Icesword concise tutorial

IceSword, also known as an ice knife or blade, IS a powerful tool for system diagnosis and removal by PJF of USTC.

There are countless tools to remove rogue software. Why is it the first? There are the following reasons:

1) Do you often have files that cannot be deleted? For example, CNNIC or 3721 file?

2) Is there a regular registry that you cannot modify? For example, the CNNIC registry is automatically protected.

3) Is there a common problem that a process cannot be killed and the system prompts "cannot be completed "?

4) is there more than N plug-ins in the browser?

5) does some programs hide the process and port while running the program?

6) Is there any rogue software file invisible in the resource manager?

1. Most so-called process tools are written using Windows Toolhlp32, psapi, or ZwQuerySystemInformation System Call (the first two eventually use this call, you can easily kill any ApiHook, not to mention some kernel-level backdoors. A very small number of tools use the kernel Thread Scheduling structure to query processes. This solution requires hard coding, not only are different versions of the system different, but a patch may also need to be used to upgrade the program, and some people have also proposed methods to prevent such a search. The IceSword process search core State solution is unique at present. Considering the possible hidden means of kernel backdoors, we can detect all hidden processes.

2. Most tools use Toolhlp32 and psapi to find the process path. The former calls the RtlDebug *** function to inject a remote thread to the target, and the latter uses the debug api to read the target process memory, essentially, it is an enumeration of PEB. By modifying PEB, it is easy for these tools to find the north. The core State Solution of IceSword originally displays the full path, and is also displayed when it is cut to other paths during running.

3. The same is true for process dll modules and 2. Other tools using PEB will be easily spoofed, while IceSword will not be mistaken (a very small number of systems do not support it, and PEB enumeration is still used ).

4. The process of IceSword is powerful and convenient (of course there will be danger ). You can easily remove multiple selected processes. Of course, to be specific, there are three other reasons: idle process, System process, and csrss process. Other processes can be easily killed. Of course, some processes (such as winlogon) will crash after they are killed.

5. There are indeed many port tools on the Internet, but there are also many methods to hide ports on the Internet. These methods do not work for IceSword. In fact, I wanted to bring a firewall for dynamic search, but I didn't want to make it too bloated. The port here refers to the port to which the IPv4 Tcpip protocol stack of windows belongs. The third-party protocol stack or IPv6 stack is not listed here.

At present, some rogue software uses the following methods: thread injection, process hiding, file hiding, and driver protection. Common users want to delete the file or find out the process, it is very difficult. Some of them can be seen. They can't be deleted, they can't be killed, and they're in a hurry. They can't be done. You still need to delete files from another system. For example, the rogue software that adopts driver protection, such as CNNIC and Yahoo assistant ,. when the sys driver is loaded, it filters out the file and the Registry, and returns a true value directly. Windows prompts that the file has been deleted, but it is still there. Some file deletion tools, such as unclocker, are invalid. IceSword is currently the only tool known to be able to directly delete such loaded drivers and adopt registry protection. Rogue software such as CNNIC can be cleared without restarting.

IS adopts many novel and kernel-level methods and techniques. The technical details of it are not discussed in this article. The following describes its main functions from the user's perspective:

■ View Processes

Including the file address of the running process, various hidden processes, and priorities. It can also be used to easily kill processes that cannot be killed by tools such as task manager and Procexp. You can also view the thread, module information, and end thread of a process.

■ View port

Similar to cport and ActivePort tools, this tool displays the current local product, corresponding application address, and name. This includes tools that use various methods to hide ports.

■ The kernel module is loaded into the PE module in the system and space. Generally, it is a driver *. sys. You can see various loaded drivers. Include some hidden driver files, such as IsDrv118.sys, which are invisible in the resource manager.

■ Start group

It is easier to understand the related methods in the Windows Startup Group. Unfortunately, the deletion function is not displayed, so you can only view it.

■ Service

Used to view hidden or unhidden services in the system. Hidden services are displayed in red. Provides services such as start, stop, and disable.

■ SPI and BHO

These two are more and more important aspects of rogue software. SPI is an interface provided by a service, that is, all Windows Network Operations send and receive packets through this interface. Many rogue software replace this. dll so that all users can access the network package and put some advertisements in a targeted manner. If you delete the. dll file, the network cannot be used or accessed. Tools such as LSPFix are designed for this function. BHO, not to mention, is a helper plug-in for browsers. When a user starts a browser, It can automatically start and pop up an advertisement window or something. These two items only provide the viewing function.

■ SSDT (System Service Descriptor Table)

System Service description table. kernel-level backdoors may modify this service table to intercept service function calls, especially some old rootkits, as mentioned above, ntrootkit uses this hook to hide the registry and files. The modified value is displayed in red. Of course, some security programs also modify the value, such as regmon.

■ Message hook

If you use SetWindowsHookEx In the dll to set a global hook, the system will load it into the process using user32, so it can also be used as a process injection method without process Trojans.

■ Thread creation and thread termination monitoring

"Monitoring into thread creation" records the incoming thread creation call records during IceSword operation in the loop buffer, and "monitoring process termination" records the termination of a process by other processes. Example: When a trojan or virus process is running, check whether there are any anti-virus programs such as norton processes. If IceSword is running, this operation is recorded, you can check which process is used to locate and end a trojan or virus process. Another example: a trojan or virus uses multi-thread protection technology. You find that an abnormal process has ended. Later, it becomes up again. You can use IceSword to find out which thread has created this process, remove them together. The "Settings" menu item may be used in the middle: In the Setting dialog box, select "prohibit thread creation". At this time, the system cannot create processes or threads. After you safely remove suspicious threads, you can cancel the prohibition.

■ What are the disadvantages of Regedit in the registry?

Speaking of Regedit, there are too many shortcomings. For example, the length of its name is limited. You can create a sub-item with a full path name larger than 255 bytes (programming or using other tools, such as regedt32 ), this item and the subkey behind it cannot be displayed in regedit; otherwise, the subkey regedit with special characters intentionally created by the program cannot be opened.

Adding registry editing in IceSword does not solve the above problem, because there are already many good tools to replace Regedit. In IceSword, the "Registry" item is written to search for registration items hidden by Trojans and backdoors. It is not blinded by any current registry hiding techniques, so that you can see the actual content of the Registry reliably.

For example, the key value HKLMSYSTEMCurrentControlSetServicesdnport added by CNNIC is used to load the driver file cndport. sys. Using Regedit, you will have an error and cannot delete it. But with IS, it can be easily killed.

■ File Creation

The IS file IS a bit similar to the resource manager. Although it IS not so convenient, its unique function IS its anti-hiding and anti-protection functions. The security side effect is that files such as system32configSAM cannot be copied or opened, but IceSword can be copied directly. Similar to the loaded driver, such as the CNNIC cdnport. sys file, only the IS file can be deleted directly. Other methods cannot break the protection of the driver.

CopyLock and KillBox are invalid even for most useful unlocker instances. By adding PendingFileRenameOperations under HKLMSYSTEMCurrentControlSetControlSession Manager without the complete deletion mechanism of Windows systems, this is the last move of all the stubborn File Deletion tools, however, it is also disabled by driver protection. In the past, it was necessary to restart and start to another production system to delete it.

---- The real means to build rogue software are useless.

The internal functions of IceSword are very powerful. You may have used a lot of software with similar functions, such as some process tools and port tools, but now the system-level backdoor functions are getting stronger and stronger, generally, process, port, registry, and file information can be easily hidden. General tools cannot find these "behind-the-scenes ". IceSword uses a large number of novel kernel technologies to prevent these backdoors from hiding.

IceSword uses a large number of novel technologies and is different from other common process tools. For example, IceSword can end all processes except the Idle process, System process, and csrss process, other similar software cannot do this. Of course, some progress may not be convenient, such as the winlogon.exe process of the system. Once killed, the system crashes. Pay attention to this.