Windows下系统服务Rootkits的检测与恢复  

Method to detect and recover from Windows native system services Rootkits

作　　者：龙海[1] 郝东白[1] 黄皓[1] 

机构地区：[1]南京大学计算机科学与技术系

出　　处：《计算机工程与设计》2008年第7期1612-1615,共4页Computer Engineering and Design

基　　金：国家863高技术研究发展计划基金项目(2007AA1Z409);江苏省高技术研究计划基金项目(BG2004030)

摘　　要：Rootkits是入侵者隐藏踪迹和保留访问权限的工具集。修改操作系统内核的Rootkit称之为内核Rootkit,使操作系统本身变得不可信任,造成极大的安全隐患。针对系统服务的Rootkits是内核中最常见的Rootkits。分析了当前Windows下系统服务各种Rootkits,提出了一种利用驱动程序,无需符号文件的检测和修复方法,能准确检测出Windows下各种系统服务Rootkits并且进行恢复。Rootldts are toolsets used by an attacker to retain root-level access to a system in a covert manner. The Rootkit which modifies the underlying kernel of the installed operating system, called kernel level Rootldt, makes the operating system distrustful and results in terrible safe hidden troubles. The Rootkits about system call are the most popular ones in kernel level Rootldts. The Rootkits about system call in Windows operating system is analyzed, a method that will detect the system-call Rootkits veraciously and recover the Windows system well is developed. The method implemented as a loaded driver doesn＇t depends on symbol files.

关 键 词：后门 内核 钩子 系统服务 重定位 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]