Detection ratio: 2 / 56 神网HIPS对比测试 ：ESET hips Vs SpyShelter Firewall

墨家小子

SHA256:        bda6fef5aa6f2d7503c1be0890dddf99ffab3dfac3ea888c1fb6d29b1567b332
File name:        mpr.dll
Detection ratio:        2 / 56
Analysis date:        2016-03-22 04:21:40 UTC ( 0 minutes ago )
https://www.virustotal.com/en/file/bda6fef5aa6f2d7503c1be0890dddf99ffab3dfac3ea888c1fb6d29b1567b332/analysis/1458620500/
Bkav        HW64.packed.D4B4        20160321
McAfee-GW-Edition        BehavesLike.Win64.Expiro.fc        20160321

SHA256:        b258c7c81dc771bb435afcc1eeb03489ca92fe49fc4c80aa94c4254e56fb46d5
File name:        TMP5FF5.exe
Detection ratio:        3 / 56
Analysis date:        2016-03-22 04:21:55 UTC ( 1 minute ago )
https://www.virustotal.com/en/file/b258c7c81dc771bb435afcc1eeb03489ca92fe49fc4c80aa94c4254e56fb46d5/analysis/1458620515/
Baidu        Win32.Trojan.WisdomEyes.151026.9950.9997        20160321
McAfee        Ransomware-FHE!65883A694CB8        20160322
Qihoo-360        QVM07.1.Malware.Gen        20160322

进入挂马网页，神网开始漏洞攻击，AD部分，两者没有什么差别，最关键的地方是ESET HIPS 连续三次拦截explorer注入，SpyShelter Firewall对此毫无反应













注销之后，SpyShelter Firewall 和 ESET hips AD方面拦截没有什么区别，但在最后一张截图注入修改SpyShelter Firewall没有反应

蓝天二号

双击，。。。诺顿 KILL  无下文。。

文件名: tmp5ff5.exe
威胁名称: SONAR.Heuristic.144完整路径: 不可用

____________________________

____________________________


在电脑上 
2016/3/22 ( 12:37:08 )

上次使用时间 
2016/3/22 ( 12:37:08 )

启动项 
否

已启动 
是

SONAR 主动防护监视电脑上的可疑程序活动。

____________________________


tmp5ff5.exe 威胁名称: SONAR.Heuristic.144
定位


极少用户信任的文件
诺顿社区中有 不到 5 名用户使用了此文件。

极新的文件
该文件已在 不到 1 周 前发行。

高
此文件具有高风险。


____________________________


来源: 外部介质

源文件:
haozip.exe

创建的文件:
tmp5ff5.exe

____________________________

文件操作

文件: c:\users\microsoft\desktop\新建文件夹\ tmp5ff5.exe 威胁已删除
____________________________

系统设置操作

事件: 进程启动 (执行者 c:\users\microsoft\desktop\新建文件夹\tmp5ff5.exe, PID:400) 未采取操作
事件: 进程启动: c:\users\microsoft\desktop\新建文件夹\ tmp5ff5.exe, PID:7984 (执行者 c:\users\microsoft\desktop\新建文件夹\tmp5ff5.exe, PID:400) 未采取操作
事件: 进程启动: c:\users\microsoft\desktop\新建文件夹\ tmp5ff5.exe, PID:400 (执行者 c:\users\microsoft\desktop\新建文件夹\tmp5ff5.exe, PID:400) 未采取操作
事件: 进程启动 (执行者 c:\users\microsoft\desktop\新建文件夹\tmp5ff5.exe, PID:7984) 未采取操作
事件: PE 文件创建: c:\360sandbox\shadow\users\microsoft\documents\ rykapp.exe (执行者 c:\users\microsoft\desktop\新建文件夹\tmp5ff5.exe, PID:7984) 未采取操作
事件: 进程启动: c:\users\microsoft\desktop\新建文件夹\ tmp5ff5.exe, PID:7984 (执行者 c:\users\microsoft\desktop\新建文件夹\tmp5ff5.exe, PID:7984) 未采取操作
____________________________


文件指纹 - SHA:
不可用
文件指纹 - MD5:
不可用

z2009

The pattern of 'TR/Crypt.XPACK.Gen2 (Cloud) [TR/Crypt.XPACK.Gen2]'
detected in file 'C:\Sandbox\Myy\DefaultBox\user\current\Documents\yjpclw.exe.
Action performed: Deny access

MXCERILYF!

红伞

qftest

再次以实例证明SSF在x64无法拦截注入

僵尸爱上猫

[mw_shl_code=css,true]2016-03-22 13:07:46, Rollback Terminate Process F:\test\TMP5FF5.exe(PID: 3696) succed(0x0)
2016-03-22 13:07:46, Rollback Terminate Process
2016-03-22 13:07:46, Rollback Terminate Process
2016-03-22 13:07:46, End Rollback for F:\test\TMP5FF5.exe
2016-03-22 13:07:46, 成功 结束进程 F:\test\TMP5FF5.exe(PID: 3696)
2016-03-22 13:07:46, Begin Rollback for F:\test\TMP5FF5.exe
2016-03-22 13:07:46, Rollback Terminate Process F:\test\TMP5FF5.exe(PID: 3696) succed(0x0)
2016-03-22 13:07:46, Rollback to remove and quarantine dropped file C:\Sandbox\Likeabull\0test\user\current\Documents\lkkqpb.exe, quarantine failed.
2016-03-22 13:07:46, Rollback to remove file \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current\Documents\lkkqpb.exe failed(0xc0000034)
2016-03-22 13:07:46, Rollback to remove directory \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current\Documents succed(0x0)
2016-03-22 13:07:46, Rollback to remove directory \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current succed(0x0)
2016-03-22 13:07:46, Rollback to remove and quarantine dropped file F:\test\TMP5FF5.exe, quarantine succed.
2016-03-22 13:07:46, Rollback to remove file \Device\HarddiskVolume3\test\TMP5FF5.exe succed(0x0)
2016-03-22 13:07:46, Rollback to remove and quarantine dropped file F:\test\TMP5FF5.exe, quarantine failed.
2016-03-22 13:07:46, 成功 结束进程 F:\test\TMP5FF5.exe, 返回代码: 0
2016-03-22 13:07:46, End Rollback for F:\test\TMP5FF5.exe
2016-03-22 13:07:46, 清除文件 F:\test\TMP5FF5.exe. 云鉴定: 未鉴定, (成功清除) 备份返回代码: 4, 清除返回代码: -1
2016-03-22 13:07:46, MpApplyCaution Type: 21, Action: 1, Caution: 024F3364, UpdatePromptStatus: 1, UpdateCautionStatus: 1
2016-03-22 13:07:46, Begin Rollback for F:\test\TMP5FF5.exe
2016-03-22 13:07:46, End Rollback for F:\test\TMP5FF5.exe
2016-03-22 13:07:46, 成功 结束进程 F:\test\TMP5FF5.exe(PID: 7000)
2016-03-22 13:07:46, Begin Rollback for F:\test\TMP5FF5.exe
2016-03-22 13:07:46, Rollback to remove and quarantine dropped file C:\Sandbox\Likeabull\0test\user\current\Documents\lkkqpb.exe, quarantine failed.
2016-03-22 13:07:46, Rollback to remove file \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current\Documents\lkkqpb.exe failed(0xc000003a)
2016-03-22 13:07:46, Rollback to remove directory \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current\Documents failed(0xc000003a)
2016-03-22 13:07:46, Rollback to remove directory \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current failed(0xc0000034)
2016-03-22 13:07:46, Rollback to remove and quarantine dropped file F:\test\TMP5FF5.exe, quarantine failed.
2016-03-22 13:07:46, Rollback to remove file \Device\HarddiskVolume3\test\TMP5FF5.exe failed(0xc0000034)
2016-03-22 13:07:46, Rollback to remove and quarantine dropped file F:\test\TMP5FF5.exe, quarantine failed.
2016-03-22 13:07:46, 成功 结束进程 F:\test\TMP5FF5.exe, 返回代码: 0
2016-03-22 13:07:46, End Rollback for F:\test\TMP5FF5.exe
2016-03-22 13:07:46, 清除文件 F:\test\TMP5FF5.exe. 云鉴定: 未鉴定, (成功清除) 备份返回代码: 4, 清除返回代码: -1
2016-03-22 13:07:46, MpApplyCaution Type: 21, Action: 1, Caution: 02503364, UpdatePromptStatus: 1, UpdateCautionStatus: 1[/mw_shl_code]破费尔看来对这玩意儿有点儿敏感

墨家小子

qftest 发表于 2016-3-22 13:04
再次以实例证明SSF在x64无法拦截注入

是啊，你可以把那两个极品神网发给SS官方，让他们自己验证，还有我的截图
补充一点：我学习模式下浏览器都是默认修改任何程序内存的，刚才调整了一下，等会再去试试，估计还能拦截到IE对别的程序注入

cfhdrty

FS DG拦截exe

liulangzhecgr

saga3721

如4楼所贴红伞全杀