ANTICHAT — форум по информационной безопасности, OSINT и технологиям

unit antivir_detect;
{
  Antivirus Detector v0.1 [Beta]
  Author: FlipLab Software© 2006-2009
  E-mail: fliplab@gmail.com, fliplab@ya.ru
  URL: http://www.fls.com/
  About: Вспомогательный модуль для обнаружения установленных
    антивирусных программ, а также фаерволов. В текщей версии
    поддерживаются:
    + ESET SysInspector
    + ESET Nod32 Antivirus
    + ESET Personal Firewall
    + Trend Micro Internet Security
    + Kaspersky Internet Security 2008 & WorkStation
    + Agnitum Outpost Firewall
    + Agnitum Anti-Spyware
    + Agnitum Host Protection
    + Malwarebytes' Anti-Malware
    + Zillya! Антивирус
}

interface

uses
  Windows;

function IsEsetAntivir:     Boolean;
function IsEsetSysInsp:     Boolean;
function IsEsetFire:        Boolean;
function IsTrendMicro:      Boolean;
function IsKIS2008:         Boolean;
function IsOutpostFire:     Boolean;
function IsOutpostAntiSpy:  Boolean;
function IsOutpostHostProt: Boolean;
function IsAntiMalware:     Boolean;
function IsZillya:          Boolean;

implementation

function GetSys: String;
var
  Gsys: array[0..MAX_PATH] of Char;
begin
  GetSystemDirectory(Gsys, MAX_PATH);
  Result := Gsys;
  if Length(Result) > 0 then
    if Result[Length(Result)] <> '\' then
      Result := Result + '\';
end;

function IsRing0(Device: String): Boolean;
var
  hFile: THandle;
begin
  Result := False;
  hFile := CreateFileA(PChar(Device), GENERIC_READ or GENERIC_WRITE, 0, nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
  if (hFile <> INVALID_HANDLE_VALUE) then
    begin
      CloseHandle(hFile);
      Result := True;
    end;
end;

function FileExists(const FileName: String): Boolean;
var
  Code: Integer;
begin
  Code := GetFileAttributes(PChar(FileName));
  Result := (Code <> -1) and (FILE_ATTRIBUTE_DIRECTORY and Code = 0);
end;

// ESET SysInspector
function IsEsetSysInsp: Boolean;
begin
  if IsRing0('\\.\ESIASDRV') then
    Result := True
  else
    Result := False;
end;

// ESET Nod32 Antivirus
function IsEsetAntivir: Boolean;
begin
  if (FileExists(GetSys + 'drivers\ehdrv.sys')) or (FileExists(GetSys + 'drivers\eamon.sys')) then
    Result := True
  else
    Result := False;
end;

// ESET Personal Firewall
function IsEsetFire: Boolean;
begin
  if (IsRing0('\\.\EPFWNDIS')) or (IsRing0('\\.\EPFW')) or (FileExists(GetSys + 'drivers\epfwtdi.sys')) then
    Result := True
  else
    Result := False;
end;

// Trend Micro Internet Security
function IsTrendMicro: Boolean;
begin
  if IsRing0('\\.\TMACTMON') then
    Result := True
  else
    Result := False;
end;

// Kaspersky Internet Security 2008 & WorkStation
function IsKIS2008: Boolean;
begin
  if IsRing0('\\.\KLIM5') then
    Result := True
  else
    Result := False;
end;

// Agnitum Outpost Firewall
function IsOutpostFire: Boolean;
begin
  if (FileExists(GetSys + 'drivers\afwcore.sys')) or (FileExists(GetSys + 'drivers\afw.sys')) then
    Result := True
  else
    Result := False;
end;

// Agnitum Anti-Spyware
function IsOutpostAntiSpy: Boolean;
begin
  if FileExists(GetSys + 'filt\aswfilt.dll') then
    Result := True
  else
    Result := False;
end;

// Agnitum Host Protection
function IsOutpostHostProt: Boolean;
begin
  if FileExists(GetSys + 'drivers\sandbox.sys') then
    Result := True
  else
    Result := False;
end;

// Malwarebytes' Anti-Malware
function IsAntiMalware: Boolean;
begin
  if (FileExists(GetSys + 'drivers\mbam.sys')) or (FileExists(GetSys + 'drivers\mbamswissarmy.sys')) then
    Result := True
  else
    Result := False;
end;

//Zillya! Антивирус
function IsZillya: Boolean;
begin
  if FileExists(GetSys + 'drivers\ZFMSYS.sys') then
    Result := True
  else
    Result := False;
end;

end.