小红伞报的毒，是误报吗

wptyh73hm

以下是扫描报告，E文不懂，帮忙看看：
Avira AntiVir Personal
Report file date: 2009年1月24日  08:40
Scanning for 1272260 virus strains and unwanted programs.
Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    NEWS-FE11825189
Version information:
BUILD.DAT     : 8.2.0.337      16934 Bytes  2008-11-18 13:05:00
AVSCAN.EXE    : 8.1.4.10      315649 Bytes  2008-11-18 01:21:28
AVSCAN.DLL    : 8.1.4.0        40705 Bytes   2008-5-26 00:56:42
LUKE.DLL      : 8.1.4.5       164097 Bytes   2008-6-12 05:44:20
LUKERES.DLL   : 8.1.4.0        12033 Bytes   2008-5-26 00:58:54
ANTIVIR0.VDF  : 7.1.0.0     15603712 Bytes  2008-10-27 04:30:38
ANTIVIR1.VDF  : 7.1.1.113    2817536 Bytes   2009-1-14 00:06:20
ANTIVIR2.VDF  : 7.1.1.172     958464 Bytes   2009-1-23 00:06:26
ANTIVIR3.VDF  : 7.1.1.173       2048 Bytes   2009-1-23 00:06:28
Engineversion : 8.2.0.60  
AEVDF.DLL     : 8.1.0.6       102772 Bytes  2008-10-14 03:05:58
AESCRIPT.DLL  : 8.1.1.32      340347 Bytes   2009-1-24 00:06:48
AESCN.DLL     : 8.1.1.5       123251 Bytes   2008-11-7 08:06:42
AERDL.DLL     : 8.1.1.3       438645 Bytes   2008-11-4 06:58:40
AEPACK.DLL    : 8.1.3.5       393588 Bytes   2009-1-24 00:06:46
AEOFFICE.DLL  : 8.1.0.33      196987 Bytes   2009-1-24 00:06:42
AEHEUR.DLL    : 8.1.0.86     1552759 Bytes   2009-1-24 00:06:40
AEHELP.DLL    : 8.1.2.0       119159 Bytes   2009-1-24 00:06:36
AEGEN.DLL     : 8.1.1.10      323957 Bytes   2009-1-24 00:06:34
AEEMU.DLL     : 8.1.0.9       393588 Bytes  2008-10-14 03:05:58
AECORE.DLL    : 8.1.5.2       172405 Bytes   2009-1-24 00:06:32
AEBB.DLL      : 8.1.0.3        53618 Bytes  2008-10-14 03:05:58
AVWINLL.DLL   : 1.0.0.12       15105 Bytes    2008-7-9 01:40:06
AVPREF.DLL    : 8.0.2.0        38657 Bytes   2008-5-16 02:28:02
AVREP.DLL     : 8.0.0.2        98344 Bytes   2008-7-31 05:02:16
AVREG.DLL     : 8.0.0.1        33537 Bytes    2008-5-9 04:26:42
AVARKT.DLL    : 1.0.0.23      307457 Bytes   2008-2-12 01:29:24
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes   2008-6-12 05:27:50
SQLITE3.DLL   : 3.3.17.1      339968 Bytes   2008-1-22 10:28:04
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes   2008-6-12 05:49:42
NETNT.DLL     : 8.0.0.1         7937 Bytes   2008-1-25 05:05:12
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes   2008-6-12 06:48:08
RCTEXT.DLL    : 8.0.52.0       86273 Bytes   2008-6-27 06:34:38
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: repair
Secondary action.................: quarantine
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, E:, F:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: high
Skipped files....................: C:\Program Files\Alwil Software\Avast4, C:\Program Files\Micropoint, C:\WINDOWS\temp\_avast4_,
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,
Start of the scan: 2009年1月24日  08:40
Starting search for hidden objects.
'52077' objects were checked, '0' hidden objects were found.
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process '360SE.EXE' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ashWebSv.exe' - '1' Module(s) have been scanned
Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'SbieSvc.exe' - '1' Module(s) have been scanned
Scan process 'CTFMON.EXE' - '1' Module(s) have been scanned
Scan process '360Tray.exe' - '0' Module(s) have been scanned
Scan process 'safeboxTray.exe' - '0' Module(s) have been scanned
Scan process 'ashDisp.exe' - '1' Module(s) have been scanned
Scan process 'MPMon.exe' - '0' Module(s) have been scanned
Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned
Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'aswUpdSv.exe' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'MPSVC1.EXE' - '0' Module(s) have been scanned
Scan process 'MPSVC2.EXE' - '0' Module(s) have been scanned
Scan process 'MPSVC.EXE' - '0' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'LSASS.EXE' - '1' Module(s) have been scanned
Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned
Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned
Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned
Scan process 'SMSS.EXE' - '1' Module(s) have been scanned
27 processes with 27 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
    [INFO]      No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
    [INFO]      No virus was found!
Boot sector 'D:\'
    [INFO]      No virus was found!
Boot sector 'E:\'
    [INFO]      No virus was found!
Boot sector 'F:\'
    [INFO]      No virus was found!
Starting to scan the registry.
The registry was scanned ( '45' files ).

Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!
The directory 'C:\WINDOWS\temp\_avast4_\' was excluded from scanning!
C:\Program Files\soft\ie7\自动安装.exe
Avira AntiVir Personal
Report file date: 2009年1月24日  08:40
Scanning for 1272260 virus strains and unwanted programs.
Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    NEWS-FE11825189
Version information:
BUILD.DAT     : 8.2.0.337      16934 Bytes  2008-11-18 13:05:00
AVSCAN.EXE    : 8.1.4.10      315649 Bytes  2008-11-18 01:21:28
AVSCAN.DLL    : 8.1.4.0        40705 Bytes   2008-5-26 00:56:42
LUKE.DLL      : 8.1.4.5       164097 Bytes   2008-6-12 05:44:20
LUKERES.DLL   : 8.1.4.0        12033 Bytes   2008-5-26 00:58:54
ANTIVIR0.VDF  : 7.1.0.0     15603712 Bytes  2008-10-27 04:30:38
ANTIVIR1.VDF  : 7.1.1.113    2817536 Bytes   2009-1-14 00:06:20
ANTIVIR2.VDF  : 7.1.1.172     958464 Bytes   2009-1-23 00:06:26
ANTIVIR3.VDF  : 7.1.1.173       2048 Bytes   2009-1-23 00:06:28
Engineversion : 8.2.0.60  
AEVDF.DLL     : 8.1.0.6       102772 Bytes  2008-10-14 03:05:58
AESCRIPT.DLL  : 8.1.1.32      340347 Bytes   2009-1-24 00:06:48
AESCN.DLL     : 8.1.1.5       123251 Bytes   2008-11-7 08:06:42
AERDL.DLL     : 8.1.1.3       438645 Bytes   2008-11-4 06:58:40
AEPACK.DLL    : 8.1.3.5       393588 Bytes   2009-1-24 00:06:46
AEOFFICE.DLL  : 8.1.0.33      196987 Bytes   2009-1-24 00:06:42
AEHEUR.DLL    : 8.1.0.86     1552759 Bytes   2009-1-24 00:06:40
AEHELP.DLL    : 8.1.2.0       119159 Bytes   2009-1-24 00:06:36
AEGEN.DLL     : 8.1.1.10      323957 Bytes   2009-1-24 00:06:34
AEEMU.DLL     : 8.1.0.9       393588 Bytes  2008-10-14 03:05:58
AECORE.DLL    : 8.1.5.2       172405 Bytes   2009-1-24 00:06:32
AEBB.DLL      : 8.1.0.3        53618 Bytes  2008-10-14 03:05:58
AVWINLL.DLL   : 1.0.0.12       15105 Bytes    2008-7-9 01:40:06
AVPREF.DLL    : 8.0.2.0        38657 Bytes   2008-5-16 02:28:02
AVREP.DLL     : 8.0.0.2        98344 Bytes   2008-7-31 05:02:16
AVREG.DLL     : 8.0.0.1        33537 Bytes    2008-5-9 04:26:42
AVARKT.DLL    : 1.0.0.23      307457 Bytes   2008-2-12 01:29:24
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes   2008-6-12 05:27:50
SQLITE3.DLL   : 3.3.17.1      339968 Bytes   2008-1-22 10:28:04
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes   2008-6-12 05:49:42
NETNT.DLL     : 8.0.0.1         7937 Bytes   2008-1-25 05:05:12
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes   2008-6-12 06:48:08
RCTEXT.DLL    : 8.0.52.0       86273 Bytes   2008-6-27 06:34:38
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: repair
Secondary action.................: quarantine
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, E:, F:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: high
Skipped files....................: C:\Program Files\Alwil Software\Avast4, C:\Program Files\Micropoint, C:\WINDOWS\temp\_avast4_,
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,
Start of the scan: 2009年1月24日  08:40
Starting search for hidden objects.
'52077' objects were checked, '0' hidden objects were found.
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process '360SE.EXE' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ashWebSv.exe' - '1' Module(s) have been scanned
Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'SbieSvc.exe' - '1' Module(s) have been scanned
Scan process 'CTFMON.EXE' - '1' Module(s) have been scanned
Scan process '360Tray.exe' - '0' Module(s) have been scanned
Scan process 'safeboxTray.exe' - '0' Module(s) have been scanned
Scan process 'ashDisp.exe' - '1' Module(s) have been scanned
Scan process 'MPMon.exe' - '0' Module(s) have been scanned
Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned
Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'aswUpdSv.exe' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'MPSVC1.EXE' - '0' Module(s) have been scanned
Scan process 'MPSVC2.EXE' - '0' Module(s) have been scanned
Scan process 'MPSVC.EXE' - '0' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'LSASS.EXE' - '1' Module(s) have been scanned
Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned
Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned
Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned
Scan process 'SMSS.EXE' - '1' Module(s) have been scanned
27 processes with 27 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
    [INFO]      No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
    [INFO]      No virus was found!
Boot sector 'D:\'
    [INFO]      No virus was found!
Boot sector 'E:\'
    [INFO]      No virus was found!
Boot sector 'F:\'
    [INFO]      No virus was found!
Starting to scan the registry.
The registry was scanned ( '45' files ).

Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!
The directory 'C:\WINDOWS\temp\_avast4_\' was excluded from scanning!
C:\Program Files\soft\ie7\自动安装.exe
    [DETECTION] Is the TR/Agent.323825.A Trojan
    [NOTE]      The file was moved to 'a503bc7f.qua'!
C:\Program Files\soft\ie7\手动安装.exe
    [DETECTION] Is the TR/Agent.323825.A Trojan
    [NOTE]      The file was moved to 'a503bc80.qua'!
The directory 'C:\Program Files\Micropoint\' was excluded from scanning!
The directory 'C:\Program Files\Alwil Software\Avast4\' was excluded from scanning!
C:\Downloads\Setup_1.27_Beta2.exe
    [0] Archive type: RAR SFX (self extracting)
    --> Setup.exe
      [DETECTION] Is the TR/Agent.892416.A Trojan
    [NOTE]      The file was moved to '49ee6a6a.qua'!
Begin scan in 'D:\' <DISK1_VOL2>
Begin scan in 'E:\' <DISK1_VOL3>
E:\FengYun\Setup.exe
    [DETECTION] Is the TR/Agent.892416.A Trojan
    [NOTE]      The file was moved to '49ee6aee.qua'!
Begin scan in 'F:\' <DISK1_VOL4>

End of the scan: 2009年1月24日  09:10
Used time: 30:41 Minute(s)
The scan has been done completely.
   1969 Scanning directories
  62145 Files were scanned
      4 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      4 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
  62140 Files not concerned
    215 Archives were scanned
      1 Warnings
      4 Notes
  52077 Objects were scanned with rootkit scan
      0 Hidden objects were found

    [DETECTION] Is the TR/Agent.323825.A Trojan
    [NOTE]      The file was moved to 'a503bc7f.qua'!
C:\Program Files\soft\ie7\手动安装.exe
    [DETECTION] Is the TR/Agent.323825.A Trojan
    [NOTE]      The file was moved to 'a503bc80.qua'!
The directory 'C:\Program Files\Micropoint\' was excluded from scanning!
The directory 'C:\Program Files\Alwil Software\Avast4\' was excluded from scanning!
C:\Downloads\Setup_1.27_Beta2.exe
    [0] Archive type: RAR SFX (self extracting)
    --> Setup.exe
      [DETECTION] Is the TR/Agent.892416.A Trojan
    [NOTE]      The file was moved to '49ee6a6a.qua'!
Begin scan in 'D:\' <DISK1_VOL2>
Begin scan in 'E:\' <DISK1_VOL3>
E:\FengYun\Setup.exe
    [DETECTION] Is the TR/Agent.892416.A Trojan
    [NOTE]      The file was moved to '49ee6aee.qua'!
Begin scan in 'F:\' <DISK1_VOL4>

End of the scan: 2009年1月24日  09:10
Used time: 30:41 Minute(s)
The scan has been done completely.
   1969 Scanning directories
  62145 Files were scanned
      4 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      4 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
  62140 Files not concerned
    215 Archives were scanned
      1 Warnings
      4 Notes
  52077 Objects were scanned with rootkit scan
      0 Hidden objects were found

will

楼主把相关文件都传到样本区看看吧  
偶们都不会文件名查杀…

dd2006

这个自动安装.exe和手动安装.exe不知道什么，红伞认是间谍软件，楼主最好上传样本，估计是误报可能性大。
Setup_1.27_Beta2.exe难道是风云防火墙？

dd2006

C:\Downloads\Setup_1.27_Beta2.exe
和
E:\FengYun\Setup.exe
这两个是误报，是风云防火墙的文件
刚从官方下载的，风云1.27 Beta2.

lomo

4 viruses and/or unwanted programs were found

C:\Program Files\soft\ie7\自动安装.exe
    [DETECTION] Is the TR/Agent.323825.A Trojan
    [NOTE]      The file was moved to 'a503bc7f.qua'!

C:\Program Files\soft\ie7\手动安装.exe
    [DETECTION] Is the TR/Agent.323825.A Trojan
    [NOTE]      The file was moved to 'a503bc80.qua'!

C:\Downloads\Setup_1.27_Beta2.exe
    [0] Archive type: RAR SFX (self extracting)
    --> Setup.exe
      [DETECTION] Is the TR/Agent.892416.A Trojan
    [NOTE]      The file was moved to '49ee6a6a.qua'!

E:\FengYun\Setup.exe
    [DETECTION] Is the TR/Agent.892416.A Trojan
    [NOTE]      The file was moved to '49ee6aee.qua'!

1、2有可能是木马
3、4应该是误报风云防火墙（建议从官网下载风云，并将误报的文件上传小红伞分析。）

[ 本帖最后由 lomo 于 2009-1-24 10:26 编辑 ]

wptyh73hm

已上报。风云是从官网下的，但我`看了一下论坛，今天小红伞对风云都报毒了，应该是误报。另两个都存在N久了，以前从没报过，估计也是误报。

leonfg

还是特征报的，有板有眼

Jade

上传到 http://virscan.org/ 看看吧

play32

小红伞今天大开杀戒了把我进程管理器程序当做木马杀掉了我现在还在一键还原重装系统软件，
貌似我还是手动处理方式它提示木马我以为真的也没注意看就删除了结果再ctrl+alt+del可怜的进程管理器消失了。
弟兄们要小心啊千万不要太信任小红伞一定不要设置成自动删除隔离才行55555
累啊我跟小红伞拼了

play32

这家伙让我又爱又恨