这是什么东西，系统文件下的，avk报了病毒，红伞没报

ch00962610

当 正在打开 文件 "C:\WINDOWS\system32\1028\1.exe" 病毒 "Win32:KillApp-O [Trj]" 从引擎 "引擎 B" 被删除. 文件更改: 否. 文件删除: 否. 隔离区: 是.

[ 本帖最后由 ch00962610 于 2008-7-28 22:01 编辑 ]

wangjay1980

O

2008-7-28 JAY21:58:53 WinRAR 压缩文件管理器  Create C:\Documents and Settings\Owner\桌面\1.exe
2008-7-28 JAY22:02:14 1.exe  Placed in group Low Restricted
2008-7-28 JAY22:02:14 1.exe  Process start C:\Documents and Settings\Owner\桌面\1.exe
2008-7-28 JAY22:02:14 1.exe  Create C:\Documents and Settings\Owner\Favorites\烟桥社区-金山毒霸2008乐园.lnk
2008-7-28 JAY22:02:14 1.exe : KLSystemData/FD-C/ Create C:\Documents and Settings\Owner\Favorites\烟桥社区-金山毒霸2008乐园.lnk
2008-7-28 JAY22:02:14 1.exe Denied: KLSystemData/KLStartupRegKeys/Common Startup Modification hkey_users\S-1-5-21-1292428093-706699826-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2008-7-28 JAY22:02:14 1.exe Denied: KLSystemData/KLStartupRegKeys/Common Startup Modification hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
2008-7-28 JAY22:02:15 1.exe Denied: KLPrivateData/KLPrivateUserFiles/My documents2 Read C:\Documents and Settings\Owner\My Documents\desktop.ini
2008-7-28 JAY22:02:15 1.exe Denied: KLPrivateData/KLPrivateUserFiles/My documents2 Read C:\Documents and Settings\Owner\My Documents\desktop.ini
2008-7-28 JAY22:02:15 1.exe Denied: KLPrivateData/KLPrivateUserFiles/My documents2 Read C:\Documents and Settings\Owner\My Documents\desktop.ini
2008-7-28 JAY22:02:15 1.exe Denied: KLPrivateData/KLPrivateUserFiles/My documents2 Read C:\Documents and Settings\Owner\My Documents\My Pictures\desktop.ini
2008-7-28 JAY22:02:15 1.exe Denied: KLPrivateData/KLPrivateUserFiles/My documents2 Read C:\Documents and Settings\Owner\My Documents\My Pictures\desktop.ini
2008-7-28 JAY22:02:15 1.exe Denied: KLPrivateData/KLPrivateUserFiles/My documents2 Read C:\Documents and Settings\Owner\My Documents\My Pictures\desktop.ini
2008-7-28 JAY22:02:15 1.exe Denied: KLPrivateData/KLPrivateUserFiles/My documents2 Read C:\Documents and Settings\Owner\My Documents\desktop.ini
2008-7-28 JAY22:02:15 1.exe Denied: KLPrivateData/KLPrivateUserFiles/My documents2 Read C:\Documents and Settings\Owner\My Documents\desktop.ini
2008-7-28 JAY22:02:15 1.exe Denied: KLPrivateData/KLPrivateUserFiles/My documents2 Read C:\Documents and Settings\Owner\My Documents\desktop.ini
2008-7-28 JAY22:02:15 1.exe  Create C:\Documents and Settings\Owner\「开始」菜单\烟桥社区.lnk
2008-7-28 JAY22:02:15 1.exe : KLSystemData/FD-C/ Create C:\Documents and Settings\Owner\「开始」菜单\烟桥社区.lnk
2008-7-28 JAY22:02:15 1.exe  Create C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\烟桥社区-金山毒霸2008乐园.lnk
2008-7-28 JAY22:02:15 1.exe : KLSystemData/FD-C/ Create C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\烟桥社区-金山毒霸2008乐园.lnk
2008-7-28 JAY22:02:25 1.exe  Process exit C:\Documents and Settings\Owner\桌面\1.exe

[ 本帖最后由 wangjay1980 于 2008-7-28 22:04 编辑 ]

ch00962610

知道是什么吗，以前都没，今天无意间扫出来的，难道是病毒库升级后误报

tracydk

不是病毒，鉴定完毕

ch00962610

饿 好像是以前残留下来的东西

tracydk

又是avast引擎报的，avast误报。。。真是。。

64575509

AVP            
d:\工具\样本\1\1.exe.1        packed: PE_Patch.UPX
ERROR: delete wrong pointer (00000000)
d:\工具\样本\1\1.exe.1        packed: UPX
ERROR: delete wrong pointer (00000000)
d:\工具\样本\1\1.exe.1        archive: Embedded
d:\工具\样本\1\1.exe.1/script.au3        infected: Trojan.Win32.Favadd.bu