看到毛豆区太安静了，特意去拉了2只小“马”让个位，拉去溜达下

老虎猫

2只可爱的小“马”希望大家喜欢！你们慢慢溜达，小弟我先去溜达下游戏！    HIPS  都来溜达小马玩玩，杀软就去样本区玩吧！呵呵

firefox3

DefenseWall log file

05.15.2012  20:54:18, 模块 C:\WINDOWS\system32\taskkill.exe, Attempt to open process C:\WINDOWS\explorer.exe (进程)

05.15.2012  20:54:17, 模块 C:\WINDOWS\system32\conime.exe, Attempt to attach to the thread input of the C:\WINDOWS\system32\csrss.exe (粉碎)

05.15.2012  20:54:17, 模块 C:\WINDOWS\system32\conime.exe, Attempt to detach from the thread input of the C:\WINDOWS\system32\csrss.exe (粉碎)

05.15.2012  20:54:17, 模块 C:\Documents and Settings\A\桌面\请打开\双击我.exe, 1:Attempt to create global windows hook with module C:\Documents and Settings\A\桌面\请打开\双击我.exe (Hook)

05.15.2012  20:54:17, 模块 C:\Documents and Settings\A\桌面\请打开\双击我.exe, Attempt to set value S133121174 within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ (注册表)

05.15.2012  20:54:17, 模块 C:\Documents and Settings\A\桌面\请打开\双击我.exe, Attempt to set value Shell within the key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ (注册表)

05.15.2012  20:54:17, 模块 C:\Documents and Settings\A\桌面\请打开\双击我.exe, 1:Attempt to hide/show window of the process C:\WINDOWS\explorer.exe. (屏幕)

05.15.2012  20:54:17, 模块 C:\WINDOWS\system32\conime.exe, 1:Process is running untrusted now (进程)

05.15.2012  20:54:17, 模块 C:\Documents and Settings\A\桌面\请打开\双击我.exe, 2:Duplicate handle TOCTTOU (TOCTTOU)

05.15.2012  20:54:17, 模块 C:\WINDOWS\system32\taskkill.exe, 1:Process is running untrusted now (进程)

05.15.2012  20:54:16, 模块 C:\Documents and Settings\A\桌面\请打开\双击我.exe, 1:Attempt to bring window of the process C:\Documents and Settings\A\桌面\请打开\双击我.exe to the top (屏幕)

05.15.2012  20:54:15, 模块 C:\Documents and Settings\A\桌面\请打开\双击我.exe, 1:Process is running untrusted now (进程)

seasonyoung

大A右键秒杀……

bluelaser

3楼，这里是HIPS区，不是杀软测评区。

a256886572008

winlocker 好像沒有很特別

两头蛇

2012-05-16 01:47:29         C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EXa0.723\请打开\请双击我.exe         Sandbox中运行         不信任级别
2012-05-16 01:47:36         C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EXa0.723\请打开\请双击我.exe         安装钩子         C:\windows\system32\MSCTF.dll
2012-05-16 01:48:07         C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EXa0.631\请打开\双击我.exe         Sandbox中运行         不信任级别
2012-05-16 01:48:16         C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EXa0.631\请打开\双击我.exe         在线扫描发现恶意程序          
2012-05-16 01:49:56         C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EXa0.723\请打开\请双击我.exe         修改文件         C:\windows\fxsst.dl

金山毒霸直接秒杀了。。。

chncwk

EAV直接砍掉不许连接。

mb147258

chncwk 发表于 2012-5-16 16:42
EAV直接砍掉不许连接。

还是EAV厉害！

哥舒夜带刀

话说小a真灵敏啊，刚点击还没下载就直接拦截了，叮叮叮3声