天琊正式版前第一个插件(超级进程监视器VC版) V1.02

chenhui530

原帖由 乘风 于 2009-3-15 10:23 发表
我是深度xpsp3完美精简版系统，

刚才下载了，但是打开时又是加载驱动失败，重启了一下也不行。
485442

朋友在启动前，先打开windbg再启动此程序
看有什么提示

重启后

chenhui530

原帖由 天月来了 于 2009-3-15 10:25 发表
我总觉得，单从进程监控来说

白名单那要是没crc值的校验监控

就不够超级，不够完美

指单纯进程监控方面

那SSM的AD监控为什么始终是HIPS类软件中的顶级监控，就是这原因吧。

除了SSM，好 ...

这个有时间加吧~~这个加起来问题不大

天月来了

那就天天期待着咯

chenhui530

原帖由 天月来了 于 2009-3-15 10:30 发表
那就天天期待着咯

目前就将就这个程序用着吧
等闲了，天琊的正式版也会出了，一个个插件也会出来到时够你眼花缭乱的了

tawny2008

原帖由 chenhui530 于 2009-3-15 10:32 发表
目前就将就这个程序用着吧
等闲了，天琊的正式版也会出了，一个个插件也会出来到时够你眼花缭乱的了

阵容强大啊，支持

乘风

原帖由 chenhui530 于 2009-3-15 10:27 发表


朋友在启动前，先打开windbg再启动此程序
看有什么提示

重启后

我复制上来了
---------------------------------------------------------------------------------------------------------------
NtCreateSection:C:\WINDOWS\system32\drivers\kmixer.sys
[1608] In DllGetClassObject
[1608] ShellExtClassFactory::ShellExtClassFactory()
[1608] ShellExtClassFactory::QueryInterface()
[1608] ShellExtClassFactory::CreateInstance()
[1608] ShellExt::ShellExt()
[1608] ShellExt::QueryInterface()==>IID_IShellExtInit
[1608] ShellExt::AddRef()
[1608] ShellExt::QueryInterface()==>IID_IContextMenu
[1608] ShellExt::AddRef()
[1608] ShellExt::QueryInterface()==>Unknown Interface!
[1608] IID:
[1608] {FC4801A3-2BA9-11CF-A229-00AA003D7352}
[1608]  
[1608] ShellExt::QueryInterface()==>Unknown Interface!
[1608] IID:
[1608] {79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}
[1608]  
[1608] ShellExt::QueryContextMenu()
[1608] Making bitmap & brush
[1608] Bitmap Handle: 184879407, Brush Handle: 168823085
[1608] Setting menu info
[1608] ShellExt::AddRef()
[1608] ShellExt::Release()
[1608] ShellExt::Release()
[1608] ShellExt::QueryInterface()==>Unknown Interface!
[1608] IID:
[1608] {FC4801A3-2BA9-11CF-A229-00AA003D7352}
[1608]  
[1608] ShellExt::QueryInterface()==>Unknown Interface!
[1608] IID:
[1608] {79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}
[1608]  
[1608] ShellExt::Release()
[1608] In DllGetClassObject
[1608] ShellExtClassFactory::ShellExtClassFactory()
[1608] ShellExtClassFactory::QueryInterface()
[1608] ShellExtClassFactory::CreateInstance()
[1608] ShellExt::ShellExt()
[1608] ShellExt::QueryInterface()==>IID_IShellExtInit
[1608] ShellExt::AddRef()
[1608] ShellExt::QueryInterface()==>IID_IContextMenu
[1608] ShellExt::AddRef()
[1608] ShellExt::QueryInterface()==>Unknown Interface!
[1608] IID:
[1608] {FC4801A3-2BA9-11CF-A229-00AA003D7352}
[1608]  
[1608] ShellExt::QueryInterface()==>Unknown Interface!
[1608] IID:
[1608] {79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}
[1608]  
[1608] ShellExt::QueryContextMenu()
[1608] Making bitmap & brush
[1608] Bitmap Handle: 201656273, Brush Handle: 1141901119
[1608] Setting menu info
[1608] ShellExt::AddRef()
[1608] ShellExt::Release()
[1608] ShellExt::Release()
[1608] ShellExt::QueryInterface()==>Unknown Interface!
[1608] IID:
[1608] {FC4801A3-2BA9-11CF-A229-00AA003D7352}
[1608]  
[1608] ShellExt::QueryInterface()==>Unknown Interface!
[1608] IID:
[1608] {79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}
[1608]  
[1608] ShellExt::Release()
[1608] In DllGetClassObject
[1608] ShellExtClassFactory::ShellExtClassFactory()
[1608] ShellExtClassFactory::QueryInterface()
[1608] ShellExtClassFactory::CreateInstance()
[1608] ShellExt::ShellExt()
[1608] ShellExt::QueryInterface()==>IID_IShellExtInit
[1608] ShellExt::AddRef()
[1608] ShellExt::QueryInterface()==>IID_IContextMenu
[1608] ShellExt::AddRef()
[1608] ShellExt::QueryInterface()==>Unknown Interface!
[1608] IID:
[1608] {FC4801A3-2BA9-11CF-A229-00AA003D7352}
[1608]  
[1608] ShellExt::QueryInterface()==>Unknown Interface!
[1608] IID:
[1608] {79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}
[1608]  
[1608] ShellExt::QueryContextMenu()
[1608] Making bitmap & brush
[1608] Bitmap Handle: -268105676, Brush Handle: 185600310
[1608] Setting menu info
[1608] ShellExt::AddRef()
[1608] ShellExt::Release()
[1608] ShellExt::Release()
NtCreateSection:E:\ARK
CreateProcess: E:\ARK
[1608] ShellExt::QueryInterface()==>Unknown Interface!
[1608] IID:
[1608] {FC4801A3-2BA9-11CF-A229-00AA003D7352}
[1608]  
[1608] ShellExt::QueryInterface()==>Unknown Interface!
[1608] IID:
[1608] {79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}
[1608]  
[1608] ShellExt::Release()
NtCreateSection:E:\ARK
NtCreateSection:C:\WINDOWS\system32\ntdll.dll
获取PspCreateProcess函数地址出错
NtCreateSection:E:\ARK
IoCreateSymbolicLink失败 0xc0000035
NtCreateSection:E:\ARK
IoCreateSymbolicLink失败 0xc0000035
NtCreateSection:E:\ARK
IoCreateSymbolicLink失败 0xc0000035
NtCreateSection:E:\ARK
IoCreateSymbolicLink失败 0xc0000035
[1608] In DLLCanUnloadNow
NtCreateSection:D:\360
CreateProcess: D:\360
NtCreateSection:D:\Avast4\Setup\avast.setup
CreateProcess: D:\Avast4\Setup\avast.setup
NtCreateSection:D:\Avast4\Setup\avast.setup
CreateProcess: D:\Avast4\Setup\avast.setup
watchdog!WdUpdateRecoveryState: Recovery enabled.
NtCreateSection:D:\SogouInput\4.0.0.2093\PinyinRepair.exe
CreateProcess: D:\SogouInput\4.0.0.2093\PinyinRepair.exe

[ 本帖最后由 乘风 于 2009-3-15 11:28 编辑 ]

chenhui530

原帖由 乘风 于 2009-3-15 11:10 发表


还是打不开，看来我是用不上了

说错了
先运行DbgView然后再运行监视器

evilangell

XP SP3,加驱动失败

chenhui530

原帖由 evilangell 于 2009-3-15 11:25 发表
XP SP3,加驱动失败

先运行DbgView再运行监视器看有什么提示

chenhui530

知道原因了