Description: 很好进程隐藏的资料 -good process information well hidden process the information very well hidden processes hidden information Platform: |
Size: 7851 |
Author:陈锋 |
Hits:
Description: Many users have got used that Windows NT Task Manager shows all processes, and many consider that i s impossible to hide a process from Task Manager. Actually, process hiding is incredibly simple. There are lots of methods available for such a purpose and there are source codes available. It still amazes me that there are only a few trojans using these methods. Literally only 1 trojan from a 1000 is hidden. I think that trojan authors are lazy, since it requires extra work to hide the process and it is always easier to use ready-made sources and copy-paste them. Therefore we should expect hidden trojan processes in a near future.-Many users have got used that Windows NT Tas k Manager shows all processes, and many consider that i s impossible to hide a process from Task Manager. Actually, hiding process is incredibly simple. There are lots of methods available for such a purpose and there are source codes available. It still amaz es me that there are only a few trojans using thes e methods. Literally only a variant is from a 1000 hidden. I think that disables authors are lazy, since it requires extra work to hide the process and it is always easier to use ready-made source s and copy-paste them. Therefore we should Expe ct hidden variant processes in a near future. Platform: |
Size: 15360 |
Author:inwing |
Hits:
Description: 挂钩SSDT隐藏进程，本人做了详细的注释，对学习驱动的人有很大帮助-SSDT hidden processes linked to, I make detailed notes, learning-driven people are very helpful Platform: |
Size: 36864 |
Author:long |
Hits:
Description: 监控线程的产生和运行以及终止，还能通过它来检测进程的隐藏。-Monitoring thread running, as well as the generation and termination, but also through it to detect hidden processes. Platform: |
Size: 196608 |
Author:黄云鹤 |
Hits:
Description:
内核驱动中检测隐藏进程
对驱动编程者有一定帮助-Kernel driver detect hidden processes on the drive programmers have a certain extent, help Platform: |
Size: 12288 |
Author:网啊 |
Hits:
Description: HMM源码的简单版，隐马氏过程，概率及数理统计中的模型，可用于图像识别。-HMM-source version of the simple, Hidden Markov processes, probability and mathematical statistics in the model, can be used for image recognition. Platform: |
Size: 727040 |
Author:shuihemumumu |
Hits:
Description: 这是一个免费开源的远程控制软件
功能特点：
提供CMDSHELL、文件管理、进程管理、端口代理（未完成）、屏幕捕获和一些其它功能。
用到了一些内核技术，包括活动进程链脱链（隐藏进程），与ICESWORD相同的进程强杀方
法（能杀掉一些杀毒软件的进程），Ring0打开文件（用于感染正在运行的可执行文件），
2000/xp下采用无驱Ring0
同时支持正向连接和反向连接，服务端和控制端均可接受管理多个连接
-This is a free open-source remote control software features: providing CMDSHELL, document management, process management, port agent (not completed), screen capture and a number of other features. Used a number of core technologies, including the activities of the process chain from chain (hidden processes), and the same process IceSword strong killing methods (some antivirus software to kill the process), Ring0 open the file (for infection of the executable file is running ), 2000/xp used under the hassel Ring0 while supporting positive connections and reverse connections, service-side and control acceptable to manage multiple client connections Platform: |
Size: 804864 |
Author:方启 |
Hits:
Description: 隐藏进程
在windows下进行隐藏进程,使任务管理器无法打开进行显示此进程-Hidden processes hidden in the windows conducted under the process, so that can not open the Task Manager to show the process Platform: |
Size: 27648 |
Author:Paul |
Hits:
Description: vb版的枚举隐藏进程，隐藏木马、病毒无处藏身-vb version of the enumeration hidden processes, hidden Trojans, viruses have no place to hide Platform: |
Size: 9216 |
Author:lmgz |
Hits:
Description: 这是本人编写的一个类似于网吧管理软件，但是是单机版的，即同一台电脑登录不同账号，并对不同账号进行时间上的控制。
功能：开机自动启动（操作注册表），隐藏过程等。并可对账号进行设置。
比较简单，而且功能不完全，还有待完善，大家看看。-This is, I prepared a similar Internet bar management software, but are stand-alone version of that same sign different computer accounts, and time on a different account control. Function: boot automatically activated (operation registry), the hidden processes. Can be set on the account. Relatively simple, but not completely functional, have to be perfect, take a look at everyone. Platform: |
Size: 29696 |
Author:coldice |
Hits:
Description: 包含修改主页、自启动、隐藏进程、与exe或txt文件关联，修改键值、自删除等功能。-Home page contains the modified, self-starting, hidden processes, and the exe or a txt file association, modified key, since the delete functions. Platform: |
Size: 25600 |
Author:焦亭 |
Hits:
Description: 该文件的主要作用就是将系统的注册表进行修改，并隐藏进程。方便有效，可以实现类似于HideTool。-The main function of the document is to modify the registry system and hidden processes. Convenient and effective, can be achieved similar to HideTool. Platform: |
Size: 3072 |
Author:fenghuan |
Hits:
Description: 通过系统API调用实现三级跳实现真隐藏
从而不容易找出真正的进程-API calls through the system to achieve true realization of the triple jump which is not easy to find the real hidden processes Platform: |
Size: 332800 |
Author:陈城 |
Hits:
Description: Open Source Utility for detecting hidden processes that is working in the kernel and have more than 12 ways for detecting hidden processes, actual engine written in C and the user interface & some other stuff written in Delphi. Platform: |
Size: 571392 |
Author:__Genius__ |
Hits:
Description: hidecon, utility rootkit for x64
requires patchguard disabled, if not disabled... use patch which you may find on my web site.
usage:
hidecon -l (display process list)
hidecon -le display hidden processes (dbgprint)
hidecon -ld (load ioport3 driver) 加载驱动
hidecon -ud (unload ioport3 driver) 卸载驱动
hidecon -ph (hide process - ProcessId) 隐藏进程
hidecon -pu (unhide process - ProcessId) 显示进程
hidecon -pht (remove handle table entry - ProcessId)
hidecon -phi (reinsert handle table entry - ProcessId)
all commands a valid ProcessId, except -ld and -ud
all information is stored in driver, hidecon.exe simply s commands and exits
let me know if any problems (twitter).
i added support for windows 8, and will enable this at sometime in the future :)-hidecon, utility rootkit for x64
requires patchguard disabled, if not disabled... use patch which you may find on my web site.
usage:
hidecon-l (display process list)
hidecon-le display hidden processes (dbgprint)
hidecon-ld (load ioport3 driver) 加载驱动
hidecon-ud (unload ioport3 driver) 卸载驱动
hidecon-ph (hide process- ProcessId) 隐藏进程
hidecon-pu (unhide process- ProcessId) 显示进程
hidecon-pht (remove handle table entry- ProcessId)
hidecon-phi (reinsert handle table entry- ProcessId)
all commands a valid ProcessId, except-ld and-ud
all information is stored in driver, hidecon.exe simply s commands and exits
let me know if any problems (twitter).
i added support for windows 8, and will enable this at sometime in the future :) Platform: |
Size: 2883584 |
Author:songjiayu |
Hits:
Search - hidden processes