红伞误报收集站

weelun94

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00290927.

We received the following archive files:
File ID         燜ilename         Size (Byte)         Result
25312002          ProxyHunter-v3.1.rar         340.51 KB         OK

A listing of files contained inside archives alongside their results can be found below:
File ID         燜ilename         Size (Byte)         Result
25312003          page1.txt          972 Byte          CLEAN
25312004          page2.txt          746 Byte          CLEAN
25312005          page3.txt          1.34 KB          CLEAN
25312006          page4.txt          631 Byte          CLEAN
3597040          ProxyHunter.exe          804 KB          MALWARE
25312007          ftp.dll          128 KB          CLEAN
25312008          telnet.dll          120 KB          CLEAN
25312009          ftp.cfg          82 Byte          CLEAN
25312010          proxyht.cfg          1.3 KB          CLEAN
25312011          telnet.cfg          8 Byte          CLEAN
25312012          169.ipr          768 Byte          CLEAN
25312013          CERNet.ipr          182 Byte          CLEAN
25312014          ChinaGBN.ipr          272 Byte          CLEAN
25312015          ChinaNet.ipr          286 Byte          CLEAN
25312016          CSTNet.ipr          202 Byte          CLEAN
25312017          HongKong.ipr          300 Byte          CLEAN
25312018          NewForCERNet.ipr          804 Byte          CLEAN
25312019          default.ppc          157 Byte          CLEAN
25312020          ChinaGBN.tsk          1.66 KB          CLEAN
25312021          ChinaNet.tsk          2.25 KB          CLEAN
25312022          HongKong.tsk          2.37 KB          CLEAN


Please find a detailed report concerning each individual sample below:
燜ilename         Result
page1.txt          CLEAN

The file 'page1.txt' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
page2.txt          CLEAN

The file 'page2.txt' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
page3.txt          CLEAN

The file 'page3.txt' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
page4.txt          CLEAN

The file 'page4.txt' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
ProxyHunter.exe          MALWARE

The file 'ProxyHunter.exe' has been determined to be 'MALWARE'. Our analysts named the threat SPR/ProxySwitcher.A. The term "SPR/" ("Security or Privacy Risk") denotes a program that might possibly be able to affect the security of your system, might trigger activities you might not want or might violate your privacy.Detection is added to our virus definition file (VDF) starting with version 7.00.01.63.
燜ilename         Result
ftp.dll          CLEAN

The file 'ftp.dll' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
telnet.dll          CLEAN

The file 'telnet.dll' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
ftp.cfg          CLEAN

The file 'ftp.cfg' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
proxyht.cfg          CLEAN

The file 'proxyht.cfg' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
telnet.cfg          CLEAN

The file 'telnet.cfg' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
169.ipr          CLEAN

The file '169.ipr' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
CERNet.ipr          CLEAN

The file 'CERNet.ipr' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
ChinaGBN.ipr          CLEAN

The file 'ChinaGBN.ipr' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
ChinaNet.ipr          CLEAN

The file 'ChinaNet.ipr' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
CSTNet.ipr          CLEAN

The file 'CSTNet.ipr' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
HongKong.ipr          CLEAN

The file 'HongKong.ipr' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
NewForCERNet.ipr          CLEAN

The file 'NewForCERNet.ipr' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
default.ppc          CLEAN

The file 'default.ppc' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
ChinaGBN.tsk          CLEAN

The file 'ChinaGBN.tsk' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
ChinaNet.tsk          CLEAN

The file 'ChinaNet.tsk' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.
燜ilename         Result
HongKong.tsk          CLEAN

The file 'HongKong.tsk' has been determined to be 'CLEAN'. Our analysts did not discover any malicious content.

Alternatively you can see the analysis result here:
http://analysis.avira.com/sample ... p;incidentid=290927

An overview of all your submissions can be found here:
http://analysis.avira.com/sample ... VLkYg7Sg7cXjRWU2byy

Please note: If you have specific questions please address them to support@avira.com

Kind regards
Avira Virus Lab

---------------------------------------------
Avira GmbH
Lindauer Str. 21, D-88069 Tettnang, Germany
Phone: +49 (0) 7542-500 0
Fax: +49 (0) 7542-525 10
Internet: http://www.avira.com

CEO: Tjark Auerbach
Headquarter: Tettnang
Commercial register: AG Ulm HRB 630992
---------------------------------------------

weelun94

文件过大(超过8mb)不可上报

weelun94

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00292324.

A listing of files alongside their results can be found below:
File ID          Filename         Size (Byte)         Result
25314097          %e9%85%b7%e7%8b%9...53.exe          2.69 MB          MALWARE


Please find a detailed report concerning each individual sample below:
Filename         Result
%e9%85%b7%e7%8b%9...53.exe          MALWARE

The file '%e9%85%b7%e7%8b%97%e9%9f%b3%e4%b9%902008%e8%90%bd%e9%9b%aa%e6%a2%a8%e8%8a%b1%e7%bb%bf%e8%89%b2%e7%b2%be%e7%ae%80%e7%89%88v5.3.32.353.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dropper.Gen. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.This malware is detected by a special detection routine from the engine module.

Alternatively you can see the analysis result here:
http://analysis.avira.com/sample ... p;incidentid=292324

An overview of all your submissions can be found here:
http://analysis.avira.com/sample ... VLkYg7Sg7cXjRWU2byy

Please note: If you have specific questions please address them to support@avira.com

Kind regards
Avira Virus Lab

---------------------------------------------
Avira GmbH
Lindauer Str. 21, D-88069 Tettnang, Germany
Phone: +49 (0) 7542-500 0
Fax: +49 (0) 7542-525 10
Internet: http://www.avira.com

CEO: Tjark Auerbach
Headquarter: Tettnang
Commercial register: AG Ulm HRB 630992
---------------------------------------------

nvhaichina

红伞误报 完美卸载的一个文件

Knight01

原帖由 nvhaichina 于 2009-4-16 17:57 发表
红伞误报 完美卸载的一个文件

Hi
这个误报已被移除。

北方星空

谁帮我上报下2个文件
星云游戏修改器
翡翠帝国游侠汉化的程序启动文件

llzy3575

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00297881.



We received the following archive files:File ID        燜ilename        Size (Byte)        Result
25323670         JadeEmpire.rar        329.08 KB        OK


A listing of files contained inside archives alongside their results can be found below:File ID        燜ilename        Size (Byte)        Result
25323671         JadeEmpire.exe         312 KB         FALSE POSITIVE
25323672         ##############.exe         169.5 KB         FALSE POSITIVE



Please find a detailed report concerning each individual sample below:燜ilename        Result
JadeEmpire.exe         FALSE POSITIVE


The file 'JadeEmpire.exe' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection will be removed from our virus definition file (VDF) with one of the next updates. 燜ilename        Result
##############.exe         FALSE POSITIVE


The file '##############.exe' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection will be removed from our virus definition file (VDF) with one of the next updates.

Alternatively you can see the analysis result here:
http://analysis.avira.com/samples/details.php?uniqueid=Jx1I7wygtEX8bn7P0B1q9PYfW3YAgWDM&incidentid=297881

An overview of all your submissions can be found here:
http://analysis.avira.com/samples/details.php?uniqueid=Jx1I7wygtEX8bn7P0B1q9PYfW3YAgWDM

Please note: If you have specific questions please address them to support@avira.com

Kind regards
Avira Virus Lab

---------------------------------------------
Avira GmbH
Lindauer Str. 21, D-88069 Tettnang, Germany
Phone: +49 (0) 7542-500 0
Fax: +49 (0) 7542-525 10
Internet: http://www.avira.com

CEO: Tjark Auerbach
Headquarter: Tettnang
Commercial register: AG Ulm HRB 630992
---------------------------------------------

[ 本帖最后由 llzy3575 于 2009-4-17 22:27 编辑 ]

slience

文件名：ComRes.dll
病毒类型：HEUR/Malware

llzy3575

Welcome back, Mr llzy3575!


We received the following archive files:
File ID         Filename        Size (Byte)        Result
25324623         ComRes.7z        3.86 KB        OK


A listing of files contained inside archives alongside their results can be found below:File ID         Filename        Size (Byte)        Result
25324475         ComRes.dll         12.5 KB         MALWARE



Please find a detailed report concerning each individual sample below: Filename        Result
ComRes.dll         MALWARE


The file 'ComRes.dll' has been determined to be 'MALWARE'. Our analysts named the threat TR/PSW.OnlineGames.blvm. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection is added to our virus definition file (VDF) starting with version 7.01.03.73. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

[ 本帖最后由 llzy3575 于 2009-4-26 20:12 编辑 ]

sxingang

文件名/软件名 Restart.rar
误报名 Restart.rar
  C:\WINDOWS\system32\Tools\ 目录

已上报
上报分析结果
Suspicious Files and Miscellaneous Uploads

Thank you for your submission. Below you can see the current status of the uploaded files.


--------------------------------------------------------------------------------

A listing of files alongside their results can be found below:

File ID  Filename Size (Byte) Result
216722  Restart.exe  421.5 KB  MALWARE


Please find a detailed report concerning each individual sample below:

Filename Result
Restart.exe  MALWARE

The file 'Restart.exe' has been determined to be 'MALWARE'. Our analysts named the threat SPR/Destart.A. The term "SPR/" ("Security or Privacy Risk") denotes a program that might possibly be able to affect the security of your system, might trigger activities you might not want or might violate your privacy.Detection is added to our virus definition file (VDF) starting with version 6.31.00.168.


--------------------------------------------------------------------------------
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.