帮忙分析下logonui.exe

Sebastian

Filename         Result
logonui.exe          KNOWN CLEAN

The file 'logonui.exe' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'Windows XP (SP2)'.

kingmuro

2009-05-10 8:37:48        gxf        3404        Sign of "Win32:Hupigon-LMG [Trj]" has been found in "C:\Documents and Settings\gxf\桌面\被秒杀的小马甲们.rar\000E5D26.exe" file.  
2009-05-10 8:37:56        gxf        3404        Sign of "VBS:Malware-gen" has been found in "C:\Documents and Settings\gxf\桌面\被秒杀的小马甲们.rar\autorun.inf" file.  
2009-05-10 8:37:56        gxf        3404        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\gxf\桌面\被秒杀的小马甲们.rar\system.dll\[UPX]\[Embedded_I#5cc0]" file.  
2009-05-10 8:37:56        gxf        3404        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\gxf\桌面\被秒杀的小马甲们.rar\usp10.dll" file.  
2009-05-10 8:37:56        gxf        3404        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\gxf\桌面\被秒杀的小马甲们.rar\000D6E01.exe" file.

kabakafa

其他不敢打开

woai_jolin

http://bbs.kafan.cn/attachment.p ... 15&t=1241919905        multiple threats        deleted (after the next restart) - quarantined       
http://bbs.kafan.cn/attachment.p ... 15&t=1241919905 » RAR » 000E5D26.exe        a variant of Win32/Hupigon trojan        was a part of the deleted object       
http://bbs.kafan.cn/attachment.p ... 15&t=1241919905 » RAR » autorun.inf        Win32/AutoRun.Agent.EE worm        was a part of the deleted object       
http://bbs.kafan.cn/attachment.p ... 15&t=1241919905 » RAR » system.dll        a variant of Win32/KillAV.NDN trojan        was a part of the deleted object       
http://bbs.kafan.cn/attachment.p ... 15&t=1241919905 » RAR » usp10.dll        a variant of Win32/TrojanDownloader.Agent.OQW trojan        was a part of the deleted object       
http://bbs.kafan.cn/attachment.p ... 15&t=1241919905 » RAR » 000D6E01.exe        probably a variant of Win32/PSW.OnLineGames.NUA trojan        was a part of the deleted object