测hips行为拦截

hsjj2005

测了没加密的几个压缩包，微点通杀

木马名称:Backdoor.Win32.Huigezi.acy

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TWIEX5\CCM.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan.Win32.KillDisk.x

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TWIEX3\TEST.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-PSW.Win32.QQDragon.r

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TWIEX2\CDYDUENGIN.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan-Spy.Win32.Small.fv

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TWIEX1\SYSTEM32\REMOTE.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Spy.Win32.Small.fu

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TWIEX1\SYSTEM32\KERNEL32.IME
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:Trojan.Win32.DebuggerCheat.a

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\TWIEX0\俊冷锁.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

hsjj2005

没加密的压缩包费尔全报。

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\rem0te.rar'
C:\Documents and Settings\Administrator\My Documents\
  rem0te.rar
    [0] Archive type: RAR
    --> rem0te\remote.exe
        [DETECTION] Is the Trojan horse TR/Drop.Agent.adp.3
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\downloader1.rar'
C:\Documents and Settings\Administrator\My Documents\
  downloader1.rar
    [0] Archive type: RAR
    --> ad001\ad001.gif
        [DETECTION] Contains signature of the dropper DR/Delf.YM.1.B
        [WARNING]   Infected files in archives cannot be repaired!
    --> ad001\as.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Agent.arc.2
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\gssBypassed.rar'
C:\Documents and Settings\Administrator\My Documents\
  gssBypassed.rar
    [0] Archive type: RAR
    --> Ccm.exe
        [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.ate Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\killdisk�ܵ�����sandboxie,bufferzone,GesWall nnT.rar'
C:\Documents and Settings\Administrator\My Documents\
  killdisk�ܵ�����sandboxie,bufferzone,GesWall nnT.rar
    [0] Archive type: RAR
    --> Test.exe
        [DETECTION] Is the Trojan horse TR/KillDisk.X
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\windowsservices.rar'
C:\Documents and Settings\Administrator\My Documents\
  windowsservices.rar
    [0] Archive type: RAR
    --> cdyduengin.exe
        [DETECTION] Is the Trojan horse TR/PSW.QQDragon.12.9
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\���ܷ��ֽ���ķ���system32.rar'
C:\Documents and Settings\Administrator\My Documents\
  ���ܷ��ֽ���ķ���system32.rar
    [0] Archive type: RAR
    --> system32\remote.exe
        [DETECTION] Is the Trojan horse TR/Drop.Agent.adp.3
        [WARNING]   Infected files in archives cannot be repaired!
    --> system32\kernel32.ime
        [DETECTION] Is the Trojan horse TR/Drop.Agent.adp.1
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\������.rar'
C:\Documents and Settings\Administrator\My Documents\
  ������.rar
    [0] Archive type: RAR
    --> ¿¡ÀäËø.exe
        [DETECTION] Is the Trojan horse TR/Agent.134029.A
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

yitp

红伞不用说了,大家清楚

jlennon

我无语了，楼主是让大家来测HIPS的，东东们都在测杀软！！

沸沸

haha，最后一个SSM防住了

ohmyivan

用杀软测试的那些人,我估计你们智商有些问题

eubyo

rem0te: 写文件remote.exe到system32目录中，被winpooch拦截
俊冷锁: 写注册表GPExtensions，RestrictRun，被ssm拦截

Nblock

原帖由 eubyo 于 2007-2-23 16:22 发表
rem0te: 写文件remote.exe到system32目录中，被winpooch拦截
俊冷锁: 写注册表GPExtensions，RestrictRun，被ssm拦截

终于看见用hips的了 现在的ssm能防俊冷锁

你再试试其他的？？

cinohtyp

Cyberhawk 除了 killdisk 那個以外, 其他沒問題.