今天又来了，还好BD2011给拦截了。win32.worm.downadupjob.a

MPKYJoJO

KIS也干不掉！求样本啊！

fake5

lz的电脑中母体仍然活跃~

鲁路修

回复 10楼 あ掵㊣峫淰℡ 的帖子

§Not waiting for/requesting any type of user interaction

§Not displaying any type of UI when terminating the execution

§Copying or moving files in C:\Windows\ or C:\Windows\Systme32\

§Having as an icon and unrelated types of an icon (e.g. a process that has as an icon a folder icon; social engineering tactics)

§Executing code in other processes’ space (trying to execute code with higher privileges)

§Running files that have been created by themselves with information stored in its binary file.

§Copying its own contents inside a different file on a disk (replicating itself)

§Adding itself in the startup sequence of the Operating System.

§Hiding themselves from typical process enumeration applications.

§Dropping drivers in C:\Windows\System32\ and registering them

爵小宝

BD就是厉害啊~呵呵~不过看来LZ的上网习惯不太好哦

sdnsr

回复 14楼 爵小宝 的帖子

我的上网习惯应该还可以，原因可能是局域网传播比较厉害，这局域网里有一千多台机器，普通工作站都只装了趋势企业版，防杀能力都比较差。