用事实说话，看看ESET对VUNDO的表现

绅博周幸

http://bbs.kafan.cn/viewthread.php?tid=234034&extra=page%3D1

今天我刚中的vundo，红伞秒杀

绅博周幸

Vundo
From Wikipedia, the free encyclopedia
  (Redirected from Vundo trojan)
Jump to: navigation, search
Vundo, or the Vundo Trojan (also known as Virtumonde or Virtumondo) is a Trojan horse that is known to cause popups and advertising for rogue antispyware programs.

Contents [hide]
1 Infection
2 Symptoms
3 References
4 See also
5 External links



[edit] Infection
Vundo infects victims' computers by exploiting a vulnerability in Sun Java 1.5 and earlier versions. Many of the popups advertise programs including (but not limited to) Sysprotect, Storage Protector and WinFixer.It attachs to the system using bogus Browser Helper Objects and DLL files attached to Winlogon and Explorer.exe.


[edit] Symptoms
Vundo will periodically show popups claiming that the computer's performance is "deteriorating", and that the user must download or buy (bogus) security software to fix this. ULWindowSeek or ULWindowURL popups are also a symptom of this virus. Many virus removal programs will remove some of these hidden files but not the actual DLL which has a random name. The DLL usually cannot be removed because the file is in use as soon as Winlogon starts. Depending on versions, Vundo attempts to prevent the user from removing it or otherwise impede its operation, such as by disabling the task manager or Windows registry editor.

千堆栈

原帖由 绅博周幸 于 2008-4-13 13:56 发表
http://bbs.kafan.cn/viewthread.php?tid=234034&extra=page%3D1

今天我刚中的vundo，红伞秒杀

千堆栈

leonfg

纯表情回复扣分

solcroft

eset杀virtumonde的方法的确很特别，之前还以为eset怎么对virtumonde老是不肯更新，过后才发现原来是这个缘故
目前对付zlob和delflob的主要方案看来是新的win32/statik启发，就等着加入到其他扫描模块里面，到时候再来回归eset

shixinlong044

怎么我的ESET不杀啊

woai_jolin

又是监控报 扫描不报的问题

sunrqing

隔离了还报什么。

hj5abc

nod有一些病毒扫描不报监控报 报 可能nuwar变种 时就这样 不过不清楚为什么.