antispy: free & powerful anti virus and rootkits toolkit
AntiSpy
AntiSpy is a free but powerful anti-virus and rootkits toolkit.
It offers you the ability with the highest privileges that can detect, analyze and restore various kernel modifications and hooks.
With its assistance, you can easily spot and neutralize malwares hidden from normal detectors.
Features
Currently, the following features are available(including but not limited to):
Process Manager
- Display system process and thread basic information.
- Detect hidden processes, threads, process modules.
- Terminate, suspend and resume processes and threads.
- View and manipulate process handles, windows and memory regions.
- View and manipulate process hotkeys, privileges, and timers.
- Detect and restore process hooks including inline hooks, patches,iat and eat hooks.
- Inject dll, dump process memory.
- Create a debug dump, include a minidump and full dump.
Kernel Module Viewer
- Display kernel module basic information, include image base, size, driver object, and so on.
- Detect hidden kernel modules.
- Unload kernel modules.
- Dump kernel image memory.
- Display and delete system driver service information.
Hook Detector
- Detect and restore SSDT, Shadow SSDT,sysenter and int2e hooks.
- Detect and restore FSD and keyboard disptach hooks.
- Detect and restore kernel code hooks including kernel inline hooks, patches,iat and eat hooks.
- Detect and restore message hooks, both global and local.
- Detect and restore kernel ObjectType hooks.
- Display Interrupt Descriptor Table(IDT).
Other Kernel Information Viewer
- View and remove kernel notifications.
- View filters for common devices include disk, volume, keyboard, and network devices.
- View IO timers, DPC timers, system threads, and so on.
Registry Manager
- View and edit the system registry.
- Detect hidden registry entries using live registry hive analysis.
File Manager
- Display file basic information,include file name,size,attributes,and so on.
- Detect hidden files.
- View and delete locked files and folders.
Service Manager
- Display system services basic information.
- Control services status.
- Modify the services startup type.
Autorun Manager
- Display almost all kinds of system autorun types.
- Enable,disable or permanently delete autoruns.
Network Viewer
- Display current network connections, including TCP and UDP information.
- View and delete IE plugins and context menu.
- Display Winsock providers(LSP).
- View and edit hosts file.
Other Tools
- Hex Editor – View and edit memory, include ring3 process memory and ring0 system memory.
- Disassembler – Like OllyDBG, support ring3 process memory and ring0 system memory.
Settings
- Custom color settings.
Download
git clone https://github.com/mohuihui/antispy.git
Copyright (c) [2010-2019] zhenfei.mzf@gmail.com rights reserved.
