据说是网络红娘8EA40B

promised

AntiVir	7.4.0.42	6.39.0.146	2007-07-13	HEUR/Malware	2.041
Arcavir AntiVirus	1.0.4	200707131137	2007-07-13	Found nothing	1.115
Avast AntiVirus	1.0.8	000756-1	2007-07-13	Win32:Hupigon-BMV	1.539
AVG AntiVirus	7.5.47.442	269.10.6/900	2007-07-14	BackDoor.Hupigon.FNG	1.153
BitDefender AntiVirus	7.60825.734607	7.13874	2007-07-15	Found nothing	2.765
Clam AntiVirus	N/A	3673	2007-07-15	Found nothing	0.118
Dr.Web AntiVirus	4.33	2007.07.14	2007-07-14	MULDROP.Trojan	4.445
F-prot AntiVirus	3.16.15	2007.07.13	2007-07-13	Found nothing	0.368
F-SECURE AntiVirus	5.51.6100	2007.07.13.04	2007-07-13	Found nothing	2.29
IKARUS AntiVirus	N/A	17:07:14	2007-07-14	Trojan-Spy.Win32.Agent.pi	1.336
Kaspersky AntiVirus	5.5.10	2007.07.14	2007-07-14	Found nothing	0.038
KingSoft Anti-Virus	2007.4.17.247	2007.7.12	2007-07-12	Found nothing	0.777
Mcafee AntiVirus	5.1.00	5074	2007-07-13	Found nothing	0.643
MKS_VIR AntiVirus	2.01	2007.07.12	2007-07-12	Found nothing	0.28
NOD32 AntiVirus	2.70.7	2399	2007-07-14	Found nothing	1.341
NORMAN AntiVirus	5.90.37	5.90	2007-07-13	W32/Hupigon.AXFU	2.523
PANDA AntiVirus	9.00.00	2007.07.14	2007-07-14	Found nothing	0.774
SOPHOS AntiVirus	2.47	4.19	2007-07-14	Found nothing	6.152
Symantec AntiVirus	N/A	20070714.016	2007-07-14	Found nothing	0.228
TrendMicro PC-cillin	8.500-1001	4.595.00	2007-07-12	Found nothing	0.043
VBA32 AntiVirus	3.12.0.2	20070714.1925	2007-07-14	Backdoor.Hupigon.16 (paranoid ...	1.278
VirusBuster AntiVirus	4.3.19:9	9.088.5/11.0	2007-07-14	Found nothing

[ 本帖最后由 promised 于 2007-7-15 09:42 编辑 ]

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\R_Server.zip'
F:\病毒样本\R_Server.zip
  [0] Archive type: ZIP
  --> R_Server.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!

woai_jolin

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/13 18:54:26 (807131 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 827472
Command line: "@C:\Users\Jason\AppData\Local\Temp\~OD4633.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: D:\virus\R_Server.zip
       15 ms D:\virus\R_Server.zip : R_Server.exe                         Trojan W32/Hupigon.AXFU ()
        0 ms D:\virus\R_Server.zip                                       
        0 ms D:\virus\R_Server.zip:Zone.Identifier                       
- File D:\virus\R_Server.zip quarantined.

===================================================================================================

The scanning started: 2007/07/15 09:10:30
               ended: 2007/07/15 09:10:31
Logged on as        : Jason
on hostname         : JASON-PC

Scanning results:
   Total number of files found..............................:       3
   Number of files scanned..................................:       3
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       1
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       1

Copyright (c) 1993-2005 Norman ASA.

seamonkey

Micropoint

只爱宠儿

网络红娘``

谢谢你提供的样本``

能过微点主动防御和卡吧主动防御(模拟键盘操作)

技术含量还不低``

微点卫士

楼上的看清楚微点的图,哪里过了?

坐在墙头

费尔报鸽子
Backdoor.Hupigon.fac.wppo

wangjay1980

2007-7-15 JAY09:38:37        C:\WINDOWS\System32\cmd.exe        Attempt to run critical application.
2007-7-15 JAY09:38:37        C:\WINDOWS\System32\cmd.exe        Action blocked.
2007-7-15 JAY09:38:41        C:\Documents and Settings\Owner\×ÀÃæ\R_Server.exe        Process is trying to register its copy as an autorun startup object. This behaviour is typical of Trojans.
2007-7-15 JAY09:38:41        C:\Documents and Settings\Owner\×ÀÃæ\R_Server.exe        Attempt to terminate process
2007-7-15 JAY09:38:49        C:\WINDOWS\System32\RedG3irl.exe        Attempt to terminate process: successfully
2007-7-15 JAY09:38:53        \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RedG3irl\ImagePath        Rollback
2007-7-15 JAY09:38:54        C:\WINDOWS\system32\tmp.bat        Rollback
2007-7-15 JAY09:38:54        C:\WINDOWS\system32\xcopy.exe        Rollback
2007-7-15 JAY09:38:54        C:\WINDOWS\system32\RedG3irl.exe        Rollback
2007-7-15 JAY09:38:41        C:\Documents and Settings\Owner\×ÀÃæ\R_Server.exe        Rollback completed

只爱宠儿

原帖由 微点卫士 于 2007-7-15 09:34 发表
楼上的看清楚微点的图,哪里过了?

我就看了下哈``没有运行``

可能不准确



就看到它调用的函数``

能不能实现就不知道了``

promised

你自己实践一下吧
反正我是在他释放BAT调用之前就咔嚓了
后续动作不得明了