一后门[MD5: 0AEE3A 7197F2]

promised

sophos
C:\ABC\Setup\Setup.exe
C:\ABC\Setup\Setup.exe\FILE:0000
>>> Virus 'Mal/Behav-141' found in file C:\ABC\Setup\Setup.exe\FILE:0000
>>> File "C:\ABC\Setup\Setup.exe" has been identified as suspicious 'Sus/Malware-A'.
C:\ABC\Setup\sysn.dll
ik
C:\ABC\Setup\Setup.exe - 特征码 'Trojan.Win32.Delf.nf' 被发现
C:\ABC\Setup\sysn.dll - 特征码 'Backdoor.Win32.Hupigon.ene' 被发现

欠妳緈諨

D:\病毒测试\未解压样本\样本.rar » RAR » sysn.dll - probably a variant of Win32/Genetik trojan
D:\病毒测试\未解压样本\样本.rar » RAR » Setup.exe - probably a variant of Win32/Genetik trojan

Graybird

Starting the file scan:

Begin scan in 'E:\样本.rar'
E:\样本.rar
  [0] Archive type: RAR
  --> sysn.dll
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
  --> Setup.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [INFO]      The file was deleted!

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\��.rar'
C:\Users\morgan\Documents\
  ��.rar
    [0] Archive type: RAR
    --> sysn.dll
        [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
        [WARNING]   Infected files in archives cannot be repaired!
      --> Setup.exe
        [1] Archive type: RSRC
        --> Object
            [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
            [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      The file was deleted!

sam.to

kis7不报，已上报

flykiss

dr.web 4.44
  C:\Documents and Settings\Administrator\桌面\样本.rar\sysn.dll - probably infected with DLOADER.Trojan
C:\Documents and Settings\Administrator\桌面\样本.rar\Setup.exe - probably infected with MULDROP.Trojan

Archive contains 2 infected items

BING126

扫描开始时间: 2007-12-1 16:48:36
扫描日志
NOD32 版本 2696 (20071130) NT
命令行: C:\Documents and Settings\Administrator\桌面\样本.rar

日期: 2007年12月1日  时间: 16:48:39
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: C:\Documents and Settings\Administrator\桌面\样本.rar
C:\Documents and Settings\Administrator\桌面\样本.rar ?RAR ?sysn.dll<病毒 - 可能是 Win32/Genetik 木马 变种>
C:\Documents and Settings\Administrator\桌面\样本.rar ?RAR ?Setup.exe<病毒 - 可能是 Win32/Genetik 木马 变种>
已扫描文件数量: 2
已发现病毒数量: 2
完成时间: 16:48:40 总共扫描时间: 1 秒 (00:00:01)

gogo8989

过了FS扫描，主动防御，显示修改注册表和启动设置，

zdlzp

蜘蛛报

sam.to

Hello,

Setup.exek, sysn.dll - Backdoor.Win32.Ceckno.fo

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Vladimir Krylov
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.