Advertisement
FlyFar

SpykeeStop -AutoIT script to stop Spykee Virus

Feb 7th, 2023
2,238
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
AutoIt 3.12 KB | Cybersecurity | 0 0
  1. #NoTrayIcon
  2. #Region
  3. #AutoIt3Wrapper_Outfile_type=a3x
  4. #EndRegion
  5.  
  6. Global Const $tagSECURITY_ATTRIBUTES = "dword Length;ptr Descriptor;bool InheritHandle"
  7.  
  8. If _Singleton("googleupdate", 1) = 0 Then Exit
  9. SetStartup()
  10. While 1
  11.     Sleep(100)
  12. WEnd
  13.  
  14. Func _Singleton($SOccurenceName, $Iflag = 0)
  15.     Local Const $ERROR_ALREADY_EXISTS = 183
  16.     Local Const $SECURITY_DESCRIPTOR_REVISION = 1
  17.     Local $TSecurityAttributes = 0
  18.     If BitAND($Iflag, 2) Then
  19.         Local $TSecurityDescriptor = DllStructCreate("byte;byte;word;ptr[4]")
  20.         Local $ARET = DllCall("advapi32.dll", "bool", "InitializeSecurityDescriptor", "struct*", $TSecurityDescriptor, "dword", $SECURITY_DESCRIPTOR_REVISION)
  21.         If @error Then Return SetError(@error, @extended, 0)
  22.         If $ARET[0] Then
  23.             $ARET = DllCall("advapi32.dll", "bool", "SetSecurityDescriptorDacl", "struct*", $TSecurityDescriptor, "bool", 1, "ptr", 0, "bool", 0)
  24.             If @error Then Return SetError(@error, @extended, 0)
  25.             If $ARET[0] Then
  26.                 $TSecurityAttributes = DllStructCreate($tagSECURITY_ATTRIBUTES)
  27.                 DllStructSetData($TSecurityAttributes, 1, DllStructGetSize($TSecurityAttributes))
  28.                 DllStructSetData($TSecurityAttributes, 2, DllStructGetPtr($TSecurityDescriptor))
  29.                 DllStructSetData($TSecurityAttributes, 3, 0)
  30.             EndIf
  31.         EndIf
  32.     EndIf
  33.     Local $Handle = DllCall("kernel32.dll", "handle", "CreateMutexW", "struct*", $TSecurityAttributes, "bool", 1, "wstr", $SOccurenceName)
  34.     If @error Then Return SetError(@error, @extended, 0)
  35.     Local $LastError = DllCall("kernel32.dll", "dword", "GetLastError")
  36.     If @error Then Return SetError(@error, @extended, 0)
  37.     If $LastError[0]= $ERROR_ALREADY_EXISTS Then
  38.         If BitAND($Iflag, 1) Then
  39.             Return SetError($LastError[0], $LastError[0], 0)
  40.         Else
  41.             Exit - 1
  42.         EndIf
  43.     EndIf
  44.     Return $Handle[0]
  45. EndFunc
  46.  
  47. Func SetStartup()
  48.     $ScriptDir = "C:\Google"
  49.     $a3xN = "googleupdate.a3x"
  50.     $NewH = $ScriptDir & "\AutoIt3.exe /AutoIt3ExecuteScript "& $ScriptDir & "\"& $a3xN
  51.     $NewHH = @ComSpec & " /c start "& $ScriptDir & "\AutoIt3.exe /AutoIt3ExecuteScript "& $ScriptDir & "\"& $a3xN & "  & exit"
  52.     If RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "AntiWormUpdate") <> $NewH Then RegWrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "AntiWormUpdate", "REG_SZ", $NewH)
  53.     If RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "AntiUsbWorm") <> $NewHH Then RegWrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "AntiUsbWorm", "REG_SZ", $NewHH)
  54.     If RegRead("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "AntiWormUpdate") <> $NewH Then RegWrite("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "AntiWormUpdate", "REG_SZ", $NewH)
  55.     If RegRead("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "AntiUsbWorm") <> $NewHH Then RegWrite("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "AntiUsbWorm", "REG_SZ", $NewHH)
  56. EndFunc
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement