查看: 2039|回复: 7
收起左侧

[已解决] 电脑中毒一定可以在进程中体现吗

 关闭 [复制链接]
leviceo
发表于 2009-1-13 17:22:23 | 显示全部楼层 |阅读模式
如果中毒了,在进程中一定可以看出来吗?
有不在进程中显示的病毒吗
伊の星
发表于 2009-1-13 17:26:24 | 显示全部楼层
不一定能在进程中体现
有些病毒只需被读就会有所动作
而被读取是不会创建进程的。
leviceo
 楼主| 发表于 2009-1-13 17:51:22 | 显示全部楼层

回复 2楼 伊の星 的帖子

被读取是什么意思呢? 双击一个程序算是被读吗
伊の星
发表于 2009-1-13 17:55:42 | 显示全部楼层

回复 3楼 leviceo 的帖子

双击程序之前,必须先读取该程序文件
然后再创建新进程,等等
如果不先读取,那你就无法获得程序信息和在用户界面中看到它了
JY-YZX714
发表于 2009-1-13 18:00:24 | 显示全部楼层
病毒运行的话当然有进程
不过可以通过特殊手段隐藏自己,一般任务管理器是看不到
不过稍微NB点的比如进程查看工具比如冰刃之类的是可以枚举到的
JY-YZX714
发表于 2009-1-13 18:04:39 | 显示全部楼层
在msdn中对进程有详细定义:
进程是一个正在运行的程序,它拥有自己的虚拟地址空间,拥有自己的代码,数据和其他系统资源,如进程创建的文件,管道,同步对象等。一个进程也包含了一个或者多个运行在此进程内的线程
明白了吗?也就是说程序运行就有进程,不过看不看不到是另外一回
补充一下MSDN原版资料,lz可以看看:
About Processes and Threads
Each  process provides the resources needed to execute a program. Aprocess has a virtual address space, executable code, open handles tosystem objects, a security context, a unique process identifier,environment variables, a priority class, minimum and maximum workingset sizes, and at least one thread of execution. Each process isstarted with a single thread, often called the <i>primarythread</i>, but can create additional threads from any of itsthreads.
A thread is the entity within a process that can be scheduled forexecution. All threads of a process share its virtual address space andsystem resources. In addition, each thread maintains exceptionhandlers, a scheduling priority, thread local storage, a unique threadidentifier, and a set of structures the system will use to save thethread context until it is scheduled. The thread context includes thethread's set of machine registers, the kernel stack, a threadenvironment block, and a user stack in the address space of thethread's process. Threads can also have their own security context,which can be used for  impersonating clients.
Microsoft Windows supports preemptive multitasking, which createsthe effect of simultaneous execution of multiple threads from multipleprocesses. On a multiprocessor computer, the system can simultaneouslyexecute as many threads as there are processors on the computer.
A job object allows groups of processes to be managed as a unit. Jobobjects are namable, securable, sharable objects that controlattributes of the processes associated with them. Operations performedon the job object affect all processes associated with the job object.
A fiber is a unit of execution that must be manually scheduled bythe application. Fibers run in the context of the threads that schedulethem. Each thread can schedule multiple fibers. In general, fibers donot provide advantages over a well-designed multithreaded application.However, using fibers can make it easier to port applications that weredesigned to schedule their own threads.

[ 本帖最后由 yzx714 于 2009-1-13 18:09 编辑 ]
leviceo
 楼主| 发表于 2009-1-13 18:11:49 | 显示全部楼层
明白,学习了
kiki
发表于 2009-1-13 18:37:28 | 显示全部楼层
dll注入........就是无进程的.....

或者修改现有进程,在内存尾段写一段进去..........


但是是程序都会有地址.....ring3下可以通过open PID都在进程

ring0下就.......
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-10-10 18:03 , Processed in 0.124292 second(s), 16 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表