main.frm

杀木马软件的源代码

    If strNoWatch <> "" Then
        MsgBox "The following port(s)" & vbCrLf & _
                "cannot be watched:" & vbCrLf & vbCrLf & _
                strNoWatch, _
                vbOKOnly + vbExclamation
    End If
    If lngPortCount > 0 Then
        'Disable form's controls
        EnableDisable False
        StatusBar1.SimpleText = "Watching..."
        MsgBox "If any attack is made" & vbCrLf & _
                "on the selected port(s)," & vbCrLf & _
                "I'll automatically re-open", _
                vbOKOnly + vbInformation, _
                "Watching " & lngPortCount & " port(s)"
        'Put app in SysTray
        GoSystemTray
    Else
        'If start button is clicked when no ports are selected
        'from the list
        MsgBox "No ports are selected!", _
                vbOKOnly + vbExclamation
    
    
    End If

StartWatch_End:
    Exit Sub
    
NoWatch:
    'Appends each failed attempt to listen to a port to a string
    'which is displayed later. blnNoWatch tells the procedure not
    'to count this as a successful port watch
    blnNoWatch = True
    strNoWatch = strNoWatch & wskPort(intSelect).LocalPort & vbCrLf
    Resume Next
    
End Sub

Private Sub cmdStartWatch_Click()
    
    'Obvious
    StartWatch
    StatusBar1.SimpleText = "Watching..."
End Sub

Private Sub cmdStopWatch_Click()

    'Obvious
    StopWatch
    StatusBar1.SimpleText = "Stop Watching..."
    
    
End Sub

Private Sub mnuWatch_Click()
    
    'Obvious
    StartWatch

End Sub


Private Sub cmdExit_Click()

    'Obvious
    ExitTrojanDefence
    
End Sub

Private Sub mnuExit_Click()

    'Obvious
    ExitTrojanDefence
    
End Sub

Private Sub cmdClearAll_Click()
    Dim intSelect   As Integer
    
    'De-select all items in list box
    For intSelect = 0 To lstPort.ListCount - 1
        lstPort.Selected(intSelect) = False
    Next intSelect
    lstPort.Refresh

End Sub

Private Sub cmdSelectAll_Click()
    Dim intSelect   As Integer
    
    'Select all items in list box
    For intSelect = 0 To lstPort.ListCount - 1
        lstPort.Selected(intSelect) = True
    Next intSelect
    lstPort.Refresh
    StatusBar1.SimpleText = "Checked All"
    
    
End Sub

Private Sub ShowErrorMsg(lngError As Long)
    '
    Dim strMessage As String
    '
    Select Case lngError
        Case WSANOTINITIALISED
            strMessage = "A successful WSAStartup call must occur " & _
                         "before using this function."
        Case WSAENETDOWN
            strMessage = "The network subsystem has failed."
        Case WSAHOST_NOT_FOUND
            strMessage = "Authoritative answer host not found."
        Case WSATRY_AGAIN
            strMessage = "Nonauthoritative host not found, or server failure."
        Case WSANO_RECOVERY
            strMessage = "A nonrecoverable error occurred."
        Case WSANO_DATA
            strMessage = "Valid name, no data record of requested type."
        Case WSAEINPROGRESS
            strMessage = "A blocking Windows Sockets 1.1 call is in " & _
                         "progress, or the service provider is still " & _
                         "processing a callback function."
        Case WSAEFAULT
            strMessage = "The name parameter is not a valid part of " & _
                         "the user address space."
    End Select
    '
    MsgBox strMessage, vbExclamation, "Error..."
    '
End Sub

Private Sub Form_Activate()
    Dim FSO             As FileSystemObject
    Dim txs             As TextStream
    Dim strFile         As String
    Dim strDefinition   As String
    Dim strPortNumber   As String
    Dim lngSplit        As Long
    Dim astrInUse()     As String
    Dim blnInUse        As Boolean
    
    If blnStartUp Then
        ReDim astrInUse(0) As String
        
        'initialise variables
        astrInUse(0) = ""
        cmdAddPort.Enabled = False
        lstPort.Clear
        Set FSO = New FileSystemObject
    
        If Len(App.Path) = 3 Then
            'Running in root directory
            strFile = App.Path & "ports.csv"
        Else
            'Running in Sub-Folder
            strFile = App.Path & "\ports.csv"
        End If
        'Check Reference file exists in program directory
        If FSO.FileExists(strFile) Then
            'Open the file as a textstream
            Set txs = FSO.OpenTextFile(strFile)
            Do Until txs.AtEndOfStream
                'Read file one line at a time
                strDefinition = txs.ReadLine
                'Check for a "," in the line
                lngSplit = InStr(1, strDefinition, ",")
                If lngSplit Then
                    blnInUse = False
                    'Check the port to see if it is already in use
                    wskPort(0).Close
                    While wskPort(0).State
                        DoEvents
                    Wend
                    'Port is the first field in the .csv file, so get it
                    'like this
                    strPortNumber = Left(strDefinition, lngSplit - 1)
                    'Attempt to Listen to port
                    wskPort(0).LocalPort = CLng(strPortNumber)
                    On Error GoTo PortInUse
                    wskPort(0).Listen
                    'If ok then add leading zeros to port number to
                    'make it 5 chars long. Not necessary, but it makes
                    'the list box look tidy. If we need the port
                    'value as Long again then CLng will do the trick
                    If Not (blnInUse) Then
                        Do Until Len(strPortNumber) = 5
                            strPortNumber = "0" & strPortNumber
                        Loop
                        'Add port and trojan name to the list box
                        lstPort.AddItem strPortNumber & vbTab & " " & _
                                        Mid(strDefinition, lngSplit + 1)
                        lstPort.Refresh
                    End If
                End If
            Loop
        Else
            'If the file is not present, a message box is displayed.
            'Much nicer than "Run-Time Error - File Not Found" and allows
            'the program to run, although the user will have to manually
            'add any ports to be watched
            MsgBox "No port definition list found!" & _
                    vbCrLf & vbCrLf & _
                    "Missing: ports.csv" & _
                    vbCrLf & vbCrLf, vbOKOnly + vbInformation, _
                    "File not found..."
        End If
        'An array has been used to store all the port numbers from
        'the reference file that coud not be used.
        If astrInUse(0) <> "" Then
            'This string will now be set ready to display
            'all failed port numbers in the .csv file
            strPortNumber = ""
            'Loop through the array, appending each failed port
            'to the string
            For lngSplit = LBound(astrInUse) To UBound(astrInUse)
                strPortNumber = strPortNumber & vbCrLf & astrInUse(lngSplit)
            Next lngSplit
            'Redim array to save memory (not a lot)
            ReDim astrInUse(0) As String
            'See if more than one port number failed.
            'A more general msgbox could be used, as elsewhere
            'in the code, but it just looks nice this way.
            'I'm just a bit old fashioned i suppose :o)
            If lngSplit > 2 Then
                MsgBox "The following ports" & vbCrLf & _
                        "are in use and have" & vbCrLf & _
                        "not been loaded" & vbCrLf & _
                        "from file:" & vbCrLf & vbCrLf & _
                        strPortNumber & vbCrLf & vbCrLf, _
                        vbOKOnly + vbInformation, _
                        "Ports in use..."
            Else
                MsgBox "The following port" & vbCrLf & _
                        "is in use and has" & vbCrLf & _
                        "not been loaded" & vbCrLf & _
                        "from file:" & vbCrLf & vbCrLf & _
                        strPortNumber & vbCrLf & vbCrLf, _
                        vbOKOnly + vbInformation, _
                        "Port in use..."
            End If
        End If
        
        'Clean up
        Set txs = Nothing
        Set FSO = Nothing
        blnStartUp = False
    End If
    
Form_Activate_End:
    Exit Sub
    
PortInUse:
    'If there is an error when trying to listen to a port
    '(normally because it is already in use), we add the
    'relevant port number to the array
    blnInUse = True
    astrInUse(UBound(astrInUse)) = strPortNumber
    ReDim Preserve astrInUse(UBound(astrInUse) + 1) As String
    Resume Next

End Sub

Private Sub Form_Load()
    Dim lngRetVal      As Long
    Dim strErrorMsg    As String
    Dim udtWinsockData As WSAData
 
    'Set the one-time flag
    blnStartUp = True
    'Check for valid Winsock enviroment
    lngRetVal = WSAStartup(&H101, udtWinsockData)
    If lngRetVal <> 0 Then
        Select Case lngRetVal
        Case WSASYSNOTREADY
            strErrorMsg = "The underlying network subsystem is not " & _
                "ready for network communication."
        Case WSAVERNOTSUPPORTED
            strErrorMsg = "The version of Windows Sockets API support " & _
                "requested is not provided by this particular " & _
                "Windows Sockets implementation."
        Case WSAEINVAL
            strErrorMsg = "The Windows Sockets version specified by the " & _
                "application is not supported by this DLL."
        End Select
        'Report any error
        MsgBox strErrorMsg, vbCritical
            End If
    
End Sub

Private Sub mnuAbout_Click()
    
   aBOUT.Show
   
   
   
   
   
End Sub

Private Sub txtAddPort_Change(Index As Integer)
    
    'Enables the 'Add Port to List' button if there is
    'anything in the 'Port Number to Add' text box
    'Sets the description to "User selected"
    If txtAddPort(0) = "" Then
        cmdAddPort.Enabled = False
    Else
        cmdAddPort.Enabled = True
        txtAddPort(1) = "User selected port"
    End If
    
End Sub

Private Sub txtAddPort_LostFocus(Index As Integer)

    'Horrible bit of code to add leading zeros to the
    'port number before it is added to the list. Also
    'makes sure it is a number.
    If txtAddPort(0) Like "#####" Then
        txtAddPort(0) = txtAddPort(0)
        cmdAddPort.SetFocus
    ElseIf txtAddPort(0) Like "####" Then
        txtAddPort(0) = "0" & txtAddPort(0)
        cmdAddPort.SetFocus
    ElseIf txtAddPort(0) Like "###" Then
        txtAddPort(0) = "00" & txtAddPort(0)
        cmdAddPort.SetFocus
    ElseIf txtAddPort(0) Like "##" Then
        txtAddPort(0) = "000" & txtAddPort(0)
        cmdAddPort.SetFocus
    ElseIf txtAddPort(0) Like "#" Then
        txtAddPort(0) = "0000" & txtAddPort(0)
        cmdAddPort.SetFocus
    ElseIf txtAddPort(0) Like "?*" Then
        MsgBox "Not a valid port!", vbOKOnly + vbExclamation
        txtAddPort(0) = ""
        txtAddPort(1) = ""
        txtAddPort(0).SetFocus
    End If
    
End Sub

Private Sub cmdAddPort_Click()
    Dim blnInUse    As Boolean
    
    'Before adding the port number to the list, a quick
    'check is made to see if the port is already in use.
    blnInUse = False
    wskPort(0).Close
    While wskPort(0).State
        DoEvents
    Wend
    wskPort(0).LocalPort = txtAddPort(0)
    On Error GoTo CannotAddToList
    wskPort(0).Listen
    If Not (blnInUse) Then
        'If all is ok then add the new port number to
        'the list box
        lstPort.AddItem txtAddPort(0) & vbTab & " " & txtAddPort(1), lstPort.ListCount
        StatusBar1.SimpleText = "Added..."
        'and select it. An assumption here that if a user has
        'manually added a port number, then they might want it
        'to be watched. A more permanent solution is to add the
        'port and description to ports.csv which should be in
        'the same directory as the program.
        lstPort.Selected(lstPort.ListCount - 1) = True
        lstPort.Refresh
    End If
    'reset the text boxes
    txtAddPort(0) = ""
    txtAddPort(1) = ""

cmdAddPort_Click_End:
    Exit Sub
    
CannotAddToList:
    blnInUse = True
    'if there is an error, this is reported
    MsgBox "Port " & txtAddPort(0) & " is already in use" & vbCrLf & _
            "and will not be added to the" & vbCrLf & _
            "list of ports to watch.", _
            vbOKOnly + vbInformation, _
            "Port in use..."
    Resume Next
    
End Sub

Private Sub wskPort_ConnectionRequest(Index As Integer, ByVal requestID As Long)
    
    'If a connection attempt is made on any of the
    'watched ports then the appropriate winsock control
    'fires this event. Because it a member of an array
    'we can use it's index value to find out which port
    'was attacked
    AttackDetected Index

End Sub

'That's all folks
'Have fun
'Yigit Aktan / M@verick