Chapter 034: Virus Analysis (Part 2)

The analysis results of the master boot record of the hard disk show that the master boot record of the hard disk has been tampered with by a virus, Xiao Yuan carefully analyzed the analysis report of the master boot record, and speculated with his own experience, and basically figured out how this virus works:

There is a built-in judgment program in the main boot record, this judgment program will first detect whether the network port of the computer is open, if it is open, he will diverge itself to the network in the form of broadcasting, if it is not open, then he will not take the initiative to spread the network, go to the next process, detect the hard disk, judge whether the hard disk is infected by the CIH virus, if it is infected, he will hide himself, without any action.

If the judgment program finds that the system is not infected, then, it will copy the CIH virus stored in a small hidden partition at the end of the hard disk to the system folder, and set it to start automatically with the system, after doing all this, it will hide itself again, when the system starts, the CIH virus will run with it, infect the system files, and then the destruction of the system will be handed over to the CIH virus.

This judgment is completely based on the fact that there is a complete Windows system in the hard disk, if it finds that there is no operating system in the system, that is to say, the hard disk may have been formatted, then this judgment program will run another program that is stored in the same hidden area as the CIH virus, this program Xiao Yuan deduced from the previous situation, it should be the game program.

Logically speaking, the working principle of this judgment program is not particularly complicated, so Xiao Yuan easily made the above inferences.

Exited the hard disk analysis program,Xiao Yuan ran a disk partition management software again,This software is more powerful than the fdisk that comes with the system,It can detect those hidden partitions that fdisk can't find,After running,The software gives a list of disk system partition tables,Sure enough,At the end, there is a hidden partition with only one megabyte,CIH virus protoplasma and the alphabet game program they played before are hidden here。

At this time, Xiao Yuan suddenly thought that Tang Xinyu partitioned the disk just now, using the built-in partition command fdisk of the system, then, after he finished dividing those hard disks, this small hidden partition should not be destroyed, but firstly, because this partition is hidden, and secondly, the viruses stored in this partition need to be extracted from the program of the master boot record to run.

In order to verify his thoughts, Xiao Yuan took a hard disk of a student machine that had not been installed on the computer and tested it, and sure enough, after Tang Xinyu repartitioned, he only destroyed the judgment program in the main boot record, and the hidden partition at the end of the disk was still there, Xiao Yuan deleted this partition easily, and the virus in it was completely destroyed.

Tang Xinyu was still doing his work, but he was also paying close attention to Xiao Yuan's side, he saw Xiao Yuan pick up a hard disk he had divided into a hard disk and put it on the computer, and did some more operations, so he took advantage of the time that the ghost clone was waiting and came over.

"The virus hasn't been killed yet?"

"Well, there's still a little bit of ...... left."

Xiao Yuan told Tang Xinyu about the results of the analysis just now, and then asked Tang Xinyu to delete the last hidden partition of all hard disks when the hard disk cloning was idle, and he himself copied the CIH virus protoplasma in the hidden partition, because he did all this under DOS, and CIH virus could not infect DOS, so he was not worried about any danger in this move.

After copying it out, he disassembled the virus, and then began to study the assembly code of the virus to see how it bypassed the CIH virus immune patch set by himself, studied it for a while, and suddenly sighed with a smile: "So that's the case, it's really barbaric!" ”

Before the original CIH virus infects the computer, it will detect whether the machine has been infected, and if it has been infected, the virus will not be re-infected, and the immune patch set by Xiao Yuan takes advantage of this to forge a false impression of being infected by a virus in the system, so as to achieve the purpose of deceiving the virus, but this modified virus is a very barbaric, but effective way, regardless of whether the computer is infected or not, it will be re-infected, in this way, The patch set by Xiao Yuan naturally had no effect.

Xiao Yuan continued to analyze the virus code and found that the onset time of the virus was set to 10:30 a.m. every Thursday, instead of the original April 26th, June 26th and the 26th of each month, which led to the outbreak of the machine virus in the computer room this morning.

Aside from the above changes, this virus is no different from the original CIH virus, so Xiao Yuan deleted it after figuring out how it worked.

At this time, Tang Xinyu had already installed all the systems of the student machine, and the last Yizang partition was also deleted by him, and after he was free, he also came around, pulled a chair and sat next to Xiao Yuan, watching him keep busy.

When Xiao Yuan saw Tang Xinyu coming, he introduced the conclusions he had obtained from his analysis to Tang Xinyu, but he didn't want to attract the dissatisfaction of Tang Sa, who was sitting on the other side.

"Giggles, brother, you're so eccentric, my sister has been sitting next to you for so long, and I don't see you explain it to your sister."

"You're doing this yourself, and you still need me to explain it to you?"

Xiao Yuan didn't look at her, and retorted directly, Tang Sa had been sitting next to him very quietly just now, so much so that when he was concentrating on analyzing the virus code, he actually forgot her existence for a while, this situation made him think about it now, a little surprised, but because he was worried that she would harass herself by using the topic, he still didn't dare to give her a good tone.

"My sister is the boss, does it matter if I understand this?" Tang Sa said dissatisfiedly.

Xiao Yuan ignored her, but continued to talk to Tang Xinyu.

Tang Xinyu looked at his old sister with an unhappy look, and a wry smile appeared on her face, she is also in her twenties this year, why is Xiao Yuan here, she always seduces Xiao Yuan from time to time, and this moment she is like a little girl who has been left out in the cold, I really don't know what she wants, he has seen the cold and capable appearance of the old sister when she is in the company to the employees, the old sister at that time and the old sister now are completely two people.

However, Xiao Yuan was lukewarm to his sister, and even completely ignored her beauty and seduction, which also made him feel weird, and he muttered to himself in his heart, could it be that Xiao Yuan is not interested in women, otherwise his sister is so sexy and beautiful, and from time to time he makes some deliberate seduction, how could this guy not react in the slightest.

Xiao Yuan didn't care whether Tang Xinyu understood it or not, he spoke quickly, and it took seven or eight minutes to finish what he thought he should say.

After explaining to Tang Xinyu, Xiao Yuan was ready to analyze the word game, and after copying the game, he found that the game file was not an executable file under Windows at all, but an executable file belonging to another system, and it could not be run under DOS at all.

All the work was done, Xiao Yuan also partitioned the hard disk on the teacher's machine, and then installed the operating system, as for the hidden partition, because there would be no harm to the computer, and because there was a game he was very interested in that was not analyzed, so he kept the hidden partition for the time being, and did not delete it.

After all the work was done, it was already more than ten o'clock in the evening, Xiao Yuan did not continue to stay here, and was ready to get up and leave.

"Xiao Yuan, what are you going to do with that challenge?" Before leaving, Tang Xinyu asked.

"Now that everyone has sent the war book to our computer room, it is natural to accept the challenge." Xiao Yuan replied, then smiled mysteriously, and then said, "But it seems that this guy is preparing for an online competition, and I haven't learned in this area yet, so I'm going to go back and talk to my master, and let his old man go out in person, hehe." ”

"By the way, do you want to copy a copy of this website?" Tang Xinyu took out the piece of paper that copied the website and asked.

"No need, I've memorized it." Xiao Yuan waved his hand, no longer stayed here, and strode away.

Walking on the streets of Nanzhou City on a bicycle, a cool breeze blew, Xiao Yuan raised his head, and let the cool night breeze blow his hair flying, feeling very comfortable.

From Nanzhou Yigao to Donkey Market Street, he needs to pass by in front of Xizi Lane, Xizi Lane is called Lane, in fact, it is a north-south street close to the wide Nanhe River, where nearly half of the restaurants, bars and dance halls and other entertainment venues in Nanzhou City are concentrated.

Xizi Lane has always been the most lively place in Nanzhou City's nightlife, outsiders come to Nanzhou, ask where to have fun, locals will generally recommend Xizi Lane to them, but the old Nanzhou people, but they know that Xizi Lane is actually the largest red light district in Nanzhou.

Xiao Yuan is a native of Nanzhou, although he passes by here every day, but in view of his age and his father's strict control of him, he rarely goes to Xizi Lane, at most, when he passes by, he turns his head and looks inside curiously.

It's the same today, Xiao Yuan passed by the intersection of Xizi Lane, habitually looked inside a few times, but suddenly found an acquaintance very unexpectedly.