Description: vb毁灭杀毒软件的原程序，加载驱动。
不结束杀毒软件进程，直接删除文件。
提供附加的Command(安静&有Msgbox两种形式）-vb destruction of the original anti-virus software program, load the driver. Antivirus software is not the end of the process, delete the file directly. Provide additional Command (quiet & have Msgbox two forms) Platform: |
Size: 20480 |
Author:侯文彬 |
Hits:
Description: SSDT的全稱是System Services Descriptor Table，系統服務描述符表。這個表就是一個把ring3的Win32 API和ring0的內核API聯繫起來。SSDT並不僅僅只包含一個龐大的位址索引表，它還包含著一些其他有用的資訊，諸如位址索引的基底位址、服務函數個數等。
通過修改此表的函數位址可以對常用windows函數及API進行hook，從而實現對一些關心的系統動作進行過濾、監控的目的。一些HIPS、防毒軟體、系統監控、註冊表監控軟體往往會採用此介面來實現自己的監控模組，
目前極個別病毒確實會採用這種方法來保護自己或者破壞防毒軟體，但在這種病毒進入系統前如果防毒軟體能夠識別並清除它將沒有機會發作.
-SSDT s full name is System Services Descriptor Table, the system service descriptor table. This is a table of the Win32 API and ring0 ring3 kernel API link. SSDT is not only a huge address contains only the index table, it also contains some other useful information, such as the address of the index base address, the number of functions and other services.
Function by modifying the address of this table can be used for windows functions and API hook, in order to achieve the action of some concern to filter systems, surveillance purpose. Some HIPS, antivirus software, system monitoring, registry monitoring software often uses this interface to implement its own monitoring module,
At present very few virus does use this method to protect themselves or to destroy anti-virus software, but if the virus before the antivirus software into the system and clear it will not be able to identify opportunities to attack. Platform: |
Size: 335872 |
Author:小明 |
Hits:
Search - Destroy AntiVirus