网上下的，是毒吗？MD5略

zszzd

如题

微点卫士

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\屏幕录像机转GIF.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\GIF动画录制.EXE
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\SERVER_SETUP.EXE
3) C:\WINDOWS.0\G_SERVER2.0.EXE
是否删除木马程序及其衍生物?
木马名称:Trojan-Dropper.Win32.Pakes.ae

程序:
C:\RECYCLER\S-1-5-21-1078081533-2000478354-1417001333-500\DC14.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?
木马名称:Trojan-Dropper.Win32.Pakes.ae

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\屏幕录像机转GIF.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\屏幕录像机转GIF.exe'
C:\Users\morgan\Documents\
  屏幕录像机转GIF.exe
      [DETECTION] Is the Trojan horse TR/Drop.Pakes.6
      [WARNING]   The file was ignored!

hj5abc

只是捆绑了鸽子..



[ 本帖最后由 hj5abc 于 2007-10-4 14:08 编辑 ]

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\Server_Setup.exe'
C:\Users\morgan\Documents\
  Server_Setup.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [WARNING]   The file was ignored!

mofunzone

看名字就知道eset又吃了kav的特征码
File:         Server_Setup.exe
Status:         INFECTED/MALWARE
MD5:         cc88cf86f8f0ab3dd4ab90e570066cbf
Packers detected:         -
Bit9 reports:         File not found

Scanner results
Scan taken on 04 Oct 2007 06:11:32 (GMT)
A-Squared         Found Backdoor.Win32.G_Door.w
AntiVir         Found BDS/Hupigon.Gen
ArcaVir         Found Trojan.G_door.W
Avast         Found Win32:Hupigon-OH
AVG Antivirus         Found BackDoor.Generic.HQH
BitDefender         Found Backdoor.G.Door.W
ClamAV         Found Trojan.Graybird-16
CPsecure         Found BackDoor.W32.Hupigon.jy
Dr.Web         Found nothing
F-Prot Antivirus         Found nothing
F-Secure Anti-Virus         Found Backdoor.Win32.G_Door.w
Fortinet         Found W32/GDoor.W!tr.bdr
Kaspersky Anti-Virus         Found Backdoor.Win32.G_Door.w
NOD32         Found Win32/G_Door.W
Norman Virus Control         Found W32/G_Door.CB
Panda Antivirus         Found Bck/Ggdoor.I
Rising Antivirus         Found nothing
Sophos Antivirus         Found Mal/Generic-A
VirusBuster         Found Backdoor.G_Door.R
VBA32         Found Backdoor.Win32.G_Door.w

hj5abc

服了红伞 ..难道 drop.pakes 是指 dropper. packages ? 纯yy..

mofunzone

应该就是你说的，被打包了的释放者

king6808

已删除：木马程序 Trojan-Dropper.Win32.Pakes        文件: F:\10.4\屏幕录像机转GIF.rar/屏幕录像机转GIF\屏幕录像机转GIF.exe

taihuxian

卡巴斯基反病毒软件 7.0

The requested URL http://bbs.kafan.cn/attachment.php?aid=135164 is infected with Backdoor.Win32.G_Door.w virus