./c0de/c/botkilla.txt

0.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
80.
81.
82.
83.
84.
85.
86.
87.
88.
89.
90.
91.
92.
93.
94.
95.
96.
97.
98.
99.
100.
101.
102.
103.
104.
105.
106.
107.
108.
109.
110.
111.
112.
113.
114.
115.
116.
117.
118.
119.
120.
121.
122.
123.
124.
125.
126.
127.
128.
129.
130.
131.
132.
133.
134.
135.
136.
137.
138.
139.
140.
141.
142.
143.
144.
/*
        BotKiller
       Coded by a59
*/
#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>
 
void DoSearch( unsigned long uStartAddr, unsigned long uEndAddr, PROCESSENTRY32 pe32 );
void KillBot( PROCESSENTRY32 pe32 );
 
struct s_Search
{
   char* szBot;
   char* szString;
};
 
s_Search sSearch[ ] =
{
   { "VNC Scanning Bot", "\x52\x46\x42\x20\x30\x30\x33\x2E\x30\x30\x38\x0A" },
   { "RXBot", "[MAIN]" },
   { "RXBot", "[SCAN]" },
   { "RXBot", "[FTP]" },
   { "Unknown", "&echo bye" },
   { NULL, NULL }
};
 
void DoSearch( unsigned long uStartAddr, unsigned long uEndAddr, PROCESSENTRY32 pe32 )
{
   char szBigBuffer[ 0x5000 ] = { 0 };
   unsigned char Curbuf[ 0x500 ] = { 0 };
 
   HANDLE hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID );
 
   printf( "Scanning PID: %d [ %s ]\nStart Address: 0x%08X End Address: 0x%08X\n\n", pe32.th32ProcessID, pe32.szExeFile, uStartAddr, uEndAddr );
 
   for( unsigned long uCurAddr = uStartAddr; uCurAddr <= uEndAddr; uCurAddr++ )
   {
      BOOL bRead = ReadProcessMemory( hProcess, (void *)uCurAddr, (void *)&Curbuf, sizeof( Curbuf ), NULL );
 
      if( bRead )
      {
         int c = 0;
 
         strcat( szBigBuffer, (char *)Curbuf );         
 
         while( sSearch[ c ].szString != NULL )
         {
            if( strstr( szBigBuffer, sSearch[ c ].szString ) )
            {
               printf( "Found string \"%s\" in \"%s\" bot \"%s\"\n\n", sSearch[ c ].szString, pe32.szExeFile, sSearch[ c ].szBot );
               KillBot( pe32 );               
            }
 
            c++;
         }
 
         if( sizeof( szBigBuffer ) > 0x150 )
            ZeroMemory( szBigBuffer, sizeof( szBigBuffer ) );
      }
 
      if( !bRead )
         break;
   }
 
   CloseHandle( hProcess );
};
 
void KillBot( PROCESSENTRY32 pe32 )
{
   MODULEENTRY32 me32 = { 0 };
   HANDLE hPath = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, pe32.th32ProcessID );
   HANDLE hKillProcess;
 
   me32.dwSize = sizeof( me32 );
 
   BOOL bRetval = Module32First( hPath, &me32 );
 
   while( bRetval )
   {
      if( !strcmp( pe32.szExeFile, me32.szModule ) )
      {
         SetFileAttributes( me32.szExePath, FILE_ATTRIBUTE_NORMAL );
 
         hKillProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID );
         TerminateProcess( hKillProcess, 0 );
 
         Sleep( 500 );
 
         if( DeleteFile( me32.szExePath ) )
            printf( "Terminated and deleted %s\n", me32.szExePath );         
      }
 
      bRetval = Module32Next( hPath, &me32 );
   }   
 
   CloseHandle( hKillProcess );
   CloseHandle( hPath );
};
 
int main( )
{
   char szFile[ 128 ];
   GetModuleFileName( GetModuleHandle( NULL ), szFile, sizeof( szFile ) );
 
   char* szBlockList[ ] = { "explorer.exe", "hidserv.exe", "WINLOGON.EXE", "SERVICES.EXE", szFile };      
   HANDLE hProcess = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
   PROCESSENTRY32 pe32;
 
   pe32.dwSize = sizeof( PROCESSENTRY32 );
 
   BOOL bRetval = Process32First( hProcess, &pe32 );
   bool bDoSearch = true;
 
   while( bRetval )
   {
      Sleep( 250 );
 
      for( int i = 0; i < ( sizeof( szBlockList ) / sizeof( char* ) ); i++ )
      {
         if( strstr( szBlockList[ i ], pe32.szExeFile ) )
            bDoSearch = false;
      }
 
      if( bDoSearch )
      {
         DoSearch( 0x00400000, 0x004FFFFF, pe32 );
         DoSearch( 0x00100000 ,0x001FFFFF, pe32 );
      }
 
      else
         bDoSearch = true;
 
      bRetval = Process32Next( hProcess, &pe32 );
   }
 
   CloseHandle( hProcess );
 
   printf( "Done scanning, press ENTER to exit this program.\n" );
 
   getchar( );
 
   return 0;
};

Back