来自百度

显示全部楼层 · 发表于 2008-5-10 22:15:24

卡巴：Backdoor.Win32.Hupigon.blvx

显示全部楼层 · 发表于 2008-5-10 22:17:33

在 C:\Documents and Settings\Administrator\桌面\金山在线杀毒用户名及密码.rar->金山在线杀毒用户名及密码.CMD->SERVER~1.EXE 中发现 Trojan/PSW.OnLineGames.zow 病毒

显示全部楼层 · 发表于 2008-5-10 22:21:38

Win32:Trojan-gen {Other}

显示全部楼层 · 发表于 2008-5-10 22:35:43

[Scanning : C:\Documents and Settings\All Users\Documents\Test]

C:\Documents and Settings\All Users\Documents\Test\金山在线杀毒用户名及密码.rar<RAR>:金山在线杀毒用户名及密码.CMD<DLLRES>:CABINET0.cab<CAB>:SERVER~1.EXE <- Trojan.Hupigon.Blto : No action

Scanned objects : 6

Infected objects : 1

显示全部楼层 · 发表于 2008-5-10 22:36:07

[Found backdoor] <W32/Hupigon.A.gen!Eldorado (not disinfectable, generic)> C:\Documents and Settings\All Users\Documents\Test\金山在线杀毒用户名及密码.rar->金山在线杀毒用户名及密码.CMD->(CAB)->SERVER~1.EXE->(PE_Patch)

---------------------------------------------------------------------
Scan ended: 2008-5-10, 22:35:54
Duration: 0:00:00

Scan result:

Scanned files:    6
Infected objects:    1
Disinfected objects:    0
Quarantined files:    0
---------------------------------------
-------------
--------

显示全部楼层 · 发表于 2008-5-10 22:45:44

显示全部楼层 · 发表于 2008-5-10 23:19:17

金山 0

显示全部楼层 · 发表于 2008-5-11 00:11:00

上报紅傘

Suspicious Files and Miscellaneous Uploads

Thank you for your submission. Below you can see the current status of the uploaded files.

We received the following archive files:
File ID    Filename Size (Byte) Result
25015726    金山在线杀毒用户名及密码.rar...密码.rar 461.33 KB OK

A listing of files contained inside archives alongside their results can be found below:
File ID    Filename Size (Byte) Result
25015727    #################...##.CMD    489 KB    UNDER ANALYSIS

Please find a detailed report concerning each individual sample below:
Filename Result
#################...##.CMD    UNDER ANALYSIS

The file '########################.CMD' has been determined to be 'UNDER ANALYSIS'.
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

显示全部楼层 · 发表于 2008-5-11 01:02:41

antivir不支持的cab类型。。
Virus or unwanted program 'TR/Hijack.Explor.4485 [trojan]'
detected in file 'C:\Sandbox\morgan\DefaultBox\user\current\Local Settings\Temp\IXP000.TMP\SERVER~1.EXE.
Action performed: Delete file

[病毒样本] 来自百度

本帖子中包含更多资源

kv

ArcaVir2008

F-Prot 6.0.9.0

本帖子中包含更多资源