摘要： 研究了Windows操作系统下的一种新型木马技术。该木马结合了Winsock2新特性SPI技术、Windows内核技术中远程植入线程技术、Windows文件系统中动态链接库(DLL)技术,并借鉴了防火墙数据报过滤和拦截的一些特性,实现了一种新的木马隐藏形态。
关键词:
木马,
服务提供接口,
远程植入线程,
动态链接库
Abstract: A new trojan horse on Windows operating system is presented. This technology combines SPI which is a new characteristic in Winsock 2 with remote thread injecting in Windows kernel and DLL(dynamic-link libraries) in Windows file system. And it uses some characteristics in filtration and interrupt of firewalls for reference. A new trojan horse hiding style is realized.
中图分类号:
施勇,薛质,李建华. 基于SPI及远程线程技术的新型木马研究[J]. , 2005, 31(07): 154-156.
SHI Yong, XUE Zhi, LI Jianhua. Study on a New Type of Trojan Horse Based on SPI and Remote Thread[J]. , 2005, 31(07): 154-156.