聊天室公屏抓到的[MD5: 7E9D26]

显示全部楼层 · 发表于 2007-6-9 11:15:33

附麦咖啡规则阻挡情况：
E:\病毒包\mfdh.exe 用户定义的规则:禁止E盘病毒包的病毒发作
2007-6-8 21:07:37 1092 KKH\yy E:\病毒包\mfdh.exe C:\WINDOWS\Hacker.com.cn.exe 通用最大保护:禁止在 Windows 文件夹中创建新的可执行文件
2007-6-8 21:07:38 1092 KKH\yy E:\病毒包\mfdh.exe C:\WINDOWS\uninstal.bat 防病毒爆发控制:将所有共享项设为只读。

SSM模块警报见图

显示全部楼层 · 发表于 2007-6-9 11:17:11

费尔报了一个启发式

显示全部楼层 · 发表于 2007-6-9 11:18:12

detected: Trojan program Backdoor.Win32.Hupigon.cgp File: C:\Documents and Settings\Owner\×ÀÃæ\Ñù±¾.rar/mfdh.exe

显示全部楼层 · 发表于 2007-6-9 11:29:00

显示全部楼层 · 发表于 2007-6-9 11:34:01

从日志上看试图创建一个Hacker.com.cn.exe客户端（后门）和一个uninstal.bat批处理
应该可以看出不是什么好东东了

显示全部楼层 · 发表于 2007-6-9 11:41:42

鸽子

显示全部楼层 · 发表于 2007-6-9 11:44:14

BitDefender

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.

GenPack:Generic.Graybird.4D6516D7

显示全部楼层 · 发表于 2007-6-9 12:23:34

Start of the scan: 2007年6月9日  12:25

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\样本.rar'
C:\Documents and Settings\Administrator\桌面\样本.rar
  [0] Archive type: RAR
  --> mfdh.exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Graybird.GN.417792.1 Backdoor server programs

显示全部楼层 · 发表于 2007-6-9 12:49:27

Scan performed at: 2007-6-9 12:51:06
Scanning Log
NOD32 version 2320 (20070609) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.rar
Operating memory - is OK

Date: 9.6.2007 Time: 12:51:11
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.rar
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?mfdh.exe - a variant of Win32/Hupigon trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 12:51:13 Total scanning time: 2 sec (00:00:02)

显示全部楼层 · 发表于 2007-6-9 14:12:57

这个鸽子MS过了金山

[病毒样本] 聊天室公屏抓到的[MD5: 7E9D26]

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源