crashdemons Posted April 11, 2008 Share Posted April 11, 2008 (edited) I wondered if someone could write a malware remover / scanner in AutoIt today, So I decided to attempt at one. The program I have come up with is a simple recursive filename and data scanner. It runs on a user-defined Definitions file which can contain Filename matches and Data Matches and can check for mutexes used by malware. When a file is "detected", the program displays a confirmation window that shows the defined malware name and allows the user to choose if SmallScan should go ahead to rename and move the file to the recycle bin. Changelog: 1.2 - Process checking/more data checking options - faster directory opening, changed definition format (see DEF file!) n/a - Defintion update 0.8 1.1 - Now closing scanned mutexes using WinAPI_CloseHandle 1.0 - Posted To-Do List: -Scan Registry? o.O Edited May 19, 2009 by crashdemons My Projects - WindowDarken (Darken except the active window) Yahsmosis Chat Client (Discontinued) StarShooter Game (Red alert! All hands to battlestations!) YMSG Protocol Support (Discontinued) Circular Keyboard and OSK example. (aka Iris KB) Target Screensaver Drive Toolbar Thingy Rollup Pro (Minimize-to-Titlebar & More!) 2D Launcher physics example Ascii Screenshot AutoIt3 Quine Example ("Is a Quine" is a Quine.) USB Lock (Another system keydrive - with a toast.) Link to comment Share on other sites More sharing options...
mrbond007 Posted April 11, 2008 Share Posted April 11, 2008 Looks promising, if you want to expand the malware database visit sites like http://www.spywaredb.com Projects : Space Regain - Memory Fusion - PWGT - Chip-ITGames : BrainPain - BrainPain Director's Cut - ProSpeed Games Pack (New)Vista vs XP : the forbidden fight Link to comment Share on other sites More sharing options...
gseller Posted April 11, 2008 Share Posted April 11, 2008 Groovy!! I can't wait to see more definitions.. Seems to work really well... Link to comment Share on other sites More sharing options...
crashdemons Posted April 11, 2008 Author Share Posted April 11, 2008 Groovy!! I can't wait to see more definitions.. Seems to work really well...There's some more now - although MyDoom, Sasser and the rest are all pretty old- I'll have to start looking at the newer threats.Also - Any hints at advanced file heuristics or data searching might be helpfulUsing Data Match to match a string in a file is fairly slow (ex: d;;string) My Projects - WindowDarken (Darken except the active window) Yahsmosis Chat Client (Discontinued) StarShooter Game (Red alert! All hands to battlestations!) YMSG Protocol Support (Discontinued) Circular Keyboard and OSK example. (aka Iris KB) Target Screensaver Drive Toolbar Thingy Rollup Pro (Minimize-to-Titlebar & More!) 2D Launcher physics example Ascii Screenshot AutoIt3 Quine Example ("Is a Quine" is a Quine.) USB Lock (Another system keydrive - with a toast.) Link to comment Share on other sites More sharing options...
Delta Posted April 12, 2008 Share Posted April 12, 2008 Very nice. What would make this really great is if it used the definition files from other anti-virus/malware/spyware software. You know something similar to those online file scanners. [size="1"]Please stop confusing "how to" with "how do"[/size] Link to comment Share on other sites More sharing options...
Innovative Posted April 12, 2008 Share Posted April 12, 2008 Incredible .. Although this doesn't help me , but at least it gave me some ideas on my workings. Thanks alot =) Link to comment Share on other sites More sharing options...
sniper120 Posted April 15, 2008 Share Posted April 15, 2008 (edited) I have made a anti spyware/anti virus program called Windows Security Manager. Sorry no GUI . The WHOLE program runs from the tray icon!My code is long due to:1. Manual Code of definitions (needs update system!)2. Add onsThis may sound like a noob thing but: If you can please let me have some code for an update system! Source, Program and basic help can be found at: Download site CODE#Include <Constants.au3>$g_szVersion = "WSM"If WinExists($g_szVersion) Then Exit ; It's already runningAutoItWinSetTitle($g_szVersion)Opt("TrayMenuMode", 1) ; Default tray menu items (Script Paused/Exit) will not be shown. ;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++SplashImageOn("", @ScriptDir&"\SplashWSM.bmp", 550, 300)Sleep(3000)SplashOff();++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++$Scan_item = TrayCreateItem("Scan")$menu_item = TrayCreateMenu("Add-Ons")$detect = TrayCreateItem("H.I.W Relealer", $menu_item)$lock = TrayCreateItem("V.L.S Mode", $menu_item)$Nuke = TrayCreateItem("Remove virus files", $menu_item)$Info_item = TrayCreateItem("Info")TrayCreateItem("")$exititem = TrayCreateItem("Shut Down")TraySetIcon("Shell32.dll","15")TraySetToolTip("Windows Security Manager")TraySetState() ; Show the tray icon;+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++TrayTip("Info", "Windows Security Manager is Runing",4,1)Func V_L_S() While 1=1 ProcessClose("firefox.exe") ProcessClose("iexplore.exe") ProcessClose("cmd.exe") WEnd If $msg = $exititem ThenendifEndFunc;_______________________________________________________________________________________$toggle = 0While 1=1 $msg = TrayGetMsg() Select Case $msg = 0 Sleep(1000) If $toggle = 0 Then TraySetState() ; Show the tray icon EndIF Case $msg = $Info_item TrayTip("Info", "Windows Security Manager Version 2.5",2,1) Case $msg = $exititem TrayTip("Info", "Windows Security Manager is Shuting Down",3,1) Sleep(5000) ExitLoop Case $msg = $lock TrayTip("Info", "Windows Security Manager Version is running V.L.S Mode!",2,1) Call("V_L_S") Case $msg = $Nuke TrayTip("Info", "Windows Security Manager Version will Nuke infected files!",1,1) SplashImageOn(" ", @ScriptDir &"/nuke.jpg",350,300,-1,-1,1)Sleep(2000) FileDelete("C:\WINDOWS\system32\ssttu.dll") FileDelete("C:\WINDOWS\system32\uttss.ini") FileDelete("C:\WINDOWS\system32\uttss.bak1") FileDelete("C:\Windows\fvprotect.exe") FileDelete("C:\my_photo2005.scr") FileDelete("C:\see_this!!.scr") FileDelete("C:\funny_pic.scr") FileDelete("C:\Windows\zipped.tmp") FileDelete("C:\Windows\zip1.tmp") FileDelete("C:\Windows\zip2.tmp") FileDelete("C:\Windows\zip3.tmp") FileDelete("C:\Windows\base64.tmp") FileDelete("C:\Windows\userconfig9x.dll") FileDelete("C:\Windows\1696195766.exe") FileDelete("C:\Program Files\Win update") FileDelete("C:\Program Files\A Better Internet") FileDelete("C:\Program Files\Kazaa") FileDelete("C:\Program Files\2020Search") FileDelete("C:\Program Files\180Solutions") SplashOff() TrayTip("Info", "Windows Security Manager Version has Nuked infected files!",1,1) Case $msg = $detect ;+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ If ProcessExists("firefox.exe") Then SoundPlay(@ScriptDir & "/alert.wav",1) MsgBox ( 0, "Warning!", "firefox internet explorer is runing!",60) ElseIf ProcessExists("iexplore.exe") Then SoundPlay(@ScriptDir & "/alert.wav",1) MsgBox ( 0, "Warning!", "Internet Explorer is runing!",6000) Else TrayTip("Info", "Windows Security Manager did not detect a hidden Internet Window",3,1) EndIf ;================================================================================= ;Live scaner would be here but there were problems! ;--------------------------------------------------------------------------------- Case $msg = $Scan_item ;----------------------------------------Start code----------------------------------------- ;info TrayTip("Info", "Windows Security Manager is scaning your computer",3,1) Sleep(400) ProgressOn("Scaning", "Scaning please wait..", "0 percent") For $i = 5 to 100 step 5 sleep(100) ProgressSet( $i, $i & " percent") Next Sleep(200) ;Scaning code ;------------------------------------------------------------------------------------------ If FileExists("C:\Program Files\Win update") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Found Win update, This is spyware!") ;------------------------------------------------------------------------------------------ ElseIf FileExists("C:\Program Files\A Better Internet") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Found A Better Internet, this is spyware.(This is a Trojan!)") ;------------------------------------------------------------------------------------------ ElseIf FileExists("C:\Program Files\Kazaa") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Found Kazaa, this insalls spyware.(This is a Trojan!) ") ;------------------------------------------------------------------------------------------ ElseIf FileExists("C:\Program Files\WildTangent") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Found WildTangent, this is spyware.(This is a Trojan!) ") ;------------------------------------------------------------------------------------------ ElseIf FileExists("C:\Program Files\2020Search") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Found 2020Search, this is spyware.(This is a Trojan!) ") ;------------------------------------------------------------------------------------------ ElseIf FileExists("C:\Program Files\180Solutions") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Found 180Solutions, this is spyware.(This is a Trojan!) ") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\4Arcade PBar") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Found 4Arcade PBar, this is spyware.(This is a Trojan!) ") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\2nd Thought") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Found 2nd Thought, this is spyware.") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\3721 Spyware") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "3721 Spyware, this is spyware.") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\7FaSSt Search") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "7FaSSt Search, this is malware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\AceSpy") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "AceSpy, this is spyware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\AccessPlugin") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "AccessPlugin , this is a Trojan!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\AbsoluteKey") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "AbsoluteKey, this is spyware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\Desktop Spy") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Desktop Spy, this is a keyloger!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\BPK") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "BPK, this is a keyloger!") ElseIf FileExists("C:\Program Files\Bpk") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Bpk, this is a keyloger!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\Hack99") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Hack99, this is a keyloger!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\Hellz Little Spy") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Hellz Little Spy, this is a keyloger!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\IPXKCR") Then MsgBox(262144, "warning", "IPXKCR, this is a keyloger!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\Phantom2") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Phantom2, this is a keyloger!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\Stukach") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Stukach, this is a keyloger!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\ABox") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Stukach, this is a keyloger!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\ABX Toolbar 1.0") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "ABX Toolbar 1.0, this is spyware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\About Blank") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "About Blank, this is spyware!!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\Ace Club Casino") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Ace Club Casino, this is adware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\AccessPlugin") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "AccessPlugin, this is spyware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\Absolute Yukon Solitaire") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Absolute Yukon Solitaire, this is adware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\Abotus") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Abotus, this is spyware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\ActiveSearch") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "ActiveSearch, this is spyware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\Y3KRAT") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Y3KRAT, this is spyware!") ElseIf FileExists("C:\Program Files\Y3KRAT 1.6") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Y3KRAT 1.6, this is spyware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\Acropolis") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Acropolis, this is spyware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\AcidBattery") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "AcidBattery, this is a Trojan!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\Acid Shivers") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Acid Shivers, this is a Trojan!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\AceNotes Free") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "AceNotes Free, this is spyware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\AckCmd") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "AckCmd, this is a Trojan!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\Acidoor") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Acidoor, this is a Trojan!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\Aconti") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Aconti, this is spyware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\AbsoluteKey") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "AbsoluteKey, this is a Trojan!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\??rvices\??rvices.exe") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "AbsoluteKey, this is spyware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\7FaSSt") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "7FaSSt, this is spyware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\7AdPro") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "7AdPro, this is spyware!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\WINDOWS\system32\ssttu.dll") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Vundo, this is a file made the Vundo Dropper! Threat level: 10 High!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\WINDOWS\system32\uttss.ini") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Vundo, this is a file made the Vundo Dropper! Threat level: 10 High!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\WINDOWS\system32\uttss.bak1") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "Vundo, this is a file made the Vundo Dropper! Threat level: 10 High!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\RealVNC") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "RealVNC, this is spyware! Threat level: 7 High!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\TightVNC") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "TightVNC, this is spyware! Threat level: 8 High!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Program Files\server.exe") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "warning", "R.C control, this is spyware! Threat level: 8 High!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\funny_pic.scr") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "Warning", "A Worm has infected your computer!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\see_this!!.scr") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "Warning", "A worm has infected your computer!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\my_photo2005.scr") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "Warning", "A worm has infected your computer!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Windows\fvprotect.exe") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "Warning", "A worm has infected your computer!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Windows\zipped.tmp") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "Warning", "A worm has infected your computer!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Windows\zip1.tmp") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "Warning", "A worm has infected your computer!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Windows\zip2.tmp") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "Warning", "A worm has infected your computer!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Windows\zip3.tmp") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "Warning", "A worm has infected your computer!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Windows\base64.tmp") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "Warning", "A worm has infected your computer!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Windows\userconfig9x.dll") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "Warning", "A worm has infected your computer!") ;----------------------------------------------------------------------------------------- ElseIf FileExists("C:\Windows\1696195766.exe") ThenSoundPlay(@ScriptDir & "/alert.wav",1) MsgBox(262144, "Warning", "A worm has infected your computer!") ;----------------------------------------------------------------------------------------- ;----------------------------------------------------------------------------------------- EndIf TrayTip("Info", "Windows Security Manager has completed the scan!",3,1) ;----------------------------------------------------------------------------------------- ProgressSet(100 , "Done", "Complete") ProgressOff() ;Definition #5 Spy Finder 5 ;----------------------------------------End code----------------------------------------- EndSelect WEndExitFull Code to scan the Running processes:CODE; Kill process! $sig = IniReadSection(@ScriptDir&"\WSM_SignaturesA.ini", "1")For $count = 0 To $sig[0][0] $temp = $sig[$count][1] If ProcessExists($temp) Then MsgBox(0,"Warning","Warning a infected process is runing on your computer! WSM will try to remove"& $temp) ProcessClose($temp) EndIfNextNext make a "INI" file called "WSM_SignaturesA" then try the code. Edited April 15, 2008 by sniper120 Link to comment Share on other sites More sharing options...
jaenster Posted April 15, 2008 Share Posted April 15, 2008 about the script, I get a windows error on run -jaenster Link to comment Share on other sites More sharing options...
sniper120 Posted April 15, 2008 Share Posted April 15, 2008 Can you tell me what the error is. (screen shot please!) Link to comment Share on other sites More sharing options...
sniper120 Posted May 25, 2008 Share Posted May 25, 2008 The error might be: >> START TEXT <<Line 5 (File "C:\Documents and Settings\USERNAME\Desktop\SCRIPTNAME.au3"):For $count = 0 To $sig[0][0]For $count = 0 To $sig^ ERRORError: Subscript used with non-Array variable. >> END TEXT <<Sorry! The ini file must have a [1] then a one line space, then a #="ProcessNAME.exe"Where the # is replace with a 0 then the next line have a number 1 and so on. Link to comment Share on other sites More sharing options...
crashdemons Posted May 19, 2009 Author Share Posted May 19, 2009 (edited) I figured I'd take another whack at this old script. The detection prompts now feature more options (eg: remove, keep quarantined, restore) The definitions file allows the user to check for specific processes. If a process is detected, it's priority is set to 0, it's suspended and you can choose to Close/Kill, keep it suspended, or resume it (with the original priority) File attributes are now temporarily removed before scanning the file and are reset upon finishing the scan, allowing +S +H (System Hidden) files to be scanned. etc. You can bet you won't hear the last of this script, even if it isn't so great. PS: Will add registry scanning at a later date, I know how to do it. Will also have to add/read checkboxes for the scan mode sometime also. Edit: Fixed commented-out ProcessClose, my bad. Edited May 19, 2009 by crashdemons My Projects - WindowDarken (Darken except the active window) Yahsmosis Chat Client (Discontinued) StarShooter Game (Red alert! All hands to battlestations!) YMSG Protocol Support (Discontinued) Circular Keyboard and OSK example. (aka Iris KB) Target Screensaver Drive Toolbar Thingy Rollup Pro (Minimize-to-Titlebar & More!) 2D Launcher physics example Ascii Screenshot AutoIt3 Quine Example ("Is a Quine" is a Quine.) USB Lock (Another system keydrive - with a toast.) Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now