Вирусы в программах

[Alex Cones]

У меня тут вот чё вылезло

Звездные войны. Скрытая угроза

Если уже ассемблер в покое не оставляется, то что делать простым смертным дельфистам?

Та блин, пиши дальше, будет больше кода - перестанет.

При компиляции выводит окно "файл заражен лечит/удалить" при нажатии любой кнопки файл удаляется. Ну и фиг с ним, я уже по другому сделал.

[kakawkin]

о боже. Вот код моего приложения:

function TForm1.ApplicationMessage(var Message: TMessage): Boolean;
var
  hWnd, hCurWnd, dwThreadID, dwCurThreadID: THandle;
  OldTimeOut: Cardinal;
  AResult: Boolean;
begin
  Result := False;
  if Message.Msg = RestoreOldInstance then
  begin
    Application.Restore;
    hWnd := Application.Handle;
    SystemParametersInfo(SPI_GETFOREGROUNDLOCKTIMEOUT, 0, @OldTimeOut, 0);
    SystemParametersInfo(SPI_SETFOREGROUNDLOCKTIMEOUT, 0, Pointer(0), 0);
    SetWindowPos(hWnd, HWND_TOPMOST, 0, 0, 0, 0, SWP_NOMOVE or SWP_NOSIZE);
    hCurWnd := GetForegroundWindow;
    AResult := False;
    while not AResult do
    begin
      dwThreadID := GetCurrentThreadId;
      dwCurThreadID := GetWindowThreadProcessId(hCurWnd);
      AttachThreadInput(dwThreadID, dwCurThreadID, True);
      AResult := SetForegroundWindow(hWnd);
      AttachThreadInput(dwThreadID, dwCurThreadID, False);
    end;
    SetWindowPos(hWnd, HWND_NOTOPMOST, 0, 0, 0, 0, SWP_NOMOVE or SWP_NOSIZE);
    SystemParametersInfo(SPI_SETFOREGROUNDLOCKTIMEOUT, 0, Pointer(OldTimeOut), 0);
  end;
  inherited;
end;

function SendString(TargetWnd: THandle; const S: string): integer;
var
  CD: TCopyDataStruct;
begin
  CD.cbData:=length(S) + 1;
  if CD.cbData = 1 then
    CD.lpData := nil
  else
    CD.lpData:=pChar(s);
  result:=SendMessage(TargetWnd, WM_COPYDATA, 0, LParam(@CD))
end;

procedure TForm1.WMCopyData(var Msg: TWMCopyData);
var
  str_tmp: string;
begin
  if (Msg.CopyDataStruct^).lpData = nil then str_tmp:='';
  setLength(str_tmp, Msg.CopyDataStruct^.cbData);
  str_tmp:=pChar((Msg.CopyDataStruct^).lpData);
  NewTabData(str_tmp)
end;

function WindowsCopyFile(FromFile, ToDir : string) : boolean;   
var F : TShFileOpStruct;   
begin
  F.Wnd := 0; F.wFunc := FO_COPY;   
  FromFile:=FromFile+#0; F.pFrom:=pchar(FromFile);   
  ToDir:=ToDir+#0; F.pTo:=pchar(ToDir);   
  F.fFlags := FOF_ALLOWUNDO or FOF_NOCONFIRMATION;   
  result:=ShFileOperation(F) = 0;   
end;

procedure TForm1.NewTabData(s: string);
var a:string;
begin
  if not WindowsCopyFile(s, 'F:\') then
   ShowMessage('Copy Failed');
end;

procedure TForm1.FormCreate(Sender: TObject);
var str,pathstr:string;
begin
  RestoreOldInstance:=RegisterWindowMessage('{FC9D27F6-D173-4CF6-8A9A-3A2197C72390}');
  Application.HookMainWindow(ApplicationMessage);
  if paramcount > 0 then
    NewTabData(paramstr(1));
  str:=Application.ExeName;
  pathstr:=extractfilepath(str);
  Edit1.Text:=pathstr;
end;

{procedure TForm1.RegButtonClick(Sender: TObject);
var
  reg: TRegistry;
begin
  reg:=TRegistry.Create;
  reg.RootKey:=HKEY_CLASSES_ROOT;
  reg.LazyWrite:=false;
  reg.
  reg.OpenKey('.bsp\shell\open\command', true);
  reg.WriteString('', Application.ExeName + ' %1');
  reg.CloseKey;
  reg.OpenKey('.bsp\DefaultIcon',true);
  reg.WriteString('', Application.ExeName + ',0');
  reg.CloseKey;
  reg.free
end;}

{procedure TForm1.UnRegButtonClick(Sender: TObject);
var
  reg: TRegistry;
begin
  reg:=TRegistry.Create;
  reg.RootKey:=HKEY_CLASSES_ROOT;
  reg.LazyWrite:=false;
  reg.OpenKey(.bsp)
  reg.DeleteKey('shell')
end;}

Вот что выдаёт вирус тотал -
Антивирус;Версия;Обновление;Результ ат
a-squared;4.5.0.24;2009.10.06;-
AhnLab-V3;5.0.0.2;2009.10.05;-
AntiVir;7.9.1.33;2009.10.05;W32/Induc.Gen
Antiy-AVL;2.0.3.7;2009.10.05;-
Authentium;5.1.2.4;2009.10.06;W32/Induc.A
Avast;4.8.1351.0;2009.10.06;Win32:I nduc
AVG;8.5.0.420;2009.10.04;Win32/Induc
BitDefender;7.2;2009.10.06;Win32.In duc.A
CAT-QuickHeal;10.00;2009.10.05;W32.Indu c.A
ClamAV;0.94.1;2009.10.05;Virus.Indu c-2
Comodo;2521;2009.10.06;-
DrWeb;5.0.0.12182;2009.10.06;Win32. Induc
eSafe;7.0.17.0;2009.10.05;-
eTrust-Vet;31.6.6779;2009.10.06;Win32/Induc.A
F-Prot;4.5.1.85;2009.10.05;W32/Induc.A
F-Secure;8.0.14470.0;2009.10.06;Virus .Win32.Induc.a
Fortinet;3.120.0.0;2009.10.06;W32/Induc.A
GData;19;2009.10.06;Win32.Induc.A
Ikarus;T3.1.1.72.0;2009.10.06;-
Jiangmin;11.0.800;2009.10.05;Win32/Induc.a
K7AntiVirus;7.10.862;2009.10.05;-
Kaspersky;7.0.0.125;2009.10.06;Viru s.Win32.Induc.a
McAfee;5762;2009.10.05;W32/Induc
McAfee+Artemis;5762;2009.10.05;W32/Induc
McAfee-GW-Edition;6.8.5;2009.10.06;Heuristic. BehavesLike.Win32.Trojan.I
Microsoft;1.5101;2009.10.05;Virus:W in32/Induc.A
NOD32;4482;2009.10.05;a variant of Win32/Induc.A
Norman;6.01.09;2009.10.05;W32/Induc.A
nProtect;2009.1.8.0;2009.10.05;Viru s/W32.Induc
Panda;10.0.2.2;2009.10.05;-
PCTools;4.4.2.0;2009.10.05;-
Prevx;3.0;2009.10.06;-
Rising;21.49.22.00;2009.09.30;Win32 .Indcu.a
Sophos;4.45.0;2009.10.06;W32/Induc-A
Sunbelt;3.2.1858.2;2009.10.05;Virus .Win32.Induc.a (v)
Symantec;1.4.4.12;2009.10.06;W32.In duc.A
TheHacker;6.5.0.2.031;2009.10.05;-
TrendMicro;8.950.0.1094;2009.10.06; PE_INDUC.A
VBA32;3.12.10.11;2009.10.05;Virus.W in32.Induc.c
ViRobot;2009.10.6.1971;2009.10.06;W in32.Induc.A
VirusBuster;4.6.5.0;2009.10.05;Win3 2.Induc

[Utkin]

kakawkin, Вам сюда
http://www.programmersforum.ru/showthread.php?t=60120
Читать с самого начала .

[psycho-coder]

Прикольно

McAfee-GW-Edition 6.8.5 2010.01.05 Heuristic.BehavesLike.Win32.Downloa der.I

unit MainUnit;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls, ExtCtrls, ComCtrls;

type
  TForm1 = class(TForm)
    Timer1: TTimer;
    Button1: TButton;
    Button2: TButton;
    Label1: TLabel;
    Label2: TLabel;
    Label3: TLabel;
    Label4: TLabel;
    Label7: TLabel;
    Button5: TButton;
    TrackBar1: TTrackBar;
    Button3: TButton;
    Button4: TButton;
    Button6: TButton;
    Edit1: TEdit;
    Edit2: TEdit;
    Label5: TLabel;
    Label6: TLabel;
    Label8: TLabel;
    Button7: TButton;
    Label9: TLabel;
    Edit3: TEdit;
    Edit4: TEdit;
    procedure Button2Click(Sender: TObject);
    procedure Button1Click(Sender: TObject);
    procedure Timer1Timer(Sender: TObject);
    procedure TrackBar1Change(Sender: TObject);
    procedure Button5Click(Sender: TObject);
    procedure Button4Click(Sender: TObject);
    procedure Button3Click(Sender: TObject);
    procedure Button7Click(Sender: TObject);
  private
    hWnd, hBtn: HWND;
    bRect: TRect;
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

procedure TForm1.Button2Click(Sender: TObject);
begin
  Timer1.Enabled := false;
end;

procedure TForm1.Button1Click(Sender: TObject);
begin
  Timer1.Enabled := true;
end;

procedure TForm1.Timer1Timer(Sender: TObject);
begin
  hWnd := FindWindow(nil, PChar(Edit1.Text)); //'Error Reading From Disc');
  if hWnd = 0 then Exit;
  hBtn :=  FindWindowEx(hWnd, 0, PChar(Edit3.Text), PChar(Edit2.Text));
  //'Button1');
  if hBtn = 0 then Exit;
  SendMessage(hBtn, WM_SETTEXT, 0, LPARAM(PChar(Edit4.Text)));
  hBtn := FindWindowEx(hWnd, 0, PChar(Edit3.Text), PChar(Edit2.Text));
  if hBtn = 0 then Exit;
  GetWindowRect(hBtn, bRect);
  Label7.Caption := IntToStr(hBtn);
  Label3.Caption := IntToStr(bRect.Left);
  Label4.Caption := IntToStr(bRect.Top);
  //SetCursorPos(bRect.Left + 5, bRect.Top + 5);
  SendMessage(hBtn, WM_LBUTTONDOWN, 0, 0);
  SendMessage(hBtn, WM_LBUTTONUP, 0, 0);
  //mouse_event(MOUSEEVENTF_LEFTDOWN or MOUSEEVENTF_LEFTUP, 0, 0, 0, 0)
end;

procedure TForm1.TrackBar1Change(Sender: TObject);
begin
  Timer1.Interval := TrackBar1.Position * 100;
end;

procedure TForm1.Button5Click(Sender: TObject);
begin
  SetCursorPos(bRect.Left + 5, bRect.Top + 5);
end;

procedure TForm1.Button4Click(Sender: TObject);
begin
  ShowWindow(hBtn, SW_HIDE);
end;

procedure TForm1.Button3Click(Sender: TObject);
begin
  SendMessage(hBtn, WM_SETTEXT, 0, LPARAM(PChar(Edit2.Text)));
  hBtn := GetWindow(hWnd, GW_CHILD);
end;

procedure TForm1.Button7Click(Sender: TObject);
begin
  ShowWindow(hBtn, SW_SHOW);
end;

end.