我对第三阶段◇第一题的菜鸟级解法（VC++6.0）
// killtrojan.cpp : Defines the entry point for the application.
// 因为是外行，不懂啥叫ring0、ring3，但经试验找到了一种解决办法，
// 需要重启动后在运行一次
// 1) 利用System.exe的消息0x10或0x11使其自行关闭服务并退出
// 2) 删除System.exe和HBKernel32.sys文件，并将HBQQXX.dll 改名移动到
// C:\HBQQXX.dll.vir
// 3) 自动重启系统
// 4) 统重自动启后，程序会自动运行一次，删除木马文件并修复注册表内容（如// 果安装了360安全软件，也会恢复其默认设置）
// 在装有Windows 2000的虚拟机上调试通过
#include "stdafx.h"
BOOL ChangeRegKeyRight(LPSTR lpSubkey); // 改变注册表权限
BOOL RestoreRegistry(void); // 恢复注册表
int APIENTRY WinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow)
{
// TODO: Place code here.
LPSTR lpWindowName = "HBInject32"; // 木马窗口名
LPSTR lpClassName = "HBInject32Class"; // 木马窗类名
// 3个木马文件
LPSTR lpDllName = "HBQQXX.dll";
LPSTR lpTroyjan1 = "drivers\\HBKernel32.sys";
LPSTR lpTroyjan2 = "System.exe";
// System.exe 自行退出的消息（两者等效，任选其一即可）
UINT Msg1 = 0x10;
UINT Msg2 = 0x11;
char buffer[MAX_PATH], buffer1[MAX_PATH], buffer2[MAX_PATH], DllName[MAX_PATH];
LPSTR lpModuleName = DllName;
LPSTR lpTroyjanName1 = buffer1;
LPSTR lpTroyjanName2 = buffer2;
// 形成木马文件的绝对路径
LPTSTR lpBuffer = buffer;
UINT path_len = GetSystemDirectory(lpBuffer, MAX_PATH);
if(path_len != 0)
{
lstrcpy(lpModuleName,lpBuffer);
lstrcat(lpModuleName,"\\");
lstrcat(lpModuleName,lpDllName);
lstrcpy(lpTroyjanName1,lpBuffer);
lstrcat(lpTroyjanName1,"\\");
lstrcat(lpTroyjanName1,lpTroyjan1);
lstrcpy(lpTroyjanName2,lpBuffer);
lstrcat(lpTroyjanName2,"\\");
lstrcat(lpTroyjanName2,lpTroyjan2);
}
// 查找System.exe是否运行
HWND hWnd = FindWindow(lpClassName, lpWindowName);
if (hWnd != NULL)
{
HMODULE hModule = GetModuleHandle(lpModuleName); // 取出System.exe 的句柄
// SendMessage(hWnd, Msg1, 0, NULL);
SendMessage(hWnd, Msg2, 0, NULL); // 发送消息 （Msg1或Msg2之一）
if(hModule != 0)
FreeLibrary(hModule);
// 删除或移动木马文件
DeleteFile(lpTroyjanName2);
DeleteFile(lpTroyjanName1);
MoveFile(lpModuleName, "c:\\HBQQXX.dll.vir");
// 提示是否要重启系统
int iMsg = MessageBox(NULL, "Please restart your computer and run this program again.", "Warning", MB_ICONQUESTION | MB_YESNO);
if (iMsg == IDYES)
{
LONG kStat;
HKEY hKey;
// 如果确认重启系统，则在注册表中添加重启后自动运行本程序仅一次
LPSTR lpSubKey00 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce";
kStat = RegOpenKeyEx(HKEY_LOCAL_MACHINE, lpSubKey00, 0, KEY_ALL_ACCESS, &hKey);
if(kStat == ERROR_SUCCESS)
{
char Filename[MAX_PATH];
LPSTR lpFilename = Filename;
// 形成本程序全路径名，并写入注册表紧运行一次的键值
if(GetModuleFileName(NULL, lpFilename, MAX_PATH))
RegSetValueEx(hKey, "killtroyjan", 0, REG_SZ, (CONST BYTE *)lpFilename, lstrlen(lpFilename));
}
RegCloseKey(hKey);
// 关闭系统并重启（尽管实现了此功能，但对内在的原理仍处于一知半解状态）
HANDLE hToken;
TOKEN_PRIVILEGES tkp;
if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
{
LookupPrivilegeValue(NULL, SE_SHUTDOWN_NAME, &tkp.Privileges[0].Luid);
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
tkp.PrivilegeCount = 1;
AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES)NULL, 0);
if (GetLastError() == ERROR_SUCCESS)
{ // 关闭系统|强制关闭其他程序|重启系统
ExitWindowsEx(EWX_SHUTDOWN | EWX_FORCE | EWX_REBOOT, 0);
}
}
}
}
else
{ // 如果没有确认重启系统、或再次运行本程序、或System.exe没运行，则删除木马文件
DeleteFile(lpModuleName);
DeleteFile("c:\\HBQQXX.dll.vir");
DeleteFile(lpTroyjanName2);
DeleteFile(lpTroyjanName1);
// 尽量恢复注册表为原来的样子
if(RestoreRegistry())
MessageBox(NULL, "Troyjan was removed from your computer.", "Success", MB_ICONINFORMATION);
else // 注册表恢复不成功
MessageBox(NULL, "Troyjan removal failed. Try again leter.", "Error!", MB_ICONERROR);
}
return 0;
}
// 改变注册表访问权限（这段的原理也还没完全理解，但确实起作用了）
BOOL ChangeRegKeyRight(LPSTR lpSubkey)
{
BOOL bSuccess = FALSE;
HKEY hKey;
if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, lpSubkey, 0, WRITE_DAC, &hKey) == ERROR_SUCCESS)
{
SID_IDENTIFIER_AUTHORITY sia = SECURITY_NT_AUTHORITY;
PSID pAdministratorsSid = NULL;
SECURITY_DESCRIPTOR sd;
PACL pDacl = NULL;
if(AllocateAndInitializeSid(&sia, 1, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS,
0, 0, 0, 0, 0, 0, &pAdministratorsSid))
{
DWORD dwAclSize = sizeof(ACL) + 1 * ( sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) ) +
GetLengthSid(pAdministratorsSid) ;
pDacl = (PACL)HeapAlloc(GetProcessHeap(), 0, dwAclSize);
if(pDacl)
if(InitializeAcl(pDacl, dwAclSize, ACL_REVISION))
if(AddAccessAllowedAce(pDacl, ACL_REVISION, KEY_ALL_ACCESS, pAdministratorsSid))
if(InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION))
// if(SetSecurityDescriptorDacl(&sd, TRUE, pDacl, FALSE)) // 尤其不懂为什么将pDacl改为NULL就有效（SDK帮助是这么说的）
if(SetSecurityDescriptorDacl(&sd, TRUE, NULL, FALSE)) // pDacl = NULL (allowing all access to the object)
if(RegSetKeySecurity(hKey, (SECURITY_INFORMATION)DACL_SECURITY_INFORMATION, &sd))
bSuccess = TRUE;
}
RegCloseKey(hKey);
RegCloseKey(HKEY_LOCAL_MACHINE);
if(pDacl != NULL)
HeapFree(GetProcessHeap(), 0, pDacl);
if(pAdministratorsSid != NULL)
FreeSid(pAdministratorsSid);
}
return bSuccess;
}
// 恢复注册表
BOOL RestoreRegistry(void)
{
BOOL bSuccess = TRUE;
HKEY hKey;
LONG kStat, safe360exist;
LPSTR lpSubKey00 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run";
LPSTR lp360safe = "Software\\360Safe";
LPSTR lp360safemon = "Software\\360Safe\\safemon";
char *safe360vnames[] = {"ARPAccess", "ExecAccess", "IEProtAccess", "LeakShowed", "MonAccess",
"NoNotiLeak", "NoNotiNews", "SiteAccess", "UDiskAccess", "weeken"};
LONG safe360values[] = {0, 1, 3, 1, 1, 0, 0, 1, 1, 0}; // 360安全软件的默认值（在我的机器上是这样的）
// 恢复360安全软件的设置
safe360exist = RegOpenKeyEx(HKEY_LOCAL_MACHINE, lp360safe, 0, KEY_ALL_ACCESS, &hKey);
if(safe360exist == ERROR_SUCCESS)
{
kStat = RegOpenKeyEx(HKEY_LOCAL_MACHINE, lp360safemon, 0, KEY_ALL_ACCESS, &hKey);
if(kStat == ERROR_SUCCESS)
{
for(int i=0; i < 10; i++) // 恢复360安全软件的默认值
RegSetValueEx(hKey, safe360vnames[i], 0, REG_DWORD, (LPBYTE)safe360values[i], sizeof(safe360values[i])+1);
}
else
BOOL bSuccess = FALSE;
RegCloseKey(hKey);
// 通过360安全软件的卸载信息找出相应的安装路径
LPSTR lpPathSafeBox360 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\360保险箱";
LPSTR lpPathSafe360 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\360安全卫士";
LPSTR lp360vname = "DisplayIcon";
char Safe360Start[MAX_PATH],SafeBox360Start[MAX_PATH];
LPTSTR lpSafe360run = Safe360Start;
LPTSTR lpSafeBox360run = SafeBox360Start;
DWORD cbValue, reg_type;
LONG kStat1, kStat2;
// 找360SafeBox的安装路径
kStat1 = RegOpenKeyEx(HKEY_LOCAL_MACHINE, lpPathSafeBox360, 0, KEY_ALL_ACCESS, &hKey);
kStat2 = RegQueryValueEx(hKey, lp360vname, 0, ®_type, (LPBYTE)lpSafeBox360run, &cbValue);
RegCloseKey(hKey);
if((kStat1 && kStat2) == ERROR_SUCCESS)
{
lstrcat(lpSafeBox360run," /r");
kStat = RegOpenKeyEx(HKEY_LOCAL_MACHINE, lpSubKey00, 0, KEY_ALL_ACCESS, &hKey);
if(kStat == ERROR_SUCCESS) // 恢复360SafeBox自启动设置
RegSetValueEx(hKey, "360Safebox", 0, REG_SZ, (CONST BYTE *)lpSafeBox360run, lstrlen(lpSafe360run));
RegCloseKey(hKey);
}
else
BOOL bSuccess = FALSE;
// 找360Safe的安装路径
kStat1 = RegOpenKeyEx(HKEY_LOCAL_MACHINE, lpPathSafe360, 0, KEY_ALL_ACCESS, &hKey);
kStat2 = RegQueryValueEx(hKey, lp360vname, 0, ®_type, (LPBYTE)lpSafe360run, &cbValue);
RegCloseKey(hKey);
if((kStat1 && kStat2) == ERROR_SUCCESS)
{
lstrcat(lpSafe360run," /start");
kStat = RegOpenKeyEx(HKEY_LOCAL_MACHINE, lpSubKey00, 0, KEY_ALL_ACCESS, &hKey);
if(kStat == ERROR_SUCCESS) // 恢复360SafeBox自启动设置
RegSetValueEx(hKey, "360Safetray", 0, REG_SZ, (CONST BYTE *)lpSafe360run, lstrlen(lpSafe360run));
RegCloseKey(hKey);
}
else
BOOL bSuccess = FALSE;
}
// 有权限的木马注册表子键(SubKey1至SubKey9)
LPSTR lpSubKey1 = "SYSTEM\\ControlSet001\\Enum\\Root\\LEGACY_HBKERNEL32\\0000\\Control";
LPSTR lpSubKey2 = "SYSTEM\\ControlSet001\\Enum\\Root\\LEGACY_HBKERNEL32\\0000";
LPSTR lpSubKey3 = "SYSTEM\\ControlSet001\\Enum\\Root\\LEGACY_HBKERNEL32";
LPSTR lpSubKey4 = "SYSTEM\\ControlSet002\\Enum\\Root\\LEGACY_HBKERNEL32\\0000\\Control";
LPSTR lpSubKey5 = "SYSTEM\\ControlSet002\\Enum\\Root\\LEGACY_HBKERNEL32\\0000";
LPSTR lpSubKey6 = "SYSTEM\\ControlSet002\\Enum\\Root\\LEGACY_HBKERNEL32";
LPSTR lpSubKey7 = "SYSTEM\\ControlSet003\\Enum\\Root\\LEGACY_HBKERNEL32\\0000\\Control";
LPSTR lpSubKey8 = "SYSTEM\\ControlSet003\\Enum\\Root\\LEGACY_HBKERNEL32\\0000";
LPSTR lpSubKey9 = "SYSTEM\\ControlSet003\\Enum\\Root\\LEGACY_HBKERNEL32";
// 没设权限的木马注册表子键
LPSTR lpSubKey10 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows";
LPSTR lpSubKey11 = "SYSTEM\\ControlSet001\\Services\\HBKernel32\\Enum";
LPSTR lpSubKey12 = "SYSTEM\\ControlSet001\\Services\\HBKernel32\\Security";
LPSTR lpSubKey13 = "SYSTEM\\ControlSet001\\Services\\HBKernel32";
LPSTR lpSubKey14 = "SYSTEM\\ControlSet002\\Services\\HBKernel32\\Enum";
LPSTR lpSubKey15 = "SYSTEM\\ControlSet002\\Services\\HBKernel32\\Security";
LPSTR lpSubKey16 = "SYSTEM\\ControlSet002\\Services\\HBKernel32";
LPSTR lpSubKey17 = "SYSTEM\\ControlSet003\\Services\\HBKernel32\\Enum";
LPSTR lpSubKey18 = "SYSTEM\\ControlSet003\\Services\\HBKernel32\\Security";
LPSTR lpSubKey19 = "SYSTEM\\ControlSet003\\Services\\HBKernel32";
// 删除有权限的木马注册表子键（职能一级一级的删）
if(ChangeRegKeyRight(lpSubKey1))
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey1);
else
BOOL bSuccess = FALSE;
if(ChangeRegKeyRight(lpSubKey2))
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey2);
else
BOOL bSuccess = FALSE;
if(ChangeRegKeyRight(lpSubKey3))
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey3);
else
BOOL bSuccess = FALSE;
if(ChangeRegKeyRight(lpSubKey4))
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey4);
else
BOOL bSuccess = FALSE;
if(ChangeRegKeyRight(lpSubKey5))
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey5);
else
BOOL bSuccess = FALSE;
if(ChangeRegKeyRight(lpSubKey6))
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey6);
else
BOOL bSuccess = FALSE;
if(ChangeRegKeyRight(lpSubKey7))
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey7);
else
BOOL bSuccess = FALSE;
if(ChangeRegKeyRight(lpSubKey8))
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey8);
else
BOOL bSuccess = FALSE;
if(ChangeRegKeyRight(lpSubKey9))
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey9);
else
BOOL bSuccess = FALSE;
// 有时删不干净，再来一遍(SubKey1~SubKey9)
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey1);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey2);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey3);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey4);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey5);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey6);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey7);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey8);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey9);
// 删除没设权限的注册表项
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey10);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey11);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey12);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey13);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey14);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey15);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey16);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey17);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey18);
RegDeleteKey(HKEY_LOCAL_MACHINE, lpSubKey19);
// 删除System.exe自启动注册表项
kStat = RegOpenKeyEx(HKEY_LOCAL_MACHINE, lpSubKey00, 0, KEY_ALL_ACCESS, &hKey);
if(kStat == ERROR_SUCCESS)
RegDeleteValue(hKey, "HBService32");
else
BOOL bSuccess = FALSE;
RegCloseKey(hKey);
return bSuccess;
}
// 尽管实现了清除木马的功能，但其中还有相当多的内容不甚了解，请各位高人指教。
