#!perl.exe -w use strict; use Net::Ping; use Win32::PerfLib; use Win32::Process; my $status = 2; while ($status < 3) { &ping; sleep (60); } sub ping { print "ping"; my $time; my $ping = Net::Ping->new("icmp"); open(INPUT, "< ip-address.txt") or die "could not open address file"; my @ip = ; close(INPUT); open(OUTPUT, ">> output.txt") or die "could not open output file"; foreach my $host (@ip){ unless ($host =~ "^#") { chop $host; $time = localtime(); if ($host ne "" && $host ne "\n"){ if ($ping->ping($host)) { print OUTPUT "$time /// $host is alive\n"; if ($status != 0) { $status = 0; &subone; } } else { print OUTPUT "$time /// $host is dead\n"; if ($status != 1) { $status = 1; &suball; } } } else {print OUTPUT "$time /// No Ip Entered\n";} } } $ping->close(); close(OUTPUT); } sub killmware { print "killmware"; my $server = ""; my %rtasks; my %counter; Win32::PerfLib::GetCounterNames($server, \%counter); my %r_counter = map { $counter{$_} => $_ } keys %counter; # retrieve the id for process object my $process_obj = $r_counter{Process}; # retrieve the id for the process ID counter my $process_id = $r_counter{'ID Process'}; # create connection to $server my $perflib = new Win32::PerfLib($server); my $proc_ref = {}; # get the performance data for the process object $perflib->GetObjectList($process_obj, $proc_ref); $perflib->Close(); my $instance_ref = $proc_ref->{Objects}->{$process_obj}->{Instances}; foreach my $p (sort keys %{$instance_ref}) { my $counter_ref = $instance_ref->{$p}->{Counters}; foreach my $i (keys %{$counter_ref}) { if($counter_ref->{$i}->{CounterNameTitleIndex} == $process_id) { $rtasks{$counter_ref->{$i}->{Counter}} = $instance_ref->{$p}->{Name}; } } } while ( (my $key, my $value) = each %rtasks ) { if ($value eq "maincnc") {Win32::Process::KillProcess($key, 0)} } } sub startup { system ('maincnc.exe'); print "startup"; } sub suball { print "suball"; open (ALL, '< all_machines.ini') or die "ERROR! all_machines.ini missing!"; open (MAIN, '> maincnc.ini') or die "ERROR! Could not write to maincnc.ini"; while (){ print MAIN $_ } close MAIN; close ALL; &killmware; &startup; } sub subone { print "subone"; open (ALL, '< oneline.ini') or die "ERROR! oneline.ini missing!"; open (MAIN, '> maincnc.ini') or die "ERROR! Could not write to maincnc.ini"; while (){ print MAIN $_ } close MAIN; close ALL; &killmware; &startup; }