Virüs mü yedim ?

'www.sordum.net - 31.07.2021 - Velociraptor
Option Explicit
'~ On Error Resume Next
RequireAdmin

Dim objReg
Set objReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")

RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects3", "Settings", "REG_BINARY", Array(48,0,0,0,254,255,255,255,122,244,0,0,1,0,0,0,48,0,0,0,48,0,0,0,0,0,0,0,0,0,0,0,86,5,0,0,48,0,0,0,96,0,0,0,1,0,0,0)

Function RegWrite(reg_keyname, reg_valuename,reg_type,ByVal reg_value)
    Dim aRegKey, Return
    aRegKey = RegSplitKey(reg_keyname)
    If IsArray(aRegKey) = 0 Then
        RegWrite = 0
        Exit Function
    End If

    Return = RegWriteKey(aRegKey)
    If Return = 0 Then
        RegWrite = 0
        Exit Function
    End If

    Select Case reg_type
        Case "REG_SZ"
            Return = objReg.SetStringValue(aRegKey(0),aRegKey(1),reg_valuename,reg_value)
        Case "REG_EXPAND_SZ"
            Return = objReg.SetExpandedStringValue(aRegKey(0),aRegKey(1),reg_valuename,reg_value)
        Case "REG_BINARY"
            If IsArray(reg_value) = 0 Then reg_value = Array()
            Return = objReg.SetBinaryValue(aRegKey(0),aRegKey(1),reg_valuename,reg_value)

        Case "REG_DWORD"
            If IsNumeric(reg_value) = 0 Then reg_value = 0
            Return = objReg.SetDWORDValue(aRegKey(0),aRegKey(1),reg_valuename,reg_value)

        Case "REG_MULTI_SZ"
            If IsArray(reg_value) = 0 Then
                If Len(reg_value) = 0 Then
                    reg_value = Array()
                Else
                    reg_value = Array(reg_value)
                End If
            End If
            Return = objReg.SetMultiStringValue(aRegKey(0),aRegKey(1),reg_valuename,reg_value)

        'Case "REG_QWORD"
            'Return = oReg.SetQWORDValue(aRegKey(0),aRegKey(1),reg_valuename,reg_value)
        Case Else
            RegWrite = 0
            Exit Function
    End Select

    If (Return <> 0) Or (Err.Number <> 0) Then
        RegWrite = 0
        Exit Function
    End If
    RegWrite = 1
End Function

Function RegWriteKey(RegKeyName)
    Dim Return
    If IsArray(RegKeyName) = 0 Then
        RegKeyName = RegSplitKey(RegKeyName)
    End If

    If (IsArray(RegKeyName) = 0) Or (UBound(RegKeyName) <> 1) Then
        RegWriteKey = 0
        Exit Function
    End If

    Return = objReg.CreateKey(RegKeyName(0),RegKeyName(1))
    If (Return <> 0) Or (Err.Number <> 0) Then
        RegWriteKey = 0
        Exit Function
    End If
    RegWriteKey = 1
End Function


Function RegSplitKey(RegKeyName)
    Dim strHive, strInstr, strLeft
    strInstr=InStr(RegKeyName,"\")
    If strInstr = 0 Then Exit Function
    strLeft=left(RegKeyName,strInstr-1)

    Select Case strLeft
        Case "HKCR","HKEY_CLASSES_ROOT"    strHive = &H80000000
        Case "HKCU","HKEY_CURRENT_USER"    strHive = &H80000001
        Case "HKLM","HKEY_LOCAL_MACHINE"    strHive = &H80000002
        Case "HKU","HKEY_USERS"     strHive = &H80000003
        Case "HKCC","HKEY_CURRENT_CONFIG"    strHive = &H80000005
      Case Else Exit Function
    End Select

    RegSplitKey = Array(strHive,Mid(RegKeyName,strInstr+1))
End Function

Function RequireAdmin()
    Dim reg_valuename, WShell, Cmd, CmdLine, I

    GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")_
    .EnumValues &H80000003, "S-1-5-19\Environment",  reg_valuename
    If IsArray(reg_valuename) <> 0 Then
        RequireAdmin = 1
        Exit Function
    End If

    Set Cmd = WScript.Arguments
    For I = 0 to Cmd.Count - 1
        If Cmd(I) = "/admin" Then
            Wscript.Echo "To script you must have administrator rights!"
            'RequireAdmin = 0
            'Exit Function
            WScript.Quit
        End If
        CmdLine = CmdLine & Chr(32) & Chr(34) & Cmd(I) & Chr(34)
    Next
    CmdLine = CmdLine & Chr(32) & Chr(34) & "/admin" & Chr(34)

    Set WShell= WScript.CreateObject( "WScript.Shell")
    CreateObject("Shell.Application").ShellExecute WShell.ExpandEnvironmentStrings(_
    "%SystemRoot%\System32\WScript.exe"),Chr(34) & WScript.ScriptFullName & Chr(34) & CmdLine, "", "runas"
    WScript.Quit
End Function

Dim WshShell, BtnCode
Set WshShell = WScript.CreateObject("WScript.Shell")

BtnCode = WshShell.Popup("Görev çubuðu Üst kýsma konumlandýrýlacak" ,0, "www.sordum.net")

Function RefreshExplorer()
'------------------------------------------------
'Refresh explorer
'------------------------------------------------
    dim strComputer, objWMIService, colProcess, objProcess
    strComputer = "."
    'Get WMI object
    Set objWMIService = GetObject("winmgmts:" _
      & "{impersonationLevel=impersonate}!\\" _
      & strComputer & "\root\cimv2")
    Set colProcess = objWMIService.ExecQuery _
      ("Select * from Win32_Process Where Name = 'explorer.exe'")
    For Each objProcess in colProcess
       objProcess.Terminate()
    Next

End Function

Call RefreshExplorer