Antivirus

[curiousmaniac]

Hello, this my code for my simple antivirus, hope its not quiet dizzy because i am only newbie in this write code stuff, ok2. this script do fast delete when detecting autorun.inf in removable disk. but when you click at tray menu..example like i click "About" tray menu..its wait for 1 minutes or more for display it..all same goes on with other menu..have any idea for remove the delay?

expandcollapse popup

#include <file.au3>
#include <Misc.au3>
#RequireAdmin

Opt("WinTitleMatchMode", 4)
Opt("TrayMenuMode", 1)

If _Singleton(@scriptname,1) = 0 Then
    MsgBox(64, "Same Process Detection", "Realtime Detection -  was already running  ", 5)
    Exit
EndIf

TraySetToolTip("Realtime Detection v1.0")
TraySetState()
$FIXREGISTRY = TrayCreateItem("Clean Registry")
$STARTUP = TrayCreateMenu("Startup")
$ADDSTARTUP = TrayCreateItem("Run Realtime Detection when system startup", $STARTUP)
$REMOVESTARTUP = TrayCreateItem("Remove Realtime Detection from system startup", $STARTUP)
TrayCreateItem("")
$ABOUTITEM = TrayCreateItem("About")
TrayCreateItem("")
$EXITITEM = TrayCreateItem("Exit")
If FileExists("C:\Realtime Detection\Realtime Detection.exe") = False Then
    TrayTip("Realtime Detection v1.0", "Right click for menu.", 5, 1)
EndIf
$NOTRAYITEMSDISPLAY = RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer", "NoTrayContextMenu")
If $NOTRAYITEMSDISPLAY = "1" Then
    RegDelete("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer", "NoTrayItemsDisplay")
    RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer", "NoTrayItemsDisplay")
    ProcessClose("explorer.exe")
    If ProcessExists("explorer.exe") = False Then
        Run("explorer.exe")
    EndIf
EndIf
$NOTRAYCONTEXTMENU = RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer", "NoTrayContextMenu")
If $NOTRAYCONTEXTMENU = "1" Then
    RegDelete("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer", "NoTrayContextMenu")
    RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer", "NoTrayContextMenu")
    ProcessClose("explorer.exe")
    If ProcessExists("explorer.exe") = False Then
        Run("explorer.exe")
    EndIf
EndIf
While 1
    $MSG = GUIGetMsg()
    If $MSG = -3 Then Exit
    $REM = DriveGetDrive("REMOVABLE")
    If Not @error Then
        For $IREM = 1 To $REM[0]
            $REMDRIVE = $REM[$IREM]
            If $REMDRIVE <> "A:" And DriveGetFileSystem($REMDRIVE) <> "" Then
                If FileExists($REM[$IREM] & "\autorun.inf") Then
                    $REMOPEN = IniRead($REMDRIVE & "\autorun.inf", "autorun", "open", "None")
                    $REMSHELL = IniRead($REMDRIVE & "\autorun.inf", "autorun", "shellexecute", "None")
                    If Not @error Then
                        $SPLITREMSHELL = StringSplit($REMSHELL, " ")
                        $SPLITREMOPEN = StringSplit($REMOPEN, " ")
                        For $IREMOPEN = 1 To $SPLITREMOPEN[0]
                            If $REMOPEN = "None" Then
                                Sleep(1000)
                            Else
                                FileSetAttrib($REMDRIVE & "\" & $SPLITREMOPEN[$IREMOPEN], "-RASH")
                                FileDelete($REMDRIVE & "\" & $SPLITREMOPEN[$IREMOPEN])
                                FileSetAttrib($REMDRIVE & "\autorun.inf", "-RASH")
                                FileDelete($REMDRIVE & "\autorun.inf")
                                TrayTip("Malware detected!", "Malware " & $REMOPEN & " hase been kick away from your " & $REMDRIVE & " drive. You can relax now.", 5, 1)
                                _FILEWRITELOG(@ScriptDir & "\RealtimeDetection.log", "[Malware] " & $REMSHELL & " was removed from " & $REMDRIVE & @CRLF)
                                
                                ProcessClose($SPLITREMOPEN[$IREMOPEN])
                            EndIf
                        Next
                        For $IREMSHELL = 1 To $SPLITREMSHELL[0]
                            If $REMSHELL = "None" Then
                                Sleep(1000)
                            Else
                                FileSetAttrib($REMDRIVE & "\" & $SPLITREMSHELL[$IREMSHELL], "-RASH")
                                FileDelete($REMDRIVE & "\" & $SPLITREMSHELL[$IREMSHELL])
                                FileSetAttrib($REMDRIVE & "\autorun.inf", "-RASH")
                                FileDelete($REMDRIVE & "\autorun.inf")
                                TrayTip("Malware detected!", "Malware " & $REMOPEN & " hase been kick away from your " & $REMDRIVE & " drive. You can relax now.", 5, 1)
                                _FILEWRITELOG(@ScriptDir & "\RealtimeDetection.log", "[Malware] " & $REMSHELL & " was removed from " & $REMDRIVE & @CRLF)
                                ProcessClose($SPLITREMSHELL[$IREMSHELL])
                            EndIf
                        Next
                    EndIf
                EndIf
            EndIf
        Next
    EndIf
    $FIX = DriveGetDrive("FIXED")
    If Not @error Then
        For $F = 1 To $FIX[0]
            $FIXDRIVE = $FIX[$F]
            If $FIXDRIVE <> "A:" And DriveGetFileSystem($FIXDRIVE) <> "" Then
                If FileExists($FIX[$F] & "\autorun.inf") Then
                    $FIXOPEN = IniRead($FIXDRIVE & "\autorun.inf", "autorun", "open", "None")
                    $FIXSHELL = IniRead($FIXDRIVE & "\autorun.inf", "autorun", "shellexecute", "None")
                    $SPLITFIXOPEN = StringSplit($FIXOPEN, " ")
                    $SPLITFIXSHELL = StringSplit($FIXSHELL, " ")
                    For $FOPEN = 1 To $SPLITFIXOPEN[0]
                        $INSPLITOPEN = $SPLITFIXOPEN[$FOPEN]
                        If $FIXOPEN = "None" Then
                            Sleep(1000)
                        Else
                            ProcessClose($SPLITFIXOPEN[$FOPEN])
                            FileSetAttrib($FIXDRIVE & "\" & $SPLITFIXOPEN[$FOPEN], "-RASH")
                            FileDelete($FIXDRIVE & "\" & $SPLITFIXOPEN[$FOPEN])
                            FileSetAttrib($FIXDRIVE & "\autorun.inf", "-RASH")
                            FileDelete($FIXDRIVE & "\autorun.inf")
                        EndIf
                    Next
                    For $FSHELL = 1 To $SPLITFIXSHELL[0]
                        $INSPLITSHELL = $SPLITFIXSHELL[$FSHELL]
                        If $FIXSHELL = "None" Then
                            Sleep(1000)
                        Else
                            ProcessClose($SPLITFIXSHELL[$FSHELL])
                            FileSetAttrib($FIXDRIVE & "\" & $SPLITFIXSHELL[$FSHELL], "-RASH")
                            FileDelete($FIXDRIVE & "\" & $SPLITFIXSHELL[$FSHELL])
                            FileSetAttrib($FIXDRIVE & "\autorun.inf", "-RASH")
                            FileDelete($FIXDRIVE & "\autorun.inf")
                        EndIf
                    Next
                EndIf
            EndIf
        Next
    EndIf
    $MSG = TrayGetMsg()
    Select
        Case $MSG = $FIXREGISTRY
            $HCUEXPLORER = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"
            $HLMEXPLORER = "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"
            $HCUSYSTEM = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System"
            $HCUADVANCED = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
            $HLMWINLOGON = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
            $HCUMAIN = "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main"
            RegDelete($HCUEXPLORER, "NoFolderOptions")
            RegDelete($HLMEXPLORER, "NoFolderOptions")
            RegDelete($HCUEXPLORER, "NoViewContextMenu")
            RegDelete($HLMEXPLORER, "NoViewContextMenu")
            RegDelete($HLMEXPLORER, "NoStartMenuMorePrograms")
            RegDelete($HCUEXPLORER, "NoStartMenuMorePrograms")
            RegDelete($HCUEXPLORER, "HideClock")
            RegDelete($HLMEXPLORER, "HideClock")
            RegDelete($HCUEXPLORER, "NoDesktop")
            RegDelete($HLMEXPLORER, "NoDesktop")
            RegDelete($HCUEXPLORER, "NoRun")
            RegDelete($HLMEXPLORER, "NoRun")
            RegDelete($HCUEXPLORER, "NoControlPanel")
            RegDelete($HLMEXPLORER, "NoControlPanel")
            RegDelete($HCUEXPLORER, "NoSMMyDocs")
            RegDelete($HLMEXPLORER, "NoSMMyDocs")
            RegDelete($HCUEXPLORER, "NoRecentDocsMenu")
            RegDelete($HLMEXPLORER, "NoRecentDocsMenu")
            RegDelete($HCUEXPLORER, "NoSMMyPictures")
            RegDelete($HLMEXPLORER, "NoSMMyPictures")
            RegDelete($HCUEXPLORER, "NoStartMenuMyMusic")
            RegDelete($HLMEXPLORER, "NoStartMenuMyMusic")
            RegDelete($HLMEXPLORER, "NoStartMenuNetworkPlaces")
            RegDelete($HCUEXPLORER, "NoStartMenuNetworkPlaces")
            RegDelete($HCUSYSTEM, "DisableRegistryTools")
            RegDelete($HCUSYSTEM, "DisableCMD")
            RegDelete($HCUSYSTEM, "Disabletaskmgr")
            RegDelete($HCUADVANCED, "HideFileExt")
            RegDelete($HCUMAIN, "Window Title")
            RegDelete($HCUEXPLORER, "NoFind")
            RegDelete($HLMEXPLORER, "NoFind")
            RegDelete($HCUEXPLORER, "NoWinKey")
            RegDelete($HLMEXPLORER, "NoWinKey")
            RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL", "CheckedValue", "REG_DWORD", "1")
            RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL", "DefaultValue", "REG_DWORD", "2")
            RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN", "CheckedValue", "REG_DWORD", "2")
            RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN", "DefaultValue", "REG_DWORD", "2")
            ProcessClose("explorer.exe")
            If ProcessExists("explorer.exe") = False Then
                Run("explorer.exe")
            EndIf
            MsgBox(64, "Realtime Detection v1.0", "Registry has been fixed")
        Case $MSG = $ADDSTARTUP
            FileCopy(@ScriptFullPath, "C:\Realtime Detection\Realtime Detection.exe", "9")
            RegWrite("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "Realtime Detection", "REG_SZ", "C:\Realtime Detection\Realtime Detection.exe")
            MsgBox("64", "Realtime Detection v1.0", "Thanks for adding me.")
        Case $MSG = $REMOVESTARTUP
            FileDelete("C:\Realtime Detection\Realtime Detection.exe")
            RegDelete("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "Realtime Detection")
            MsgBox("64", "Realtime Detection v1.0", "You remove me..:-|.")
        Case $MSG = $ABOUTITEM
            ABOUT()
        Case $MSG = $EXITITEM
            ExitLoop
    EndSelect
WEnd

Func ABOUT()
    MsgBox("64", "Realtime Detection v1.0", "Is This OK?.")
EndFunc

Mr.Fix.au3

[Aladdin]

Keep in mind that this script will not completely stop execution of file which is written in AutoRun.Inf File until you dismount and remount your USB Disk Drive. i don't know why it happens but once i tried to create such script but even after deleting the AutoRun.Inf file the virus will be not removed. it was just a learning test and i did not tried writing something similar to that again. let me know the results if it really works.

Aladdin

[curiousmaniac]

Thanks Alladdin, about what you say is right..sometimes user must plug out and in again the removable disk...i'll try till it work..anyone have any idea to remove the delay?

[maniack]

u write all this code?

cuz this script look very familiar

[rajeshontheweb]

thats because of mount points created in windows registry

i fill post the details shortly actually i missed the link somewhere

i had tried to device such a stuff using wmi that will detect any usb inserted and try to act immediately.

stuff like usbcillin and ninja pendisk do it well.

[rajeshontheweb]

guys, it is Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints

but be careful. u have to backup the registry before you delete any keys.

I would recommend even all those registry delete commands you have in your scripts, you better use the registry backup function as well before you delete - it is always safe :-)