kuzzle��ʲô kuzzle��Ԥ�� -pc6��Ѷ

��λ�ã��ҳ��Ѷ�� kuzzle��ʲô kuzzle��Ԥ��

kuzzle��ʲô kuzzle��Ԥ�� ʱ�䣺2017/8/4 11:23:37��Դ��www.pc6.com��ߣ�0..0��Ҫ��(0)

��ڽ��һ��в��û��ѵĲ��ٴ��Ϯ,��Ѷ��֪��kuzzle��ʲô,kuzzle��ʵ��һ��õ��ֱ��Ĳ��,�û��Ҳ��Ҫ��,һ��kuzzle��Ԥ��ɡ�

��һ��

��գ��ް�ȫ�Ŷӽػ��Բ��"Kuzzle"��ò��Ⱦ��Ժ��ٳ��ҳĲ��ͬʱ��ܲ��ߵ�Զ��ָ��ƻ����"Kuzzle"ӵ�зǳ��ߵļ��ˮƽ��ö��ֶζ�ܰ�ȫ��Ĳ�ɱ��֪��ȫ��̵Ĳ�Ʒ��ǩ��ð�ȫ��"��"��λ��ܲ�ɱ��ص��ǣ��û��ʹ��װϵͳҲ��ò��ʹ�û��Գ��ڴ��ڱ��Ż�Ŀ��֮�¡�

��ݻ��ް�ȫ�Ŷӷ��"Kuzzle"ͨ��վ�ĸ��ƹ㴫��Ĭ��Я��"�Ƽ��±�"��Ը�Ⱦ��ҳ�ᱻ�ٳ֣��ȸ衢��360�ȶ��ᱻ�޸�Ϊhao123��վ��

��ް�ȫ�Ŷ�ͨ��Դ��֣�"Kuzzle"��ö��ּ��ֶζ�ܰ�ȫ��Ĳ�ɱ��оͰ��֪��ȫ��̱��Դ��˾��ǩ��ȫ��⵽��ǩ��ʱ��Ὣ��Ϊ�Ǳ��Դ��Ʒ��Զ��Ź��в�ɱ��ҵ�ڵİ�ȫ��ذ��ͨ��"��ļ�ǩ��"��ɽ��Щ��ȫ��©��ɹ��ԡ�

��"Kuzzle"ͨ��۸ĵ��ϵͳ�е��¼��MBR��;��¼��VBR��ڲ��޸��£��û��ʹ��װϵͳҲ�޷��޹��ʦ��ʾ��꣬ͨ��MBR��VBR��Ⱦ��ȼ��Կ��Ĳ��å��࣬��å��ȫ��Խ��Խ��ʹ�ò��ֶ�ǿ��ʶ��ӣ��û��Σ��ͳ��

��Ŀǰ��"��ް�ȫ��"��⣬��ء��ɱ"Kuzzle"��Ѿ��Ⱦ�ò��ķǻ��û��ʹ��"��רɱ��"��ײ�ɱ�ò��

��"Kuzzle"ͨ��Ⱦ�û��MBR��VBR

��Bootkit��"Kuzzle"αװ��"�Ƽ��±�"��ù��ڼ��֪��վ�ĸ��ƹ㴫��"Kuzzle"ʹ��Ч��ǩ��Ӧ�ú��"��©��"��ܰ�ȫ��ز��롣"Kuzzle"��Чǩ��"Kuzzle"��ļ��ģ�顣��õ��Ч��ǩ��ֱ��"Beijing VRV Software Corporation Limited."��"�Ͼ��˼��Ϣ��޹�˾"��

��ͨ��Ϊ��Чǩ��ĳ��Ǵ�ͳ��"��ļ��"��ǻ��ɱ��Դ��Ч��ǩ��ڿ��ȡ��ͨ��ʽй¶��֤��ķ��

��ڲ��У��Ƿ��ָò��к�ǿ��ԣ��ǩ��İ�Ȩ��Ϣαװ��죬��ģ��Ӧ�еĹ��ܡ��밵��У��ϸ��Ѳ��ǩ��ģ��а��Ĳ��ܡ�

��"�Ƽ��±�"��Ч��ǩ��ĳ��ڴ��ز��Ͳ��װ��Ĺ��ͨ�õģ��߿��ͨ��ƿش��룬�·��⹦��ģ�鵽�û��ִ��Ϊ��Ŀǰ��ǿ��ͨ��ƿش��룬��Ⱦ�û��MBR��VBR��Ҫ��Ϊ�Ǵ۸��ҳ��ٳֵ��վ��"https://www.hao123.com/?tn=9******1_hao_pg"��

��"Kuzzle"��"Bootkit"ģ��Ⱦģ��XP��Win7��Win10��ϵͳ��ͨ��Ⱦ��MBR��VBRפ��û�ϵͳ�У��ͨ��Hook��̶�д��ӶԿ�ɱ��ɱ��⣬��ʹ�û��쳣��װϵͳҲ�޷��"Kuzzle"��

��"Kuzzle"��Ա�֮ǰ�ı��ع��"��"��"��"��Bootkit��ǿ��õ��ȫ��ļ��ܴ��û�Ӳ�̣�ֻ��ڲ��ʱ�Ż��ڴ��ܺ��أ��̲��ļ�ȫ�̲��ء��ް�ȫʵ��ҷ��ֽ��ڸ�ȾMBR��VBR��å��ƣ��վ�Ѿ��Ϊ��å��Ͳ��Ҫ��

��"Kuzzle"��Ĺ��ͼ��ʾ��

��һ��

��Ŀǰ��"��ް�ȫ��"��⣬��ء��ɱ"Kuzzle"��Ѿ��Ⱦ�ò��ķǻ��û��ʹ��"��רɱ��"��ײ�ɱ�ò��

��"Kuzzle"ͨ��Ⱦ�û��MBR��VBR

��ͨ��Ϊ��Чǩ��ĳ��Ǵ�ͳ��"��ļ��"��ǻ��ɱ��Դ��Ч��ǩ��ڿ��ȡ��ͨ��ʽй¶��֤��ķ��

��"Kuzzle"��Ĺ��ͼ��ʾ��

��"Kuzzle"��Ĺ��

��1.ͨ��ƹ�"Kuzzle"

��ް�ȫʵ��ҷ��֣�ĳ��"��"�ƹ��а��Bootkit��"Kuzzle"��ò��"αװ"��Ϊ"�Ƽ��±�"��Ӧ�á�Ϊ�˴ﵽ��ƭЧ��װ��"�Ƽ��±�"��ṩ�ı��༭��ܣ��û�ֱ��"�Ƽ��±�"��װ��ִ�в��롣

��ƹ㲡��"�Ƽ��±�"

��ʹ��"��"�ں�̨��װʱ��"��"��õ��ļ�"kpazq5.ini"Ϊ"�Ƽ��±�"��װ��Ӱ�װ��"-silent"��

��ļ�

��"�Ƽ��±�"��װ��ж��װ��ݸñ�־λִ�в�ͬ��̣��ʹ�ò��"-silent"��ͻ�ִ�в��غͰ�װ��̣��ͼ��ʾ��

��װ��

��װ��ִ�в��ʱ��û��Ƿ��"ksafesvc.exe"��"baidusdsvc.exe"��̣��һ��̣��װ��ͻ��ñ�־λ"g_bflags"��ͼ��ʾ��ñ�־λ��װ��ͷŵ�"��"�ļ�"net.dat"��"�Ƽ��±�"��װ��أ��һ��Ч��ǩ��"pdfsvr.exe"��أ��Ŀ��Ϊ��Щ��ȫ��"��©��"��

��ɽ�Ͱٶ�

��"pdfsvr.exe"��Ч��ǩ��ͼ��ʾ��

��pdfsvr.exe��ǩ��

��2.��װ��

��"�Ƽ��±�"��װ��"calsp_820.exe"��һ��ͷ��ĸ��ΪIMAGEFILE��Դ�ļ��ͼ��

��calsp_820.exe��Դ�ļ�

��Щ��Դ�ļ��Ͳ��ͷ��ͷŵ��ļ��Ӧ��ϵ��±��Ļ��ļ��ϸ��

��Դ�ļ�˵��

��ͷ��"calsp_820.exe"��ͷ��Դʱ�Żỹԭԭʼ��Դ�ļ�ͷ4��ֽڣ��ͼ��

��ԭ�ļ�ǰ4��ֽ�

��ͷ��в�ͬ��Դ�ļ��ϸ��

��1��IMAGEFILE\144\2052��Դ��Ӧ�ļ�setup.dat��ļ��ԭ֮��Notepad2CN��cab�Խ�ѹ��

��setup.dat�ļ�

��2��IMAGEFILE\145\2052��Դ��Ӧ�ļ�upsoar.ini�ļ��"�Ƽ��±�"��ļ��

��3��IMAGEFILE\151\2052��Դ��Ӧ�ļ�pdfsvr.exe��"pdfsvr.exe"��"�Ͼ��˼��Ϣ��޹�˾"��Ч��ǩ��ϸ��Ϣ��Ϊ"��PDF��ά��"��Ҳ��ó��Ϣ��װ��⵽ϵͳ��ksafesvc.exe��baidusdsvc.exe��̺Ż��ͷ�"pdfsvr.exe"��ʹ��"/service"��ִ�С��ͼ��

��pdfsvr.exe�ļ�

��4��IMAGEFILE\155\2052��Դ��Ӧ�ļ�"net.dat"��һ��ܵĶ��ļ��ԭ��ǰ�װ��ؼ��Ĳ��"net.dat "��װ��"calsp_820.exe"��"pdfsvr.exe"��ڴ��ܺ�ִ�в��룬��ɺ��"Kuzzle"��غͰ�װ��̡��ܺ��net.dat�ļ�ȫ�̲��أ�ֻ��ڴ��г��֣�ͨ��ֶα��ļ��Ϣ��ͼ��

��net.dat�ļ�

��3.��̷��

��Ƽ��±��װ��"calsp_820.exe"��PDF��ά��"pdfsvr.exe"ʹ��ͬ�Ľ��Key"0x3B"��ԭͬΪ0x270��ShellCode��룬��ܺ��ShellCode��ȫ��ͬ��Ҫ��ڴ��м��ء��ܲ��ͷ��ͷŵ�"net.dat"�ļ��ý��ܺ��PE��ڵ㡣��ԭShellCode�Ĵ��£�