The lpk. dll virus is believed to be familiar to everyone. It has been prevalent for some time, and the corresponding killing tool can also be searched and downloaded from the Internet, which is sufficient to indicate the extensiveness and danger of the virus. This article analyzes the behavior of the virus and presents you with all the manual processes.
Rising experts pointed out that not all lpk. dll file
user Set Smbpass XXX//Set properties ciphertext hash How is the hash of the target host acquired? You can get the hash value by PWDUMP7 this tool. Just copy the following paragraph. Exploit//Start attack Get current shell, execute command (iv), LPK's right to raise Trigger: The directory exists EXE file is executed, his feature is that every executable file to be loaded before the file, the Windows system is to determine whether the current file directory exists this file, if the
/The usp10 was written last time, and the LPK code is pasted this time.// The following files are in LPK. cpp. the header file is the same as that of the previous usp10.
// LPK. cpp: defines the entry point for the DLL application.//
//////////////////////////////////////// //////////////////////////////////////// ////////////////////////////////////////// Header
1. Restart your computer and press F8 to enter the safe mode with command line
2. Go to the C root directory and run the following command:
Attrib-S-H-R lpk. dll/s
Attrib-S-H-R usp10.dll/s
Del/s lpk. dll
Del/s usp10.dll
3. Run the preceding command on all disks.
4. restart the computer: shutdown/r/t 1
Note: These two files under the system directory system32 are protected by the system and will
Analysis of a Trojan trojan virus (2) Analysis of the Trojan trojan virusI. Basic Information
Sample name: hra33.dll or lpk. dll
Sample size: 66560 bytes
File Type: Win32 dll file
Virus name: Dropped: Generic. ServStart. A3D47B3E
Sample MD5: 5B845C6FDB4903ED457B1447F4549CF0
Sample SHA1: 42e93156dbeb527f6cc213372449dc44bf477a03
This sample file is the virus file C: \ WINDOWS \ system32 \ hra33.dll that was released to the user's system C: \ WINDOWS \
From: 90 sacret Team Information Security TeamThe method I provided is relatively harsh, but it is a way of thinking that may help you when your intrusion is blocked. Let's take a look at the requirements of this injection point:1. magic_quote is off2. You can write files. It is best to have the write permission for any directory.3. It is best to have the permission to read files, but if you do not have the permission4. the injection point must be POST (in this way, a post128KB file can be creat
, sha1, sha256)
2. Modify the downloaded package information (not limited to version)
2.1 change openssh-5.9p1.tar.gz version information
As you can see, if openssh_5.9p1 is not found in the unzipped source code using grep, continue searching:
Change the version in the source code file of the version information (I changed all OpenSSH to SSH, 5.9 to 3.3, and P1 to P9)
In addition, the grep search keyword is still incorrect. For the correct information, see:
After modification, package the ch
CLASSID, "5220cb21-c88d-11cf-b347-00aa00a28331", is for the License Manager and not for your ActiveX controls. You are must use the same CLASSID every the refer file. In addition, your should keep the Name property of the Because can only have one LPK a file for each HTML page, make sure so you include all of the licensed ActiveX Controls For the page, you generate your LPK file. For example:
Id= "Microsof
Note: This classid, "" 5220cb21-c88d-11cf-b347-00aa00a28331 "", is for the License Manager and not for your ActiveX controls. you must use the same classid every time you refer to the LPK file. in addition, you shoshould keep the name property of the Because you can only have one LPK file for each HTML page, make sure that you include all of the licensed ActiveX controls for the page when you generate your
word Daquan 7. Power Tools Hash Read, no net rights, Brazilian Yakiniku, Lxc, Linux, IIS, exp Daquan, Port forwarding, 3389 Daquan, DLL, UDFNC, LPK, off-Star, S-u, no component 8.arp sniffing ARP EMP v1.0, cain_v4.9 Chinese version, MAC address scanner, Netfuke, fantasy network Shield 3.7, ARPKiller.exe, Sniffing Tan Ma 9. Social engineering Emailsearch, MB social Worker Assistant Toolkit, theharvester--free environment edition, social Work tool-Mobi
administrator.Conditions: 3389 Remote Desktop on trigger lpk Backdoor Trigger condition: The current directory exists Lpk.dll and exe program,EXE program is run, that is, trigger backdoorGenerate Lpk.dll through the tool and upload to the administrator's Common exe program directory by Webshell , waiting for the administrator to trigger execution. Tool Tools lpk sethc Use this tool to upload an open 3389
Address: http://blog.csdn.net/you_and_me12/article/details/7262915
Edit (scale down, graffiti, etc.) the image and save it as an image of the specified format and size.
Post Code first:
Bitmap bmp = Bitmap.createBitmap(480, 800, Config.ARGB_8888);Canvas canvas = new Canvas(bmp);canvas.drawBitmap(this.bmp, matrix, paint);canvas.save(Canvas.ALL_SAVE_FLAG);canvas.restore();File file = new File("/sdcard/akai/");if(!file.exists())file.mkdirs();try {FileOu
Edit (scale down, graffiti, etc.) the image and save it as an image of the specified format and size.
Post firstCode :
Copy code The Code is as follows: bitmap BMP = bitmap. createbitmap (480,800, config. argb_8888 );
Canvas canvas = new canvas (BMP );
Canvas.drawbitmap(this.bmp, matrix, paint );
Canvas. Save (canvas. all_save_flag );
Canvas. Restore ();
File file = new file ("/sdcard/Akai /");If (! File. exists ())File. mkdirs ();Try {Fileoutpu
Edit (shrink, doodle, etc.) the picture and save it to a picture of the specified format and size.
Post Code First:
Copy Code code as follows:
Bitmap bmp = Bitmap.createbitmap (config.argb_8888);
Canvas Canvas = new Canvas (BMP);
Canvas.drawbitmap (this.bmp, Matrix, paint);
Canvas.save (Canvas.all_save_flag);
Canvas.restore ();
File File = new file ("/sdcard/akai/");
if (!file.exists ())
File.mkdirs ();
try {
Fil
Address: http://lwglucky.blog.51cto.com/1228348/282331
From a foreigner's war3 plug-in, haha, that is, wutil has to PF, actually can display the magic value as the blood bar, in fact, this desire was previously thought about, but I really don't know how to implement it. I don't know if war3 has this function, or the foreigner actually implemented it in Bt. This is a post, and it is being studied ~~~ After analyzing MH. pdll, we found that it is implemented by injecting DLL, because some function
:
[CFG]GuiMode = 1ExitMode = 1[SEARCH]Parameter = 0x00300432[CONTROLCENTER]ProfileName = myscan
Then, set the file attribute to read-only. Otherwise, the configuration file will be deleted after the call. Don't ask me what I mean. I don't know what it means. The installation directory of little red umbrella also contains many avp files. However, it can be determined that guimode = 1 means to control whether the pop-up interface is displayed. Wow, don't hit me. To test the success or failure, we
set of third-party controls, that is, zeos DBO.Zeosdbo is a powerful data operation control developed by Delphi. It also has Lazarus-related versions. You can obtain it from SourceForge, which is free and open-source.
Based on zeosAs described in DBO documentation, to install zcomponents. LPK on Lazarus, you only need to compile and install zcomponents. LPK. The remaining four packages, zeosDBO has been in
, many virus files will be generated, so we need to use anti-virus software for offline antivirus. So I got 169 viruses ...... I haven't been so poisoned for a long time! I used to use Linux. Now I need to transfer my work to Windows. Ah, I am poisoned! As follows:
5. Pay attention to network connections. For example, if "netstat-an" is used, you can use the "Traffic firewall" that comes with 360 to check the network connection status. If an exception occurs, the network will be cut off immedia
network elites, to defend the homeland network security by the team way.For the country's information security to do a strong support, to learn something to share, so that more people understand the meaning of cyber security, popularize the security awareness of the vast number of netizens. Uphold the safety and security of network security knowledge, the maintenance of the homeland's network security, and constantly accumulate more knowledge to arm themselves.Guest Killer Security Team memberF
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.