Winpooch_V0.5.10_src
所属分类:钩子与API截获
开发工具:Visual C++
文件大小:455KB
下载次数:74
上传日期:2008-03-05 20:28:51
上 传 者:
zzz3265
说明: 用APIHook 方式拦截系统操作, 包括进程, 文件...等, 用来防护病毒, 木马.
(Methods used to intercept APIHook system, including the process, documents ... and so on, used protective viruses, Trojans.)
文件列表:
Winpooch V0.5.10-src\languages\Bulgarian.txt (10254, 2006-02-12)
Winpooch V0.5.10-src\languages\Dutch.txt (11070, 2006-02-12)
Winpooch V0.5.10-src\languages\English.txt (10256, 2006-02-12)
Winpooch V0.5.10-src\languages\French.txt (11462, 2006-02-12)
Winpooch V0.5.10-src\languages\German.txt (10996, 2006-02-12)
Winpooch V0.5.10-src\languages\Hungarian.txt (11570, 2006-02-12)
Winpooch V0.5.10-src\languages\Italian.txt (21194, 2006-02-12)
Winpooch V0.5.10-src\languages\LICENSE_BG (38848, 2006-02-12)
Winpooch V0.5.10-src\languages\LICENSE_DE (25292, 2006-02-12)
Winpooch V0.5.10-src\languages\LICENSE_EN (15399, 2006-02-12)
Winpooch V0.5.10-src\languages\LICENSE_ES (16813, 2006-02-12)
Winpooch V0.5.10-src\languages\LICENSE_FR (15361, 2006-02-12)
Winpooch V0.5.10-src\languages\LICENSE_HU (17568, 2006-02-12)
Winpooch V0.5.10-src\languages\LICENSE_IT (19352, 2006-02-12)
Winpooch V0.5.10-src\languages\LICENSE_NL (17614, 2006-02-12)
Winpooch V0.5.10-src\languages\LICENSE_PL (20564, 2006-02-12)
Winpooch V0.5.10-src\languages\LICENSE_PTBR (19724, 2006-02-12)
Winpooch V0.5.10-src\languages\LICENSE_SV (17604, 2006-02-12)
Winpooch V0.5.10-src\languages\LICENSE_TR (16274, 2006-02-12)
Winpooch V0.5.10-src\languages\Polish.txt (10744, 2006-02-12)
Winpooch V0.5.10-src\languages\PortugueseBr.txt (12184, 2006-02-12)
Winpooch V0.5.10-src\languages\Spanish.txt (10496, 2006-02-12)
Winpooch V0.5.10-src\languages\Swedish.txt (10896, 2006-02-12)
Winpooch V0.5.10-src\languages\Turkish.txt (9276, 2006-02-12)
Winpooch V0.5.10-src\winpooch\.cvsignore (595, 2006-02-12)
Winpooch V0.5.10-src\winpooch\AboutWnd.c (12152, 2006-02-12)
Winpooch V0.5.10-src\winpooch\AboutWnd.h (1798, 2006-02-12)
Winpooch V0.5.10-src\winpooch\Application.c (10245, 2006-02-12)
Winpooch V0.5.10-src\winpooch\AskDlg.c (7742, 2006-02-12)
Winpooch V0.5.10-src\winpooch\AskDlg.h (2153, 2006-02-12)
Winpooch V0.5.10-src\winpooch\Assert.c (2587, 2006-02-12)
Winpooch V0.5.10-src\winpooch\Assert.h (1924, 2006-02-12)
Winpooch V0.5.10-src\winpooch\BuildCounter.pl (2146, 2006-02-12)
Winpooch V0.5.10-src\winpooch\CHANGELOG (7342, 2006-02-12)
Winpooch V0.5.10-src\winpooch\Condition.c (16517, 2006-02-12)
Winpooch V0.5.10-src\winpooch\Condition.h (3543, 2006-02-12)
Winpooch V0.5.10-src\winpooch\Config.c (8752, 2006-02-12)
Winpooch V0.5.10-src\winpooch\Config.h (2803, 2006-02-12)
Winpooch V0.5.10-src\winpooch\ConfigWnd.c (12631, 2006-02-12)
Winpooch V0.5.10-src\winpooch\ConfigWnd.h (1798, 2006-02-12)
... ...
Winpooch - Readme
*****************
Author Benoit Blanchon
Date 02/02/2006
Version 0.5.10
Web site http://www.winpooch.com/
About Winpooch
--------------
Winpooch is a watchdog for Windows. It watches running
programs and prevents them from doing dangerous operations.
This very simple program helps you to detect Trojans and
spywares. I can also detect virus : if ClamWin is installed on your
computer, you can tell Winpooch to scan each executable file before
allowing it to run.
Winpooch runs under 32-bits versions of Windows 2000,
Windows XP and Windows 2003. Support for ***-bits versions will come later.
About version 0.5.10
--------------------
It's been a very long time from the release date of the 0.5.9.
Many reasons to that : new job, new home, new computer... I was several
months without having a second to type a line of code. Anyway, the new
branch 0.6 is still under development.
What Winpooch watches ?
-----------------------
By default, Winpooch will not spy services, but this can be
activated by modifying the value "Use debug privilege" in the configuration
Window.
With default rules, Winpooch will ask the user before allowing
a program to write sensible files or registry keys. Default rule are
very rich, you may choose to reduce them or to change default action.
Don't hesitate to create you own filters, this new Winpooch is
highly customizable.
Which API function are hooked ?
-------------------------------
This section is intended to users with some knowledge of the Win32 API.
If you don't know about it, you can skip it.
- Functions in ntdll.dll :
+ NtSetValueKey
and so :
. RegSetValueExA
. RegSetValueA
. RegSetValueExW
. RegSetValueW
+ NtCreateFile and NtOpenFile
and so :
. CreateFileA
. CreateFileW
. CopyFileA
. CopyFileW
. CopyFileExA
. CopyFileExW
+ NtSetInformationFile
and so :
. MoveFileA
. MoveFileW
. MoveFileExA
. MoveFileExW
. MoveFileWithProgressA
. MoveFileWithProgressW
+ NtDeleteFile
and so :
. DeleteFileA
. DeleteFileW
- Functions in kernel32.dll :
+ CreateProcessA
+ CreateProcessW
- Functions in ws2_32.dll
+ connect
+ listen
Next evolutions
---------------
What you may expect for next versions :
- Wizard to help you configure filters
- Kernel-mode API hooking (planned for versions 0.6.x)
Please note that version 0.6.0 is keeping us very busy
so it's difficult to add new features into 0.5 branch. Thanks
for your comprehension.
About license
-------------
Winpooch comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it under
certain conditions. For details, please read LICENSE text file.
This software uses the FreeImage open source image library.
See http://freeimage.sourceforge.net for details.
FreeImage is used under the GNU GPL, version 2.
Authors
-------
Benoit Blanchon.............. Programming
Sylvain Fajon................ Graphics and tests
Amaury Bertron-Besnier....... Web site
Seather...................... Dirs and keys to watch
Andrea Vezzali............... Original Italian translation
Moreno Monga................. Current Italian translation
Marcin "Angelo" Wawrzyniak... Polish translation
Márton Balázs (documan)...... Hugarian translation
Andreas Ender................ German translation
Hakan Aktas.................. Turkish translation
Vitor Brock.................. Portuguese translation
Jochem Jean van de Groep..... Dutch translation
近期下载者:
相关文件:
收藏者: