trollware

Tested On

• WindowsXP, Windows Server 2008 R2

Features

• Adds users to the host (Admin and other random users)
• Will play an audio file in the background (Never Give You Up works nicely!)
• Adds Icons to the Desktop (Chrome, My Computer, IE) that link to a generate vbs file. The file presents a series of pop-ups to the users.
• Replaces Utilmon.exe with cmd.exe
• Replaces Login and Shutdown Sounds (My Little Pony or Never Give You Up work nicely)
• Randomizes filenames, but could do a better job of hiding them
• Creates Scheduled Task for Running the trollware
• Creates Registry Keys to add the trollware to Run when a user logs in

Notes

• You need to provide your own media files for this script (Windows Boot Sound Replacements, etc.)
• Must be run as an Administrator
• By default, newer versions of Windows have blocks in place on sensitive system folders like "C:\Windows\Media" - There is a way to do this and it has been added to the script, but it extends the run time by a bit
• Need to change from running on Desktop to Temp

Bugs

• On Windows 2008, reg add asks to overwrite 3 keys, should be forced and silent
• May have to manually run the commands to give the Admin group access to C:\Windows\Media and C:\Windows\System32

Screenshots

IE Error:

Something Goofed:

Trojan:

Sphos Failed:

Copying SAM:

Secure Tunnel:

Windows Defender:

Self Delete:

Memory Corruption:

System Reboot:

Desktop Icon:

Liability

• THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
• Run this at your own risk. This author is not liable for your actions...Be smart and use common sense.