unit1.pas

delphi Trojan.Win32.Delf.ji

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, Registry, StdCtrls;

type
  TForm1 = class(TForm)
    Button1: TButton;
    Label1: TLabel;
    procedure Button1Click(Sender: TObject);
    procedure FormCreate(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;
  Prog : String;
  Registre : TRegistry;
implementation

{$R *.dfm}

procedure TForm1.Button1Click(Sender: TObject);
begin
Registre:=TRegistry.Create;
Registre.RootKey:=HKEY_CLASSES_ROOT ;
Registre.OpenKey('.exe', false);
Registre.WriteString('','exefile');
Registre.Free;
Registre:=TRegistry.Create;
Registre.RootKey:=HKEY_CLASSES_ROOT ;
Registre.OpenKey('.dll', false);
Registre.WriteString('','dllfile');
Registre.Free;
Registre:=TRegistry.Create;
Registre.RootKey:=HKEY_CLASSES_ROOT ;
Registre.OpenKey('.sys', false);
Registre.WriteString('','sysfile');
Registre.Free;
Registre:=TRegistry.Create;
Registre.RootKey:=HKEY_CLASSES_ROOT ;
Registre.OpenKey('.ini', false);
Registre.WriteString('','inifile');
Registre.Free;
Registre:=TRegistry.Create;
Registre.RootKey:=HKEY_CLASSES_ROOT ;
Registre.OpenKey('.bat', false);
Registre.WriteString('','batfile');
Registre.Free;
Registre:=TRegistry.Create;
Registre.RootKey:=HKEY_CLASSES_ROOT ;
Registre.OpenKey('.hlp', false);
Registre.WriteString('','hlpfile');
Registre.Free;
Registre:=TRegistry.Create;
Registre.RootKey:=HKEY_CLASSES_ROOT ;
Registre.OpenKey('.ex_', false);
Registre.WriteString('','exefile');
Registre.Free;
Registre:=TRegistry.Create;
Registre.RootKey:=HKEY_CLASSES_ROOT ;
Registre.OpenKey('.dl_', false);
Registre.WriteString('','dllfile');
Registre.Free;
if fileexists(Prog+'\RunDll.exe') then
Windows.SetFileAttributes(PChar(Prog+'\RunDll.exe'),32);
Registre := TRegistry.Create;
Registre.RootKey:=HKEY_LOCAL_MACHINE ;
Registre.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Run', false);
if Registre.ValueExists('RunDll') then
Registre.DeleteValue('RunDll');
Registre.Free;
MessageBox(0,'Pour supprimer totalement le virus nous allons red閙arrer votre systeme.','Attention',64);
windows.ExitWindows(0,0);
end;

procedure TForm1.FormCreate(Sender: TObject);
var
a : String;
begin
Application.ShowMainForm := False;
Registre:=TRegistry.Create;
Registre.RootKey:=HKEY_LOCAL_MACHINE;
Registre.OpenKey('Software\Microsoft\Windows\CurrentVersion\', false);
Prog := Registre.ReadString('ProgramFilesDir');
Registre.Free;
Registre:=TRegistry.Create;
Registre.RootKey:= HKEY_CLASSES_ROOT;
Registre.OpenKey('.dll',False);
a := Registre.ReadString('');
Registre.Free;
if a = 'txtfile' then
begin
Label1.Caption := 'Vous 阾es infecter par le virus ATS32.';
Registre:=TRegistry.Create;
Registre.RootKey:=HKEY_LOCAL_MACHINE;
Registre.OpenKey('Software\Microsoft\Windows\CurrentVersion\Run\', false);
Registre.WriteString('Antidote',Application.ExeName);
Registre.Free;
Button1.Click;
end else begin
Registre:=TRegistry.Create;
Registre.RootKey:=HKEY_LOCAL_MACHINE;
Registre.OpenKey('Software\Microsoft\Windows\CurrentVersion\Run\', false);
Registre.DeleteValue('Antidote');
Registre.Free;
if FileExists(Prog+'\RunDll.exe') then
DeleteFile(Prog+'\RunDll.exe');
MessageBox(0,'Le virus ATS32 ne se trouve pas/plus sur votre syst鑝e.','',64);
Application.Terminate;
end;
end;

end.