刚刚搜到的鸽子

显示全部楼层 · 发表于 2008-3-9 03:01:57

又是XXX带来的。。。。

显示全部楼层 · 发表于 2008-3-9 03:18:39

这个东西貌似要篡改沙盒的服务~~测试的人小心~~！！

][HKEY_USERS\Sandbox_Alexander_Blair_XZone\machine\SYSTEM\CurrentControlSet\Services\csrss.exe]
"Type"=dword:00000110
"Start"=dword:00000002
"ErrorControl"=dword:00000000
"DisplayName"="csrss.exe"
"ImagePath"="G:\\WINDOWS\\ravtask.exe"
"SbieProcessId"=dword:000003a8
"SbieCurrentState"=dword:00000004
"SbieControlsAccepted"=dword:00000003
"SbieWin32ExitCode"=dword:00000000
"SbieServiceSpecificExitCode"=dword:00000000
"SbieCheckPoint"=dword:00000000
"SbieWaitHint"=dword:00000000

[HKEY_USERS\Sandbox_Alexander_Blair_XZone\machine\SYSTEM\CurrentControlSet\Services\SbieSvc]
"SandboxedServices"=hex(7):63,00,73,00,72,00,73,00,73,00,2e,00,65,00,78,00,65,\
00,00,00,00,00

[ 本帖最后由 ALEXBLAIR 于 2008-3-9 03:28 编辑 ]

显示全部楼层 · 发表于 2008-3-9 03:19:40

顺便说一句，卡巴飘~~

显示全部楼层 · 发表于 2008-3-9 03:27:03

原帖由 ALEXBLAIR 于 2008-3-9 03:18 发表
这个东西貌似要篡改沙盒的服务~~测试的人小心~~！！

C:\Documents and Settings\Administrator\桌面\ggmm.exe
[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs

那我就不頂風作案了

显示全部楼层 · 发表于 2008-3-9 03:27:41

红伞

D:\病毒样本\NEW\
  ggamm.rar
  ggamm.rar:Zone.Identifier
[0] Archive type: RAR
--> ggmm.exe
      [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs

显示全部楼层 · 发表于 2008-3-9 03:28:09

比我快

显示全部楼层 · 发表于 2008-3-9 09:05:04

木马名称:Backdoor.Win32.GreyPigeon.jpc

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\GGMM.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2008-3-9 09:09:18

毒霸HACK.HUIGEZHI

显示全部楼层 · 发表于 2008-3-9 09:22:55

===================================================================================================
On-demand scanner 7.0.0.10

NSE revision 5.91.10
nvcbin.def revision 5.90.00 of 2008/03/07 16:10:27 (1356064 variants)
nvcmacro.def revision 5.90.00 of 2008/02/04 16:47:24 (20430 variants)
Total number of variants: 1376494
===================================================================================================

   Time  Filename                                                    Virus name
---------------------------------------------------------------------------------------------------

- Scanning drive: G:\
- Scanning system areas of drive: G:\
- Scanning files matching: G:\v\ggamm.rar
   374 ms G:\v\ggamm.rar : ggmm.exe                                  Trojan Hupigon.gen126 ()
- File G:\v\ggamm.rar quarantined.
      2 ms G:\v\ggamm.rar
      1 ms G:\v\ggamm.rar:Zone.Identifier

===================================================================================================

The scanning started: 2008/03/09 09:22:35
            ended: 2008/03/09 09:22:36
Logged on as       : Jason
on hostname       : JASON-PC

Scanning results:
Total number of files found..............................:    3
Number of files scanned..................................:    3
Number of files/directories skipped due to exclude list..:    0
Number of files that could not be opened.................:    0
Number of archive files unpacked.........................:    1
Number of archive files not unpacked.....................:    0
Number of infections.....................................:    1

Copyright (c) 1993-2007 Norman ASA.

显示全部楼层 · 发表于 2008-3-9 09:30:19

E:\VIRUS\ggamm.rar » RAR » ggmm.exe - a variant of Win32/Hupigon trojan

[病毒样本] 刚刚搜到的鸽子

本帖子中包含更多资源

回复 4楼 llgiggs 的帖子