6cf769，美味的鸽子！

显示全部楼层 · 发表于 2007-7-25 14:29:43

死的
算了
还想用SANDBOX类

显示全部楼层 · 发表于 2007-7-25 16:15:04

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/24 08:21:08 (815016 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 835357
Command line: "@C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~OD15.tmp"
===================================================================================================

   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: F:\v\server3.exe
   16 ms F:\v\server3.exe                                           Trojan W32/Hupigon.dam ()
- File F:\v\server3.exe quarantined.
- File F:\v\server3.exe deleted.

===================================================================================================

The scanning started: 2007/07/25 16:15:13
            ended: 2007/07/25 16:15:13
Logged on as       : Administrator
on hostname       : 2FEA146376E2420

Scanning results:
Total number of files found..............................:    1
Number of files scanned..................................:    1
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    0
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    1

Copyright (c) 1993-2005 Norman ASA.

显示全部楼层 · 发表于 2007-7-25 16:25:57

原帖由 风野胤 于 2007-7-25 15:54 发表
死了
用DSA什么都没抓到
不过也不一定
DSA的fd很差的

FD还好，基本上一般的破坏性还拦得住，虽然不是很理想
RD却存着大漏洞，删除安全模式，强行关闭现实隐藏文件等行为DSA都不报
不建议用DSA来跑毒

显示全部楼层 · 发表于 2007-7-25 16:52:44

金山挂了

费尔报后门鸽子,耶

微点:
程序开启后马上自行关闭

[病毒样本] 6cf769，美味的鸽子！