首页
社区
课程
招聘
[转帖]XueTr (Malicious code detection)
发表于: 2012-6-1 21:02 2251

[转帖]XueTr (Malicious code detection)

2012-6-1 21:02
2251
From:EXETOOLS

Description:

Currently,the following features are available:

*Process Manager
View system process and thread basic information.
Detect hidden processes,threads,process modules.
Terminate, suspend and resume processes and threads.
View and manipulate process handles,windows and memory regions.

*Kernel Module Viewer
Display kernel module information including ImageBase,Size,Driver Object,ImagePath,ServiceName and Load Order.
Detect hidden kernel modules.
Unload kernel module(dangerous,never try it on Windows 7).
Dump kernel image memory.
Display and delete system driver service information.

*Hook Detector
View and restore SSDT,Shadow SSDT,sysenter and int2e hooks.
View and restore FSD and keyboard disptach hooks.
View and restore kernel code hooks including kernel inline hooks,patches,IAT and EAT hooks.
View and restore usermode process hooks incluing inline hooks,patches,IAT and EAT hooks.
View and restore message hooks(both global and local).
View and restore kernel ObjectType hooks.
Display Interrupt Descriptor Table(IDT).

*System Callback Viewer
Display and remove Kernel Notifications(Process/Thread/Image/Registry/Lego/Shutdown/Bugcheck/FileSystem/Logon).

*Network Viewer
Display current network connections, including the local and remote addresses and state of TCP connections.
View and delete IE plugins and context menu.
View and restore tcpip dispatch hooks.
Display winsock providers(SPI).
View and edit hosts file.

*Filter Viewer
View and remove filters for common devices including disk,volume,keyboard and network devices.

*Registry Viewer
View and edit system registry.
Detect hidden registry entries using live registry hive analysis.

*File Explorer
Detect hidden files using both disk analysis and driver methods.
View and delete locked files and folders.
View file basic information including NTFS Alternate Data Streams.

*Autorun Manager
Display and delete common autorun entries.

*Service Manager
Display Win32 service information (for Ring0 modules,it is included in Kernel Module Viewer).
Change service status and configuration.

*DPC Timer
Enumerate and delete DPC Timer objects.

*Miscellaneous
View and repair common filetype assosications.
View and repair image hijacks.

*Settings
Option to defense from process creation,thread creation,module load and message hook installation.
Option to defense from file creation,registry key creation.
Option to prevent system suspend,log-off,shutdown and reboot.
Option to prevent locking workstation and switching destop.
option to prevent setting system time.


Download:
 http://xuetr.com/download/


Welcome forum.forum is a home.


Please respect the copyright from the Internet.
Пожалуйста, уважайте авторское право в Интернете.
來源于互聯網, 請尊重版權.
所發資源全部來自對互聯網公共資源的收集和整理,僅供學習之用,請于下載后24小時自行刪除!
Issued by all the resources of public resources from the Internet to collect and collate,
study purposes only,
please delete themselves 24 hours after downloading!
Выпущено всеми ресурсами государственных ресурсо
в из Интернет
а на сбор и обобщение, изучение целей, пожалуйста,
удалите себя
24 часов после скачивания!
You can Google.

Программное обеспечение выпуска и Windows Crack
Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха
Compassion are compulsory for any Buddhist, Jew money for the people of the world will a
break this oath can be satisfactorily beings all desire and governance 84 000 kinds of
diseases. Bodhisattva white Buddha: "If living beings recite the Great Compassion Mantra,
Health Buddhas States, not the immeasurable Samadhi eloquence, if not then by all seek in
the now Health rest into Zhengjue, provided that in addition to the poor and not sincere .
No merciful Avalokitesvara Bodhisattva, would like to sincerely recite this mantra, who obtain Nirvana.
Нет милосердный Бодхисаттвы Авалокитешвары, хоте
л бы искренне повторять эту мантру,
которые получают нирваны.

[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法

收藏
免费 1
支持
分享
最新回复 (1)
雪    币: 1015
活跃值: (235)
能力值: ( LV12,RANK:440 )
在线值:
发帖
回帖
粉丝
2
顶一个,站位
2012-6-1 21:46
0
游客
登录 | 注册 方可回帖
返回
//