病毒常用方法之注册表操作

注册表的增删查改操作基本上是恶意代码的常规操作,但是对注册表的操作通常会留下痕迹,导致被发现,最后被清理掉 .对于驱动模块更是如此,驱动程序的入口函数的第二个参数就是注册表路径,当驱动加载后该值会被写到相应的位置,这是为了隐藏自己,要将与之相关的表项都删掉.下面是一段反汇编代码:

 int __stdcall DeleteKey(POBJECT_ATTRIBUTES ObjectAttributes)
 DeleteKey       proc near            

 var_24          = OBJECT_ATTRIBUTES ptr -24h;  
 var_C           = word ptr -0Ch
 var_A           = word ptr -0Ah
 var_8           = dword ptr -8
 ObjectAttributes= dword ptr  8;传入的参数，包含要操作对象的一些信息，这里就是注册表名字信息
                push    ebp
                mov     ebp, esp
                sub     esp, 28h
                push    ebx
                push    esi
                mov     esi, 100h
                push    edi
                mov     eax, esi
                call    __alloca_probe_16
                and     [ebp+var_24.RootDirectory], 0 ;初始化RootDirectory
                xor     eax, eax
                mov     [ebp+var_C], ax
                mov     ebx, esp
                push    [ebp+ObjectAttributes] ; ObjectAttributes
                mov     eax, esi
                mov     [ebp+var_A], ax
                lea     eax, [ebx+10h]
                mov     [ebp+var_8], eax
                lea     eax, [ebp+var_C]
                mov     [ebp+var_24.ObjectName], eax
                xor     eax, eax
                mov     [ebp+var_24.Length], 18h
                mov     [ebp+var_24.Attributes], 40h
                lea     edi, [ebp+var_24.SecurityDescriptor]
                stosd
                stosd
                push    0F003Fh      ; DesiredAccess
                lea     eax, [ebp+var_24.RootDirectory];RootDirectory被当成Handle用
                push    eax             ; KeyHandle
                xor     edi, edi
                call    ds:ZwOpenKey;打开要操作的注册表
                test    eax, eax
                jl      short loc_10004C60
                mov     edi, ds:ZwEnumerateKey
                jmp     short loc_10004C32
 loc_10004C1D:                         
                mov     ax, [ebx+0Ch]
                mov     [ebp+var_C], ax
                lea     eax, [ebp+var_24]
                push    eax      ; ObjectAttributes
                call    DeleteKey
                test    eax, eax
                jz      short loc_10004C45

 loc_10004C32:                          
                lea     eax, [ebp+ObjectAttributes]
                push    eax          ; ResultLength
                push    esi             ; Length
                push    ebx         ; KeyInformation
                push    0      ; KeyInformationClass
                push    0               ; Index
                push    [ebp+var_24.RootDirectory] ; KeyHandle
                call    edi ; ZwEnumerateKey 遍历子项
                test    eax, eax
                jge     short loc_10004C1D;还有表项，往回走，去loc_10004c1d 接着调用自己DeleteKey（）

 loc_10004C45:                          
                push    [ebp+var_24.RootDirectory] ; KeyHandle
                call    ds:ZwDeleteKey
                push    [ebp+var_24.RootDirectory] ; Handle
                xor     ecx, ecx
                test    eax, eax
                setnl   cl  ;操作成功，设cl=1
                mov     edi, ecx
                call    ds:ZwClose

 loc_10004C60:                         
                mov eax, edi
                lea     esp, [ebp-34h]
                pop     edi
                pop     esi
                pop     ebx
                leave
                retn    4
 DeleteKey       endp