红伞PASS(已经被杀)

显示全部楼层 · 发表于 2008-4-18 12:36:06

上次做红伞录象教程时修改的...

今天升级后发现还是没被伞杀

所以还是把样本发出来好了

PS：教程发去黑客动画吧了 http://www.hack58.com/Soft/html/12/24/2008/2008032912695.htm

====================

传到论坛来还没2个小时就被杀,效率不错

[ 本帖最后由 cici584522 于 2008-4-18 14:28 编辑 ]

显示全部楼层 · 发表于 2008-4-18 12:42:31

先写文件C:\WINDOWS\Hacker.com.cn.exe
Hacker.com.cn.exe再安装服务
Hacker.com.cn.exe启动调用IE浏览器

显示全部楼层 · 发表于 2008-4-18 12:55:33

就算我们想复制你的做法也不知道你是用哪个客户端生成的啊

显示全部楼层 · 发表于 2008-4-18 13:11:50

E:\VIRUS\1（18）.rar > RAR > 1.exe - Win32/Hupigon 特洛伊木马

显示全部楼层 · 发表于 2008-4-18 13:12:31

date/time: 2008-4-18 13:09:42
filename: 1（18）.rar
original path: E:\VIRUS\
filesize: 302.75 KB
virusname: Backdoor.Win32.Hupigon.nqr
suggestion: Save & Delete
signatureId: 247735

显示全部楼层 · 发表于 2008-4-18 13:23:01

在 C:\Documents and Settings\Administrator\桌面\1.rar->1.exe 中发现 Backdoor/Huigezi.qy 病毒, 已删除

显示全部楼层 · 发表于 2008-4-18 13:23:52

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\1.rar<RAR>:1.exe <- Trojan.Hupigon.Dsx : No action

Scanned objects : 2

Infected objects : 1

显示全部楼层 · 发表于 2008-4-18 13:24:15

[Found backdoor] <W32/Hupigon.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\1.rar->1.exe

---------------------------------------------------------------------
Scan ended: 2008-4-18, 13:24:00
Duration: 0:00:00

Scan result:

Scanned files:    6
Infected objects:    1
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-4-18 13:34:57

Scanning Report
18 April 2008 13:34:43 - 13:34:43
Computer name: PUMA-PC
Scanning type: Scan target
Target: C:\Users\Administrator\Desktop\1.rar

--------------------------------------------------------------------------------

Result: 1 malware found
Backdoor.Win32.Hupigon.dsx (virus)
C:\Users\Administrator\Desktop\1.rar\1.exe

--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 2
Not scanned: 0
Result:
Viruses: 1
Spyware: 0
Suspicious items: 0
Riskware: 0
Actions:
Disinfected: 0
Renamed: 0
Deleted: 0
Quarantined: 0
Failed: 0
Boot Sectors:
Scanned: 0
Infected: 0
Suspicious items: 0
Disinfected: 0

--------------------------------------------------------------------------------

Options
Definitions version:
Viruses: 2008-04-18_01
Spyware: 2008-04-18_01
Scanning Engines:
F-Secure AVP: 7.00.171, 2008-04-18
F-Secure Libra: 2.04.04, 2008-04-15
F-Secure Orion: 1.02.38, 2008-04-18
F-Secure Draco: 1.00.35, 2008-04-02
Scanning options:
Scan all files
Scan inside archives
Actions:
Viruses: Quarantine and delete
Spyware: Quarantine and delete

显示全部楼层 · 发表于 2008-4-18 13:58:05

微点砍掉

[病毒样本] 红伞PASS(已经被杀)

本帖子中包含更多资源

IK

kv

本帖子中包含更多资源