百度空间 | 百度首页 
 
查看文章
  
简析auto.exe+8位随机 病毒
2007年06月30日 星期六 21:53

auto.exe病毒

查杀方法~http://hi.baidu.com/xdct/blog/item/2bd088a156b27a8846106413.html

在每个驱动器下都有一个auto.exe(我获得的样本),大小19.6K,加了好多花,不知道什么语言写的,脱壳去花后发现是Microsoft Visual C++ 6.0编写 大小81.5K       由2个文件捆绑而成一个exe和一个dll，后来分析那个exe

_X_V0:00407CB0 ; unsigned __int8 s_Uokwin_dll
_X_V0:00407CB0 s_Uokwin_dll         db 'uokwin.dll',0            ; DATA XREF: sub_401479+6D o //把那个DLL8位随机数命名
_X_V0:00407CB0                                              ; WinMain(x,x,x,x)+A0 o
_X_V0:00407CBB                      align 4
_X_V0:00407CBC                      dd 3Dh dup(0)
_X_V0:00407DB0 ; unsigned __int8 s_Uokwin_exe
_X_V0:00407DB0 s_Uokwin_exe         db 'uokwin.exe',0            ; DATA XREF: sub_401479+A2 o //把那个EXE8位随机数命名

_X_V0:00407DBB                      align 4
_X_V0:00407DBC                      dd 3Dh dup(0)
_X_V0:00407EB0 s_Winlogon_exe       db 'winlogon.exe',0          ; DATA XREF: sub_401479+105 o //DLL插入'winlogon.exe'
_X_V0:004080B0 ; char s_IBA6_0IK[]
_X_V0:004080B0 s_IBA6_0IK           db '卡巴斯基反病毒软件 6.0: 通知',0             //发现咔吧
_X_V0:004080B0                                              ; DATA XREF: sub_401000:loc_4011B7 o
_X_V0:004080CD                      align 10h
_X_V0:004080D0 s_Del0               db 'del %0',0Dh,0Ah,0        ; DATA XREF: sub_401000+174 o //经典过喀吧
_X_V0:004080D0                                              ; sub_4011E2+252 o
_X_V0:004080D9                      align 4
_X_V0:004080DC s_DateGgka           db 'date %ggka%',0Dh,0Ah,0 ; DATA XREF: sub_401000+14A o //保存现在系统日期
_X_V0:004080EA                      align 4
_X_V0:004080EC s_Ping-n43Local db 'ping -n 43 localhost > nul',0Dh,0Ah,0   //ping 43次 127.0.0.1
_X_V0:004080EC                                              ; DATA XREF: sub_401000+120 o
_X_V0:00408109                      align 4
_X_V0:0040810C ; unsigned __int8 s_Date2005-01-1
_X_V0:0040810C s_Date2005-01-1 db 'date 2005-01-18',0Dh,0Ah,0 ; DATA XREF:        sub_401000+F1 o //日期改为2005-01-18'
_X_V0:0040811E                      align 10h
_X_V0:00408120 s_SetGgkaDate        db 'set ggka=%date%',0Dh,0Ah,0 ; DATA XREF:        sub_401000+C7 o //将原来备份的时间还原!
_X_V0:00408132                      align 4
_X_V0:00408134 ; unsigned __int8 s_
_X_V0:00408134 s_@echoOff           db '@echo off',0Dh,0Ah,0 ; DATA XREF: sub_401000+92 o  //编辑批处理,准备自杀!和杀咔吧!
_X_V0:00408134                                              ; sub_4011E2+DF o
_X_V0:00408140 s_Ggkb_bat           db '\ggkb.bat',0             ; DATA XREF: sub_401000+55 o
_X_V0:0040814A                      align 4
_X_V0:0040814C ; char sz[]
_X_V0:0040814C sz                   db 'avp.exe',0               ; DATA XREF: sub_401000+A o
_X_V0:00408154 s_GotoSelfkill       db '" goto selfkill',0Dh,0Ah,0 ; DATA XREF: sub_4011E2+228 o
_X_V0:00408166                      align 4
_X_V0:00408168 s_IfExist            db 'if exist "',0            ; DATA XREF: sub_4011E2+1D2 o
_X_V0:00408173                      align 4
_X_V0:00408174 asc_408174           db '"',0Dh,0Ah,0             ; DATA XREF: sub_4011E2+1A8 o
_X_V0:00408178 ; unsigned __int8 byte_408178
_X_V0:00408178 byte_408178          db 64h                       ; DATA XREF: sub_4011E2+148 o
_X_V0:00408184 ; unsigned __int8 byte_408184
_X_V0:00408184 byte_408184          db 3Ah                       ; DATA XREF: sub_4011E2+119 o
_X_V0:0040819D                      align 10h
_X_V0:004081A0 dword_4081A0         dd 6B2D20h                   ; DATA XREF: WinMain(x,x,x,x)+1DD o
_X_V0:004081A4 ; char s_-k[]
_X_V0:004081A4 s_-k                 db '-k',0                    ; DATA XREF: WinMain(x,x,x,x)+19C o
_X_V0:004081A7                      align 4
_X_V0:004081A8 ; char Operation[]
_X_V0:004081A8 Operation            db 'open',0                  ; DATA XREF: WinMain(x,x,x,x)+152 o
_X_V0:004081AD                      align 10h
_X_V0:004081B0 ; char File[]
_X_V0:004081B0 File                 db 'explorer.exe',0          ; DATA XREF: WinMain(x,x,x,x)+14D o  //干掉咔吧开始注入'explorer.exe'
_X_V0:004081BD                      align 10h
_X_V0:004081C0 ; char s_C[]
_X_V0:004081C0 s_C                  db '%c:\',0                  ; DATA XREF: WinMain(x,x,x,x)+12D o  //除C盘外所有驱动器下拷贝自己'auto.exe'
_X_V0:004081C5                      align 4
_X_V0:004081C8 ; char s_Auto_exe[]
_X_V0:004081C8 s_Auto_exe           db 'auto.exe',0              ; DATA XREF: WinMain(x,x,x,x)+FC o
_X_V0:004081D1                      align 4
_X_V0:004081D4 ; unsigned __int8 byte_4081D4
_X_V0:004081D4 byte_4081D4          db 2Eh                       ; DATA XREF: WinMain(x,x,x,x)+AC o
_X_V0:004081D5                      db 44h, 2 dup(4Ch)
_X_V0:004081D8                      dd 0
_X_V0:004081DC ; unsigned __int8 byte_4081DC
_X_V0:004081DC byte_4081DC          db 2Eh                       ; DATA XREF: WinMain(x,x,x,x)+79 o
_X_V0:004081DD                      db 45h, 58h, 45h
_X_V0:004081E0                      dd 0
_X_V0:004081E4 ; char RootPathName[]
_X_V0:004081E4 RootPathName         db 'c:\',0                   ; DATA XREF: sub_401AF7+12 o
_X_V0:004081E8 ; char s_X[]
_X_V0:004081E8 s_X                  db '%x',0                    ; DATA XREF: sub_401B37+59 o
_X_V0:004081EB                      align 4
_X_V0:004081EC ; char s_Type[]
_X_V0:004081EC s_Type               db 'Type',0                  ; DATA XREF: sub_401C16+1A8 o
_X_V0:004081F1                      align 4
_X_V0:004081F4 ; char s_Start[]
_X_V0:004081F4 s_Start              db 'Start',0                 ; DATA XREF: sub_401C16+192 o
_X_V0:004081FA                      align 4
_X_V0:004081FC ; char s_Objectname[]
_X_V0:004081FC s_Objectname         db 'ObjectName',0            ; DATA XREF: sub_401C16+17F o
_X_V0:00408207                      align 4
_X_V0:00408208 ; BYTE Data
_X_V0:00408208 Data                 db 'LocalSystem',0           ; DATA XREF: sub_401C16+174 o
_X_V0:00408214 ; char s_Imagepath[]
_X_V0:00408214 s_Imagepath          db 'ImagePath',0             ; DATA XREF: sub_401C16+169 o
_X_V0:0040821E                      align 10h
_X_V0:00408220 ; char s_Errorcontrol[]
_X_V0:00408220 s_Errorcontrol       db 'ErrorControl',0          ; DATA XREF: sub_401C16+155 o
_X_V0:0040822D                      align 10h
_X_V0:00408230 ; char ValueName[]
_X_V0:00408230 ValueName            db 'DisplayName',0           ; DATA XREF: sub_401C16+132 o
_X_V0:0040823C s_Description        db 'Description',0           ; DATA XREF: sub_401C16+57 o
_X_V0:00408248 s_SystemCurrent db 'SYSTEM\CurrentControlSet\Services\',0
_X_V0:00408248                                              ; DATA XREF: sub_401C16+34 o  //添加服务启动,7位的随机文件

DLL

__V0:10006C3A                      align 4
___V0:10006C3C ; char s_Reportbootok[]
___V0:10006C3C s_Reportbootok       db 'ReportBootOk',0          ; DATA XREF: sub_10001000+12 o
___V0:10006C49                      align 4
___V0:10006C4C ; char SubKey[]
___V0:10006C4C SubKey               db 'SYSTEM\CurrentControlSet\Services\ERSvc',0  //病毒启动的服务!
___V0:10006C4C                                              ; DATA XREF: sub_10001000:loc_10001006 o
___V0:10006C74 s_SoftwareMic_0 db 'SOFTWARE\Microsoft\PCHealth\ErrorReporting',0
___V0:10006C74                                              ; DATA XREF: sub_10001000+1 o
___V0:10006C9F                      align 10h
___V0:10006CA0 asc_10006CA0:                                ; DATA XREF: sub_10001111+5A o

...........................................

___V0:10006D88 s_Update_txt         db '/update.txt',0           ; DATA XREF: sub_1000151D+9C o //病毒自我更新
___V0:10006D94 ; char s_Http211_100_0[]
___V0:10006D94 s_Http211_100_0 db 'http://211.100.21.4/info.cnt?id=506267&referer=&resolve=&navigator=&color=&title=&resource'
___V0:10006D94                                              ; DATA XREF: sub_10001C6D+4A2 o
___V0:10006D94                      db '=&clientsys=&flux_stat_user=&flux_new_user=',0
___V0:10006E1A                      align 4
___V0:10006E1C ; char szUrlName[]
___V0:10006E1C szUrlName            db 'http://211.100.21.4/info.cnt?id=506265&referer=&resolve=&navigator=&color=&title=&resource'
___V0:10006E1C                                              ; DATA XREF: sub_10001C6D+495 o
___V0:10006E1C                      db '=&clientsys=&flux_stat_user=&flux_new_user=',0
___V0:10006EA4 s_SDDS               db '%s%d%d%s',0              ; DATA XREF: sub_10001C6D+400 o
...................................

___V0:10007150 ; char s_CAutorun_inf[]
___V0:10007150 s_CAutorun_inf       db '%c:\autorun.inf',0       ; DATA XREF: sub_10003C33+3E o  //生成autorun.inf'
___V0:10007160 ; struct HKEY__ stru_10007160
___V0:10007160 stru_10007160        HKEY__ <74666F53h>           ; DATA XREF: sub_10003C33+2B o
___V0:10007164                      db       77h ; w
___V0:10007165                      db       61h ; a
___V0:10007166                      db       72h ; r
___V0:10007167                      db       65h ; e
___V0:10007168                      db       5Ch ; \
___V0:10007169                      db       4Dh ; M
___V0:1000716A                      db       69h ; i
___V0:1000716B                      db       63h ; c
___V0:1000716C                      db       72h ; r
___V0:1000716D                      db       6Fh ; o
___V0:1000716E                      db       73h ; s
___V0:1000716F                      db       6Fh ; o
___V0:10007170                      db       66h ; f
___V0:10007171                      db       74h ; t
___V0:10007172                      db       5Ch ; \
___V0:10007173                      db       77h ; w
___V0:10007174                      db       69h ; i
___V0:10007175                      db       6Eh ; n
___V0:10007176                      db       64h ; d
___V0:10007177                      db       6Fh ; o
___V0:10007178                      db       77h ; w
___V0:10007179                      db       73h ; s
___V0:1000717A                      db       5Ch ; \
___V0:1000717B                      db       43h ; C
___V0:1000717C                      db       75h ; u
___V0:1000717D                      db       72h ; r
___V0:1000717E                      db       72h ; r
___V0:1000717F                      db       65h ; e
___V0:10007180                      db       6Eh ; n
___V0:10007181                      db       74h ; t
___V0:10007182                      db       56h ; V
___V0:10007183                      db       65h ; e
___V0:10007184                      db       72h ; r
___V0:10007185                      db       73h ; s
___V0:10007186                      db       69h ; i
___V0:10007187                      db       6Fh ; o
___V0:10007188                      db       6Eh ; n
___V0:10007189                      db       5Ch ; \
___V0:1000718A                      db       65h ; e
___V0:1000718B                      db       78h ; x
___V0:1000718C                      db       70h ; p
___V0:1000718D                      db       6Ch ; l
___V0:1000718E                      db       6Fh ; o
___V0:1000718F                      db       72h ; r
___V0:10007190                      db       65h ; e
___V0:10007191                      db       72h ; r
___V0:10007192                      db       5Ch ; \
___V0:10007193                      db       41h ; A
___V0:10007194                      db       64h ; d
___V0:10007195                      db       76h ; v
___V0:10007196                      db       61h ; a
___V0:10007197                      db       6Eh ; n
___V0:10007198                      db       63h ; c
___V0:10007199                      db       65h ; e
___V0:1000719A                      db       64h ; d
___V0:1000719B                      db       5Ch ; \
___V0:1000719C                      db       46h ; F
___V0:1000719D                      db       6Fh ; o
___V0:1000719E                      db       6Ch ; l                                              //强制隐藏!
___V0:1000719F                      db       64h ; d
___V0:100071A0                      db       65h ; e
___V0:100071A1                      db       72h ; r
___V0:100071A2                      db       5Ch ; \
___V0:100071A3                      db       48h ; H
___V0:100071A4                      db       69h ; i
___V0:100071A5                      db       64h ; d
___V0:100071A6                      db       64h ; d
___V0:100071A7                      db       65h ; e
___V0:100071A8                      db       6Eh ; n
___V0:100071A9                      db       5Ch ; \
___V0:100071AA                      db       53h ; S
___V0:100071AB                      db       48h ; H
___V0:100071AC                      db       4Fh ; O
___V0:100071AD                      db       57h ; W
___V0:100071AE                      db       41h ; A
___V0:100071AF                      db       4Ch ; L
___V0:100071B0                      db       4Ch ; L
___V0:100071B1                      db         0
___V0:100071B4 ; char s_Checkedvalue[]
___V0:100071B4 s_Checkedvalue       db 'CheckedValue',0          ; DATA XREF: sub_10003C33+26 o
___V0:100071C4 s_Autorun            db 'AutoRun',0               ; DATA XREF: sub_10003C33+1F o


类别：西毒 | 添加到搜藏 | 浏览() | 评论 (13)
 
最近读者：
 
网友评论：
1
2007年06月30日 星期六 22:06 | 回复
214 s_R db 'r',0 ; DATA XREF: sub_10003E5A+D8 o ___V0:10007216 align 4 ___V0:10007218 s_Alexa_daf db '\alexa.daf',0 ; DATA XREF: sub_10003E5A+9F o //生成alexa.daf'没联网不知道,因该是下载的 ___V0:10007223 align 4 ___V0:10007224 s_Msf3sf_sys db '\Msf3sf.sys',0 ; DATA XREF: sub_10003E5A+91 o //生成Msf3sf.sys'没联网不知道,因该是下载的 ___V0:10007224 ; sub_100041BF+93 o ___V0:10007230 s_HttpData_alex db 'http://data.alexa.com/data?cli=10&dat=snba&ver=7.2&cdt=alx_vw%3D20%26wid%3D4830%26act%3D20' ___V0:10007230 ; DATA XREF: sub_10003E5A+60 o ___V0:10007230 db '040000000%26ss%3D1024x768%26bw%3D775%26t%3D0%26amznid%3Dchinawebmas0b-20%26ttl%3D0%26stc%3' ___V0:10007230 db 'D%26vis%3D1%26rq%3D0&stc&url=http://www.sina.com.cn/',0 ___V0:10007319 align 4
 
2
2007年06月30日 星期六 22:06 | 回复
___V0:1000731C s_D9adyz93472kb db 'd9adyz93472kb63z521t6e80wqpi56znb16fya6im3dr3xwed9adyz93472kb63z521t6e80wqpi56znb16fya6im3' ___V0:1000731C ; DATA XREF: sub_10003FF4+39 o ___V0:1000731C db 'dr3xwed9adyz93472kb63z521t6e80wqpi56znb16fya6im3dr3xwe',0 ___V0:100073AD align 10h ___V0:100073B0 ; unsigned __int8 s__com ___V0:100073B0 s__com db '.com',0 ; DATA XREF: sub_10004113+7D o
 
3
2007年06月30日 星期六 22:08 | 回复
杀这个毒很简单,先找服务项找到对应的7位文件名,在安全模式下删除启动项和SYSTEM32下的对应的2个7位文件一个EXE一个DLL,在在每个盘下删除AUTO.EXE和autorun.inf' 完成!
 
4
2007年07月01日 星期日 03:14 | 回复
错了,不是七位...是八位....你自己数数..
 
5
2007年07月01日 星期日 10:28 | 回复
不好意思,最近太累了,眼神不好,改正,谢谢啊达 该毒脱壳后竟然免杀,哎.无语 该毒8位随机是根据自己机子的不同算出来的,就和某些软件注册时算出的机器码一样!
 
6
2007年07月01日 星期日 16:58 | 回复
来了,留个脚印
 
7
2007年07月02日 星期一 20:19 | 回复
那个是个下载器,JM好像有个,没去看 每次下的木马好像都不同
 
8
2007年07月04日 星期三 15:33 | 回复
虽然看不懂那些东西,可是这个毒现在看来确实好杀的不得了,如果不能确定是哪些文件是问题项,可是先还原,然后不要双击别的盘符,把每个盘根目录下的AUTO.EXE和autorun.inf删除也行嘿嘿,病毒呀,来的更猛烈些吧,没有你世界少了很多的乐趣
 
9
2007年09月02日 星期日 18:15 | 回复
auto.exe 我中的是21大+autorun.inf 。。。 不知道是什么东西。。
 
10
2007年09月02日 星期日 20:59 | 回复
请把你的auto.exe发给我分析一下谢谢~~ 我的QQ:48993263 EMAIL: comeup-123@163.com
 
11
2007年09月07日 星期五 22:52 | 回复
rencai a
 
12
2007年09月16日 星期日 22:20 | 回复
转了收藏。我那有这个病毒的标本（前天抓的，应该还很新鲜，哈）：http://hi.baidu.com/sunsee/blog/item/bebe6034d59b294d241f1451.html
 
13
2007年12月08日 星期六 21:39 | 回复
真牛
 
发表评论：
姓　名：
网址或邮箱： (选填)
内　容：
验证码： 请点击后输入四位验证码，字母不区分大小写
      

     

©2009 Baidu