远程线程注入DLL的检测与卸载方法研究  

Research on Detection and Uninstall Method in Remote Thread Injection of DLL

作　　者：王佩红[1] 赵尔敦[1] 张瑜[1] 

机构地区：[1]华中师范大学计算机科学系,武汉430079

出　　处：《计算机与数字工程》2010年第3期106-108,142,共4页Computer & Digital Engineering

摘　　要：研究了Windows操作系统下的一种木马检测技术,该木马结合了远程线程注入、动态链接库(DLL)等技术。针对目前最新的远程线程注入实现木马隐藏的关键技术,提出了一种进程被远程注入动态链接库的检测方法和相应动态链接库的卸载方法。实验表明,这种方法对已被远程线程注入DLL的进程检测和恢复效果明显。A trojan horse detection technology in the Windows operation system is investigaeted,which combines several advancing technologies including remote thread injection and dynamic-link library（DLL）,etc.According to the latest technology of hidding the Trojan Horse through remote thread injection,a detection method for discovering whether a process is remotely injected into DLL is proposed.And furthermore,a corresponding DLL uninstall method is also given.The remarkable effects of the proposed method have been proved by the experiment results.

关 键 词：远程线程注入 进程 模块 DLL 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]