回复:小孩测瑞星之 “小孩2号”完成 Ring3下 无驱动 无提示干掉瑞星监控
截获到程序含有以下信息
lianggaochuan@163.com QQ253914122;
低级内核dll:kernel32.dll GetCurrentThreadId GetLastError ExitProcess WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetSystemTime GetFileType CreateFileA CloseHandle GetCommandLineA TlsSetValue TlsGetValue LocalAlloc GetModuleHandleA GetModuleFileNameA FreeLibrary HeapFree HeapReAlloc HeapAlloc GetProcessHeap user32.dll CharNextA kernel32.dll WriteFile SizeofResource SetFileAttributesA LockResource LoadResource GetWindowsDirectoryA GetTempPathA GetSystemDirectoryA FindResourceA FindFirstFileA EnumResourceNamesA CreateFileA CloseHandle user32.dll CharLowerBuffA shell32.dll ShellExecuteA
你把原理直接写出来不完了。