利用反钩挂技术侦测隐藏进程的攻击

为躲避查杀,先进的木马病毒都采用了进程隐藏技术来运行。通过分析可知,为了实现进程隐藏,实现对API函数的钩挂必不可少,因此,实现反API函数钩挂技术就成为了监测使用了隐藏技术木马的关键。在讨论了在用户空间内侦测各种API函数钩挂技术的关键技术的基础上,提出了可靠的枚举进

Detection of Attack by Hidden Process Using Anti-hook Technology

To avoid being scanned and killed,the advanced Trojan run under the system of hidden process.By analyzing these virus,the fact was known that,if you want to implement the hidden process,API hook is necessary.Therefore anti-hook has become the key technology of detecting Trojan using hidden process.The method of reliably enumerating modules in a progress and detecting the deep inline hook were put forward while the technology of detecting all kinds of HOOK in user-mode was discussed.The practice illustrates that using anti-hook technology can make scanning and killing Trojan easier by exposing the hidden information about these Trojans.