
Ŀ
                                                                    
                        
                                    
                           
                                          
Ĵ
                                  5                           
ٰ



                       ⨪ ⮣  - 2
                               by DrMAD

                               章   ࠭.
                             䨭 㫠.
                             -   , - ᪠ , -  
                             ! 諨           
                             ...

                             .. 誨.  .

                               

     諮  ᪥  "᪮  蠫"  뫠  㡫 ,
饭   ᬮ७   ࠡ      ᯥ᪨    "    -
୥᪨ ⠢  ".  뫨 ᫥騥 ᫮:

:    த ,   ᫥   "孨      䨫䨨  堪᪨  ⠪"
:    ᮡࠥ  ன 줮஬ ᢮ ⥫     ⥬
:    ᮫,  ᠢ   -   த  "孨    䨫䨨
:     ⠪".   ᮬ,    "孨"  㤥  
:    浪,     "䨫䨥"...   祬   ௥
:       ⮩,  ᠭ, .

         "᪨  ᫥⥫     ᮢ",
⥫⢮ "",  315 ,  ࠦ 4000 .    ன
஢ ᢮ ⨪  ⮩ . :)

         1.  , ,   

    ,   ⥫쭮  ⠫    ࠭訪    .  
    ⮫쪮  ࠧ, ⮡ ᬥ
   ᢮  . , ⥬  , -祣  㤠.

>     .. 16.   ...⭮  ᯥ譮  㦥  ᭮  ࠧ
> ⭮⥫쭮 ,    ࠭  ४⭮ 祭  
>   室.

    "" ⭮⥫쭮      祣?     ⭮⥫쭮     ⭮
㦥?    ,  設? 모뢠 ᢮ ⨢,
稢      ? :)

>     .. 18.    ॢ  ,   㥬   ࢮ   
> 쬨,   ,  ...    ⨢樨  ᯥ樠쭮  ,
>      १...  ..

    ᮢ  ࢮ  80-   ஢.  
ᮢ ( ᮢ६  ⮣ ନ) ⮣  뫮.

>  .. 20.    ६    쬨...  ⢮ 
> ⨯ Hercules,   뢮  ...

    Hercules -         ,    .  ,  "
뢮  " ,  ࠡ騥   ࠢ Hercules,
  ࠢ  MDA.   ࠩ    㯮
  80- , 饭 ⮩ ⥬.

>    . 22.  ᫨  LoveSan...    筮 뢮  
> ,        ᥩ  ५    ,  ᨤ    
> ...

     60  ஢   뫮,  ⥬  ,    
    ᨤ.   ⢮ ⥫, ࠤ, ,
⮬ ࠭ᯮ, ... :)

> . 23.    ணࠬ,   ᯮᮡ      ᠬ⥫쭮   ࠧ,
> ⥪饬   짮⥫, ਭ 뢠 ﬨ.

     "ਭ"?  ,  ஬         .   ᯥ᪨   
䨪      砥  (᪮쪮    ).    10  
⢮  ࠧ  ᮢ  -   "䠩   ࢨ",   
᪠    १  짮⥫.  ⮢
ࢨ (ᮡ ࠧ     ୨,   㬠
⮦,        -    -)  ᪠  ⮦  
짮⥫.  ३  "" ⫨砥  ""  ⥬,    
ਪ९    ணࠬ ꥪ,  ᠬ  ᥡ,
।⢥ (  ।) ᯮ  ⥬  .  
짮⥫     譨  䨣࠭.

>    . 27. ...直     饭 " ".

    "" - 稥,     .          ૨,
 ५ "᫥",   " ᫥". :)

> C 27.  ᪨ ॢ 孨᪮ 㬥樨...   ॠ쭮 
> ࠡ  ਣ.

    ᭮,       ⠪     孨᪠  㬥  
१ _ॢ_,   ⠭ ਣ  ॠ쭮 ࠡ?
,  ᮫⭮  祣.  㣮  ,       
  _᪠_   孨᪮   㬥樨,      㦥
ਣ.      ୮.    .  ᯥ᪨  ⠪
᪠  . :)

> . 30.  ⪮஢  ணࠬ       ᪨
> 㯠騪,    ⮬᪮/㠢⮬᪮
> ᯠ.

    ,      ᪮쪮   ࠭      ᪠뢠   
᭮뢠 ⥧    ᫮. :)

>    . 31.    室    Windows    .  ⢮
> 㯠騪 १ ᫮...

        .   㯠騪  ⮦  뫮    䨣,
  묨 뫨 ᥣ 4:  PkLite,  diet,  LZCOM/LZEXE,
AinExe.    TSCrunch  - 蠫?    EXEPack?   
PPACK?  ...

>    . 33.   ,   ᪮         㯠騪,    ⮢
> ᯠ騪  ⠢  ஡...

    堩  쬥  猪, ᮧ  ᫥  
 㯠 UPX,  ⠥  _⮬᪨_ ࠧ-UPX-. ,
⭮ ᯥ 業⮢ 10 -  .

>     . 35.    ﭮ     ⮣   ,      
> ᮧ  २⢥    ᥬ  ᠫ २⢥
> ᨮ...

     筮     .    90%    ᮢ    ᮧ    
"ᨮ",  騬 ⮪ ᥬ .  ⠪ 
1993 ᮫ 쥧 ਫ  ᪮ன  ୮  
᪮ ⪮  ᮫⭮ ਬ⨢   ⨯ "娦类".
 諮. :)

>    . 35. ... ଠ쭮 ⪮஢ ணࠬ 稭 
> ⠪ 뢠 ⮢ ...

       ⠪  "ଠ쭮  ⪮஢"?      ⮣ 
"ଠ쭮 ⪮஢"?  -,       ணࠬ,
ᠭ  , ⠪    뫮 .

>    . 35.  ,    ᥬ    ⠭ 㧥
> ।...

    . :)

> . 37   . ...  I-Worm.Kilez.h

    ,  "I-Worm" ,   "h".   ,  ⪠ ᪨஢
᢮  㬪     ?    ⠪ ,    
뫮. , ᬮਬ:

I-Worm.Klez.h         -  ᯥ᪮,
W32/Klez.gen@MM       - McAfee,
W32.Klez.A@mm         - Symantec,
Win32.HLLM.Klez.57344 - Doctor Web,
W32/Klez-H            - Sophos,
Win32/Klez.H@mm       - RAV,
WORM_KLEZ.H           - Trend Micro,
W32/Klez.H            - H+BEDV,
W32/Klez.H@mm         - FRISK,
Win32:Klez            - ALWIL,
I-Worm/Klez.H         - Grisoft,
Win32.Klez.H@mm       - SOFTWIN,
Worm.Klez.H           - ClamAV,
W32/Klez              - Panda,
Win32/Klez.H          - Eset.

> . 38.   ७   䠩 窠  室      
> ...

    㪢쭮   ᫥饩  ࠭    뢠,    
 뫪   室,        ᠬ 窥
室.           ନ "窠 室",  ᫮
""    砥 譥.

>    . 39.  ...猪 ᥪ,  ᨬ   䨧᪮ ᬥ饭 
> 䠩,   ஥஢  ந쭮 㠫쭮 ...

    ...    ᮢᥬ   ⭮,            .   㧪
(஥஢)  ᥪ権    ந  ⪮  筮
㥬  .  RVA  ᥪ樨            
"ந".

>    . 40. ...䠪 㨫䠭.

    ᪮쪮   ,   䠪 䠭. ࠭,  ,
ய訩   楫 ,  㯮୮     ࠢ쭮  
䠬    ⮩  ᠬ  .    ᠬ  ᠥ   MZ - ઠ
늮᪨,    덮᪨. , :

    Mark J. Zbikowski,
    Senior Software Designer,
    Microsoft Corp. Redmond, WA.

      ,  ஢塞 ᪮쪨  , 祬  
__      祭      ࠭   
४ ଠ?

> . 43. ...᪮ ...

    祯⪠.   "".

>     . 46.     䠪  㧪  䠩  樮  ⥬  
> த뢠  ,    ⠡    "".
> 室  ᫥ 樨  ⥬,   ⥬ 室
> ⠡   ᮤন  Import Table,  ।⢥ ᠬ
> ᯮ塞 䠩 ࠡ⠥    䨪஢ ᠬ.

    ? -,         ⮬ ,   易⥫쭮
஢    ࠪ⨪.    ப,   쬥  .
䨣        祬  ⥬  ⠡  ᫥ ⮣,  
㧪 﫠,   ஥   稫 ࠢ?

>    . 55.  筮, ⮡ 祢 ⪠ ⢮  祬 
>  ஢ 䠩.

    祬  ,      ⮩    ? ,
    ?

>    . 56.    ᮢ襭      ᯮ         
> ࠧ UUE-஢... த "UsKL[aS4ijk".

      UUE,   Mime (筥,  Base-64).

> . 67. ...Jmp'  宩 ᪠  ᥬ 䠩

    , , -⠪  "" ⨫. :):):)

> . 88. ...ﬨ ਭ 뢠...

    . ਬ砭  . 23.

> . 88.       ॢ⨢  ,  ⨢
> ᪠       ࠩ 䥪⨢묨 ।⢠
> .

    . ਬ砭  . 16.

> . 91.    ,  㦥    ,  
> ⪭묨   ...

    ⥫     ਬ稪    ⠪ "".

>    . 92.    ,   㤠 ࠧ  ᪮쪨
>  設 (   , 祬  ).

    ᭮, ᫨  "᪮쪨 "  " " - ᪮쪮
? :)

>     . 99.   ஢       㡨    ⥢
> 䨫஬, - ࠭㧥஬  ⨧஬.

    ᥬ  .    ⮣,  ⠪  ࠭㧥  ᪠  ,
祬 .

>    . 99. ...  ଥ Intel IA-32...

     뫮  ⠪:  " ଥ  Intel  IA-32    Intel,
ࠧࠡ⠭ ମ Intel". 뫮  . :) ( ,   ਫ:
IA = Intel Architecture).

>    . 99. ...    䨧...

       ⥫  祭 ஡.   筮, 뢠, 
祬  .    襬,    ⮬   訢 -㣮,  
஬        ᢮  䨪      ணࠬ,
ਬ,  ⠪:  "䨪  _ਭ_  ᮢᥬ  ,  
ᥬ ⠫   " :) ,     뫮,  楢 ,
  ⫨   ⨪.

> . 99.    ᪮쪮  ᨬ  ⥣ ࠭,
> ।      ।  ᫥  뤥      
> ᭮  Outlook Express...

    -,             䨨   뢠   
࠭ (propagation),  ᪮ 楫 (targetting).

>  . 106. ஡ ᣥ஢ ᫥⥫쭮 砩  
> ⠩ ⢮  蠣,  ॡ      ᥩ
>   00 FFh. 祢,   100h 蠣 ⢨ 㬠
>     㤠.

      ᠬ 㡠 訡  .     ᪠.  
⠥  ᭮     ࠭   ⥢   ,
ᯮ饣  砩 ⥣ ᪠ 楫  ࠦ. 室
।뫪 ࠢ,  뢮 ⮦ (⥬ ,        
ࠪ᪨       ,  饭  祭  ࠭
ᮢ).    ⮤ ⥫⢠ - ઠ.  ᠬ  ஡
 ⮬,   _⢮__ , ᪠ IP-࠭⢮ 砩
ࠧ        ᮣᮢ뢠  ᢮  ⢨,  㥬   
    ⥬  IP-ᠬ.    ⮩ 樨, 
ਢ      ("஡   ᣥ஢..."),      蠥
୮  -  ਬ  ⭮   - .  
" ࠧ  砩 ᫠"  5- ᪥  "᪮  蠫".  
⮣, ࠧ⨥ ⮩  ਢ  쬠  १⠬ - .
 "  -३"  5- ᪥ "᪮ 蠫".

> . 107.  . 3.2. ᨬ 㤥쭮 ᪮ ࠭ 
>  ६.

     ᭥    㭪,  ,    ⮬  ,  室
ᬠਢ 㪢쭮  ᪮. :(

> .. 112.    ,    ⨢    ࠢ 
> ﬨ.  ਭ樯.

    . ਬ砭  .  16.  ஬ ⮣, ᫥  । 
⨥  "⨢".  宦,    殮 ᥩ   
 ⥪-䠣 ⨯ AidsTest. ,   ⮬ 砥, ,
  窮 ७  뫮  ᮣ. :)

>  .. 113. ...  ஧䨫...

    "஧䨋 -  த    ᥪ...    .." .  ᪨
横᪨ ᫮.  :  ᪠ 横, 1982. 㪢 ""
.

> . 121.    ⭨    㡫権,  饭   ஡
> ९...

     ,  .   -    ⮣ ᫠ १ . :)

> . 123.      室   ⠫       ०묨
> ⨭,  ࠡ⠫  ,  ⮬  뫨 ᪮஢
> 騬 ᨮ...

    ᨮ -      祫,    ண  __  ࠢ  
祭 ॡ㥬 १.   ⠭,  ࠡ ணࠬ
(㤦)  -   ᢨ⥫⢮ ࠩ ᨮ ணࠬ,
 砫쭮 ஭  饣 筮 ࠧ ⥫⮬,
⮡   ⫠. :)

>   . 126.  ᪮ ᪠... 㪠⥫ .

    ...   襩 ࠭ ⭨    㤥⮢ 
 ᪠,      ஥筨  ,      ᪠  㪠⥫
,      ᪮  (⠭  ISO)   "᪮"
(Turbo Pascal  Object Pascal) ਠ.       ᯥ᪨  
,  ⪭    ᠬ   ᢮ . :)

> . 126. ...BFG-900...

    -, BFG-9000. :)

> . 132.  ᭮  㦨  ?

     "" - 祣.     - 祭   "祣",  
 ணࠬ묨, 묨  ᪨. :):):) 祯⪠.

> . 142. ...ப ...

    ப. 祯⪠.

> . 142. "-筮"

        "ࠍ-筮"? 祯⪠.

> . 148. ⥫  "᪮ ᨮ᪮"  ...

       ᫮ ""? :) 祯⪠.

> . 150. ...⥪ NTDLL.DLL  KERNEL32.DLL ᥣ  
> ᭮ ࠭⢥  ...

     Windows 9X - .   Windows NT  ,      騩
KERNEL32  饭   ⫠稪,    ᫮.

> . 153. ...࠭  쥬  ᫮.

    ࠭. 祯⪠.

> . 159.  ...    ᪮  横  (ࠢ,    ⮬  
>  設 㧪     100%).

    Sleep()  横,   ஡  㦥.

> . 159. ...㢥 ࠤ樨 ᮯ⥫⢠...

    ,   ᠬ ,   35.      10-15 ᠫ  
᭮  - ࠭    ᨪ. :)

> .. 200.          ३   몠   ᯥ樠쭮
> ⪮, 饭 Microsoft.  饫  ᫥饩 뫪...

    ଠ쭮 ᮫⭮ ४,     - ᮫⭮  ᯮ
ᮢ.  ᪮쪮   ,  99%  IE ᨩ 5.0  5.5
⮪     த.

> . 201.  砫쭮,   । 稥  㣨 ⥬... -
> .

     ୥  - "।﫮",  ᠭ "third party".
,     "堪᪮"  (    ⮩  ࠭,  
) ᮢ, ⠭  "ண". :)

>     . 202.    ...ਮ᪨     ஫          ॥
> HKLM\...\Run...  ... ஫ ᯨ᮪ ᮢ, 뢠 
> Alt+Ctrl+Del...

    -,  ⮬    ᫥ 訢 ,
     묨  ᮢ⠬,  ᮤঠ    ᯨ᮪
  祩  ॥,  ⮤  ᫥  ⨢  ᮢ   
⮪,   ..    ।祫 ଠ쭮 ⯨,   "计
㫮",  ந   ᢮   3-4-⭥  ,
㦥  ⮣ ᯮ.

>     . 202.  ...让   㤥, ᫨  㤠  யᠭ
>   ணࠬ ( 㦥).

    -,   "।  ᮢ"    ᪮쪮     ⠫ 
ᯮ ⮣   ᯥ᪨,  ,   ୠ "ணࠬ".
  ᠬ   ⮨ ⠪ 㯠 (ᮡ  ⭮襭  "䨫
"). "ॢ ". :/

>     . 209.  ⭮,     襥 २⢮  砥
>  ,      ᮢ襭⢥    ⢮  ,   ,  
> ६ ந  ஭⥫ ᮮ㦥.

    -,   ⠪          宬  ભ   ᠭ
᪮, ૠ,  㢮஢    㧮,  ࠫ ᨫ 
蠫 㪮,    ᠬ ᨫ . :)

> . 207. Boot form secondary device

      "from". 祯⪠.

> . 212. , 訢騩  ᪨ .

          3  ࠢ.  쪮     
  ,    ?  ⥯ 檥   
5      㣮  㬠 "ᢥ" ⫥ﬨ.

> . 216.  ...⨫ DUMPBIN,  室      ⠢
>  Windows-.

     ᠬ  , 祭   .

> . 251.  ...᫨  ᡮ 誨 -6  騬 ,   ᠭ
> ᮢ६ ...

    " ⠩    ।        ᮢ᪨   !"   ()   .
८ࠦ᪨.  :)   ⮨  ਣ쭮   ணᨢ
⭮  ⥪     .  筠 ࠡ⪠ 
⪠ ,  ᮡ࠭  ⢥ ⭮    ࠡ⠢襩  
ଠ  ᫮  ᯫ樨 ...  ᪮쪮   㬠?...  ᥣ
᪮쪮 ⪮ ᮢ!    "ଠ" ᫮   ⮣  .
:(     ॠ ,    থ ᯮ  㦮
ᮬ᪮ .

>     . 254.  ᫥  稯  VIA  KT133,    㦨 ᪮쪮
> ᪨ 訡 ஢騪 ।...

    ... 쭮  ⢥ত.  :)  ,      
  ଥ  㬥    稯,   ਭ樯
奬      ࠡ  ஢騪  ।?        
奬 쭨    ᠬ⥫쭮  ࠧࠫ    ன⢥ 
⬠?

                         2. 騥 ⫥

     ᫥      KPNC     200%    १⮢  ᢮
⥫쭮:  ᭠砫 㡫 ⤥   ࠧ ୠ,
⮬ 몫뢠   ୥,   ᮡࠥ     
 . 砥 "⥬᪨ ᡮ୨ ⥩".
    , ᮬ,     ᠬ  ,    ஦  
쪮  த  㬠࠭ (筥,  ᪮࠯)   -
⢥ 筨 ⢮.  :)   窨 ७  楫⭮
   쭮-⠪ 諥. :(
     ,   訡        㦨.      
,     .    (ᮡ,  饭 UNIX) 
 ஫⠫   ᮬ.  㬠,  ॠ ᯥ 
  ᪠          ⢮ ࠧ  
饩.
     ⮬ ,   ⭮,   訡 ,   祣  .
  ⮩   ࠧ 祣   ᤥ. :(
       稭   ꥬ "ॠ",    
ୠ᪮  ᮤঠ    祭  樮,    쬠
४ .  -     ⥫ ᠬ
⥩.  ⭮,   ॠ  ࠧ  ⥩,  ⠭  ,
⨢   (⭮,  ⮬,  ᠭ  ࠧ ६
 ⠭   ࠧ  㣨  ⥫).  ,    ६
ந ⫥ ஢ "ᢥ".  ⮨   ।
ࠧ 㡫  ᨫ쭮  ॢ訥    ⠬         
 ० ?
       ࢠ    ,   ன ࠪ᪨ 
᪨ "쪨",  "ﯭ⮥ ",  "᪫  ",  "룠
",  "ন      墮"  稥 ࠧ  ਨ,
묨 쬠    ᥣ   뫨 믠 ।騥 
㯮⮣ . 祬,      "᪨
 㡭"  " -ன".  :) ⮪      -०
쭮   ("" ४ࠬ ⥫⢠ ""),     
⮫ "䠪⮢" ⮦ 墠⠥ ("" ᠬ ).
    ⭮, ஬  ।    ४      
 室 業஢.  ⮡ - ᮢ
쪠 ( 쪠) 㣠    ,   .
     饬  楫     㤮⢮ਫ.  :(    稫
ﭨ⮩  筮.    ᯮ짮   ࠢ筨 
ᯥ ( ⭮   ଠ樨      ),    
祡   砩 (  ࠧ ⠭  祫,  
ࠩ      ਢ襣    ⥬  ணࠬ஢).
 ,   ᢥ   ࠧ諥   ⮦  쪨 
    .      ,  筮,  -ன    
(ਬ,    " १ ࠭㧥"  訥 ᪨ 
 "  UNIX").   業⮢ 10 饣  ꥬ.
    祬,   ᢨ⥫⢠,    訫    
稭 "᪨-2"  "᪨ "  (  ࠩ  ,  㦥
   ୥   㧪 PE-ணࠬ   ७ 
 ᮢ).      몮  ப. :) ,  堯
஡,        㤥  ⤥쭮 ,     ⢥
ਫ    -  "।᪠  "     "
"   (      ᢮   ६      "饭   ୥"  諨
஭᪨ 䠭⠧).
    ᫨   ⮣   -⠪ "᪨-2",     
ᠫ  "孨 ⥢  ⠪-2"          頭
"祡  ᥬ".
    ,   ᪠.
