Printable View
:eek:
last night i was screwing around and made a bat file that erases windows useing the "deltree/y c:\windows" command.
i then scanned it with my av and it said it was fine no virus
so my ? is how do you protect your self from a a file that will erase your fiels but its not a virus
i dont go into dos and run the edit program on every file i download so is there a program out there that checks for that kind of thing?
you could not run them for starters. Im really not sure on howto scan for them, but you can just right click them and goto edit and or open with word/note-pad and just view the contents withought running them, instead of going into a dos shell every time. hope that helps some.
You'll seldom see a batch file alone for download these days.. and usually if you download a batch file it's a good idea to see what it does if you don't trust the site. It's true that an exe designed to delete files isn't classified as a virus and won't be detected, however system files and files that are in use won't be deleted. I'm sure you could do some damage still, but you'd be able to recover. If someone ran a batch file that deleted files on their system.... I'd prolly laugh at them... It's not something you should come by very often, probably never unless you're dealing with malicious websites and in that case it's your own fault.
The definition of a virus is a file that can replicate its own code. A malicious batch file has to be run by the "victim" so it isn't really much of a threat. Even if you were to rename it like readme.bat, anyone who knows anything will edit the file before running anything with a .bat extension. Also as HTRegz said, you can't delete windows entirely while in windows because many of the files are in use.
-NeuTron
Well seeing as though a batch file isn't an executable , nav can't really help you much . But to see it's contents what you would have to do is to right click on the batch file and click 'edit'.
Then you can see if it contains any malicious commands.
Not that I would try it... seeing as I can't find my Virtual PC of Windows XP... but don't OS's like Windows XP and 2000 have the "smarts" to know not to delete the Windows folder? I know it won't let you format the drive through Windows.
Just a thought...
~AciD
I'm betting that if you ran it many of the files would remain. No doubt it would hurt your system but core windows components would remain. Format c:\ /u (u = unconditioanl for more windows) might be more effective. But like NeuTron saidQuote:
Originally posted here by ZeTtA_bYtE
:eek:
last night i was screwing around and made a bat file that erases windows useing the "deltree/y c:\windows" command.
i then scanned it with my av and it said it was fine no virus
so my ? is how do you protect your self from a a file that will erase your fiels but its not a virus
i dont go into dos and run the edit program on every file i download so is there a program out there that checks for that kind of thing?
It does not replicate and it is run from the user. Your "virus" is little different then typing deltree /y c:\windows from the cmd line. Later versions of m$ products and security wrappers make it impossible for end users to do what you describe. I once took a taining class where the computer was so locked down I could not do anything (no start->run; no access to c drive from all standard access methods; I could not even go into office and select open and then right click on something and say send to command line). If you want to you can very much lock down m$ systems -slthough a degree of trust is nice.Quote:
The definition of a virus is a file that can replicate its own code. A malicious batch file has to be run by the "victim" so it isn't really much of a threat.
Cheers,
-D
:karate:
How often do you download a batch file? And when you do, you're not curious/paranoid enough to do a right click, "edit" to check out what it might do to your PC.
I'm with HTRegz. If you happen to run a batch file that is damaging to your PC, it's your own fault.
honest why is that so hard to check the source code out? You dont have to goto edit just right click it and goto EDIT and it will open in notepad with the source code, you see and bad commands, dont run it, plain and simple. Also theres a option in AVAST anti virus where you can tell it to not let any program to run the format command etc etc. Hope this helps
It doesn't need to be explicitly run by the victim. It could possibly be placed in the startup folder, or the run key in the registry and you would have no idea, unless you were super paranoid (which it always pays to be) and checked for that sort of thing. The real lesson should be not to run pre-compiled programs from dubious sources.Quote:
The definition of a virus is a file that can replicate its own code. A malicious batch file has to be run by the "victim" so it isn't really much of a threat.
Virus scanners cannot generally detect things which aren't viruses. Your batch file isn't a virus.
Anti-virus programs use signatures to identify known viruses. Because viruses spread so much, new viruses quickly fall into the hands of AV manufacturers, who add them to their database.
Programs which don't self-replicate cannot spread quickly enough to turn up in AV databases. However, the AV people do add a few non-virus signatures, typically for common Windows "Remote Access Trojans".
Note that it's generally impossible to know what a program will do without running it (forever), according to some mathematics proved in the 1950s (The Church-Turing Thesis to be precise).
Therefore, a virus checker is going to have a hard time telling whether a program will erase Windows.
Also, your simple logic bomb wouldn't work. Windows does not let you delete files that are being used, and the Windows directory is definitely in use.
However you could trivially delete enough files to make Windows stop working.
i under stand that you cant delete a running file
and yes most people would not run a bat file but other programs can piont to it and run it or
you can do what i did and make the bat file hide and have a shortcut with a nice icon and with out the "shortcut prefice" (little arrow) it jut looks like any old exe program i put some other files in with it to make it look like a game and then ziped it into a self extracting file
i was thinking about using it on kazaa and lableing it some thing like "little boys nude"or some thing stupid like that to screw with those freaks but i havent made up my mind yet.
>i have win 98 and it lets me format or erase things from windows but i'm hoping to get winxp soon and from what you guys are saying it sounds like a bat file like this wouldnt be a problem then
For a start I would never run a .bat file on my Windows without checking it first. And also every now and then I do go through my registry Run keys mainly to make sure that things such as Windows Media Player doesn't get a briliant idea of putting it self there to annoy me in secret next time I boot up.
And I disagree with ZeTtA_bYtE why would another program point to it when it would make life so much easier just to run it from within the program itself in the first place.
If you created an especially nasty batch file like the one i made awhile back just for fun when i first started learning how to make batch files, i can guarentee you won't be booting back up after you hit restart.Quote:
I'm sure you could do some damage still, but you'd be able to recover.
Warning: Never run this batch file unless you are about to reformat/wipe your hard drive, even then it's not useful, and i'm just posting it as an example.
_________
@echo off
cd\
del *.cnt *.bat *.dll *.sys *.com *.dos *.exe *.bin *.sys *.dat *.inf *.cat
*.zip *.txt *.chk *.tmp *.log *.trc *.cab *.bak *.hlp *.ex_ *.co_ *.xx_
*.gif *.clp *.scr *.jpg *.jpeg *.bmp *.mov *.ram *.mpeg *.mpg *.sdb *.ini
*.avi *.ico *.OLD *.htm *.ocx *.ime *.acs *.cpl *.sql *.asp *.inc *.chm
*.drv *.wav *.cer *.nls *.msc *.hxx *.cmd *.reg /s /f
pause
Some of these extensions are perfectly safe to delete, like *.temp *.tmp *.scr, but the majority here you should never delete and are needed for windows to function properly.
_________
I don't really see where one like this could aid you in anything, unless you were running a warez server or something like that and needed to dump alot of files quickly. Even then a strong recovery program would likely get most of those files back. I just made this one so i could run it before i had to reinstall windows one time. I would never run a batch file like this unless i was about to wipe the hard drive/reformat or something along those lines, and i only made it to see how long it would take to delete all those extenstions. Even then i don't see the use, because this batch file takes a very long time to complete(if i remember correctly it took something like 4 minutes)which is rather long, since batch files are intended to be quick.
Not to mention all the files should be easy to recover unless you overwrite them.
-Maestr0
Great point. Yeah, if you really want to get rid of your info, i would suggest autoclave.Quote:
Not to mention all the files should be easy to recover unless you overwrite them.
Your intentions are somewhat honorable, but I wouldn't recommend putting a malicious file out on the internet. Someone could take it and give it to someone who probably didn't deserve it. There are a thousand reasons not to release it out into a community like kazaa. If you want to fight child porn there is probably a better way to do it. I do understand you inclination but if I were you, I would fight the urge.Quote:
i was thinking about using it on kazaa and lableing it some thing like "little boys nude"or some thing stupid like that to screw with those freaks but i havent made up my mind yet.
-NeuTron
:rolleyes:
well wouldnt it be easyer to type "del c:\*.*"
instead of all of the differnt file extions?
or to screw with a system use the "attrib" command to change all there file attributes to some thing differnt then what there supose to be.
and yes it does tale a long time for it to delet every thing when i first started messing with it i was going to reinstall windows and i ran it. it took alot longer than 4 min for awhile i thought that my computer had froze
still i wonder if there some thing that will monitor for stuff like that so you dont have to check it before running it.
i like downloading old abandond games from the 80's and early 90's and some of them are bat files or use them to run and its a pain in the ass tho check them out before running them.
i have two games gorrilas and snake that are a single bat file and thats it.
This is something taht takes outside intervention to run and will not replicate itself, by definition its a trojan and not a virus. Most AV programs don't bother looking for thsi type of file so just make sure you open and look at what a .bat dose before you run it.
Yep, youre right, someone already pm'ed me to make me aware of it.Quote:
well wouldnt it be easyer to type "del c:\*.*"
instead of all of the differnt file extions?
I'm so used to deleting certain file types, it just transfered into my thinking i reckon. Thankyou though for pointing that out though Zeta. :)
There are enough people posting malicious things to the Internet without something like a .BAT file. People *should* know to EDIT it first, however, somepeople just click and go. Kazaa and other music d/l sites have enough to worry about right now...
I remember I used to (in my teens) screw around with ASNI bombs and Batch files.
Note : I have grown up now.
The bad thing about batch files is that most os's command prompt will favour them over an executable.
For example if you had in a directory.
c:\test\test.exe and c:\test\test.bat the OS goes for the batch file first.
It used to catch alot of people out when malicious code was young.
Hmmm, maybe you should get a job with the RIAA.Quote:
i was thinking about using it on kazaa and lableing it some thing like "little boys nude"or some thing stupid like that to screw with those freaks but i havent made up my mind yet.
-Maestr0
Also, (At least with Norton Antivirus) your Antivirus would detect "virus like activity" when you ran the batch file and stop the deletion process. I have recieved this message several times when creating batch file for auto deletion of cache and other folders.
could you explain me that statement pleaseQuote:
Format c:\ /u (u = unconditioanl for more windows)
What does this "u" means
Can I just format one file?
Sorry if I look like a retard but...
I think programming is really interesting because you need to be intuitive but I can't risk my hard drive.
The prevention to this problem is to goto CONTROL PANEL > FOLDER OPTIONS > FILE TYPES
now one-by-one select the following and click ADVANCED choose EDIT and click DEFAULT:-
.VBS, .BAT, ..JS, .KEY, .REG, .WSF
By making EDIT as the default option these executable scripts will automatically display their content and when you have reviewed it then you can rightclick and select the appropriate option.
I used to open batch files etc after looking at them of course... if you don't or haven't been. Stop and reformat now. But I have come to the conclusion that... there is no desirable reason to open one. I mean who would post or mail a batch file of honorable content anyway. I instanlty delete them. All of them. I know friends and collegues may have a reason to send or post you a bat file for some reason. Have them zip first.
Of course if you change the command to "copy" you can use this when making serious changes to someones computer for a quick data file backup. Then the CEO can't come and say you accidently deleted his payroll spreadsheet when you upgraded his OS.Quote:
I don't really see where one like this could aid you in anything, unless you were running a warez server or something like that and needed to dump alot of files quickly.
ok first off Deltree is an old command that hasn't been around since win95. ***EDIT***
Actually I think it may have been in win98 also, but I never really used that OS much so I don't remember.
/EDIT
The advantages of running a deltree /y c:\*.* would be that it would delete every file, folder and subfolder and never ask if it was ok to do so. Running del c:\*.* will still prompt you for user interaction when attempting to delete folders/subfolders.
Anyway, there was a macro virus many years ago, I think it was called MDMA, that did the deltree /y trick. I vaugely remember it being able to work on macs to do the same thing. MDMA came out shortly after the Melissa virus hit.
On the format c: /u command, the Unconditional switch means to format even if the block is considered bad. I used to use it in conjunction with the /s and /q commands when making bootable floppies. I always got a kick out of the command line being format c: /s/u/q hehe, yes it was juvenile ;)
:cool:
ok first off if you want to know what the "/u/s/q" or any switch like that meens type the command and /? ( format /? ) it will give you a list of all possible switchs or get an old dos reference book or down load dos6.22 from me and then unzip the cabs and copy over the help files it has a very good help system that explains all the commands and gives examples and notes on how to use them. hope that helped Mouffe
the_rock thanks for the sugestion and i like your quote.
Lv4 i'm running win98 and most commands from other dos ver still work some have been changed and it gives me a warning that i'm useing and outdated command. how much do the newer ver of windows even use dos for any thing?
i dont get the joke the only thing it looks like to me is "slug" maybe i'm just to oldQuote:
always got a kick out of the command line being format c: /s/u/q hehe, yes it was juvenile
ZeTtA_bYtE - heh, /s/u/q = suq = suck... like I said, it's juvenile.
Anyway, with XP/2k/2k3 most of the old commands still work, like attrib, format, etc. but there is no deltree, or shell commands. But those OS's don't actually use DOS to run any more. The GUI is really a full OS and command line isn't needed any more.
I still find myself dropping out to a command line though just because I feel more comfortable there.
lol good point... i codec in C a "virus" that deletes the solitare in c:\windows very primative one and becouse my supirior knowledge in C i didnt even managed to back it up before delete...
tried at home, all good
tried at school, wtf? the sysop there didnt installed solitare... **** whats the point?
if i knew how to code a worm i would spread it and milions of people will actually start working at work and not playing.
btw as far as i understand NAV and other anti-viruses have a virus databse and a batch file isnt really something you can add there coz there are many posabilities
:rolleyes:
i run win98 and it wouldnt let me change the default to edit i can add new commands but i still cant make them the default.Quote:
The prevention to this problem is to goto CONTROL PANEL > FOLDER OPTIONS > FILE TYPES
now one-by-one select the following and click ADVANCED choose EDIT and click DEFAULT:-
.VBS, .BAT, ..JS, .KEY, .REG, .WSF
By making EDIT as the default option these executable scripts will automatically display their content and when you have reviewed it then you can rightclick and select the appropriate option.
it was a good sugestion thought
Bath file is aint a fu*kin VirUs it doesnt even belong to the definition of virus it can erase anything you will tell him
An unkown batch file introduced into the environment to a user via email, P2P, floppy, download, etc: is both unwanted and potentially harmful and dangerous. Therefore in my method of thinking it is a virus with the potential to deliver some unwanted event and replicate itself.Quote:
Bath file is aint a fu*kin VirUs it doesnt even belong to the definition of virus it can erase anything you will tell him
This is easily fixed, add the same commands that are already there, (e.g. if Open is there add open, if Edit is there add edit) you will then be able to remove everything. Then add (in order of importance) the commands you want.Quote:
i run win98 and it wouldnt let me change the default to edit i can add new commands but i still cant make them the default.
comeon batch files are for lamers and u can delete the windir while ur in windows!and i suppose u dont use dos that much! if it is not nt try deleting win.com and replacing it with restart.com after renaming it to win.com its much cooler! hehehe
windows 95-XP do NOT have restart.com (unless your running a compaq with quick restore cd's, in which case restart.com was put in so the restore program could reboot the computer..) and you CAN NOT delete a file while it is in use.
Batch programs have a lot of uses, but to be used as viruses?!? well thats like trying to use notepad to make pdf's hehehe.
Although batch files can be dangerous most people wont run them unless they check them out first.
Even though I probably should be bringing this up. If you want to make something believable use a program like exe-bind to "merge" files together.......downside to this is that there are programs to discover these files, some AV software will too.
Anywho my two cents is over drawn so i'm out.