又3个[MD5: 192402 EAD893 DEC7E3]

显示全部楼层 · 发表于 2007-10-1 16:07:39

C:\ABC\server.exe - 可疑代码段被发现 (Level: 175)
C:\ABC\SoundMAN.dll - 特征码 'Trojan-PWS.Win32.Lmir' 被发现
C:\ABC\sysclient.exe - 特征码 'Trojan-PWS.Win32.Lmir' 被发现
3 文件被扫描
(0 压缩档 0 文件)
2 特征码被侦测
1 可疑代码段被发现
耗时: 0:00.687

显示全部楼层 · 发表于 2007-10-1 16:12:10

deleted: Trojan program Backdoor.Win32.Hupigon.nqy File: F:\Documents and Settings\Crusade\×ÀÃæ\ABC.zip/SoundMAN.dll
deleted: Trojan program Backdoor.Win32.Hupigon.nqy File: F:\Documents and Settings\Crusade\×ÀÃæ\ABC.zip/sysclient.exe
deleted: Trojan program Backdoor.Win32.Hupigon.nqy File: F:\Documents and Settings\Crusade\×ÀÃæ\ABC.zip/server.exe

显示全部楼层 · 发表于 2007-10-1 16:12:57

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\ABC.zip'
C:\Documents and Settings\Administrator\桌面\ABC.zip
  [0] Archive type: ZIP
  --> sysclient.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Graybird.GN.464896 Backdoor server programs
  --> server.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Graybird.GN.464896 Backdoor server programs
   [INFO]    The file was deleted!

End of the scan: 星期一 2007年10月1日  16:12
Used time: 00:11 min

The scan has been done completely.

显示全部楼层 · 发表于 2007-10-1 16:38:24

server.exe
Jiangmin  Trojan/Agent.oop
Sunbelt  VIPRE.Suspicious
Webwasher  Trojan.Graybird.GN.464896
panda  Bck/Blackhole.AZ
Kingsoft  Win32.Troj.Heidong.J.675840
Rising  Backdoor.Agent.hlp
Symentec  Backdoor.Singu
Avira  BDS/Graybird.GN.464896
Avast!  Win32:Hupigon-BQO
Bitdefender  GenPack:Generic.Graybird.CD165BA4
CAT-QUICKHeal  (Suspicious) - DNAScan
F-prot  Possible W32/Heuristic-162!Eldorado (not disinfectable)
Ikarus  suspicious(level 175)
MKS_Vir  Win32.4
nProtect  GenPack:Generic.Graybird.CD165BA4
Kaspersky  Backdoor.Win32.Hupigon.nqy

SoundMAN.dll
Rising  Worm.Win32.Delf.ytk
Jiangmin  Trojan/Agent.ooo
Kaspersky  Backdoor.Win32.Hupigon.nqy
Ikarus  Trojan-PWS.Win32.Lmir
Prevx1  Heuristic: Suspicious Self Modifying File

sysclient.exe
Rising  Worm.Win32.Delf.ytk
Kingsoft  Worm.Delf.649728
Jiangmin  TrojanDropper.Agent.ctq
Panda  Suspicious file
kaspersky  Backdoor.Win32.Hupigon.nqy
Ikarus  Trojan-PWS.Win32.Lmir
ClamAV  Trojan.Downloader.Adload-130
Avast!  Win32:Hupigon-BQO [Trj]
Avira  BDS/Graybird.GN.464896

显示全部楼层 · 发表于 2007-10-1 17:13:33

TrustPort Antivirus On-Demand Scanner

   Status       Quarantined
   Target       G:\v\ABC.zip
                           Options
                                                   , Requested action: Move to quarantine, Excluded extensions
                           disabled, Excluded objects disabled, Heuristics enabled, Sandbox enabled,
                           Scan archives

            Statistics                Details

                                                      Files       Boot sectorsRegistry key

                           Scanned             5                      0                            0
                           Infected             1                      0                            0
                           Repaired             0                      0                            0
                           Renamed             0                      -                            -
                        Quarantined             1                      -                            -
                              Deleted             0                      -                            0

显示全部楼层 · 发表于 2007-10-1 18:24:12

灰鸽子！nod没反映

显示全部楼层 · 发表于 2007-10-1 19:42:21

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SYSCLIENT.EXE
木马程序生成以下文件:
1) C:\WINDOWS.0\SYSTEM32\SYSCLIENT.EXE
2) C:\WINDOWS.0\SYSTEM32\SOUNDMAN.DLL
3) C:\WINDOWS.0\SYSTEM32\SERVER.EXE
是否删除木马程序及其衍生物?

木马名称:未知木马

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SERVER.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-10-1 19:43:24

MicroVita AntiSpyware
_____________________________________________

         风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]
               http://221.10.254.214/
----------------------------------------------
开始扫描……

正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\ABC\sysclient.exe]
                  …………发现Spy！报告: [4]
文件信息:  大小:649728  MD5:dec7e3065285e70312f4ccdfa4f9456e

[C:\Documents and Settings\Administrator\桌面\Virus\ABC\server.exe]
                  …………发现Spy！报告: [4]
文件信息:  大小:464896  MD5:1924024e0172a6bc00c061f7fe21a781

[C:\Documents and Settings\Administrator\桌面\Virus\ABC\SoundMAN.dll]
                  …………发现Spy！报告: [4]
文件信息:  大小:92672  MD5:ead89399f7f847973ca84c8fd2515c90

文件数:3 病毒数:3  比重:1
OK  扫描完毕！
  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎
[2] 文件特征码引擎
[1] 文件启发式引擎

[ 本帖最后由 FBAV 于 2007-10-1 19:45 编辑 ]

显示全部楼层 · 发表于 2007-10-1 20:50:06

已删除：木马程序 Backdoor.Win32.Hupigon.nqy 文件　: G:\10.1\ABC.zip/SoundMAN.dll
已删除：木马程序 Backdoor.Win32.Hupigon.nqy 文件　: G:\10.1\ABC.zip/sysclient.exe
已删除：木马程序 Backdoor.Win32.Hupigon.nqy 文件　: G:\10.1\ABC.zip/server.exe

显示全部楼层 · 发表于 2007-10-1 21:00:07

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 279
Paranoia Database - 6309
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\New Folder (2)

C:\Documents and Settings\uhthn\Desktop\New Folder (2)\SoundMAN.dll - Suspicious of Win32.Backdoor.Hupigon.5
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\sysclient.exe - Infected with SDB:Win32.Backdoor.Hupigon.10 - Deleted
C:\Documents and Settings\uhthn\Desktop\New Folder (2)\server.exe - Infected with SDB:Win32.Backdoor.Hupigon.10 - Deleted

3 Files scanned
2 Infected files found
1 Suspicious files found
0 Files cured
2 Files deleted

[病毒样本] 又3个[MD5: 192402 EAD893 DEC7E3]

本帖子中包含更多资源