Forum | | | | Gary12345 | Hi,
i want gladly a BKA Remover basteln. The basiert on one very leichtem Testcode, the Nich runs. If the Testcode walk would, would the remainder only yet Frauensache.
Vll a small introduction in things BKA and Trojaner:
for a long time hovers in the gefährlichem internet one sogenannter BKA Trojaner rum. this blackmail The People with money, so these again "entsperrt" go can (to payment). now - usually goes this BKA Trojaner to the equal principle. it nistet itself in the explorer one (means swaps The Real explorer.exe with the Schaddatei from. now determined my idea not only whom BKA Trojaner separate too others Trojaner (only Ransomware).
now have I me virtual, The bekanntesten Schaddateien for such Trojaner into eindimensionales aray To pack (speak a list). i will these list then with Fileexist inquire, whether these Files too present are.
BKA Remover
Window 0,0 - 500,500
Window Title "BKA Remover"
Window Style 64
Def @GetUserNameA(2) !"Advapi32.dll", "GetUserNameA"
Def &CSIDL_COMMON_APPDATA $23
Declare Button1%, Button2%,Button3%,Button4%,Button5%,Files$
'Procedures
Proc GetSpecialDir
Parameters csidl&
Declare Result$
Result$ = Space$(256)
If External("Shell32", "SHGetSpecialFolderPathA", 0, Addr(Result$), csidl&, 0)
Return Trim $(Result$)
EndIf
Return ""
ENDPROC
Proc GetUserName
Declare Buffer#, Size&, User$
Size& = 255
Dim Buffer#, 256
GetUserNameA(Buffer#, Addr(Size&))
User$ = String $(Buffer#, 0)
Dispose Buffer#
Return User$
ENDPROC
Dateien$ = Create("List", 1)
AddStrings(Files$, "C:\documents and Settings\All Users\Anwendungsdaten\wvf0rsf.js")
AddStrings(Files$, "C:\documents and Settings\All Users\Anwendungsdaten\WvF0RsF.pad")
AddStrings(Files$, "C:\documents and Settings\All Users\Anwendungsdaten\dsgsdgdsgdsgw.js")
AddStrings(Files$, "C:\documents and Settings\All Users\Anwendungsdaten\dsgsdgdsgdsgw.pad")
AddStrings(Files$, "C:\documents and Settings\All Users\Startmenü\programs\Autostart\ctfmon.lnk")
AddStrings(Files$, "C:\documents and Settings\"+GetUserName()+"\Anwendungsdaten\wvf0rsf.js")
AddStrings(Files$, "C:\documents and Settings\"+GetUserName()+"\Anwendungsdaten\WvF0RsF.pad")
AddStrings(Files$, "C:\documents and Settings\"+GetUserName()+"\Anwendungsdaten\dsgsdgdsgdsgw.js")
AddStrings(Files$, "C:\documents and Settings\"+GetUserName()+"\Anwendungsdaten\dsgsdgdsgdsgw.pad")
AddStrings(Files$, "C:\documents and Settings\"+GetUserName()+"\Startmenü\programs\Autostart\ctfmon.lnk")
AddStrings(Files$, "C:\ProgramData\dsgsdgdsgdsgw.pad")
AddStrings(Files$, "C:\documents and Settings\All Users\wgsdgsdgdsgsd.exe")
AddStrings(Files$, "C:\documents and Settings\"+GetUserName()+"\wgsdgsdgdsgsd.exe")
AddStrings(Files$, "C:\ProgramData\RWvESYd.js")
AddStrings(Files$, "C:\Users\All Users\AppData\Roaming\Microsoft\windows\Start Menu\Programs\Startup\runctf.lnk")
AddStrings(Files$, "C:\Users\"+GetUserName()+"\AppData\Roaming\Microsoft\windows\Start Menu\Programs\Startup\runctf.lnk")
AddStrings(Files$, "C:\ProgramData\RWvESYd.pad")
AddStrings(Files$, "C:\ProgramData\dsgsdgdsgdsgw.pad")
AddStrings(Files$, "C:\ProgramData\dsgsdgdsgdsgw.js ")
AddStrings(Files$, "C:\Users\All Users\wgsdgsdgdsgsd.exe")
AddStrings(Files$, "C:\Users\"+GetUserName()+"\wgsdgsdgdsgsd.exe")
AddStrings(Files$, "C:\ProgramData\k5wtzba.js")
AddStrings(Files$, "C:\ProgramData\k5wtzba.reg")
AddStrings(Files$, "C:\ProgramData\k5wtzba.bat")
AddStrings(Files$, "C:\ProgramData\k5wtzba.pad")
AddStrings(Files$, "C:\documents and Settings\All Users\Anwendungsdaten\0tbpw.pad ")
AddStrings(Files$, "C:\documents and Settings\All Users\Anwendungsdaten\0tbpw.js ")
'Mainwindow
Button1% = Create("Button",%HWND,"Scan",150,50,200,50)
Create("Tooltip",%HWND,Button1%,"Einen Scan to Trojanern ausführen")
Button2% = Create("Button",%HWND,"Updaten",150,100,200,50)
Create("Tooltip",%HWND,Button2%,"Das Program updaten")
Button3% = Create("Button",%HWND,"Andere Remover suchen",150,150,200,50)
Create("Tooltip",%HWND,Button3%,"Nach like Tools suchen")
Button4% = Create("Button",%HWND,"Spende,Contact and Sonstiges",150,200,200,50)
Create("Tooltip",%HWND,Button4%,"Spende make, with me Contact take in or other Aktionen")
Button5% = Create("Button",%HWND,"Beenden",150,250,200,50)
Create("Tooltip",%HWND,Button5%,"Das jeweilige Program beenden")
PopUp "&Programm"
AppendMenu 101, "Scan"
AppendMenu 102, "Updaten"
AppendMenu 103, "Andere Remover suchen"
AppendMenu 104, "Spende, Contact and Sonstiges"
Separator
AppendMenu 105, "Beenden"
While 1
WaitInput
If clicked(Button1%)
If FileExists(Files$)
Print Files$
EndIf
EndIf
EndWhile
The Loop is only so To Testzwecken made, should still To Whileloop made go.
I have already a Tipp get, the me but not logical appeared:
- I should something with InsertString make. naturally lies I me The Help through: "Die row s becomes on the position n2 into list the Controls n1 eingefügt. These function power naturally only sense with of/ one unsortierten Controls. has n2 the value -1 becomes The row end appended."
and the I will even not. i will only Files a Lieste insert in beliebiger Order.
How your testing can, that the program goes:
prepares still one Textdokument, save it under of/ one Malwaredatei into right Ordner ex and schaut whether the Remover the recognize.
yet are missing me jegliche ideas, Why the program Nich goes.
what planned is for the Program:
i'd yet a Autostartlister install. (have there too Includes). so could one too dangerous Deleting Entries.
love Regards |
| | | | |
| | | | | | | |
| | Gary12345 | Vielen Thanks. the would now mean, I now only The Filenames indicate should? ought to means to whom Files yourself search? |
| | | | |
| | | very. have the code supra but even again a Tippfehler entnommen.
You can so simply directories add and Bösdateien and the code finds then any. |
| | | | |
| | Gary12345 | I login me later. will be now first time any Files present and if it funkt, then would the lovely.
but now one large Thank you on you |
| | | | |
| | | gladly happen.
with whom Filenames addstring "wgsdgsdgdsgsd.exe" always lower case use since the Dateiliste too with lower case vorliegt.
i'd The Dateiliste but sooner as Textdatei from the internet loading about of your Page around the Tool slight currently hold to there You then always only on your Page The list update must.
If you not simply succeed simply again report, dürften only "3" Lines More go. |
| | | | |
| | Gary12345 | Jo, can we later make. CompileMarkSeparationcls
Declare Button1%, Button2%,Button3%,Button4%,Button5%
Button1% = Create("Button",%HWND,"Scan",150,50,200,50)
Create("Tooltip",%HWND,Button1%,"Einen Scan nach Trojanern ausführen")
Button2% = Create("Button",%HWND,"Updaten",150,100,200,50)
Create("Tooltip",%HWND,Button2%,"Das Programm updaten")
Button3% = Create("Button",%HWND,"Andere Remover suchen",150,150,200,50)
Create("Tooltip",%HWND,Button3%,"Nach dergleichen Tools suchen")
Button4% = Create("Button",%HWND,"Spende,Kontakt und Sonstiges",150,200,200,50)
Create("Tooltip",%HWND,Button4%,"Spende machen, mit mir Kontakt aufnehmen oder sonstige Aktionen")
Button5% = Create("Button",%HWND,"Beenden",150,250,200,50)
Create("Tooltip",%HWND,Button5%,"Das jeweilige Programm beenden")
PopUp "&Programm"
AppendMenu 101, "Scan"
AppendMenu 102, "Updaten"
AppendMenu 103, "Andere Remover suchen"
AppendMenu 104, "Spende, Kontakt und Sonstiges"
Separator
AppendMenu 105, "Beenden"
Proc GetSpecialDir
Parameters csidl&
Declare Result$
Result$ = Space$(256)
If External("Shell32", "SHGetSpecialFolderPathA", 0, Addr(Result$), csidl&, 0)
Return Trim$(Result$)
EndIf
Return ""
EndProc
chdir getSpecialDir(0)//desktop
chdir "../../"
addfiles *"*.*"
chdir getSpecialDir($26)//programme
addfiles *"*.*"
var s$=lower$(MoveListToStr$("\n"))
clearlist
addstring "dsgsdgdsgdsgw.js"
addstring "wgsdgsdgdsgsd.exe"
addstring "runctf.lnk"
var c&=0
whileloop 0,%getCount
if instr("\\"+listboxitem$(&loop)+"\n",s$)
print "Fund: "+listboxitem$(&loop)
add c&,1
endif
wend
print c&,"Funde."
waitinput
href='./../../function-references/XProfan/end/'>end
now to that trouble:
would be it possible, that it whom complete way indicating and these File automatically deletes? it should inquire, whether a Fund existing.
means somehow so:
If instr("\\"+listbositem$(<=1)+"\n",s$)
EDIT: ne so kanns Nich weg. stupid idea. must Yes go through.
or not?
If the Done is, I will thoroughly The Help reading and then could We also The idea with the Textdokument make. (or. a Textdatei, The then from the Inet loaded becomes). |
| | | | |
| | | here with Download: CompileMarkSeparation {$cleq}
cls
chdir getSpecialDir(0)//desktop
chdir "../../"
addfiles *"*.*"
chdir getSpecialDir($26)//programme
addfiles *"*.*"
var s$=lower$(MoveListToStr$("\n"))
var tmp$=downloadFile("https://quelltext.xprofan.com/src/nuamvvucveecc.txt")
while %Loading
waitinput 10
endwhile
clearlist
moveStrToList($Download,"\n")
var c&=0
var p&=0
whileloop 0,%getCount
p&=instr(listboxitem$(loop)+"\n",s$)
if p&
print "Fund: "+listboxitem$(loop)
tmp$=substr$(midd(s$,p&-260,520),1,listboxitem$(&loop)+"\n")
tmp$=substr$(tmp$,len(tmp$,"\n"),"\n")+listboxitem$(loop)
print "Datei:",tmp$
add c&,1
endif
wend
print c&,"Fund(e)."
waitinput
end
Proc GetSpecialDir
Parameters csidl&
Declare Result$
Result$ = Space$(256)
If External("Shell32", "SHGetSpecialFolderPathA", 0, Addr(Result$), csidl&, 0)
Return Trim$(Result$)
EndIf
Return ""
EndProc
proc midd
parameters s$,f&,l&
case f&<1 : f&=1
return mid$(s$,f&,l&)
./../../function-references/XProfan/endproc/'>endproc
|
| | | | |
| | Gary12345 | would be it weg, whom Text To format. Have there no Durchblick How I the separate should o.O Sorry, if I me stupid in lieu of |
| | | | |
| | Gary12345 | many Thanks where can I The Textdatei Upload? Have namely zurzeit none Server. which good Hoster know Thou? |
| | | | |
| | | gary12345 (23.01.13)
many Thanks where can I The Textdatei Upload? Have namely zurzeit none Server. which good Hoster know Thou?
many Members benefit since years whom XProfan.com Server the quasi for Members available standing.
If you want, then can You completely free and werbefrei very speedy WebSpace with eigener SubDomain and/ or eigener Domain having I yet enough Serverkapazitäten available have. Hierbei can You you a arbitrary address select - z.B. name.XProfan.com.
You sustain then FTP, PHP, SQL, EMails, IMAP, Pop, etc., means everything what a complete Own Domain ausmacht and not limited as Freehoster offer separate its a real physikalische Domain. you have then too infinite plenty Webspace and infinite plenty Traffic-capacity. If you the interested then simply say because then richte I the Server properly one.
From Freehostern sustain one no vergleichbares tender. often are The Webspaces slow or Werbebehaftet or one do not have The Possibility, its Webspace too as an afterthought with of/ one own TLD To understand.
gary12345 (23.01.13)
would be it weg, whom Text To format. Have there no Durchblick How I the separate should o.O Sorry, if I me stupid in lieu of
hang hold of it ex what You How very Show want. there's Yes many different windows-Controls and one can also HTML benefit. |
| | | | |
| | Gary12345 | naturally take I then whom XProfan Server.
name the Servers ought to his: malwareboard.XProfan.com
is Yes perfect. Something like is Yes Real class. another rießiges Thank you.
PS: I can it hardly grasp, that it nowadys yet something like gives.
Vielen Thanks |
| | | | |
|
AnswerTopic-Options | 24.290 Views |
Themeninformationenthis Topic has 4 subscriber: |