0. It had perfect heuristix, comparable with TBAV (maybe better). When u ran test of HD, it took program by program, lists all instructions it steped, list all triggled flags and everything. It could fake STEALTH viruses, it could read directly from disk, use XMS, trace INTs and much more. And that had very nice interface. U should see that. Wholy sci-fi! And it took me thinkin' about many things. Hehe, I can remember, I was runnin' that AV three times per day and I wanted from AV to find some virus, becoz I loved that feelin', when infected file was cleaned. Weird? Yeah, who said I'm not, hehe X-D?

What programming languages can you use?

My first language was PASCAL. Then I was very interested in ASM. When I had holidays, I decided I should learn C/C++. Two months of readin' some boox and I know everything about it. Then I know Delphi (a little only), Java (look at my page) and some scriptin' langs, such as HTML or JavaScript.

What's your favourite programming language and why?

I l0ve assembler. I can do everything, that I can't do elsewhere. I hate objects, visuals, components and sh!tz such like. Who doesn't know any low-level language ain't coder, but developer. Everybody can click and so create program, what it ain't thing I wanna do. If I can't see all resources it takes, whole source, registers, opcodes and otherz, I don't like it. I like to optimize and fully optimize my code and have fully control of my programm I can only in assembler. I don't like ppl, which don't like assembler 8-).

How did you get into vx comunity?

When I was surfing on internet, I found link to WM.CAP. There was link to 29A page and there I downloaded 29A#2 magazine. That was nirvana. I haven't ever seen so kewl zine as 29A#2 (except of this, ofcoz X-D). There I found some link to IRC. I didn't know, what da hell that IRC is. After some friends advices, I downloaded some client for IRC and went to hispanola IRC. Huh, I had a BiG luck. There were many good coderz at the same time and everyone was on-line! Everyone wanted to show me his page, they wanted to chat with me and when I said "I'm interested in Win32", noone stood under the control. I won't ever forget for that moment, when Darkman said: "Hey guy, u r that coder, we r lookin' for. Join 29A!". I couldn't believe, that the best VX group ever wants lammer such me. They said they wants me in da 29A and I thought, it ain't possible, it's only a dream. Then, I decided I must do everything to join that group.

What can you tell us about your first virus?

Hehe, it's funny story. If I'll forget to my first lame PASCAL EXE append virus, my first virus was Win32.Eva. That time, I hadn't any motivation and I promised myself, I will code something really kewl. Then it happened. I fell in the love with some nice girl. And becoz she didn't know it and it happened on Friday, start of weekend, I didn't know, what I should that dead weekend do. I decided it would be better to code something. By those three days, I coded, commented and debugged my first (Win32) virus. (Un)fortunately, Eva knows sh!t about computers and maybe it's better. However, I must give her all my thanx, becoz that was perfect enter to VX scene. Darkman was dead, when I said him "I have a virus for u. It's Win32.Eva and it's coded by me".

And the sure followed next pieces from your workshop. Tell us more about them.

Hmmm, there r many pieces from my workshop. And if u won't be bored of that, I will list here all I coded.

Viruses:


All these viruses have much more features than I said here. But if I would say all features, this interview would be all about my viruses and not about me...

Engines:


Tutorials:


Huh, that's all for now. But soon, u will be able to get more and more viruses/engines/tutorials... I code very fast, as many ppl say about me.

What your best virus you have ever written and what features it has?

Ok, my best virus is always that last one and everytime, I code something new, it's better than my previous work. Well, my best virus is for now Win98.BeGemot. It is first Win98 EXE/SCR/RAR/SFX/CPL/DAT/BAK resident, ring3, ring0, Pentium+, multithreaded, compressed, stealth, slow poly, fast infector, which contains communication interface that allows u to communicate with virus, if it's in memory. It uses SEH, undocumented opcode, and many more new features, by which is now undetectable by any AV. This is virus I'm the most proud of...

How did you get in 29A and what is the feeling 'to be in'?

Hehe, I don't know, how did I get in 29A. I wrote 3 viruses. And as I heard, my third one (Win32.Leviathan) was the thing, by which I am 29Aer. Thanx g0d X-D! When Reptile and Darkman said, I'm in 29A, I thought I will jump thru the window. It everything I wanted and when it came to me, I was 5 minutes in trans. That feelin' was great, really. Now what r my feelings? I won't lie u, I'm very proud on myself that I'm in 29A. It happens sometimes in your life only, that u r part of something great and that u r first human in the world, who did something. But becoz I promised to all 29A stuff I will do impossible for our group, I'm tryin' to do that. And also I won't forget my beginner ages so I try to help every beginner as much as I can. Everytime I do something, I ask myself, if that thing I did is right and if I'm lammer or if I'm not. Be selfcritic, that's very important thing. Think about u and about things, u did.

What are the most important technological advances in virus writing?

We r breakin' unbreakable. Still remember those old ages, when some guy XORed his virus and all AV world was absolutly mad of it? Now we use hi-technologies, such as poly, meta, stealth, anti-heur, anti-debug and things such like. We learn operating system and we know more, becoz we want it and becoz its our hobby. Without us, everybody would be developer or guy from microsoft. Without us, everybody would think on and on, that Windows is the best 32bit (huh) system in da world. We breakin' the law, we want know more and we know it.

In the history of the virus writing community, there was thousands of viruses, some of them elite, other absolute crap. What's your personal TOP 5 of viruses and why?

I have many favourite viruses and I don't wanna say, that that virus is better than that one. I will list them without any order...


There r many other viruses I like and I for sure forgot some, which I like more than that, which is listed above. But it's very hard to say, what's better, what's best and what's crap.

The same as for viruses can be applied to antivirus software (but they are here not thounsands but in some couple of dozens exmplares). Your personal TOP five of anvirus packages and reason(s) why:


And that's all. Next AVs I don't like very much. Bah, who likes AVs ;)

What do you think about AV people?

They r very smart ppl. Noone, who don't understand system at least as good as VXerz, can't be AVer. What I don't like is that all AVerz thinx, that we VXerz r stupid kiddos and again all VXerz means same about AVerz. To code kewl virus u must know OS and to analyse kewl virus, u need it same. It's wrong to compare two uncomparable things, such as to code tiny COM infector and to analyse OneHalf.

It's often posssible to meet you on IRC. What's your favourite channel?

Yeah, I'm there very often, usualy 7 days in week. My favourite channels r #vir and #virus on Undernet.

Did you ever meet someone from the scene in person (e.g. on the scene meet last summer) If so, how looks the meet like?

I didn't meat any VXer, but I will - this summer in Amsterdam.

What can you tell us about local Czech virus scene?

Hmm, not much. I think, there ain't any VX scene in czech republic. Many ppl may remember viruses such as Halloween, Raptor, Semtex, etc. That time, when there weren't any Windozes, czech was full of VX writers. Now, I don't know any ppl from Czech Republic, which is interested in Win viriis. That's a pity. Our ppl r full of potential and entusiasm...

Now the same question, but the Dark side of the force - Czech AV producents - how are the products, are they worth of testing against new viruses etc ...

I don't like czech AV products very much. I know, that czech AVAST! is the best scanner in the world. AVAST! reached 100% border in Virus Bulettin as the first scanner in the world. But AVAST!, over 100% virus detection hasn't any heuristix, so I don't like it very much. Same as czech AVG. AVG has heuristix for DOS files, but still not for Win32 files. That's baaaad. But let's wait... we will c...

Yeah, when I gave to one czech AV firm pattern of Win98.Milennium, they said, there ain't any viriis. When I asked them, on which OS they tested it, they said: "Win95". I said, it is Win98 specific virus and they replied: "hmmm, maybe." Ignorants!

Once, you told you know some AVG ppl, how is(are) the person(s) like?

Yeah, I know them, but I don't wanna explain here detaills, becoz they would have some problems with it. Some other AV firm could say, they have contact with VX ppl and that could be big pain for Grisoft. There ain't any contact, but however, ppl r jerx. Yeah, they have very nice secretaries (really! X-D) and those ppl r very, very smart. But similarly as other AVerz, they say we VXerz r only kids without any morals. But that is only their problem, rite? Nevertheless, I must say, that ppl from Grisoft r really very smart. No doubt!

Now, let's discuss some vx technologies, what do you think about use and perspectives of stealth, polymorphism, viruses under "other" operating systems ...

New operating systems, more holes, new/more places for viruses, new techs, etc. Viruses will stay with us. We will find new techniques for our babes, new ways for hidin' them, new targets to infect, etc. Now, it seems it will be metamorphism. What will be next? Who knows...

What do you think about payloads in viruses and especially the destructive ones?

Payload is the only thing, that should be visible to user. It's the way, how to show user virus presency. But destructive payloads, they r all lame. Many users will have problems with it and many AVs will rig money only becoz of some lammer. We will be more "persecuted" and we will have more and more problems. Destructivity ain't product of smart ppl.

Your opinion to the topic macroviruses and their perspectives:

When I tried to code macrovirus for WinWord97, I did it in a minute. Macrovirus can be beginnin', but codin' it is too much easy for ppl, which can do more than click and create. Normal viruses has more chances to be spreaded out than macroviruses. Computer can run without editor, but not without OS. However, I think macroviruses r still very perspective.

Are there some people from the vx & av scene you would like to meet in person?

I would like to meet every good VXer & AVer, whoever he is. I don't wanna say names here, becoz I would forget someone...

What do you think about the manics who want to prosecute virus writers?

They r rite. I know, that modifyin'/deletin' valueable data ain't rite way, how to show what is inside of me, but, but ...ehrm, ...but... I like taste of fame. Who not? X-D

Your relationship to beer, girls, inline skating and other important things:

Beer is da best thing in da world. Mmm, I can say, that I'm alcoholic, becoz I usualy drink 3, sometimes more litters per week. And, have I ever said u, that 50% of my work was written, when I was drunk? X-D No lie! Girls r something the most weird thing in da world. Who can understand them?

Favourite meal, drink, band, pub and the rest of the small joys of life:

I have many favourite meals, such as grill chix, pizza, hamburgers and so on. My favourite drink is beer and juice. Music, music is one of my most favourite things. And becoz I'm very weird human, I like both of light pop (e.g. ABBA) and hard rock (Lucie, Black Sabath, ...), sometimes I like also metal (Marilyn Manson). I like groups, which plays their own style. I like originality and I hate commerce. When there is group, which plays only for money, it ain't good band. And if there is group, which plays originaly and plays its own style, I can always find something great in it. What I like is oldies, becoz they played their own style, they had been originaly and they didn't play only for money.
My favourite pub? Hahaha, I would be very silly, if I would tell ya it. Sorry. But I can say, that I love every pub, where I can find any czech beer.
My last <drug>, which I use is nikotin. Yeah, I smoke cigs. I try to stop that money washin', but it's too hard for me X-D. Sometimes, I have a joint with my friends, but it's not very regulary.

Everyone today surfs the internet. Let's see someone of your favourites places on the web:

Hmmm, it's hard and I know I will forget some URLs for sure, but here r some URLs, I use regulary and I like them...

http://www.29a.net/ - page of da best VX group
http://post.cz/ - post server I use
http://www.coderz.net/vtc/ - VB's site. Tons of materials for VXerz
http://www.virusexchange.org/nop/ - Virogen's site, everything u want is there
http://www.microsoft.com/ - when I wanna laugh and my page, ofcoz X-D

Do you have webpage? If so, where is the page to find?

Sure I have. Informations there r usualy 2 months old and in internet, u can find tons of pages, which r absolutly better than mine. However, I like it and I'm proud for my Java: http://benny29a.cjb.net/

What about you plans for the future as coder and in general?

Hmm, I don't know, what will I do in the future. I know, that viriis r something, which I understand more as anything other. Maybe, I will be next AVer, in the future. I know, u will hate me, but what other I would like to do more than work with viriis. Other plans r very unbright. I would like to study university, but I know I'm not so smart. Well, I hope I will do something, I will really like.

Thanx for givin' me place for talkin' about myself and I hope u weren't bored. See ya sometimes, somewhere...