procedure CloseAndDeleteMe;
stdcall;
function ThreadDeleteBegin(Param: Pointer): Boolean;
stdcall;
var
XDeleteFile :
function (pFileName: PChar): Boolean;
stdcall;
XSleep :
procedure (dwMilliseconds: DWord);
stdcall;
XOpenProcess :
function (dwDesiredAccess: DWord; bInheritHandle: Boolean; dwProcessId: DWord): DWord;
stdcall;
XTerminateProcess:
function (dwProcess: DWord; dwExitCode: DWord): Boolean;
stdcall;
XCloseHandle :
function (dwHandle: DWord): Boolean;
stdcall;
pFileName : PChar;
dwProcessID : DWord;
begin
Result := False;
@XDeleteFile := PPointer(DWord(Param)+0*SizeOf(Pointer))^;
@XSleep := PPointer(DWord(Param)+1*SizeOf(Pointer))^;
@XOpenProcess := PPointer(DWord(Param)+2*SizeOf(Pointer))^;
@XTerminateProcess := PPointer(DWord(Param)+3*SizeOf(Pointer))^;
@XCloseHandle := PPointer(DWord(Param)+4*SizeOf(Pointer))^;
dwProcessID := PDWord(DWord(Param)+5*SizeOf(Pointer))^;
pFilename := Pointer(DWord(Param)+6*SizeOf(Pointer));
if (@XDeleteFile <>
nil)
and
(@XSleep <>
nil)
and
(@XOpenProcess <>
nil)
and
(@XTerminateProcess <>
nil)
and
(pFilename <>
nil)
and
(dwProcessID <> 0)
then
begin
dwProcessID := XOpenProcess(PROCESS_ALL_ACCESS,false,dwProcessID);
if (dwProcessID <> 0)
then
begin
if XTerminateProcess(dwProcessID,0)
then
begin
XSleep(1000);
Result := XDeleteFile(pFileName);
end;
XCloseHandle(dwProcessID);
end;
end;
end;
procedure ThreadDeleteEnd;
asm end;
var
pTargetMemory : Pointer;
pTargetMemMove : Pointer;
dwProcessID : DWord;
dwKernelHandle : DWord;
dwProcessIDClose: DWord;
dwThreadID : DWord;
dwWritten : DWord;
dwMemSize : DWord;
sFileName :
String;
pAddr :
array[0..4]
of Pointer;
begin
dwProcessID := uallProcess.FindProcess('
explorer');
if (dwProcessID = 0 )
then
Exit;
dwProcessID := OpenProcess(PROCESS_ALL_ACCESS,false,dwPRocessID);
if (dwProcessID = 0)
then
Exit;
sFileName := Paramstr(0);
dwMemSize := 5*SizeOf(Pointer)+length(sFileName)+1+Integer(@ThreadDeleteEnd)-Integer(@ThreadDeleteBegin);
pTargetMemory := VirtualAllocExX(dwProcessID,
nil,dwMemSize,MEM_COMMIT
or MEM_RESERVE,PAGE_EXECUTE_READWRITE);
pTargetMemMove := pTargetMemory;
dwKernelHandle := GetModuleHandleA('
kernel32.dll');
pAddr[0] := GetProcAddress(dwKernelHandle,'
DeleteFileA');
pAddr[1] := GetProcAddress(dwKernelHandle,'
Sleep');
pAddr[2] := GetProcAddress(dwKernelHandle,'
OpenProcess');
pAddr[3] := GetProcAddress(dwKernelHandle,'
TerminateProcess');
pAddr[4] := GetProcAddress(dwKernelHandle,'
CloseHandle');
dwProcessIDClose := GetCurrentProcessID;
if (pTargetMemory <>
nil)
then
begin
if WriteProcessMemory(dwProcessID,pTargetMemMove,@pAddr[0],SizeOf(pAddr),dwWritten)
then
begin
pTargetMemMove := Pointer(DWord(pTargetMemMove)+dwWritten);
if WriteProcessMemory(dwProcessID,pTargetMemMove,@dwProcessIDClose,SizeOf(dwProcessIDClose),dwWritten)
then
begin
pTargetMemMove := Pointer(DWord(pTargetMemMove)+dwWritten);
if WriteProcessMemory(dwProcessID,pTargetMemMove,@sFileName[1],Length(sFileName),dwWritten)
then
begin
pTargetMemMove := Pointer(DWord(pTargetMemMove)+dwWritten+1);
if WriteProcessMemory(dwProcessID,pTargetMemMove,@ThreadDeleteBegin,
DWord(@ThreadDeleteEnd)-DWord(@ThreadDeleteBegin),dwWritten)
then
CreateRemoteThreadX(dwProcessID,
nil,0,pTargetMemMove,pTargetMemory,0,dwThreadID);
end;
end;
end;
end;
CloseHandle(dwProcessID);
end;