[sysshield]系统安全盾

ultralqxq

晕啊！！我下载了你的测试。。虽然冰刃能显示那个隐藏进程。。但是这时把冰刃关掉后，点“下一步”改边PID值后，这时再开冰刃发现找不到那个seehide.exe进程了！！用任务管理器反而能看到！！怎么回事啊？？

emca

对于SysShieled的发展，我想是否可以这样设计：
由于Windows2K/XP/2k3的基本系统目录中的程序都是基本固定的、已知的，而且XP以上系统默认均有系统文件保护能力（假设不担心系统文件被恶意修改），因此可以设计为Windows目录、System32目录的已知可执行文件允许被执行（创建进程），其他目录下的可执行文件、其他名称的可执行文件一律不予执行（创建进程）。这样可以防住一大批隐藏在系统目录中的可执行文件病毒的加载。与文件创建阻止功能相结合，系统目录应当就相当安全了！

wang6071

下面引用由emca在 2005/11/28 11:59am 发表的内容：
对于SysShieled的发展，我想是否可以这样设计：
由于Windows2K/XP/2k3的基本系统目录中的程序都是基本固定的、已知的，而且XP以上系统默认均有系统文件保护能力（假设不担心系统文件被恶意修改），因此可以设计　...

其他目录下的可执行文件、其他名称的可执行文件一律不予执行（创建进程）:各个兄弟所用微软外的程序可是N多的呀,只能执行微软的程序恐怕没谁用计算机了.
我想红叶兄的意思是做一个认证,如程序是微软的就pass过,不是微软的就提示用户认证一下.这样做也有一定难点:
1:什么样的程序是微软的程序?现在很多木马都会伪装成微软的程序,就连3721的驱动也如此处理了．
2:如何判断监测进程？不用驱动级的HOOK就会漏掉不少进程的创建．
3：如何结束进程？由于现在驱动级的木马通常都是一启动就隐藏进程本身，隐藏注册表中它的注册键值，隐藏文件，想要结束掉它也不是一件易事．就说看得见的进程吧，能实时结束掉IceSword的进程吗?当然现在如IceSword这样不能被结束的第三方程序还不太多，但难保以后木马不会使用这样的技术．
　　如果微软从底层结出一个安全管理的方案或权限设置就没这么多问题了．如果微软的软件安全策略能定制得灵活一点就好了，可目前为止，偶认为还是没有较好的软件限制方案．

撼云城

支持一下　！！！！！！

wang6071

今天检查了一下sysshield,发现参数设置中一直存在一个Bug,至使防木马效果不好.
这是由于判断中将模糊匹配与类型匹配搞反了所致，结果是两个设置不对应，导致了木马释放文件到system32下可能不删除．
修订后，用类型过滤windows目录应可防住绝大多数木马，下载:
http://wangsea.ys168.com
先更正这个Bug,等偶再研究一下驱动再做其它修订．看来不学驱动搞个底层级的进程检测是不利于中招后的恢复的．前面附件的那个测试因为win2003 sp1后已不支用户进ring0会失效，所以不打算用它了，还是得做个驱动来检测才有扩展性．

6618

时不时进来学习一下，顶啊。

xdg3669

wang607１兄弟：
　　　不知这个算不算是个BUG：
　　　在某个文件夹设置类型过滤、模糊过滤当这个目录里的*.exe、*.dll等文件的大小改变、或这些文件在运行或更新后被当作新文件删去！
　　　我的C:\Program Files\下的一些.exe、.dll文件就被莫名其妙地删去！

wang6071

to xdg3669:
  这个不是Bug,凡是因为文件改名或文件删除后重新生成,都被当作是新增文件,所以会如此操作.(最初的版本因为没有设置对文件改名的侦测,后来考虑到某些安装程序是先解压成临时文件,然后再更名为正式的文件,所以后来的版本都增加了对此类改名的操作)   

xubo1971

黑名单文件最近有更新吗？

gdlgh

黑名单：包括360搜、3721、百度、博彩网摘、彩信通、CNIC、DUDU、多多QQ表情、易趣工具栏、很棒、划词、网络猪、搜狗、搜易、天下搜索、U88、YAHOO、一搜、YOK工具条、娱乐心空、完美网易通等20几个插件。
此黑名单俺一直使用中，也不断更新。
_abbca_.dll
_abbca_.exe
_huytam_.exe
180ax.exe
2.css
3.css
3721.exe
a.exe
a~nsisu_.exe
abhcop.sys
aboutagirl.exe
aclayer.dll
aclayer.exe
adaware.exe
adfilter.dll
adinstall.exe
ahook.sys
alevir.exe
alg.exe
alliveex.dll
allverx.dat
alrex.dll
aoyou_mini.exe
apihookdll.dll
aplica32.exe
aqadcup.exe
asbar.dll
asiesec.dll
asmenu.dll
assecblk.dll
assist.dll
assistant
aswipe.dll
aupdate.exe
autolive.dll
autolive.ini
autolvsw.ini
av.exe
avserve.exe
avserve2.exe
baidubar.dat
baidubar.dll
baiducb.exe
baidu-trackycn.exe
barhelp23.0.dll
bcup.exe
bdgdins.dll
bdguard.dat
bdguard.sys
bind_8050.exe
bind_8190.exe
blss.exe
bocaitoolbar.dll
brasil.exe
bugsfix.exe
buup.exe
bvt.exe
cdn.dll
cdndet.dll
cdnglo.dll
cdnhook.sys
cdniehlp.dll
cdnprot.sys
cdnspie.dll
cdntran.sys
cdnup.exe
cfs7zd.dll
cfsbho.dll
cfsupd.dll
cfsys.dll
cmd32.exe
cnminpk.sys
cnnic.exe
cns.dat
cns.dll
cns.exe
cns01.dat
cns03.dat
cnshook.dll
cnsinfo.dat
cnsmin.dat
cnsmin.dll
cnsminhk.cab
cnsminkp.sys
command.exe
conime.exe
conscorr.exe
contextmenu.htm
contmenu.dll
coolbar
crss.exe
ctfmon.exe
dcomx.exe
dddiemon.dll
dddmext.dll
dddspocx.dll
dddupdate.exe
dhelp.dll
diskman.exe
diybar2.dll
dlpig.exe
dmdaemon.dll
dmipn.dll
dmsched
dtap.dll
dtctr.dll
dudu.exe
dudu_hh.exe
duduacc.exe
dudupros.exe
duduprosvc.exe
dvdkeyauth.exe
dvldr32.exe
ebaytb.dll
ebaytbdaemon.exe
ebaytoolbarcomm.dll
exiorer.exe
exp1orer.exe
explore.exe
explorer.exe
firewall_anti.dll
firewall_anti.exe
frundlll.exe
g_server.dll
g_server.exe
g_server_hook.dll
g_server2.0.exe
game.exe
gdtest.htm
gr-125.exe
hap.dll
hbast.dll
hbcf.ini
hber.ini
hbhelper.dll
hbhsy.ini
hbkf.ini
hbu.ini
hbuf.ini
hcalway.sys
hdp.ini
hdtbar.xml
hello.exe
helper.dll
helper.ini
henbagkiller.exe
henbang.exe
henbang.ini
hepler.html
hepler1025.ini
hfind.exe
hmapi.dll
hmtoolbar.dll
hookdll.dll
hwclock.exe
idnmail.exe
ieangel.dll
iebar.inf
iebar23.0.dll
iehelper.dll
iexplor.exe
iexplorer.dll
iexplorer.exe
iexplorer_hook.dll
imaoe.dll
imaol.dll
imuiepls.dll
imuliver.dll
inetapi32.dll
infofobar.dat
infofobar.dll
isass.exe
iservc.dll
iservc.exe
kernel32.exe
khdap.sys
knqtwz]`.dll
linbak.dll
loader.exe
locator.exe
lowlvl.dll
lsass.exe
lssas.exe
m2syadll.dll
madbp.sys
mario.exe
menuinfo.dll
meobjsdt.dll
microapmddt.dll
miniddd.exe
mmsassist.dll
mouse1.dll
movesearch.exe
msetup.exe
msinfo.dll
msinthk.dll
msn.exe
mstasks.exe
mwqu_32.dll
n0tpad.exe
nbar.exe
netlib.exe
netpig_setup.exe
netsendserver.dll
netsendserver.exe
netsendserverkey1.dll
nmwizarda14.exe
notepad.exe
notifier.dll
ntd11.dll
ntd1l.dll
ntdl1.dll
ntdll.dll
optimum.dll
p2psvr.exe
patch03.dll
patch05.dll
patch06.dll
patch10.dll
pig3setup.exe
pig4setup.exe
pigup.exe
pluginenlog.dll
pnpsvc.inf
powerlist.ocx
powerplayer.dll
prostrdll.dll
pupw.sys
qcssbl9.exe
qq.exe
qqemo.exe
qqfacerclient.e
qqfacerclient.exe
qyule.exe
ranx.dll
rasvss.dll
rb32.exe
rdriv.sys
remotesetup.exe
rep.exe
repair.dll
rss.dll
run.exe
run32.dll
rund1132.exe
rund1l32.exe
rundl132.exe
rundll16.exe
rundll32.exe
saga.sys
scrblock.dll
scvhost.exe
searchm.dll
serinit32.exe
services.exe
setup99.exe
smss.exe
sobarnetinstaller.exe
sodaie.dll
softreg20.exe
softreg38.exe
sogoutb_setup_mini.ex
sogoutb_setup_pp365xi
spoolsv.exe
ssl.dll
stdsver.dll
stdup.dll
svch0st.exe
svchost.exe
svchosts.exe
svohost.exe
svr.dat
svshost.exe
sysmonde64.dll
system.exe
system32.exe
tbhelper.dll
temp0.dll
temp1.dll
temp2.inf
tgbrfv_.exe
tgbrfv_5.dll
thdstat.exe
tollbar.bmp
toolbar.bmp
toolbar.dll
toolbaru88.dll
tutuag32.exe
tvclient.bin
u88.exe
u88.ico
u88.url
u88icon.ico
u88setup.exe
uninstall.exe
unpig.exe
unregister.ini
update.dat
usign.dll
ustqilnr.sys
vika23.exe
visionnet.dll
vkclient.exe
vkreader.exe
vpip.exe
waitdown.lst
web.exe
webband.dll
win32.exe
windcheck2.exe
windows.exe
winhtp.dll
wininit.exe
winio.dll
winio.sys
winio.vxd
winlogin.exe
winlogon.dll
winlogon.exe
winlogon_hook.dll
winup.exe
winupdate.exe
wiwshost.exe
wlzsetup30.exe
wmimgr.exe
ws2_32.dll
ws2-64.dll
wsocket.dll
wuauclt.exe
xporexp.exe
xpstyle.dll
xpwindow.dll
yadfilter.dll
yadwreg.dll
yahoo!
yalive.dll
yaliveex.dll
yalliveex.dll
yangling.dll
yasbar.dll
yascenter.exe
yasctrlh.dll
yasfsks.dll
yasierres.dll
yasiesec.dll
yasnoad.dll
yassecblk.dll
yassisres.dll
yassist.dll
yassist4.exe
yassistex.dll
yassistse.exe
yaswiper.dll
ydragsearch.dll
yeheocx.dll
yhelper.dll
yieacore.dll
yieangel.dll
yieares.dll
yieaui.dll
yisou_znmq.exe
ykeepmain.dll
ylive.exe
ymenuinfo.dll
ynotifier.dll
yok_supersearch.dll
yoptimum.dll
yprockg.dll
yrepair.dll
yscrblock.dll
ysettings.dll
yulesetup.exe
yuninst.dll
ywiper.dll
yzsnetproto.dll
zsearch.exe
zsmod.dll
zsup.exe
zunins.exe[UploadFile=Filter_1135642375.rar]

wang6071

一个检测并杀进程的辅助工具,基本可用,尚待完善,各兄弟可试用之
[UploadFile=KillProc_1135684826.rar]

推士机

此贴不能沉，顶上！

rz001

一头雾水，坚决支持！

emca

以下是前面兄弟的黑名单和本人的黑名单经 合并、去重、排序 后的黑名单：
180ax.exe
2.css
3.css
3721.exe
879f5.msi
AsMenu.dll
Assecblk.dll
AutoLive.dll
AutoLive1.dll
BDGuard.SYS
BaiDuBar.dll
BoCaiToolBar.dll
CnsMinKP.sys
DtCtr.dll
DuDuAcc.exe
DuDuProsvc.exe
IEAngel.dll
IEHelper.dll
Khdap.sys
MMSAssist.dll
Madbp.sys
MenuInfo.dll
Microsoft\hdp.ini
Notifier.dll
PowerList.ocx
PowerPlayer.dll
Run.exe
SoDAIE.dll
TVClient.bin
ToolBar.dll
WebBand.dll
XPWindow.dll
YDragSearch.dll
YLive.exe
YOK_SuperSearch.dll
_abbca_.dll
_abbca_.exe
_huytam_.exe
a.exe
abhcop.sys
aboutagirl.exe
aclayer.dll
aclayer.exe
adaware.exe
adfilter.dll
adinstall.exe
ahook.sys
alevir.exe
alg.exe
alliveex.dll
allverx.dat
alrex.dll
aoyou_mini.exe
apihookdll.dll
aplica32.exe
aqadcup.exe
asbar.dll
asiesec.dll
asmenu.dll
assecblk.dll
assist.dll
assist.dll
assistant
assistse.exe
aswipe.dll
aupdate.exe
autolive.dll
autolive.ini
autolvsw.ini
av.exe
avserve.exe
avserve2.exe
a~nsisu_.exe
baidu-trackycn.exe
baidubar.dat
baidubar.dll
baiducb.exe
barhelp23.0.dll
bcup.exe
bd.exe
bdgdins.dll
bdguard.dat
bdguard.sys
bind.exe
bind_8050.exe
bind_8190.exe
blss.exe
bocaitoolbar.dll
brasil.exe
bugsfix.exe
buup.exe
bvt.exe
cdn.dll
cdn.exe
cdnaux.dll
cdnctr.exe
cdndet.dll
cdnglo.dll
cdnhook.sys
cdniehlp.dll
cdnprh.dll
cdnprot.sys
cdnspie.dll
cdntdns.dll
cdntran.sys
cdnunins.exe
cdnup.exe
cfs7zd.dll
cfsbho.dll
cfsupd.dll
cfsys.dll
client.dll
cmd32.exe
cnminpk.sys
cnnic.exe
cns.dat
cns.dll
cns.exe
cns01.dat
cns03.dat
cnshook.dll
cnsinfo.dat
cnsmin.dat
cnsmin.dll
cnsminhk.cab
cnsminkp.sys
command.exe
conime.exe
conscorr.exe
contextmenu.htm
contmenu.dll
coolbar
copyso.exe
crss.exe
ctfmon.exe
dcomx.exe
dddiemon.dll
dddmext.dll
dddmext.dll
dddspocx.dll
dddupdate.exe
dhelp.dll
diskman.exe
diybar2.dll
dlpig.exe
dmdaemon.dll
dmipn.dll
dmsched
dtap.dll
dtctr.dll
dudu.exe
dudu_hh.exe
duduacc.exe
duduacc.exe
dudupros.exe
duduprosvc.exe
dvdkeyauth.exe
dvldr32.exe
eBayTb.dll
eBayToolbarComm.dll
ebaytb.dll
ebaytbdaemon.ex
ebaytbdaemon.exe
ebaytoolbarcomm.dll
exiorer.exe
exp1orer.exe
explore.exe
explorer.exe
firewall_anti.dll
firewall_anti.exe
frundlll.exe
g_server.dll
g_server.exe
g_server2.0.exe
g_server_hook.dll
game.exe
gdtest.htm
gr-125.exe
hap.dll
hbast.dll
hbcf.ini
hber.ini
hbhap.dll
hbhelper.dll
hbhsy.ini
hbkf.ini
hbsetup.log
hbu.ini
hbuf.ini
hcalway.sys
hda.ini
hdp.dll
hdp.ini
hdtbar.xml
hello.exe
helper.dll
helper.ini
henbagkiller.exe
henbang.INI
henbang.exe
henbang.ini
hepler.html
hepler1025.ini
hfind.exe
hmapi.dll
hmtoolbar.dll
hookdll.dll
hwclock.exe
idnconv.dll
idnmail.exe
ieangel.dll
iebar.inf
iebar23.0.dll
iehelper.dll
iexplor.exe
iexplore.exe
iexplorer.dll
iexplorer.exe
iexplorer_hook.dll
imaconv.dll
imaoe.dll
imaol.dll
imuiepls.dll
imuliver.dll
inetapi32.dll
infofobar.dat
infofobar.dll
isass.exe
iservc.dll
iservc.exe
kernel32.exe
khdap.sys
knqtwz]`.dll
linbak.dll
loader.exe
locator.exe
lowlvl.dll
lsass.exe
lssas.exe
m2syadll.dll
madbp.sys
mario.exe
menuinfo.dll
meobjsdt.dll
microapmddt.dll
minib.dll
miniddd.exe
mmsassist.dll
mouse1.dll
movesearch.exe
msetup.exe
msinfo.dll
msinthk.dll
msn.exe
mstasks.exe
mwqu_32.dll
n0tpad.exe
nbar.exe
netlib.exe
netpig_setup.exe
netsendserver.dll
netsendserver.exe
netsendserverkey1.dll
nmwizarda14.exe
notepad.exe
notifier.dll
ntd11.dll
ntd1l.dll
ntdl1.dll
ntdll.dll
optimum.dll
p2psvr.exe
patch03.dll
patch05.dll
patch06.dll
patch10.dll
pig.exe
pig3setup.exe
pig4setup.exe
pigup.exe
pluginenlog.dll
pnpsvc.inf
powerlist.ocx
powerplayer.dll
prostrdll.dll
pupw.sys
qcssbl9.exe
qq.exe
qqemo.exe
qqfacerclient.e
qqfacerclient.exe
qyule.exe
ranx.dll
rasvss.dll
rb32.exe
rdriv.sys
remotesetup.exe
rep.exe
repair.dll
rss.dll
run.exe
run32.dll
rund1132.exe
rund1l32.exe
rundl132.exe
rundll16.exe
rundll32.exe
saga.sys
scrblock.dll
scvhost.exe
search.exe
searchm.dll
serinit32.exe
services.exe
setup99.exe
smss.exe
sobarnetinstaller.exe
sodaie.dll
softreg20.exe
softreg38.exe
sogoutb_setup_mini.ex
sogoutb_setup_pp365xi
spoolsv.exe
ssl.dll
stdsver.dll
stdup.dll
svch0st.exe
svchost.exe
svchosts.exe
svohost.exe
svr.dat
svshost.exe
sysmonde64.dll
system.exe
system32.exe
taskmgr.exe
tbhelper.dll
tcgg.exe
temp0.dll
temp1.dll
temp1.dll =
temp2.inf
tgbrfv_.exe
tgbrfv_5.dll
thdstat.exe
tollbar.bmp
toolbar.bmp
toolbar.dll
toolbarU88.dll
toolbaru88.dll
tutuag32.exe
tvclient.bin
u88.exe
u88.ico
u88.url
u88icon.ico
u88setup.exe
uninstall.exe
unpig.exe
unregister.ini
update.dat
usign.dll
ustqilnr.sys
vika23.exe
visionnet.dll
vkclient.exe
vkreader.exe
vpip.exe
waitdown.lst
web.exe
webad.dll
webband.dll
win.htm
win32.exe
windcheck2.exe
windows.exe
winhtp.dll
wininit.exe
winio.dll
winio.sys
winio.vxd
winlogin.exe
winlogon.dll
winlogon.exe
winlogon_hook.dll
winup.exe
winupdate.exe
wiwshost.exe
wlzsetup30.exe
wmimgr.exe
ws2-64.dll
ws2_32.dll
wsocket.dll
wuauclt.exe
xporexp.exe
xpstyle.dll
xpwindow.dll
yAngling.dll
yAssecblk.dll
yNotifier.dll
yaLive.dll
yaLiveEx.dll
yadfilter.dll
yadwreg.dll
yahoo!
yalive.dll
yaliveex.dll
yalliveex.dll
yangling.dll
yasbar.dll
yascenter.exe
yasctrlh.dll
yasfsks.dll
yasierres.dll
yasiesec.dll
yasnoad.dll
yassecblk.dll
yassisres.dll
yassist.dll
yassist4.exe
yassistex.dll
yassistse.exe
yaswiper.dll
ydragsearch.dll
yeheocx.dll
yhelper.dll
yieaUI.dll
yieacore.dll
yieangel.dll
yieares.dll
yieaui.dll
yisou.dll
yisou_znmq.exe
yisoub.dll
yisous.dll
yisouu.dll
ykeepmain.dll
ylive.exe
ymenuinfo.dll
ynotifier.dll
yok_supersearch.dll
yoptimum.dll
yprockg.dll
yrepair.dll
yscrblock.dll
ysettings.dll
yulesetup.exe
yuninst.dll
ywiper.dll
yzsnetproto.dll
zsearch.exe
zsmod.dll
zsup.exe
zunins.exe

xubo1971

新版黑名单，收下了！

wang6071

[UploadFile=1_1136391991.jpg][UploadFile=1_1136392092.rar][UploadFile=2_1136392102.rar]
正在做的辅助工具,希望大家喜欢,偶准备慢慢完善它
进程检测可检测到隐藏的进程,模块卸载可以关掉某些钩子,杀进程的威力较大，选红色显示的杀即可(头几个进程被杀后可能会关机，重启等)
服务管理是dump出hive注册表文件来的，所以可检测出隐藏的服务．

6618

下载下来用了一下，好用，期待完善！

wang6071

[UploadFile=Image1_1136457854.jpg][UploadFile=1_1136457868.rar][UploadFile=2_1136457878.rar]
今天有空,又加了一页功能

xdg3669

强烈支持！！

mzszwh

运行反黑工具提示：
初始化失败，本例程不能使用于你使用的系统，请退出

wang6071

忘了说明,目前只支持win2000 sp4, winxp ,win2003 (win2003升级到sp1后不支持)

wang6071

[这个贴子最后由wang6071在 2006/01/07 06:00pm 第 3 次编辑]

[UploadFile=Image1_1136555207.jpg]

开始加IE插件的检测删除功能．．．．
[UploadFile=syscheck_1136628026.rar][UploadFile=syscheck_1136628038.rar]

pyqkgd

试用了新版,功能确是不错,但不知我运行后在进程栏中只有三个进程项?.[UploadFile=001_1136644032.jpg]

wang6071

to pyqkgd:
   进程显示不完整的原因:
   1:可能是权限不够.
   2:可能是系统中有一个OpenProcess的钩子,将打开进程返回了空值,如果是这样可能系统已经被黑,用Icesword查一下.(主要看一下ssdt部分被更改的函数地址是何种软件所为)
   3:软件兼容性的问题,请告知您的系统版本.

ctsren

我运行后在进程栏也是只有三个进程项，系统为WinXPsp2。[UploadFile=tt_1136651312.jpg]

wang6071

[UploadFile=kerneldos_1136653604.rar]
用这个试一试,看看有无异常进程

推士机

辅助工具很实用，期待wang6071兄不断完善其功能！

wang6071

[UploadFile=Image1_1136715091.jpg][UploadFile=Syscheck_1136715109.rar][UploadFile=Syscheck_1136715119.rar]
自已搞的ring0级总是不太成功,功力有限啊.现在干脆用个大牛写的检测工具,偶做了个接口让工作在syscheck下,这下兼容性可没问题了,现在隐藏进程显示得也易寻了.

推士机

现在进程显示正常了，原来的确只能显示三个

wang6071

关于3721的system32\drivers\cnsminkp.sys驱动的删除方法:
注意:在资源管理器中删除会删不了system32\driver32\cnsminkp.sys的
1:直接执行删除服务cnsminkp后立即重启(成功率不高),重启后如该服务已停止可删除cnsminkp.sys
2:删除服务cnsminkp后用IcesWord的文件管理删除cnsminkp.sys.(此法100%成功),
3:删除服务cnsminkp后开cmd,键入: echo "">c:\windows\system32\drivers\cnsminkp.sys,完成后立即重启(试过有一定成功率),重启后如服务已停止可删除cnsminkp.sys