System maintenance software (PC Hunter)

PC Hunter is a driver-level system maintenance tool that can view various underlying system information of Windows, including processes, driver modules, kernels, kernel hooks, application layer hooks, networks, registry, files, startup items, system miscellaneous, Computer physical examination, etc.

At the same time, PC Hunter is also a powerful manual antivirus auxiliary software and ARK The tool has complete manual anti-virus configuration, which can detect latent virus Trojans in the computer: prohibit the creation of processes, prohibit the creation of registry entries, prohibit the resetting of registry values, prohibit the creation of threads, prohibit the loading of modules, prohibit the modification of the system time, It is prohibited to create files, prohibit message hook module injection, prohibit computer locking, prohibit disk writing, prohibit standby/logoff/shutdown/restart, prohibit loading drivers, prohibit switching desktops, force restart, and force restart with violence, etc.

PC Hunter is re-developed on the basis of the original XueTr. XueTr only supports 32-bit operating systems, while PC Hunter not only supports 32-bit 2000, XP, 2003, Vista, 2008, Win7, Win8, but also supports 64-bit Win7, Win8 system, then the ARK tools for 64-bit Windows 7 and Windows 8 are currently available including Win64AST and PowerTool. With PC Hunter.

PC Hunter makes extensive use of Windows kernel technology, especially in order to do some detection, it uses some undisclosed kernel data structures of Windows. Currently, it has initially implemented the following functions:

Function introduction

1. View processes, threads, process modules, process windows, process memory information, kill processes, kill threads, uninstall modules and other functions
2. View the kernel driver module and support the memory copy of the kernel driver module.
3. View SSDT, Shadow SSDT, FSD, KBD, TCPIP, Classpnp, Atapi, Acpi, SCSI, IDT, GDT information, and can detect and restore ssdt hook and inline hook
4. View Notify Routine information such as CreateProcess, CreateThread, LoadImage, CmpCallback, BugCheckCallback, Shutdown, Lego, etc., and support the deletion of these Notify Routines.
5. View port information, currently does not support 2000 system
6. View message hooks
7. Kernel module iat, eat, inline hook, patches detection and recovery
8. Disk, volume, keyboard, network layer and other filter driver detection and support deletion
9. Registry editing
10. Process iat, eat, inline hook, patches detection and recovery
11. File system viewing, supporting basic file operations
12. View (edit) IE plug-ins, SPI, startup items, services, Host files, image hijacking, file associations, system firewall rules, and IME
13.ObjectType Hook detection and recovery
14.DPC timer detection and deletion
15.MBR Rootkit detection and repair
16. Kernel object hijacking detection
17.WorkerThread enumeration
18. Some callback information enumeration in Ndis
19. Hardware debugging register and debugging related API detection

Instructions for use

After unzipping, PCHunter32.exe is the 32-bit version, PCHunter64.exe is the 64-bit version, and the current version is PC Hunter 1.0. PC Hunter is divided into free version and professional version. In addition to integrating all the functions of the free version, the professional version also has some functions that the free version does not have, including:
1. Added support for some network parts, including but not limited to: NdisTdiCallback, TdiPnpClient, NdisTcpoffloadHandlers, NdisOldTable, FwpsTcpipDispatchTable, FwpsL2DispatchTable, WfpNblDisp atchTable、WfpstreamShim、WfpMacShim、NetioLayerCallback、NsiLegacyHandler、WfpDeviceObject、WfpCallout、NmrProvider(Client)、NsiChangeNotification、 NsiChangeNotification_Monitor, NdisInterface
2. The process section supports viewing process creation time and process startup command line parameters.