Virus is a computer program that can copy itself and infect computers.
The term "virus" is erroneously used to refer to other types of malware, including adware and spyware programs that do not have the reproductive ability.
A true virus can spread from one computer to another (in some form of executable code).
One of the ways by which a virus can infect your PC is through USB/Flash drives.
Common viruses such as 'Ravmon' , 'New Folder.exe', 'Orkut is banned' are spreading through USB drive .
Most anti virus programs are unable to detect them and even if they do, in most cases they are unable
to delete the file, only quarantine it.So in our post we use command prompt to remove harmful files that
any anti-virus can't.


These are the steps.

Step 1:

 Run the command prompt by going to start and type cmd on the search programs and files.

Step 2:

 Select the virus affected drive
                 (drivename: )
examples
C:
J:
F:
D:
E:

Step 3:

 type attrib -s -h *.* /s /d then press enter

Step 4:

 type dir 
        the dir command shows you the content of the drive

Step 5:

check if there is an unusual .exe file
                 if there's an autorun.inf file rename it

                    (rename filename.extension newfilename )

Step 6:

by doing the following steps you can now acces the drive without affecting the virus

 Go to my computer

Step 7:

Select the drive

Step 8:

Delete the harmful files
             *you can also delete the harmful files using command prompt
              ( type del filename)

About author
hiiii......, this is ajay, woking as a technical engineer, a tech geek, enjoys ethical hacking

Read More »

In this post, I will show how to create a simple virus that disables the USB ports on the computer (PC). As usual, I am using my favorite C programming language to create this virus. Anyone with a basic knowledge of C language should be able to understand the working of this virus program.

Once this virus is executed it will immediately disable all the USB ports on the computer. As a result you’ll will not be able to use your pen drive or any other USB peripheral devices on the computer. The source code for this virus is available for download. You can test this virus on your own computer without any worries since I have also given a program to re-enable all the USB ports.

1. Download the source code of the virus program on to your computer from the following link:
   Download the USB_Block.rar
   The download contains the following 2 files:
   • block_usb.c (source code)
   • unblock_usb.c (source code)
2. You need to compile them before you can run it. A step-by-step procedure to compile C programs is given in my post - How to Compile C Programs.
   3. Upon compilation of block_usb.c you get block_usb.exe which is a simple virus that will block (disable) all the USB ports on the computer upon execution (double click).
3. To test this virus, just run the block_usb.exe file and insert a USB pen drive (thumb drive). Now you can see that your pen drive will never get detected. To re-enable the USB ports just run theunblock_usb.exe  (you need to compile unblock_usb.c) file. Now insert the pen drive and it should get detected.
4. You can also change the icon of this file to make it look like a legitimate program. For more details on this refer my post – How to Change the ICON of an EXE file (This step is also optional).

How it Works?

The idea behind the working of this virus is pretty straightforward. It works by gaining access to the Windows registry and modifying its settings to disable the USB device support on the computer.

On the other hand, the other program will re-set the registry settings back to the normal so that the support for USB devices is re-enabled. I hope you like this post. Please pass your comments.

Read More »

Most of us are familiar with the virus that used to block Orkut and Youtube websites. If you are curious about creating such a virus on your own, here is how it can be done.

As usual I am using my favorite programming language ‘C’ to create thiswebsite blocking virus. I will give a brief introduction about this virus before I jump into the technical jargon.

This virus has been exclusively created in ‘C’. So, anyone with a basic knowledge of ‘C’ will be able to understand the working of this virus program. When this program is executed, it will block all those websites that are listed in the source code. In the following example, the sites that are listed in the source code are Google, Yahoo and Youtube. When you download the source code of this program, you have a choice to include your own list of sites that you want this virus to block.

I have just removed the source code of this program from this post as it is lengthy and makes the post look messy. You can still download the source code of this virus program from the following link:

Download Block_Site.rar

How Virus Program Works?

The Windows operating system maintains a special file called HOSTS which can be used to block any given hostname or domain name (website) by adding new entries onto it. This program works by modifying the HOSTS file by adding new entries of those sites that are intended to be blocked. The HOSTS file is located at:

%windir%\system32\drivers\etc (Usually: C:\windows\system32\drivers\etc)

So, when you execute this program, all it does is add the entries of the list of those sites (mentioned in the source code) to this HOSTS file. Once this is done, the site will be blocked from your computer. So, none of the browsers would be able to load those sites on your computer.

For more information on HOSTS file, I recommend reading my other post on How to use HOSTS file to block websites.

Now, as far as the technical part of this program is concerned, people who have a working knowledge of ‘C’ should be easily able to understand the working of this virus program. However, for those who are new to ‘C’ programming, here is the algorithm of this program:

• Determine the Root drive. ie: Find the drive (C:, D:, E: or F:) on which the Windows is installed.
• Navigate to: %windir%\system32\drivers\etc
• Open/Load the HOSTS file.
• Copy a list of those websites that are mentioned in the ARRAY to the END of the file.
• Save the file and Exit.

How to Compile the Source Code?

For a step-by-step compilation guide, refer my post: How to compile C Programs?

Testing the Virus:

1. To test, run the compiled module. It will block the sites that are listed in the source code.
2. Once you run the file block_Site.exe, restart your browser program. Then, type the URL of the blocked site and you’ll see the browser showing error “Page cannot displayed“.
3. To remove the virus type the following command in the Run.
   %windir%\system32\drivers\etc
4. There, open the file named “hosts” using the notepad. At the bottom of the opened file you’ll see something like this:
   127.0.0.1 google.com
5. Delete all such entries which contain the names of blocked sites.

NOTE: You can also change the ICON of the virus to make it look like a legitimate program. This method is described in the post: How to Change the ICON of an EXE file?

Read More »

Most of you may be curious to know about how to make a Trojan or Virus on your own. Well, here is an answer to your curiosity. In this, post I’ll show you how to make a simple trojan on your own using the C programming language.

This trojan when executed will eat up the hard disk space on the root drive (The drive on which the Windows is installed, usually C: Drive) of the computer on which it is run. Also, this trojan works pretty quickly and is capable of eating up approximately 1 GB of hard disk space for every minute it is run.

So, I’ll call this as Space Eater Trojan. Since this program is written using a high level programming language, it is often undetected by antivirus programs. The source code for this program is available for download at the end of this post. Let’s see how this trojan works:

Before I move on to explain the working of this program, you need to know what exactly is a Trojan horse and how it works. Unlike what many of us think, a trojan horse is not a virus. In simple words, it is just a program that appears to do a favorable task but in reality performs undisclosed malicious functions that allow the attacker to gain unauthorized access to the host machine or cause a damage to the computer.

Now let’s move on to the working of our Trojan:

The trojan horse which I have created appears itself as an antivirus program that scans the computer for malware programs. However, in reality it does nothing other than eating up the hard disk space on the root drive by filling it up with a huge junk file. The rate at which it fills up the hard disk space it too high. As a result, the the root drive gets filled up completely with in minutes of running this program.

Once the disk space is full, the trojan reports that the scan is complete. The victim will not be able to clean up the hard disk space using any of the cleanup program. This is because, the trojan intelligently creates a huge file in the Windows\System32 folder with the .dll extension. Since the junk file has the .dllextension it is often ignored by the disk cleanup software. Hence there is now way to recover the hard disk space other than reformatting the drive.

The algorithm of the Trojan is as follows:

1. Search for the root drive.
2. Navigate to %systemroot%\Windows\System32 on the root drive.
3. Create the file named “spceshot.dll“.
4. Start dumping the junk data onto the above file and keep increasing its size until the drive is full.
5. Once the drive is full, stop the process.

You can download the Trojan source code HERE. Please note that I have not included the executable for security reasons. You need to compile it to obtain the executable.

How to compile the program?

For step-by-step compilation guide, refer my post How to compile C Programs.

How to test this trojan horse?

To test the trojan, just run the SpaceEater.exe file on your computer. It will generate a warning message at the beginning. Once you accept it, the Trojan runs and eats up the hard disk space.

NOTE: To remove the warning message you’ve to edit the source code and then re-compile it.

How to fix the damage and free up the space?

To remove the damage and free up the space, just type the following in the “run” dialog box:

%systemroot%\system32

Now search for the file “spceshot.dll“. Just delete it and you’re done. No need to re-format the hard disk.

 NOTE: You can also change the ICON of the virus to make it look like a legitimate program. This method is described in the post: How to Change the ICON of an EXE file ?

Please pass your comments and tell me your opinion. I am just waiting for your comments. 

Read More »