点饭的百度空间
银牌会员
积分 2315
发帖 2236
注册 2007-11-30
|
#1 Tlbs病毒(二) glok+5b61-57f7.sys微点重启完全清除
平不孤独
引用:
00407313 56 push esi
00407314 8BF1 mov esi,ecx
00407316 E8 63FEFFFF call Packed_W.0040717E
0040731B 8BCE mov ecx,esi
0040731D E8 68FFFFFF call Packed_W.0040728A
00407322 8BCE mov ecx,esi
00407324 E8 71FEFFFF call Packed_W.0040719A //跟进去
00407329 8BCE mov ecx,esi
0040732B E8 D3FEFFFF call Packed_W.00407203
00407330 8B46 04 mov eax,dword ptr ds:[esi+4]
00407333 8B40 28 mov eax,dword ptr ds:[eax+28]
00407336 0306 add eax,dword ptr ds:[esi]
00407338 5E pop esi
00407339 C3 retn
引用:
004071BA 55 push ebp
004071BB 56 push esi
004071BC 8B03 mov eax,dword ptr ds:[ebx]
004071BE 0307 add eax,dword ptr ds:[edi]
004071C0 50 push eax
004071C1 E8 D5040000 call Packed_W.0040769B //辗转周折实现LoadLibrary
004071C6 8B73 04 mov esi,dword ptr ds:[ebx+4]
004071C9 0337 add esi,dword ptr ds:[edi]
004071CB 8BE8 mov ebp,eax
004071CD EB 22 jmp short Packed_W.004071F1
004071CF 8B0E mov ecx,dword ptr ds:[esi]
004071D1 85C9 test ecx,ecx
004071D3 79 09 jns short Packed_W.004071DE
004071D5 81E1 FFFF0000 and ecx,0FFFF
004071DB 51 push ecx
004071DC EB 08 jmp short Packed_W.004071E6
004071DE 8B07 mov eax,dword ptr ds:[edi]
004071E0 03C1 add eax,ecx
004071E2 83C0 02 add eax,2
004071E5 50 push eax
004071E6 55 push ebp
004071E7 E8 A3040000 call Packed_W.0040768F //辗转周折实现GetProcAddress解密导入表
004071EC 8906 mov dword ptr ds:[esi],eax
004071EE 83C6 04 add esi,4
004071F1 833E 00 cmp dword ptr ds:[esi],0
004071F4 ^ 75 D9 jnz short Packed_W.004071CF
004071F6 83C3 14 add ebx,14
004071F9 833B 00 cmp dword ptr ds:[ebx],0
004071FC ^ 75 BE jnz short Packed_W.004071BC
004071FE 5E pop esi
004071FF 5D pop ebp
00407200 5B pop ebx //解密完成后跳到此
00407201 5F pop edi
00407202 C3
retnretn后再次执行到返回，
引用:
00407085 E8 B0020000 call Packed_W.0040733A
0040708A 8D4D EC lea ecx,dword ptr ss:[ebp-14]
0040708D E8 81020000 call Packed_W.00407313
00407092 FFD0 call eax //跟进去就是OEP
00407094 8D4D EC lea ecx,dword ptr ss:[ebp-14]
00407097 8BF0 mov esi,eax
释放驱动glok+5b61-57f7.sys，给service安装apc，这种RK微点是可以拦截的，不错记得以前蓝屏过。。。。StartService后
重启完全清除。。。
| |
※ ※ ※ 本文纯属【点饭的百度空间】个人意见，与【 微点交流论坛 】立场无关※ ※ ※
|
你的微笑 is 微点的骄傲！
http://hi.baidu.com/new/micropoint |
|
|
