Management of driver. sys

Source: Internet
Author: User
Tags ssdt

Recently, security tools such as SSDT have been removed from the virus epidemic. So far, the SSDT recovery of these viruses is basically achieved by loading a virus driver. sys. As long as the virus driver is not loaded, it is much easier to process it even if it is done. Therefore, how to properly manage system drivers without leaving loopholes for such viruses is a concern for every user.
Here, I will use the "Software Restriction Policy" and rising's "active defense" settings to deal with such viruses. The sys Solution and Its Protection effects are described as follows:

1. Set "Software Restriction Policy" to treat system. sys and non-system. sys differently.


2. Protect files in the drivers directory from changes.


3. Special case handling-IceSword operation problems.

4. Rising's own protection problems.
 
5. The above scheme protects against the two popular virus samples. sys. This solution is only designed to prevent virus driver loading,

Protection against virus files other than. sys is not covered in this post.


6. Supplementary Note: by default, the "assigned file type" in the "Software Restriction Policy" does not include SYS. You must add the following files on your own:


7. Additional instructions: Prohibit malicious programs from deleting group policy settings

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.