k8无视

IllusionWing

UG认识.

IllusionWing

Virustotal里报的还不少,.,,.....

AhnLab-V3	2008.6.26.0	2008.06.26	-
AntiVir	7.8.0.59	2008.06.27	-
Authentium	5.1.0.4	2008.06.27	W32/Nuj.A.gen!Eldorado
Avast	4.8.1195.0	2008.06.26	-
AVG	7.5.0.516	2008.06.26	-
BitDefender	7.2	2008.06.27	Trojan.Flystudio.AI
CAT-QuickHeal	9.50	2008.06.26	-
ClamAV	0.93.1	2008.06.27	Trojan.Dropper-2514
DrWeb	4.44.0.09170	2008.06.27	Trojan.MulDrop.8685
eSafe	7.0.17.0	2008.06.26	-
eTrust-Vet	31.6.5911	2008.06.27	-
Ewido	4.0	2008.06.26	-
F-Prot	4.4.4.56	2008.06.27	W32/Nuj.A.gen!Eldorado
F-Secure	7.60.13501.0	2008.06.26	-
Fortinet	3.14.0.0	2008.06.27	-
GData	2.0.7306.1023	2008.06.27	-
Ikarus	T3.1.1.26.0	2008.06.27	Trojan.Win32.Agent.ala
Kaspersky	7.0.0.125	2008.06.27	-
McAfee	5326	2008.06.26	-
Microsoft	1.3704	2008.06.27	Worm:Win32/Nuj.A
NOD32v2	3222	2008.06.26	-
Norman	5.80.02	2008.06.26	-
Panda	9.0.0.4	2008.06.26	-
Prevx1	V2	2008.06.27	-
Rising	20.50.41.00	2008.06.27	-
Sophos	4.30.0	2008.06.27	Troj/Dropr-K
Sunbelt	3.0.1176.1	2008.06.26	-
Symantec	10	2008.06.27	-
TheHacker	6.2.96.362	2008.06.27	-
TrendMicro	8.700.0.1004	2008.06.27	-
VBA32	3.12.6.8	2008.06.27	-
VirusBuster	4.5.11.0	2008.06.23	Worm.Nuj.LV
Webwasher-Gateway	6.6.2	2008.06.27	Win32.Malware.gen (suspicious)

[ 本帖最后由 gankeyu 于 2008-6-27 16:48 编辑 ]

欠妳緈諨

avast!扫描不报,运行后报Win32:Trojan-gen {Other}

电影结束了

物件: VitaClean.exe
        路徑: E:
        狀態: 已偵測病毒
        病毒: Trojan.Flystudio.AI (引擎 B)

Palkia

Rising 20.50.41.00 2008.06.27 -

aaad2008

avast!基因报

syfwxmh

to kl

yk1234

貌似有映像劫持、打开自动播放、关闭安全软件服务等行为。
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SfcDisable SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun \ autorun.inf windir \system32\_SYSTEM \Regedit.exe \System32\cmd.exe \System32\ntsd.exe MPMon.exe MPSvc2.exe MPSvc1.exe MPSvc.exe avp.exe avp.com SysCheck.exe RfwService.exe RfwMain.exe RavMonD.exe RavMon.exe CCenter.exe Rav.exe 360safe.exe fixtool.exe 修复工具.exe \System32\net.exe stop srservice \System32\sc.exe config srservice start=disabled \System32\net.exe stop KVWSC \System32\sc.exe config KVWSC start=disabled \System32\net.exe stop SharedAccess \System32\sc.exe config SharedAccess start=disabled \System32\net.exe stop KVSrvXP \System32\sc.exe config KVSrvXP start=disabled \System32\net.exe stop KavSvc \System32\sc.exe config KavSvc start=disabled \System32\net.exe stop RsRavMon \System32\sc.exe config RsRavMon start=disabled \System32\net.exe stop RsCCenter \System32\sc.exe config RsCCenter start=disabled \System32\sc.exe config AVP start=disabled \System32\sc.exe config RfwService start=disabled C:\ ntldr shellexcute AutoRun IceSword.exe Microsoft\Infested\ \system32\dllcache\       ?\Debugger SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ :\IceSword.exe

File ID          Filename          Size (Byte)         Result
25059162          VitaClean.ex          723.22 KB          UNDER ANALYSIS

The file 'VitaClean.ex' has been determined to be 'MALWARE'.
Our analysts named the threat TR/FlyStudio.AI.1587.The term "TR/" denotes a trojan horse that is able to spy out data, toviolate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.00.05.17.

[ 本帖最后由 yk1234 于 2008-6-27 22:22 编辑 ]

markrhy

红伞不报

wangjay1980

2008-6-27 JAY19:26:04 Process exit C:\Documents and Settings\Owner\桌面\VitaClean.exe  
2008-6-27 JAY19:26:04 Autorun  Denied: KLPrivileges/KLSelfStart
2008-6-27 JAY19:26:04 Process start C:\Documents and Settings\Owner\桌面\VitaClean.exe  
2008-6-27 JAY19:26:04 Placed in group Untrusted : Heur.Worm.Generic