Bootkit.Pitou (19.04.06)

显示全部楼层 · 发表于 2019-4-9 12:26:25

wizebright kill all

显示全部楼层 · 发表于 2019-4-10 11:20:28

，就一个. 发表于 2019-4-8 16:38
我勾选强力模式了的天天万双击的人这点肯定清除但是扫一次我这里没清除掉，而你那边你说你扫了两次， ...

看了下，这个木马是在R3通过往磁盘发送IOCTL_SCSI_PASS_THROUGH，也就是10多年前机器狗采用穿还原的方法来写磁盘的，现在所有的杀软应该都有防御了。还原的我只研究过SHADOW DEFEND这个有防御。所以应该没影响。被穿的还原，可能是太烂了，不建议使用。
01 9ce6f7a0 890abe28 86ebe538 00000101 8502b9d8 nt!IofCallDriver+0x63
02 9ce6f7f8 890a7309 84f5f790 86ebe538 00000000 storport!PortPassThroughSendAsync+0x15f (FPO: [Non-Fpo])
03 9ce6f828 89074eff 8502b9d8 86000000 00000000 storport!RaidAdapterPassThrough+0x6c (FPO: [Non-Fpo])
04 9ce6f83c 890a7480 8502b9d8 86ebe538 86ebe538 storport!RaidAdapterScsiPassThroughIoctl+0x12 (FPO: [Non-Fpo])
05 9ce6f858 890a7cd9 8502b9d8 0004d004 8502b9d8 storport!RaidAdapterDeviceControlIrp+0xaa (FPO: [Non-Fpo])
06 9ce6f874 82482593 8502b920 86ebe538 86ebe538 storport!RaDriverDeviceControlIrp+0x69 (FPO: [Non-Fpo])
07 9ce6f88c 8907ec92 00000000 86ebe538 9ce6f8b8 nt!IofCallDriver+0x63
08 9ce6f89c 890a9d3e 84f5f848 86ebe538 89085000 storport!RaUnitScsiPassThroughIoctl+0x4a (FPO: [Non-Fpo])
09 9ce6f8b8 890a7cd0 84f5f848 0004d004 86ebe60c storport!RaUnitDeviceControlIrp+0xe9 (FPO: [Non-Fpo])
0a 9ce6f8d4 82482593 84f5f790 86ebe538 86ebe630 storport!RaDriverDeviceControlIrp+0x60 (FPO: [Non-Fpo])
0b 9ce6f8ec 89657c5c fffdcc01 86ebe538 857c52e8 nt!IofCallDriver+0x63
0c 9ce6f970 89641d0a 857c52e8 86ebe538 86ebe538 CLASSPNP!ClassDeviceControl+0xcb2 (FPO: [Non-Fpo])
0d 9ce6f98c 89656e38 857c52e8 0004d004 00000000 disk!DiskDeviceControl+0x1ac (FPO: [Non-Fpo])
0e 9ce6f9a8 896553bf 857c52e8 86ebe538 857c52e8 CLASSPNP!ClassDeviceControlDispatch+0x48 (FPO: [Non-Fpo])
0f 9ce6f9bc 82482593 857c52e8 86ebe538 00000000 CLASSPNP!ClassGlobalDispatch+0x20 (FPO: [Non-Fpo])
10 9ce6f9d4 88f1b44c 857cc020 86ebe538 00000000 nt!IofCallDriver+0x63
11 9ce6fa0c 88f148c8 017cc020 86ebe538 86ebe638 partmgr!PmIoctlRedirect+0x13d (FPO: [Non-Fpo])
12 9ce6fa2c 88f14152 00000000 857cc110 857cc020 partmgr!PmFilterDeviceControl+0x260 (FPO: [Non-Fpo])
13 9ce6fa40 82482593 857cc020 86ebe538 86ebe65c partmgr!PmGlobalDispatch+0x1d (FPO: [Non-Fpo])
14 9ce6fa58 825e6b35 85072cd8 85072c20 86ebe538 nt!IofCallDriver+0x63
15 9ce6fa70 825e61ef 85072cd8 86ebe538 323d25f6 nt!RawReadWriteDeviceControl+0x14b
16 9ce6fab8 82482593 85072c20 86ebe538 86ebe538 nt!RawDispatch+0x20a
17 9ce6fad0 82bc53e8 850576d0 00000000 850084a8 nt!IofCallDriver+0x63
18 9ce6fafc 82482593 850576d0 86ebe538 86ebe538 FLTMGR!FltpDispatch+0xe2 (FPO: [Non-Fpo])
19 9ce6fb14 8267699f 850084a8 86ebe538 86ebe638 nt!IofCallDriver+0x63
1a 9ce6fb34 82679b71 850576d0 850084a8 00000000 nt!IopSynchronousServiceTail+0x1f8
1b 9ce6fbd0 826c03f4 850576d0 86ebe538 00000000 nt!IopXxxControlFile+0x6aa
1c 9ce6fc04 824891ea 000000a0 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
1d 9ce6fc04 773470b4 000000a0 00000000 00000000 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 9ce6fc34)
1e 0012f518 77345864 756d989d 000000a0 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
1f 0012f51c 756d989d 000000a0 00000000 00000000 ntdll!ZwDeviceIoControlFile+0xc (FPO: [10,0,0])
20 0012f57c 75fda671 000000a0 0004d004 0012f5e0 KernelBase!DeviceIoControl+0xf6 (FPO: [Non-Fpo])
21 0012f5a8 00408e65 000000a0 0004d004 0012f5e0 kernel32!DeviceIoControlImplementation+0x80 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
22 0012f9e8 00408580 0000008e 00000000 012f3d2c nt_400000+0x8e65
23 0012f9fc 00402b65 0000008e 00000000 012f3d2c nt_400000+0x8580
24 0012fa14 0040bf86 00000080 00000000 012f212c nt_400000+0x2b65
25 0012fa4c 00402683 5c2e5c5c 53594850 4c414349 nt_400000+0xbf86
26 0012fb68 00401335 7ffd4000 0012ff5c 00406a2a nt_400000+0x2683
27 0012fb74 00406a2a 03020100 07060504 0b0a0908 nt_400000+0x1335
28 0012ff5c 0040b3ea 0012ff70 0040b511 00400000 nt_400000+0x6a2a
29 0012ff64 0040b511 00400000 0012ff88 00404d21 nt_400000+0xb3ea
2a 0012ff70 00404d21 00000000 0040b4d1 0040b4d1 nt_400000+0xb511
2b 0012ff88 75fe3c45 7ffd4000 0012ffd4 773637f5 nt_400000+0x4d21
2c 0012ff94 773637f5 7ffd4000 773f42e3 00000000 kernel32!BaseThreadInitThunk+0xe (FPO: [Non-Fpo])
2d 0012ffd4 773637c8 00404c4f 7ffd4000 00000000 ntdll!__RtlUserThreadStart+0x70 (FPO: [Non-Fpo])
2e 0012ffec 00000000 00404c4f 7ffd4000 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])

[病毒样本] Bootkit.Pitou (19.04.06)