晕,别再下载进行测试了.我通过10分钟的测试,已经肯定此AVEWIN32.DLL测试文件对网页监控的彻彻底底的失败....看来红伞需要继续进行网页监控的尝试.
使用测试文件,启动电脑并进入样本区的http://bbs.kafan.cn/viewthread.php?tid=89210&extra=page%3D1帖里的毒网进行测试,结果昨天晚上能够拦截到的病毒，今天居然红伞没有任何提示!!!!!! 
接着,在COMODO在低级报警设置下，也已经记忆并允许我的浏览器运行规则的情况下，开始出现报警提示,说浏览器试图通过OLE操作使用SVCHOST.EXE,并说明此行为有可能被用来劫持其他程序. 
然后我用红伞进行INTERNET临时文件夹扫描，没有找到木马!!难道是红伞已经拦截了???!!!但并没有给出提示???!!!我恢复了以前的AVEWIN32.DLL文件，并启动电脑，并重新扫描刚才的路径,结果如下:
Begin scan in 'C:\Documents and Settings\Administrator'
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4BUFYDSP\a1[1].jpg
[DETECTION] Contains signature of the exploits EXP/Ani.Gen
[INFO] The file was deleted!
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4BUFYDSP\s[1].jpg
[DETECTION] Contains signature of the exploits EXP/Ani.Gen
[INFO] The file was deleted!
End of the scan: 2007年5月26日 08:53
Used time: 01:41 min
The scan has been done completely.
248 Scanning directories
3131 Files were scanned
2 viruses and/or unwanted programs were found
0 classified as suspicious:
2 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
0 Files cannot be scanned
3129 Files not concerned
8 Archives were scanned
0 Warnings
0 Notes
0 Hidden objects were found 
恢复并查杀后，红伞又能监控此网页,而且COMODO也不再报浏览器调用SVCHOST.EXE文件的OLE劫持,看来BETA文件不仅仅是不成熟，更反而成了木马的帮凶!!!  
希望红伞以后做完善了再.......哎.....妈的,吓死我鸟....呵呵......!!!  
此帖扣分!!!! (开个玩笑,其实还真应该谢谢你!又了解了这个DLL文件的职能) 
[ 本帖最后由 伯夷叔齐 于 2007-5-26 13:06 编辑 ] |
楼主: ianlai
发表于 2007-5-26 08:39:15
发表于 2007-5-26 09:11:55
