[病毒样本] 1

显示全部楼层 · 发表于 2008-3-15 14:19:47

Starting the file scan:

Begin scan in 'E:\AV\camfrog4.1ע��.rar'
E:\AV\camfrog4.1ע��.rar
  [0] Archive type: RAR
  --> camfrog4.1×¢²áÂë.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [INFO]    The file was deleted!

1

显示全部楼层 · 发表于 2008-3-15 15:30:10

提取
Sign of "Win32:Hupigon-EKT [Trj]" has been found in "C:\Documents and Settings\Administrator\Local Settings\Temp\IXP000.TMP\4.exe" file.

显示全部楼层 · 发表于 2008-3-15 15:35:04

Starting the file scan:

Begin scan in 'E:\AV\4.zip'
E:\AV\4.zip
  [0] Archive type: ZIP
  --> 4.exe
   [DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-3-15 17:11:37

行为分析

路径：HKEY_CURRENT_USER\MACHINE\SOFTWARE\MICROSOFT\Windows\CURRENTVERSION\RunOnce

键名：wextract_cleanup0
新键值："rundll32.exe C:\WINNT\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\""

描述：注册表常规启动项

路径：HKEY_CURRENT_USER\MACHINE\SOFTWARE\MICROSOFT\Windows\CURRENTVERSION\RunOnce

键名：wextract_cleanup0
原键值：UNKNOWN TYPE: 1954182507
新键值：

描述：注册表常规启动项

启动服务 WINS

连接 60.191.124.236:8000

在windows目录下生成360tray.exe

显示全部楼层 · 发表于 2008-3-15 17:14:34

这東西是不报的

显示全部楼层 · 发表于 2008-3-15 18:32:24

E:\virus\camfrog4.1注册码.rar » RAR » camfrog4.1注册码.exe - is OK
E:\virus\4.zip » ZIP » 4.exe - a variant of Win32/Hupigon trojan - was a part of the deleted object
E:\virus\4.zip - a variant of Win32/Hupigon trojan - deleted - quarantined

显示全部楼层 · 发表于 2008-3-15 19:35:15

detected: Trojan program Trojan-Dropper.Win32.Agent.fxb URL: http://bbs.kafan.cn/attachment.php?aid=220062//camfrog4.1×¢²áÂë.exe

显示全部楼层 · 发表于 2008-3-15 19:40:27

显示全部楼层 · 发表于 2008-3-15 21:14:32

[Found backdoor] <W32/Hupigon.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\4.zip->4.exe->(PE_Patch.MaskPE)

[病毒样本] 1

本帖子中包含更多资源

本帖子中包含更多资源

回复 3楼 solcroft 的帖子

本帖子中包含更多资源