ceshi1.exe [MD5: 407E6A] [VirusTotal: 16/43 (37.2%)]

蝉鸣时

File: ceshi1.exe
MD5: 407E6A31D8EA7C42C794BAB56DABC958
VirusTotal: 16/43 (37.2%)　Click here to view the VirusTotal report

ESET NOD32 detected.
ceshi1.exe - a variant of Win32/TrojanDownloader.VB.OWR trojan

kxmp

to sucop

幸福的猪猪

检测到威胁: Trojan.BAT.Runner.ak        C:\Documents and Settings\*****\My Documents\ceshi1.exe/FSG/#       

卡巴斯基的特征码可以识别。               

zst470396853

卡巴  金山  数字都杀了  数字报QVM20

咆哮的蜗牛

nod

留侯

大蜘蛛MISS，已上报

hansyu

miss,to AVG

猪头大队

360网盾报毒
红伞Miss 上报，确认是毒，入库。

zdolo

QVM18

zuo

2010-12-11 19:07:13    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: C:\Program Files\F0D372DB329B4CB080027FF4F94.t
规则: [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*

2010-12-11 19:07:14    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: C:\Program Files\F0D372DB329B4CB080027FF4F94.exe
规则: [文件组]文件安全读写规则(询问创建) -> [文件]*\program files\*; *.exe

2010-12-11 19:07:15    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: C:\Program Files\F0D372DB329B4CB080027FF4F94.vbs
规则: [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*

2010-12-11 19:07:15    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: C:\Program Files\F0D372DB329B4CB080027FF4F94.bat
规则: [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*

2010-12-11 19:07:15    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: C:\Program Files\F0D372DB329B4CB080027FF4F94.s
规则: [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*

2010-12-11 19:07:15    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: C:\Program Files\F0D372DB329B4CB080027FF4F94.s
规则: [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*

2010-12-11 19:07:15    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cache

2010-12-11 19:07:16    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; Cookies

2010-12-11 19:07:17    修改注册表值    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History
值: C:\Documents and Settings\Administrator\Local Settings\History
规则: [注册表组]IE浏览器设置保护(询问) -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders; History

2010-12-11 19:07:18    从其他进程复制句柄    阻止
进程: c:\windows\system32\svchost.exe
目标: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
句柄: (Key) \REGISTRY\USER\S-1-5-21-57989841-842925246-854245398-500\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
规则: [应用程序]c:\windows\system32\svchost.exe

2010-12-11 19:07:18    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: TCP [本机 : 1384] ->  [202.102.110.204 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-11 19:07:18    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: TCP [本机 : 1385] ->  [216.45.51.221 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-11 19:07:20    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: TCP [本机 : 1386] ->  [204.188.243.34 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-11 19:07:20    访问网络    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: TCP [本机 : 1387] ->  [216.45.51.221 : 80 (http)]
规则: [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2010-12-11 19:07:22    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: C:\Program Files\F0D372DB329B4CB080027FF4F94.t
规则: [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*

2010-12-11 19:07:32    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: C:\Program Files\F0D372DB329B4CB080027FF4F94.t
规则: [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*

2010-12-11 19:07:42    创建文件    阻止
进程: c:\documents and settings\administrator\桌面\ceshi1\ceshi1.exe
目标: C:\Program Files\F0D372DB329B4CB080027FF4F94.t
规则: [文件组]系统文件夹写保护(阻止创建) -> [文件]*\program files; *.*