How to over-ride a shutdown virus

You may have read my last instructable, on how to make a shutdown virus, but this
instructable will show you how to OVER-RIDE that shutdown virus =]

THIS IS EXTREMELY EASY!!!

Step 1 Making Or Activating The Over-Ride

To make a over-ride shortcut (that sits on your desktop until it is needed) follow these steps.

If you want to make it look cool (because all your friends are around and you want to look like a hacker), go to step 3.


-Go to your desktop.

-right click.

-select "New".

-select "Shortcut".

A box should come up as shown below.

Comments

[lieuwe]

 useful trick, it only works if you have time left before it shuts down, override is without a dash though, nice ible

[messmaker]

Yeah, that is a problem.
However if they havent written a forced code such as

shutdown -s -f -t 100

you can just open a word document and it will ask if you would like to save it before it shutsdown, this will give you all the time you need to run the file
or go through the "look like a hacker" option.

[grundisimo]

shutdown/p shuts it down immediately and is shorter to type.....

[lieuwe]

 assuming that you have time to open a word file, shutdown viruses are nasty buggers, but booting into safe mode will often keep them from starting...

[messmaker]

if your computer is too slow to load a word document or notepad in 3 seconds, you should just get a new computer.

[lieuwe]

 if you have a shutdown virus it might as well shut down instantly, there is no rule that they have to wait 3 seconds...

[messmaker]

i never said it did.
but im saying if you cant open a word document fast enough, you might aswell get a new computer because.

a standard, stock computer should be able to open a word document on desktop before immediate shutdown.

[lieuwe]

 that's not true, as soon as a program gives the shutdown command, windows prevents any new programs from opening, and if the virus maker is just a bit smart, the virus will use the /f argument when shutting down, this forces all opened programs to close, no matter what...

[messmaker]

u mean Shutdown -s -f -t 100 -c "message here" the "-f" making it a force shutdown. but a shutdown -a over rides even a Forced shutdown. a shutdown -a will only fail if its a shutdown coming straight from windows itself. -f doesnt stop u aborting it.and u could even have the shutdown over ride in a usb pre made, so u can immediatly open it =]

[lieuwe]

like a said, you might not have time to override it, if no delay is given it'll start shutting down, preventing any new programs from opening, if i give my computer the shutdown command it logs out almost immediately...

[messmaker]

yes but, you could write the code, and run it through start up. (start up files) so, on a seperate Computer, make a program that opens autonomously and runs a ISO (Instant Shutdown Over-ride). that will open before the shutdown commances, or has time to process =]

[lieuwe]

yes, but that isn't metioned in the instructable anywhere, i'm well aware that you *can* stop these viruses, but not always as mentioned in the instructable. the best possible way to remove these viruses is to boot into safe mode and remove the registry entry that starts it up...

[messmaker]

If you were smart about making the virus in the first place you would make it come under the Administrators name, so even the system will allow it, and delete the Admin and create a new one. you can make viruses do it, by programming it to add a new Admin and delete the old one. and put a total random password like "8456589n-t5489549458y" (you wont have to remember it, it just means the Admin wont be able to guess the password and they will have to do a total system delete, and re-setup.)

[messmaker]

you could even make it as complex as telling the virus to: 1. Make a new hidden Admin. 2. Under that admin name, run a immediate shutdown into start up files. 3. Delete the Admin user. . Leaving no trace that you created the Admin in the first place, and making it seem to the system that the Shutdown file in the start-up files was legally placed by a former Admin.

[lieuwe]

use ophcrack live cd to get the admin pass, boot in save mode, remove start up entries change admin pass back, reboot normally. but that isn't the point, i know that you can make pretty advanced viruses, and there's almost always a way to get rid of it, the point is that NONE of this is mentioned in the instructable, you might want to add a step for the shutdown viruses that you can't stop this way.

[messmaker]

oph crack doesnt get hidden admins passwords. and this is a simple virus instructable. if i made it too complex people would just get tied up in knots. and if i wanted to do this to someone, i would break in, and fry the main processor. then you would need a whole new computer. and i could make it a hidden permanent file in the start up also, so its part of the system, then it will never let u delete it. i cant mention everything in the insctructable. this instructable is only for getting rid of a noob virus. made by a "script kiddy".

[grundisimo]

You can make a batch file that automatically aborts remote shutdowns... I did at school...

[hellrider75]

nice pic and VERY nice trick

[messmaker]

Thanks, anything you want to know, inbox me or ask me here =]