希望有人描述这些代码行如何工作并解释其是否为病毒？

Question

这可能是违反某些TOS规则或类似规则的，但是我安装了一个程序并即时询问它是否会是病毒，但是如果有人能够告诉我哪种编程语言，我将不胜感激，因此我可以可能会学习它，因为代码看起来很时髦，我认为学习一些新颖的东西会很有趣。

我添加了DOS标签，因为文件扩展名为.sys，并在Google上说它在DOS和Microsoft Windows操作系统中使用。

MZ?       ÿÿ  ?       @                                   è   º ?   Í!?LÍ!This program cannot be run in DOS mode. $       é???øfß?øfß?øfßö?eÞ?øfßö?bÞ?øfßö?gÞ?øfß?øgß?øfß??bÞ?øfß??cÞ?øfß??dÞ?øfßRich?øfß                        PE  d? \ñ]        ð " 
                   @         


        p     ??   `A                                            P  <            @  ?   $  x   `      !  8                           @!                Ø                           .text   ?                          h.rdata  ?                        @  H.data   X   0                    @  È.pdata  ?   @                    @  HINIT       P                       b.reloc      `      "              @  B                                                                                                                                                                                                                                                                                                H?\$WH?ì HcÁH?=   I?ØL?ÊE3ÀH?T$@H?LÇøèh  Ç   ?Àx!?
ä#  ?ÑH?D$@?âÿÁ?
Ò#  H???Bë?ÈÿH?\$0H?Ä _ÃÌÌÌH?ì(HcÁH?
ª  H?LÁøèÜ  3É?À?Á?AÿH?Ä(ÃÌH?\$WH?ì HcÙH?=|  H?Lßøè  3É?ÀH?LßøH?\$0?Á?AÿH?Ä _ÃfÁÉ?ÁÃ3ÀÃÌH?ì(HcÁH?
>  D?D$0L?D$0H?LÁøèª  ?Éÿ?ÀIL$0?ÁH?Ä(ÃÌH?ì(HcÁH?
  D?D$0L?D$0H?LÁøè?  ?Éÿ?ÀIL$0?ÁH?Ä(ÃÌH?ì(E?ÀA?   EEÈD?Â?ÑH?L$Hè  ?Àx(?
?"  ?ÑH?D$H?âÿÁ?
?"  H?
?  H?Ñ?Bë?ÈÿH?Ä(ÃÌÌH?\$H?t$WAVAWH?ì@L?ñI?ÙH?ÁI?øL?úèp  I?FE3ÉM?V(E3ÀI?3ÒL?T$0H?@H?\$(H?|$ ÿø  H?T$`?D$`I?Nèv  ?|$`?ÿxAº0   A?Ks  ?JÑÿ  H?ØH?Àu??  Àë I?N(H?I8H?H?   H?HH?Hèp  I??ÇH?\$hH?t$pH?Ä@A_A^_ÃÌÌÌH?\$H?t$WH?ì0H?ùH?ÚH?Áè?  H?GE3ÀL?O(H?ÓH?H?@ÿK  H?T$@?D$@H?OèÉ  ?D$@H?\$HH?t$PH?Ä0_ÃÌH?\$WH?ì H?ùH?ÁèZ  H?GH?W(H?H?@ÿù
  H?T$0?D$0H?Oèw  H?O(ÿu
  ºKs  H?Ïÿ
  ?D$0H?\$8H?Ä _ÃH?ì8ÇD$    è   H?Ä8ÃÌÌH?\$H?l$H?t$WAVAWH?ìpD?úE?ðº0   H?ñA?Ks  A?é?JÑÿ?  H?ØH?Àu
??  Àé?   H?Hè#  ?È?À??   H?K(D?Í??$?   E?ÆH??   H?L$PH?d$H H?d$@ H?d$8 H?d$0 H?d$( H?@H?
R   ?T$ A??ÿô  H?T$`?D$`H?Kèr  ?L$`?ÉxH?C(H?@8H?H? H?CH??ÁL?\$pI?[ I?k(I?s0I?ãA_A^_ÃÌH?ì(H?
ý  è[  H?
ñ  H?Ä(éQ  H?ì8H?d$  H??  H?Ð  H?D$(H?L$ è  ?ÀxL??  ?ÊÿH?
?  è  H?Ä8ÃÌÌH?ì8ÆD$  è   H?Ä8ÃÌH?ì8ÆD$ è   H?Ä8ÃÌL?ÜI?[I?sI?{ AVH?ìPE?ñI?ðL?ÒH?ù?d$8 A? I?CèI?cÈ E3ÉE3À?T$@I?Êÿc
  H?D$03ÒD?BH?Èÿ7
  ?H?Oè  H?GL?O(H?E?ÆH?T$0??$?    tH?@0ëH?@8ÿ?
  ?D$pH?T$pH?Oè  ?\$p?Ûx    H?G(?H8?H?L$0ÿÚ
  ë?  ÀH?L$0ÿè
  ?ÃH?\$`H?t$hH?|$xH?ÄPA^Ã@SH?ì E3ÀH?ÙA?Pÿr
  3Ò?ÿ?
  H?CH?Àu??  ÀëH???   H?
"   H?HðH?XøÆ@?à3ÀH?Ä [ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌH?ì(I?È3ÒE3Àÿ&
  ?  ÀH?Ä(Ã@SH?ì H?Ùÿ
  H?Kº  Àÿ>
  H?CH???   H??ÿÿÿH?BðH?ZøÆB?àH?Ä [ÃÌÌH?\$WH?ì0?H?ÚH?ù=  uH?d$  E3ÉE3À3Òÿ?    H?G?@0?H?\$@H?Ä0_ÃÌÌÌH?\$WH?ì ?ÚL?)  H?ù3Ò3ÉÿÄ      D?ËL?Ç3Ò3Éÿ?    L?  3Ò3ÉH?\$0H?Ä _Hÿ%?      L?ÜH?ìHI?cè H?m  I?c I?KI?CàE3ÉI?cØ E3Àº   ÿj   ?Ày?ÐH?
m  èlÿÿÿ?  Àë
H?L$`ÿN   3ÀH?ÄHÃÌÌÌH?ìhH??  H3ÄH?D$PE3ÉH?T$(WÀÇD$ $VHVWÉÇD$$   H?T$ E?A0óD$0óL$@èYùÿÿ?øÿ?ÀH?L$PH3Ìèþ  H?ÄhÃÌ@SH?ì@H?d$P H?T$PH?d$X H?Ù?    ÿÖ  ?Ày HÇÀ
  Àëp?KH?T$Xÿ?  ?Ày
H?L$Pÿ?  ëØ?C H?L$`L?KL?D$PH?SH?d$` H?L$0H?L$XÆD$(H?D$ ÿm  H?L$PHcØÿW  H?L$XÿL  H?ÃH?Ä@[ÃÌÌÌ@SH?ì ?Q3Û?ÒtK?út
HÇÀ  ÀH?Ä [Ã?IH?T$0H?\$0ÿ  ?ÀxH?L$0ÿ  H?L$0H?Øÿï  H?ÃH?Ä [ÃH?ÁH?Ä [éðþÿÿ@SH?ì H?ÙL?  3É3Òÿ?  L?Ã3Ò3Éÿ?  L?ú  3Ò3ÉH?Ä [Hÿ%?  ÌÌÌÌÌÌÌÌÌÌ@SH?ì`H?ã  H3ÄH?D$PH?ÙH?
A  è?ÿÿÿWÀD$ D$0D$@ë'?ør"?|$ $VHVuH?L$ èÿþÿÿH?Ð?Ëèéýÿÿ?ÀtE3ÉH?T$ ?ËE?A0èB?ÿÿ?ÀÂH?
ó  è6ÿÿÿ?ËèçöÿÿH?L$PH3Ìè
  H?Ä`[Ã@SH?ì@H?G  H3ÄH?D$0WÀ?   D$ ?ö   f?\$ èÛöÿÿE3Àf?D$"?Sÿ?Ëè=?ÿÿ?Ø?øÿuH?
  èÆþÿÿ?ÈÿëHA?   H?T$ ?Ëè?öÿÿ?øÿuH?
û  è?þÿÿ?ËèOöÿÿëϺ
   ?Ëè?öÿÿ?øÿu  H?
õ  ëØ?ÃH?L$0H3ÌèT  H?Ä@[ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌH?\$WH?ìpH?  H3ÄH?D$`èºùÿÿ?Ày?ÐH?
  èüÿÿé?   èÿÿÿ?Ø?øÿuH?
  è
þÿÿèfùÿÿé?   ºö   H?
-  èÌûÿÿëEH?d$H H?)þÿÿHcÏE3ÉH?L$0E3ÀH?D$(H?L$HH?d$  º   ÿ?  ?Àx^H?L$Hÿy  ?d$@ L?D$@WÀH?T$P?ËD$Pè?ôÿÿ?ø?øÿu?H?
Õ  èxýÿÿ?Ëè)õÿÿH?L$`H3ÌèL   H??$?   H?Äp_ÃH?
?  èJýÿÿ?ÏèûôÿÿëÉÿ%{  ÿ%]  ÿ%_  ÿ%a  ÌÌÌÌÌÌÌff?     H;
I  uHÁÁf?ÁÿÿuÃHÁÉé   ÌÌ  ÌÌÌÌÌÌÌÌÌÌÌÌÌ?   Í)ÌÌÌÌÌÌÌÌÌÿ%Š  ÌÌHƒì(M‹A8H‹ÊI‹Ñè
   ¸   HƒÄ(ÃÌÌÌHƒì(A‹ L‹ÉD‹ØL‹ÑAƒãø¨tA‹@McP÷ØLÑHcÈL#ÑIcÃN‹H‹B‹HH‹BŠTöÂt ¶ÂƒàðLÈM3ÈI‹Éè>ÿÿÿHƒÄ(ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌff„     ÿàÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌH‹ÁIƒørG¶ÒI¹I¯ÑIƒøOsPM‹ÈIƒáøIÉfD  J‰TøIƒéuõIƒàtJ‰TøÃf„     Iƒàt
BˆT ÿIÿÈuöÃfffffff„     fHnÂÀLÁHƒÁHƒáðL+ÁM‹ÈIÁét/))AHÁ€   )A )A°IÿÉ)AÀ)AÐ)Aà)AðuÕIƒàM‹ÈIÁétfD  HƒÁIÿÉuôIƒàtBDðÃÌÌÌÌÌÌÌFailed to create server thread. Status code: %X. ÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌ[socksrv]  ÌÌÌÌÌ
 ÌÌÌÌÌÌÌÌÌÌÌÌÌÌFailed to create listen socket. Failed to bind socket. ÌÌÌÌÌÌÌÌÌFailed to set socket mode to listening. ÌÌÌÌÌÌÌÌNew connection. Connection closed. ÌÌÌÌÌÌÌÌÌÌÌÌÌFailed to initialize KSOCKET. Status code: %X. ÌFailed to initialize listening socket. ÌÌÌÌÌÌÌÌÌListening on port %d. ÌÌÌÌÌÌÌÌÌÌFailed to accept client connection. ÌÌÌÌÌÌÌÌÌÌÌÌFailed to create thread for handling client connection.                                                                                                         &Q      >Q      VQ      Q              pQ      ˆQ      œQ      °Q      ÀQ      ÎQ      æQ      üQ      R      R      ,R      8R      DR      RR      jR      xR      R      šR      ²R      ÈR      æR              à @     @           €  à  ð      \ñ]       {   H"  H      \ñ]    
   <  Ä"  Ä                                                                                                0 @                   Ø  @   à  @   è  @           E                                                                                                                     RSDSu[ùб׽B°G]ξu   C:\Users\jonttufin\Desktop\rw_socket_driver\kernelmode_server\x64\Release\kernel_socket_server.pdb           .text$mn      0   .text$mn$00 À  ð   .text$mn$21 °  è  .text$s     Ø   .idata$5    Ø      .00cfg  è      .gfids   !  H  .rdata  H"  ¸  .rdata$zzzdbg    $  „  .xdata   0      .data    0  8  .bss     @  ˜  .pdata   P  (   .idata$2    (P     .idata$3    @P  Ø   .idata$4    Q  þ  .idata$6      B  

4 
2p  b    B    d T 4 Òðàp

4 
2p  d
 4   R
p
  d 4
 rð
à
p

  t d
 4 ’à        "     ˆ    20

4 
Rp  ‚  

4 
2p  r0 I20  Â    P     r0  0     20  ²0  P    
4 
Òp  `                                                                                                                                                               2¢ß-™+                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             e  $  h     $    È  $  Ô     $    ;   $  <  ’   $  ”  Y  t$  \  »  `$  ¼     P$     6  $  8  7  4$  8  X  ($  X  ž  $     ³  $  ´  Ç  $  È  °  Œ$  °    ¼$    ,   $  ,  n  ¼$  p  ±  È$  ´     ä$     a  Ø$  d  Ç  %  È  m  ô$  p  Ø   %  Ø    8%     ¼  D%  ¼  r  $%  €  —  X%  À  Þ  p%    %   $  (  ‡   $     ¥  x%  À  ©  €%                                                                                                          @P          fQ      hP          S  (                           &Q      >Q      VQ      Q              pQ      ˆQ      œQ      °Q      ÀQ      ÎQ      æQ      üQ      R      R      ,R      8R      DR      RR      jR      xR      R      šR      ²R      ÈR      æR              WskRegister WskCaptureProviderNPI WskReleaseProviderNPI 
WskDeregister NETIO.SYS  ExAllocatePoolWithTag Ä ExFreePoolWithTag  KeInitializeEvent ’KeResetEvent  ¡KeSetEvent  ËKeWaitForSingleObject EMmProbeAndLockPages [MmUnlockPages kIoAllocateIrp mIoAllocateMdl ÀIoFreeIrp ÁIoFreeMdl NIoReuseIrp  Ù
__C_specific_handler  Z DbgPrintEx  rPsCreateSystemThread   
ZwClose ObfDereferenceObject  MmCopyVirtualMemory áPsLookupProcessByProcessId  ?PsGetProcessSectionBaseAddress  ntoskrnl.exe                                                                                                                                                                                                                                                   Ø?à???????À?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            x    0?g *?H??
??X0?T1
0   + 0?@
+?7??00?,0?
+?70?ö ??ð??í?µ?Õ??$f??Ú?`Ö?Ø1?Õ0?Ò
+?71?Ã?À    Û?AÕ?3?4??-?Ð?   t8
s>?C"ªÃãæQü???â   m.FÕE0???óëì+?-%??   ß' ?RÚºyì??gâÈÚ)I*   ?AÍ^'ÿE??æãæÃ+Éë   vçÌÿ;7J?P[?#ÐRíÜ&?µ "   ÃðÄ?MÒM3?|0"B%{+1 $                      0!0 + Æ?U??ø?U7?rÏÈv?Ê??0?0?ü?q-Bæ1??G?ç?z ??0
    *?H??
 03110/U(WDKTestCert jonttufin,1320619273301513210
190628105213Z
290628000000Z03110/U(WDKTestCert jonttufin,1320619273301513210?"0
    *?H??
 ? 0?
? ?qn{-q5?zaQ?áõpß??7?BF?gÊ#??Ü?!FnjÚ??6/6ÄG?û03ù^zjßà:Ñl?5óv$?)ç??Ã?Ï??Úÿ2cÛÛ#?Äë?åÚ}?ê
þ
dÃ?????º\?Ó?<êÓùT@ ÀÛ?c_?àHM?À?CQüÔ??
p`ÁÆ@?6Óey?Gö?Ú?'1"º?
ÄÒ
sn$?n???N?î??(??ÃL}ýøD9??`-iÚc??µ.9\ùG??ãq?X'ñgVÍ??
Î~"ª??c- öt?&o??èðâý ?$0"0
U00U%0
+0
    *?H??
 ? +1?ÎÆé0äÄÊ??'??í~?7[H1?iÁþ1??éÇia.#?,Z àMç?eû?RpL?``í??ªUQn[E+ÀCÙòD0?[?Ç4    ?u?JmB[HªAÏ?:?`7Gõ?Ñ"Ð?p?éÛ]âøB ?Ëîú~5ñ*R?
iv?úKØBæ>oªÒ?&Izn[ÏK?ì$??b?Íe&À?=éYîõl*Ç͵?*#@ì
?GY?àé???i`É?]?ÙM
%ä3?ÎÎä?Âé$mò?z??éVÀ~??Ö^?`?`jàímKT#À?8µBSºßf1?à0?Ü0G03110/U(WDKTestCert jonttufin,132061927330151321q-Bæ1??G?ç?z ??0   + ?p0
+?710 0 *?H??
    1
+?70
+?7
10
+?70#   *?H??
    1Å???Ôþ?lÖ}æ/???Hz?0
    *?H??
 ? ?ªN?+?)r???&h"1ñì?~v?ƪ???U_á??H0yh??ñ?????ïÏxí??O-jô
9l?$
ÉVÚZôe7â?)º?Uª?ó?û-c??????>J?Ùä:εðn?}ä?âêw3?VOÝôÖ??ÔdÒ??ëÛ ?ær?CÇ??*ÅÈå@2?9?poáüOVÉ3?ÌðÀ?q???ËDýG?ÃH?]?ê`p?æü?Ï.VéU?}o?Ï#ØR'9?Ëé??3ê?
èEÜÈN?áR?òÅhE
Ò?$?Ü/?&é?åÃ}??ÖS??Ð]Ø_EK   

在病毒总数上，除了一个病毒外，所有人都说它不是病毒，但是这行代码看起来像是它试图关闭ntoskrnl.exe一样，我对其进行了搜索，而且看起来必须如此蓝屏死亡的发生。

Answer 1

我同意Nick McDermaid的观点，文件内容代表可执行代码，并不代表人类可以阅读。有一些程序可以对可执行代码进行反编译，称为“反编译器”，但是我敢肯定，您将需要对其进行大量修改。例如，this one使用.NET编写的代码。

如果您担心病毒，并且系统上已安装防病毒软件，则可以右键单击文件名并进行扫描。