oo.exe [md5:17afcc1]

mofunzone

难得vba32 XX庆祝下

File:	oo.exe
Status:	POSSIBLY INFECTED/MALWARE(Note: this file was only classified as malware by scanners known togenerate more false positives than the average scanner. Do not considerthese results definately accurate. Also, because of this, results ofthis scan will not be recorded in the database.)
MD5:	17afcc1378fb25f68d241dd92dd02949
Packers detected:	-
Bit9 reports:	File not found
Scanner results
Scan taken on 01 Jul 2007 05:23:47 (GMT)
A-Squared	Found  nothing
AntiVir	Found BDS/Hupigon.Gen
ArcaVir	Found  nothing
Avast	Found Win32:Hupigon-OH
AVG Antivirus	Found  nothing
BitDefender	Found  nothing
ClamAV	Found Trojan.Graybird-16
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found  nothing
Fortinet	Found  nothing
Kaspersky Anti-Virus	Found  nothing
NOD32	Found  nothing
Norman Virus Control	Found  nothing
Panda Antivirus	Found  nothing
Rising Antivirus	Found  nothing
VirusBuster	Found  nothing
VBA32	Found  nothing

绅博周幸

过VBA32的多了，感觉最近半年VBA32拉下了不少病毒库，光靠启发无疑是盲人摸象，还是有海量特征码支持一下比较好

wangjay1980

detected: virus Heur.Backdoor.Generic        File: C:\Documents and Settings\Owner\×ÀÃæ\oo.rar/oo.exe

yzt1004

咳咳～～～貌似多引擎扫描出错了~我这还是25号的病毒库呢

[ 本帖最后由 yzt1004 于 2007-7-1 13:35 编辑 ]

wangjay1980

引擎不同吧

小邪邪

本来咖啡直接扫是不杀的
可是当在用AVK扫的时候，咖啡监控却跳出来把AVK(avast引擎)释放的临时文件给截杀掉了
这报的也是鸽子

wangjay1980

detected: Trojan program Backdoor.Win32.Hupigon.us URL: http://bbs.kafan.cn/attachment.php?aid=95161//oo.exe



Hello,

oo.exe_ - Backdoor.Win32.Hupigon.us

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Dmitry Shvetsov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.



> Attachment: oo.zip

[ 本帖最后由 wangjay1980 于 2007-7-1 16:58 编辑 ]

dsl5

微点测试结果:
时间        处理结果        木马名称        木马进程名        木马文件创建者
2007-07-01 16:05:52        处理成功        未知木马        C:\WINDOWS\HACKER.COM.CN.EXE        D:\OO.EXE
2007-07-01 16:05:52        处理成功        未知木马        D:\OO.EXE        C:\PROGRAM FILES\WINRAR\WINRAR.EXE
2007-07-01 16:05:43        处理成功        未知间谍软件        C:\WINDOWS\HACKER.COM.CN.EXE        D:\OO.EXE
2007-07-01 16:05:43        处理成功        未知间谍软件        D:\OO.EXE        C:\PROGRAM FILES\WINRAR\WINRAR.EXE

这么复杂

Virus check with AntiVirusKit
Version 17.0.6353
Virus signatures of 6/30/2007
Start time: 7/1/2007 16:18
Engine(s): Engine A (AVK 17.5753), Engine B (AVKB 17.279)
Heuristic: On
Archives: On
System areas: On

Check system areas...
Check selected directories and files...
Object: oo.exe
        In archive: C:\Documents and Settings\Administrator\桌面\oo.rar
        Status: Virus detected
        Virus: Win32:Hupigon-OH [Trj] (Engine B)
Object: oo.rar
        Path: C:\Documents and Settings\Administrator\桌面
        Status: Virus detected
        Virus: Win32:Hupigon-OH [Trj] (Engine B)
Analysis complete: 7/1/2007 16:18
    1 files checked
    1 infected files detected
    0 suspected files detected

这么复杂

费尔的

Date,Virus Name,Virus Type,User,Filename,Scan Type
2007-7-1 16:19:47,Heuri.Possible/Packed,启发式扫描,Administrator,C:\Documents and Settings\Administrator\桌面\oo.rar>>oo.exe,Manual scan