大家帮忙看看

欠妳緈諨

原帖由 EQ2 于 2007-6-21 00:22 发表
解压后报了鸽子。。。。。无语ing。。

AVAST直接扫描就报了鸽子

hunivic

Start of the scan: 2007年6月21日  02:03

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\123.rar'


End of the scan: 2007年6月21日  02:03
Used time: 00:03 min

The scan has been done completely.

      0 Scanning directories
      2 Files were scanned
      0 viruses and/or unwanted programs were found
      0 classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes
      0 Hidden objects were found
红伞没有报

taihuxian

Virus: Backdoor.Win32.Hupigon.cj

Virus found while downloading Web content.

Address: bbs.kafan.cn

a256886572008

運行521.exe，發現下列行為，被EQ-Secure RC2攔截！
-----------------
2007-06-21 06:46:33    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\123_2founder\123\520\521.exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-21 06:46:33    创建文件      操作:阻止
进程路径:D:\桌面\virus\123_2founder\123\520\521.exe
文件路径:C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp\2004703.bat
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.bat

---------------------------------
1.他會在C:\Documents and Settings\Hung  Jui Hung\Local Settings\Temp\產生
   2004703.bat

a256886572008

運行520.exe，發現下列行為，被EQ-Secure RC2攔截！
--------------------
2007-06-21 06:48:38    运行应用程序      操作:允许
进程路径:C:\windows\Explorer.EXE
文件路径:D:\桌面\virus\123_2founder\123\520\520\520.exe
规则:应用程序规则->系統程序->%windir%\Explorer.EXE


2007-06-21 06:48:38    创建文件      操作:阻止
进程路径:D:\桌面\virus\123_2founder\123\520\520\520.exe
文件路径:C:\windows\windowsXP.bat
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.bat


2007-06-21 06:48:38    创建文件      操作:阻止
进程路径:D:\桌面\virus\123_2founder\123\520\520\520.exe
文件路径:C:\windows\windowsXP.bat
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.bat


2007-06-21 06:48:39    创建文件      操作:阻止
进程路径:D:\桌面\virus\123_2founder\123\520\520\520.exe
文件路径:C:\windows\windowsXP.bat
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.bat


2007-06-21 06:48:39    修改注册表内容      操作:阻止
进程路径:C:\windows\system32\services.exe
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\windowsXP
注册表名称:[Key]
规则:所有程序规则->服務_普通模式->HKEY_LOCAL_MACHINE\SYSTEM\*controlset*\Services\*


2007-06-21 06:48:40    创建文件      操作:阻止
进程路径:D:\桌面\virus\123_2founder\123\520\520\520.exe
文件路径:C:\windows\uninstal.bat
规则:所有程序规则->全局設置_可執行文件1_普通模式->%SystemDrive%\*.bat

------------------------------------------
1.他會在C:\windows\產生
   windowsXP.bat
2.他會修改注册表内容
   HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\windowsXP
   [Key]
3.他會在C:\windows\產生
   uninstal.bat

红心王子

斧头kv直接报的鸽子
没的说砍

wangjay1980

detected: Trojan program Backdoor.Win32.Hupigon.cj        URL: http://bbs.kafan.cn/attachment.p ... cab/520.exe/520.exe

曲中求

红伞启发报，文件是自解压，释放在windows的temp目录下：一个520，一个521

[ 本帖最后由 曲中求 于 2007-6-21 11:58 编辑 ]

woai_jolin

2007/6/21 13:10:28        Scanning Log
2007/6/21 13:10:28        Version of virus signature database: 2342 (20070621)
2007/6/21 13:10:28        Date: 21.6.2007  Time: 13:10:28
2007/6/21 13:10:28        Scanned disks, folders and files: D:\病毒测试\
2007/6/21 13:10:40        D:\病毒测试\520.rar - a variant of Win32/Hupigon trojan - deleted
2007/6/21 13:10:40        D:\病毒测试\520.rar » RAR » 520.exe - a variant of Win32/Hupigon trojan
2007/6/21 13:10:40        Number of scanned files: 3
2007/6/21 13:10:40        Number of threats found: 1
2007/6/21 13:10:40        Time of completion: 13:10:40  Total scanning time: 12 sec (00:00:12)