5.8 可以攔截 病毒修改文件隱藏屬性了。

a256886572008

1.看下圖，我刻意作規則測試，可以攔截  修改隱藏屬性。




2.可以如下設置，保護所有文件 不 被病毒修改隱藏屬性 或是 被刪除。(手動 HIPS 是無法這樣做的)

(1)在這勾選  部份限制。



(2)在 計算機安全規則 那邊，依照下圖，添加文件保護。

?:\*



修改文件隱藏屬性的病毒：

http://bbs.kafan.cn/thread-1110175-1-1.html

紫涵

楼主还是向官方反应一下，叫官方默认加入?:\*吧。

mxf147

这东西动作还真多

011-10-20 11:22:01         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         在线扫描发现恶意程序          
2011-10-20 11:22:09         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\KsecDD
2011-10-20 11:22:16         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         在线扫描发现恶意程序          
2011-10-20 11:22:22         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe
2011-10-20 11:22:26         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改注册表项         HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData
2011-10-20 11:22:27         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         创建进程         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe
2011-10-20 11:22:33         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\Tcp
2011-10-20 11:22:36         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\Ip
2011-10-20 11:22:38         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改注册表项         HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iXeCoRGTCNoNBmj.exe
2011-10-20 11:22:38         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\NamedPipe\ROUTER
2011-10-20 11:22:38         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\NamedPipe\ROUTER
2011-10-20 11:22:40         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\NetBT_Tcpip_{47807F3E-07A0-40E9-AC73-DEBC8310EFB6}
2011-10-20 11:22:43         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\Afd\Endpoint
2011-10-20 11:22:46         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy
2011-10-20 11:22:46         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\NamedPipe\ROUTER
2011-10-20 11:22:46         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
2011-10-20 11:22:46         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         DNS/RPC 客户端访问         \RPC Control\DNSResolver
2011-10-20 11:22:46         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         DNS/RPC 客户端访问         \RPC Control\DNSResolver
2011-10-20 11:22:46         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\Afd\Endpoint
2011-10-20 11:22:46         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         \Device\KsecDD
2011-10-20 11:22:50         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\RasAcd
2011-10-20 11:22:52         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改注册表项         HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData
2011-10-20 11:22:52         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\NamedPipe\ROUTER
2011-10-20 11:22:52         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\NetBT_Tcpip_{BAB711FF-6D4C-4077-9305-8CFCCC4049F0}
2011-10-20 11:22:53         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\NetBT_Tcpip_{E2FC711A-D06B-49BC-A80C-7B0D7B4F50B4}
2011-10-20 11:22:58         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         DNS/RPC 客户端访问         \RPC Control\DNSResolver
2011-10-20 11:22:58         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\Afd\Endpoint
2011-10-20 11:22:58         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\NamedPipe\ROUTER
2011-10-20 11:23:04         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\Afd\Endpoint
2011-10-20 11:23:04         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         DNS/RPC 客户端访问         \RPC Control\DNSResolver
2011-10-20 11:23:04         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\Afd\Endpoint
2011-10-20 11:23:04         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         DNS/RPC 客户端访问         \RPC Control\DNSResolver
2011-10-20 11:23:04         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\Afd\Endpoint
2011-10-20 11:23:04         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\NamedPipe\ROUTER
2011-10-20 11:23:04         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         DNS/RPC 客户端访问         \RPC Control\DNSResolver
2011-10-20 11:23:04         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\Afd\Endpoint
2011-10-20 11:23:04         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         DNS/RPC 客户端访问         \RPC Control\DNSResolver
2011-10-20 11:23:04         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\Afd\Endpoint
2011-10-20 11:23:04         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures
2011-10-20 11:23:12         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe
2011-10-20 11:23:13         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\Afd\Endpoint
2011-10-20 11:23:13         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\NamedPipe\ROUTER
2011-10-20 11:23:13         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         DNS/RPC 客户端访问         \RPC Control\DNSResolver
2011-10-20 11:23:13         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\Afd\Endpoint
2011-10-20 11:23:13         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         DNS/RPC 客户端访问         \RPC Control\DNSResolver
2011-10-20 11:23:13         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         \Device\Afd\Endpoint
2011-10-20 11:23:21         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temp\P5tM1QBI6DSS92.exe.tmp
2011-10-20 11:23:27         C:\Documents and Settings\Administrator\桌面\Vtest\xxx-HD-movie.avi.exe         修改注册表项         HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations
2011-10-20 11:24:49         C:\WINDOWS\explorer.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012011102020111021
2011-10-20 11:24:50         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\desktop.ini
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\Program Files\COMODO\COMODO Internet Security\cfplogvw.exe
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         \Device\NamedPipe\lsarpc
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         \Device\NamedPipe\lsarpc
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\WINDOWS\explorer.exe
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         发送消息         C:\WINDOWS\system32\csrss.exe
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         \Device\NamedPipe\lsarpc
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C\BaseClass
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\Administrator\Recent\'vboxsrv' 上的 Virus_test (E).lnk
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\WINDOWS\explorer.exe
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\NetHood
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\WINDOWS\explorer.exe
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\WINDOWS\explorer.exe
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         发送消息         C:\WINDOWS\system32\csrss.exe
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\WINDOWS\explorer.exe
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         发送消息         C:\WINDOWS\system32\csrss.exe
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\WINDOWS\explorer.exe
2011-10-20 11:24:57         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         发送消息         C:\WINDOWS\system32\csrss.exe
2011-10-20 11:24:58         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\程序\desktop.ini
2011-10-20 11:25:01         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\程序\游戏\desktop.ini
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\WINDOWS\explorer.exe
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         发送消息         C:\WINDOWS\system32\csrss.exe
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\WINDOWS\explorer.exe
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         发送消息         C:\WINDOWS\system32\csrss.exe
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改注册表项         HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Start Menu
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\Administrator\Recent\'vboxsrv' 上的 Virus_test (E).lnk
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\WINDOWS\explorer.exe
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Recent
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\WINDOWS\explorer.exe
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\WINDOWS\explorer.exe
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         发送消息         C:\WINDOWS\system32\csrss.exe
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\WINDOWS\explorer.exe
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         发送消息         C:\WINDOWS\system32\csrss.exe
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         访问内存         C:\WINDOWS\explorer.exe
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         发送消息         C:\WINDOWS\system32\csrss.exe
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\desktop.ini
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\程序\desktop.ini
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\程序\游戏\desktop.ini
2011-10-20 11:25:04         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\程序\管理工具\desktop.ini
2011-10-20 11:25:06         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\程序\附件\desktop.ini
2011-10-20 11:25:08         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\程序\附件\娱乐\desktop.ini
2011-10-20 11:25:10         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\程序\管理工具\desktop.ini
2011-10-20 11:25:10         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\程序\附件\desktop.ini
2011-10-20 11:25:10         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\程序\附件\娱乐\desktop.ini
2011-10-20 11:25:10         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\程序\附件\系统工具\desktop.ini
2011-10-20 11:25:25         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\程序\附件\系统工具\desktop.ini
2011-10-20 11:25:25         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\程序\附件\通讯\desktop.ini
2011-10-20 11:25:26         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
2011-10-20 11:25:29         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         创建进程         C:\WINDOWS\system32\attrib.exe
2011-10-20 11:25:39         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\「开始」菜单\程序\附件\通讯\desktop.ini
2011-10-20 11:25:39         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改注册表项         HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop
2011-10-20 11:25:39         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\桌面\COMODO Firewall.lnk
2011-10-20 11:25:39         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
2011-10-20 11:25:39         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
2011-10-20 11:25:39         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         创建进程         C:\WINDOWS\system32\attrib.exe
2011-10-20 11:26:47         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk.exe
2011-10-20 11:26:56         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         创建进程         C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk.exe
2011-10-20 11:27:05         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改注册表项         HKUS\S-1-5-21-823518204-1202660629-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop
2011-10-20 11:27:05         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         创建进程         C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk.exe
2011-10-20 11:27:19         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         创建进程         C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk.exe
2011-10-20 11:27:25         C:\Documents and Settings\All Users\Application Data\iXeCoRGTCNoNBmj.exe         修改文件         \Device\NamedPipe\lsarpc

lf968

我用OA试过楼主示例的这一只，OA直接block，根本不让运行，估计是无法拦截

a256886572008

lf968 发表于 2011-10-20 11:31
我用OA试过楼主示例的这一只，OA直接block，根本不让运行，估计是无法拦截

OA 有個彈框，列表所有文件，應該可以攔截。

a256886572008

mxf147 发表于 2011-10-20 11:30
这东西动作还真多

必須要等個幾分鐘，才會出現下一步，調用 attrib.exe 修改文件的隱藏屬性。

lf968

a256886572008 发表于 2011-10-20 11:37
OA 有個彈框，列表所有文件，應該可以攔截。

Run Safe?没有这个弹框，直接就是block

lf968

mxf147 发表于 2011-10-20 11:30
这东西动作还真多

这一只很暴力，运行起来comodo默认规则是无法全部拦截的

mxf147

a256886572008 发表于 2011-10-20 11:38
必須要等個幾分鐘，才會出現下一步，調用 attrib.exe 修改文件的隱藏屬性。

日志里已经出现调用Attrib了

zckey

已经添加了，谢谢LZ。