进程分析工具XueTr

XueTr is a free anti-virus&rootkit utility.It offers you the ability to detect, analyze and fix various kernel structure modifications and gives you a wide scope of the kernel.With its help,you can easily spot and remove malwares hidden from normal software. XueTr currently supports the following Windows 32-bit versions: Windows 2000 SP4 Windows XP (no SP,SP1, SP2, SP3) Windows Server 2003 (no SP,SP1,SP2,R2) Windows Vista (no SP,SP1,SP2) Windows Server 2008 (no SP,SP1) Windows 7 Currently,the following features are available: *Process Manager View system process and thread basic information. Detect hidden processes,threads,process modules. Terminate, suspend and resume processes and threads. View and manipulate process handles,windows and memory regions. *Kernel Module Viewer Display kernel module information including ImageBase,Size,Driver Object,ImagePath,ServiceName and Load Order. Detect hidden kernel modules. Unload kernel module(dangerous,never try it on Windows 7). Dump kernel image memory. Display and delete system driver service information. *Hook Detector View and restore SSDT,Shadow SSDT,sysenter and int2e hooks. View and restore FSD and keyboard disptach hooks. View and restore kernel code hooks including kernel inline hooks,patches,IAT and EAT hooks. View and restore usermode process hooks incluing inline hooks,patches,IAT and EAT hooks. View and restore message hooks(both global and local). View and restore kernel ObjectType hooks. Display Interrupt Descriptor Table(IDT). *System Callback Viewer Display and remove Kernel Notifications(Process/Thread/Image/Registry/Lego/Shutdown/Bugcheck/FileSystem/Logon). *Network Viewer Display current network connections, including the local and remote addresses and state of TCP connections. View and delete IE plugins and context menu. View and restore tcpip dispatch hooks. Display winsock providers(SPI). View and edit hosts file. *Filter Viewer View and remove filters for common devices including disk,volume,keyboard and network devices. *Registry Viewer View and edit system registry. Detect hidden registry entries using live registry hive analysis. *File Explorer Detect hidden files using both disk analysis and driver methods. View and delete locked files and folders. View file basic information including NTFS Alternate Data Streams. *Autorun Manager Display and delete common autorun entries. *Service Manager Display Win32 service information (for Ring0 modules,it is included in Kernel Module Viewer). Change service status and configuration. *DPC Timer Enumerate and delete DPC Timer objects. *Miscellaneous View and repair common filetype assosications. View and repair image hijacks. *Settings Option to defense from process creation,thread creation,module load and message hook installation. Option to defense from file creation,registry key creation. Option to prevent system suspend,log-off,shutdown and reboot. Option to prevent locking workstation and switching destop. option to prevent setting system time. Warning:Use it at your own risk.This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY. 2010-11-30 Special version for www.52pojie.cn: *Added worker thread enumeration feature *Fixed several bugs. 2010-10-01 V0.37: *Added mouse driver irp hook scan *Added user32.ll:_apfnDispatch hook scan *Added LSP/Safeboot repair feature *Added list and remove feature for hidden reg *Fixed several bugs. 2010-07-16 V0.36: *Added GDT detection feature *Added Object Hijack detection feature for detecting the TDL3 malware *Fixed one potential BSOD 2010-07-07 V0.35: *Fixed one potential BSOD *Fixed several bugs. 2010-05-16 V0.34: *Added MBR Rootkit detection feature *Added Input Method Editor(IME) enumeration feature *Added classpnp\atapi\acpi irp hook scan *Fixed two potential BSODs *Fixed several bugs. 2010-04-01 V0.33: *A�