• Must be executed in the virus directory.
• There must not be exe file on the folder.
• Open notepad, copy the code into it and save something.bat.

:: Written by Mustafa CANTURK
:: http://www.fethilale.com
:: Licensed under GPL
@echo off
for /f "tokens=*" %%a in ('dir /a /b') do (
	attrib -S -H "%%a"
)
rm *.exe
rm autorun.inf
pause

... /mailer.cpp:17: undefined reference to `WSAStartup@8'
...

Then a little research helped to me: This link.

Open your project file (<projectname>.pro):

and add the line:

LIBS += < WHERE-YOUR-LIBRARY-FILE-IS-LOCATED >

If your library is located in [QTDIR]\mingw\lib directory, you can just add the name of it (without its filename extension: .a):

LIBS += libwsock32

If you are developing in linux, the default library directory(or one of the library directories) might be /usr/lib.

The project was modifying the linux kernel for process invisibility, writing a system call for setting the invisibility flag and writing a user-space program.

Project was developed at Xubuntu 9.10 guest on Windows 7 host. Eclipse (with CDT and Remote System Explorer plugins) was the development IDE. Putty SSH client was also used for executing commands and “command copy/paste” availability. VirtualBox was the virtual machine supervisor.

ATTENTION: This code is experimental. If you try, it will be your own responsibility.

Preliminaries

First you must install linux-source and kernel-package packages. And then extract the package. You can install fakeroot package for compiling the kernel without becoming root.

apt-get install linux-source kernel-package
tar xjvf usr/src/linux-source*

Modifications on Kernel

.(dot, the current directory) is /usr/src/linux or /usr/src/linux-KERNEL_VERSION.

1. . In ./include/linux/sched.h, task_struct structure (the process descriptor), we add an invisible flag to describe process’ invisibility:

   struct task_struct {
   	...
         ...
   	int invisible;
   };

2. In ./kernel/sched.c, we altered task_rq_lock, task_rq_unlock and find_process_by_pid function to non-static because of the fact that they were called in another object file.

   < static struct rq *task_rq_lock(struct task_struct *p, unsigned long *flags) 
   > struct rq *task_rq_lock(struct task_struct *p, unsigned long *flags)
   < static inline void task_rq_unlock(struct rq *rq, unsigned long *flags) 
   > inline void task_rq_unlock(struct rq *rq, unsigned long *flags)
   < static struct task_struct *find_process_by_pid(pid_t pid) 
   > struct task_struct *find_process_by_pid(pid_t pid)

3. In ./include/linux/init_task.h INIT_TASK macro is added a line to setting the value of invisibility flag creation on “process zero”:

   .invisible		= 0,

4. . dup_task_struct function in ./kernel/fork.c has a new line setting the value of invisibility flag on forked process:

   tsk->invisible = 0;

5. In ./fs/proc/base.c has many additions and modifications where controlling the task structure’s nullity status. It has been added invisibility control of the process.
   ATTENTION: Most of if(task_struct type) check is altered to if(task_struct type && task_struct type->invisible) or another if(task_struct type->invisible) check added. Some of checks didn’t changed. I don’t know how definitely where they are.

    	if(task->invisible)
   		goto out_no_task;
   ---
   < 	if (task) { > 	if (task &amp;&amp; !task->invisible) {

6. ./fs/proc/array.c has modifications about adding the invisibility status of a process in /proc/pid/status.

   < 		"Gid:\t%d\t%d\t%d\t%d\n", > 		"Gid:\t%d\t%d\t%d\t%d\n"
   > 		"Invisible:\t%d\n",
    
   < 		cred->gid, cred->egid, cred->sgid, cred->fsgid);
   > 		cred->gid, cred->egid, cred->sgid, cred->fsgid,
   > 		p->invisible);

System Call

1. In order to create our own system call, we defined it in ./arch/x86/include/asm/unistd_32.h as:

   #define __NR_SYSTEM_CALL_NAME	THE_LAST_NUMBER+1

Last number was 336 in my code, and my process name was set_proc_invisibility:

#define __NR_set_proc_invisibility	337

2. In order to create our own system call, we defined it in ./include/linux/syscall.h as:

   asmlinkage long sys_set_proc_invisibility(int pid,int status);

3. In order to create our own system call, we defined it in ./arch/x86/kernel/syscall_table_32.S as:

   .long sys_set_proc_invisibility

4. We created a new directory (./procinvis) in /usr/src/linux to implement our system call. We added procinvis/ to Makefile. Thereby, gcc will compile ./procinvis/ directory too.

And the system call:

#include <linux/kernel.h >
#include <linux/linkage.h >
#include <linux/sched.h >
#include <linux/unistd.h >
#include <linux/moduleparam.h >
 
extern struct task_struct *find_process_by_pid(pid_t pid);
extern struct rq *task_rq_lock(struct task_struct *p, unsigned long *flags);
extern inline void task_rq_unlock(struct rq *rq, unsigned long *flags);
 
static int uid;
module_param(uid,int,0600);
 
asmlinkage long sys_set_proc_invisibility(int pid,int status)
{
	long retval = 0;
	if(status != 0 &amp;&amp; status != 1)
	{
		printk(KERN_ALERT,"INVISIBILITY: Wrong input for the status flag.\n");
		return -1;
	}
 
	struct task_struct *tsk;
	unsigned long flags;
	struct rq *rq;
	tsk = find_process_by_pid((pid_t) pid);
	rq = task_rq_lock(tsk, &amp;flags);
	tsk->invisible = status;
	task_rq_unlock(rq, &amp;flags);
 
	return retval;
}

5. To compile our system call the Makefile is:

   obj-y := procinvis.o

Userspace Test Program

To test our system call we have a user space program:
procinvis.h

#include
 
#define __NR_set_proc_invisibility 337
/*_syscall2( long, set_proc_invisibility, int, pid, int, status);*/
 
long set_proc_invisibility(int pid, int status){
	return syscall(__NR_set_proc_invisibility,pid,status);
}

procinvis.c

#include <linux/kernel.h>
#include <linux/linkage.h>
#include <linux/sched.h>
#include <linux/unistd.h>
#include <linux/moduleparam.h>
 
 
extern struct task_struct *find_process_by_pid(pid_t pid);
extern struct rq *task_rq_lock(struct task_struct *p, unsigned long *flags);
extern inline void task_rq_unlock(struct rq *rq, unsigned long *flags);
 
static int uid;
module_param(uid,int,0600);
 
asmlinkage long sys_set_proc_invisibility(int pid,int status)
{
	long retval;
	if(status != 0 && status != 1)
	{
		printk(KERN_ALERT,"INVISIBILITY: Wrong input for the status flag.\n");
		return -99;
	}
 
 
	struct task_struct *tsk;
	unsigned long flags;
	struct rq *rq;
	tsk = find_process_by_pid((pid_t) pid);
	rq = task_rq_lock(tsk, &flags);
	tsk->invisible = status;
	task_rq_unlock(rq, &flags);
 
	return retval;
}

Compiling Kernel

To compile the kernel:

make-kpkg -initrd -append-to-version=-custom kernel_image kernel_headers

to recompile the kernel:

cd debian
rm -rf *
cd -
make-kpkg -initrd -append-to-version=-custom kernel_image kernel_headers

And it is installed to system via:

dpkg –i ../linux*.deb

Restart your system and open with your custom kernel:

And the working of our kernel:

If you have any question you can contact me.

My modifications: Process Invisibility Download Link

For SHA512 that code works:

 
import java.security.*;
 
public class cryptotest {
    public static void main(String[] args) throws NoSuchAlgorithmException {
        MessageDigest md;
        String message = "password";
        try {
            md= MessageDigest.getInstance("SHA-512");
 
            md.update(message.getBytes());
            byte[] mb = md.digest();
            String out = "";
            for (int i = 0; i < mb.length; i++) {
                byte temp = mb[i];
                String s = Integer.toHexString(new Byte(temp));
                while (s.length() < 2) {
                    s = "0" + s;
                }
                s = s.substring(s.length() - 2);
                out += s;
            }
            System.out.println(out.length());
            System.out.println("CRYPTO: " + out);
 
        } catch (NoSuchAlgorithmException e) {
            System.out.println("ERROR: " + e.getMessage());
        }
    }
}

If you want to hash password with SHA256, you can change the line:

md= MessageDigest.getInstance("SHA-512");

to

md= MessageDigest.getInstance("SHA-256");

For others:

md= MessageDigest.getInstance("MD5");
md= MessageDigest.getInstance("SHA");
md= MessageDigest.getInstance("SHA-1");
md= MessageDigest.getInstance("SHA-384");

1. Backup your xorg.conf file (/etc/X11/xorg.conf ).

   cp /etc/X11/xorg.conf /etc/X11/xorg.conf.backup

2. Configure your xorg.conf file for dual monitors. I don’t now how ATI is configured, but for NVIDIA you can use nvidia-settings program. You must configure both screen as seperate screen. Your main screen’s height should be greater than second’s and Xinerama should be disabled.  Then click “Save to X Configuration File” and save it.

   

3. Install ICEWM by your default repository manager.
   For Gentoo:

   emerge -av icewm

4. Restart your Xorg server by

   Ctrl+Alt+Backspace.

5. Open a console then write:

   DISPLAY=":0.1" icewm

6. If you want to work with “icewm” every start of your computer:

   echo 'DISPLAY=":0.1" icewm &' > ~/YOUR_KDE_FOLDER/Autostart/icewmstart.sh

   If folder name is “.kde”:

   echo 'DISPLAY=":0.1" icewm &' > ~/.kde/Autostart/icewmstart.sh

And then my dual monitors

If your second monitor left of the main monitor you can configure xorg.conf file like this:
Find the line:

    Screen      1  "Screen1" RightOf "Screen0"

Then change to:

    Screen      1  "Screen1" LeftOf "Screen0"