红伞误报收集站

will

　　　

若发现误报（无论是网页误报还是文件误报），请按照以下方式回帖，让红伞更完美：

文件名/软件名
误报名
下载地址/链接地址（如有的话）
附件（方便上传的话）
是否上报：已上报/未上报
上报分析结果

上报得到分析回复后再将回复结果贴出
贴出误报分析结果的伞友将得到经验奖励。

PS.
   1.欢迎伞友承包误报上报，详情如下：
   a.仅上报没有人上报的误报样本（已经上报的就不必了）
   b.需要有较强的毅力，能坚持上报
   c.得到上报回复后将分析结果贴出
   d.坚持上报的伞友每月将有50经验奖励
      有意者请PM伞区版主

   2.可疑及误报样本上报详解   by jimmyleo    点击查看

   3.此贴禁止发布误报外的任何内容，否则一律删除

[ 本帖最后由 yimike 于 2008-4-21 11:55 编辑 ]

亮

文件名/软件名:  大智慧的HSHOOK.dll
误报名             :  MALWARE
下载地址/链接地址: 东北证券的大智慧完全版C
是否上报：        已上报
上报分析结果:
Thank you for your submission. Below you can see the current status of the uploaded files.

We received the following archive files:
File ID          Filename          Size (Byte)         Result
3805588          4839f81c.qua         38.28 KB         OK

A listing of files contained inside archives alongside their results can be found below:
File ID          Filename          Size (Byte)         Result
3655412          4839f81c.vir          38 KB          MALWARE


Please find a detailed report concerning each individual sample below:
Filename         Result
4839f81c.vir          MALWARE

The file '4839f81c.vir' has been determined to be 'MALWARE'. Our analysts named the threat HEUR/Malware. This malware is detected by a special detection routine from the engine module.已被确定为'恶意软件'
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

亮

文件名/软件名:  大智慧的PYDLL.dll
误报名             :  MALWARE
下载地址/链接地址: 东北证券的大智慧完全版C
是否上报：        已上报
上报分析结果:
Thank you for your submission. Below you can see the current status of the uploaded files.

We received the following archive files:
File ID          Filename          Size (Byte)         Result
3805585          4835f80d.qua         138.28 KB         OK

A listing of files contained inside archives alongside their results can be found below:
File ID          Filename          Size (Byte)         Result
3804281          4835f80d.vir          138 KB          FALSE POSITIVE


Please find a detailed report concerning each individual sample below:
Filename         Result
4835f80d.vir          FALSE POSITIVE

The file '4835f80d.vir' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection will be removed from our virus definition file (VDF) with one of the next updates.这意味着，这个文件是没有恶意的，但只是虚惊一场。检测将被删除.
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

亮

文件名/软件名:WinUpdatelist.exe
误报名      :MALWARE
是否上报：已上报
上报分析结果:
Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00135038.

We received the following archive files:

File ID          Filename          Size (Byte)         Result
3805588          4839f81c.qua         38.28 KB         OK

A listing of files contained inside archives alongside their results can be found below:
File ID          Filename          Size (Byte)         Result
3655412          4839f81c.vir          38 KB          MALWARE


Please find a detailed report concerning each individual sample below:
Filename         Result
4839f81c.vir          MALWARE

The file '4839f81c.vir' has been determined to be 'MALWARE'. Our analysts named the threat HEUR/Malware. This malware is detected by a special detection routine from the engine module.

Alternatively you can see the analysis result here:
http://analysis.avira.com/samples/details.php?uniqueid=BIkhrVxZ2EvyS4EcwV1jFrTttKVABkx1&incidentid=135038

An overview of all your submissions can be found here:
http://analysis.avira.com/samples/details.php?uniqueid=BIkhrVxZ2EvyS4EcwV1jFrTttKVABkx1

Please note: The detection of Spy/Adware is not available in the product "AntiVir PersonalEdition Classic". Please address specific questions to support@avira.com

Kind regards
Avira Virus Lab

---------------------------------------------
Avira GmbH
Lindauer Str. 21, D-88069 Tettnang, Germany
Phone: +49 (0) 7542-500 0
Fax: +49 (0) 7542-525 10
Internet: http://www.avira.com

CEO: Tjark Auerbach
Headquarter: Tettnang
Commercial register: AG Ulm HRB 630992
---------------------------------------------

亮

文件名/软件名:  企业之星的update.dll
误报名             :  MALWARE
是否上报：        已上报
上报分析结果:
Thank you for your submission. Below you can see the current status of the uploaded files.

We received the following archive files:
File ID          Filename          Size (Byte)         Result
3805588          4839f81c.qua        92.36 KB         OK

A listing of files contained inside archives alongside their results can be found below:
File ID          Filename          Size (Byte)         Result
3655412          4839f81c.vir          92.36KB          MALWARE


Please find a detailed report concerning each individual sample below:
Filename         Result
4839f81c.vir          MALWARE

The file '4839f81c.vir' has been determined to be 'MALWARE'. Our analysts named the threat HEUR/Malware. This malware is detected by a special detection routine from the engine module
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

sice

文件名/软件名:NEWordAddin.dll/NoteExpress v1.9.3.198
误报名:is TR/Crypt.xpack.gen Trojan horse ?
下载地址/链接地址（如有的话）:http://www.scinote.com/support/c ... h.cgi?code=SXDZKJDX
附件（方便上传的话）






是否上报：未上报上报分析结果

ykz1991

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00143526.



A listing of files alongside their results can be found below:

File ID 燜ilename Size (Byte) Result
25001470  NEWordAddin.dll  2.39 MB  FALSE POSITIVE


Please find a detailed report concerning each individual sample below:

燜ilename Result
NEWordAddin.dll  FALSE POSITIVE

The file 'NEWordAddin.dll' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection will be removed from our virus definition file (VDF) with one of the next updates.

geforce

文件名:cmdow.exe pskill.exe

是否上报：未上报

无尽藏海

确认，这种报法无误

File ID         Filename        Size (Byte)        Result
25013876         cmdow.exe         18 KB         MALWARE
218854         pskill.exe         92 KB         MALWARE



Please find a detailed report concerning each individual sample below:
Filename        Result
cmdow.exe         MALWARE


The file 'cmdow.exe' has been determined to be 'MALWARE'. Our analysts named the threat SPR/HideWindows.I. The term "SPR/" ("Security or Privacy Risk") denotes a program that might possibly be able to affect the security of your system, might trigger activities you might not want or might violate your privacy.Detection is added to our virus definition file (VDF) starting with version 6.34.00.141.



Filename        Result
pskill.exe         MALWARE


The file 'pskill.exe' has been determined to be 'MALWARE'. Our analysts named the threat APPL/PsKill.E. The term APPL/ denotes an application of dubious origin or which might be hazardous to use.Detection is added to our virus definition file (VDF) starting with version 6.37.00.216.

[ 本帖最后由 无尽藏海 于 2008-5-10 10:18 编辑 ]

ykz1991

pskil好久以前就上报过

还曾经在样本区发过帖子 l
http://bbs.kafan.cn/viewthread.php?tid=199275