小马一P

372826096

小马一P
无解压密码

[ 本帖最后由 372826096 于 2007-5-27 21:49 编辑 ]

金剑

风暴胜者V2 测试版本(http://www.v0day.com)
_________您的安全是我们的责任_______________
载入病毒库…进行整理…分配内存…可以使用
蜜罐检测:正常 OK!
===============================================
   ___________病毒查杀结果__________________

===============================================
2007年5月27日19时15分 开始查杀C:\Documents and Settings\root\桌面\新建文件夹\alg
=========================================
_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。

-----------------------------------------
2007年5月27日19时15分1秒收起线程…100% 查杀完毕！
扫描文件：1查杀病毒：0

[ 本帖最后由 金剑 于 2007-5-27 19:15 编辑 ]

tracydk

Starting the file scan:

Begin scan in 'F:\样本\alg.rar'
F:\样本\alg.rar
  [0] Archive type: RAR
  --> alg.exe
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Hupigon.Gen Backdoor server programs
      [INFO]      The file was deleted!

The EQs

Scan performed at: 2007-5-27 19:15:25
Scanning Log
NOD32 version 2292 (20070525) NT
Command line: C:\Documents and Settings\EQ2\桌面\alg.rar
Operating memory - is OK

Date: 27.5.2007  Time: 19:15:31
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\alg.rar
C:\Documents and Settings\EQ2\桌面\alg.rar ?RAR ?alg.exe - a variant of Win32/Hupigon trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 19:15:32 Total scanning time: 1 sec (00:00:01)

caocao

KIS 7
已经隔离: 病毒 Trojan.Generic (变种)        文件: D:\Downloads\alg.rar/alg.exe

372826096

KAV6.0没反映...........

fanrubin

我的卡7页没有反应

jlennon

欠妳緈諨

AVAST查到

jlennon

Processes:
PID        ParentPID        User        Path       
--------------------------------------------------
1384        1416        MSEOSJD88JED:Administrator        C:\program files\internet explorer\IEXPLORE.EXE       

Ports:
Port        PID        Type        Path       
--------------------------------------------------

Explorer Dlls:
DLL Path        Company Name        File Description       
--------------------------------------------------
No changes Found                       

IE Dlls:
DLL Path        Company Name        File Description       
--------------------------------------------------
No changes Found                       

Loaded Drivers:
Driver File        Company Name        Description       
--------------------------------------------------

Monitored RegKeys
Registry Key        Value       
--------------------------------------------------

Kernel31 Api Log
       
--------------------------------------------------
***** Installing Hooks *****       
71a270df     RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\WinSock2\Parameters)       
71a27cc4     RegOpenKeyExA (Protocol_Catalog9)       
71a2737e     RegOpenKeyExA (000000F3)       
71a2724d     RegOpenKeyExA (Catalog_Entries)       
71a278ea     RegOpenKeyExA (000000000001)       
71a278ea     RegOpenKeyExA (000000000002)       
71a278ea     RegOpenKeyExA (000000000003)       
71a278ea     RegOpenKeyExA (000000000004)       
71a278ea     RegOpenKeyExA (000000000005)       
71a278ea     RegOpenKeyExA (000000000006)       
71a278ea     RegOpenKeyExA (000000000007)       
71a278ea     RegOpenKeyExA (000000000008)       
71a278ea     RegOpenKeyExA (000000000009)       
71a278ea     RegOpenKeyExA (000000000010)       
71a278ea     RegOpenKeyExA (000000000011)       
71a278ea     RegOpenKeyExA (000000000012)       
71a278ea     RegOpenKeyExA (000000000013)       
71a22623     WaitForSingleObject(778,0)       
71a283c6     RegOpenKeyExA (NameSpace_Catalog5)       
71a2737e     RegOpenKeyExA (00000004)       
71a27f5b     RegOpenKeyExA (Catalog_Entries)       
71a280ef     RegOpenKeyExA (000000000001)       
71a280ef     RegOpenKeyExA (000000000002)       
71a280ef     RegOpenKeyExA (000000000003)       
71a22623     WaitForSingleObject(770,0)       
71a11afa     RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\Winsock2\Parameters)       
71a11996     GlobalAlloc()       
7c80b689     ExitThread()       
406b88     GetCommandLineA()       
40619b     RegOpenKeyExA (HKCU\Software\Borland\Locales)       
4061b9     RegOpenKeyExA (HKLM\Software\Borland\Locales)       
4061d7     RegOpenKeyExA (HKCU\Software\Borland\Delphi\Locales)       
40d3d7     GetVersionExA()       
4402f2     GetCurrentProcessId()=1416       
43ff3b     LoadLibraryA(imm32.dll)=76300000       
746826aa     GetVersionExA()       
746830a7     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\Compatibility\alg.exe)       
746830a7     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\SystemShared\)       
7468245b     CreateMutex(CTF.LBES.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7468245b     CreateMutex(CTF.Compart.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7468245b     CreateMutex(CTF.Asm.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7468245b     CreateMutex(CTF.Layouts.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7468245b     CreateMutex(CTF.TMD.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
746830a7     RegOpenKeyExA (HKCU\Keyboard Layout\Toggle)       
7468260a     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\)       
74684683     GetCurrentProcessId()=1416       
7468245b     CreateMutex(CTF.TimListCache.FMPDefaultS-1-5-21-1060284298-1214440339-682003330-500MUTEX.DefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7469d232     WaitForSingleObject(748,1388)       
746b556a     GetCurrentProcessId()=1416       
7c816513     WaitForSingleObject(740,64)       
73658f33     GetVersionExA()       
73665225     GetVersionExA()       
7365d4f4     LoadLibraryA(C:\windows\system32\ole32.dll)=76990000       
4522db     RegOpenKeyExA (HKLM\System\CurrentControlSet\Control\Keyboard Layouts\E0040804)       
457019     GetVersionExA()       
49b2da     LoadLibraryA(ntdll.dll)=7c920000       
49b48c     GetVersionExA()       
76f3147f     GetVersionExA()       
402dd9     CreateFileA(C:\Program Files\Common Files\Microsoft Shared\MSINFO\paramstr.txt)       
402d04     WriteFile(h=738)       
4094eb     CreateFileA(C:\Documents and Settings\Administrator\桌面\alg.exe)       
409535     ReadFile()       
489d5f     CreateProcessA((null),"C:\program files\internet explorer\IEXPLORE.EXE",0,(null))       
7c819154     LoadLibraryA(advapi32.dll)=77da0000       
10001e25     LoadLibraryA(psapi.dll)=76bc0000       
10001e66     GetCurrentProcessId()=1416       
76bc183b     ReadProcessMemory(h=700)       
76bc185a     ReadProcessMemory(h=700)       
76bc1878     ReadProcessMemory(h=700)       
76bc17bb     ReadProcessMemory(h=700)       
*****   Injecting C:\iDEFENSE\SysAnalyzer\api_log.dll into new process       
*****   OpenProcess Handle=700       
*****   Remote Allocation base: 140000       
*****   WriteProcessMemory=1 BufLen=23  BytesWritten:23       
*****   LoadLibraryA=7c801d77       
*****   CreateRemoteThread=6fc       
489dac     ReadProcessMemory(h=6f8)       
489c9a     LoadLibraryA(ntdll.dll)=7c920000       
489f34     WriteProcessMemory(h=6f8,len=4)       
489f50     WriteProcessMemory(h=6f8,len=bb000)       
404a5f     ExitProcess()       
74681d36     GetCurrentProcessId()=1416       
74682056     GetCurrentProcessId()=1416       
***** Injected Process Terminated *****       
7d5f6a01     GetCurrentProcessId()=1416       
71a22623     WaitForSingleObject(b8,0)       
71a22623     WaitForSingleObject(c0,0)       

DirwatchData
       
--------------------------------------------------
WatchDir Initilized OK       
Watching C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp       
Watching C:\windows       
Watching C:\Program Files       
Created: C:\Program Files\Common Files\Microsoft Shared\MSInfo\paramstr.txt       
Modifed: C:\Program Files\Common Files\Microsoft Shared\MSInfo\paramstr.txt       
Modifed: C:\Program Files\Common Files\Microsoft Shared\MSInfo       
Modifed: C:\windows\Prefetch\ALG.EXE-26CCD8D9.pf       
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET9AED.tmp       
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET13.tmp       
Deteled: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET13.tmp       
Modifed: C:\windows\Debug\UserMode\userenv.log       
Deteled: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET9AED.tmp       
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFF183.tmp       
Deteled: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFF183.tmp       
Modifed: C:\windows\Prefetch\PROC_ANALYZER.EXE-3974E660.pf       
Modifed: C:\windows\Prefetch\SNIFF_HIT.EXE-1AB02EA8.pf       
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFFBCD.tmp       
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFFBCD.tmp       
Deteled: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFFBCD.tmp