Detection ratio: 5 / 56 大蜘蛛主防 Vs 简单行为挂马（无注入，只加密勒索）

cfhdrty

DG可以玩一年

daisy_wsm

https://www.virusbook.cn/report/scan/90edaf2739fec412c7ac1efcaf2e13a20058363b9c4cafa418049d94eaa6b674-1458537206219

nick20010117

墨家小子 发表于 2016-3-21 11:07
不是专业弄不明白啊，就像挂马网页，有的只是通过漏洞木马进来了，有的像我刚才测试那个，不仅仅是木马进 ...

大蜘蛛有漏洞攻击防护，你可以看看设置了，有一个防御exploit

僵尸爱上猫

费尔的主防撑起了这破软件的一片天
[mw_shl_code=css,true]2016-03-21 22:54:32, ClientCreatePrompt success
2016-03-21 22:54:32, ->ShowPromptWindow
2016-03-21 22:54:32, <-ShowPromptWindow: 0
2016-03-21 22:54:39, ->ShowPromptWindow
2016-03-21 22:54:39, <-ShowPromptWindow: 1
2016-03-21 22:56:54, C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe . 云鉴定: 未鉴定, (等待处理)
2016-03-21 22:56:54, ServerCreatePrompt and send to client success for C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, action: 0
2016-03-21 22:56:54, ClientCreatePrompt success
2016-03-21 22:56:54, ->ShowPromptWindow
2016-03-21 22:56:54, <-ShowPromptWindow: 0
2016-03-21 22:56:54, Rules 0 for F:\test\1B04.tmp.exe 0.200000000 -> Level: 40.8800.100000200400000
2016-03-21 22:56:54, Rules 150 for F:\test\1B04.tmp.exe 40.400000 -> Level: 40.8800.100000200400000
2016-03-21 22:56:54, F:\test\1B04.tmp.exe . 云鉴定: 未鉴定, (等待处理)
2016-03-21 22:56:54, ServerCreatePrompt and send to client success for F:\test\1B04.tmp.exe, action: 0
2016-03-21 22:56:54, F:\test\1B04.tmp.exe . 云鉴定: 未鉴定, (等待处理)
2016-03-21 22:56:54, ServerCreatePrompt and send to client success for F:\test\1B04.tmp.exe, action: 0
2016-03-21 22:56:54, ClientCreatePrompt success
2016-03-21 22:56:54, PromptUnion for F:\test\1B04.tmp.exe
2016-03-21 22:56:54, ClientCreatePrompt success
2016-03-21 22:56:54, ->ShowPromptWindow
2016-03-21 22:56:54, <-ShowPromptWindow: 1
2016-03-21 22:57:16, ProcessLoad was blocked for C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe. <- F:\test\1B04.tmp.exe(PID:4324)::F:\test\1B04.tmp.exe(TID:1084)
2016-03-21 22:57:16, Begin Rollback for C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe
2016-03-21 22:57:16, Rollback Terminate Process C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe(PID: 5052) succed(0x0)
2016-03-21 22:57:16, Rollback Terminate Process
2016-03-21 22:57:16, Rollback Terminate MainThread 1260 in process C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe(PID: 5052) succed(0x0)
2016-03-21 22:57:16, End Rollback for C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe
2016-03-21 22:57:16, 成功 结束进程 C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe(PID: 5052)
2016-03-21 22:57:16, Begin Rollback for C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe
2016-03-21 22:57:16, Rollback Terminate Process C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe(PID: 5052) succed(0x0)
2016-03-21 22:57:16, Rollback to remove and quarantine dropped file C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, quarantine succed.
2016-03-21 22:57:16, Rollback to remove file \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe succed(0x0)
2016-03-21 22:57:16, Rollback to remove and quarantine dropped file C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, quarantine failed.
2016-03-21 22:57:16, 成功 结束进程 C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, 返回代码: 0
2016-03-21 22:57:16, End Rollback for C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe
2016-03-21 22:57:16, 清除文件 C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe. 云鉴定: 未鉴定, (成功清除) 备份返回代码: 4, 清除返回代码: -1
2016-03-21 22:57:16, PromptCancelled: C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, IsDanger: 1, FileIsNotExist, IsFileRedirected: 0, Level: 40, Flags: 0x8800, FlagsEx: 0x100000200400000
2016-03-21 22:57:16, PromptCancelled: C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, IsDanger: 1, FileIsNotExist, IsFileRedirected: 0, Level: 40, Flags: 0x8800, FlagsEx: 0x100000200400000
2016-03-21 22:57:16, PromptCancelled: C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, IsDanger: 1, FileIsNotExist, IsFileRedirected: 0, Level: 40, Flags: 0x8800, FlagsEx: 0x100000200400000
2016-03-21 22:57:16, PromptCancelled: C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, IsDanger: 1, FileIsNotExist, IsFileRedirected: 0, Level: 40, Flags: 0x8800, FlagsEx: 0x100000200400000
2016-03-21 22:57:16, PromptCancelled: C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, IsDanger: 1, FileIsNotExist, IsFileRedirected: 0, Level: 40, Flags: 0x8800, FlagsEx: 0x100000200400000
2016-03-21 22:57:16, PromptCancelled: C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, IsDanger: 1, FileIsNotExist, IsFileRedirected: 0, Level: 40, Flags: 0x8800, FlagsEx: 0x100000200400000
2016-03-21 22:57:16, PromptCancelled: C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, IsDanger: 1, FileIsNotExist, IsFileRedirected: 0, Level: 40, Flags: 0x8800, FlagsEx: 0x100000200400000
2016-03-21 22:57:16, PromptCancelled: C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, IsDanger: 1, FileIsNotExist, IsFileRedirected: 0, Level: 40, Flags: 0x8800, FlagsEx: 0x100000200400000
2016-03-21 22:57:16, PromptCancelled: C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, IsDanger: 1, FileIsNotExist, IsFileRedirected: 0, Level: 40, Flags: 0x8800, FlagsEx: 0x100000200400000
2016-03-21 22:57:29, Rollback Terminate Process F:\test\1B04.tmp.exe(PID: 4324) succed(0x0)
2016-03-21 22:57:29, Begin Rollback for F:\test\1B04.tmp.exe
2016-03-21 22:57:29, Rollback Terminate Process
2016-03-21 22:57:29, Rollback Terminate Process
2016-03-21 22:57:29, Rollback Terminate MainThread 1084 in process F:\test\1B04.tmp.exe(PID: 4324) succed(0x0)
2016-03-21 22:57:29, Rollback Terminate NormalThread 4516 in process F:\test\1B04.tmp.exe(PID: 4324) succed(0x0)
2016-03-21 22:57:29, End Rollback for F:\test\1B04.tmp.exe
2016-03-21 22:57:29, 成功 结束进程 F:\test\1B04.tmp.exe(PID: 2956)
2016-03-21 22:57:29, Begin Rollback for F:\test\1B04.tmp.exe
2016-03-21 22:57:29, Rollback Terminate Process F:\test\1B04.tmp.exe(PID: 4324) succed(0x0)
2016-03-21 22:57:29, Rollback Terminate Process
2016-03-21 22:57:29, Rollback Terminate Process
2016-03-21 22:57:29, Rollback to remove and quarantine dropped file C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, quarantine failed.
2016-03-21 22:57:29, Rollback to remove file \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe failed(0xc0000056)
2016-03-21 22:57:29, Rollback to remove directory \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current\Documents failed(0xc0000101)
2016-03-21 22:57:29, Rollback to remove directory \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current failed(0xc0000101)
2016-03-21 22:57:29, Rollback to remove and quarantine dropped file F:\test\1B04.tmp.exe, quarantine succed.
2016-03-21 22:57:29, Rollback to remove file \Device\HarddiskVolume3\test\1B04.tmp.exe succed(0x0)
2016-03-21 22:57:29, Rollback to remove and quarantine dropped file F:\test\1B04.tmp.exe, quarantine failed.
2016-03-21 22:57:29, 失败 结束进程 F:\test\1B04.tmp.exe, 返回代码: -1073741810
2016-03-21 22:57:29, End Rollback for F:\test\1B04.tmp.exe
2016-03-21 22:57:29, 清除文件 F:\test\1B04.tmp.exe. 云鉴定: 未鉴定, (成功清除) 备份返回代码: 4, 清除返回代码: -1
2016-03-21 22:57:29, MpApplyCaution Type: 21, Action: 1, Caution: 02AF3364, UpdatePromptStatus: 1, UpdateCautionStatus: 1
2016-03-21 22:57:29, Begin Rollback for F:\test\1B04.tmp.exe
2016-03-21 22:57:29, End Rollback for F:\test\1B04.tmp.exe
2016-03-21 22:57:29, 成功 结束进程 F:\test\1B04.tmp.exe(PID: 4324)
2016-03-21 22:57:29, Begin Rollback for F:\test\1B04.tmp.exe
2016-03-21 22:57:29, Rollback to remove and quarantine dropped file C:\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe, quarantine failed.
2016-03-21 22:57:29, Rollback to remove file \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current\Documents\ooldny.exe failed(0xc0000034)
2016-03-21 22:57:29, Rollback to remove directory \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current\Documents succed(0x0)
2016-03-21 22:57:29, Rollback to remove directory \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current succed(0x0)
2016-03-21 22:57:29, Rollback to remove and quarantine dropped file F:\test\1B04.tmp.exe, quarantine failed.
2016-03-21 22:57:29, Rollback to remove file \Device\HarddiskVolume3\test\1B04.tmp.exe failed(0xc0000034)
2016-03-21 22:57:29, Rollback to remove and quarantine dropped file F:\test\1B04.tmp.exe, quarantine failed.
2016-03-21 22:57:29, End Rollback for F:\test\1B04.tmp.exe
2016-03-21 22:57:29, 成功 结束进程 F:\test\1B04.tmp.exe, 返回代码: 0
2016-03-21 22:57:29, 清除文件 F:\test\1B04.tmp.exe. 云鉴定: 未鉴定, (成功清除) 备份返回代码: 4, 清除返回代码: -1
2016-03-21 22:57:29, MpApplyCaution Type: 21, Action: 1, Caution: 031C3364, UpdatePromptStatus: 1, UpdateCautionStatus: 1
[/mw_shl_code]