[65da74] mofunzone在NOD32区发的

solcroft

最近过ESS的样本也不容易找了，刚好mofunzone发了三个，拿来测试GeSWall一下

GeSWall是Gentle Security Wall的简称，这个东西也名副其实，gentle到极点，要不是把拦截提示全开，安装了后几乎要感觉不到它的存在
对病毒也毫不下杀手，不防止传播，只制死病毒让它无法发作
蛮有趣的东西

[ 本帖最后由 solcroft 于 2007-6-20 18:08 编辑 ]

a256886572008

運行1.exe，發現下列行為，被EQ-Secure RC2攔截！
-----------------
2007-06-20 16:42:24    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\ka1\1.exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-20 16:42:24    创建文件      操作:阻止
进程路径:D:\桌面\virus\ka1\1.exe
文件路径:C:\windows\system32\wuclmi.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-20 16:42:25    创建文件      操作:阻止
进程路径:D:\桌面\virus\ka1\1.exe
文件路径:C:\windows\system32\wincfg.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe


2007-06-20 16:42:25    创建文件      操作:阻止
进程路径:D:\桌面\virus\ka1\1.exe
文件路径:C:\windows\system32\mvdbc.exe
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.exe

-------------------------------------------------------------
1.他會在C:\windows\system32\產生
   wuclmi.exe
   mvdbc.exe

蓝色牛仔裤

[Scan path] C:\Documents and Settings\Administrator\桌面\1.rar
>>C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\data001 - Ok
>>>>C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\data002\data001 - Ok
>>>C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\data002\data002 - Ok
>>>C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\data002\data003 - Ok
>>>C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\data002\data004 - Ok
>>>C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\data002\data005 - Ok
>>>C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\data002\data006 - Ok
>>>C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\data002\data007 - Ok
>>>C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\data002\data008 - Ok
>>>C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\data002\data009 - Ok
>>C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\data002 - Ok
>>C:\Documents and Settings\Administrator\桌面\1.rar\1.exe\data003 infected with Trojan.Sniff
>C:\Documents and Settings\Administrator\桌面\1.rar\1.exe - archive contains infected objects
C:\Documents and Settings\Administrator\桌面\1.rar - archive contains infected objects

l784588

avast 拦截不让下.

seamonkey

KIS7 Pass

┵￠urtain〆

拦截

luyu918

驱逐舰拦截不让下！！

dyw1021

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\1.rar'
C:\Documents and Settings\Administrator\桌面\1.rar
  [0] Archive type: RAR
  --> 1.exe
      [DETECTION] Is the Trojan horse TR/Drop.Spy.Pca.A.2
      [INFO]      The file was moved to '46eaf2a2.qua'!

kp2006

rav

Trojan.Win32.Sniff.es

taihuxian

AVK另一个引擎起作用
Virus: Win32:Delf-DQP [Trj]

Virus found while downloading Web content.

Address: bbs.kafan.cn