viruscleaner.frm

彻底清除“I Love You”病毒并介绍了病毒的原理及特征。Cool

VERSION 5.00
Begin VB.Form VirusCleanerMain 
   Caption         =   "Love Cleaner"
   ClientHeight    =   6615
   ClientLeft      =   60
   ClientTop       =   345
   ClientWidth     =   9150
   LinkTopic       =   "Form1"
   ScaleHeight     =   6615
   ScaleWidth      =   9150
   StartUpPosition =   3  'Windows Default
   Begin VB.TextBox Text2 
      Height          =   375
      Left            =   960
      TabIndex        =   6
      Text            =   "2"
      Top             =   5760
      Width           =   375
   End
   Begin VB.TextBox Text1 
      Height          =   3015
      Left            =   120
      MultiLine       =   -1  'True
      TabIndex        =   1
      Top             =   240
      Width           =   7815
   End
   Begin VB.CommandButton Command1 
      Caption         =   "Check And Clean"
      Height          =   495
      Left            =   6720
      TabIndex        =   0
      Top             =   5760
      Width           =   2175
   End
   Begin VB.Frame Frame1 
      Caption         =   "Current Drive Being Scanned"
      Height          =   1935
      Index           =   1
      Left            =   0
      TabIndex        =   2
      Top             =   3480
      Width           =   8055
      Begin VB.DriveListBox Drive4 
         CausesValidation=   0   'False
         Height          =   315
         Left            =   120
         TabIndex        =   5
         Top             =   240
         Width           =   4095
      End
      Begin VB.DirListBox Dir4 
         Height          =   1215
         Left            =   120
         TabIndex        =   4
         Top             =   600
         Width           =   4095
      End
      Begin VB.FileListBox File4 
         Height          =   1455
         Left            =   4320
         Pattern         =   "*.vbs"
         TabIndex        =   3
         Top             =   240
         Width           =   3375
      End
   End
   Begin VB.Label Label5 
      Caption         =   "Enter Number of Days to Search and Delete Files For"
      Height          =   255
      Left            =   1440
      TabIndex        =   7
      Top             =   5760
      Width           =   4815
   End
End
Attribute VB_Name = "VirusCleanerMain"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False

Private Sub Command1_Click()
'---------------------------------------------------------------
'Love Virus Cleaner
'May 4, 20000
'----------------------------------------------------------------
Dim strBuffer As String
Dim lngReturn As Long
Dim strWindowsSystemDirectory As String

Dim sReturnString As String 'holds the string of data returned
Screen.MousePointer = vbHourglass
sReturnString = GetStringValue("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "MSKernel32")

If InStr(1, sReturnString, "Error:") > 0 Then 'cannot get the resistry entry
Else
Text1.Text = Text1.Text & vbCrLf & "Run Entry Has Virus Entry"
Text1.Text = Text1.Text & vbCrLf & "Entry contains " & sReturnString
Text1.Text = Text1.Text & vbCrLf & "Removing Run Entry Key"
SetStringValue "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "MSKernel32", ""

End If

sReturnString = GetStringValue("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "Win32DLL")

If InStr(1, sReturnString, "Error:") > 0 Then 'cannot get the resistry entry
Else
Text1.Text = Text1.Text & vbCrLf & "RunServices Entry Has Virus Entry"
Text1.Text = Text1.Text & vbCrLf & "Entry contains " & sReturnString
Text1.Text = Text1.Text & vbCrLf & "Removing RunServices Entry Key"
SetStringValue "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices", "Win32DLL", ""

End If




strBuffer = Space$(MAX_PATH)
lngReturn = GetSystemDirectory(strBuffer, MAX_PATH)
strWindowsSystemDirectory = Left$(strBuffer, Len(strBuffer) - 1)

strWindowsSystemDirectory = Mid(strWindowsSystemDirectory, 1, InStr(1, strWindowsSystemDirectory, Chr(0)) - 1)
'Text1.Text = Text1.Text & vbCrLf & "Looking for file:LOVE-LETTER-FOR-YOU.HTM"
'If Dir(strWindowsSystemDirectory & "\LOVE-LETTER-FOR-YOU.HTM") <> "" Then
'Kill strWindowsSystemDirectory & "\LOVE-LETTER-FOR-YOR.HTM"
'Text1.Text = Text1.Text & vbCrLf & "FILE REMOVED:LOVE-LETTER-FOR-YOU.HTM"
'Else
'Text1.Text = Text1.Text & vbCrLf & "FILE NOT FOUND:LOVE-LETTER-FOR-YOU.HTM"
'End If

'update the home page
Text1.Text = Text1.Text & vbCrLf & "Updating Home Page to CNN.COM"

SetStringValue "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main", "Start Page", "http://www.cnn.com/"

SetStringValue "HKEY_USERS\Software\Microsoft\Internet Explorer\Main", "Start Page", "http://www.cnn.com/"



'Developing the file system class would be another way of hangle




Dim icounter3 As Long
Dim irc As Integer
   
ierrorflag = ""
 
'find good and bad drive
For icounter5 = 0 To Drive4.ListCount - 1
On Error GoTo Driveerror
Drive4.Drive = Drive4.List(icounter5)
On Error GoTo 0
Next


For icounter5 = 0 To Drive4.ListCount - 1
  'skip bad drive
  If InStr(1, ierrorflag, Trim(Str(icounter5))) > 0 Then
    icounter5 = icounter5 + 1
   End If
  'get out of loop if at end of drives
  If icounter5 > Drive4.ListCount - 1 Then
     Exit For
  End If

  Drive4.Drive = Drive4.List(icounter5)
   Dir4.Path = "\"
  
    
    Path = Dir4.Path
     
    
    
        sname = Findfile(Dir4.Path, "Dummy")
            
   
  
Next


Screen.MousePointer = vbDefault

Text1.Text = Text1.Text & vbCrLf & "Done"
Exit Sub
Fileerror:
ierrorflag1 = ierrorflag1 & icounter6
Driveerror:
ierrorflag = ierrorflag & icounter5
Resume Next




End Sub

Private Sub Dir1_Change()
Dir1.Path = Drive4.Drive

End Sub


Private Sub Drive4_Change()
Dir4.Path = Drive4.Drive
End Sub


Public Function Findfile(Path As String, File As String) As String
If Right(Path, 1) <> "\" Then Path = Path & "\"
  
  DirName = Dir(Path & "*.*", vbDirectory)
  Do While True
  
    If DirName = "" Then Exit Do
    DoEvents
    If DirName <> "." And DirName <> ".." Then
      If DirName <> "?" Then
      If (GetAttr(Path & DirName) And vbDirectory) = vbDirectory Then
        LastDir = DirName
        DirName = Findfile(Path & DirName & "\", File)
        If DirName <> "" Then
          Path = DirName
          Exit Do
        End If
        DirName = Dir(Path, vbDirectory)
        Do Until DirName = LastDir Or DirName = ""
          DirName = Dir
        Loop
        If DirName = "" Then Exit Do
      Else ' we have a file see if vbs
      
         If UCase(Right(DirName, 3)) = "VBS" Then
         
            irc = Int(Date - FileDateTime(Path & DirName))
             DoEvents
           ' If irc < 2 Then    ' good to look at the file bcasue less than 2 days old
           If irc < Val(Text2.Text) Then   ' good to look at the file bcasue less than 2 days old
              Text1.Text = Text1.Text & vbCrLf & Path & DirName
             Kill (Path & DirName)
            End If
         
         End If
         'check for the love letter file
          If UCase(DirName) = "LOVE-LETTER-FOR-YOU.HTM" Then
             Text1.Text = Text1.Text & vbCrLf & Path & DirName
             Kill (Path & DirName)
          End If
          
      End If
      End If
    End If
    DirName = Dir
  Loop
End Function