木马的伪装和免杀技术分析  

Analysis of Technology of Trojan's Disguise and Avoidable Clean

作　　者：蔺聪[1] 黑霞丽[2] 

机构地区：[1]广东商学院教育技术中心,广东广州510320 [2]广东商学院信息学院,广东广州510320

出　　处：《计算机与现代化》2009年第1期25-27,共3页Computer and Modernization

摘　　要：首先介绍了木马技术的结构和基本功能,描述了木马的发展概况——它的五个发展阶段,及其未来的发展趋势。然后着重从更名换姓、文件捆绑、木马加壳、文件重组四个方面分析了木马的伪装技术。最后从加壳、修改特征码、加花指令、修改内存特征码等方面,分析和介绍了木马的免杀的技术。本文试图通过研究木马的攻击技术,找到防范的途径。Firstly, it＇ s introduced in the text the structure, functions, development and current of the Trojan horse. In order to enter our computer stealthily, trojan will disguise itself by all means, in the second part of the text, it＇ s introduced emphatically four disguise technology for Trojan horses. For Trojan horses, disguise is the first step, to avoid the scan and clean of antivirus software, the most important of all is to make the trojan to avoid clean, in the last, it is empasised on adding shell, amending key, adding nop instruction, amending key in the memory in the text, and try to find the method of preventing according to study the technology of trojan hourses＇ attacking.

关 键 词：伪装 免杀 加壳 花指令 特征码 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]