微点报毒（一个分割命令）

显示全部楼层 · 发表于 2008-3-11 22:04:38

卡巴、诺顿、NOD32等大厂都无报

抱歉，因是未知病毒，好像是发错去区

，请版主帮忙移去微点区

[ 本帖最后由 climbing 于 2008-3-11 22:49 编辑 ]

显示全部楼层 · 发表于 2008-3-11 22:16:05

紅傘等小廠也不報

显示全部楼层 · 发表于 2008-3-11 22:16:46

金山MISS

显示全部楼层 · 发表于 2008-3-11 22:43:16

没有报，只是未知病毒！

这也叫报毒？

显示全部楼层 · 发表于 2008-3-11 22:54:59

文本字符串参考位于 00AB0000..00B01FFF
地址    反汇编                                                    文本字符
00AB1009 imul ebp,dword ptr ds:[esi+67],0AB1058                   ASCII 07,"TObject"
00AB11D7 test byte ptr ss:[esp+2C],1                               (初始 CPU 选择)
00AB2ADC push 0AB2B5C                                              ASCII "SOFTWARE\Borland\Delphi\RTL"
00AB2B10 push 0AB2B78                                              ASCII "FPUMaskValue"
00AB3543 mov ebx,0AF0038                                           ASCII "  at 00000000"
00AB3606 mov edx,0AF0028                                           ASCII "Runtime error    at 00000000"
00AB3627 push 0AF0048                                              ASCII "Error"
00AB362C push 0AF0028                                              ASCII "Runtime error    at 00000000"
00AB4A59 push 0AB4BC8                                              ASCII "kernel32.dll"
00AB4A69 push 0AB4BD8                                              ASCII "GetLongPathNameA"
00AB4C1C push 0AB4DA8                                              ASCII "Software\Borland\Locales"
00AB4C3A push 0AB4DC4                                              ASCII "Software\Borland\Delphi\Locales"
00AB4ED4 cmp dword ptr ds:[ebx+4],10000                            UNICODE "=::=::\"
00AB5435 mov edx,0AF0060                                           ASCII 20,"                               "
00AB65B9 imul ebp,dword ptr ds:[edi+6E],0AB6608                   ASCII 0E,"EHeapException"
00AB70C0 mov edx,0AB70D8                                           ASCII "%d"
00AB70F1 mov edx,0AB710C                                           ASCII "%d"
00AB712B mov edx,0AB7144                                           ASCII "%.*x"
00AB716A mov edx,0AB7184                                           ASCII "%.*x"
00AB73E1 mov eax,0AB7408                                           ASCII "\:"
00AB74A9 mov eax,0AB74D4                                           ASCII "\:"
00AB843F mov edx,0AB8554                                           ASCII "gg"
00AB85AA mov edx,0AB864C                                           ASCII "yy"
00AB85B9 mov edx,0AB8658                                           ASCII "yyyy"
00AB89B9 mov edx,0AB8DB0                                           ASCII "AM/PM"
00AB89CE mov edx,0AB8DB8                                           ASCII "A/P"
00AB89E3 mov edx,0AB8DBC                                           ASCII "AMPM"
00AB8B25 mov edx,0AB8DB0                                           ASCII "AM/PM"
00AB8B62 mov edx,0AB8DB8                                           ASCII "A/P"
00AB8B9F mov edx,0AB8DBC                                           ASCII "AMPM"
00AB8BE8 mov edx,0AB8DC4                                           ASCII "AAAA"
00AB8C2C mov edx,0AB8DCC                                           ASCII "AAA"
00AB935C mov eax,0AB9460                                           ASCII "ddd"
00AB948C mov ecx,0AB9648                                           ASCII "AM"
00AB94B5 mov ecx,0AB9654                                           ASCII "PM"
00AB95A6 mov ecx,0AB9648                                           ASCII "AM"
00AB95CF mov ecx,0AB9654                                           ASCII "PM"
00AB9BE7 mov edx,0AB9CD0                                           ASCII "gg"
00AB9C00 mov edx,0AB9CDC                                           ASCII "ggg"
00AB9C0D mov edx,0AB9CE0                                           ASCII "yyyy"
00AB9C26 mov edx,0AB9CF0                                           ASCII "eeee"
00AB9C35 mov edx,0AB9CF8                                           ASCII "yy"
00AB9C4E mov edx,0AB9D04                                           ASCII "ee"
00ABAC91 mov ecx,0ABAE78                                           ASCII "m/d/yy"
00ABACBE mov ecx,0ABAE88                                           ASCII "mmmm d, yyyy"
00ABACFE mov ecx,0ABAEA0                                           ASCII "am"
00ABAD20 mov ecx,0ABAEAC                                           ASCII "pm"
00ABAD83 mov edx,0ABAEC4                                           ASCII "hh"
00ABADD6 mov edx,0ABAED0                                           ASCII " AMPM"
00ABADE5 mov edx,0ABAEE0                                           ASCII "AMPM "
00ABAE12 push 0ABAEFC                                              ASCII ":mm:ss"
00ABAF25 push 0ABAF5C                                              ASCII "kernel32.dll"
00ABAF35 push 0ABAF6C                                              ASCII "GetDiskFreeSpaceExA"
00ABBCA4 mov edx,0ABBCE4                                           ASCII "0x"
00ABC2AC mov eax,0ABC2B2                                           ASCII "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/= $()[]{},;:-_\*"'
"
00ABC360 push 0ABC3D8                                              ASCII "
"
00ABCCE4 mov ecx,0ABCDE8                                           ASCII "\pagefile.sys"
00ABCD04 mov ecx,0ABCE00                                           ASCII "\win386.swp"
00ABD328 mov edx,0ABD384                                           ASCII "Software\ASProtect\SpecData"
00ABD489 mov edx,0ABD4D4                                           ASCII "Software\ASProtect\SpecData"
00ABD8B7 mov edx,0ABD998                                           ASCII "TypeLib"
00ABD8E2 mov edx,0ABD998                                           ASCII "TypeLib"
00ABD8FA mov edx,0ABD9A8                                           ASCII "TypeLib\"
00ABD91E mov edx,0ABD9A8                                           ASCII "TypeLib\"
00ABD943 mov edx,0ABD9A8                                           ASCII "TypeLib\"
00ABD9DB mov edx,0ABDA38                                           ASCII "TypeLib"
00ABDA6C mov edx,0ABDADC                                           ASCII "CLSID\"
00ABDB07 mov edx,0ABDB48                                           ASCII "TypeLib"
00ABDB78 mov edx,0ABDBE4                                           ASCII "CLSID\"
00ABDC03 mov edx,0ABDC70                                           ASCII "CLSID"
00ABDC46 mov edx,0ABDC70                                           ASCII "CLSID"
00ABDC59 mov edx,0ABDC80                                           ASCII "CLSID\"
00ABDCCA mov edx,0ABDD00                                           ASCII "CLSID\"
00ABDE0C mov edx,0ABDEFC                                           ASCII "TypeLib"
00ABE4F4 mov edx,0ABE570                                           ASCII "CLSID\"
00ABE5B7 mov edx,0ABE680                                           ASCII "TypeLib"
00ABE6E0 mov edx,0ABE718                                           ASCII "CLSID"
00AC4EBB push 0AC5148                                              ASCII "\\.\Scsi"
00AC4F22 mov eax,0AC5168                                           ASCII "SCSIDISK"
00AC4FF9 push 0AC5174                                              ASCII "\\.\SMARTVSD"
00AC528A mov edx,0AC52D8                                           ASCII "\\.\"
00AC53CB mov edx,0AC542C                                           ASCII "PhysicalDrive0"
00AC53DA mov edx,0AC5444                                           ASCII "C:"
00AC58A9 mov edx,0AC58F8                                           ASCII "Error: "
00AC58BC push 0AC5900                                              ASCII "Protection Error"
00AC5936 push 0AC5964                                              ASCII "Error"
00AC5BAA push 0AC5BF0                                              ASCII "120
"
00AC5C1E push 0AC5C64                                              ASCII "121
"
00AC92CC mov ecx,0AC92EC                                           ASCII "Bits index out of range"
00AC9555 mov ecx,0AC95A0                                           ASCII "TMPPool.Cache: Invalid pointer"
00AC97E9 mov ecx,0AC9828                                           ASCII "TMPPool.Obtain: Out of memory"
00ACA1F8 mov ecx,0ACA7B4                                           ASCII "Division by zero in LargeDiv."
00ACABF5 mov ecx,0ACACD0                                           ASCII "Base256ToMPInt: Length of Str exceeds MaxBitSize"
00ACB33B mov edx,0ACB3F0                                           ASCII "ABCDEFGHJKLMNPQRSTUVWXYZ23456789- "
00ACB473 mov edx,0ACB524                                           ASCII "ABCDEFGHJKLMNPQRSTUVWXYZ23456789- "
00ACBBFC push 0ACBD68                                              ASCII "netapi32.dll"
00ACBC17 push 0ACBD68                                              ASCII "netapi32.dll"
00ACBC32 push 0ACBD78                                              ASCII "Netbios"
00ACBDF4 push 0ACBF30                                              ASCII "Rpcrt4.dll"
00ACBE0F push 0ACBF30                                              ASCII "Rpcrt4.dll"
00ACBE33 mov ebx,0ACBF3C                                           ASCII "UuidCreateSequential"
00ACBE3A mov ebx,0ACBF54                                           ASCII "UuidCreate"
00ACBFC9 push 0ACC138                                              ASCII "Iphlpapi.dll"
00ACBFE4 push 0ACC138                                              ASCII "Iphlpapi.dll"
00ACBFFF push 0ACC148                                              ASCII "GetAdaptersInfo"
00ACC0A0 mov eax,0ACC16C                                           ASCII "VPN"
00ACC58C mov ecx,0ACC5AC                                           ASCII "ProductId"
00ACC591 mov edx,0ACC5C0                                           ASCII "Software\Microsoft\Windows\CurrentVersion"
00ACC5F0 mov ecx,0ACC610                                           ASCII "ProductID"
00ACC5F5 mov edx,0ACC624                                           ASCII "Software\Microsoft\Windows\CurrentVersion"
00ACC8B0 mov ecx,0ACC8D0                                           ASCII "Identifier"
00ACC8B5 mov edx,0ACC8E4                                           ASCII "Hardware\Description\System\CentralProcessor\0"
00ACCA59 mov ecx,0ACCB98                                           ASCII "Identifier"
00ACCA5E mov edx,0ACCBAC                                           ASCII "HARDWARE\DESCRIPTION\System"
00ACCA71 mov edx,0ACCBAC                                           ASCII "HARDWARE\DESCRIPTION\System"
00ACCA76 mov ecx,0ACCBD0                                           ASCII "SystemBiosDate"
00ACCAD6 mov ecx,0ACCBE8                                           ASCII "BIOSDate"
00ACCADB mov edx,0ACCBFC                                           ASCII "Enum\Root\*PNP0C01\0000"
00ACCAEE mov ecx,0ACCC1C                                           ASCII "BIOSName"
00ACCAF3 mov edx,0ACCBFC                                           ASCII "Enum\Root\*PNP0C01\0000"
00ACCB06 mov ecx,0ACCC30                                           ASCII "BIOSVersion"
00ACCB0B mov edx,0ACCBFC                                           ASCII "Enum\Root\*PNP0C01\0000"
00ACCC82 mov ecx,0ACCD3C                                           ASCII "\System\Iosubsys\Smartvsd.vxd"
00ACCCB5 mov ecx,0ACCD64                                           ASCII "\System\Smartvsd.vxd"
00ACE2ED mov ecx,0ACE3AC                                           ASCII "\System\SER.VXD"
00ACE6F0 add eax,10000                                           UNICODE "=::=::\"
00ACF1BF mov ecx,0ACF240                                           ASCII "ProductType"
00ACF1C4 mov edx,0ACF254                                           ASCII "System\CurrentControlSet\Control\ProductOptions"
00ACF1D3 mov edx,0ACF28C                                           ASCII "WINNT"
00ACF1E8 mov edx,0ACF29C                                           ASCII "SERVERNT"
00ACF1FD mov edx,0ACF2B0                                           ASCII "LANMANNT"
00ACF49F mov edx,0ACF508                                           ASCII "Server"
00ACF4AD mov edx,0ACF518                                           ASCII "Advanced Server"
00ACF4BB mov edx,0ACF530                                           ASCII "Home Edition"
00ACF4C9 mov edx,0ACF548                                           ASCII "Professional"
00ACF4D7 mov edx,0ACF560                                           ASCII "Datacenter Server"
00ACF5DC mov ecx,0ACF648                                           ASCII "CSDVersion"
00ACF5E1 mov edx,0ACF65C                                           ASCII "\SYSTEM\CurrentControlSet\Control\Windows\"
00ACF6B9 mov edx,0ACF6F8                                           ASCII "SP"
00ACFBE4 mov esi,0ACFFA4                                           ASCII "Intel 486SX Processor"
00ACFBF8 mov esi,0ACFFD4                                           ASCII "Intel DX2 Processor"
00ACFC0C mov esi,0AD0004                                           ASCII "Intel 486 Processor"
00ACFC20 mov esi,0AD0034                                           ASCII "Intel SX2 Processor"
00ACFC34 mov esi,0AD0064                                           ASCII "Write-Back Enhanced Intel DX2 Processor"
00ACFC48 mov esi,0AD0094                                           ASCII "Intel DX4 Processor"
00ACFC5C mov esi,0AD0004                                           ASCII "Intel 486 Processor"
00ACFC70 mov esi,0AD00C4                                           ASCII "Pentium"
00ACFCDD mov esi,0AD0124                                           ASCII "Pentium II"
00ACFD09 mov esi,0AD0154                                           ASCII "Celeron"
00ACFD1D mov esi,0AD0184                                           ASCII "Pentium II Xeon"
00ACFD31 mov esi,0AD0184                                           ASCII "Pentium II Xeon"
00ACFD45 mov esi,0AD0124                                           ASCII "Pentium II"
00ACFD68 mov esi,0AD0154                                           ASCII "Celeron"
00ACFD7C mov esi,0AD0154                                           ASCII "Celeron"
00ACFD90 mov esi,0AD0124                                           ASCII "Pentium II"
00ACFDB7 mov esi,0AD01B4                                           ASCII "Pentium III Xeon"
00ACFDCB mov esi,0AD01B4                                           ASCII "Pentium III Xeon"
00ACFDDF mov esi,0AD01E4                                           ASCII "Pentium III"
00ACFE08 mov esi,0AD0154                                           ASCII "Celeron"
00ACFE1C mov esi,0AD01E4                                           ASCII "Pentium III"
00ACFE30 mov esi,0AD01B4                                           ASCII "Pentium III Xeon"
00ACFE44 mov esi,0AD01E4                                           ASCII "Pentium III"
00ACFE58 mov esi,0AD01E4                                           ASCII "Pentium III"
00ACFE6C mov esi,0AD01B4                                           ASCII "Pentium III Xeon"
00ACFE80 mov esi,0AD01E4                                           ASCII "Pentium III"
00ACFEA6 mov eax,0AD021C                                           ASCII "P6 (Model %d)"
00ACFED1 mov esi,0AD0154                                           ASCII "Celeron"
00ACFEE2 mov esi,0AD022C                                           ASCII "Pentium 4"
00ACFEF3 mov esi,0AD025C                                           ASCII "Xeon"
00ACFF04 mov esi,0AD022C                                           ASCII "Pentium 4"
00AD02F7 mov esi,0AD03A0                                           ASCII "Cyrix MediaGX"
00AD0315 mov esi,0AD03D0                                           ASCII "Cyrix 6x86"
00AD0326 mov esi,0AD0400                                           ASCII "Cyrix GXm"
00AD0337 mov esi,0AD0430                                           ASCII "6x86MX"
00AD0359 mov eax,0AD0468                                           ASCII "%dx86"
00AD04B1 mov esi,0AD05BC                                           ASCII "Am486(R) or Am5x86"
00AD0516 mov esi,0AD061C                                           ASCII "AMD-K5 (Model 1)"
00AD052A mov esi,0AD064C                                           ASCII "AMD-K5 (Model 2)"
00AD053B mov esi,0AD067C                                           ASCII "AMD-K5 (Model 3)"
00AD054C mov esi,0AD06AC                                           ASCII "AMD-K6(R)"
00AD055D mov esi,0AD06DC                                           ASCII "AMD-K6"
00AD056E mov esi,0AD070C                                           ASCII "AMD-K6(R) -2"
00AD057F mov esi,0AD073C                                           ASCII "AMD-K6(R) -3"
00AD0590 mov esi,0AD076C                                           ASCII "Unknown AMD Model"
00AD05A1 mov esi,0AD079C                                           ASCII "Unknown AMD Chip"
00AD07F2 mov esi,0AD0810                                           ASCII "Crusoe"
00AD0C58 mov edx,0AD0D7C                                           ASCII "GenuineIntel"
00AD0C8D mov edx,0AD0D94                                           ASCII "CyrixInstead"
00AD0CC2 mov edx,0AD0DAC                                           ASCII "AuthenticAMD"
00AD0CF4 mov edx,0AD0DC4                                           ASCII "GenuineTMx86"
00AD0D2A mov esi,0AD0DE0                                           ASCII "Unknown"
00AD0E68 push 0AD0F84                                              ASCII "kernel32.dll"
00AD134C push 0AD1368                                              ASCII "\VarFileInfo\Translation"
00AD1477 push 0AD1510                                              ASCII "\StringFileInfo\"
00AD1538 mov edx,0AD1550                                           ASCII "Comments"
00AD1564 mov edx,0AD157C                                           ASCII "CompanyName"
00AD1590 mov edx,0AD15A8                                           ASCII "FileDescription"
00AD15C3 mov edx,0AD15FC                                           ASCII "FileVersion"
00AD1610 mov edx,0AD1628                                           ASCII "InternalName"
00AD1640 mov edx,0AD1658                                           ASCII "LegalCopyright"
00AD1670 mov edx,0AD1688                                           ASCII "LegalTrademarks"
00AD16A0 mov edx,0AD16B8                                           ASCII "OriginalFilename"
00AD16D7 mov edx,0AD1710                                           ASCII "ProductVersion"
00AD1728 mov edx,0AD1740                                           ASCII "ProductName"
00AD1754 mov edx,0AD176C                                           ASCII "SpecialBuild"
00AD1784 mov edx,0AD179C                                           ASCII "PrivateBuild"
00AD17F2 mov eax,0AD180C                                           ASCII "%d.%d.%d.%d"
00AD1FF3 mov eax,0AD2270                                           ASCII "lhaplpkbq%eiuw"
00AD2039 push 0AD2288                                              ASCII "

显示全部楼层 · 发表于 2008-3-11 22:55:16

"
00AD2069 push 0AD2288                                              ASCII "
"
00AD2099 push 0AD2288                                              ASCII "
"
00AD20C9 push 0AD2288                                              ASCII "
"
00AD20F9 push 0AD2288                                              ASCII "
"
00AD2129 push 0AD2288                                              ASCII "
"
00AD2159 push 0AD2288                                              ASCII "
"
00AD2189 push 0AD2288                                              ASCII "
"
00AD21B9 push 0AD2288                                              ASCII "
"
00AD21E9 push 0AD2288                                              ASCII "
"
00AD2219 push 0AD2288                                              ASCII "
"
00AD22C1 push 0AD235C                                              ASCII "
"
00AD22C6 push 0AD2368                                              ASCII "> "
00AD230B push 0AD235C                                              ASCII "
"
00AD2313 push 0AD235C                                              ASCII "

"
00AD2A93 mov edx,0AD2B1C                                           ASCII "Server not found"
00AD2AC9 mov eax,0AD2B38                                           ASCII "HELO User.With.Error"
00AD2C3C mov edx,0AD2C84                                           ASCII "MAIL FROM: "
00AD2CC4 mov edx,0AD2D0C                                           ASCII "RCPT TO:"
00AD2D5B mov eax,0AD2E00                                           ASCII "DATA"
00AD2D6F mov edx,0AD2E10                                           ASCII "From: "
00AD2D87 mov edx,0AD2E20                                           ASCII "To: "
00AD2D9F mov edx,0AD2E30                                           ASCII "Subject: "
00AD2DB1 mov eax,0AD2E44                                           ASCII "Content-Type: text/plain; charset=ISO-8859-1"
00AD2DBB mov eax,0AD2E7C                                           ASCII "Content-Transfer-Encoding: 8bit
"
00AD3138 mov edx,0AD31D4                                           ASCII "
"
00AD3210 mov edx,0AD336C                                           ASCII "CPU: "
00AD3244 mov edx,0AD337C                                           ASCII ", "
00AD3268 mov edx,0AD3388                                           ASCII "Intel"
00AD3276 mov edx,0AD3398                                           ASCII "Cyrix"
00AD3284 mov edx,0AD33A8                                           ASCII "AMD"
00AD3292 mov edx,0AD33B4                                           ASCII "Crusoe"
00AD32DB push 0AD337C                                              ASCII ", "
00AD32E0 push 0AD33D0                                              ASCII "MMX"
00AD3302 push 0AD33DC                                              ASCII " @ "
00AD3322 push 0AD33E8                                              ASCII " MHz"
00AD3431 mov eax,0AD3500                                           ASCII "On"Qfqrmf`Vgdl"
00AD343B push 0AD3518                                              ASCII "OS: "
00AD3467 push 0AD3534                                              ASCII ", "
00AD34B1 push 0AD3540                                              ASCII "
"
00AD3579 mov edx,0AD3640                                           ASCII "Eip: %x
Eax: %x
Ecx: %x
Edx: %x
Ebx: %x
Esi: %x
Edi: %x
Ebp: %x
Esp: %x
"
00AD36B6 mov edx,0AD37B4                                           ASCII "-1
"
00AD36E9 mov eax,0AD37C4                                           ASCII "Dspmq@k``?"
00AD36FB push 0AD37E4                                              ASCII "
"
00AD3770 push 0AD37E4                                              ASCII "
"
00AD3884 mov eax,0AD3B0C                                           ASCII "Wdpqjlj>"
00AD389C push 0AD3B2C                                              ASCII "
"
00AD38A7 mov eax,0AD3B38                                           ASCII "HlcefAew`?"
00AD38DD push 0AD3B2C                                              ASCII "
"
00AD390E push 0AD3B4C                                              ASCII "Code = [%d]"
00AD3913 push 0AD3B2C                                              ASCII "
"
00AD3918 push 0AD3B60                                              ASCII "- %d"
00AD391D push 0AD3B2C                                              ASCII "
"
00AD3922 push 0AD3B60                                              ASCII "- %d"
00AD3927 push 0AD3B2C                                              ASCII "
"
00AD392C push 0AD3B60                                              ASCII "- %d"
00AD3931 push 0AD3B2C                                              ASCII "
"
00AD3936 push 0AD3B60                                              ASCII "- %d"
00AD393B push 0AD3B2C                                              ASCII "
"
00AD3940 push 0AD3B70                                              ASCII "- %x"
00AD3945 push 0AD3B2C                                              ASCII "
"
00AD394A push 0AD3B80                                              ASCII "- [%s]"
00AD3C02 mov edx,0AD3CE8                                           ASCII "Error"
00AD3C44 mov edx,0AD3CF8                                           ASCII "
Module name: "
00AD3C59 mov eax,0AD3D10                                           ASCII "
Application data:"
00AD3D4F mov eax,0AD3E54                                           ASCII "08:,50*65=(450"
00AD3D7A mov eax,0AD3E6C                                           ASCII "trgpCbwtdfm(dhe"
00AD3D9D mov eax,0AD3E84                                           ASCII "ctexCbwtdfm(dhe"
00AD3DC1 mov eax,0AD3E9C                                           ASCII "@qrnj`epljh&Ubxg{}"
00AD3DD3 mov eax,0AD3E84                                           ASCII "ctexCbwtdfm(dhe"
00AD3DE5 mov eax,0AD3E6C                                           ASCII "trgpCbwtdfm(dhe"
00AD3EE1 push 0AD3F50                                              ASCII "Information"
00AD3EE9 mov eax,0AD3F64                                           ASCII "Sdrmqw$sdv&ubi|)"
00AD3F06 push 0AD3F78                                              ASCII "Error"
00AD3F0E mov eax,0AD3F88                                           ASCII "Sdrmqw$w`kboi`(m{{ex*"
00AD4052 add esp,10000                                           UNICODE "=::=::\"
00AD5B81 push 0AD5BEC                                              ASCII "158
"
00AD5D11 push 0AD5D7C                                              ASCII "158
"
00AD6A40 push 0AD6A98                                              ASCII "174 (blacklisted key)
"
00AD6D67 push 0AD6DC4                                              ASCII "191
"
00AD7169 push 0AD71C8                                              ASCII "190
"
00AD72CF push 0AD72E8                                              ASCII "192
"
00AD7AE1 mov edx,0AD7C48                                           ASCII "Keys"
00AD7AEE mov edx,0AD7C58                                           ASCII "Names"
00AD7AFB mov edx,0AD7C68                                           ASCII "Passwords"
00AD7B16 mov ecx,0AD7C7C                                           ASCII "Value"
00AD7B1B mov edx,0AD7C8C                                           ASCII "LastKey"
00AD7B67 mov edx,0AD7C68                                           ASCII "Passwords"
00AD7BAB mov edx,0AD7C48                                           ASCII "Keys"
00AD7BD9 mov edx,0AD7C58                                           ASCII "Names"
00AD7D19 push 0AD7E38                                              ASCII "-1"
00AD7D22 mov ecx,0AD7E44                                           ASCII "Value"
00AD7D27 mov edx,0AD7E54                                           ASCII "LastKey"
00AD7D7B mov edx,0AD7E64                                           ASCII "Passwords"
00AD7D9B mov edx,0AD7E78                                           ASCII "Keys"
00AD7DBB mov edx,0AD7E88                                           ASCII "Names"
00AD7EAD push 0AD7EC4                                              ASCII "193
"
00AD8AA5 push 0AD8AC8                                              ASCII "109
"
00AD8C81 push 0AD8CA8                                              ASCII "110
"
00AD8DAA push 0AD8DD0                                              ASCII "113
"
00AD8ECC push 0AD8EF4                                              ASCII "113
"
00AD9233 push 0AD92D4                                              ASCII "107
"
00AD9593 push 0AD95AC                                              ASCII "112
"
00AD96B3 push 0AD96D0                                              ASCII "111
"
00AD96F1 push 0AD9720                                              ASCII "107
"
00AD9706 push 0AD9730                                              ASCII "108
"
00AD9E70 push 0AD9EB4                                              ASCII "107
"
00AD9E85 push 0AD9EC4                                              ASCII "108
"
00ADA16D push 0ADA1A4                                              ASCII "181
"
00ADA5CA push 0ADA610                                              ASCII "194
"
00ADE141 push 0ADE160                                              ASCII "199
"
00ADF40B push 0ADF43C                                              ASCII "198
"
00ADF96E push 0ADF99C                                              ASCII "58
"
00AE0200 push 0AE0214                                              ASCII "Key is not valid, please try again!"
00AE0263 push 0AE042C                                              ASCII "EDIT"
00AE0296 push 0AE042C                                              ASCII "EDIT"
00AE02BF mov edx,0AE0434                                           ASCII "OK"
00AE02C4 mov eax,0AE0438                                           ASCII "BUTTON"
00AE02ED mov edx,0AE0440                                           ASCII "Cancel"
00AE02F2 mov eax,0AE0438                                           ASCII "BUTTON"
00AE0320 mov eax,0AE0448                                           ASCII "Static"
00AE034B mov eax,0AE0448                                           ASCII "Static"
00AE0376 mov eax,0AE0448                                           ASCII "Static"
00AE038A push 0AE0450                                              ASCII "MS Sans Serif"
00AE061D push 0AE07C0                                              ASCII "MAINICON"
00AE064B mov eax,0AE07CC                                           ASCII "KeysDialog"
00AE0677 mov eax,0AE07CC                                           ASCII "KeysDialog"
00AE06A4 push 0AE07D8                                              ASCII "Name:"
00AE06B4 push 0AE07E0                                              ASCII "Code:"
00AE20F5 push 0AE215C                                              ASCII " Mode Activation Dialog."
00AE21D2 push 0AE221C                                              ASCII "Incorrect Password!
"
00AE21F5 push 0AE223C                                              ASCII "172
"
00AE22C7 push 0AE22F8                                              ASCII "172
"
00AE253F push 0AE260C                                              ASCII "175
"
00AE258A push 0AE261C                                              ASCII "176
"
00AE2731 push 0AE2750                                              ASCII "150
"
00AE2854 mov edx,0AE28A0                                           ASCII "kernel32.dll"
00AE290B push 0AE2930                                              ASCII "180
"
00AE2CA5 push 0AE2D7C                                              ASCII "
"
00AE2CC1 push 0AE2D7C                                              ASCII "
"
00AE2CDD push 0AE2D7C                                              ASCII "
"
00AE2D15 push 0AE2D7C                                              ASCII "
"
00AE2D2D push 0AE2D7C                                              ASCII "
"
00AE2F3A push 0AE2F64                                              ASCII "253
"
00AE305B push 0AE322C                                              ASCII "KERNEL32.DLL"
00AE30AD push 0AE323C                                              ASCII "NTDLL.DLL"
00AE30C4 push 0AE3248                                              ASCII "ADVAPI32.DLL"
00AE30DB push 0AE3258                                              ASCII "GetProcAddress"
00AE30F9 push 0AE3268                                              ASCII "RaiseException"
00AE3142 push 0AE3278                                              ASCII "GetLastError"
00AE3160 push 0AE3288                                              ASCII "SetLastError"
00AE31F7 push 0AE32A0                                              ASCII "251
"
00AE3401 push 0AE34D0                                              ASCII "86
"
00AE3487 push 0AE34E0                                              ASCII "82
"
00AE356B push 0AE3668                                              ASCII "KERNEL32.DLL"
00AE35A8 push 0AE3680                                              ASCII "The ordinal "
00AE35BF push 0AE3698                                              ASCII " could not be located in the dynamic link library "
00AE35E7 push 0AE36CC                                              ASCII "LOADER ERROR"
00AE35F3 push 0AE36E4                                              ASCII "The procedure entry point "
00AE3606 push 0AE3698                                              ASCII " could not be located in the dynamic link library "
00AE362E push 0AE36CC                                              ASCII "LOADER ERROR"
00AE3920 push 0AE3958                                              ASCII "180
"
00AE3A50 push 0AE3AA8                                              ASCII "180
"
00AE3E4F push 0AE3E84                                              ASCII "153
"
00AE3E68 push 0AE3E94                                              ASCII "152
"
00AE3FE5 push 0AE401C                                              ASCII "195
"
00AE4104 push 0AE419C                                              ASCII "107
"
00AE7F39 push 0AE7F58                                              ASCII "197
"
00AE9211 push 0AE9240                                              ASCII "196
"
00AE952B mov edx,0AE9578                                           ASCII "112
"
00AE9539 mov edx,0AE9588                                           ASCII "113
"
00AE9547 mov edx,0AE9598                                           ASCII "115
"
00AE9555 mov edx,0AE95A8                                           ASCII "111
"
00AE9563 mov edx,0AE95B8                                           ASCII "1048"
00AE95C0 push 0AE95D4                                              ASCII "27
"
00AE96E8 push 0AE979C                                              ASCII "161
"
00AE9729 push 0AE979C                                              ASCII "161
"
00AE9C4D push 0AE9C70                                              ASCII "101
"
00AE9F7C push 0AE9FA0                                              ASCII "109
"
00AEA15B push 0AEA180                                              ASCII "110
"
00AEA2FE push 0AEA324                                              ASCII "110
"
00AEA4A2 push 0AEA4C8                                              ASCII "110
"
00AEA550 push 0AEA6F0                                              ASCII "107
"
00AEAEAB push 0AEAECC                                              ASCII "102
"
00AEB941 push 0AEBABC                                              ASCII "180
"
00AEBC71 push 0AEBDC0                                              ASCII "160
"
00AEBD70 mov edx,0AEBDD0                                           ASCII "150
,"
00AEBFAD push 0AEBFDC                                              ASCII "107
"
00AEBFC2 push 0AEBFEC                                              ASCII "108
"
00AEC447 push 0AEC46C                                              ASCII "157
"
00AEC8C5 mov esi,0AEC913                                           ASCII " \\.\SICE"
00AEC9CB push 0AEC9F0                                              ASCII "Protection Error"
00AECA9F mov edx,0AECAFC                                           ASCII "90
_"
00AECDEF push 0AECE14                                              ASCII "103
"
00AED289 push 0AED330                                              ASCII "42
"
00AED4EB push 0AED520                                              ASCII "151
"
00AEDAED push 0AEDD50                                              ASCII "85
"
00AEDB07 push 0AEDD50                                              ASCII "85
"
00AEDC87 push 0AEDD60                                              ASCII "55
"
00AEDCE6 push 0AEDD70                                              ASCII "57
"
00AEDD2A push 0AEDD80                                              ASCII "60
"
00AEDE83 push 0AEDF18                                              ASCII "45
"
00AEDEF0 push 0AEDF28                                              ASCII "34
"
00AEE4CE push 0AEE638                                              ASCII "100
"
00AEE6B0 push 0AEE6D4                                              ASCII "150
"
00AEE7DC push 0AEE84C                                              ASCII "170
"
00AF0375 sub dword ptr ds:[eax+eax+AC8128],0AC8144                ASCII "OuOcsUmarJ`Ubd|afg"
00AF0381 sub dword ptr ds:[eax+eax+AC8178],0AC8190                ASCII "L`rTjfsKcCojb"
00AF0391 sub dword ptr ds:[eax+eax+AC81D8],0AC81F0                ASCII "BmmqfKejaic"
00AFA6CC imul ebp,dword ptr ss:[ebp+54],657079                   ASCII "N("

显示全部楼层 · 发表于 2008-3-11 23:16:05

0012FDA8  /CALL 到 FindFirstFileA 来自 00AB725B
0012FDAC  |FileName = "C:\Documents and Settings\xxx桌面\Split[1]\aspr_keys.ini"
0012FDB0  \pFindFileData = 0012FDB8

[ 本帖最后由黄金马甲出租于 2008-3-11 23:22 编辑 ]

显示全部楼层 · 发表于 2008-3-11 23:18:36

是非常可疑啊，split程序为什么要调用smss.exe连接网络呢

显示全部楼层 · 发表于 2008-3-11 23:25:18

0012FA28  /CALL 到 CopyFileA
0012FA2C  |ExistingFileName = "E:\virus\Test.exe"
0012FA30  |NewFileName = "C:\windows\smss.exe"
0012FA34  \FailIfExists = FALSE

显示全部楼层 · 发表于 2008-3-11 23:43:28

包了一层antivir托不掉的外壳而已，运行之后秒杀

[可疑文件] 微点报毒（一个分割命令）

本帖子中包含更多资源

没看错的话是灰鸽子２００８黑防贺岁版

本帖子中包含更多资源

回复 8楼 wolffshen 的帖子

本帖子中包含更多资源