Mensajes

Te recomiendo que utilices el api de windows para tocar el registro las declaraciones basicas son

Código [Seleccionar] Expandir

Public Declare Function RegQueryValue Lib "advapi32.dll" Alias "RegQueryValueA" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal lpValue As String, lpcbValue As Long) As Long
Public Declare Function RegEnumKey Lib "advapi32" Alias "RegEnumKeyA" (ByVal hKey As Long, ByVal iSubKey As Long, ByVal lpszName As String, ByVal cchName As Long) As Long
Public Declare Function RegOpenKey Lib "advapi32" Alias "RegOpenKeyA" (ByVal hKey As Long, ByVal lpszSubKey As String, phkResult As Long) As Long
Public Declare Function RegCloseKey Lib "advapi32" (ByVal hKey As Long) As Long
Public Declare Function RegCreateKey Lib "advapi32.dll" Alias "RegCreateKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long
Public Declare Function RegSetValue Lib "advapi32.dll" Alias "RegSetValueA" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal dwType As Long, ByVal lpData As String, ByVal cbData As Long) As Long
Public Declare Function RegDeleteKey Lib "advapi32.dll" Alias "RegDeleteKeyA" (ByVal hKey As Long, ByVal lpSubKey As String) As Long
Public Declare Function RegSetValueEx Lib "advapi32.dll" Alias "RegSetValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, lpData As Any, ByVal cbData As Long) As Long
Public Declare Function RegDeleteValue Lib "advapi32.dll" Alias "RegDeleteValueA" (ByVal hKey As Long, ByVal lpValueName As String) As Long


las consantes basicas

Código [Seleccionar] Expandir


Public Const HKEY_LOCAL_MACHINE = &H80000002
Public Const HKEY_CLASSES_ROOT = &H80000000



y las operaciones basicas son

Código [Seleccionar] Expandir


RegOpenKey HKEY_LOCAL_MACHINE, "llave que quieras abrir (SOFTWARE\Microsoft\Windows\CurrentVersion\Run)", h
valor = "c:\windows..."
RegSetValueEx h, "nombre del valor(prueba)", 0, 1, ByVal valor, Len(valor)
RegCloseKey h


y para borrar la clave anterior

Código [Seleccionar] Expandir


RegOpenKey HKEY_LOCAL_MACHINE, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run", h

RegDeleteValue h, "nombre del valor antrior"

RegCloseKey h


La cuestion es si creas tu propio gusano o troyano escrito en vb y el api de win32 que posibilidades tienes de que un antivirus lo detecte?

por que utilice el
app.pathname & "\" & app.exename & ".exe"

i me salto la heuristica del "NOD32"

hola me gustaria saber si existe alguna funcion del api de windows que se dispare cuando se abre una aplicacion como el explorer word ect

ya esta es con
app.tasvisible=false

gracias igualmente

Hola chicos he escrito una aplicacion en VB que es un keylogger y querria saber si la puedo ejecutar como un proceso de windows y no como una aplicacion

agradecaeria la explicacion

gracias