asked on

Where/how to begin programming

Hello,

I am willing to learn programming. I can do some simple batch files but i really need to go advanced. What i am into is writing removal scripts. First for some softwares and then for some malware infections to begin programing.

1- What language should i start learning ? Which language would be the most efficient and easier( doesnt necessarily need to be very easy- i like challenges-) to use to 1) remove files 2) remove registry entries 3) modify registry entries

2- What are the good softwares would allow me to monitor changes created by the malware infections in the system. I have been using regmon and filemon and for the installations i am using installwatchpro. Would you have any recommendations ?

Thank you for your time.

SOLUTION

mish33

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ASKER CERTIFIED SOLUTION

F. Dominicus

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

wnross

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

r-k

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

Venabili

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

saravananvg

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

wnross

padmaja: most of the languages describe are "write once run anywhere" Perl,Python,TCL, etc...

You definately do not want to do system admin work with C/C++ or Java.

Some samples: Deleting Files

Perl
-------------------delete.pl ------------
unlink("C:\\Documents and Settings\\All Users\\virus.exe");
------------------- CUT HERE ---------------

Visual Basic with Windows Script Host
------------------ delete.vbs ---------------
Set fso = CreateObject("Scripting.FileSystemObject")
Set aFile = fso.GetFile("C:\Documents and Settings\All Users\virus.exe")
aFile.Delete
------------------- CUT HERE ---------------

Using the registry:
Perl
------------------- listentries.pl ---------------------
use Win32::Registry;

my $hive = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run";
my ($hkey, %value_list, $key);

$HKEY_LOCAL_MACHINE->Open($hive,$hkey);

$hkey->GetValues(\%value_list);
print "$hive values\n";
foreach $value (keys %value_list) {
print "$value\n";
}
$hkey->Close();
------------------- CUT HERE ---------------

Visual Basic with Windows Script Host
------------------ listentries.vbs ---------------
Set WshShell = WScript.CreateObject("WScript.Shell")

WScript.Echo WshShell.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS")
------------------- CUT HERE ---------------
(Note that VBS does not allow you to directly list what entries there are, but perl does)

Venabili

And delete file Java:
(new File("filename")).delete();

Registries are tough in Java but the simple deletion is not a problem at alll....

Purple_Sky

ASKER

Thank you all for the great advices.

Initially I am not planing to go very hardcore with the programing BUT if I like enjoy it ( i am sure I will ) why not. i am planing to stick with the windows platform.

Seems like I am going to start with perl, python and/or vbs then advance to C++ and Java as needed.

Are there any other monitoring tools you can recommend ?

Again thank you for your time and all informing replies.

wnross

Besides configsafe? The closest i've seen is Norton's GoBack, but it doesn't tell you what changed where configsafe does.

Any ideas out there?

Purple_Sky

ASKER

Thank you all :)

r-k

Thanks. You can't go wrong with the utilities from Sysinternals. They also have an excellent page with useful programming tips: http://www.sysinternals.com/Information.html

Also highly recommended: http://www.codeproject.com/ and http://www.codeguru.com/