Win32/Induc.A，“Delphi”病毒，感染SysConst.pas，有人有代码示例可供搜索吗？
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
接受 或继续使用网站，即表示您同意使用 Cookies 和您的相关数据。
发布评论
评论（2）
我一直在分析病毒。网络上流传的信息称它会感染受感染计算机上编译的所有可执行文件，但这一信息并不完全正确。它仅感染没有 VCL 运行时包且没有调试 DCU 编译的可执行文件。
如果使用包进行编译，SysConst 单元已经在编译后的 VCL 包中，不会受到影响。
并且该病毒仅将自身添加到 SysConst.dcu 文件的非调试版本中。
否则，到目前为止我在网上读到的内容都是准确的。病毒将 SysConst.pas 文件复制到“实现”行，然后将自身附加到新文件（SysConst.pas 有一个空的实现部分 - 它只是常量声明）。它将原始 SysConst.dcu 备份到 SysConst.bak，将受感染的源代码副本编译为新的 SysConst.dcu，然后删除源副本。最后，它设置新受感染 dcu 文件的文件创建和修改日期以匹配旧的干净文件。鬼鬼祟祟的！
它除了复制之外什么也不做——没有恶意的有效负载。
I've been analysing the virus. The information circulating on the web, that it infects all executables compiled on an infected machine, isn't quite correct. It only infects executables compiled WITHOUT the VCL runtime package AND without debug DCUs.
If you compile with packages, the SysConst unit is already in the compiled VCL package, which isn't affected.
And the virus only adds itself to the non-debug version of the SysConst.dcu file.
Otherwise, what I've read so far on the web is accurate. The virus copies the SysConst.pas file up to the 'implementation' line, then appends itself to the new file (SysConst.pas has an empty implementation section - it's only constant declarations). It backs up the original SysConst.dcu to SysConst.bak, compiles the infected source code copy to a new SysConst.dcu and then deletes the source copy. Finally, it sets the file creation and modification date of the new infected dcu file to match the old clean one. Sneaky!
It does nothing other than duplicate - there's no malignant payload.
我见过。对此还是有点困惑。当第一个通知发出时，我只查看了 .pas 文件。我没有发现 .pas 文件有任何问题，并将其保留到今天。然后我更仔细地研究了一下并查看了 .dcu 文件。我发现两个受感染的 .DCU 文件。两者的长度都是 18K，而不是 12K，后者只是一个小问题。第二个技巧是找到最后六个参数为 0,0,0,3,0,0 的 CreateFile。我将未受感染的 SysConst.DCU 文件从 DEBUG 文件夹复制到 LIB 中。然后我重新构建了被感染的应用程序，总共五个。其中一份可追溯至 6 月 22 日。其他则为最近。一个应用程序与另外两个受感染的应用程序在同一个周末构建，报告称是干净的。但我还是重建了它。
我一直在运行由卡巴斯基授权的 ZoneAlarm Security Suite Anti-Virus，直到大约五个小时前，它一直为我提供有关受感染应用程序的清晰报告。我必须使用 Avast 扫描应用程序！了解在那之前哪些人实际上被感染了。我一直在犹豫是否要放弃 ZA 的 AV，但这最终敲定了交易。我知道我不想要任何误报，但它们比任何漏报要少得多。五名受影响的客户之一很不高兴。我不能责怪他。
最后一个有趣的一点（当然我使用的是 Delphi 7.1）。调试中的新（旧？）SysConst.dcu 长度为 11,681 字节，而 .bak 文件我认为从原始文件创建的令人讨厌的文件长度为 11,658 字节。不知道这是否重要，但我保留了两者。我将在接下来的一段时间编译之前检查 dcu。这很麻烦，但接下来的一段时间里，偏执狂将统治这里的一天。
I've seen it. Still a little confused by it. When the first notice of it went out, I only looked at the .pas file. I didn't find anything wrong with the .pas file and left it for the day. THEN I researched a little more carefully and went to look at the .dcu files. I found TWO infected .DCU files. Both were 18K in length, rather than 12K, which was one tipoff. The second tipoff was finding the CreateFile with 0,0,0,3,0,0 as the last six parameters. I copied the uninfected SysConst.DCU file from the DEBUG folder up into LIB. I then re-built the apps that were infected, five in all. One dated back to June 22. The others more recently. One app built the same weekend as two other infected apps, reported clean. But I rebuilt it anyway.
I have been running the ZoneAlarm Security Suite Anti-Virus, licensed from Kapersky, and it kept giving me clean reports on the infected apps right through till about five hours ago. I had to scan the apps with Avast! to learn which ones were actually infected up until then. I had been teetering on discarding ZA's AV, but this clinches the deal. I know I don't want any false positives, but they are a whole lot less annoying than any missed positives. One of the five affected clients was NOT happy. And I can't blame him.
One last interesting bit (I am using Delphi 7.1 of course). The new (old?) SysConst.dcu from debug is 11,681 bytes long, whereas the .bak file I presume the nasty piece of business created out of the original is 11,658 bytes long. Don't know if it is significant, but I'm keeping both around. And I'll be checking out the dcu before compiling for the next little while. It's a bother, but paranoia rules the day around here for the next little while.