Windows RootKit进程隐藏与检测技术的研究  

Research on Windows RootKit hidden process and detection technology

作　　者：刘正宏[1] 

机构地区：[1]北京电子科技职业学院,北京100176

出　　处：《中国现代教育装备》2011年第9期24-26,共3页China Modern Educational Equipment

摘　　要：目前木马制造者趋于利用RootKit技术来隐藏它们的进程,危害信息与网络安全。重点从用户和内核两种模式深入剖析了Windows RootKit隐藏进程技术,并提出基于进程表的综合检测机制。测试证明:只有从用户和内核两种模式下应用多种进程表检测技术,才是安全检测隐藏进程更为有效的方法。At present the designers of Trojan Horse tend to use the RootKit technique to hide their process and harm the safety of information and network.This article focuses on using the two modes of user and kernel,this thesis analyses in detail the hidden process technology in Windows RootKit.It also point out the detection mechanism based on processList.Test results proved that only applying various processList detecting technology from two modes of user and Kernel can we test the hidden process more safely and effectively.

关 键 词：WINDOWS ROOTKIT 远程线程注入 Dkom 进程表 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]