可疑文件

xiaoxmj

http://www.virustotal.com/file-s ... f9d034ad-1307081182

金山云鉴定安全

jayavira

to eset

Hello,

131745422_473754608_studentexchangeprogrames.exe_ - Trojan-Downloader.Win32.Agent.gpnj

以上文件包含恶意代码，下次更新后即可查杀。感谢您的上报。

-----------------
Best Regards, Bian Liang
Virus Analyst, Kaspersky Lab China.

wuyongliang

avast!  拦截

留侯

大蜘蛛clean。

沉默游侠

360网盾报毒

wqcaokeyinwq

微点KILL.......................

hddu

2011-06-03 15:14:30    运行应用程序      操作:允许
进程路径:F:\virus\student exchange programes\student exchange programes.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
命令行:--ch=1
触发规则:所有程序规则->其它程序设置->*\Temp\*


2011-06-03 15:14:44    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
命令行:--ch=1
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-06-03 15:14:53    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-06-03 15:14:55    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\Microsoft\*.exe


2011-06-03 15:14:55    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\C81E.F7E
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-06-03 15:14:55    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\C81E.F7E
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-06-03 15:14:55    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\C81E.F7E
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-06-03 15:15:01    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
命令行:startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-06-03 15:15:13    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
命令行:/I
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-06-03 15:15:14    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\explorer.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\31003.bat"
触发规则:所有程序规则->系统程序设置->%windir%\system32\cmd.exe


2011-06-03 15:15:22    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\E.exe
命令行:check
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-06-03 15:15:30    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
命令行:/I
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-06-03 15:15:31    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
文件路径:C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Application Policy Service
触发规则:所有程序规则->WINDOWS默认目录设置->%windir%\system32\config\*


2011-06-03 15:15:31    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns4.exe
文件路径:C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Application Policy Service
触发规则:所有程序规则->WINDOWS默认目录设置->%windir%\system32\config\*


2011-06-03 15:15:34    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\dwm.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2011-06-03 15:15:36    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
命令行:startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-06-03 15:15:50    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
命令行:startC:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\csrss.exe%C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-06-03 15:16:16    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\F.exe
命令行:check
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-06-03 15:16:29    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
命令行:startC:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\csrss.exe%C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-06-03 15:16:34    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-06-03 15:16:35    修改注册表内容      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
注册表名称:Load
更改后:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\csrss.exe
触发规则:所有程序规则->自动运行->*\Software\Microsoft\Windows nt\Currentversion\Windows


2011-06-03 15:16:50    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
命令行:startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-06-03 15:18:53    删除文件      操作:使用任务隔离区操作
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
文件路径:C:\Documents and Settings\Administrator\My Documents\My Pictures
触发规则:应用程序规则->%ProgramFiles%文件设置->%ProgramFiles%\*.exe->?:\Documents and Settings\*\My Documents\*


2011-06-03 15:19:03    删除文件      操作:阻止
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
文件路径:C:\Documents and Settings\All Users\「开始」菜单\程序\管理工具
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\*


2011-06-03 15:19:05    删除文件      操作:阻止
进程路径:C:\WINDOWS\system32\wbem\wmiprvse.exe
文件路径:C:\Documents and Settings\Administrator\「开始」菜单\程序\管理工具
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\*菜单\*


2011-06-03 15:19:34    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\ns8.exe
命令行:startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe


2011-06-03 15:19:51    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
文件路径:C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
命令行:startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
触发规则:应用程序规则->TEMP临时目录->*\Temp\*->*\Temp\*.exe

522586971

金山鉴定安全的一般都是木马

hddu

522586971 发表于 2011-6-3 15:33
金山鉴定安全的一般都是木马

打击力度好大啊。

绅博周幸

感谢您提交可疑文件，根据样本文件的复杂程度，鉴定大约需要 3—5 分钟 ，如果鉴定超时我们会将该样本提交到人工鉴定，人工鉴定需要较长时间(几个小时至1个工作日不等)。您可以通过上报号查询鉴定结果。






文件上报成功
上报号：13cd4d5bac6fb9ea9efc1a13d4e464cd



文件MD5：13cd4d5bac6fb9ea9efc1a13d4e464cd

鉴定结果：转人工鉴定，请几个小时后再来查询