NOD32v2.70.32的监控比以前更强悍了！

blackfox

用了几天NOD新版，感觉NOD32  2.70.32在IMON和AMON的协调性与病毒隔离方面，比以前有进步了，而且抓到毒网后，AMON、IMON能够协调把病毒隔离，留下样本，以前的版本也遇到过毒网，不过即使选中隔离，也不会留下样本，MS都删除了，看偶的威胁监控日志：
Time Module Object Name Threat Action User Information
2007-2-23 22:03:22 AMON file F:\RECYCLER\S-1-5-21-448539723-1604221776-1801674531-1003\Df2.js JS/TrojanDownloader.IstBar.G trojan quarantined - deleted - error while cleaning - operation unavailable for this type of object
Event occurred on a file modified by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
2007-2-23 22:03:18 AMON file F:\样本\chinavb[1].js JS/TrojanDownloader.IstBar.G trojan error while cleaning - operation unavailable for this type of object
Event occurred at an attempt to access the file by the application: C:\WINDOWS\Explorer.EXE.
2007-2-23 21:52:30 AMON file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4PAJ09QR\chinavb[1].js JS/TrojanDownloader.IstBar.G trojan quarantined - deleted - error while cleaning - operation unavailable for this type of object
Event occurred on a new file created by the application: C:\Program Files\Internet Explorer\iexplore.exe. The file was moved to quarantine. You may close this window.
2007-2-23 21:52:30 IMON file http://soft.jetdown.com/chinavb.js JS/TrojanDownloader.IstBar.G trojan Connection terminated
2007-2-23 21:48:58 AMON file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\O1IJC9A7\chinavb[1].js JS/TrojanDownloader.IstBar.G trojan quarantined - deleted - error while cleaning - operation unavailable for this type of object
Event occurred on a new file created by the application: C:\Program Files\Internet Explorer\iexplore.exe. The file was moved to quarantine. You may close this window.
2007-2-23 21:48:58 IMON file http://soft.jetdown.com/chinavb.js JS/TrojanDownloader.IstBar.G trojan Connection terminated
2007-2-23 21:43:19 AMON file F:\RECYCLER\S-1-5-21-448539723-1604221776-1801674531-1003\Df1.htm HTML/Exploit.IframeBof trojan quarantined - deleted - error while cleaning - operation unavailable for this type of object
Event occurred on a file modified by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
2007-2-23 21:43:16 AMON file F:\样本\07004[1].htm HTML/Exploit.IframeBof trojan error while cleaning - operation unavailable for this type of object
Event occurred at an attempt to access the file by the application: C:\WINDOWS\Explorer.EXE.
2007-2-23 21:42:47 AMON file F:\样本\07004[1].htm HTML/Exploit.IframeBof trojan error while cleaning - operation unavailable for this type of object
Event occurred at an attempt to access the file by the application: C:\WINDOWS\Explorer.EXE.
2007-2-23 21:42:41 AMON file F:\样本\07004[1].htm HTML/Exploit.IframeBof trojan error while cleaning - operation unavailable for this type of object
Event occurred at an attempt to access the file by the application: C:\Program Files\WinRAR\WinRAR.exe.
2007-2-23 21:42:29 AMON file F:\样本\07004[1].htm HTML/Exploit.IframeBof trojan error while cleaning - operation unavailable for this type of object
Event occurred at an attempt to access the file by the application: C:\WINDOWS\Explorer.EXE.
2007-2-23 21:42:27 AMON file F:\样本\07004[1].htm HTML/Exploit.IframeBof trojan error while cleaning - operation unavailable for this type of object
Event occurred at an attempt to access the file by the application: C:\WINDOWS\Explorer.EXE.
2007-2-23 21:39:09 AMON file C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\U29ZDKGP\07004[1].htm HTML/Exploit.IframeBof trojan quarantined - deleted - error while cleaning - operation unavailable for this type of object
Event occurred on a new file created by the application: C:\Program Files\Internet Explorer\iexplore.exe. The file was moved to quarantine. You may close this window.
2007-2-23 21:39:08 IMON file http://www.gridvod.info/111111.files/qzhuce.files/popu.files/07004.htm HTML/Exploit.IframeBof trojan Connection terminated

deane_tiantian

顶。永远的NOD迷（至少两年内会是 ）

bluenice

NOD是动态启发+静态启发？
动态启发应该是运行某病毒后，报出的病毒名应该不是确切的病毒名，这样才是真正的动态启发。
比如A。exe扫描不报，运行A，生产B。exe，那么如果NOd此时报B为某某病毒，（有具体病毒名）的话，说明不是动态。因为NOD脱壳的缘故，要运行A生产B后，NOD才认识B。
如果B报的是未知病毒的话，说明是动态启发。

aoyang

新版看来比2.5的时候厉害多了 有机会都想再装来玩玩

ly250094040

静态就是和特征码相似度对比

动态就是虚拟运行

The EQs

原帖由 deane_tiantian 于 2007-2-23 22:56 发表
顶。永远的NOD迷（至少两年内会是 ）

如果未来vba32能解决误报和高内存占用率，扫描速度慢的问题的话。。。vba32将会成为nod32最有力的竞争者。。

xiaoz

顶，偶也是nod fans。

想念天堂

曾经用过VBA刚安装就说我中了灰鸽子，然后内存占用100%，我就直接死机

The EQs

是的。。。vba32的内存占用的确很BT。。。。

估计白俄罗斯的电脑都很强悍~