gezi[MD5:a52fa1]

显示全部楼层 · 发表于 2007-7-12 08:38:08

C:\Documents and Settings\Administrator\My Documents\attachment.php ?ZIP ?070705ok.exe - 正常

显示全部楼层 · 发表于 2007-7-12 08:38:15

Starting the file scan:

Begin scan in 'F:\病毒样本\070705ok.zip'
F:\病毒样本\070705ok.zip
  [0] Archive type: ZIP
  --> 070705ok.exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-12 08:47:07

AVAST!过了啊

显示全部楼层 · 发表于 2007-7-12 08:53:06

AhnLab-V3	2007.7.11.1	20070711	no virus found
AntiVir	7.4.0.39	20070711	BDS/Hupigon.Gen
Authentium	4.93.8	20070711	no virus found
Avast	4.7.997.0	20070712	no virus found
AVG	7.5.0.476	20070712	BackDoor.Hupigon.DHL
BitDefender	7.2	20070712	no virus found
CAT-QuickHeal	9.00	20070711	no virus found
ClamAV	devel-20070416	20070712	Trojan.Packed-12
DrWeb	4.33	20070711	no virus found
eSafe	7.0.15.0	20070710	no virus found
eTrust-Vet	30.8.3780	20070711	no virus found
Ewido	4.0	20070711	no virus found
FileAdvisor	1	20070712	no virus found
Fortinet	2.91.0.0	20070712	no virus found
F-Prot	4.3.2.48	20070711	no virus found
Ikarus	T3.1.1.8	20070711	Generic.Graybird
Kaspersky	4.0.2.24	20070712	Backdoor.Win32.Hupigon.exb
McAfee	5072	20070711	no virus found
Microsoft	1.2704	20070711	no virus found
NOD32v2	2394	20070711	no virus found
Norman	5.80.02	20070711	Hupigon.gen124
Panda	9.0.0.4	20070712	Suspicious file
Sophos	4.19.0	20070706	no virus found
Sunbelt	2.2.907.0	20070711	VIPRE.Suspicious
Symantec	10	20070711	no virus found
TheHacker	6.1.6.145	20070712	no virus found
VBA32	3.12.0.2	20070712	no virus found
VirusBuster	4.3.23:9	20070711	no virus found
Webwasher-Gateway	6.0.1	20070712	Trojan.Hupigon.Gen

显示全部楼层 · 发表于 2007-7-12 08:53:13

D:\Download\T3\070705ok.zip:\070705ok.exe - 特征码 'Generic.Graybird' 被侦测
D:\Download\T3\070705ok.zip

2 个文件被扫描
(1 个压缩档和 1 个文件)
1 个病毒被侦测
0 个可疑代码段被侦测
耗时： 0:00.191

显示全部楼层 · 发表于 2007-7-12 09:23:29

金山也没反应

显示全部楼层 · 发表于 2007-7-12 10:17:28

C:\Documents and Settings\lq-1\桌面\070705ok.zip>
>070705ok.exe>>aspr.ske.2.x.new　Backdoor.Win32.Gpigeon.zvy

显示全部楼层 · 发表于 2007-7-12 10:22:19

運行070705ok.exe，發現下列行為，被EQ-Secure RC4攔截！

2007-07-12 10:15:15 创建文件    操作:允许
进程路径:D:\桌面\virus\070705ok\070705ok.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\java\java
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-12 10:15:21 创建文件    操作:允许
进程路径:D:\桌面\virus\070705ok\070705ok.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\drive\C\windows\uninstal.bat
触发规则:所有程序规则->保護安全軟體->C:\Documents and Settings\Hung  Jui Hung\Application Data\Sandbox\DefaultBox\*

2007-07-12 10:15:23 运行应用程序    操作:阻止
进程路径:D:\桌面\virus\070705ok\070705ok.exe
文件路径:C:\windows\system32\cmd.exe
命令行:/c C:\windows\uninstal.bat
触发规则:黑名单->防卸规则->*\cmd.exe

1.他會在C\windows\java\生成
java
2.他會在C\windows\生成
uninstal.bat
3.他會運行C:\windows\system32\cmd.exe
/c C:\windows\uninstal.bat
--------------------------
話說樓主，這個樣本是否從FTP抓的呢

ftp://222.191.251.99/
username:czh808
password:haha123520

显示全部楼层 · 发表于 2007-7-12 10:57:58

When opening file "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6GD3JPHG\070705ok[1].zip" the virus "Backdoor.Win32.Hupigon.exb" from engine "Engine A" has been detected. File cleaned: no. File deleted: no. Quarantine: no.

[病毒样本] gezi[MD5:a52fa1]

本帖子中包含更多资源

nod pass

AVK