
   WsyscheckһֶľĹߣĿǼ򻯲ľʶ

  һ˵ԲжҪԲò鿴·鿴ļ鿴ļڣ鿴ļ̣΢ļУ飬鿴ȷWsyschckЩ򻯲ṩصݹ

  жϲľȡ˵ķWsyscheckܵϤ̶ȡ

Wsyscheckܼ򵥽:

1:еģ顢ʾ

  ʾ΢ļʹˡУ΢ļǩܺͨ΢ļҲʾ
  SSDtҼȫʾĬ϶ȡѡʾSSDTѸĵĿ
  
2:Wsyscheckɫʾ

ҳ

  ɫʾ΢,ϺɫʾȻ΢,ģз΢ļ

ҳ

  ɫʾ÷΢,Ҹ÷.sys.exe.dllķľʹַʽ

  ʹáֵɫʾмֵϵͳпɱұҲпľļֵ

  ȡˡģ顢ʾ󣬲鿴Եļ̡򣬽ʹá͡޸ڡ׹۲쵽ľ

  ҳв鿴ģҳв鿴ʹü̵¼ơ

  ʹáá-У΢ļǩϺɫʾδͨ΢ǩļͬʱڸʾ"΢ļУ"ʾPassno pass(Ծݴ˲οǷǼð΢ļעϺɫʾ࣬ϵͳϳGhost棬Щ汾ܾ΢ǩݿԽ)

SSDTҳ

  ĬʾȫSSDTɫʾں˱HOOKĺ鿴ģ飬Եαǩӳ·HOOKģһǰ档Ҳȡȫʾ,ʾڸı˵ĺ

  SSDTҳġ쳣ʾYES,úInline HookһͬʱڴHOOKַHOOK,Ӧģ·ʾInline Hook·ʹáָǰ롱ָֻInline Hook·ʾΪַHOOKģ·ʹáָǰַܾͻָĬϵĺˡ
  
  ʹáָкͬʱָHOOK

  ľ޸SSDTʱȻָSSDTעɾȲ

ļҳ

  ɫʾĳݡ

3:Wsyscheck״̬ʾ棡δسɹһЩ޷ɡ

  ǰȫֹWsyscheckWsyscheckĹһòҪķɶϵͳ޸

  سɹ,ľļֱʹWsyscheckиҳеɾļ,ܴСֱɾеļĹܡ

4:жģ

  HOOKϵͳؼ̵ģжؿܵϵͳģдйϵжز˵ģ鲻Ҫǿжأɾģļ(ʹɾļʧ)

5:ļɾ

  ص,WsyscheckɾѾ,ļɾ(ģֱʹҼ´ɾĸ),صDLLļɾȻļȻɼʵɾļʧ

  ļҳġɾɾļվֻ֧Ŀ¼µļɾӦעļڻվڣʹֱɾܡʹüйܽƵһطܿվڵļɾǸ

  WsyscheckĻdosɾܡҪWsyscheckĸģļWDosDel.dat,ļWsyscheckһʾҳ棬Ӵɾļ˵н֡ɾļѡתDosɾļĳЩϣִСdosɾϵͳļҪ޸(ʱ޸ļϵͳ)ʱ벻Ҫ޸رԴ¿DosɾNTFS֧BUGɵģҪ޸ֻرյԴ¿ɡ

  ɾ롰Dosɾͬʱʹáбֶ༭,һһļ·ɡرճʱ֮һɾбѯǷִС
   
    ע⣬ΪⲡػWsyscheckɾĳЩļʱܻȡ0ֽļռλķʽȷɾЩ0ֽļWsyscheck˳ᱻԶǷô˷ʽڡáµġɾļѡǷѡ


  Ҫɾļ,µġɾļǰļɾǰļݵ%SystemDrive%\VirusBackupĿ¼Уҽļ.vir׺ִС


6:ڽ̵Ľķ

  ȷϵľļ,ѡ̲ɾļ,ĻWsyscheckὫɾļʱΪľйδͬʱ¼ľļʱǿѡáµġɾļʱ̲ɾļWsyscheck0ֽڵļֹľ

  ҲʹýҳġֹСܾеIFEOٳֹܣǿʹһЩԶĳִͨļõĳáȫ顱ҳġóܣľʹIFEOٳֺҲԡóлָٳֵĳ

  µġֹļľķļдעмӻֹ,ʹñܸܺɵɾľļעֹֹļԶӡ־ҳȡҳʧԹ۲һ־ԱֹĶҵȽصľļעǣľϵͳ̣ӳ־ֹϵͳ̵ĶҪҷֱöǷкý̵ģļ

  Ҫ־ȡǰCtrl+Aȫѡơע,Ϊֹ־,1000Զɾǰ400־

  ڷдע޷޸áֹļҳдעḶ̌ľ߳̽й޸ע

  ڲ鿴̫鷳Ļɾļֱɾɾ֮޸ע

8:

  ҳпɳCtrl,ShiftѡִصĹܡ

  ļеġļбб1PEִһεõ2,12ȽϣԸĳЩWsyscheckⲻصRootKit

9:ľļ򵥷
  
  1: ѡáµġɾļֹļ

  2: ѡ񲡶̣ʹá̲ɾļ

  3: 뵽еģ಻£ȫֹڸͨͬģ̵ģ鼴ɡáֱɾģļִк󿴲仯ļʵѾɾʹáжģ顱ܣΪҲ롰ɾãԭжϵͳеģʱпϵͳǰ

  4: ִСʱļAutorun.inf

  5ڰȫп޸޸һ¡ǿִж

  6: 󲿷ݵĲӦÿԸ㶨ˡʱٴμ飬ֻ̲ʹáá̡߳жءɾDosɾȷ

  7: лļҳļСΪ50Kңȥų΢ļĹһܵļѡʬļɾ


10:WsyscheckʹõĲ˵:

  WsyscheckԴȼ
  Wsyscheck 1 ڱ׼  Wsyscheck 2   Wsyscheck 3 ʵʱ
  ҪʵʱWsyscheck,Ա༭һ RunWs.bat ,Ϊ Wsyscheck 3
  RunWs.batWsyscheckһ˫RunWs.batWsyscheckʵʱȼ

  Wsyscheck -f wsyscheckָݲѯSSdtеĺ,Ȼ˳
  Wsyscheck -s -fĻִдȫ˳

  罫Wsyscheck.exeWsyscheckȻִָвݲѯSSdtеĺָSSdtʾҳAuto Restoreп򲻴˹ܡ⣬Wsyscheckʹͷ


11:ֹ˵(ָ˵µӲ˵)

  һ㿴⼴ʶ,Բ˵:

  ʱļ:ɾ%TEMP%,%windir%\Temp%windir%\Downloaded Program Filesµļ

  ӲԶ:ܻ޷˫򿪹ϡע⣬ĳЩ޸ҪעЧ

  ޸ȫģʽĳЩľƻȫģʽļֵ޷밲ȫģʽȱݵǰȫģʽֵٻָĬϵİȫģʽֵ

  WsyscheckĴڱѲȡַ,Ȼľ,뽫WsyscheckС


                                                               Wangsea 20071222 
                                                               Wang6071@sina.com.cn 
                                                               http://wangsea.ys168.com 


  












