[可疑文件] 4X

显示全部楼层 · 发表于 2009-4-12 16:05:17

红伞在WINDOWS目录中掃出來的

都是可执行(PE)文件

Begin scan in 'C:\WINDOWS'
C:\WINDOWS\system32\tasklists.exe
   [DETECTION] Contains a recognition pattern of the (harmful) BDS/Hupigon.bswa back-door program
   [NOTE]    A backup was created as '4a549e92.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\WINDOWS\system32\drivers\kmwok.sys
   [DETECTION] Is the TR/Rootkit.Gen Trojan
   [NOTE]    A backup was created as '4a589ecb.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\WINDOWS\system32\drivers\sptd.sys
   [WARNING] The file could not be opened!
C:\WINDOWS\vnc\plugins\checkactive.xpn
   [DETECTION] Contains a recognition pattern of the (harmful) BDS/Graybird.OAL back-door program
   [NOTE]    A backup was created as '4a469f22.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\WINDOWS\vnc\plugins\crack_vnc.xpn
   [DETECTION] Contains recognition pattern of the SPR/Hacktool.81920.D program
   [NOTE]    A backup was created as '4a429f2c.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!

http://www.virustotal.com/zh-cn/analisis/545edf902c3b15cd38c74983b6925d6b
http://www.virustotal.com/zh-cn/analisis/80e0c2268410fa960c9062ff8fb2b03e
http://www.virustotal.com/zh-cn/analisis/fc91f43fb81a5e373a455b8152e5241c
http://www.virustotal.com/zh-cn/analisis/f541abe321a3e29e1de3947f1d9d8d50

[ 本帖最后由 lunglungyu 于 2009-4-12 16:09 编辑 ]

显示全部楼层 · 发表于 2009-4-12 16:09:25

D:\kafan\4X\tasklists.exe 已检测: Backdoor.Win32.Hupigon!IK
D:\kafan\4X\kmwok.sys 已检测: Trojan.Rootkit!IK
D:\kafan\4X\checkactive.xpn 已检测: Virus.Win32.Trojan!IK
D:\kafan\4X\crack_vnc.xpn 已检测: Trojan.Generic!IK

显示全部楼层 · 发表于 2009-4-12 16:09:30

DW
tasklists.exe - infected with Trojan.DownLoad.8806
TO3

显示全部楼层 · 发表于 2009-4-12 16:55:26

KV09 1 TO3

显示全部楼层 · 发表于 2009-4-12 19:51:26

2009/4/12 19:46:31 已删除木马程序 Backdoor.Win32.Hupigon.bswa G:\Temp\Virus\4X\4X\tasklists.exe
To KL

显示全部楼层 · 发表于 2009-4-12 19:54:26

文件或对象名称病毒名称最终处理状态
E:\My Documents\桌面\test\4X\4X\checkactive.xpn Application.Generic.5976 已移动至隔离区
E:\My Documents\桌面\test\4X\4X\tasklists.exe Backdoor.Hupigon.32739 已移动至隔离区
E:\My Documents\桌面\test\4X\4X\kmwok.sys Rootkit.4401 已移动至隔离区
E:\My Documents\桌面\test\4X\4X\crack_vnc.xpn Trojan.Generic.771025 已移动至隔离区

显示全部楼层 · 发表于 2009-4-12 20:12:12

McAfee 全灭。。

显示全部楼层 · 发表于 2009-4-12 20:14:52

js 0

显示全部楼层 · 发表于 2009-4-12 20:56:25

Hello,

checkactive.xpn,
crack_vnc.xpn,
kmwok.sys

No malicious code were found in these files.

Sincerely yours,
Mikhail Gorshenin,
Virus Analyst.
_____________________
Kaspersky Lab Ltd
Moscow, Russia

10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia
Tel./Fax: + 7 (495) 797 8700
http://www.kaspersky.com http://www.viruslist.com

显示全部楼层 · 发表于 2009-4-15 08:01:08

名称: Backdoor.Hupigon.EOPB
类型: Trojan

描述:

文件:
c:\users\administrator\desktop\4x\tasklists.exe

[可疑文件] 4X

本帖子中包含更多资源

BD