Skip to content

Instantly share code, notes, and snippets.

@Albirew
Last active June 12, 2024 19:02
Show Gist options
  • Save Albirew/27fce325d3f54b5023773ee1f61f39a0 to your computer and use it in GitHub Desktop.
Save Albirew/27fce325d3f54b5023773ee1f61f39a0 to your computer and use it in GitHub Desktop.
evolution of a "harmless" troll batch file (see revisions)

FILE MOVED IN IT'S OWN REPOSITORY HERE

@InfinityDevTech
Copy link

InfinityDevTech commented Sep 27, 2020

That was wayyyy to confusing to decode

Something as specific requires some context

@Albirew
Copy link
Author

Albirew commented Sep 27, 2020

well...
everything before empty line is troll batch file creation using escape characters (double percent gives unprocessed simple percent)
almost everything after empty line is just an html webpage created then started fullscreen
last 5 lines should replace AM/PM near clock with custom text and reboot machine
something like this?

@david232143
Copy link

Hey, i hope you are active and could help me. So i started the bat file and thought its just a little joke. I followed all ur steps to remove this harmless malware. Then i found out if i made a screenshot via Microsoft the file was names at the end with "YOLO BATCHMEN". how can i Remove it

@Albirew
Copy link
Author

Albirew commented Apr 22, 2021

Then i found out if i made a screenshot via Microsoft the file was names at the end with "YOLO BATCHMEN". how can i Remove it

ah, it uses the "customized" AM/PM, in a way, i'm glad this work (even if that was supposed to place the "YOLO BatchMan" next to the clock, but since i'm from a country with 24h format, i never saw it)
you may get it fixed by starting a command prompt and pasting these 2 lines in it:

reg add "HKCU\Control Panel\international" /v s1159 /t REG_SZ /d "AM" /f
reg add "HKCU\Control Panel\international" /v s2359 /t REG_SZ /d "PM" /f

@david232143
Copy link

omg thanks for your help, sorry for not replying for so long

@Maple38
Copy link

Maple38 commented Mar 30, 2022

Hey what does this do? I'm putting it on a school library computer regardless, but still kinda curious.

@Albirew
Copy link
Author

Albirew commented Mar 30, 2022

Hey what does this do? I'm putting it on a school library computer regardless, but still kinda curious.

Hey! it puts a fake BSOD (to force user to reboot after batch silent installlation) and change AM/PM to some "yolo batchman" text
it also create a self-replicating batch file (that starts some shit like web browser, notepad, paint and file explorer in a loop) and register it in startup,
Some shit may not work anymore (like the website, i believe it was playing some cursed video in loop at the time) since it was made in 2015 (and for windows 7)

@Miguel-EpicJS
Copy link

lol, should a put this in my school computer

@Maple38
Copy link

Maple38 commented Mar 31, 2022

Hey what does this do? I'm putting it on a school library computer regardless, but still kinda curious.

Hey! it puts a fake BSOD (to force user to reboot after batch silent installlation) and change AM/PM to some "yolo batchman" text it also create a self-replicating batch file (that starts some shit like web browser, notepad, paint and file explorer in a loop) and register it in startup, Some shit may not work anymore (like the website, i believe it was playing some cursed video in loop at the time) since it was made in 2015 (and for windows 7)

Nice perfect for school PCs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment