I am guessing the virus would be tied to DLL calls.
I found this code which shows it uses two dynamic link libraries.
Code: Select all
Func _IMAGESEARCH($FINDIMAGE, $RESULTPOSITION, ByRef $X, ByRef $Y, $TOLERANCE)
$SIZE = WinGetClientSize("Darkfall Online")
Return _IMAGESEARCHAREA($FINDIMAGE, $RESULTPOSITION, 0, 0, $SIZE[0], $SIZE[1], $X, $Y, $TOLERANCE)
EndFunc
Func _IMAGESEARCHAREA($FINDIMAGE, $RESULTPOSITION, $X1, $Y1, $RIGHT, $BOTTOM, ByRef $X, ByRef $Y, $TOLERANCE)
If $TOLERANCE > 0 Then $FINDIMAGE = "*" & $TOLERANCE & " " & $FINDIMAGE
$RESULT = DllCall("ImageSearchDLL.dll", "str", "ImageSearch", "int", $X1, "int", $Y1, "int", $RIGHT, "int", $BOTTOM, "str", $FINDIMAGE)
If $RESULT[0] = "0" Then Return 0
$ARRAY = StringSplit($RESULT[0], "|")
$X = Int(Number($ARRAY[2]))
$Y = Int(Number($ARRAY[3]))
If $RESULTPOSITION = 1 Then
$X = $X + Int(Number($ARRAY[4]) / 2)
$Y = $Y + Int(Number($ARRAY[5]) / 2)
EndIf
Return 1
EndFunc
Func _ISPRESSED($SHEXKEY, $VDLL = "user32.dll")
Local $A_R = DllCall($VDLL, "short", "GetAsyncKeyState", "int", "0x" & $SHEXKEY)
If @error Then Return SetError(@error, @extended, False)
Return BitAND($A_R[0], 32768) <> 0
EndFunc
If you guys could help me identify which .dll has a virus that would be great.
I can then try to recreate the dll functions with clean code and post it here.
Who is online