4X

ghj89100062

hddu

2009-07-15 13:56:49    创建文件      操作:阻止并结束进程
进程路径:E:\4[1]\EntSver.exe
文件路径:C:\WINDOWS\EntSver.exe
触发规则:所有程序规则->WINDOWS文件夹设置->%windir%\*.exe


2009-07-15 13:56:49    创建文件      操作:阻止并结束进程
进程路径:E:\4[1]\EntSver.exe
文件路径:C:\WINDOWS\EntSver.exe
触发规则:所有程序规则->WINDOWS文件夹设置->%windir%\*.exe


2009-07-15 13:57:01    修改文件      操作:阻止并结束进程
进程路径:E:\4[1]\QQ炫舞双P反11外挂.exe
文件路径:C:\WINDOWS\System32\drivers\Beep.sys
触发规则:所有程序规则->WINDOWS文件夹设置->%WinDir%\system32\drivers\beep.sys


2009-07-15 13:57:04    创建文件      操作:阻止并结束进程
进程路径:E:\4[1]\Server_Setup.exe
文件路径:C:\WINDOWS\EntSver.exe
触发规则:所有程序规则->WINDOWS文件夹设置->%windir%\*.exe


2009-07-15 13:57:04    创建文件      操作:阻止并结束进程
进程路径:E:\4[1]\Server_Setup.exe
文件路径:C:\WINDOWS\EntSver.exe
触发规则:所有程序规则->WINDOWS文件夹设置->%windir%\*.exe


2009-07-15 13:57:06    进程间消息操作      操作:阻止并结束进程
进程路径:E:\4[1]\楠楠.EXE
目标进程:C:\Program Files\Filseclab\xfilter\xfilter.exe
消息类型:2730Ѐ
触发规则:应用程序规则->进程间消息操作 ->?:\*->%ProgramFiles%\Filseclab\*.exe


2009-07-15 13:57:06    进程间消息操作      操作:阻止并结束进程
进程路径:E:\4[1]\楠楠.EXE
目标进程:C:\Program Files\Filseclab\xfilter\xfilter.exe
消息类型:2730Ѐ
触发规则:应用程序规则->进程间消息操作 ->?:\*->%ProgramFiles%\Filseclab\*.exe

sam.to

15/7/2009 13:59:41        Detected: Backdoor.Win32.Hupigon.dkwt        C:\Documents and Settings\kato\桌面\4\QQ炫舞双P反11外挂.exe               
15/7/2009 13:59:41        Detected: Backdoor.Win32.Hupigon.blto        C:\Documents and Settings\kato\桌面\4\Server_Setup.exe               
15/7/2009 13:59:41        Detected: Backdoor.Win32.Hupigon.blto        C:\Documents and Settings\kato\桌面\4\EntSver.exe               
15/7/2009 14:00:22        Detected: Trojan-PSW.Win32.QQPass.cmk        C:\Documents and Settings\kato\桌面\4\楠楠.exe/NSPack/UPack/ASPack/PE_Patch.MaskPE

大師missed 2, 已上报

[ 本帖最后由 sam.to 于 2009-7-15 14:02 编辑 ]

kkgh

瑞星全杀

xyao

Server_Setup.exe - Win32/Hupigon.AXBR 特洛伊木马
楠楠.exe - Win32/PSW.QQPass.NDT 特洛伊木马
EntSver.exe - Win32/Hupigon.AXBR 特洛伊木马
QQ炫舞双P反11外挂.exe - Win32/Delf.NSN 特洛伊木马

黑衣~魂

DR.WEB清空

楠楠.exe - infected with Win32.HLLW.Autoruner.1891
\EntSver.exe - infected with BackDoor.Pigeon.11728
QQ炫舞双P反11外挂.exe - infected with BackDoor.Graybird.2091
\Server_Setup.exe - infected with BackDoor.Pigeon.11728

悠柚

Virus: Trojan.Packed.17770, Backdoor.Generic.179492, Backdoor.Hupigon.156164 (Engine A), Win32:Trojan-gen {Other} (3x), Win32:Hupigon-NMB [Trj] (Engine B)

Virus found while downloading Web content.

Address: bbs.kafan.cn

tun

Log is generated by AjLL.

< CA (Vet) >
        EntSver.exe --- Win32/Pigeon.AXZU
        楠楠.exe --- Win32/Pipown.OI
        QQ炫舞双P反11外挂.exe --- Win32/AMalum.QJK
        Server_Setup.exe --- Win32/Pigeon.AXZU

< ClamAV >
        EntSver.exe --- Trojan.Agent-15445
        楠楠.exe --- PUA.Packed.NPack-2
        QQ炫舞双P反11外挂.exe --- Trojan.Hupigon-19347
        Server_Setup.exe --- Trojan.Agent-15445

HC303

Begin scan in 'G:\virus\4'
G:\virus\4\EntSver.exe
    [DETECTION] Contains a recognition pattern of the (harmful) BDS/Hupigon.Gen back-door program
G:\virus\4\QQ炫舞双P反11外挂.exe
    [DETECTION] Is the TR/Spy.Gen Trojan
G:\virus\4\Server_Setup.exe
    [DETECTION] Contains a recognition pattern of the (harmful) BDS/Hupigon.Gen back-door program
G:\virus\4\楠楠.exe
    [DETECTION] Is the TR/PSW.QQpass.CMK.2 Trojan

zhoufish

avast清空