剖析远程控制免杀DLL木马  

Analysis on Technology of Remote Control and Avoidable Clean DLL Trojan

作　　者：张懿[1] 刘嘉勇[1] 

机构地区：[1]四川大学电子信息学院,四川成都610064

出　　处：《信息安全与通信保密》2011年第4期56-57,60,共3页Information Security and Communications Privacy

摘　　要：木马是一类具有隐藏性、自发性的恶意程序,目的多为控制用户电脑以窃取信息。首先简单介绍了木马程序的设计原理和木马的主要工作流程,木马客户端和服务端之间的通信过程。在此基础之上,介绍了几种目前主流的木马免杀技术,主要包括特征免杀、加花指令免杀、加壳免杀及内存免杀等。然后介绍了利用远程线程注入的方法进行木马注入DLL程序,从而达到木马进程隐藏的目的。最后综述了木马防治的基本方法。Trojan is a malicious program,hidden and spontaneous,which steals information by controlling user＇s computers. Firstly this paper briefs design principle,working process and communication between client and server of the Trojan program, on this basis,several main Trojan-disguised methods are explained,including modification of memory features,flower-added command and packer. And then it describes the method,which,by using remote thread injection DLL achieves the purpose of Trojan process hiding. Finally it summarizes the useful and basic methods for users to protect their computers from Trojans.

关 键 词：木马编程 免杀技术 DLL木马 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]