本文将对当今先进的病毒/反病毒技术做全面而细致的介绍，重点当然放在了反病毒上，特别是虚拟机和实时监控技术。文中首先介

绍几种当今较为流行的病毒技术，包括获取系统核心态特权级，驻留，截获系统操作，变形和加密等。然后分五节详细讨论虚拟机

技术：第一节简单介绍一下虚拟机的概论；第二节介绍加密变形病毒，作者会分析两个著名变形病毒的解密子；第三节是虚拟机实

现技术详解，其中会对两种不同方案进行比较，同时将剖析一个查毒用虚拟机的总体控制结构；第四节主要是对特定指令处理函数

的分析；最后在第五节中列出了一些反虚拟执行技术做为今后改进的参照。论文的第三章主要介绍实时监控技术，由于win9x和

winnt/2000系统机制和驱动模型不同，所以会分成两个操作系统进行讨论。其中涉及的技术很广泛：包括驱动编程技术，文件钩挂，

特权级间通信等等。本文介绍的技术涉及操作系统底层机制，难度较大。所提供的代码，包括一个虚拟机C语言源代码和两个病毒

实时监控驱动程序反汇编代码，具有一定的研究和实用价值。-This paper will today s advanced virus/anti-virus technology to do a comprehensive and detailed introduction, the focus of course on the anti-virus, especially the virtual machines and real-time monitoring technology. Firstly Introduction

Several of today s more popular Shao-virus technology, including access to the system kernel mode privilege level, presence of intercepted system operation, deformation and encryption. Five sections and then discuss in detail the virtual machine

Technology: the first a brief overview of the virtual machine　Section II describes the deformation encrypted virus, the author analyzes the deformation of the virus to decrypt two famous son　III is the virtual machine implementation

Detailed current technology, which will compare two different programs, and will dissect a virus scanning of virtual machines with the overall control structure　fourth main function is to deal with specific instructions

Analysis　Finally, in section V lists some of the a