收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › 測智能主防
12345678下一页
返回列表 发新帖
楼主: a256886572008
 收起左侧

[病毒样本] 測智能主防

  [复制链接]
will
发表于 2011-7-29 19:44:56 | 显示全部楼层
hj5abc 发表于 2011-7-29 19:39
读写底层磁盘修改MBR，北极熊说过这在Ring3下可无驱动穿还原

UAC降权的话，不提权貌似也是不能访问底层 ...

有加驱。。所以。。我以为是为了穿还原
回复

举报

IOOOOI
发表于 2011-7-29 20:21:30 | 显示全部楼层
余热 发表于 2011-7-29 18:36
。。。。。。

哇塞，第一次见到这种弹窗。
回复

举报

星晨
发表于 2011-7-29 21:08:14 | 显示全部楼层
a256886572008 发表于 2011-7-29 12:21
實機雙擊測試病毒吧，看看BD 的 AVC 能否防住

无虚拟机表压力大
回复

举报

schumi小粉
发表于 2011-7-29 21:09:36 | 显示全部楼层
OA

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

72380656
发表于 2011-7-29 23:14:58 | 显示全部楼层
提示加驱动和联网，OP拦截
回复

举报

liange
发表于 2011-7-29 23:31:22 | 显示全部楼层
ESET入库了...下的时候就报了
回复

举报

will
发表于 2011-7-30 00:20:31 | 显示全部楼层
kaspersky
51e907c4.exe - Trojan-Dropper.Win32.TDSS.aqul
回复

举报

sanhu35
发表于 2011-7-30 08:02:18 | 显示全部楼层
本帖最后由 sanhu35 于 2011-7-30 08:03 编辑
hj5abc 发表于 2011-7-29 14:18
你有拦截到setup149028440.exe这个文件么

路径是C:\Users\XXX\AppData\Local\Temp\


动作开始，键盘记录后 会有个底层写磁盘的操作。

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:43    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe

2011-7-30 07:43:44    底层键盘操作    阻止
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
规则: [应用程序组]『询问』病毒测试 -> [应用程序]c:\documents and settings\administrator\local settings\temp\setup3858621824.exe


利用打印机程序加载病毒。

2011-7-30 07:43:45    修改注册表值    阻止
进程: c:\windows\system32\spoolsv.exe
目标: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers\2630892160\Name
值: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\290.tmp
规则: [注册表组]重要设置 -> [注册表]*\SYSTEM\CurrentControlSet\Control\Print\*; Name

2011-7-30 07:50:46    修改注册表值    阻止
进程: c:\windows\system32\spoolsv.exe
目标: HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ParseAutoexec
值: 1
规则: [注册表组]WinLogon -> [注册表]*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon


2011-7-30 07:50:46    修改注册表值    阻止
进程: c:\windows\system32\spoolsv.exe
目标: HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ParseAutoexec
值: 1
规则: [注册表组]WinLogon -> [注册表]*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon


2011-7-30 07:43:50    修改文件    允许
进程: c:\documents and settings\administrator\local settings\temp\setup3858621824.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\setup3858621824.exe



病毒本体的操作被阻止后，利用打印机程序加载病毒模块 允许后。
键盘记录，底层操作。
此病毒阻止键盘记录和底层操作。
阻止 sploolsv.exe 修改注册表
*\SYSTEM\CurrentControlSet\Control\Print\*; Name
*\SYSTEM\CurrentControlSet\Control\Print\*；Driver








本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x

评分

参与人数 1人气 +1 收起 理由
hj5abc + 1 太感谢你了～测试辛苦～

查看全部评分

回复

举报

hx1997
发表于 2011-7-30 12:12:42 | 显示全部楼层
OA一步搞定

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

bvc
发表于 2011-7-31 12:27:51 | 显示全部楼层
求测马马图~
回复

举报

下一页 »
12345678下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-11-24 16:18 , Processed in 0.110242 second(s), 15 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表