从我的肉鸡上抓的病毒[b15bb6]

显示全部楼层 · 发表于 2007-7-20 13:51:29

从我的肉鸡上抓到的一个病毒，应该是老毒了，看看它都做什么吧……

显示全部楼层 · 发表于 2007-7-20 13:59:49

费尔无反应

显示全部楼层 · 发表于 2007-7-20 14:02:40

不是吧？！
卡巴6和avast都会报的……
费尔居然飘了？？？

显示全部楼层 · 发表于 2007-7-20 14:06:56

C:\virus\_scvhost.rar »RAR »_scvhost.exe - a variant of Win32/Hupigon trojan

显示全部楼层 · 发表于 2007-7-20 14:07:32

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

&#26700 : Not detected by Sandbox (Signature: W32/Hupigon.gen16)

[ DetectionInfo ]
* Sandbox name: NO_MALWARE
* Signature name: W32/Hupigon.gen16

[ General information ]
* Decompressing UPX.
* File length:    287744 bytes.
* MD5 hash: b15bb68b443dc1e7467f2d96683c0efe.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\paramstr.txt.

[ Process/window information ]
* Creates an event called .

[ Signature Scanning ]
* C:\WINDOWS\paramstr.txt (13 bytes) : no signature detection.

(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

显示全部楼层 · 发表于 2007-7-20 14:08:28

搞不懂ikaurs

IKARUS - T3SCAN V1.25 (WIN32)
      T3 V1.01.08
      Copyright (c) 2003 - 2007 by IKARUS Software.
      Written by Richard Schmoegner.
      All rights reserved.

Signature-database from 18.7.2007 17:07:57 (Build: 69228)

C:\virus\_scvhost.rar:\_scvhost.exe - Signature 'MalwareScope.Backdoor.Hupigon.1
7' found

      2 Files scanned
      (1 Archiv with 1 file)
      1 Signature found
      0 Suspect code-parts found
      Used time: 0:00.266

谀哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪姆
?          VirusBlokAda (Console scanner)          ?
?Vba32 Windows/CL 3.12.0.2 / 2007.07.15 21:04 (Vba32.W) ?
?       Copyright (c) 1993-2007 by VBA Ltd.          ?
酝屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯屯图
Key file not found
Demo mode
Command line options:
/r=susp.rpt /ha=3 /collect_suspects /nc /af+ /ar+ /bt- /mr- /wk+ /ml+ /rw+ /as-
Ctrl-C will terminate program execution

C:\virus\_scvhost.rar
C:\virus\...\_scvhost.exe : infected MalwareScope.Trojan-PSW.Game.14

Directories    : 0    Files in archives:    Files on disks:
Archives:                - total    : 1    - total    : 2
- scanned       : 1    -  scanned : 1    - scanned    : 2
- contain viruses : 1    -  infected : 1    - infected : 1
- deleted       : 0    -  suspicious : 0    - suspicious  : 0

Startup : 14:07:25 20-07-2007
End       : 14:07:31 20-07-2007
Total time : 00:00:06

显示全部楼层 · 发表于 2007-7-20 14:09:43

已检测到: 木马程序 Backdoor.Win32.Hupigon.evc URL: http://bbs.kafan.cn/attachment.php?aid=102955//_scvhost.exe
KAV7

显示全部楼层 · 发表于 2007-7-20 14:11:10

咖啡报木马，BackDoor-AWQ.b

显示全部楼层 · 发表于 2007-7-20 14:14:25

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\_scvhost.rar'
C:\Documents and Settings\Administrator\桌面\_scvhost.rar
  [0] Archive type: RAR
  --> _scvhost.exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-7-20 14:14:51

Start of the scan: 2007年7月20日  14:14

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\_scvhost.rar'
C:\Documents and Settings\Administrator\桌面\_scvhost.rar
  [0] Archive type: RAR
  --> _scvhost.exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
   [INFO]    A backup was created as '47035322.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

[病毒样本] 从我的肉鸡上抓的病毒[b15bb6]

本帖子中包含更多资源