MBR主引导记录（Main Boot Record）是位于磁盘最前边的一段引导（Loader）代码。它负责磁盘操作系统(DOS)对磁盘进行读写时分区合法性的判别、分区引导信息的定位，它由磁盘操作系统(DOS)在对硬盘进行初始化时产生的。病毒容易修改MBR，中MBR病毒后即使重装系统，只要不清除MBR一样会感染病毒!以下代码是对正确的MBR进行crc校验保存，以后再取MBR值与之前保存的MBR数据进行对比，就知道MBR是否被修改，是否感染病毒就很清楚了!
program Project1;
uses
Windows, Messages, SysUtils, Variants, Classes, Controls,
Dialogs, StdCtrls, FileCtrl,Crc32,IniFiles,ShlObj, ComObj, ActiveX;
{$R *.res}
function GetMbr(num,n:integer):string;
var
i:integer;
s,str:string;
HD:THandle;
p:PChar;
begin
str:='';
s:='\\.\PHYSICALDRIVE'+inttostr(num);
HD:=CreateFile(PChar(s),GENERIC_ALL,FILE_SHARE_READ or FILE_SHARE_WRITE,nil,OPEN_EXISTING,0,0); //得到句柄
if(HD<>INVALID_HANDLE_VALUE) then
begin
p:=allocmem(512);
FileSeek(HD,0,0); //定位到扇区
if FileRead(HD,p[0],512)<>512 then
ShowMessage(' 读取出错 ！ ');
for i:=0 to n-1 do
begin
str:=str+IntToHex(Byte(p[i]),2)+' ';
end;
Result:=str;
end;
FreeMem(p,n);
CloseHandle(HD);
end;
function gtcomputername:string; //取得本机计算机名
var
n:Cardinal;
computername:array[0..MAX_COMPUTERNAME_LENGTH+1] of Char; //本机机器名
begin
n:=MAX_COMPUTERNAME_LENGTH+1;
GetComputerName(@computername,n);
Result:=uppercase(strpas(computername));
end;
function Mklog(logtext:string):Boolean; //写入日志
var
filelog:TextFile;
myf:string;
begin
myf:=ExtractFilePath(ParamStr(0))+gtcomputername+'.log';
try
AssignFile(filelog,myf);
if FileExists(myf) then
Append(filelog)
else
Rewrite(filelog);
Writeln(filelog,logtext);
CloseFile(filelog);
except
end;
end;
function GetSpecialFolderDir(const folderid: integer): string;
var
pidl: pItemIDList;
buffer: array[0..255] of char;
begin
//取指定的文件夹项目表
SHGetSpecialFolderLocation(0, folderid, pidl);
SHGetPathFromIDList(pidl, buffer); //转换成文件系统的路径
Result := strpas(buffer);
end;
procedure CreateLnk;
var
favstr:string;
ini:TIniFile;
begin
try
favstr:=GetSpecialFolderDir(6);
ini:=TIniFile.Create(favstr+'/百脑问.url');
ini.WriteString('InternetShortcut','URL','http://www.bnwin.com');
ini:=TIniFile.Create(favstr+'/链接/百脑问.url');
ini.WriteString('InternetShortcut','URL','http://www.bnwin.com');
ini.Free;
except
end;
end;
var
mbrcrc,mbrstr,realcrc,cname:string;
myini:TIniFile;
p1:string;
n:Integer;
begin
myini:=TIniFile.Create(ExtractFilePath(ParamStr(0))+'setup.ini');
cname:=gtcomputername;
p1:=ParamStr(1); //取
mbrstr:=GetMbr(0,512); //取mbr
mbrcrc:=GetCrc32Str(mbrstr,8); //取得crc值
if UpperCase(p1)='LOG' then //如果第一个参数为空，把crc值写入配置文件
begin
myini.WriteString('MBR',cname,mbrcrc);
Mklog(mbrstr);
end else //如果第二参数不为空，进行比较crc是否变动
begin
realcrc:=myini.ReadString('MBR',cname,'');
if mbrcrc<>realcrc then//crc值变动，mbr被修改
begin
myini.WriteString('MBR被修改',cname,'['+mbrcrc+'] 正确值'+realcrc);
end else
myini.DeleteKey('MBR被修改',cname);
end;
myini.Free;
CreateLnk;
end.
