TELKOM
NIKA Indonesia
n
Journal of
Electrical En
gineering
Vol. 12, No. 10, Octobe
r 20
14, pp. 7389
~ 739
4
DOI: 10.115
9
1
/telkomni
ka.
v
12i8.534
5
7389
Re
cei
v
ed
De
cem
ber 1
2
, 2013; Re
vi
sed
May 25, 20
14
; Accepte
d
Ju
ly 10, 201
4
A New Systemic Safety Detecting Software
Xilong Qu
1
*
,
Yingjun Wan
g
2
1
School of Co
mputer & Com
m
unic
a
tion, Hu
nan Instit
ute of
Engin
eeri
ng,
Xi
an
gtan, 41
11
01, Chi
n
a
2
School of Infor
m
ation En
gi
ne
erin
g, Hena
n Institut
e of Scie
nce an
d T
e
chnolo
g
y
,
Xi
n
x
ia
ng
, 45300
3, Chi
n
a
*Corres
p
o
ndi
n
g
author, e-ma
i
l
: 5700
40
863
@
qq.com
A
b
st
r
a
ct
Becaus
e it
is
hard t
o
fin
d
a
nd to c
l
e
a
r co
ckhorse
an
d vi
rus dev
el
ope
d
by ro
ot kit te
chno
logy
,
antivir
us soft at present is
hard to clear virus in
the system
, which
m
a
k
e
the system
in dangers status
of
ha
z
a
r
d
. So,
de
signi
ng
a s
p
e
e
d
y
clear
T
r
oja
n
an
d vir
u
s
mak
e
s by
root k
i
t i
s
very i
m
porta
nt. T
he artic
l
e.i
s
base
d
on SD
K, adopti
ng th
e techn
o
lo
gy.o
f kernel to
de
sign the C
l
a
i
rvoyant syste
m
i
c
safety detec
tin
g
software. It major f
unction
is
monit
o
rs.the
service
of
the
system
and the operati
on. M
onitor
the regis
t
er
changer. Sear
ch the file, process,
system
m
o
dule hided
by the vir
u
s.
It can also end
protected pr
ocesses
and d
e
l
e
te pr
otected files f
o
rcibly. T
h
ro
u
gh the p
o
r
t.mapp
ing
of proc
esses, it
can find.p
o
rt mess
a
ges
ope
ne
d.by system, pr
ocess
e
s
ope
nin
g
ports
and.cock
hors
e
effectively. This softw
are ca
n also fi
nd NT
FS
stream files so as to find vir
u
s
effectively. It
can
als
o
exa
m
i
ne
BHO (Br
o
w
s
er He
lper
Objects) a
nd
L
SP
(Layer Serv
ice
Provid
er) so as
to protect bro
w
sers
and net
w
o
rks from hij
a
cking. It can al
so exa
m
i
ne SS
DT
(Syste
m
Se
rvice
D
e
scri
p
t Ta
b
l
e
)
an
d
SSD
T
Sh
a
d
o
w
(Syste
m
Se
rvi
c
e
D
e
scri
p
t Tab
l
e
Sh
ad
o
w
), and
resu
me a
m
en
ded ite
m
s. It can als
o
exa
m
i
ne an
d op
er
ati
ng servi
ng pr
o
g
ra
mmers of s
ystem. After the
actual syste
m
test, it declares
that the system
has real
i
z
e
d
th
e abov
e go
als
of functions.
Ke
y
w
ords
:
SSDT, IRP, root k
i
t
Co
p
y
rig
h
t
©
2014 In
stitu
t
e o
f
Ad
van
ced
En
g
i
n
eerin
g and
Scien
ce. All
rig
h
t
s reser
ve
d
.
1. Introduc
tion
As the comp
uter is wi
dely
used in soci
al lif
e each d
o
main, the compute
r
viru
s years,
Such a
s
“Big
thief in the
netwo
rk gam
es”,
“Worm.
w h b
o
y. h” “dove”
“Trojan
of QQ, Dove in
gray” i
s
ram
pant increa
si
ngly to steal the user
s’ p
a
ssword a
ccounts, pe
rso
nal priva
c
y. The
comm
ercial
secret Prop
ert
y
in Netwo
r
k, acco
rding to
the su
rvey fickl
e ki
nd
s be
come
s a
ne
w
trend, in
the
develop
men
t
of com
pute
r
viru
se
s. Ma
nufactu
ring
a
nd
selling
Trojan
s an
d virus
online b
e
com
e
s ramp
ant g
r
adu
ally. The
crim
e of u
s
i
ng viru
se
s, T
r
ojan te
ch
nol
ogy to theft and
fraud o
n
the
netwo
rk i
s
rapidly risi
ng.
The situat
io
n of online secu
rity is very serio
u
s. M
any
Internet users suffered
from
t
he.
“Wo
r
m. w h
boy. h” that b
r
o
k
en o
u
t in
20
07.In fact,
a
bout
today’s te
chn
o
logy that ma
inly use
d
so
me co
nventio
nal metho
d
s
whi
c
h p
r
og
ra
mming
skill i
s
not
good. Such as, it infects Exe. corn and
other
docum
ents thro
ugh
U disk auto run info. And it
can’t ru
n after infection g
e
nerally. It infects the sh
are
d
folder. It can enume
r
ate
and sp
re
ad the
wea
k
p
a
sswo
r
ds of L
NN
compute
r
. Du
e to ther
e is
no adva
n
ced
hiding te
ch
n
o
logy. We
would
kno
w
that
on
ce it infe
cted
our
com
pute
r
..Howeve
r
,
In
today there
are
a lot of vi
rus of hig
h
skill
and hi
dden
well in ou
r com
puters. Such
as the
harm
br
ou
ght by “d
ove” that is
h
a
rd to b
e
fou
n
d
by general ordinary u
s
e
r
s
than by
”Worm. w h boy. h”. Beca
use
ordin
a
ry u
s
ers are d
epe
nd
ent
on antiviru
s
softwa
r
e, the
y
have no reco
gnition of
most of the emergi
ng virus. So it ca
n’t
intercept effect very well. This situation has ke
pt for many years. With
more an
d more chan
ges
in the viru
s, the viru
s in
dustry
chai
n
activities m
o
re a
nd m
o
re ram
pant, this p
hen
ome
non
become
s
more seri
ou
s, whi
c
h led to a u
s
er
’s mi
stru
st
of the
antivirus software
In ord
e
r to
so
lve the growi
ng ne
w th
rea
t
ant
ivirus ve
ndors
step i
n
two di
re
ction
s
at th
e
same
time
On the
one
hand.
The
y
used
the
tradition
al
cha
r
a
c
teri
stics ide
n
tificati
on
stren
g
theni
ng
engine h
u
llin
g and sampl
e
colle
ction,
sp
eed up the u
pdate
s
of the virus si
gnatu
r
e
Today, Thi
s
i
s
still the
mai
n
way to d
eal
with
and
so
on. On
the
ot
her han
d,
we
sh
ould
devel
op
the new vi
ru
s identificatio
n tech
nology,
su
ch a
s
be
havior recog
n
ition re
gistry
and ap
plication
prote
c
tion
an
d so o
n
.
Now, the viru
s
Trojan
nee
dn’t
evade th
e a
n
t
i-virus software
by mo
difying
the sign
ature
passively as befor
e they adopt Root kit technology
or other technolo
g
y prev
ent
actively from being di
scove
r
ed by the an
tivirus softw
are, or clo
s
e an
tivirus
s
o
ftware direc
t
ly. It
i
s
difficult to re
move the viru
s co
mpletely whe
n
it is found.
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 10, Octobe
r 2014: 738
9
– 7394
7390
2.
Curre
nt Di
ffi
culties Sy
stem Securit
y
D
e
tec
t
s Fa
ced
Due to
the a
n
t
i-virus
soft
wa
re u
s
e
d
by o
r
di
nary
users
without the
b
a
si
s of the
co
mputer.
Thus,
the an
ti-virus has
t
o
deal with viruse
s
by th
eir self. No
w, beca
u
se
a
n
tivirus
software
techn
o
logy h
a
sn’t rea
c
he
d
high sta
nda
rds that c
an a
c
curately ju
d
ge the viru
s
by itself, whi
c
h
cau
s
e
d
a lot
of virus
esca
ped b
e
ing
re
moved.
To
th
e
users who have
certai
n basi
c
com
put
er
techn
o
logy, t
hey ne
ed
soft
ware that
can
loo
k
ove
r
th
e
syste
m
info
rmation, the
n
j
udge
viru
s
and
resto
r
e the
ke
rnel date a
nd
date structu
r
e
s
that cha
nge
d by virus by themselve
s
.
Making up for the
shortage, it will make up fo
r the
shortage of the
antivirus software
i
n
judgme
n
t the suspici
o
u
s
files thro
ugh
software in j
u
d
g
ment the su
spi
c
iou
s
file throu
gh antivirus
manually
co
mbination
of tools a
nd p
e
ople. So a
s
t
o
achieve th
e real
active
defen
se, we
need
badly more e
fficient safety monitoring
software
sy
ste
m
beca
u
se most ordina
ry users’ soft
ware
s
y
s
t
em is
unsafe.
System safet
y
inspectio
n
mainly tests to
detect the key positio
n of system tha
t
hidden
trouble. Such
as pro
c
e
s
se
s threa
d
s reg
i
stry,
the port opened
syst
em docum
ent
s, etc. The virus
in orde
r to le
t themselve
s
not is easily
found.
So they are gen
erally used to
adoptin
g hidd
en
skill
s. Fo
r example viru
se
s can inje
ct
into the
key
system in th
e pro
c
e
s
s. Without
cre
a
ting
pro
c
e
s
s and
i
t
can
also
e
s
cap
e
the fire
wall. Th
e viru
se
s al
so
can
use
d
some
HOOK technol
og
y
or inlin
e HO
O
KED that can
be in Rin
g
Hook a
nd
ri
ngo
HOOK
whi
c
h
can.mo
dify the IAT table
as
well
as the E
A
T table B
e
cause d
r
iv
ers are
l
a
yered a
nd
IRP
pa
ss
i
t
on
laye
r by layer we ca
n let
the device
dri
v
er hoo
ke
d u
p
to a few ke
y drivers
(s
uch as file sy
stem) to
filtere
r
out the harm
of
the IRP in ou
rselve
s, so th
at use
r
s
ca
n’t detect
its
exis
tenc
e In order to detec
t effec
t
ively s
o
me
key info
rmati
on. We mu
st
deal di
re
ctly
with
syst
em
o
f
the bottom
whi
c
h
can
av
oid foole
d
by
the
v
i
ruse
s.
With the eme
r
gen
ce of lot
s
of Root
kit tech
nolo
g
y The HIPS techn
o
logy ha
s e
m
erg
ed.
The Chin
ese mean
of HIPS
is ho
st
intrusio
n
o
n
p
r
ev
ention syste
m
HIPS
i
s
kin
d
of software
that
can mo
nitor the ope
ration
of the compu
t
er. File
s and
the other files u
s
ed by d
o
cum
ents a
n
d
document
s chang
es re
gist
ry
and re
por
t
to you requ
e
s
t pe
rmissio
n
.
If you stop,
it will not b
e
to
run
or
cha
n
g
e
. For i
n
sta
n
c
e, you
doubl
e-cli
c
k o
n
a
v
i
rus prog
ram.
HIPs
rep
o
rt
you but you
stop
it, then the virus is
not ru
nning vi
ruses update
at a
first rate, which
ma
ke
s the footste
p
s
of
antivirus software
can’t
ke
ep up
with th
e viru
s,
but
HIPs
can
sol
v
e these
pro
b
lem, a
s
lon
g
as
you have eno
ugh professio
nal level,
you can only u
s
e
HIPs without
antivirus software. But HIPs
can’t call a firewall. It can
only be calle
d a firewa
ll system, becau
se it ca
n’t prevent the attack
behavio
r to your comp
uter by
other com
puter on the
netwo
rk.
2.1. Ne
w
Soft
w
a
r
e
De
sign of Tes
t
ing the Sy
stem’s Safety
With the ri
si
ng of the te
chni
cal level
of the virus cre
a
tor a
n
d
further
re
se
arch on
Wind
ows
kernel, now th
e
developm
en
t and re
se
ar
ch di
re
ction
of the virus t
e
ch
nolo
g
y have
adopte
d
the
Root
kit of technolo
g
y to make it di
sa
pp
ear in
user’
s
comp
uter fo
r
hackin
g
. It also
can
use
kernel technol
o
g
y to rid A
N
TIAV dire
ctly and th
en p
e
rform
fre
e
ly their
ope
rati
on
defen
se is th
e unity of op
posite
s
no m
a
tter in which aspe
ct, onl
y when we familiar with b
o
th
oppo
site can
we a
c
hieve a
better defen
se.
This
system’
s
desig
n is ba
sed on the mo
del.
The fun
c
tion need to be a
c
hieved
1>.Pro
ce
ss m
anag
ement u
nder
Ring
3
2>.Ri
ng0
che
ck p
r
o
c
e
ss th
at includ
e tho
s
e hid
den by
viruse
s an
d force and the
pro
c
e
s
s
3>.Sendi
ng IRP dire
ctly to the NTFS to view the hidd
en file or fold
ers
4>.Deleting fil
e
s man
dato
r
y
5>.viewi
ng a
nd re
stori
ng
SSDT
6> viewi
ng a
nd re
stori
ng
SSDT Shado
w
7.>Detectin
g
the stre
am of NTFS file
8>.Che
cki
ng
the port ope
n
ed by system
and sh
owi
n
g
the prog
re
ss
of openin
g
the ports
9>.Che
cki
ng
the LSP
10>Ch
ecking
the BHO.
11>.
C
he
ckin
g the system
kernel mo
dul
e
12>.T
he se
rvi
c
e man
age
m
ent of system
13>Syste
m
m
onitorin
g
14>.A
ctively
defen
se of sy
stem itself
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
A New Sys
t
emic
Safety
Detec
t
ing Soft
ware (Xilong Qu)
7391
2.2. The Gen
e
ral Ideal De
sign
De
signi
ng a
prog
ram i
n
terface to inte
ra
ct with
the u
s
er at first. Fo
r LSP, BHO registry
file stre
am d
r
ive and th
e rings i
nqui
ry
of se
rv
ice
st
artup
pro
c
e
s
s
can
call
th
e SDK fun
c
ti
ons
directly without use the dri
v
er. For SSDK, SSD
K Sh
adow, process killing
the process
strongly,
see
k
in
g the h
i
dden file, are
desig
n the corr
espon
ding
drive and o
p
e
r
ated in the d
r
ive.
2.3. Sy
stem
Architec
ture
Diagram
Becau
s
e the
prog
ram i
s
re
alize
d
und
er
the joint of Ringo an
d Rin
g
3
, it can be d
i
vided
into two
big
module
s
. O
n
e of them
is Rin
g0 a
nd
Ring
3. They
reali
z
ed
syn
c
hroni
zatio
n
a
n
d
comm
uni
cati
on b
e
twee
n t
hem th
rou
gh
the IOCTL. Ring3 i
s
divid
e
d into
pro
c
e
s
s ma
nag
eme
n
t
regi
stry ma
na
gement, n
e
twork ma
nag
e
m
ent, sy
stem
modul
e q
u
e
r
y, servi
c
e
an
d the l
oad
dri
v
er
query, B
H
O
man
agem
e
n
t Rin
g0 i
n
clude
pro
c
e
ss man
agem
e
n
t, conta
c
t fi
le qu
ery, S
S
DT
manag
eme
n
t, SSDK Shad
ow ma
nag
em
ent, active de
fense fu
nctio
n
modul
es i
n
the system, t
he
architectu
re d
i
agra
m
of the system i
s
sh
o
w
n in Figu
re
1.
Figure 1. System Archite
c
t
u
re Di
ag
ram
Service a
nd l
oadin
g
(1)
Process man
ageme
n
t, proce
s
s mana
gement
in
clu
des
conve
n
tional en
umeration
that uses th
e
sn
apshot a
n
d
the
e
nd
of the process t
hat u
s
e
s
the
Termi
nate p
r
ocess. Drivi
n
g
pro
c
e
s
s en
u
m
erate
the
p
r
ocess by tra
v
ersal
sy
ste
m
. Pro
c
e
s
s
manag
eme
n
t is to
view p
r
oce
s
s
that hidden b
y
virus. The
pro
c
e
ss
killed
forcibly
an
d the pro
c
e
s
s by terminal p
r
ocess. Beca
use
this fun
c
tion
can’t rea
c
h to
the bottom. It can e
nd
mo
st of the process that
re
m
a
in fore
pro
c
es
s
only.
(2)
The
regi
stry manag
eme
n
t:
The regi
stry come
true
th
e win
d
o
w
op
eration
that b
r
ing
s
the regi
ster itself. It mainly prevent
s the
regi
stry from IEOF by the
virus. Moreov
er it can dire
ctly
provide
the
i
n
formatio
n of
loo
k
ing
ove
r
IEOF a
nd th
e info
rmation
from
the
sta
r
t by the
m
selves
so that the user ca
n use it easily.
(3)
Viewing
the
hidde
n file
s: The
fun
c
tion re
alize
the fun
c
tion
of deletin
g
and
enume
r
atin
g the file by through send
IRP
to the NTFS file system
(4)
Network ma
n
ageme
n
t :Net
work m
anag
e is divide
d i
n
to port p
r
o
c
ess map
p
ing
that
can vie
w
the port of syste
m
and sh
ow
the pro
c
e
ss
of openin
g
p
o
rt, so that re
alize the fun
c
tion
repo
rt and LS
P viewing
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 10, Octobe
r 2014: 738
9
– 7394
7392
(5)
Module
information q
uery
system:
Thi
s
fun
c
tion i
s
mainly lo
ok over th
e m
odel
informatio
n that loaded into
the system
kernel
and
let the user vie
w
the driver m
o
dule of loadi
n
g
virus into the
kernel. It realize
d
by call
ing the
Nt Q
uery System
Information.th
at system do
n’t
anno
un
ce to query mo
dule
in the kern
el spa
c
e.
(6)
Viewing
the
NTFS
stre
am
file: Du
e to
desi
gn fla
w
s i
n
wi
ndo
ws ex
plore
r
ca
n’t, view
the st
ream
file of bli
nded
in file
s a
n
d
fleers
that
viruse
s
hidd
en regul
arly,
this fu
nctio
n
is
desi
gne
d for this situ
ation
whi
c
h can di
splay
the strea
m
files’ name
of file and folders.
(7)
SSDT: Because the SSDT
is the portal of
ring3 enteri
ng ring0.It is a battleground of
virus an
d ant
i-viru
s softwa
r
e, SSDT ma
nagem
ent m
a
jor view the
chan
ged SS
DT entri
es a
n
d
read o
r
igin
al SSDT from the NT
DLL, d
ll and drt the corre
c
t SSDT table address throu
gh the
repo
sition
an
d u
s
e it
to
selectively
restore
th
e p
r
o
c
ess of
Hooked
(B
ecau
se
so
me
antivirus
softwa
r
e al
so
use this te
ch
nique
). SSDT
Shadow
i
s
si
milar to SSDT but it doesn
’
t have export.
(8)
SSDT Sha
d
o
w
: Thi
s
fun
c
t
i
on is si
milar to the SSDT, but the S
S
DT Sha
d
o
w
is
anothe
r table
of the system
it will be nee
d to use
only
if the applicati
on is the form
of windo
w.
(9)
Active defen
se: System
realizes the a
c
tive defe
n
se
prim
arily by
the
HOOK
Zw
Open Process functio
n
whi
c
h can preve
n
t ot
her process to openi
n
g
prote
c
ted p
r
ocess.
(10
)
Information
servi
c
e
s
an
d
drivers lo
ad
ed:
It is mainly to check the sy
stem
service
prog
ram
info
rmation. Viruses
of regi
stered itself
a
s
a
system
service p
r
og
ram. S
oap
s to
re
alized
tak
e
the initiative to s
t
art with the s
y
s
t
em.
(11
)
BHO: BHO
i
s
a
hel
per ob
ject of
bro
w
se
r, which b
e
l
ong
s to th
e
COM
co
mpo
nents.
After installati
on, they will becom
e
a part of the browser;
you can di
rectly c
ontrol
the browser f
o
r
the sp
ecifie
d
operation. According
to the
need, it
can l
e
t you op
en t
he spe
c
ified
web
s
ite. o
r
e
v
en
to coll
ect
all
kind
s
of p
r
ivate letter i
n
yo
ur
syst
em. S
u
ch
a
s
the
h
o
me p
age
is
cha
nge
d. IE
boot
will POP up ads and
so
on.
At present, the browse
r hi
jack has become one of t
he biggest threat
to Internet users. Actu
ally “bro
wser hij
a
ck is through t
he BHO te
ch
nology is le
ga
l”.
BHO management is
by re
ading HKEY_LOCAL_MACHINE\SO
FTWARE\Mic
ros
o
ft\Windows\
The key na
m
e
unde
r Cu
rrent Versi
on\Explore
r
\Bro
wser Hel
p
e
r
Obj
e
cts, which re
ading
the DLL file p
a
th by loadin
g
the co
rre
sp
ondin
g
.
Service
s
and lo
adi
ng the drive
r
is to view the
path of the se
rvice p
r
og
ram
in the syste
m
. Many vi
ruse
s regi
st
e
r
it
self
f
o
r t
he s
e
rv
ice t
o
st
a
r
t
with s
y
s
t
em.
3. Implementation
Due
toy the l
i
mitation of
space, this
art
i
cl
e o
n
ly list
s
the impl
eme
n
tation p
r
o
c
e
s
s that
Ring
3 layer view the proce
ss.
This fu
nctio
n
get a
snap
shot
by: Cre
a
teT
oolh
e
lp3
2
Snap
shot
a
nd it al
so
ca
n get
a
pro
c
e
ss PI
D
and p
r
o
c
e
ss
name by: Pro
c
e
s
s32Fi
r
st
a
nd Pro
c
e
s
s3
2, Next pro
c
e
ss
enum
erating
the process
snap
shot. Th
e
impleme
n
tation of o
peni
n
g
the process
operation
w
ill
fail whe
n
di
d
n
’t
put the pro
c
e
ss of p
e
rmi
s
sion to d
ebu
g permi
ssio
ns. So call: A
d
just To
ke
n Privilege
s.rig
h
t to
bring
up thi
s
pro
c
e
ss to th
e De
bug p
e
rmissi
on
s,
Th
en call ::Ope
n Pro
c
e
ss.o
p
en.the process to
get the pro
c
ess handl
e. Finally, we can get t
he path name by
process ha
n
d
le callin
g: “Get
Module Fil
e
Name Ex”
The co
de im
plementatio
n is as follo
ws:
1) Get a snap
shot of the proce
ss
H Process Snap = ::CreateToolhel
p32S
nap
shot( T
H
32CS_S
NAPPROCESS,.0 );
2) Improving the pro
g
ram p
e
rmi
ssi
on to Deb
u
g
……
if (!::”Open Process Tok
en ”(Get
Curre
nt Process
(),.TOKEN_ADJUST_P
R
IVILEGES|TOKEN
_QUERY,.
&h Tok
e
n))
Return
FALSE;.
Privilege
s. Privilege Co
unt = 1;.
Privilege
s. Privileges [0].Attribute
s
= ea
bl
e?SE_PRIVILEGE_ENAB
LED:0;
if (!::Look up
Privilege Value (NULL, SE_
DEBUG_NAME,.& Privile
ges. Privileges [0]..
Luci
d
))……
B Result
= ::Adjust To
ken
Privilege
s ( h
Toke
n, .FALSE, .& Privileges, .size of
(TOKEN_PRI
VILEGES),.NULL,.NULL);.
3) Enume
r
ati
on pro
c
e
s
s snap
shot to
ge
t a the process PID and p
r
o
c
e
ss n
a
me
……
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
A New Sys
t
emic
Safety
Detec
t
ing Soft
ware (Xilong Qu)
7393
If ( ! Process32First( h Pro
c
e
ss Sna
p
,.& process Entry ))
Return;
……
Do {
……
.h Process=::
Open Pr
ocess(P
R
OCESS_ALL_A
CCE
SS, false,
pro
c
e
ssE
ntry.th32Pro
ce
ssID);
::Get Module
File Name E
x
(h Process, NULL, Pro
c
e
ss Path,
MAX_PATH);
…:
Close
Ha
ndle(h
Pro
c
e
s
s);
}
while
( ::Proce
ss32
Next( h Process Sna
p
,.& proce
s
s Entry ));
:: Clos
e Handle (h Proc
ess
Snap);/
Results are as follows:
Figure 2. Gen
e
ral Enum
era
t
ion Process
Re
sults 1 d
e
liberately
ch
o
s
e
som
e
wel
l
-kn
o
wn b
o
th
at dom
e
sti
c
and
forei
gn
several
antivirus
software and p
e
rf
orm a co
mpa
r
iso
n
test of the syste
m
.
Table 1. The
Four
Core Fu
nction
s in the
Test
Re
sult
s of the System Compa
r
e
with the Software
use
d
at Hom
e
and Abroad
Process
Management
Test:Select IceSw
o
rd
process,.click rig
ht
then mandato
ry t
r
y
to
end of the p
r
oce
ss
Test of find hidde
n files:
use the "Worry
hidden"soft
w
a
re.
H
ide
the folder of c: \
demonxjj
SSDT detection:
Open sp
y
sw
ord, if HOOK
can be
detected, or H
O
OK
function can display
module resides.
Test of Active
defense: Op
en th
e
sy
stem, int
r
oduc
es its
process b
y
use t
he
Task Manager
。
The s
y
stem
can
can
can
Can not
Kaspersky
Can not
Can not
Can not
can
Avast
Can not
Can not
Can not
can
Kingsoft
Can not
Can not
Can not
can
Rising
Can not
Can not
Can not
can
4. Conclu
sion
This tre
a
tise
desi
gne
d the new type of syste
m se
cu
rity detection software m
a
inl
y
use a
lot of drive
r
pro
g
ra
mmin
g
technolo
g
y and
Win
d
o
w
s core
pro
g
rammi
ng te
chn
o
logy. T
he
appli
c
ation la
yer software
dire
ctly use
s
the SDK to
write interface, driver u
s
e
r
WDK to. The SDK
to write inte
rface,
drive
r
u
s
e
s
WDK
to
he m
a
in
advantage
of the
software i
s
able to
view
the
hidde
n pro
c
e
ss an
d hidd
e
n
folder. It also ca
n fore e
n
d pro
c
e
s
s, mandato
r
y delete folders can
view the rest
ore SSDT, L
SP the pro
c
ess of po
rt mappin
g an
d
so o
n
, One
of the bigg
est
cha
r
a
c
teri
stic is to view
a
nd re
sto
r
e S
S
DT
Sha
dow. The BHO
registry
and
system monito
ring
module i
s
introdu
ce
d in d
e
tail, becau
se their prin
ci
ple and impl
ementation i
s
simple, we
can
modify the
BHO
and
re
gistry th
rou
g
h
the
re
gistry API
func
tion. In the as
pec
t
of
s
ystem
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 10, Octobe
r 2014: 738
9
– 7394
7394
monitori
ng p
r
i
m
arily thro
ug
h HO
OK Z w
Cre
a
te Key a
nd Z w Ope
n
Key. and pre
v
ent files to b
e
deleted.
Due to
the
softwa
r
e
dev
elopme
n
t time is limite
d
t
heir l
e
vel is
not high,
so
in the
comp
atibility and
stability
of the
softwa
r
e is very p
o
o
r
an
d i
s
n
o
t very po
we
rful.
It is ba
dly sh
ort
of the fam
o
u
s
. Ice
s
word
and
uses che
c
k in
m
any fil
ed..The
only
advantag
e i
s
able to
view the
SSDT Shad
o
w
an
d re
sto
r
e those ad
dresse
s of
HO
OK. Please
keep the im
po
rtant date
wh
en
usin
g to avoid BSOD.
Ackn
o
w
l
e
dg
ements
The a
u
thors
gratefully a
cknowl
edge
the
sup
p
o
r
t from
the followi
ng
spo
n
sors: Provincial
Natural S
c
ie
nce
Fou
ndati
on of
Hu
nan
(
13
JJ902
2) &
(11
J
J90
1
8
)
and
Provin
cial S
c
ien
c
e
&
Tech
nolo
g
y Plan Proje
c
t of Hun
an(201
0
G
K3048
) & (2
013GK3
029
).
This re
se
arch is supp
orte
d by the
con
s
tru
c
t p
r
og
ra
m of the
key discipli
ne i
n
Hu
nan
provin
ce.
Referen
ces
[1]
Sun Li, Li Y
a
n
g
, Li Ji-Yun. T
he CEP-Bas
e
d
Correl
a
tion S
o
lutio
n
of Monit
o
rin
g
Events o
n
Distrib
uted It
Resources.
Co
mp
uter App
lica
t
ions an
d Softw
are
. 2013; 30
(8): 303-3
06.
[2]
QU XiL
ong,
H
A
O Z
hong
Xia
o
,
BAI LinF
e
ng.
Res
earch
of
Distribut
ed S
o
ft
w
a
r
e
R
e
so
urc
e
Sh
arin
g i
n
Clou
d
M
anuf
ac
turing
S
y
stem.
Internatio
na
l J
ourn
a
l
of Adv
a
nc
e
m
e
n
ts in
C
o
mputi
ng T
e
c
h
nol
ogy
. 20
11
;
3(10): 99
–1
06.
[3]
Jian-
qua
n Ou
yang,H
ua
Nie,
Min Z
h
a
ng. F
u
sing
Aud
i
o-Vis
ual F
i
ng
erpri
n
t to Det
e
ct T
V
Commerc
i
a
l
Advertisem
ent.
Computers a
n
d
Electrica
l
En
gin
eeri
n
g
. 20
1
1
; 37(6): 99
1–1
008.
[4]
QU XiL
o
n
g
, BAI LinF
eng HAO
Z
hong
Xi
ao M
D
3 Mod
e
l Lo
ad
ing i
n
Game.
Journ
a
l of Co
mputers
. 2
0
12;
7(2): 521-
52
7.
[5]
W
ang Bi
n-Ju
n, W
ang J
i
ng-
ya
, Du Ka
i-
xua
n
,
Han
Yu. R
e
se
arch o
n
attach
an
d strateg
y
of CAPT
CHA
technology
.
Ap
plicati
on R
e
se
arch of co
mput
ers
. 2013; 3
0
(9
): 2776-2
7
7
9
.
[6]
CHEN Yu
e E, W
A
NG Yong, QU Xi-L
on
g. Estimati
on of th
e Maximum Output Po
w
e
r of
Doub
le-C
la
d
Photon
ic Cr
ystal F
i
ber L
a
ser.
Chin
ese Phys
i
cs Letters
. 201
2; 29(7): 74
214
-742
17.
[7]
Che
n
Qiao,
Xu
Mai-cha
ng, Qu Xi-lo
ng. H
eat
Gener
ati
on b
y
Electrical
Curr
ent in Qu
antu
m
Dot S
y
st
e
m
w
i
t
h
F
ano R
e
s
ona
nce.
Co
mmune T
h
e
o
ry. Phys.
2012; 5
8
(
2
): 295-2
99.
[8]
PENG
Xia
o
, H
U
Z
h
i
Gang,
QU Xi
Lon
g.
H
y
brid-P
olic
y
Co-al
l
oc
ation
Mode
l i
n
C
o
m
putatio
na
l Grid
.
Journ
a
l of Softw
are
. 2012; 7(
2): 382-3
88.
[9]
Z
hou Yo
u-
yi, Don
g
Da
o-gu
o
,
Jin Che
ng. D
e
sig
n
an
d App
l
icatio
n of Main
Memor
y
Data
base i
n
Hi
gh-
Conc
urrenc
y C
l
uster Mon
i
tori
ng S
y
stem.
Co
mp
uter App
lica
t
ions an
d Softw
are.
2011; 28
(6): 128-1
30.
Evaluation Warning : The document was created with Spire.PDF for Python.