1:еģ顢ʾ

  ʾ΢ļʹˡУ΢ļǩܺͨ΢ļҲʾ
  SSDtҼȫʾĬ϶ȡѡʾSSDTѸĵĿ
  
2:Wsyscheckɫʾ

ҳ

  ɫʾ΢,ϺɫʾȻ΢,ģз΢ļ

ҳ

  ɫʾ÷΢,Ҹ÷.sys.exe.dllķľʹַʽ

  ʹáֵɫʾмֵϵͳпɱұҲпľļֵ

  ȡˡģ顢ʾ󣬲鿴Եļ̡򣬽ʹá͡޸ڡ׹۲쵽ľ

  ҳв鿴ģҳв鿴ʹü̵¼ơ

  ʹáá-У΢ļǩϺɫʾδͨ΢ǩļͬʱڸʾ"΢ļУ"ʾPassno pass(Ծݴ˲οǷǼð΢ļעϺɫʾ࣬ϵͳϳGhost棬Щ汾ܾ΢ǩݿԽ)

SSDTҳ

  ĬʾȫSSDTɫʾں˱HOOKĺ鿴ģ飬Եαǩӳ·HOOKģһǰ档Ҳȡȫʾ,ʾڸı˵ĺ

  SSDTҳġ쳣ʾYES,úInline HookһͬʱڴHOOKַHOOK,Ӧģ·ʾInline Hook·ʹáָǰ롱ָֻInline Hook·ʾΪַHOOKģ·ʹáָǰַܾͻָĬϵĺˡ
  
  ʹáָкͬʱָHOOK

  ľ޸SSDTʱȻָSSDTעɾȲ

ļҳ

  ɫʾĳݡ

3:Wsyscheck״̬ʾ棡δسɹһЩ޷ɡ

  ǰȫֹWsyscheckWsyscheckĹһòҪķɶϵͳ޸

  سɹ,ľļֱʹWsyscheckиҳеɾļ,ܴСֱɾеļĹܡ

4:жģ

  HOOKϵͳؼ̵ģжؿܵϵͳģдйϵжز˵ģ鲻Ҫǿжأɾģļ(ʹɾļʧ)

5:ļɾ

  ص,WsyscheckɾѾ,ļɾ(ģֱʹҼ´ɾĸ),صDLLļɾȻļȻɼʵɾɹ۲쵽ļʧ

  ļҳġɾɾļվֻ֧Ŀ¼µļɾӦעļڻվڣʹֱɾܡʹüйܽƵһطܿվڵļɾǸΪҼɾɾվ

  Ϲɾ˵ļʹWsyscheckĻdosɾܡʹádosɾܺ˵һɾļִкԶļȥӵdosɾڶϵͳ¿ܴһЩ⣬áҪWdosdel.datWsyscheckһŻʾҳ档

  ɾΪ޷ʹõһֶָΣɾ롰Dosɾͬʱʹáбֶ༭,һһļ·ɡرճʱ֮һɾбѯǷִС

  Ҫɾļ,µġɾļǰļɾǰļݵ%SystemDrive%\VirusBackupĿ¼Уҽļ.vir׺ִС

6:ڽ̵Ľķ

  ʹýҳġֹСܾеIFEOٳֹܣǿʹһЩԶĳִͨļõĳáȫ顱ҳġóܣ,ľʹIFEOٳֺҲԡóлָٳֵĳ

  ⣬µġֹļľķļдעмӻֹ,ʹñܸܺɵɾľļע
  ֹֹļԶӡ־ҳȡҳʧԹ۲һ־ԱֹĶҵȽصľļעǣľϵͳ̣ӳ־ֹϵͳ̵ĶҪҷֱöǷкý̵ģļ

  Ҫ־ȡǰCtrl+Aȫѡơע,Ϊֹ־,1000Զɾǰ400־

  ,㻹ʹýеġ߳Ϣܣ߳ģӦϵйӦ̣߳Ȼػػֱִɾļܡ

7:ľļ򵥷

  򵥵ķǣسɹ,ľļֱʹWsyscheckиҳеɾļܣǿɾľļ,ִϵͳעȼ;

  Ѵľ²Ϊһο
  a.SSDTľģڹ,ȻָSSDT,ڷҳľķļ
  b.ľ̺󷴸ľԳʹá̲ɾļ򡰽ֹС,䲻ɾ
   ʹáֹļ䲻ٴ½̡ļЧ
  c.Щľ÷עһ²жһ·ҳеĺɫʾ״̬STOPAutoйһΣп˱ľ
   d.ǿҽעһ¡óĿǰIFEOɱľľǱȽеġ
   e.ļҳг˿ܵ;һһǷľĿ
   f.ļáʱ䡱ڲļ
   g.ڼʮֿ϶Զλע·ǰϡַ´βٹ۲ϵͳǷжǷһľ
   h.Autorun.infʽľùµġAutorun.infܣϡֹļʹȡõЧֶоʹWsyscheckõļԷ˫̷ٴμľֶɾAutorun.infļǰWsyscheckļдļ鿴ľľλҵľļʱһ¸̸Ŀ¼Ա֤ȫAutorun.infļ
   i.ʹáֹļעһ־ҳԱҵľĸԴ־ҳ۲쵽дļдעĽ̡˽Ƿϵͳʱֱӹرղɾϵͳ̣Ҫֶһ¸ý̵ģ飨ϲ鿴һ»ҳļڿҵľϵͳ̵ģ飩ļעɺҪ˳ֹļӦֱʹùµġȷǵɹ
   j.ȷľļֱɾɾֱɾҵɾϵͳϵͳټش˳ļɾľıȽϺãʽʧЧ,DOSɾɾļ

8:WsyscheckԴȼ

  Wsyscheck 1 ڱ׼  Wsyscheck 2   Wsyscheck 3 ʵʱ

  ҪʵʱWsyscheck,Ա༭һ RunWs.bat ,Ϊ Wsyscheck 3
  RunWs.batWsyscheckһ˫RunWs.batWsyscheckʵʱȼ

9:ֹ˵(ָ˵µӲ˵)

  ʱļ:ɾ%TEMP%,%windir%\Temp%windir%\Downloaded Program Filesµļ

  Autorun.inf:̸Ŀ¼µAutorun.infָļɾ̵Autorun.infָļ

  ޸ļʾӲԶ:˵̫д,ܻ޷˫򿪹ϡע⣬ĳЩ޸ҪעЧ

  ޸ȫģʽĳЩľƻȫģʽļֵ޷밲ȫģʽȱݵǰȫģʽֵٻָĬϵİȫģʽֵ

  ȫԭSSDT(ĳЩɱԭSSDT,ܽKvϵ,Kav6.0ʹû,汾вԡ粻ȷ,ʹñǰ˳ɱ),ֻϵͳļ̣ȻִӲ˵ܡ

  WsyscheckĴڱѲȡַ,Ȼľ,뽫WsyscheckС


                                                            Wangsea 20071109
                                                            Wang6071@sina.com.cn
  












