`
caobihole
  • 浏览: 949033 次
文章分类
社区版块
存档分类
最新评论

遭遇beep.sys/Backdoor.Win32.Agent,DOVA/Backdoor.Win32.Hupigon,myRAT.rmvb/Trojan.Win32.Delf等2

 
阅读更多

遭遇beep.sys/Backdoor.Win32.Agent,DOVA/Backdoor.Win32.Hupigon,myRAT.rmvb/Trojan.Win32.Delf等2

endurer 原创 2008-06-22 第1

(继1)

http://purpleendurer.ys168.com 下载 FileInfo 和 bat_do。

用FileInfo 提取 pe_xscan 的 log 中红色标记的文件的信息;用 bat_do 打包备份,延时删除,改所选文件名,再延时删除。

下载并安装 瑞星卡卡安全助手,切换到[高级功能]->[系统启动项管理],

在左边点击[登录项],在右边找到 F2、O4 项对应的项目,右击,从弹出的菜单里选择删除。

在左边分别点击[服务项]和[驱动],找到 O23组的对应项, 右击,从弹出的菜单中选择删除。

另外检查发现

文件说明符 : c:/windows/system32/drivers/beep.sys 属性 : A--- 数字签名:否 PE文件:是 获取文件版本信息大小失败! 创建时间 : 2008-6-16 16:30:47 修改时间 : 2008-6-16 16:30:48 大小 : 2278 字节 2.230 KB MD5 : 57feb7a53fc0fc0d72460c79f6fe4a70 SHA1: 426C70291E57437C7F922055D6E9F780582CB6AD CRC32: b4f9768e

(卡巴斯基报为:Backdoor.Win32.Agent.krx[KLAB-5393973])

也用 bat_do处理了。

用WinRAR删除Windows临时文件夹,IE临时文件夹,c:/windows/prefetch 中可以删除的文件。

重启电脑~

这下电脑工作正常了。

附部分病毒文件信息:

文件 beep.sys 接收于 2008.06.17 11:48:14 (CET)

反病毒引擎 版本 最后更新 扫描结果
AhnLab-V3 2008.6.17.0 2008.06.17 -
AntiVir 7.8.0.55 2008.06.17 -
Authentium 5.1.0.4 2008.06.17 -
Avast 4.8.1195.0 2008.06.16 -
AVG 7.5.0.516 2008.06.16 Worm/Agent.N
BitDefender 7.2 2008.06.17 -
CAT-QuickHeal 9.50 2008.06.16 -
ClamAV 0.93.1 2008.06.17 -
DrWeb 4.44.0.09170 2008.06.17 -
eSafe 7.0.15.0 2008.06.16 -
eTrust-Vet 31.6.5881 2008.06.17 -
Ewido 4.0 2008.06.16 -
F-Prot 4.4.4.56 2008.06.12 -
F-Secure 7.60.13501.0 2008.06.17 -
Fortinet 3.14.0.0 2008.06.17 -
GData 2.0.7306.1023 2008.06.17 -
Ikarus T3.1.1.26.0 2008.06.17 -
Kaspersky 7.0.0.125 2008.06.17 -
McAfee 5318 2008.06.16 -
Microsoft 1.3604 2008.06.17 -
NOD32v2 3192 2008.06.17 -
Norman 5.80.02 2008.06.16 -
Panda 9.0.0.4 2008.06.16 -
Prevx1 V2 2008.06.17 -
Rising 20.49.11.00 2008.06.17 -
Sophos 4.30.0 2008.06.17 -
Sunbelt 3.0.1153.1 2008.06.15 -
Symantec 10 2008.06.17 -
TheHacker 6.2.92.352 2008.06.17 -
TrendMicro 8.700.0.1004 2008.06.17 -
VBA32 3.12.6.7 2008.06.17 -
VirusBuster 4.3.26:9 2008.06.12 -
Webwasher-Gateway 6.6.2 2008.06.17 -
附加信息
File size: 2278 bytes
MD5...: 57feb7a53fc0fc0d72460c79f6fe4a70
SHA1..: 426c70291e57437c7f922055d6e9f780582cb6ad
SHA256: 8f374788e5331a514bb7af41349fe2e41d1bf747c3cf6f8c0450f70d7700f62a
SHA512: 25496d47a6a7385e517575d4c82b3eaa6f477f5344c0db91d87ee55f0ccec035<BR>834f7cfd854405cdbe784847ffcd5c2c66e1fea2bb34d50bc8bbfef99ffa14da
PEiD..: -
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x102e6 timedatestamp.....: 0x4853ae23 (Sat Jun 14 11:40:19 2008) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x2a0 0x23c 0x240 5.84 738686680103bf7136d1d58d91449851 .rdata 0x4e0 0x94 0xa0 2.56 b3ae866fa0e297874aa7207a07840525 .data 0x580 0x18 0x20 0.00 70bc8f4b72a86921468bf8e8441dce51 INIT 0x5a0 0x144 0x160 4.44 5d072eceb6de4a7376bf9d6312676161 .reloc 0x700 0x58 0x60 3.47 d9b273eae760f0b360a5cdc940e91f18 ( 1 imports ) > ntoskrnl.exe: IoCreateSymbolicLink, IoCreateDevice, RtlInitUnicodeString, IofCompleteRequest, DbgPrint, IoDeleteDevice, IoDeleteSymbolicLink, KeServiceDescriptorTable, ProbeForWrite, ProbeForRead, _except_handler3 ( 0 exports )

文件说明符 : D:/test/myRAT.rmvb 属性 : -SH- 数字签名:否 PE文件:是 语言 : 中文(中国) 文件版本 : 1.0.0.500 说明 : 版权 : 备注 : 产品版本 : 1.0.0.0 产品名称 : 公司名称 : 合法商标 : 内部名称 : 源文件名 : 创建时间 : 2008-6-16 2:44:19 修改时间 : 2008-6-16 10:44:20 大小 : 135680 字节 132.512 KB MD5 : 2d12b069fe76521573f6c7335b5b4b3a SHA1: 4CCF4F2AE88DF6B28544AC5628EE5F87157EBB13 CRC32: 6a109c0d

卡巴斯基报为:Trojan-Downloader.Win32.Delf.jdo,瑞星报为:Trojan.Win32.Delf.fck

文件 myRAT.rmvb 接收于 2008.06.17 12:03:37 (CET)

反病毒引擎 版本 最后更新 扫描结果
AhnLab-V3 2008.6.17.0 2008.06.17 -
AntiVir 7.8.0.55 2008.06.17 BDS/Backdoor.Gen
Authentium 5.1.0.4 2008.06.17 W32/OnlineGames.A.gen!Eldorado
Avast 4.8.1195.0 2008.06.16 -
AVG 7.5.0.516 2008.06.16 -
BitDefender 7.2 2008.06.17 -
CAT-QuickHeal 9.50 2008.06.16 -
ClamAV 0.93.1 2008.06.17 -
DrWeb 4.44.0.09170 2008.06.17 BackDoor.Siggen.18
eSafe 7.0.15.0 2008.06.16 -
eTrust-Vet 31.6.5881 2008.06.17 -
Ewido 4.0 2008.06.16 -
F-Prot 4.4.4.56 2008.06.12 W32/OnlineGames.A.gen!Eldorado
F-Secure 7.60.13501.0 2008.06.17 -
Fortinet 3.14.0.0 2008.06.17 -
GData 2.0.7306.1023 2008.06.17 Trojan-Downloader.Win32.Delf.jdo
Ikarus T3.1.1.26.0 2008.06.17 Backdoor.Win32.Delf.RAN
Kaspersky 7.0.0.125 2008.06.17 Trojan-Downloader.Win32.Delf.jdo
McAfee 5318 2008.06.16 -
Microsoft 1.3604 2008.06.17 Backdoor:Win32/Delf.RAN
NOD32v2 3193 2008.06.17 -
Norman 5.80.02 2008.06.16 -
Panda 9.0.0.4 2008.06.16 Suspicious file
Prevx1 V2 2008.06.17 -
Rising 20.49.11.00 2008.06.17 Trojan.Win32.Delf.fck
Sophos 4.30.0 2008.06.17 Troj/Delf-FAH
Sunbelt 3.0.1153.1 2008.06.15 -
Symantec 10 2008.06.17 -
TheHacker 6.2.92.352 2008.06.17 -
TrendMicro 8.700.0.1004 2008.06.17 -
VBA32 3.12.6.7 2008.06.17 -
VirusBuster 4.3.26:9 2008.06.12 -
Webwasher-Gateway 6.6.2 2008.06.17 Trojan.Backdoor.Backdoor.Gen
附加信息
File size: 135680 bytes
MD5...: 2d12b069fe76521573f6c7335b5b4b3a
SHA1..: 4ccf4f2ae88df6b28544ac5628ee5f87157ebb13
SHA256: 48305730acf26f319facfa169e6eb8b07e1cdcb90e0cd34421e0f4d56422ff7b
SHA512: 44ef829d1fc28f1412ca9d4b675e31bb255f35c45bd7d1bddb91955988e57ef3<BR>9be30e2d2db3488f5fb7f306ea95dda97d67078c39a85edd1f22d6f1af9ee24c
PEiD..: -

PEInfo: PE Structure information

( base data ) entrypointaddress.: 0x41c1b4 timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992) machinetype.......: 0x14c (I386)

( 7 sections ) name viradd virsiz rawdsiz ntrpy md5<BR>CODE 0x1000 0x1b208 0x1b400 6.50 1300615699205731585424971640e87b<BR>DATA 0x1d000 0x20f0 0x2200 4.12 711df5be86fe3c18b34b3d17bd67f542<BR>BSS 0x20000 0x1ab5 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<BR>.idata 0x22000 0x1a20 0x1c00 4.74 b0c33623819f6d387b0ad873910e4b82 .edata 0x24000 0x87 0x200 1.54 e547a716c28ead40f0a419a6f25e807f<BR>.reloc 0x25000 0x15c8 0x1600 6.70 a65c4f4337ad0f54873701703a63ff27 .rsrc 0x27000 0x2d8 0x400 2.39 7495ebf8c9de446dfdcdbb598f5522af<BR><BR>( 22 imports ) <BR>&gt; kernel32.dll: DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, WideCharToMultiByte, MultiByteToWideChar, GetThreadLocale, GetStartupInfoA, GetLocaleInfoA, GetLastError, GetCommandLineA, FreeLibrary, CreateDirectoryA, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle user32.dll: GetKeyboardType, MessageBoxA advapi32.dll: RegQueryvalueExA, RegOpenKeyExA, RegCloseKey oleaut32.dll: SysFreeString, SysReAllocStringLen, SysAllocStringLen<BR>&gt; kernel32.dll: TlsSetvalue, TlsGetvalue, TlsFree, TlsAlloc, LocalFree, LocalAlloc advapi32.dll: SetSecurityDescriptorDacl, RevertToSelf, RegSetvalueExA, RegQueryvalueExA, RegQueryInfoKeyA, RegOpenKeyExA, RegEnumvalueA, RegEnumKeyExA, RegDeletevalueA, RegDeleteKeyA, RegCreateKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegevalueA, InitializeSecurityDescriptor, ImpersonateLoggedOnUser, GetUserNameA, DuplicateTokenEx, CreateProcessAsUserA, AdjustTokenPrivileges kernel32.dll: lstrlenA, lstrcpyW, lstrcpyA, lstrcmpiA, lstrcmpW, WriteFile, WinExec, WaitForSingleObject, UnmapViewOfFile, TerminateProcess, Sleep, SetThreadPriority, SetFileTime, SetFilePointer, SetFileAttributesW, SetFileAttributesA, SetEvent, SetErrorMode, ResumeThread, ReleaseMutex, ReadFile, QueryPerformanceFrequency, QueryPerformanceCounter, OpenProcess, OpenMutexA, MultiByteToWideChar, MoveFileExA, MoveFileA, MapViewOfFile, LocalFileTimeToFileTime, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalMemoryStatus, GlobalHandle, GlobalLock, GlobalFree, GlobalAlloc, GetWindowsDirectoryA, GetVolumeInformationA, GetVersionExA, GetVersion, GetTimeFormatW, GetTickCount, GetThreadPriority, GetTempPathA, GetSystemDirectoryA, GetSystemDefaultLangID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeThread, GetDriveTypeA, GetDiskFreeSpaceExA, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcess, GetComputerNameA, FreeLibrary, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, ExitThread, EnterCriticalSection, DosDateTimeToFileTime, DeleteFileW, DeleteFileA, DeleteCriticalSection, CreateThread, CreateProcessA, CreatePipe, CreateMutexA, CreateFileMappingW, CreateFileA, CreateEventA, CloseHandle gdi32.dll: SelectObject, GetSystemPaletteEntries, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBColorTable, DeleteObject, DeleteDC, CreatePalette, CreateHalftonePalette, CreateDIBSection, CreateCompatibleDC, BitBlt<BR>&gt; user32.dll: mouse_event, keybd_event, UnhookWindowsHookEx, TranslateMessage, ShowWindow, SetWindowsHookExA, SetCursorPos, SetClipboardData, SendMessageA, ReleaseDC, PostMessageA, PeekMessageA, OpenClipboard, OemToCharA, MsgWaitForMultipleObjects, MoveWindow, MessageBoxA, IsWindowVisible, GetWindowThreadProcessId, GetWindowTextLengthA, GetWindowTextW, GetWindowTextA, GetWindowRect, GetWindowLongA, GetSystemMetrics, GetProcessWindowStation, GetParent, GetMessageA, GetDesktopWindow, GetDC, GetCursorPos, GetClipboardData, GetClassNameA, ExitWindowsEx, EnumWindows, EmptyClipboard, DispatchMessageA, DestroyWindow, CloseWindow, CloseClipboard, CallNextHookEx kernel32.dll: Sleep shell32.dll: SHFileOperationA advapi32.dll: UnlockServiceDatabase, StartServiceA, SetServiceStatus, RegisterServiceCtrlHandlerA, QueryServiceStatus, QueryServiceConfigA, OpenServiceA, OpenSCManagerA, LockServiceDatabase, EnumServicesStatusA, DeleteService, CreateServiceA, ControlService, CloseServiceHandle, ChangeServiceConfigA<BR>&gt; wininet.dll: InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle URLMON.DLL: URLDownloadToFileA shell32.dll: SHGetSpecialFolderPathA imm32.dll: ImmReleaseContext, ImmGetCompositionStringW, ImmGetContext<BR>&gt; ws2_32.dll: WSAIoctl, WSACleanup, WSAStartup, WSAGetLastError, gethostbyname, socket, shutdown, setsockopt, send, select, recv, ntohs, ntohl, ioctlsocket, inet_ntoa, inet_addr, htons, htonl, connect, closesocket MSVFW32.DLL: ICSeqCompressFrame, ICSeqCompressFrameEnd, ICSeqCompressFrameStart, ICSendMessage, ICClose, ICOpen, ICInstall AVICAP32.dll: capCreateCaptureWindowA, capGetDriverDescriptionA<BR>&gt; Setupapi.dll: SetupDiClassNameFromGuidA, SetupDiDestroyDeviceInfoList, SetupDiGetDeviceRegistryPropertyA, SetupDiEnumDeviceInfo, SetupDiGetClassDevsA shell32.dll: ShellExecuteA wininet.dll: InternetGetConnectedStateEx

( 4 exports ) Install, InstallEx, ServerMain, ServiceMain

文件说明符 : D:/test/DOVA 属性 : -SHR 数字签名:否 PE文件:是 获取文件版本信息大小失败! 创建时间 : 2008-6-16 2:44:38 修改时间 : 2008-6-16 16:30:50 大小 : 231729 字节 226.305 KB MD5 : 76d5a93a77a4b266ce590864fe2cdae4 SHA1: E9E2694515A8D0BEF74E5D4094E49DB4DC46E297 CRC32: 3c8f8c39

卡巴斯基报为:Backdoor.Win32.Hupigon.clpz

文件 DOVA 接收于 2008.06.17 11:49:53 (CET)

反病毒引擎 版本 最后更新 扫描结果
AhnLab-V3 2008.6.17.0 2008.06.17 Win32/NSAnti.suspicious
AntiVir 7.8.0.55 2008.06.17 BDS/Backdoor.Gen
Authentium 5.1.0.4 2008.06.17 W32/Hupigon.A.gen!Eldorado
Avast 4.8.1195.0 2008.06.16 Win32:Hupigon-ZA
AVG 7.5.0.516 2008.06.16 Generic10.ANTC
BitDefender 7.2 2008.06.17 MemScan:Backdoor.Hupigon.ZUW
CAT-QuickHeal 9.50 2008.06.16 Win32.Packed.NSAnti.r
ClamAV 0.93.1 2008.06.17 -
DrWeb 4.44.0.09170 2008.06.17 BackDoor.Pigeon.2254
eSafe 7.0.15.0 2008.06.16 suspicious Trojan/Worm
eTrust-Vet 31.6.5881 2008.06.17 -
Ewido 4.0 2008.06.16 Backdoor.GrayBird.kx
F-Prot 4.4.4.56 2008.06.12 W32/Hupigon.A.gen!Eldorado
Fortinet 3.14.0.0 2008.06.17 -
GData 2.0.7306.1023 2008.06.17 Backdoor.Win32.Hupigon.clpz
Ikarus T3.1.1.26.0 2008.06.17 Packed.Win32.Klone.af
Kaspersky 7.0.0.125 2008.06.17 Backdoor.Win32.Hupigon.clpz
McAfee 5318 2008.06.16 -
Microsoft 1.3604 2008.06.17 VirTool:Win32/Obfuscator.A
NOD32v2 3193 2008.06.17 -
Norman 5.80.02 2008.06.16 W32/Suspicious_N.gen
Panda 9.0.0.4 2008.06.16 Suspicious file
Prevx1 V2 2008.06.17 Suspicious
Rising 20.49.11.00 2008.06.17 -
Sophos 4.30.0 2008.06.17 Sus/UnkPacker
Sunbelt 3.0.1153.1 2008.06.15 VIPRE.Suspicious
Symantec 10 2008.06.17 -
TheHacker 6.2.92.352 2008.06.17 -
TrendMicro 8.700.0.1004 2008.06.17 -
VBA32 3.12.6.7 2008.06.17 suspected of Backdoor.XiaoBird.1
VirusBuster 4.3.26:9 2008.06.12 Packed/NSPack
Webwasher-Gateway 6.6.2 2008.06.17 Trojan.Backdoor.Backdoor.Gen
附加信息
File size: 231729 bytes
MD5...: 76d5a93a77a4b266ce590864fe2cdae4
SHA1..: e9e2694515a8d0bef74e5d4094e49db4dc46e297
SHA256: 56002d8d72834e91189ac226b809be2968ddcd199edf74486b8baa527ae64c81
SHA512: 8f414f7d1f035e621db966d760dbba76ff18aeb895c62398e1368522094f45f5<BR>7161dfe25018fca5aff40e881adb66169511403d931220017f334e0e1b8ca80f
PEiD..: -
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x4df028 timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 0x1000 0xde000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e 0xdf000 0x39000 0x38531 8.00 15910b31c9cfb5449b6989cf64121b8e 0x118000 0x88a 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e ( 25 imports ) > KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess > USER32.DLL: GetKeyboardType > ADVAPI32.DLL: RegQueryvalueExA > OLEAUT32.DLL: SysFreeString > KERNEL32.DLL: TlsSetvalue > ADVAPI32.DLL: RegSetvalueExA > KERNEL32.DLL: lstrcpyA > MPR.DLL: WNetOpenEnumA > VERSION.DLL: VerQueryvalueA > GDI32.DLL: UnrealizeObject > USER32.DLL: CreateWindowExA > KERNEL32.DLL: Sleep > OLEAUT32.DLL: SafeArrayPtrOfIndex > COMCTL32.DLL: ImageList_SetIconSize > SHELL32.DLL: Shell_NotifyIconA > WININET.DLL: InternetReadFile > ADVAPI32.DLL: StartServiceA > WSOCK32.DLL: WSACleanup > IMAGEHLP.DLL: CheckSumMappedFile > WINMM.DLL: waveOutWrite > AVICAP32.DLL: capCreateCaptureWindowA > MSACM32.DLL: acmFormatChooseA > WS2_32.DLL: WSAIoctl > ADVAPI32.DLL: SetSecurityInfo > AVICAP32.DLL: capGetDriverDescriptionA ( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=E5A5604431A0EFF889FD0378A1F6E80097A6ED84
packers (Avast): NsPack, NsPack
packers (F-Prot): NSPack
packers (Authentium): NSPack
分享到:
评论

相关推荐

Global site tag (gtag.js) - Google Analytics