遭遇beep.sys/Backdoor.Win32.Agent,DOVA/Backdoor.Win32.Hupigon,myRAT.rmvb/Trojan.Win32.Delf等2

遭遇beep.sys/Backdoor.Win32.Agent,DOVA/Backdoor.Win32.Hupigon,myRAT.rmvb/Trojan.Win32.Delf等2

endurer 原创 2008-06-22 第1

(继1)

http://purpleendurer.ys168.com 下载 FileInfo 和 bat_do。

用FileInfo 提取 pe_xscan 的 log 中红色标记的文件的信息;用 bat_do 打包备份,延时删除,改所选文件名,再延时删除。

下载并安装 瑞星卡卡安全助手,切换到[高级功能]->[系统启动项管理],

在左边点击[登录项],在右边找到 F2、O4 项对应的项目,右击,从弹出的菜单里选择删除。

在左边分别点击[服务项]和[驱动],找到 O23组的对应项, 右击,从弹出的菜单中选择删除。

另外检查发现

文件说明符 : c:/windows/system32/drivers/beep.sys 属性 : A--- 数字签名:否 PE文件:是 获取文件版本信息大小失败! 创建时间 : 2008-6-16 16:30:47 修改时间 : 2008-6-16 16:30:48 大小 : 2278 字节 2.230 KB MD5 : 57feb7a53fc0fc0d72460c79f6fe4a70 SHA1: 426C70291E57437C7F922055D6E9F780582CB6AD CRC32: b4f9768e

(卡巴斯基报为:Backdoor.Win32.Agent.krx[KLAB-5393973])

也用 bat_do处理了。

用WinRAR删除Windows临时文件夹,IE临时文件夹,c:/windows/prefetch 中可以删除的文件。

重启电脑~

这下电脑工作正常了。

附部分病毒文件信息:

文件 beep.sys 接收于 2008.06.17 11:48:14 (CET)

反病毒引擎版本最后更新扫描结果
AhnLab-V32008.6.17.02008.06.17-
AntiVir7.8.0.552008.06.17-
Authentium5.1.0.42008.06.17-
Avast4.8.1195.02008.06.16-
AVG7.5.0.5162008.06.16Worm/Agent.N
BitDefender7.22008.06.17-
CAT-QuickHeal9.502008.06.16-
ClamAV0.93.12008.06.17-
DrWeb4.44.0.091702008.06.17-
eSafe7.0.15.02008.06.16-
eTrust-Vet31.6.58812008.06.17-
Ewido4.02008.06.16-
F-Prot4.4.4.562008.06.12-
F-Secure7.60.13501.02008.06.17-
Fortinet3.14.0.02008.06.17-
GData2.0.7306.10232008.06.17-
IkarusT3.1.1.26.02008.06.17-
Kaspersky7.0.0.1252008.06.17-
McAfee53182008.06.16-
Microsoft1.36042008.06.17-
NOD32v231922008.06.17-
Norman5.80.022008.06.16-
Panda9.0.0.42008.06.16-
Prevx1V22008.06.17-
Rising20.49.11.002008.06.17-
Sophos4.30.02008.06.17-
Sunbelt3.0.1153.12008.06.15-
Symantec102008.06.17-
TheHacker6.2.92.3522008.06.17-
TrendMicro8.700.0.10042008.06.17-
VBA323.12.6.72008.06.17-
VirusBuster4.3.26:92008.06.12-
Webwasher-Gateway6.6.22008.06.17-
附加信息
File size: 2278 bytes
MD5...: 57feb7a53fc0fc0d72460c79f6fe4a70
SHA1..: 426c70291e57437c7f922055d6e9f780582cb6ad
SHA256: 8f374788e5331a514bb7af41349fe2e41d1bf747c3cf6f8c0450f70d7700f62a
SHA512: 25496d47a6a7385e517575d4c82b3eaa6f477f5344c0db91d87ee55f0ccec035<BR>834f7cfd854405cdbe784847ffcd5c2c66e1fea2bb34d50bc8bbfef99ffa14da
PEiD..: -
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x102e6 timedatestamp.....: 0x4853ae23 (Sat Jun 14 11:40:19 2008) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x2a0 0x23c 0x240 5.84 738686680103bf7136d1d58d91449851 .rdata 0x4e0 0x94 0xa0 2.56 b3ae866fa0e297874aa7207a07840525 .data 0x580 0x18 0x20 0.00 70bc8f4b72a86921468bf8e8441dce51 INIT 0x5a0 0x144 0x160 4.44 5d072eceb6de4a7376bf9d6312676161 .reloc 0x700 0x58 0x60 3.47 d9b273eae760f0b360a5cdc940e91f18 ( 1 imports ) > ntoskrnl.exe: IoCreateSymbolicLink, IoCreateDevice, RtlInitUnicodeString, IofCompleteRequest, DbgPrint, IoDeleteDevice, IoDeleteSymbolicLink, KeServiceDescriptorTable, ProbeForWrite, ProbeForRead, _except_handler3 ( 0 exports )

文件说明符 : D:/test/myRAT.rmvb 属性 : -SH- 数字签名:否 PE文件:是 语言 : 中文(中国) 文件版本 : 1.0.0.500 说明 : 版权 : 备注 : 产品版本 : 1.0.0.0 产品名称 : 公司名称 : 合法商标 : 内部名称 : 源文件名 : 创建时间 : 2008-6-16 2:44:19 修改时间 : 2008-6-16 10:44:20 大小 : 135680 字节 132.512 KB MD5 : 2d12b069fe76521573f6c7335b5b4b3a SHA1: 4CCF4F2AE88DF6B28544AC5628EE5F87157EBB13 CRC32: 6a109c0d

卡巴斯基报为:Trojan-Downloader.Win32.Delf.jdo,瑞星报为:Trojan.Win32.Delf.fck

文件 myRAT.rmvb 接收于 2008.06.17 12:03:37 (CET)

反病毒引擎版本最后更新扫描结果
AhnLab-V32008.6.17.02008.06.17-
AntiVir7.8.0.552008.06.17BDS/Backdoor.Gen
Authentium5.1.0.42008.06.17W32/OnlineGames.A.gen!Eldorado
Avast4.8.1195.02008.06.16-
AVG7.5.0.5162008.06.16-
BitDefender7.22008.06.17-
CAT-QuickHeal9.502008.06.16-
ClamAV0.93.12008.06.17-
DrWeb4.44.0.091702008.06.17BackDoor.Siggen.18
eSafe7.0.15.02008.06.16-
eTrust-Vet31.6.58812008.06.17-
Ewido4.02008.06.16-
F-Prot4.4.4.562008.06.12W32/OnlineGames.A.gen!Eldorado
F-Secure7.60.13501.02008.06.17-
Fortinet3.14.0.02008.06.17-
GData2.0.7306.10232008.06.17Trojan-Downloader.Win32.Delf.jdo
IkarusT3.1.1.26.02008.06.17Backdoor.Win32.Delf.RAN
Kaspersky7.0.0.1252008.06.17Trojan-Downloader.Win32.Delf.jdo
McAfee53182008.06.16-
Microsoft1.36042008.06.17Backdoor:Win32/Delf.RAN
NOD32v231932008.06.17-
Norman5.80.022008.06.16-
Panda9.0.0.42008.06.16Suspicious file
Prevx1V22008.06.17-
Rising20.49.11.002008.06.17Trojan.Win32.Delf.fck
Sophos4.30.02008.06.17Troj/Delf-FAH
Sunbelt3.0.1153.12008.06.15-
Symantec102008.06.17-
TheHacker6.2.92.3522008.06.17-
TrendMicro8.700.0.10042008.06.17-
VBA323.12.6.72008.06.17-
VirusBuster4.3.26:92008.06.12-
Webwasher-Gateway6.6.22008.06.17Trojan.Backdoor.Backdoor.Gen
附加信息
File size: 135680 bytes
MD5...: 2d12b069fe76521573f6c7335b5b4b3a
SHA1..: 4ccf4f2ae88df6b28544ac5628ee5f87157ebb13
SHA256: 48305730acf26f319facfa169e6eb8b07e1cdcb90e0cd34421e0f4d56422ff7b
SHA512: 44ef829d1fc28f1412ca9d4b675e31bb255f35c45bd7d1bddb91955988e57ef3<BR>9be30e2d2db3488f5fb7f306ea95dda97d67078c39a85edd1f22d6f1af9ee24c
PEiD..: -

PEInfo: PE Structure information

( base data ) entrypointaddress.: 0x41c1b4 timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992) machinetype.......: 0x14c (I386)

( 7 sections ) name viradd virsiz rawdsiz ntrpy md5<BR>CODE 0x1000 0x1b208 0x1b400 6.50 1300615699205731585424971640e87b<BR>DATA 0x1d000 0x20f0 0x2200 4.12 711df5be86fe3c18b34b3d17bd67f542<BR>BSS 0x20000 0x1ab5 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<BR>.idata 0x22000 0x1a20 0x1c00 4.74 b0c33623819f6d387b0ad873910e4b82 .edata 0x24000 0x87 0x200 1.54 e547a716c28ead40f0a419a6f25e807f<BR>.reloc 0x25000 0x15c8 0x1600 6.70 a65c4f4337ad0f54873701703a63ff27 .rsrc 0x27000 0x2d8 0x400 2.39 7495ebf8c9de446dfdcdbb598f5522af<BR><BR>( 22 imports ) <BR>&gt; kernel32.dll: DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, WideCharToMultiByte, MultiByteToWideChar, GetThreadLocale, GetStartupInfoA, GetLocaleInfoA, GetLastError, GetCommandLineA, FreeLibrary, CreateDirectoryA, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle user32.dll: GetKeyboardType, MessageBoxA advapi32.dll: RegQueryvalueExA, RegOpenKeyExA, RegCloseKey oleaut32.dll: SysFreeString, SysReAllocStringLen, SysAllocStringLen<BR>&gt; kernel32.dll: TlsSetvalue, TlsGetvalue, TlsFree, TlsAlloc, LocalFree, LocalAlloc advapi32.dll: SetSecurityDescriptorDacl, RevertToSelf, RegSetvalueExA, RegQueryvalueExA, RegQueryInfoKeyA, RegOpenKeyExA, RegEnumvalueA, RegEnumKeyExA, RegDeletevalueA, RegDeleteKeyA, RegCreateKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegevalueA, InitializeSecurityDescriptor, ImpersonateLoggedOnUser, GetUserNameA, DuplicateTokenEx, CreateProcessAsUserA, AdjustTokenPrivileges kernel32.dll: lstrlenA, lstrcpyW, lstrcpyA, lstrcmpiA, lstrcmpW, WriteFile, WinExec, WaitForSingleObject, UnmapViewOfFile, TerminateProcess, Sleep, SetThreadPriority, SetFileTime, SetFilePointer, SetFileAttributesW, SetFileAttributesA, SetEvent, SetErrorMode, ResumeThread, ReleaseMutex, ReadFile, QueryPerformanceFrequency, QueryPerformanceCounter, OpenProcess, OpenMutexA, MultiByteToWideChar, MoveFileExA, MoveFileA, MapViewOfFile, LocalFileTimeToFileTime, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalMemoryStatus, GlobalHandle, GlobalLock, GlobalFree, GlobalAlloc, GetWindowsDirectoryA, GetVolumeInformationA, GetVersionExA, GetVersion, GetTimeFormatW, GetTickCount, GetThreadPriority, GetTempPathA, GetSystemDirectoryA, GetSystemDefaultLangID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeThread, GetDriveTypeA, GetDiskFreeSpaceExA, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcess, GetComputerNameA, FreeLibrary, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, ExitThread, EnterCriticalSection, DosDateTimeToFileTime, DeleteFileW, DeleteFileA, DeleteCriticalSection, CreateThread, CreateProcessA, CreatePipe, CreateMutexA, CreateFileMappingW, CreateFileA, CreateEventA, CloseHandle gdi32.dll: SelectObject, GetSystemPaletteEntries, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBColorTable, DeleteObject, DeleteDC, CreatePalette, CreateHalftonePalette, CreateDIBSection, CreateCompatibleDC, BitBlt<BR>&gt; user32.dll: mouse_event, keybd_event, UnhookWindowsHookEx, TranslateMessage, ShowWindow, SetWindowsHookExA, SetCursorPos, SetClipboardData, SendMessageA, ReleaseDC, PostMessageA, PeekMessageA, OpenClipboard, OemToCharA, MsgWaitForMultipleObjects, MoveWindow, MessageBoxA, IsWindowVisible, GetWindowThreadProcessId, GetWindowTextLengthA, GetWindowTextW, GetWindowTextA, GetWindowRect, GetWindowLongA, GetSystemMetrics, GetProcessWindowStation, GetParent, GetMessageA, GetDesktopWindow, GetDC, GetCursorPos, GetClipboardData, GetClassNameA, ExitWindowsEx, EnumWindows, EmptyClipboard, DispatchMessageA, DestroyWindow, CloseWindow, CloseClipboard, CallNextHookEx kernel32.dll: Sleep shell32.dll: SHFileOperationA advapi32.dll: UnlockServiceDatabase, StartServiceA, SetServiceStatus, RegisterServiceCtrlHandlerA, QueryServiceStatus, QueryServiceConfigA, OpenServiceA, OpenSCManagerA, LockServiceDatabase, EnumServicesStatusA, DeleteService, CreateServiceA, ControlService, CloseServiceHandle, ChangeServiceConfigA<BR>&gt; wininet.dll: InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle URLMON.DLL: URLDownloadToFileA shell32.dll: SHGetSpecialFolderPathA imm32.dll: ImmReleaseContext, ImmGetCompositionStringW, ImmGetContext<BR>&gt; ws2_32.dll: WSAIoctl, WSACleanup, WSAStartup, WSAGetLastError, gethostbyname, socket, shutdown, setsockopt, send, select, recv, ntohs, ntohl, ioctlsocket, inet_ntoa, inet_addr, htons, htonl, connect, closesocket MSVFW32.DLL: ICSeqCompressFrame, ICSeqCompressFrameEnd, ICSeqCompressFrameStart, ICSendMessage, ICClose, ICOpen, ICInstall AVICAP32.dll: capCreateCaptureWindowA, capGetDriverDescriptionA<BR>&gt; Setupapi.dll: SetupDiClassNameFromGuidA, SetupDiDestroyDeviceInfoList, SetupDiGetDeviceRegistryPropertyA, SetupDiEnumDeviceInfo, SetupDiGetClassDevsA shell32.dll: ShellExecuteA wininet.dll: InternetGetConnectedStateEx

( 4 exports ) Install, InstallEx, ServerMain, ServiceMain

文件说明符 : D:/test/DOVA 属性 : -SHR 数字签名:否 PE文件:是 获取文件版本信息大小失败! 创建时间 : 2008-6-16 2:44:38 修改时间 : 2008-6-16 16:30:50 大小 : 231729 字节 226.305 KB MD5 : 76d5a93a77a4b266ce590864fe2cdae4 SHA1: E9E2694515A8D0BEF74E5D4094E49DB4DC46E297 CRC32: 3c8f8c39

卡巴斯基报为:Backdoor.Win32.Hupigon.clpz

文件 DOVA 接收于 2008.06.17 11:49:53 (CET)

反病毒引擎版本最后更新扫描结果
AhnLab-V32008.6.17.02008.06.17Win32/NSAnti.suspicious
AntiVir7.8.0.552008.06.17BDS/Backdoor.Gen
Authentium5.1.0.42008.06.17W32/Hupigon.A.gen!Eldorado
Avast4.8.1195.02008.06.16Win32:Hupigon-ZA
AVG7.5.0.5162008.06.16Generic10.ANTC
BitDefender7.22008.06.17MemScan:Backdoor.Hupigon.ZUW
CAT-QuickHeal9.502008.06.16Win32.Packed.NSAnti.r
ClamAV0.93.12008.06.17-
DrWeb4.44.0.091702008.06.17BackDoor.Pigeon.2254
eSafe7.0.15.02008.06.16suspicious Trojan/Worm
eTrust-Vet31.6.58812008.06.17-
Ewido4.02008.06.16Backdoor.GrayBird.kx
F-Prot4.4.4.562008.06.12W32/Hupigon.A.gen!Eldorado
Fortinet3.14.0.02008.06.17-
GData2.0.7306.10232008.06.17Backdoor.Win32.Hupigon.clpz
IkarusT3.1.1.26.02008.06.17Packed.Win32.Klone.af
Kaspersky7.0.0.1252008.06.17Backdoor.Win32.Hupigon.clpz
McAfee53182008.06.16-
Microsoft1.36042008.06.17VirTool:Win32/Obfuscator.A
NOD32v231932008.06.17-
Norman5.80.022008.06.16W32/Suspicious_N.gen
Panda9.0.0.42008.06.16Suspicious file
Prevx1V22008.06.17Suspicious
Rising20.49.11.002008.06.17-
Sophos4.30.02008.06.17Sus/UnkPacker
Sunbelt3.0.1153.12008.06.15VIPRE.Suspicious
Symantec102008.06.17-
TheHacker6.2.92.3522008.06.17-
TrendMicro8.700.0.10042008.06.17-
VBA323.12.6.72008.06.17suspected of Backdoor.XiaoBird.1
VirusBuster4.3.26:92008.06.12Packed/NSPack
Webwasher-Gateway6.6.22008.06.17Trojan.Backdoor.Backdoor.Gen
附加信息
File size: 231729 bytes
MD5...: 76d5a93a77a4b266ce590864fe2cdae4
SHA1..: e9e2694515a8d0bef74e5d4094e49db4dc46e297
SHA256: 56002d8d72834e91189ac226b809be2968ddcd199edf74486b8baa527ae64c81
SHA512: 8f414f7d1f035e621db966d760dbba76ff18aeb895c62398e1368522094f45f5<BR>7161dfe25018fca5aff40e881adb66169511403d931220017f334e0e1b8ca80f
PEiD..: -
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x4df028 timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 0x1000 0xde000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e 0xdf000 0x39000 0x38531 8.00 15910b31c9cfb5449b6989cf64121b8e 0x118000 0x88a 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e ( 25 imports ) > KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess > USER32.DLL: GetKeyboardType > ADVAPI32.DLL: RegQueryvalueExA > OLEAUT32.DLL: SysFreeString > KERNEL32.DLL: TlsSetvalue > ADVAPI32.DLL: RegSetvalueExA > KERNEL32.DLL: lstrcpyA > MPR.DLL: WNetOpenEnumA > VERSION.DLL: VerQueryvalueA > GDI32.DLL: UnrealizeObject > USER32.DLL: CreateWindowExA > KERNEL32.DLL: Sleep > OLEAUT32.DLL: SafeArrayPtrOfIndex > COMCTL32.DLL: ImageList_SetIconSize > SHELL32.DLL: Shell_NotifyIconA > WININET.DLL: InternetReadFile > ADVAPI32.DLL: StartServiceA > WSOCK32.DLL: WSACleanup > IMAGEHLP.DLL: CheckSumMappedFile > WINMM.DLL: waveOutWrite > AVICAP32.DLL: capCreateCaptureWindowA > MSACM32.DLL: acmFormatChooseA > WS2_32.DLL: WSAIoctl > ADVAPI32.DLL: SetSecurityInfo > AVICAP32.DLL: capGetDriverDescriptionA ( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=E5A5604431A0EFF889FD0378A1F6E80097A6ED84
packers (Avast): NsPack, NsPack
packers (F-Prot): NSPack
packers (Authentium): NSPack
  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值