System maintenance software (PC Hunter)

PC Hunter is a driver-level system maintenance tool that can view various underlying system information of Windows, including processes, driver modules, kernels, kernel hooks, application layer hooks, networks, registry, files, startup items, system miscellaneous, Computer physical examination, etc.

At the same time, PC Hunter is also a powerful manual anti-virus auxiliary software and ARK tool. It has complete manual anti-virus configuration, which can detect latent viruses and Trojans in the computer: it is prohibited to create processes, create registry entries, and reset registry values. , prohibit creating threads, prohibit loading modules, prohibit modifying system time, prohibit creating files, prohibit message hook module injection, prohibit locking the computer, prohibit writing disk, prohibit standby/logoff/shutdown/restart, prohibit loading drivers, prohibit switching desktops, force Restart, force restart due to violence, etc.

PC Hunter is re-developed on the basis of the original XueTr. XueTr only supports 32-bit operating systems, while PC Hunter not only supports 32-bit 2000, XP, 2003, Vista, 2008, Win7, Win8, but also supports 64-bit Win7, Win8 system, then the ARK tools for 64-bit Windows 7 and Windows 8 are currently available including Win64AST, PowerTool and PC Hunter.

PC Hunter makes extensive use of Windows kernel technology, especially in order to do some detection, it uses some undisclosed kernel data structures of Windows. Currently, it has initially implemented the following functions:

Function introduction

1. View processes, threads, process modules, process windows, process memory information, kill processes, kill threads, uninstall modules and other functions
2. View the kernel driver module and support the memory copy of the kernel driver module.
3. View SSDT, Shadow SSDT, FSD, KBD, TCPIP, Classpnp, Atapi, Acpi, SCSI, IDT, GDT information, and can detect and restore ssdt hook and inline hook
4. View Notify Routine information such as CreateProcess, CreateThread, LoadImage, CmpCallback, BugCheckCallback, Shutdown, Lego, etc., and support the deletion of these Notify Routines.
5. View port information, currently does not support 2000 system
6. View message hooks
7. Kernel module iat, eat, inline hook, patches detection and recovery
8. Disk, volume, keyboard, network layer and other filter driver detection and support deletion
9. Registry editing
10. Process iat, eat, inline hook, patches detection and recovery
11. File system viewing, supporting basic file operations
12. View (edit) IE plug-ins, SPI, startup items, services, Host files, image hijacking, file associations, system firewall rules, and IME
13.ObjectType Hook detection and recovery
14.DPC timer detection and deletion
15.MBR Rootkit detection and repair
16. Kernel object hijacking detection
17.WorkerThread enumeration
18. Some callback information enumeration in Ndis
19. Hardware debugging register and debugging related API detection

Instructions for use

After unzipping, PCHunter32.exe is the 32-bit version, PCHunter64.exe is the 64-bit version, and the current version is PC Hunter 1.0. PC Hunter is divided into free version and professional version. In addition to integrating all the functions of the free version, the professional version also has some functions that the free version does not have, including:
1. Added support for some network parts, including but not limited to: NdisTdiCallback, TdiPnpClient, NdisTcpoffloadHandlers, NdisOldTable, FwpsTcpipDispatchTable, FwpsL2DispatchTable, WfpNblDispatchTable, WfpstreamShim, WfpMacShim, NetioLayerCallback, NsiLegacyHandler, WfpDeviceObject, WfpC allout, NmrProvider(Client), NsiChangeNotification, NsiChangeNotification_Monitor ,NdisInterface
2. The process section supports viewing process creation time and process startup command line parameters.