*******************************************************************************************************
Godmessage Worm v0.1
 Author: 6IT
 Thanks: The Pull - Creator of Godmessage I, II, III, & IV - this is his brainchild.
 Thanks: StoneFisk - Coauthor of Godmessage I, II, III, & IV. 
 Thanks: To all the people who helped make godmessage what it is today (In no particular order): Exxtreme, Nicula Laurentiu, Sugien, Dabbler, Blade, and everyone else I forgot to mention
 Thanks: All the beta testers out there, Thanks for the feedback. 
 Special Thanks: George Guninski - Without his exploit, Godmessage wouldn't exist. Keep finding those bugs George!

*******************************************************************************************************

*******************************************************************************************************
Disclaimer: I take no responsibility for the use of this code and you use the software at your own risk.
Under no circumstances shall I be liable for direct, indirect, special, incidental, or consequential damages resulting from the use, misuse, or inability to use this software.
*******************************************************************************************************

*******************************************************************************************************

NOTE: This is theoretical code, it has never been fully tested. 
      I just build them, I don't release them...

vbs file Generates a Godmessage.html in its directory, and checks for the existence of three copies of itself on the hard drive.

It spreads itself by the following ways:

Outlook Express - Spreads through Outlook Express signatures (similar to KaK, but in VBScript)

Outlook Contacts - Sends 1 to 5 emails every hour to Random Outlook contacts with Godmessaeg.html attached, Records what Contacts have been sent to. (similar to ILOVEYOU)

Scan Drives - Searches through all hard drives, looking for vbs and html files. vbs files are backed up with a .GMW extension and then copied over. Html documents are Injected with Godmessage code keeping the original html content intact. (similar to ILOVEYOU)

NetBios - Scans for open NetBios Ports and maps a network drive, copies vbs file to mapped drive's Startup directory. (similar to network.vbs)


Depending on where GMW.vbs is ran from it will do the following:

On WinNT/2K
If ran from the user's temp directory:
- Add the html to the Outlook Express signature
- Randomly send to Outlook Contacts every hour
- Checks the Godmessage Run Environment (See Below)

If ran from the user's Local Settings Directory:
- Scan the hard drives for vbs and html files
- Checks the Godmessage Run Environment (See Below) every hour

If ran from the user's directory:
- Scan for open NetBios shares
- Checks the Godmessage Run Environment (See Below)

If ran from anywhere else (hta)
- Checks the Godmessage Run Environment (See Below)

On Win9x
If ran from temp directory:
- Add the html to the Outlook Express signature
- Randomly send to Outlook Contacts every hour
- Checks the Godmessage Run Environment (See Below)

If ran from the Windows Directory:
- Scan the hard drives for vbs and html files
- Checks the Godmessage Run Environment (See Below) every hour

If ran from the root directory:
- Scan for open NetBios shares
- Checks the Godmessage Run Environment (See Below)

If ran from anywhere else (hta)
- Checks the Godmessage Run Environment (See Below)

CheckEnvi() - Godmessage Run Environment
- Checks for Godmessage.html in vbs dir, spawn it if it doesn't exist.
- Checks for Both HTA files in Startup dir and deletes them
- Checks for all three vbs locations to see if they exist, add and run them if they don't.
- Checks the regentries for the vbs files, creates them if they don't exist.

The Godmessage.html file creates two HTA files when run from explorer. The first HTA plants theThing server from Godmessage IV, the second creates a copy of GMW.vbs and runs it.
