C++博客-chenjavahttp://www.cppblog.com/chenjava/zh-cnWed, 15 Apr 2026 00:25:53 GMTWed, 15 Apr 2026 00:25:53 GMT60Search Samplehttp://www.cppblog.com/chenjava/archive/2008/11/30/68231.html马洲浪子马洲浪子Sun, 30 Nov 2008 12:34:00 GMThttp://www.cppblog.com/chenjava/archive/2008/11/30/68231.htmlhttp://www.cppblog.com/chenjava/comments/68231.htmlhttp://www.cppblog.com/chenjava/archive/2008/11/30/68231.html#Feedback0http://www.cppblog.com/chenjava/comments/commentRss/68231.htmlhttp://www.cppblog.com/chenjava/services/trackbacks/68231.htmlFirstTime>'2008-11-18' and SigID=0 and FileType!='Text' and FileType!='DLL-PE' and Comment!='Clean' and (Submitter='Symantec' or Submitter='Grisoft' or Submitter='inca' or Submitter='Arbor' or Submitter='SecureComputing' or Submitter='AhnLab')
 
FirstTime>'2008-11-11 2' and FirstTime<'2008-11-11 10:30' and FileType='EXE-PE' and SigID>'10000000' and FileSize>'20000' and FileSize<'500000' and Submitter!='chensl' and Kaspersky!='Trojan.Win32.Obfuscated.gen'
 
FirstTime>'2008-11-09' and SigID>'10000000' and FileType='EXE-PE' and FileSize>'30000' and FileSize<'100000' and Archive='' and (Pack='' or Pack like '%UPX' or Pack like '%UPack')

FirstTime>'2008-11-21' and SigID>10000000 and Kaspersky='' and Trendmicro='' and McAfee='' and Antivir='' and Symantec='' and Sophos='' and NOD32='' and Panda='' and Grisoft='' and BitDefender=''



马洲浪子 2008-11-30 20:34 发表评论
]]>Virus分析问题http://www.cppblog.com/chenjava/archive/2008/08/29/60325.html马洲浪子马洲浪子Fri, 29 Aug 2008 01:40:00 GMThttp://www.cppblog.com/chenjava/archive/2008/08/29/60325.htmlhttp://www.cppblog.com/chenjava/comments/60325.htmlhttp://www.cppblog.com/chenjava/archive/2008/08/29/60325.html#Feedback0http://www.cppblog.com/chenjava/comments/commentRss/60325.htmlhttp://www.cppblog.com/chenjava/services/trackbacks/60325.html1.如果VirtualSize比SizeOfRawData小,这种情况下,数据被载入到内存的情况是怎么样的?SizeOfRawData比VirtualSize大的部分会不会被载入到内存?
 
A:试验VirtualSize比SizeOfRawData小不超过1000h时,SizeOfRawData会全部载入内存,还需要再试验超过1000h的情况
 
2.svchost跟startservice api之间有什么区别?
3.210756
205933 erwinb取了upack 0.37
215151 yuhn是如何取的
217541 Worm/Zhelatin.DDB2@mm
 yuhn取的


马洲浪子 2008-08-29 09:40 发表评论
]]>