[filename.info logo]
[cn ntoskrnl.exe][de ntoskrnl.exe][es ntoskrnl.exe][fr ntoskrnl.exe][gb ntoskrnl.exe][it ntoskrnl.exe][jp ntoskrnl.exe][kr ntoskrnl.exe][nl ntoskrnl.exe][pt ntoskrnl.exe][ru ntoskrnl.exe][us ntoskrnl.exe]
 

ntoskrnl.exe (5.1.2600.1151)

ソフトウェアに含まれている

名前:Windows XP Home Edition, Deutsch
免許証:商業
情報リンク:http://www.microsoft.com/windowsxp/

ファイル細部

ファイル道:C:\WINDOWS\Driver Cache\i386 \ ntoskrnl.exe
ファイル日付:2003-04-24 19:15:36
版:5.1.2600.1151
ファイルサイズ:1.927.936 バイト

検査合計及びファイルは切り刻む

CRC32:C835E20D
MD5:3B7A AA18 52BC 635B 5278 8144 EA79 7CBC
SHA1:7883 A571 BA5F 5E7B 5D1A DA6A B9EB 9113 6A6F D4B4

版資源情報

会社名前:Microsoft Corporation
ファイル記述:NT-Kernel und -System
ファイルオペレーティングシステム:Windows NT, Windows 2000, Windows XP, Windows 2003
ファイル・タイプ:Application
ファイル版:5.1.2600.1151
内部名:ntoskrnl.exe
法的版権: Microsoft Corporation. Alle Rechte vorbehalten.
元のファイル名:ntoskrnl.exe
製品名:Betriebssystem Microsoft Windows
プロダクト版:5.1.2600.1151

ntoskrnl.exe は次のレポートで見つけられた:

W97M.Homer

W97M.Homer について
...It deletes the file C:WinntSystem32Ntoskrnl.exe from Windows NT systems Type: Virus...
脅威の査定
...Deletes files: Ntoskrnl.exe Modifies files:...
技術的詳細
...The virus deletes the file C:WinntSystem32Ntoskrnl.exe from Windows NT systems. This payload is triggered...
源: http://securityresponse.symantec.com/avcenter/venc/data/w97m.homer.html

W32.Bolzano

技術的詳細
...In such a case, W32.Bolzano has the chance to patch ntoskrnl.exe, the Windows NT kernel, located in the WINNTSYSTEM32 directory....
...virus modifies only 2 bytes in a security API called SeAccessCheck that is part of ntoskrnl.exe. This way Bolzano is able to...
...Unfortunately the consistency of ntoskrnl.exe is checked in only one place....
...The loader, ntldr, is supposed to check it when it loads ntoskrnl.exe into physical memory during machine boot-up....
...If the kernel gets corrupted ntldr is supposed to stop loading ntoskrnl.exe and display an error message even before a "blue screen" appears....
取り外しの指示
...If the system has been infected, the system files ntoskrnl.exe and ntldr.exe have been patched....
...prolific virus, W32.Funlove.4099, which applies the same patching techniques to ntoskrnl.exe and ntldr.exe. You can find this tool here:...
源: http://securityresponse.symantec.com/avcenter/venc/data/w32.bolzano.html

W32.Funlove.4099

技術的詳細
...the equivalent rights logs on, W32.FunLove.4099 has the opportunity to modify the Ntoskrnl.exe file, the Windows NT kernel located in the WinntSystem32 folder....
...Unfortunately, the consistency of Ntoskrnl.exe is checked only once during the startup process....
...The loader, Ntldr, checks Ntoskrnl.exe when it loads into physical memory during startup....
...If the kernel becomes corrupted, Ntldr is supposed to stop loading Ntoskrnl.exe and display an error message, even before a "blue screen" appears....
...files on those computers. In addition, the Ntoskrnl.exe and Ntldr patch is performed on the network drives....
...components over the network. The Ntoskrnl.exe and Ntldr patches are executed by a routine picked up from the Bolzano virus....
...Developer Network documentation. Can Ntoskrnl.exe be infected across the network, without Flcss.exe actually being copied to the system?...
...As long as the drive is writeable, FunLove will modify Ntoskrnl.exe over the network, even without dropping Flcss.exe onto the system....
...FunLove does not actually infect Ntoskrnl.exe, but it changes the file's security function....
...Once the affected computer is restarted, the modified Ntoskrnl.exe and Ntldr are loaded, and security is compromised....
源: http://securityresponse.symantec.com/avcenter/venc/data/w32.funlove.4099.html

W32.Petch

技術的詳細
...C:WindowsSystem32Ntkrnlpa.exe C:WindowsSystem32Ntoskrnl.exe C:WindowsSystem32Ntoskrnl.exe...
源: http://securityresponse.symantec.com/avcenter/venc/data/w32.petch.html

W32.Gruel@mm

技術的詳細
...C:WINNTSystem32*.dll C:WINNTSystem32Ntoskrnl.exe C:WINNTSystem32Command.com...
...C:WINNTRegedit.exe C:WindowsSystem32Ntoskrnl.exe C:WindowsSystem32Command.com...
......
源: http://securityresponse.symantec.com/avcenter/venc/data/w32.gruel@mm.html

運行

ファイルを拾い読みしなさい

• 名指しで




Valid HTML 4.01!
Tegtmeier のインターネットの解決 著版権の2004 催すこと: NetGate