winlegon 样本

显示全部楼层 · 发表于 2009-3-10 09:50:54

http://www.virustotal.com/zh-cn/analisis/a6bfeefe8422a44c578b3eb123b1feca

反病毒引擎版本最后更新扫描结果
a-squared 4.0.0.101 2009.03.09 Backdoor.Win32.VB!IK
AhnLab-V3 5.0.0.2 2009.02.27 -
AntiVir 7.9.0.107 2009.03.09 TR/Dropper.Gen
Authentium 5.1.0.4 2009.03.09 W32/Heuristic-210!Eldorado
Avast 4.8.1335.0 2009.03.09 -
AVG 8.0.0.237 2009.03.09 Downloader.Generic8.AAET
BitDefender 7.2 2009.03.10 BehavesLike:Win32.Malware
CAT-QuickHeal 10.00 2009.03.09 (Suspicious) - DNAScan
ClamAV 0.94.1 2009.03.09 -
Comodo 1039 2009.03.09 -
DrWeb 4.44.0.09170 2009.03.10 -
eSafe 7.0.17.0 2009.03.09 Suspicious File
eTrust-Vet 31.6.6388 2009.03.09 -
F-Prot 4.4.4.56 2009.03.09 W32/Heuristic-210!Eldorado
F-Secure 8.0.14470.0 2009.03.09 Backdoor.Win32.VB.hxt
Fortinet 3.117.0.0 2009.03.09 -
GData 19 2009.03.10 -
Ikarus T3.1.1.45.0 2009.03.09 Backdoor.Win32.VB
K7AntiVirus 7.10.664 2009.03.09 -
Kaspersky 7.0.0.125 2009.03.09 Backdoor.Win32.VB.hxt
McAfee 5548 2009.03.09 -
McAfee+Artemis 5548 2009.03.09 -
Microsoft 1.4405 2009.03.09 -
NOD32 3922 2009.03.09 a variant of Win32/TrojanDownloader.VB.NUF
Norman 6.00.06 2009.03.09 Suspicious_F.gen
nProtect 2009.1.8.0 2009.03.09 -
Panda 10.0.0.10 2009.03.09 Suspicious file
PCTools 4.4.2.0 2009.03.09 Packed/FSG
Prevx1 V2 2009.03.10 -
Rising 21.20.02.00 2009.03.09 -
SecureWeb-Gateway 6.7.6 2009.03.09 Trojan.Dropper.Gen
Sophos 4.39.0 2009.03.09 Mal/EncPk-C
Sunbelt 3.2.1858.2 2009.03.09 VIPRE.Suspicious
Symantec 1.4.4.12 2009.03.10 Trojan Horse
TheHacker 6.3.3.0.277 2009.03.09 -
TrendMicro 8.700.0.1004 2009.03.09 PAK_Generic.002
VBA32 3.12.10.1 2009.03.09 -
ViRobot 2009.3.9.1641 2009.03.09 -
VirusBuster 4.5.11.0 2009.03.09 Packed/FSG

附加信息
File size: 47841 bytes
MD5...: dacc1a7d142890122e810767cdfe2f5a
SHA1..: a2b5655c807d76cad0a1aa36af5aa1df5fe8227f
SHA256: 4d144a92f8cad02250a7cbb58f1d1b0da336aaeff35cb97f1153c8c175d03f81
SHA512: 258eb980eb47e86083b534269ed3ff6c74292bd3ce27379aacbe781b421c0e1c c142ce7d3b995bea62a4aa2d80d3cb26b1d8aecf9c7b645c7755b57a8c21115a
ssdeep: 768:GEt1pF2IDa8ZpzU89BT1nB46s+djaFpFW9VaAgmloWp0rHeWwNH7z1J3f262 lvCa:BN1DzLzRz4D+djabChl4RwNH7xJ3f2dh 
PEiD..: FSG v2.0 -> bart/xt
TrID..: File type identification Win32 Executable Generic (67.9%) Generic Win/DOS Executable (15.9%) DOS Executable Generic (15.9%) Targa bitmap (Original TGA Format) (0.0%) MS Flight Simulator Aircraft Performance Info (0.0%)
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x154 timedatestamp.....: 0x21475346 (Fri Sep 11 01:35:02 1987) machinetype.......: 0x14c (I386) ( 2 sections ) name viradd virsiz rawdsiz ntrpy md5 0x1000 0x1f000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e 0x20000 0xc000 0xb8e1 7.85 47cf78da1e06a8ac7d617e910b465bee ( 1 imports ) > KERNEL32.dll: LoadLibraryA, GetProcAddress ( 0 exports ) 
packers (Authentium): FSG
CWSandbox info: <a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=dacc1a7d142890122e810767cdfe2f5a' target='_blank'>http://research.sunbelt-software ... e810767cdfe2f5a&;lt;/a>
packers (F-Prot): FSG
packers (Kaspersky): FSG

[ 本帖最后由孤独的我于 2009-3-10 09:52 编辑 ]

显示全部楼层 · 发表于 2009-3-10 09:56:47

微点杀一个：

程序：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WINLEGON\WINLEGON.EXE
木马程序生成以下文件：
1) C:\WINDOWS\SYSTEM32\WINLEGON.EXE
是否删除木马程序及其衍生物?

另一个没看出啥动作，运行后自动退出。

显示全部楼层 · 发表于 2009-3-10 10:02:18

卡巴检测到：木马程序 Backdoor.Win32.VB.hxt URL: http://bbs.kafan.cn/attachment.p ... //winlegon.exe//FSG

显示全部楼层 · 发表于 2009-3-10 10:02:19

VirSCAN.org Scanned Report :
Scanned time : 2009/03/10 09:52:32 (CST)
Scanner results: 全部的杀毒软件报告没有发现病毒!
File Name    : winlogon.exe
File Size    : 493056 byte
File Type    : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5          : 440eda2420cfa1b3b2ab4725fc33825d
SHA1          : e7f961947a0f03da2f883f17722ffc7c00031a3f
Online report  : http://virscan.org/report/5c1ddd5d493410fae1d89ce3d3571e09.html
Scanner       Engine Ver    Sig Ver          Sig Date Time Scan result
a-squared    4.0.0.32       20090309180419 2009-03-09  2.54 -
安博士V3    2009.03.09.02 2009.03.09       2009-03-09  1.49 -
AntiVir       7.9.0.107    7.1.2.142       2009-03-09  1.95 -
安天          2.0.18       20090309.2212869  2009-03-09  0.12 -
Authentium    5.1.1          200903092111    2009-03-09  1.14 -
AVAST!       3.0.1          090309-0       2009-03-09  0.03 -
AVG          7.5.52.442    270.11.9/1992    2009-03-09  1.96 -
BitDefender 7.81008.2773477 7.24083          2009-03-10  2.60 -
CA (VET)    9.0.0.143    31.6.6388       2009-03-10  5.39 -
ClamAV       0.94.2       9082             2009-03-10  0.10 -
Comodo       3.8          1039             2009-03-09  0.49 -
CP Secure    1.1.0.715    2009.03.09       2009-03-09  7.31 -
Dr.Web       4.44.0.9170    2009.03.10       2009-03-10  4.19 -
F-Prot       4.4.4.56       20090309       2009-03-09  1.11 -
F-Secure    5.51.6100    2009.03.09.07    2009-03-09  0.10 -
飞塔          2.81-3.117    10.138          2009-03-09  0.22 -
GData       19.3794/19.254  20090309       2009-03-09  4.28 -
ViRobot       20090309       2009.03.09       2009-03-09  0.40 -
Ikarus       T3.1.01.45    2009.03.09.72404  2009-03-09  4.05 -
江民杀毒    11.0.706       2009.03.09       2009-03-09  1.56 -
卡巴斯基    5.5.10       2009.03.09       2009-03-09  0.07 -
金山毒霸    2009.2.5.15    2009.3.9.20    2009-03-09  0.61 -
迈克菲       5.3.00       5548             2009-03-09  2.79 -
Microsoft    1.4405       2009.03.10       2009-03-10  5.43 -
mks_vir       2.01          2009.03.09       2009-03-09  2.72 -
Norman       6.00.06       6.00.00          2009-03-06  8.01 -
熊猫卫士    9.05.01       2009.03.09       2009-03-09  1.65 -
趋势科技    8.700-1004    5.886.12       2009-03-09  0.03 -
Quick Heal    10.00          2009.03.09       2009-03-09  1.05 -
瑞星          20.0          21.20.02.00    2009-03-09  0.85 -
Sophos       2.84.1       4.39             2009-03-10  2.04 -
Sunbelt       5032          5032             2009-03-09  0.61 -
赛门铁克    1.3.0.24       20090309.003    2009-03-09  0.06 -
nProtect    20090309.03    3298746          2009-03-09  3.93 -
The Hacker    6.3.2.7       v00277          2009-03-09  0.53 -
VBA32       3.12.10.1    20090309.1748    2009-03-09  1.94 -
VirusBuster 4.5.11.10    10.102.4/969634 2009-03-09  1.32 -

显示全部楼层 · 发表于 2009-3-10 10:02:22

前些日我的电脑也中了这种病毒，我手动把它删了，结果电脑出现蓝屏，系统启动不了

显示全部楼层 · 发表于 2009-3-10 10:14:04

Name: Packed/FSG
Type: Sequence

Description:

Files:
c:\users\administrator\desktop\winlegon.exe

Winlogon.exe这个应该是正常的系统文件

显示全部楼层 · 发表于 2009-3-10 10:17:19

费尔启发 Heuri.Suspicious.ERNM

显示全部楼层 · 发表于 2009-3-10 11:04:13

过咖啡8.7i

显示全部楼层 · 发表于 2009-3-10 12:33:38

Sophos:Mal/EncPk-C

显示全部楼层 · 发表于 2009-3-10 13:06:23

--> winlegon.exe
[DETECTION] Is the TR/Dropper.Gen Trojan
[NOTE] The file was moved to '4a23f59f.qua'!

[病毒样本] winlegon 样本

本帖子中包含更多资源