VS start taking images of soft kill, talk about the kernel and process protection, to detect hidden drivers in the kernel process and directly call the NTFS file driver detects hidden files, executable files through the software firewall implantation

再谈内核及进程保护
..................\Protect
..................\.......\MAKEFILE
..................\.......\objfre
..................\.......\......\i386
..................\.......\......\....\Protect.sys
..................\.......\Protect.c
..................\.......\Protect.dsp
..................\.......\Protect.dsw
..................\.......\SOURCES
在内核驱动中检测隐藏进程
........................\code
........................\....\Release
........................\....\.......\Ring0.sys
........................\....\Ring0.c
........................\....\Ring0.dsp
........................\....\Ring0.dsw
........................\....\Ring0.opt
........................\涉及驱动加载软件
........................\................\Dbgview.exe
........................\................\DrvLoader.exe
映像劫持VS启动杀软
..................\IFEO Hijack
..................\...........\IFEO Hijack.cpp
..................\...........\IFEO Hijack.dsp
..................\...........\IFEO Hijack.dsw
..................\...........\IFEO Hijack.ncb
..................\...........\IFEO Hijack.opt
..................\...........\IFEO Hijack.plg
..................\...........\ReadMe.txt
..................\...........\Release
..................\...........\.......\IFEO Hijack.exe
..................\...........\.......\IFEO Hijack.obj
..................\...........\.......\IFEO Hijack.pch
..................\...........\.......\StdAfx.obj
..................\...........\.......\vc60.idb
..................\...........\StdAfx.cpp
..................\...........\StdAfx.h
植入执行文件穿越软件防火墙
..........................\asm.txt
..........................\Inject
..........................\......\Inject.asm
..........................\insert.txt
..........................\readme.txt
..........................\SERVER
..........................\......\CommonDlg.cpp
..........................\......\RESOURCE.H
..........................\......\SERVER.CPP
..........................\......\SERVER.RC
..........................\Setup
..........................\.....\INJECT.DAT
..........................\.....\RESOURCE.H
..........................\.....\SETUP.C
..........................\.....\SETUP.RC
直接调用NTFS文件驱动检测隐藏文件
................................\ntfsrdsys
................................\.........\main.c
................................\.........\MAKEFILE
................................\.........\ntfsrd.sys
................................\.........\NtWrap.c
................................\.........\NtWrap.h
................................\.........\Sources
................................\ntfsrdusr
................................\.........\main.c
................................\.........\ntfsrdusr.exe

• We are an exchange download platform that only provides communication channels. The downloaded content comes from the internet. Except for download issues, please Google on your own.
• The downloaded content is provided for members to upload. If it unintentionally infringes on your copyright, please contact us.
• Please use Winrar for decompression tools
• If download fail, Try it againg or Feedback to us.
• If downloaded content did not match the introduction, Feedback to us，Confirm and will be refund.
• Before downloading, you can inquire through the uploaded person information

Nothing．