两个玩笑程序,无害,放心测试

sinbad2

关闭IEtest  是先打开IE,双击test.ex时看IE会不会立即关闭,如果关闭则表示防护失败;
test mouse 是双击text.exe,如果这时候鼠标点击电脑双反应,咚咚地响,则表示防护失败.

我用过的所有杀毒软件都不杀两个,只有微点主防,一解压就删除.用金山猎豹的沙盘,防护成功,不错不错.

大家用你们的法宝测试下,看成功还是失败,交流交流.

hx1997

虚拟机研究下

感谢DW，我知道了Mouse test的原理
Disable所有窗口，真邪恶

MD成功防御

2011-9-5 22:34:01    Manipulate window of another process    Denied
Process: c:\documents and settings\administrator\桌面\test.exe
Target: c:\program files\internet explorer\iexplore.exe
Rule: [App]* -> [Target App]*


2011-9-5 22:35:42    Manipulate window of another process    Denied and killed the process
Process: c:\documents and settings\administrator\桌面\test.exe
Target: c:\windows\explorer.exe
Rule: [App]* -> [Target App]c:\windows\*



本还想拿BSA看看用了什么API但是似乎SBIE直接阻止了没拦截到API？

OA不错   操控进程窗口、修改窗口属性，我还是没猜出是哪个API




Mouse那个，OA直接阻止无弹窗

Created:      2011-9-5 22:53:56
Summary:      Program Guard: test.e -> explorer.exe
Description:  C:\Documents and Settings\Administrator\桌面\test.e(1832) wants to change window attributes in C:\WINDOWS\explorer.exe(1140)
Event type:   Program Guard(9)
Event action: Blocked(3)

Created:      2011-9-5 22:53:56
Summary:      Program Guard: kernel event
Description:  OADriver: HwndParamLock, 1832 -> 1140, Code: 0/0, Act: 96/60, Deny (rule)
Event type:   Kernel event(26)
Event action: None(1)
Processes:
  PID:    1140        Name: explorer.exe
  PID:    1832        Name: test.e

Created:      2011-9-5 22:53:56
Summary:      Program Guard: test.exe
Description:  C:\WINDOWS\explorer.exe -> C:\Documents and Settings\Administrator\桌面\test.exe
Event type:   Program Guard(9)
Event action: Allowed(2)


DW成功防御

09.05.2011  22:59:09，模块 C:\Documents and Settings\Administrator\桌面\test.exe， 2:Attempt to manipulate window of the process C:\Program Files\Internet Explorer\IEXPLORE.EXE. (屏幕)

09.05.2011  23:00:51，模块 C:\Documents and Settings\Administrator\桌面\test.exe， Attempt to enable/disable window of the process C:\WINDOWS\explorer.exe (屏幕)


卡巴IE Test成功，Mouse Test杯具了啊
2011-9-5 23:05:33        test.exe        已拒绝: 钩住传入信息流       


RTDS两个测试均失败...

EQ似乎也是？还是我规则问题？

ESET HIPS目前还木有窗口方面的防御项目，所以杯具了

Palkia

留侯

大蜘蛛clean，已上报！

sinbad2

大蜘蛛clean??什么意思?查出来了,是有害的?还是没查出什么来?

hx1997

sinbad2 发表于 2011-9-5 23:04
大蜘蛛clean??什么意思?查出来了,是有害的?还是没查出什么来?

clean是没找到病毒的意思

3801187

kangzhen

mse无视了....

电影结束了

hx1997 发表于 2011-9-5 22:27
虚拟机研究下

感谢DW，我知道了Mouse test的原理

OA   P版的？

shutuo864

不错 微点全防！微点真牛！