_________ SWAT MAGAZINE ISSUE FIFTEEN: MARCH 1999 __________ / \___________________________________________/ \ / SWATeam Hard Drive Annihilater \ / By -=The Firestarter=- \ ----------------------------------------------------------------------- This is a kind of review on a program that I wrote around the middle of this month. So what is it? As the name implies, it is a program to kill hard drives. I came up with the idea when going over the source code for Hard Drive killer 3 by Munga Bunga. So you ripped off munga bungas program? No. Actually I started to alter some of the code so that I could test it out on killing a floppy disk, then I decided to change a bit more stuff, in the end I scrapped it compleatly and started from the beginning. So what does it do? Well it wipes out key files on the hard drive before formatting the drive, that way if you do manage to recover data, you will only be able to get so far. It attacks the directorys C:\windows and c:\Windows\system before anything, it also wipes out c:\program files that way if the final stage goes wrong, you've got a long day ahead of you reinstalling everything. An unconditional format ensures that most data is unrecoverable (especially the files taken out by wipe) So what is it coded in? Well the main program is a batch file, but it uses "Wipe" written by Nowhere Man, Deltree and format by Microshaft and Reboot by some other company. So how does it work? When it's first run, all that happens is autoexec.bat is written to. The actual attack takes place when the computer next gets rebooted. When the computer gets rebooted, a program called wipe.com gets copied into windows and windows\system then the command "wipe *.*" is issued. Once that is done, the line "deltree /y c:\progra~1" gets run, as you can guess this wipes out a lot of data, after program files is gone, "deltree /y c:\windows" gets issued, although most of the program files and windows can be restored, the final stage takes care of it. the autoexec.bat file is altered to only contain the string to format the drive unconditionaly. In around a few minutes the drive is free from all data. Of course the person who's computer it was run on would probably wonder what the hell is going on. So when the computer first reboots, the lines: Microsoft Windows has detected an error. Attempting to recover data. WARNING rebooting now will cause all data to be lost indefinatly. Please wait... appear on the screen, while all of the files get wiped out. Once all of the key files have been taken out, the line: Recovery 100% sucessful hit any key to continue will appear, once a key get's hit, the computer will reboot. Upon reboot the screen will aprear to hang for a few seconds, while it is like this, the hard drive is being formatted. If the person where to go ahead and reboot the computer, well have you ever rebooted a computer while it's in the middle of a format? All of the required programs come in one self extracting zip file, once all of the files are extracted (ideally in the c:\ directory) all one has to do is run the shda.bat file and all's set. All of the files needed to wipe the drive out are contained within the archive, including deltree and format, since these files will be deleted when the computer first reboots. Isn't that program really lame then? Depends on how you use it really, I mean I only coded it because I got board, and I figured that maybe it would have some use to sombody out there. So what use would such a file have? Well if you ever need to cover your tracks, this program does a good job. You can modify the batch file so that it takes out any directories that you want, also it can be modified to deal with more than one hard drive (well I've got a copy that will kill both of my HD's), but this public release version will only take out the c: drive. Other uses would be malice, I dunno, some of you might hold a grudge against Dixon's or PC World, so you'd probably kill all of the hard drives in the shop. Maybe you used Back Orifice or netbus and got onto sombodies computer, only to find it full of child porn, after downloading there c:\my documents directory to look for there address (for whatever reason you want it for) you can kill there hard drive. The uses of this program are endless, not that I condone the use of it to wipe out loads of computer systems, I only wrote it because I was board, I didn't have any intention for writing it. So where can I get it? Good question, well at the time of me writing this, there is no place on this earth that you can get the program, if you e-mail me I will let you have a copy, but by the time this issue goes out, it will probably be in file library, in a new secion labled "member programs", you'll find one or two public release programs there (like Doh-Boy's red box proggy and my Password protection proggy), occationally you will find a new program probably written in Qbasic appear there. I'll probably review the new programs that are of any good, who knows.