怎么预防 修改时间的病毒

jiimoo

修改时间的病毒 样本,时间修改到1980,机器巨卡...

The EQs

Scan performed at: 2007-5-6 14:08:58
Scanning Log
NOD32 version 2244 (20070505) NT
Command line: C:\Documents and Settings\EQ2\桌面\wzkSP.rar
Operating memory - is OK

Date: 6.5.2007  Time: 14:09:02
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\wzkSP.rar
C:\Documents and Settings\EQ2\桌面\wzkSP.rar ?RAR ?wzkSP.exe - Win32/Agent.NAT worm - was a part of the deleted object
Number of scanned files: 3
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 14:09:02 Total scanning time: 0 sec (00:00:00)

mofunzone

用antivir预防

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\wzkSP.rar'
C:\Documents and Settings\morgan\My Documents\
  wzkSP.rar
    [0] Archive type: RAR
    --> Autorun.inf
    --> wzkSP.exe
        [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

欠妳緈諨

启发

promised

当然是HIPS啦

The EQs

hips能防得住？？修改时间的病毒直接修改BIOS里面的时间。。。

黑衣~魂

McAfee 已自動封鎖並移除 病毒。

詳細資料
偵測: W32/Generic.m (病毒), W32/Generic.m (病毒)
檔案路徑: C:\Documents and Settings\all.HOME\桌面\wzkSP.exe

马力

驱逐舰

蓝色牛仔裤

Check system areas...
Check selected directories and files...
Object: wzkSP.exe
        In archive: C:\Documents and Settings\Administrator\桌面\wzkSP.rar
        Status: Virus detected
        Virus: Worm.Win32.Agent.t (KAV engine), Win32:Trojan-gen. {Other} (AVAST-Engine)
Object: wzkSP.rar
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Virus detected
        Virus: Worm.Win32.Agent.t (KAV engine), Win32:Trojan-gen. {Other} (AVAST-Engine)
Analysis complete: 2007-5-6 14:12
    1 files checked
    1 infected files detected
    0 suspected files detected

mofunzone

omg
能直接在win下修改该bios时间的东西我还是第一次听说过
我以为，除非cmos电池没电，不然bios的时间是不会变的，win的正版验证正式用的bios时间来做的，在win下都能该bios时间win就没得救了。。