本帖最后由 linyinlu 于 2014-9-28 13:00 编辑
我BDTS2015勇敢实机双击了
管理员运行以后，静默安装一堆东西，什么9733，FM，百度杀毒，hao123主页等等一应俱全，但是安装的这些东西都提供了卸载程序，还算不错
安装以后，自身会产生一个uninstall.exe文件，而这个文件其实就是下载器本身，所以只是同一个文件改个名字而已
这个下载器最牛掰的地方在于，运行以后，它自动关闭AVC及IDS，而且无法启用
虽然在删除以后没有在系统的其他地方发现残留，不过AVC和IDS还是无法启用，正在全盘扫描中。实在不行，只有重装系统了
源代码可以被反编译，不过目前只能看到一堆汇编：
[mw_shl_code=python,true]start proc
403121 SUB ESP,00000180
403127 PUSH EBX
403128 PUSH EBP
403129 PUSH ESI
40312a XOR EBX,EBX
40312c PUSH EDI
40312d MOV [ESP+18],EBX
403131 MOV DWORD PTR [ESP+10],0040915C
403139 XOR ESI,ESI
40313b MOV BYTE PTR [ESP+14],20
403140 CALL [00407030]
403146 PUSH 00008001
40314b CALL [004070B0]
403151 PUSH EBX
403152 CALL [0040727C]
403158 PUSH +08
40315a MOV [00003F18],EAX
40315f CALL sub_405e06
403164 MOV [00003E64],EAX
403169 PUSH EBX
40316a LEA EAX,[ESP+34]
40316e PUSH 00000160
403173 PUSH EAX
403174 PUSH EBX
403175 PUSH 0041F424
40317a CALL [00407158]
403180 PUSH 00409150
403185 PUSH 00423660
40318a CALL sub_405aba
40318f CALL [004070AC]
403195 MOV EDI,00429000
40319a PUSH EAX
40319b PUSH EDI
40319c CALL sub_405aba
4031a1 PUSH EBX
4031a2 CALL [0040710C]
4031a8 CMP BYTE PTR [00429000],22
4031af MOV [00003E60],EAX
4031b4 MOV EAX,EDI
4031b6 JNZ 004031C2
4031b8 MOV BYTE PTR [ESP+14],22
4031bd MOV EAX,00429001
4031c2 PUSH DWORD PTR [ESP+14]
4031c6 PUSH EAX
4031c7 CALL sub_4055ce
4031cc PUSH EAX
4031cd CALL [0040721C]
4031d3 MOV [ESP+1C],EAX
4031d7 MOV CL,[EAX]
4031d9 CMP CL,BL
4031db JZ 00403253
4031dd CMP CL,20
4031e0 JNZ 004031E8
4031e2 INC EAX
4031e3 CMP BYTE PTR [EAX],20
4031e6 JZ 004031E2
4031e8 CMP BYTE PTR [EAX],22
4031eb MOV BYTE PTR [ESP+14],20
4031f0 JNZ 004031F8
4031f2 INC EAX
4031f3 MOV BYTE PTR [ESP+14],22
4031f8 CMP BYTE PTR [EAX],2F
4031fb JNZ 00403230
4031fd INC EAX
4031fe CMP BYTE PTR [EAX],53
403201 JNZ 00403211
403203 MOV CL,[EAX+01]
403206 OR CL,20
403209 CMP CL,20
40320c JNZ 00403211
40320e OR ESI,+02
403211 CMP DWORD PTR [EAX],4352434E
403217 JNZ 00403227
403219 MOV CL,[EAX+04]
40321c OR CL,20
40321f CMP CL,20
403222 JNZ 00403227
403224 OR ESI,+04
403227 CMP DWORD PTR [EAX-02],3D442F20
40322e JZ 00403242
403230 PUSH DWORD PTR [ESP+14]
403234 PUSH EAX
403235 CALL sub_4055ce
40323a CMP BYTE PTR [EAX],22
40323d JNZ 004031D7
40323f INC EAX
403240 JMP 004031D7
403242 MOV [EAX-02],EBX
403245 ADD EAX,+02
403248 PUSH EAX
403249 PUSH 00429400
40324e CALL sub_405aba
403253 MOV EBP,0042A400
403258 PUSH EBP
403259 PUSH 00000400
40325e CALL [00407148]
403264 CALL sub_4030ed
403269 TEST EAX,EAX
40326b JNZ 0040328D
40326d PUSH 000003FB
403272 PUSH EBP
403273 CALL [004070A4]
403279 PUSH 00409148
40327e PUSH EBP
40327f CALL sub_405add
403284 CALL sub_4030ed
403289 TEST EAX,EAX
40328b JZ 0040330B
40328d PUSH 0042A000
403292 CALL [00407144]
403298 PUSH ESI
403299 CALL sub_402c74
40329e CMP EAX,EBX
4032a0 MOV [ESP+10],EAX
4032a4 JNZ 0040330B
4032a6 CMP [00423E7C],EBX
4032ac JZ 004032FB
4032ae PUSH EBX
4032af PUSH EDI
4032b0 CALL sub_4055ce
4032b5 MOV ESI,EAX
4032b7 CMP ESI,EDI
4032b9 JB 004032C6
4032bb CMP DWORD PTR [ESI],3D3F5F20
4032c1 JZ 004032C6
4032c3 DEC ESI
4032c4 JMP 004032B7
4032c6 CMP ESI,EDI
4032c8 MOV DWORD PTR [ESP+10],00409100
4032d0 JB 00403336
4032d2 MOV [ESI],BL
4032d4 ADD ESI,+04
4032d7 PUSH ESI
4032d8 CALL sub_405686
4032dd TEST EAX,EAX
4032df JZ 0040330B
4032e1 PUSH ESI
4032e2 PUSH 00429400
4032e7 CALL sub_405aba
4032ec PUSH ESI
4032ed PUSH 00429800
4032f2 CALL sub_405aba
4032f7 MOV [ESP+10],EBX
4032fb OR DWORD PTR [00423F0C],-01
403302 CALL sub_40357e
403307 MOV [ESP+18],EAX
40330b CALL sub_4034a0
403310 CALL [00407280]
403316 CMP [ESP+10],EBX
40331a JZ 00403405
403320 PUSH 00200010
403325 PUSH DWORD PTR [ESP+14]
403329 CALL sub_40535f
40332e PUSH +02
403330 CALL [004070A0]
403336 PUSH 0040913C
40333b PUSH EBP
40333c CALL sub_405add
403341 MOV ESI,00429C00
403346 PUSH ESI
403347 PUSH EBP
403348 CALL [004070F0]
40334e TEST EAX,EAX
403350 JZ 0040330B
403352 PUSH EBX
403353 PUSH EBP
403354 CALL [00407080]
40335a PUSH EBP
40335b CALL [00407074]
403361 CMP [00429400],BL
403367 JNZ 00403374
403369 PUSH ESI
40336a PUSH 00429400
40336f CALL sub_405aba
403374 PUSH DWORD PTR [ESP+1C]
403378 PUSH 00424000
40337d CALL sub_405aba
403382 PUSH +1A
403384 MOV WORD PTR [00424400],0041
40338d POP EDI
40338e MOV ESI,0041F024
403393 MOV EAX,[00003E70]
403398 PUSH DWORD PTR [EAX+00000120]
40339e PUSH ESI
40339f CALL sub_405aee
4033a4 PUSH ESI
4033a5 CALL [00407144]
4033ab CMP [ESP+10],EBX
4033af JZ 004033F0
4033b1 PUSH +01
4033b3 PUSH ESI
4033b4 PUSH 0042AC00
4033b9 CALL [0040709C]
4033bf TEST EAX,EAX
4033c1 JZ 004033F0
4033c3 PUSH EBX
4033c4 PUSH ESI
4033c5 CALL sub_405807
4033ca MOV EAX,[00003E70]
4033cf PUSH DWORD PTR [EAX+00000124]
4033d5 PUSH ESI
4033d6 CALL sub_405aee
4033db PUSH ESI
4033dc CALL sub_4052ef
4033e1 CMP EAX,EBX
4033e3 JZ 004033F0
4033e5 PUSH EAX
4033e6 CALL [004070EC]
4033ec MOV [ESP+10],EBX
4033f0 INC BYTE PTR [00424400]
4033f6 DEC EDI
4033f7 JNZ 00403393
4033f9 PUSH EBX
4033fa PUSH EBP
4033fb CALL sub_405807
403400 JMP 0040330B
403405 CMP [00423EF4],EBX
40340b JZ 00403488
40340d PUSH +03
40340f CALL sub_405e06
403414 PUSH +04
403416 MOV EBP,EAX
403418 CALL sub_405e06
40341d PUSH +05
40341f MOV ESI,EAX
403421 CALL sub_405e06
403426 CMP EBP,EBX
403428 MOV EDI,EAX
40342a JZ 00403474
40342c CMP ESI,EBX
40342e JZ 00403474
403430 CMP EDI,EBX
403432 JZ 00403474
403434 LEA EAX,[ESP+1C]
403438 PUSH EAX
403439 PUSH +28
40343b CALL [00407098]
403441 PUSH EAX
403442 CALL EBP
403444 TEST EAX,EAX
403446 JZ 00403474
403448 LEA EAX,[ESP+24]
40344c PUSH EAX
40344d PUSH 00409128
403452 PUSH EBX
403453 CALL ESI
403455 PUSH EBX
403456 PUSH EBX
403457 LEA EAX,[ESP+28]
40345b PUSH EBX
40345c PUSH EAX
40345d PUSH EBX
40345e PUSH DWORD PTR [ESP+30]
403462 MOV DWORD PTR [ESP+38],00000001
40346a MOV DWORD PTR [ESP+44],00000002
403472 CALL EDI
403474 PUSH EBX
403475 PUSH +02
403477 CALL [00407224]
40347d TEST EAX,EAX
40347f JNZ 00403488
403481 PUSH +09
403483 CALL sub_401430
403488 MOV EAX,[00003F0C]
40348d CMP EAX,-01
403490 JZ 00403496
403492 MOV [ESP+18],EAX
403496 PUSH DWORD PTR [ESP+18]
40349a CALL [004070A0]
4034a0 MOV EAX,[00009014]
4034a5 CMP EAX,-01
4034a8 JZ 004034B8
4034aa PUSH EAX
4034ab CALL [004070EC]
4034b1 OR DWORD PTR [00409014],-01
4034b8 CALL sub_4034e5
4034bd PUSH +07
4034bf PUSH 0042A800
4034c4 CALL sub_4053d0
4034c9 RET
start endp[/mw_shl_code]
了解汇编语言的可以看下。对汇编我了解甚少 |
楼主: minjiaming
[复制链接]
发表于 2014-9-28 00:01:35
楼主