L A M P I R A N. Universitas Sumatera Utara

Transcription

1 L A M P I R A N

2 KEMENTERIAN PENDIDIKAN NASIONAL UNIVERSITAS SUMATERA UTARA FAKULTAS MATEMATIKA DAN ILMU PENGETAHUAN ALAM PROGRAM STUDI D III TEKNIK INFORMATIKA Jl. Bioteknologi No. 1 Kampus USU MEDAN Telp/FAX KARTU BIMBINGAN TUGAS AKHIR MAHASISWA Nama Mahasiswa : SYAIPUL AMRI NST NIM : Judul Tugas Akhir : PERANCANGAN PROGRAM APLIKASI ANTIVIRUS KOMPUTER MENGGUNAKAN VISUAL BASIC 6.0 Dosen Pembimbing : Dr. Sutarman, M.Sc Tanggal Mulai Bimbingan : Tanggal Selesai Bimbingan : No. Tanggal Asisten Bimbingan Pembahasan Pada Asisten Mengenai Pada BAB Desember 2010 Pengajuan Judul Tugas Akhir Mei 2011 Pengajuan Bab 1 Bab Mei 2011 Uji Program Paraf Dosen Pembimbing Keterangan Kartu ini dikembalikan ke Departemen Matematika bila Bimbingan Mahasiswa telah selesai Diketahui, Departemen Matematika FMIPA USU Ketua Disetujui, Pembimbing Utama/ Penanggung Jawab Prof. Dr. Tulus, M.Si Dr. Sutarman, M.Sc NIP NIP

3 SURAT KETERANGAN Hasil Uji Program Tugas Akhir Yang bertanda tangan dibawah ini, menerangkan bahwa Mahasiswa Tugas Akhir Program Diploma III Teknik Informatika: Nama : SYAIPUL AMRI NST NIM : Program Studi : D-III Teknik Informatika Judul Tugas Akhir : PERANCANGAN PROGRAM APLIKASI ANTIVIRUS KOMPUTER MENGGUNAKAN VISUAL BASIC 6.0 Telah melaksanakan test program Tugas Akhir pada tanggal./05/2011. Dengan Hasil : Sukses / Gagal Demikian diterangkan untuk digunakan melengkapi syarat pendaftaran Ujian Meja Hijau Tugas Akhir Mahasiswa bersangkutan di Departemen Matematika FMIPA USU Medan. Medan, 2011 Dosen Pembimbing, Dr. Sutarman, M.Sc NIP

4 LAMPIRAN Listing program Perancangan Aplikasi Antivirus 1. Source Code form utama (frmmain) Dim LewatTombolQuit As Boolean Dim StatScan As String Dim ItemKlik As Long Private Sub ckall_click() If ckall.value = 1 Then lvresult.checkall lvresult.uncheckall Private Sub cmdabout_click() MsgBox "Nosta Adalah Antivirus yg dirancang dengan source code Visual basic 6.0. Nosta dibuat dengan tujuan yaitu untuk menyelesaikan Tugas Akhir Studi Program Diploma!", vbexclamation, "Tentang Nosta" Private Sub CmdAct_Click() PopupMenu mnlv, 32, cmdact.left, cmdact.top , mnexplore Private Sub cmdbrowse_click() PopupMenu mnpath, 0, cmdbrowse.left, cmdbrowse.top + 375, mncustom Private Sub cmdfix_click() PopupMenu mnfix, 32, cmdfix.left, cmdfix.top + 960, mnfa Private Sub cmdhapus_click() PopupMenu mnremove, 0, cmdhapus.left, cmdhapus.top + 375, mnsp Private Sub cmdlist_click() If cmdlist.caption = "List viruses" Then cmdlist.caption = "Close list" ListVirus lstvirus cmdlist.caption = "List viruses" lstvirus.visible = False Private Sub cmdoption_click() frmoption.show 1, Me Private Sub cmdquit_click() LewatTombolQuit = True Unload Me End

5 Private Sub cmdscan_click() Dim Count As Byte Dim OldTimer As Single StatScan = "Finished!" cmdfix.enabled = False cmdact.enabled = False If lstscan.count = 0 Then Exit Sub If cmdscan.caption = "Start &scan" Then lvresult.clearlist ' clear list 'BuildLV PosisiScan (True) BERHENTI = False cmdscan.caption = "Abort &scan" cmdlist.caption = "List viruses" 'LepasSemuaKunci ' lepas kalo ada file-file virus yang dikunci biar bisa ke-scan 'LepasSemuaKunciCad ' lepas kunci cadangan lstvirus.visible = False ckall.enabled = False ckall.value = 0 VirusFound = 0 FileFound = 0 FileCheck = 0 FileNotCheck = 0 nregval = 0 nerrorreg = 0 lblthreat.caption = "Threat Found : 0 file(s)" OldTimer = Timer If frmoption.ck5.value = 1 Then lblstatus.caption = "Status : Scan Registry!" lblstatus.refresh If frmoption.ck2 = 1 Then ScanRegistry lblfile, True, False ScanRegistry lblfile, False, False Sleep 300 ' rehat 0.3 detik If frmoption.ck4.value = 1 Then lblstatus.caption = "Status : Scan Service!" ScanService lblfile, True ' Sleep 300 ' rehat 0.3 detik lblstatus.caption = "Status : Scan Startup!" ' scan startup di reg dan common (folder) ScanRegStartup lblfile, True, frmoption.ck2 lblstatus.refresh Sleep 300 ' rehat 0.3 detik lblstatus.caption = "Status : Scan Process!" ScanProses False, lblfile ' Scan Proses dulu

6 Sleep 300 lblstatus.caption = "Status : Scan Module!" ScanProses True, lblfile lblstatus.caption = "Status : Scan Root!" ScanRootDrive lblfile For Count = 0 To lstscan.count - 1 If BERHENTI = True Then Exit For lblstatus.caption = "Status : Scan File!" ' Dapatkan informasi Untuk ArrS 2 dulu GetLnkSample left(lstscan.itemtext(count), 3) KumpulkanFile RemoveFromRight(lstScan.ItemText(Count), 4), lblfile, True cmdscan.caption = "Start &scan" PosisiScan (False) MsgBoxU " ##### LAPORAN-SCAN! ######" & Chr(13) & _ " " & Chr(13) & Chr(13) & ChrW$(&H221A) & _ " Scan Status : " & StatScan & Chr(13) & ChrW$(&H221A) & _ " File Found : " & FileFound & Chr(13) & ChrW$(&H221A) & _ " File Scanned : " & FileCheck & Chr(13) & ChrW$(&H221A) & _ " File Not Scanned : " & FileNotCheck & Chr(13) & ChrW$(&H221A) & _ " Virus Found : " & VirusFound & Chr(13) & ChrW$(&H221A) & _ " Value Scanned : " & nregval & " value(s)" & Chr(13) & ChrW$(&H221A) & _ " Bad Value : " & nerrorreg & " value(s)" & Chr(13) & ChrW$(&H221A) & _ " Total Time : " & Jadikan_Menit(Round(Timer - OldTimer, 0)) & Chr(13) & Chr(13) & _ " " & Chr(13) & Chr(13) & _ "End Time :: " & Now, ChrW$(&H221A) & " -N O S T A- " & ChrW$(&H221A), 0, Me If lvresult.count > 0 And frmoption.ck2.value = 0 Then ckall.enabled = True cmdfix.enabled = True cmdact.enabled = True lblstatus.caption = "Status : [Ready]" StopKumpulkan BERHENTI = True PosisiScan (False) StatScan = "Aborted!" cmdscan.caption = "Start &scan" Private Sub cmdtools_click()

7 PopupMenu mntool, 0, cmdtools.left, cmdtools.top Private Sub Form_Initialize() Call InitCommonControls Dim IccEx As INIT_COMMON_CONTROLSEX IccEx.dwSize = Len(IccEx) IccEx.dwICC = ICC_WIN95_CLASSES Or ICC_ALL_CLASSES Call InitCommonControlsEx(IccEx) Private Sub Form_Load() Dim isi As String ' init ektensi penjara JailExt = "." & ChrW$(&H6BC) & ChrW$(&H695) & ChrW$(&H6BE) ' ini folder jai; FolderJail = left(environ$("windir"), 3) & ChrW$(&H6DE) & "~NOSTA~" & ChrW$(&H6DE) BuatPenjara lstscan.columnadd 0, "[Path]", 1000, ColumnLeft, 0, SortNone lstscan.headerhide = True lstscan.useunicode = True lstscan.itemadd 0, "", GetSpecFolder(WINDOWS_DIR) & "\*.*", 0, 0 lstscan.itemadd 1, "", GetSpecFolder(PROGRAM_FILE) & "\*.*", 0, 0 LoadDataIcon BacaDatabase "" ' Load DB Icon LoadSetting Environ$("windir") & "\NOSTA-SET.ini" BuildLV ScanService lblfile, True ScanProses False, lblfile lblfile.caption = " --> [Ready]" If lvresult.count > 0 Then ckall.enabled = True cmdfix.enabled = True cmdact.enabled = True Me.Refresh Private Sub Form_MouseMove(Button As Integer, Shift As Integer, X As Single, Y As Single) Label1.ForeColor = vbblack Label1.FontBold = False Private Sub Form_Resize() Me.Height = 8640 Me.Width = 7065 Private Sub Form_Unload(Cancel As Integer) If LewatTombolQuit = False Then Cancel = 1

8 Private Sub Label1_Click() ShellExecute Me.hwnd, vbnullstring, " vbnullstring, "C:\", 1 Private Sub Label1_MouseMove(Button As Integer, Shift As Integer, X As Single, Y As Single) Label1.ForeColor = vbblue Private Sub lvresult_ehitemclick(byval litem As Long) ItemKlik = litem Private Sub mnap_click() lstscan.clearlist Private Sub mnca_click() If MsgBox("kamu akan kehilangan semua deteksi virus dalam listview ini!, Apakah kamu yakin?", vbexclamation + vbyesno, "NOSTA") = vbyes Then lvresult.clearlist ckall.enabled = False cmdfix.enabled = False cmdact.enabled = False Private Sub mncustom_click() UniDialog1.FolderMessage = "Select a path : " UniDialog1.ShowFolder Private Sub mndoc_click() frmdocheal.show 1, Me Private Sub mnexplore_click() Path = GetFilePath(lvResult.SubItemText(ItemKlik, 1)) Shell "Explorer.exe /e," & Path, vbnormalfocus Private Sub mnfa_click() lvresult.checkall FIX_Threat lvresult Private Sub mnfc_click() FIX_Threat lvresult Private Sub mnos_click() If mnos.caption = "[Hide Interface]" Then Me.Hide Me.WindowState = vbnormal

9 Private Sub mnjail_click() frmjail.show 1, Me Private Sub mnpd_click() frmdeleter.show 1, Me Private Sub mnpm_click() frmproses.show 1, Me Private Sub mnpro_click() ShowProperty lvresult.subitemtext(itemklik, 1), Me.hwnd Private Sub mnrem_click() If AdakahFlash = " " Then MsgBoxU ChrW(&H221A) & " Removable Drive is not avalaible! ", ChrW$(&H221A) & " -N O S T A- " & ChrW$(&H221A), vbexclamation, Me PecahFD (AdakahFlash) Private Function PecahFD(sFD As String) As Byte Dim stmp() As String Dim bcount As Byte If InStr(sFD, ",") > 0 Then ' Berarti ada lebih dari 1 stmp = Split(sFD, ",") PecahFD = UBound(sTmp) + 1 For bcount = 1 To PecahFD - 1 If SudahAdakah(sTmp(bCount)) = False Then lstscan.itemadd lstscan.count, "", stmp(bcount) & "\*.*", 0, 0 bcount PecahFD = 1 If SudahAdakah(sTmp(bCount)) = False Then lstscan.itemadd lstscan.count, "", sfd & "\*.*", 0, 0 Private Sub mnsp_click() Dim bpath As Byte For bpath = 0 To lstscan.count If lstscan.itemselected(bpath) = True Then lstscan.itemremove (bpath) Private Sub mntv_click() frmvirus.show 1, Me

10 Private Sub UniDialog1_FolderSelect(ByVal Path As String) If Path <> "" Then If SudahAdakah(Path) = False Then lstscan.itemadd lstscan.count, "", Path & "\*.*", 0, 0 MsgBox "Current path has been added!", vbexclamation, "NOSTA" Private Function AddSlash(sPath As String) As String If right(spath, 1) = "\" Then AddSlash = spath AddSlash = spath & "\" Private Sub PosisiScan(TF As Boolean) If TF = True Then cmdoption.enabled = False cmdlist.enabled = False cmdabout.enabled = False cmdquit.enabled = False cmdtools.enabled = False frscan.enabled = False cmdhapus.enabled = False cmdbrowse.enabled = False frresult.enabled = False cmdfix.enabled = False cmdact.enabled = False cmdoption.enabled = True cmdlist.enabled = True cmdabout.enabled = True cmdquit.enabled = True cmdtools.enabled = True frscan.enabled = True cmdhapus.enabled = True cmdbrowse.enabled = True frresult.enabled = True cmdfix.enabled = True cmdact.enabled = True Private Function SudahAdakah(sPath As String) As Boolean Dim btemp As Byte For btemp = 1 To lstscan.count If lstscan.itemtext(btemp - 1) = spath & "\*.*" Then SudahAdakah = True Exit Function

11 SudahAdakah = False Private Sub BuildLV() With lvresult.clearlist.columnclear.listmode = ehyperlist.initimlheader.imlheaderaddicon picup.picture.imlheaderaddicon picdown.picture.initimlsmall.imlsmalladdicon picup.picture.imlsmalladdicon picdown.picture.imlsmalladdicon pic1.picture.imlsmalladdicon pic2.picture.imlsmalladdicon pic3.picture.imlsmalladdicon pic4.picture.imlsmalladdicon pic5.picture.imlsmalladdicon pic6.picture.imlsmalladdicon pic7.picture.imlsmalladdicon pic8.picture.imlsmalladdicon pic9.picture.imlsmalladdicon pic10.picture.imlsmalladdicon pic11.picture.imlsmalladdicon pic12.picture.imlsmalladdicon pic13.picture.checkboxes = True.InitImlState.LoadStateImageList.ViewMode = StyleReport.ColumnAdd 0, "[Object Name]", 180, ColumnCenter.ColumnAdd 1, "[Object Path]", 400, ColumnLeft.ColumnAdd 2, "[Size]", 100, Columnright.ColumnAdd 3, "[Status]", 140, ColumnCenter '.ItemsSorted = True '[ko aneh ketika di shorted chekboc fak ikut shorted]???.skincheckbox CheckBoxXP, False.SkinHeaders HeaderXP, &H753F17, &H94511F, &HC46A28, False '.HeaderForeColor = vbblack.headerpressed = vbblack.headercustom = True.UseUnicode = True.ForeColor = vbblack.fullrowselect = True.BorderStyle = Thick.GridLines = True.ScrollBarFlat = True.InitList 0, 3 End With

12 Private Function Jadikan_Menit(Detik As Long) As String Dim kmenit As Single Dim kdetik As Byte kmenit = (Detik / 60) kdetik = Detik Mod 60 Jadikan_Menit = Round(kMenit - 1, 0) & " m " & kdetik & " s" Private Function FIX_Threat(ByRef lvfix As uchyperlistng) Dim strtext As String Dim strstat As String Dim strpath As String Dim pfile As Long Dim scfile As Long Dim ffile As Long Dim icount As Long Dim niconitem As Long ' klo lebih dari 6 artinya penanganan registry, attrib atau virus yang sudah di fix Dim ifileres As Long Dim nworm As String Dim shapus As Boolean Dim breg As Boolean If frmoption.ck4.value = 0 Then ' klo proses belum di scan sebelumnya strpath = Environ$("windir") & "\System32\wscript.exe" KillProByName strpath ' buat jaga-jaga klo ada proses Wscripst 'Call LepasSemuaKunci ' buat jaga-jaga kalo ada proses yang masih dikunci 'Call LepasSemuaKunciCad ' buat jaga-jaga kalo ada proses yang masih dikunci lblstatus.caption = "Status : [Fixing] - Please Wait!" Me.Refresh With lvfix '.ListRefresh For icount = 0 To lvfix.count - 1 strtext =.SubItemText(iCount, 3) strpath =.SubItemText(iCount, 1) nworm =.ItemText(iCount) niconitem =.ItemIcon(iCount) lblfile.caption = "Processing (" & pfile + 1 & ")! " & strpath If.Checked(iCount) = True And niconitem < 7 And niconitem <> 14 Then pfile = pfile + 1 scfile = scfile + 1 ' sukses di hapus If isinfecteddoc(strpath) = False Then ' jika doc pattern coba sembuhkan... If nworm = "W32/Srig4 4[exe]" Then ' jika W32/Srigala, coba restore ifileres = HealInfeksiSrigala(strPath) strtext = "Restore : " & ifileres & " file(s)".subitemtext(icount, 3) = strtext If niconitem > 2 And niconitem < 7 Then ' ketangkep karena HEUR JailFile strpath, FolderJail, nworm

13 .SubItemText(iCount, 3) = ChrW(&H221A) & " Move to Jail " & ChrW(&H221A) If niconitem = 2 Then ' virus yang dah ada namanya shapus = HapusFile(strPath) If shapus = False Then strtext = "!Can't Deleted!" strtext = ":: Deleted ::".SubItemText(iCount, 3) = strtext strtext = "Heal : " & HealDoc(strPath, strpath & "_repair_.doc").subitemtext(icount, 3) = strtext If strtext = "!Can't Deleted!" Or strtext = "Heal : Fail!" Then ' jika hpus virus gagal dan heal doc gagal ffile = ffile + 1 ' file yang gagal difix scfile = scfile - 1 If niconitem > 2 And niconitem < 7 Then ' jika udah dipenjara lvfix.itemicon(icount) = 14 lvfix.refresh lvfix.itemicon(icount) = 7 lvfix.refresh If.Checked(iCount) = False Then If.Checked(iCount) = True And niconitem > 6 And niconitem < 14 Then ' penanganan ATTR dan REG breg = FIX_REG_ATTR(nWorm, strpath, strtext, icount) lvfix.refresh If breg = True Then scfile = scfile + 1 ' sukses di fix dinaikann ffile = ffile + 1 pfile = pfile + 1 ' objek yang di proses DoEvents End With lblfile.caption = "Processing : Complete!" MsgBoxU " #### FIXED-REPORT ####" & Chr(13) & _ " " & Chr(13) & Chr(13) & ChrW(&H221A) & _ " Processed : " & pfile & " object(s)" & Chr(13) & ChrW(&H221A) & _ " Fixed : " & scfile & " object(s)" & Chr(13) & ChrW(&H221A) & _ " Fail Fixed : " & ffile & " object(s)" & Chr(13) & Chr(13) & _ " ", ChrW(&H221A) & " FIXED " & ChrW(&H221A), vbexclamation, Me lblstatus.caption = "Status : [Ready]" lvfix.refresh Me.Refresh

14 Private Function FIX_REG_ATTR(sOBJ As String, sobjpath As String, sstatus As String, nitem As Long) As Boolean Dim lmain As Long Dim spath As String Dim svalue As String Dim strue As String Dim sexcept(4) As String sexcept(0) = "DWORD Fixed!" sexcept(1) = "STRING Fixed!" sexcept(2) = "STRING Deleted!" sexcept(3) = "Normalized!" sexcept(4) = "Fixed!" ' status jika option clean after found di check If sstatus = sexcept(0) Or sstatus = sexcept(1) Or sstatus = sexcept(2) Or sstatus = sexcept(3) Or sstatus = sexcept(4) Then FIX_REG_ATTR = False Exit Function lmain = GetMainKeyLong(sObjPath) spath = GetPathReg(sObjPath) svalue = GetValueReg(sObjPath) strue = GetTrueValue(sObjPath) Select Case UCase(left(sOBJ, 11)) Case "BAD DWORD V" FIX_REG_ATTR = True SetDwordValue lmain, spath, svalue, CLng(sTrue) lvresult.itemicon(nitem) = 11 lvresult.subitemtext(nitem, 3) = "DWORD Fixed!" Case "BAD STRING " FIX_REG_ATTR = True SetStringValue lmain, spath, svalue, strue lvresult.itemicon(nitem) = 9 lvresult.subitemtext(nitem, 3) = "STRING Fixed!" Case "VIRUS START" FIX_REG_ATTR = True DeleteValue lmain, spath, svalue lvresult.itemicon(nitem) = 9 lvresult.subitemtext(nitem, 3) = "STRING Deleted!" Case "HIDDEN FILE" FIX_REG_ATTR = True NormalizeAttribute sobjpath lvresult.itemghosted(nitem) = False lvresult.subitemtext(nitem, 3) = "Normalized!" Case "HIDDEN FOLD" FIX_REG_ATTR = True NormalizeAttribute sobjpath lvresult.itemghosted(nitem) = False lvresult.subitemtext(nitem, 3) = "Normalized!" Case FIX_REG_ATTR = False Exit Function End Select Private Function GetMainKeyLong(sRegPath As String) As Long

15 Dim stmp() As String stmp = Split(sRegPath, "\") GetMainKeyLong = StringToMain(sTmp(0)) Private Function GetPathReg(sRegPath As String) As String Dim TMP As String TMP = left(sregpath, InStr(sRegPath, "=> (")) TMP = Mid(TMP, InStr(TMP, "\") + 1) TMP = GetFilePath(TMP) GetPathReg = TMP Private Function GetValueReg(sRegPath As String) As String Dim TMP As String TMP = left(sregpath, InStr(sRegPath, " => (") - 1) TMP = GetFileName(TMP) If TMP = "(Default)" Then TMP = "" GetValueReg = TMP Private Function GetTrueValue(sRegPath As String) As String Dim TMP As String TMP = Mid(sRegPath, InStr(sRegPath, ">>> ") + 4) GetTrueValue = TMP 2. listing program form delete Dim ucfile As String Private Sub cmdbrowse_click() UniDialog1.ShowOpen Private Sub Command1_Click() If ValidFile(ucFile) = True Then If MsgBox("Yakinkah anda akan menghapus file : " & Chr(13) & _ "[ " & ucfile & " ]?", vbexclamation + vbyesno, "#Power Delete#") = vbyes Then If PowerDel(ucFile) = 1 Then MsgBox "Penghapusan Sukses!", vbinformation, "#Power Delete#" MsgBox "Penghapusan Gagal!", vbinformation, "#Power Delete#" MsgBox "File [ " & ucfile & " ] " & Chr(13) & _ "Tidak terdeteksi keberadaanya!", vbexclamation, "#Power Delete#" Private Sub Command2_Click() MsgBox "Anda dapat menggunakan program alat ini untuk :" & Chr(13) & _

16 "*Menghapus file yang susah dihapus secara manual" & Chr(13) & _ "*Menghapus file yang dilindungi proses lain" & Chr(13) & Chr(13) & _ "Ingat file yang dilindungi system kemungkinan gagal dihapus!", vbinformation, "#Power Deleter#" Private Sub Text1_Change() ucfile = Text1.Text Private Sub UniDialog1_OpenFile(ByVal filename As String) ucfile = filename Text1.Text = filename Private Function PowerDel(sFile As String) As Long Dim LEAX As Long Dim CTurn As Long Dim PID As Long Dim nsize As Long Dim ENPC() Dim sprosespath As ENUMERATE_PROCESSES_OUTPUT As String LEAX = PamzEnumerateProcesses(ENPC()) MYID = GetCurrentProcessId() If LEAX <= 0 Then GoTo LBL_TERAKHIR For CTurn = 0 To (LEAX - 1) sprosespath = PamzNtPathToUserFriendlyPathW(ENPC(CTurn).szNtExecutablePathW) PID = ENPC(CTurn).nProcessID If UCase(sFile) = UCase(sProsesPath) Then If PamzTerminateProcess(PID) > 0 Then HapusFile sfile CekInModule sfile, PID CTurn = 0 Sleep 500 For CTurn = 0 To 10 HapusFile sfile If ValidFile(sFile) = True Then PowerDel = 0 PowerDel = 1 LBL_TERAKHIR: Private Sub CekInModule(strFile As String, PID As Long)

17 Dim LEAX As Long Dim CTurn As Long Dim paddress As String Dim smodulepath As String Dim ENMC() As ENUMERATE_MODULES_OUTPUT LEAX = PamzEnumerateModules(TargetPID, ENMC) If LEAX <= 0 Then GoTo LBL_TERAKHIR For CTurn = 0 To (LEAX - 1) smodulepath = PamzNtPathToUserFriendlyPathW(ENMC(CTurn).szNtModulePathW) If UCase(strFile) = UCase(sModulePath) Then If PamzTerminateProcess(PID) > 0 Then PamzTerminateProcess (PID) HapusFile strfile LBL_TERAKHIR: 3. listing program form docheal Private Sub cmdheal_click() If isinfecteddoc(txtfile.text) = True Then HealDoc txtfile.text, txtfile.text & ".doc" MsgBox "Bukan dokumen yang terinfeksi!", vbexclamation, "Perhatian" Private Sub cmdpilih_click() UniDialog1.ShowOpen Private Sub Command1_Click() MsgBox "You can use this tool to heal infected doc caused by some viruses!", vbexclamation, "N*O*S*T*A" Private Sub UniDialog1_OpenFile(ByVal filename As String) If filename <> "" Then txtfile.text = filename UniLabel1.Caption = filename 4. listing program form jail Dim spathres As String Private Sub Command1_Click() Dim ncount As Long

18 Dim sfile As String If LvJail.Count = 0 Then Exit Sub For ncount = 0 To LvJail.Count - 1 sfile = FolderJail & "\" & LvJail.SubItemText(nCount, 3) HapusFile sfile LvJail.ClearList MsgBox "All prisoner killed!", vbexclamation, "NOSTA" READ_DATA FolderJail Private Sub Command2_Click() If LvJail.Count = 0 Then Exit Sub UniDialog1.ShowFolder Private Sub Command3_Click() Dim sfile As String If LvJail.Count = 0 Then Exit Sub sfile = FolderJail & "\" & LvJail.SubItemText(nItemTerpilih, 3) HapusFile sfile READ_DATA FolderJail Private Sub Command4_Click() Dim sfile As String Dim OriFile As String With LvJail If.Count = 0 Then Exit Sub OriFile =.SubItemText(nItemTerpilih, 1) sfile = FolderJail & "\" &.SubItemText(nItemTerpilih, 3) If PathIsDirectory(StrPtr(GetFilePath(OriFile))) <> 0 Then If ValidFile(OriFile) = True Then If MsgBox("File is already exist. Do you want to over write?", vbyesno + vbexclamation, "NOSTA") = vbyes Then RestoreJailFile sfile, OriFile HapusFile sfile READ_DATA FolderJail MsgBox "Prisoner released!", vbexclamation, "NOSTA" RestoreJailFile sfile, OriFile HapusFile sfile READ_DATA FolderJail MsgBox "Prisoner released!", vbexclamation, "NOSTA" MsgBox "Original path is not avalaible - use custom path to relese prisoner!", vbexclamation, "NOSTA" End With Private Sub Form_Load() BuildLV READ_DATA FolderJail

19 Private Function nitemterpilih() As Long Dim pnum As Long For pnum = 0 To LvJail.Count - 1 If LvJail.ItemSelected(pNum) = True Then nitemterpilih = pnum Exit Function Private Sub BuildLV() With LvJail.ClearList.ColumnClear.ListMode = ehyperlist.initimlheader.imlheaderaddicon picup.picture.imlheaderaddicon picdown.picture.initimlsmall.imlsmalladdicon picup.picture.imlsmalladdicon picdown.picture.imlsmalladdicon pic1.picture.loadstateimagelist.viewmode = StyleReport.ColumnAdd 0, "[Virus Name]", 130, ColumnCenter.ColumnAdd 1, "[Original Path]", 300, ColumnLeft.ColumnAdd 2, "[Size]", 100, ColumnCenter.ColumnAdd 3, "[In Jail]", 60, ColumnLeft.SkinHeaders HeaderXP, &H753F17, &H94511F, &HC46A28, False.HeaderPressed = vbblack.headercustom = True.UseUnicode = True.ForeColor = vbblack.scrollbarflat = True.FullRowSelect = True.BorderStyle = Thick.GridLines = True.InitList 0, 3 End With Private Function READ_DATA(sJail As String) Dim nfree As Long Dim lngitem As Long Dim nop As Long Dim hfile As Long Dim nlenght As Long Dim nturn As Long Dim spath As String Dim stmp As String Dim nvirname As String Dim atmp() As String Dim sfile() As String Dim nfile As Long Dim clfile As New clsfile

20 nfile = GetFile(sJail, sfile) With LvJail.ClearList For nturn = 0 To nfile - 1 On Error GoTo LEWAT hfile = clfile.vbopenfile(sfile(nturn), FOR_BINARY_ACCESS_READ, LOCK_NONE) If hfile > 0 Then Dim BuffData() As Byte nlenght = clfile.vbfilelen(hfile) If nlenght > 1000 Then nlenght = 1000 nop = clfile.vbreadfileb(hfile, 1, nlenght, BuffData) clfile.vbclosefile hfile stmp = StrConv(BuffData, vbunicode) stmp = StrConv(sTmp, vbfromunicode) atmp() = Split(sTmp, " ") spath = Mid(aTmp(0), 5) nlenght = CLng(aTmp(1)) nvirname = atmp(2) lngitem =.Count.ItemAdd lngitem, "", nvirname, 2, 0.SubItemsAdd lngitem, 1, spath.subitemsadd lngitem, 2, Format$(nLenght, "#,#") & " B".SubItemsAdd lngitem, 3, GetFileName(sFile(nTurn)) Erase BuffData LEWAT: Label1.Caption = "Prisoner amount : " &.Count & " file(s)" End With Private Sub UniDialog1_FolderSelect(ByVal Path As String) Dim sfile As String Dim OriFile As String spathres = Path OriFile = LvJail.SubItemText(nItemTerpilih, 1) sfile = FolderJail & "\" & LvJail.SubItemText(nItemTerpilih, 3) If PathIsDirectory(StrPtr(GetFilePath(sPathRes))) <> 0 Then RestoreJailFile sfile, spathres & "\" & GetFileName(OriFile) HapusFile sfile READ_DATA FolderJail MsgBox "Prisoner released!", vbexclamation, "N*O*S*T*A" 5. listing program form option Private Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hwnd As Long, ByVal wmsg As Long, _ ByVal wparam As Long, lparam As Any) As Long Private Declare Sub ReleaseCapture Lib "user32" () Private Const WM_NCLBUTTONDOWN = &HA1 Private Const HTCAPTION = 2 Private Sub cmdcancel_click() LoadSetting Environ$("windir") & "\NOSTA-SET.ini"

21 Me.Hide Private Sub cmdok_click() Dim WinDir As String WinDir = Environ$("windir") WriteSetting WinDir & "\NOSTA-SET.ini" Me.Hide Private Sub Image1_MouseMove(Button As Integer, Shift As Integer, X As Single, Y As Single) Dim lngreturnvalue As Long If Button = 1 Then Call ReleaseCapture lngreturnvalue = SendMessage(Me.hwnd, WM_NCLBUTTONDOWN, HTCAPTION, 0&) Private Sub WriteSetting(sPath As String) Dim isi As String isi = "N*O*S*T*A Scanner Configuration" & Chr(13) & "[Don't Change Anything Manually]" isi = isi & Chr(13) & ck1.value isi = isi & ck2.value isi = isi & ck3.value isi = isi & ck4.value isi = isi & ck5.value isi = isi & ck6.value If ValidFile(sPath) = True Then HapusFile spath WriteAnsiFile spath, isi 6. listing program form proses Dim stfilestart() As String Dim JumStart As Long Private Sub Command1_Click() Call Pamz_Get_Processes(lvProses, True) Private Function nitemterpilih() As Long Dim pnum As Long For pnum = 0 To lvproses.count - 1 If lvproses.itemselected(pnum) = True Then nitemterpilih = pnum Exit Function Private Sub Command10_Click() If PamzForceUnLoadProcessModule32(CLng(lbPID), CLng(lbBase)) > 0 Then Call Pamz_Get_Modules(CLng(lbPID.Caption), lvmodule) MsgBox "Success unload selected module!", vbinformation

22 MsgBox "Fail to unload selected module!", vbexclamation Private Sub Command2_Click() Dim PID As Long PID = lvproses.subitemtext(nitemterpilih, 2) If PamzTerminateProcess(PID) > 0 Then Command1_Click MsgBox "Process with PID: [" & PID & "] was terminated succesfully!" Command1_Click MsgBox "Process with PID: [" & PID & "] cannot be terminated!" Private Sub Command3_Click() Dim PID As Long PID = lvproses.subitemtext(nitemterpilih, 2) If PamzSuspendResumeProcessThreads(PID, False) > 0 Then lvproses.subitemtext(nitemterpilih, 6) = "Paused" lvproses.subitemtext(nitemterpilih, 6) = "Ps-Failed" Private Sub Command4_Click() Dim PID As Long PID = lvproses.subitemtext(nitemterpilih, 2) If PamzSuspendResumeProcessThreads(PID, True) > 0 Then lvproses.subitemtext(nitemterpilih, 6) = "Running" lvproses.subitemtext(nitemterpilih, 6) = "Rs-Failed" Private Sub Command5_Click() Explore lvproses Private Sub Explore(Lv As uchyperlistng) Static Path As String Path = GetFilePath(Lv.SubItemText(nItemTerpilih, 8)) Shell "Explorer.exe /e," & Path, vbnormalfocus Private Sub Command6_Click() Unload Me Private Sub Command7_Click() Dim PID As Long Dim spath As String PID = lvproses.subitemtext(nitemterpilih, 2)

23 spath = lvproses.subitemtext(nitemterpilih, 8) If PamzTerminateProcess(PID) > 0 Then Shell spath, vbminimizednofocus Command1_Click MsgBox "Process with PID: [" & PID & "] was restarted succesfully!" MsgBox "Process with PID: [" & PID & "] cannot be restarted!" Private Sub Command8_Click() MsgBox "Apakah anda yakin menambahkan proses berikut : " & Chr(13) & _ "* " & lvproses.subitemtext(nitemterpilih, 7) & Chr(13) & _ "Sebagai virus temporary?" & Chr(13) & _ "Jika yakin tekan tombol 'Tambahkan' pada jendela baru yang muncul!" & Chr(13) & _ "Tutup langsung jendela baru jika anda tak yakin!", vbexclamation, "Add As Virus" Me.Hide frmvirus.unilabel1.caption = lvproses.subitemtext(nitemterpilih, 8) frmvirus.text1.text = frmvirus.unilabel1.caption frmvirus.text2.text = "New Virus" frmvirus.show 1, frmmain Private Sub Command9_Click() If ValidFile(lvProses.SubItemText(nItemTerpilih, 8)) = True Then ShowProperty lvproses.subitemtext(nitemterpilih, 8), Me.hwnd Private Sub Form_Load() Call BuilLvModule Call Pamz_Get_Processes(lvProses, False) Private Sub Pamz_Get_Processes(ByRef Lv As uchyperlistng, brefresh As Boolean) Dim LEAX As Long Dim CTurn As Long Dim ENPC() As ENUMERATE_PROCESSES_OUTPUT If brefresh = False Then Call BuilLvProcess LEAX = PamzEnumerateProcesses(ENPC()) Lv.ClearList If LEAX <= 0 Then GoTo LBL_TERAKHIR EnumStatStart stfilestart() For CTurn = 0 To (LEAX - 1) Lv.ItemAdd CTurn, "", ENPC(CTurn).szNtExecutableNameW, 0, 0 Lv.SubItemsAdd CTurn, 1, GetStatStart(PamzNtPathToUserFriendlyPathW(ENPC(CTurn).szNtExecutable PathW)) & " value(s)"

24 Lv.SubItemsAdd CTurn, 2, ENPC(CTurn).nProcessID Lv.SubItemsAdd CTurn, 3, ENPC(CTurn).nParentProcessID Lv.SubItemsAdd CTurn, 4, ENPC(CTurn).bIsHiddenProcess Lv.SubItemsAdd CTurn, 5, ENPC(CTurn).bIsBeingDebugged Lv.SubItemsAdd CTurn, 6, ENPC(CTurn).bIsLockedProcess Lv.SubItemsAdd CTurn, 7, Format$(ENPC(CTurn).nSizeOfExecutableOpInMemory, "#,#") Lv.SubItemsAdd CTurn, 8, PamzNtPathToUserFriendlyPathW(ENPC(CTurn).szNtExecutablePathW) If ENPC(CTurn).bIsHiddenProcess = True Then Lv.ItemGhosted(CTurn + 1) = True Erase ENPC() LBL_TERAKHIR: Me.Frame1.Caption = "Process List (" & LEAX & ")" Private Sub Pamz_Get_Modules(ByVal TargetPID As Long, ByRef lb As uchyperlistng) Dim LEAX As Long Dim CTurn As Long Dim paddress As String Dim ENMC() As ENUMERATE_MODULES_OUTPUT LEAX = PamzEnumerateModules(TargetPID, ENMC) lb.clearlist If LEAX <= 0 Then lb.itemadd 0, "", "Caution : cannot emumerate modules from selected PID!", 0, 0 GoTo LBL_TERAKHIR For CTurn = 0 To (LEAX - 1) paddress = Hex$(CLng(PamzNtPathToUserFriendlyPathW(CStr(ENMC(CTurn).pBaseAddress )))) lb.itemadd CTurn, "", "0x" & paddress & "! " & PamzNtPathToUserFriendlyPathW(ENMC(CTurn).szNtModulePathW), 0, 0 Erase ENMC() lbpid = TargetPID LBL_TERAKHIR: Me.Frame2.Caption = "List of Modules (" & LEAX & ")" Private Sub BuilLvModule() With lvmodule.columnclear.checkboxes = False.ColumnAdd 0, "Module Name", 600, ColumnLeft.FullRowSelect = True.HeaderHide = True.ScrollBarFlat = True.ItemsSorted = True End With Private Sub BuilLvProcess() With lvproses.clearlist.listmode = ehyperlist.initimlsmall.imlsmalladdicon picpro.picture

25 .LoadStateImageList.ViewMode = StyleReport.ColumnAdd 0, "Process Name", 150, ColumnLeft.ColumnAdd 1, "Start-Up", 100, ColumnCenter.ColumnAdd 2, "PID", 80, ColumnCenter.ColumnAdd 3, "ParentPID", 80, ColumnCenter.ColumnAdd 4, "Hidden", 50, ColumnLeft.ColumnAdd 5, "In Debug", 50, ColumnLeft.ColumnAdd 6, "Locked", 50, ColumnLeft.ColumnAdd 7, "Size [B]", 60, Columnright.ColumnAdd 8, "Update Path", 400, ColumnLeft.ItemsSorted = True.SkinHeaders HeaderXP, &H753F17, &H94511F, &HC46A28, False.HeaderPressed = vbblack.headercustom = True.UseUnicode = True.ForeColor = vbblack.fullrowselect = True.GridLines = True.ScrollBarFlat = True.InitList 0, 8 End With Private Sub lbbase_change() If Len(lbBase.Caption) > 1 Then Command10.Enabled = True Command10.Enabled = False Private Sub lvmodule_ehitemclick(byval litem As Long) lbbase.caption = GetHexAdressToLng(lvModule.ItemText(lItem)) Private Sub lvproses_ehitemclick(byval litem As Long) Dim PID As Long PID = lvproses.subitemtext(litem, 2) Call Pamz_Get_Modules(PID, lvmodule) lbbase.caption = "" Private Function GetHexAdressToLng(sModulePath As String) As Long Dim stmp() As String stmp = Split(sModulePath, "!") GetHexAdressToLng = CLng("&H" & Mid(sTmp(0), 3)) Private Sub EnumStatStart(ByRef strfile() As String) Dim inum As Long Dim icount As Long Dim stfile() As String inum = EnumRegStartup(stFile, True) ReDim strfile(inum) As String For icount = 1 To inum strfile(icount - 1) = stfile(icount - 1)

26 JumStart = inum Private Function GetStatStart(sFile As String) As Long Dim inum As Long Dim njum As Long For inum = 1 To JumStart If UCase(sFile) = UCase(stFileStart(iNum - 1)) Then njum = njum + 1 GetStatStart = njum 7. listing program form Virus Dim stombol Dim nvirus Dim ntemp As String As Long As Long Private Sub Command1_Click() UniDialog1.ShowOpen Private Sub Command2_Click() MsgBox "Dengan bantuan program alat ini anda dapat : " & Chr(13) & _ "* Menambahkan penanda virus-virus baru kedalam database secara sementara!" & Chr(13) & _ "* Membersihkan virus yang tak dikenal tanpa update program!" & Chr(13) & _ "* Pilih file yang akan dijadikan virus dan tekan tombol 'Tambahkan'!" & Chr(13) & Chr(13) & _ "Yakinkan jikalau virus baru yang anda tambahkan benarbenar sebuah virus!", vbinformation, "#My Virus#" Private Sub Command3_Click() If Command3.Caption = "Lihat Data" Then Me.Height = 4605 Command3.Caption = "Sembunyikan Data" Me.Height = 2850 Command3.Caption = "Lihat Data" Private Sub Command4_Click() If Text1.Text = "" Then MsgBox "Pilih dulu path file yang akan dijadikan virus! ", vbexclamation, "Caution" Exit Sub If AddVirusTemp(UniLabel1.Caption, Text2.Text) = True Then MsgBox "File [ " & Text1.Text & " ]" & Chr(13) & _

27 "Berhasil ditambahkan sebagai sample virus temporary!" & Chr(13) & _ "Nama virus yang anda berikan : " & Text2.Text & Chr(13) & Chr(13) & _ "Scan komputer untuk melihat hasilnya!", vbexclamation, "#My Virus#" ntemp = ntemp + 1 Frame1.Caption = "Virus Temporary ( " & ntemp & " )!" List1.List(0) = "Virus Temporary ( " & ntemp & " ) virus" List1.AddItem Text1.Text Text1.Text = "" UniLabel1.Caption = "" Text2.Text = "" Command3_Click MsgBox "File [ " & Text1.Text & " ]" & Chr(13) & _ "Gagal ditambahkan sebagai sample virus temporary!", vbexclamation, "#My Virus#" Text1.Text = "" Text2.Text = "" UniLabel1.Caption = "" Private Sub Command5_Click() UniDialog1.fileName = "" UniLabel1.Caption = "" Text1.Text = "" Text2.Text = "" Private Sub Form_Unload(Cancel As Integer) Cancel = 1 Me.Hide Private Sub List1_Click() List1.ToolTipText = List1.List(List1.ListIndex) Private Sub UniDialog1_OpenFile(ByVal filename As String) If ValidFile(fileName) = True Then UniLabel1.Caption = filename Text1.Text = filename Text2.Text = "New Virus" Text1.Text = ""