1x

幸福的猪猪

群里面某人发的一个链接，下载物说是瑞星升级保姆...kaba heur，to kill！

小红伞报灰鸽子……


Hello,


x.exe - Backdoor.Win32.Hupigon.gvyy

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.


[ 本帖最后由 幸福的猪猪 于 2009-5-20 16:30 编辑 ]

einnawy

nis报Suspicious.MH690.A

Beloved

2009-5-20 16:38:46    加载动态链接库    允许
进程: e:\virus\tddownload\tddownload\x.exe
目标: c:\windows\system32\oleaut32.dll
规则: [应用程序]*
2009-5-20 16:38:46    加载动态链接库    允许
进程: e:\virus\tddownload\tddownload\x.exe
目标: c:\windows\system32\mpr.dll
规则: [应用程序]*
2009-5-20 16:38:46    加载动态链接库    允许
进程: e:\virus\tddownload\tddownload\x.exe
目标: c:\windows\system32\version.dll
规则: [应用程序]*
2009-5-20 16:38:46    加载动态链接库    允许
进程: e:\virus\tddownload\tddownload\x.exe
目标: c:\windows\system32\comctl32.dll
规则: [应用程序]*
2009-5-20 16:38:47    加载动态链接库    允许
进程: e:\virus\tddownload\tddownload\x.exe
目标: c:\windows\system32\shell32.dll
规则: [应用程序]*
2009-5-20 16:38:47    加载动态链接库    允许
进程: e:\virus\tddownload\tddownload\x.exe
目标: c:\windows\system32\comctl32.dll
规则: [应用程序]*
2009-5-20 16:38:47    加载动态链接库    允许
进程: e:\virus\tddownload\tddownload\x.exe
目标: c:\windows\system32\wininet.dll
规则: [应用程序]*
2009-5-20 16:38:47    加载动态链接库    允许
进程: e:\virus\tddownload\tddownload\x.exe
目标: c:\windows\system32\wsock32.dll
规则: [应用程序]*
2009-5-20 16:38:47    加载动态链接库    允许
进程: e:\virus\tddownload\tddownload\x.exe
目标: c:\windows\system32\winmm.dll
规则: [应用程序]*
2009-5-20 16:38:47    加载动态链接库    允许
进程: e:\virus\tddownload\tddownload\x.exe
目标: c:\windows\system32\avicap32.dll
规则: [应用程序]*
2009-5-20 16:38:47    加载动态链接库    允许
进程: e:\virus\tddownload\tddownload\x.exe
目标: c:\windows\system32\msacm32.dll
规则: [应用程序]*
2009-5-20 16:38:47    加载动态链接库    允许
进程: e:\virus\tddownload\tddownload\x.exe
目标: c:\windows\system32\uxtheme.dll
规则: [应用程序]*
2009-5-20 16:38:47    加载动态链接库    允许
进程: e:\virus\tddownload\tddownload\x.exe
目标: c:\windows\system32\msctf.dll
规则: [应用程序]*
2009-5-20 16:38:47    加载动态链接库    允许
进程: e:\virus\tddownload\tddownload\x.exe
目标: c:\windows\system32\msctfime.ime
规则: [应用程序]*
2009-5-20 16:38:47    修改文件    阻止
进程: e:\virus\tddownload\tddownload\x.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件组]命名管道 -> [文件]\device\namedpipe\lsarpc
2009-5-20 16:38:47    修改文件    阻止
进程: e:\virus\tddownload\tddownload\x.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件组]命名管道 -> [文件]\device\namedpipe\lsarpc
2009-5-20 16:38:47    创建文件    阻止
进程: e:\virus\tddownload\tddownload\x.exe
目标: C:\WINDOWS\Hacker.com.cn.exe
规则: [文件组]文件阻止及保护 -> [文件]*; *.exe
2009-5-20 16:38:47    创建文件    阻止
进程: e:\virus\tddownload\tddownload\x.exe
目标: C:\WINDOWS\Hacker.com.cn.exe
规则: [文件组]文件阻止及保护 -> [文件]*; *.exe
2009-5-20 16:38:47    创建文件    阻止
进程: e:\virus\tddownload\tddownload\x.exe
目标: C:\WINDOWS\Hacker.com.cn.exe
规则: [文件组]文件阻止及保护 -> [文件]*; *.exe
2009-5-20 16:38:48    安装驱动程序或服务    阻止
进程: e:\virus\tddownload\tddownload\x.exe
目标: 系统漏洞修复工具
文件路径: C:\WINDOWS\Hacker.com.cn.exe
规则: [应用程序]*

[ 本帖最后由 ahu2422 于 2009-5-20 16:36 编辑 ]

linkak

IK:Backdoor.Win32.Hupigon

悠柚

Starting the file scan:

Begin scan in 'D:\TDDownload\TDDOWNLOAD.zip'
D:\TDDownload\TDDOWNLOAD.zip
  [0] Archive type: ZIP
    --> TDDOWNLOAD/x.exe
      [DETECTION] Contains a recognition pattern of the (harmful) BDS/Hupigon.Gen back-door program

Beginning disinfection:
D:\TDDownload\TDDOWNLOAD.zip
    [WARNING]   The file was ignored!


End of the scan: 2009年5月20日  17:00
Used time: 00:00 Minute(s)

The scan has been done completely.

      0 Scanned directories
      3 Files were scanned
      1 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      0 files were deleted
      0 Viruses and unwanted programs were repaired
      0 Files were moved to quarantine
      0 Files were renamed
      0 Files cannot be scanned
      2 Files not concerned

nosferatu

费尔：Heuri.Possible/Packed

250662772

而且是黑防的灰鸽子Hacker.com.cn

kingsheet

卡巴不报

JusT.Like

Last infection: bbs.kafan.cn
Infected with: Backdoor.Hupigon.AYPE

BING126

McAfee miss