unit1.~pas

U盘autorun病毒通测与查杀工具安装SUI控件

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, ExtCtrls, SUIForm, SUIMgr, SUIButton, SUIImagePanel, SUIGroupBox,
  SUIRadioGroup, StdCtrls, SUIComboBox, Registry, ServiceManager,WinSvc,
  inifiles,TLHelp32,psapi, Menus, SUIPopupMenu;

type
  TForm1 = class(TForm)
    suiForm1: TsuiForm;
    suiGroupBox1: TsuiGroupBox;
    radiobtn1: TsuiRadioButton;
    radiobtn2: TsuiRadioButton;
    suiButton1: TsuiButton;
    suiGroupBox2: TsuiGroupBox;
    suiButton2: TsuiButton;
    Label1: TLabel;
    suiGroupBox3: TsuiGroupBox;
    Label2: TLabel;
    suiButton3: TsuiButton;
    suiGroupBox4: TsuiGroupBox;
    suiButton4: TsuiButton;
    Memo1: TMemo;
    Label3: TLabel;
    Label4: TLabel;
    Timer1: TTimer;
    Label5: TLabel;
    Memo2: TMemo;
    Timer2: TTimer;
    suiPopupMenu1: TsuiPopupMenu;
    N1: TMenuItem;
    N2: TMenuItem;
    SaveDialog1: TSaveDialog;
    suiBuiltInFileTheme1: TsuiBuiltInFileTheme;
    procedure suiButton1Click(Sender: TObject);
    procedure suiButton4Click(Sender: TObject);
    procedure suiButton3Click(Sender: TObject);
    procedure Timer1Timer(Sender: TObject);
    procedure suiButton2Click(Sender: TObject);
    procedure Timer2Timer(Sender: TObject);
    procedure FormCreate(Sender: TObject);
    procedure N2Click(Sender: TObject);
    procedure N1Click(Sender: TObject);
  private
    { Private declarations }
  public
    kill_name,task_name,kill_copy,copy_task_name:string;
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

//配置服务
procedure   ConfigService(ServiceName:   string;   fDisable:   boolean;   lpDesc:   string);   
  type   
      PQueryServiceLockStatus   =   ^TQueryServiceLockStatus;   
  const   
      SERVICE_CONFIG_DESCRIPTION:   DWord   =   1;   
  var   
      DynChangeServiceConfig2:   function( hService: SC_HANDLE; dwInfoLevel:DWORD;lpInfo:   Pointer):Bool;StdCall;   
      sclLock:   SC_LOCK;   
      lpqslsBuf:   PQueryServiceLockStatus;   //LPQUERY_SERVICE_LOCK_STATUS;   
      dwBytesNeeded,   dwStartType:   DWORD;   
      schSCManager,   schService:   SC_Handle;   
      aLibHndl:   THandle;   
      TempP:   PChar;   
      ret:   boolean;   
  begin   
      schSCManager   :=   OpenSCManager(nil,   nil,   SC_MANAGER_ALL_ACCESS);   
     if   schSCManager   =   0   then   raise   Exception.Create(SysErrorMessage(GetLastError));   
       sclLock   :=   LockServiceDatabase(schSCManager);   
      try   
          if   (sclLock   =   nil)   then   
          begin   
              if   (GetLastError()   <>   ERROR_SERVICE_DATABASE_LOCKED)   then   
                  raise   Exception.Create(SysErrorMessage(GetLastError));   
              lpqslsBuf   :=   PQueryServiceLockStatus(LocalAlloc(LPTR,   sizeof(QUERY_SERVICE_LOCK_STATUS)   +   256));   
              if   (lpqslsBuf   =   nil)   then   
                  raise   Exception.Create(SysErrorMessage(GetLastError));   
              if   not   (QueryServiceLockStatus(   
                  schSCManager,   
                  lpqslsBuf^,   
                  sizeof(QUERY_SERVICE_LOCK_STATUS)   +   256,   
                  dwBytesNeeded))   then   
                  raise   Exception.Create(SysErrorMessage(GetLastError));   
    
              if   (lpqslsBuf^.fIsLocked   >   0)   then   
              begin   
                  OutputDebugString(pchar('Locked   by:   '   +   lpqslsBuf^.lpLockOwner   +   
                      '   duration:   '   +   IntToStr(lpqslsBuf^.dwLockDuration)   +   '   seconds'));   
              end   
              else   
                  OutputDebugString(pchar('No   longer   locked'));   
    
              LocalFree(cardinal(lpqslsBuf));   
              raise   Exception.Create(SysErrorMessage(GetLastError));   
          end;   
    
         schService   :=   OpenService(   
              schSCManager,   //   SCManager   database   
              pchar(ServiceName),   //'Sample_Srv',   //   name   of   service   
              SERVICE_CHANGE_CONFIG);   //   need   CHANGE   access   
          if   (schService   =   0)   then   
              raise   Exception.Create(SysErrorMessage(GetLastError));   
          try   
              if   fDisable   then
                 dwStartType   :=   2
              else
                  dwStartType  :=   SERVICE_DEMAND_START; //SERVICE_DEMAND_START
              if   not   (ChangeServiceConfig(   
                  schService,   //   handle   of   service   
                  SERVICE_WIN32_OWN_PROCESS   or   SERVICE_INTERACTIVE_PROCESS,   //SERVICE_NO_CHANGE,   //   service   type:   no   change   
                  dwStartType,   //   change   service   start   type   
                  SERVICE_NO_CHANGE,   //   error   control:   no   change   
                  nil,   //   binary   path:   no   change   
                  nil,   //   load   order   group:   no   change   
                  nil,   //   tag   ID:   no   change   
                  nil,   //   dependencies:   no   change   
                  nil,   //   account   name:   no   change   
                  nil,   //   password:   no   change   
                  nil))   then   
              begin   
                  raise   Exception.Create(SysErrorMessage(GetLastError));
              end   
              else   
                  OutputDebugString('ChangeServiceConfig   SUCCESS');   
    
              //     sdBuf.lpDescription   :=   lpDesc;   
              aLibHndl   :=   GetModuleHandle(advapi32);   
              ret   :=   aLibHndl   <>   0;   
              if   not   ret   then   Exit;   
              try   
              DynChangeServiceConfig2   :=   GetProcAddress(aLibHndl,   'ChangeServiceConfig2A');   
              ret   :=   @DynChangeServiceConfig2   <>   nil;   
              if   not   ret   then   Exit;   
              TempP   :=   PChar(lpDesc);   //ChangeServiceConfig2   
    
              ret   :=   DynChangeServiceConfig2(schService,   SERVICE_CONFIG_DESCRIPTION,   @TempP);   
    
              if   not   ret   then   
                  raise   Exception.Create(SysErrorMessage(GetLastError))   
              else   
                  OutputDebugString('ChangeServiceConfig2   SUCCESS');   
              finally   
                  FreeLibrary(aLibHndl);   
              end;   
          finally   
              CloseServiceHandle(schService);   
          end;   
      finally   
          //   Release   the   database   lock.   
          UnlockServiceDatabase(sclLock);   
          //   Close   the   handle   to   the   service.   
          CloseServiceHandle(schService);
      end;   
  end;

  function   GetPathFileofModule(ModuleName:String):String;  //取得进程文件路径
  var   
      hProcSnap:   THandle;   
      pProcess:   THandle;   
      pe32:   TProcessEntry32;   
      s:   string;   
      buf:array[0..MAX_PATH]   of   char;
      hMod:HMODULE;   
      cbNeeded:DWORD;   
  begin   
      hProcSnap   :=   CreateToolHelp32SnapShot(TH32CS_SNAPALL,   0);   
      if   hProcSnap   =   INVALID_HANDLE_VALUE   then   Exit;   
      pe32.dwSize   :=   SizeOf(ProcessEntry32);   
      if   Process32First(hProcSnap,   pe32)   =   True   then   
          while   Process32Next(hProcSnap,   pe32)   =   True   do   
          begin   
                  if   uppercase(pe32.szExeFile)=uppercase(ModuleName)   then   
                  begin   
                        pProcess:=OpenProcess(PROCESS_QUERY_INFORMATION   or   
                                                                                PROCESS_VM_READ,   
                                                                                FALSE,   
                                                                                pe32.th32ProcessID);   
                        if   pProcess<>0   then   
                        begin   
                              if   EnumProcessModules(   pProcess,@hMod,sizeof(hMod),cbNeeded)   then
                              begin   
                                    ZeroMemory(@buf,MAX_PATH+1);   
                                    GetModuleFileNameEx(pProcess,   hMod,buf,MAX_PATH+1);   
                                    Result:=strpas(buf);   
                              end;   
                        end;   
                  end;   
          end;   
      CloseHandle(hProcSnap);   
  end;

procedure TForm1.suiButton1Click(Sender: TObject);
var
  reg:TRegistry;
  driver_set: array [0..15] of char;
  server_hard:TServiceManager;
begin
reg:=Tregistry.Create;
server_hard:=TServiceManager.Create;   //连接shellhwdetection服务
server_hard.Connect(nil,nil,SC_MANAGER_CONNECT);
server_hard.OpenServiceConnection('ShellHWDetection');
reg.RootKey:=HKEY_CURRENT_USER;
if reg.OpenKey('Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\',true) then
begin
  if Reg.ValueExists('NoDriveAutoRun')=false then
    begin
      reg.CreateKey('NoDriveAutoRun');
    end;

  if radiobtn1.Checked=true then
    begin
     driver_set[0]:=char($FF);
     driver_set[1]:=char($FF);
     driver_set[2]:=char($FF);
     driver_set[3]:=char($FF);
     reg.WriteBinaryData('NoDriveAutoRun',driver_set,4);
     if server_hard.StopService then
        memo1.Lines.Add(datetimetostr(now)+':关闭硬件播放事件服务成功!')
     else
        memo1.Lines.Add(datetimetostr(now)+':关闭硬件播放事件服务失败!');
     ConfigService('ShellHWDetection',false,'为自动播放硬件事件提供通知');

     memo1.Lines.Add(datetimetostr(now)+':'+'已关闭所有驱动器自动播放功能!');
     memo1.Lines.Add('系统提示：请重新启动计算机或注销后重新登陆，设置才会有效!');
    end;
  if radiobtn2.Checked=true then