2x (Hupigon源自外挂）

显示全部楼层 · 发表于 2009-6-11 09:23:25

kaba miss，to killing！

Hello,

2.exe_, 3.exe_ - Backdoor.Win32.Hupigon.hbuh

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

avira all kill ！

[ 本帖最后由幸福的猪猪于 2009-6-11 14:22 编辑 ]

显示全部楼层 · 发表于 2009-6-11 09:36:22

卡巴不报

显示全部楼层 · 发表于 2009-6-11 10:00:44

显示全部楼层 · 发表于 2009-6-11 10:44:22

2.exe创建文件
C:\WINDOWS\system32\serverss
C:\WINDOWS\DELME.BAT
创建 inproc COM 服务
{00000000-0000-0000-0000-000000000000}
删除注册表值
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp\\NoRealMode

3.exe
创建文件C:\WINDOWS\Server.exe
写入注册表键值HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3bf41072-b2b1-21c1-b5c1-0305f4155515}\\StubPath

显示全部楼层 · 发表于 2009-6-11 10:45:17

微点杀毒kill

显示全部楼层 · 发表于 2009-6-11 10:49:01

前两个样本有问题

显示全部楼层 · 发表于 2009-6-11 12:03:23

等待楼主上报回信

显示全部楼层 · 发表于 2009-6-11 17:33:29

killl nod

显示全部楼层 · 发表于 2009-6-11 17:44:24

Starting the file scan:

Begin scan in 'C:\Users\Administrator\Desktop\2'
C:\Users\Administrator\Desktop\2\3.exe
[DETECTION] Contains a recognition pattern of the (harmful) BDS/Hupigon.Gen back-door program
[NOTE] The file was deleted!
C:\Users\Administrator\Desktop\2\2\2.exe
[DETECTION] Contains a recognition pattern of the (harmful) BDS/Hupigon.Gen back-door program
[NOTE] The file was deleted!

显示全部楼层 · 发表于 2009-6-11 22:49:44

McAfee 报了1个。。

[病毒样本] 2x (Hupigon源自外挂）

本帖子中包含更多资源

本帖子中包含更多资源