灰鸽子 病毒
Gray is a well-known dove back door. Compared to the older ice, black, gray pigeon can be said to be the back door of the home are a combination of different opinions. The rich and powerful functionality and flexibility of operation, well hidden so that others are to be outshone by the back door. Client simple and convenient to operate so that the entry of just a beginner can act as hackers. When used in legal cases, the gray pigeon is a good remote control software. However, if some of it to do illegal things, gray pigeons have become very powerful hacking tool. This is like powder, on various occasions, brought different. Gray dove to the complete presentation may be only a gray pigeon author to make it clear that we are here only for a brief.
Gray Pigeon client and server are based on the preparation of Delphi. Hackers use of the client to configure a server program. Can be configured to include information on the type of line (for example, wait for the connection or take the initiative to connect), take the initiative to connect using the public network IP (domain name), a password to connect, the use of the port, the start of the name, the name of the service, the process of hidden ways, the use of the Shell, agents, icons and so on.
Server for the client to connect a variety of ways, making the environment in a variety of network users may be poisoning, including local area network users (Internet through a proxy), the public network and ADSL users to dial-up users.
As the gray dove to intercept the API call, in the normal mode file server and its services are registered to hide, that is to say, even if you set up a "show all hidden files" do not see them. In addition, the gray-end services doves of the file name can be customized, hand-All this has brought about the detection of certain difficulties.
However, through careful observation, we found that the detection of gray pigeons still have to follow the law. From the above analysis we can see that principle to run, regardless of the custom server-side file name is what will normally be installed in the operating system directory in order to generate a "_hook.dll" at the end of the document. Through this, we can more accurately detect the hand-gray-end services doves.
Due to the normal mode will hide their gray pigeons, so detection of gray pigeons must operate in a safe mode. Into the safe mode is: Start the computer in the Windows system into the start screen, press the F8 key (or in your computer holding down the Ctrl key), in the event of the start-up options menu, select "Safe Mode" Or "Safe Mode."
1, dove gray as a result of the document itself has hidden attributes, so set Windows to show all files. Open "My Computer" menu, select "Tools" - "" Folder Options ", click" view "to remove" hide protected operating system files "before the Duigou, and the" hidden files and folders " Select the item "Show hidden files and folders," then click "OK."
2, open the Windows "search files", enter the file name "_hook.dll", the search location to choose the Windows installation directory (for 98/xp default C: \ windows, 2k/NT for the C: \ Winnt).
3, after a search, we have Windows directory (does not contain a subdirectory), the discovery of a document Game_Hook.dll.
4, according to the analysis of the principle of gray pigeons, we know that if it is gray pigeons Game_Hook.DLL documents, the operating system is installed in the directory will be Game.exe and Game.dll document. Open the Windows directory, there are really two documents at the same time there is a record for keyboard operation GameKey.dll document.
After a few steps which we operate on the basic of these documents can be gray-end services doves of the.
