暂过卡巴、瑞星的灰鸽子

wangjay1980

Hello.
Backdoor.Win32.Hupigon.bcbm
New malicious software was found in the attached file.
It's detection will be included in the next update. Thank you for your help.
-----------------
Regards, Yury Nesmachny
Virus Analyst, Kaspersky Lab.

Ph.: +7(495) 797-8700
E-mail: newvirus@kaspersky.com
http://www.kaspersky.com   http://www.viruslist.com


> Attachment: ttplayer.rar

303898443

8.0.0.268报特洛伊程序，阻止下载。

wangfeng66

文件 ttplayer.rar 接收于 2008.03.06 05:36:19 (CET)
当前状态: 完成

结果: 16/32 (50.00%)
格式化文本 打印结果  
反病毒引擎 版本 最后更新 扫描结果
AhnLab-V3 2008.3.4.0 2008.03.06 -
AntiVir 7.6.0.73 2008.03.05 HEUR/Crypted
Authentium 4.93.8 2008.03.06 -
Avast 4.7.1098.0 2008.03.06 Win32:QQRob-AS
AVG 7.5.0.516 2008.03.05 BackDoor.Hupigon3.AWTD
BitDefender 7.2 2008.03.06 GenPack:Backdoor.Hupigon.YUK
CAT-QuickHeal 9.50 2008.03.05 (Suspicious) - DNAScan
ClamAV 0.92.1 2008.03.06 -
DrWeb 4.44.0.09170 2008.03.05 BackDoor.Graybird
eSafe 7.0.15.0 2008.02.28 suspicious Trojan/Worm
eTrust-Vet 31.3.5590 2008.03.05 -
Ewido 4.0 2008.03.05 -
FileAdvisor 1 2008.03.06 -
Fortinet 3.14.0.0 2008.03.06 -
F-Prot 4.4.2.54 2008.03.05 -
F-Secure 6.70.13260.0 2008.03.06 W32/Hupigon.gen6
Ikarus T3.1.1.20 2008.03.06 Generic.Graybird
Kaspersky 7.0.0.125 2008.03.06 Heur.Trojan.Generic
McAfee 5245 2008.03.05 New Malware.bl
Microsoft 1.3301 2008.03.05 VirTool:Win32/Obfuscator.C
NOD32v2 2925 2008.03.06 Win32/Hupigon.NCT
Norman 5.80.02 2008.03.05 -
Panda 9.0.0.4 2008.03.06 -
Prevx1 V2 2008.03.06 -
Rising 20.34.22.00 2008.03.05 -
Sophos 4.27.0 2008.03.06 Sus/UnkPacker
Sunbelt 3.0.930.0 2008.03.05 -
Symantec 10 2008.03.06 -
TheHacker 6.2.92.233 2008.03.04 -
VBA32 3.12.6.2 2008.03.05 suspected of Backdoor.XiaoBird.1
VirusBuster 4.3.26:9 2008.03.05 -
Webwasher-Gateway 6.6.2 2008.03.06 Heuristic.Crypted
附加信息
File size: 382860 bytes
MD5: c606885f2f0e7f74d702842037049283
SHA1: 5c9307b54951351179a43898a7c2921e83ac69f6
PEiD: -
packers: VPacker

ldy144028

费尔，查出来了

白衣方振眉

江民网页监控发现拦截

lcatxin

扫描进行于：2008-3-6 17:20:24
扫描日志
NOD32版本 2925 (20080305) NT
命令行： C:\Documents and Settings\xin\桌面\ttplayer.rar

日期： 6.3.2008  时间：17:20:25
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\xin\桌面\ttplayer.rar
C:\Documents and Settings\xin\桌面\ttplayer.rar >>RAR >>ttplayer.exe - Win32/Hupigon.NCT 木马
已扫描的文件数目：1
已发现的病毒数目：1
完成时间： 17:20:26 总扫描时间：1 秒 (00:00:01)
但是没有直接杀

[ 本帖最后由 lcatxin 于 2008-3-6 17:22 编辑 ]

田纳西

红伞已确认是一个后门，已去掉启发定义了一个新的变种并入库。
Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00128055.




We received the following archive files:



File ID  Filename  Size (Byte) Result
3784513  ttplayer.rar 373.89 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename  Size (Byte) Result
3784514  ttplayer.exe  378.74 KB  MALWARE


Please find a detailed report concerning each individual sample below:

Filename Result
ttplayer.exe  MALWARE

The file 'ttplayer.exe' has been determined to be 'MALWARE'. Our analysts named the threat BDS/Hupigon.YUK.18. The term "BDS/" denotes a Backdoor-Server program. Backdoor-Server programs are used to spy out, modify or delete data.Detection is added to our virus definition file (VDF) starting with version 7.00.02.238. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Crypted

ztly159

检测到：木马程序 Backdoor.Win32.Hupigon.bcbm        URL: http://bbs.kafan.cn/attachment.php?aid=214505//ttplayer.exe
已删除：木马程序 Backdoor.Win32.Hupigon.bcbm        文件: C:\Documents and Settings\Administrator\桌面\ttplayer.rar/ttplayer.exe

iceflag

卡巴不让下啊
不过一会我会下的我U盘就赞毒了
512的那天我装满了就好了啊

mikelon

微点在eq报了五六次后终于出手了，这时已经出现了已经成功安装灰鸽子服务器端的提示了。真是好吓人