昨天在本人父母的机子上发现了一个文件，怀疑是木马（文件名为game.exe图标和QQ游戏的一样，大小不同），我父母机子当时装的卡巴斯基工作站8.0，我的本子装的小红伞v9，我的台机是诺顿2009，我在三台机子上用最新数据库、最大启发都扫描了一遍，都不报，决定上报给卡巴斯基、小红伞和赛门铁克等公司，顺便对比下卡巴斯基、小红伞和赛门铁克，McAfee四家公司对新病毒样本的响应及入库速度
我上报后最新的扫描结果在19楼，有兴趣的可以去看看
7月23日 晚上10:08 ，上报至卡巴斯基中国，
7月24日下午2:35 ，卡巴回信：
您好，
game.exe - Trojan.Win32.StartPage.dyw
以上文件包含恶意代码，下次更新即可查杀。感谢您的上报。
Best Regards, NewVirus
--------------------------------------------------------------------------
7月24日下午3:08 ，上报至小红伞，McAfee
7月24日下午4:56 ，小红伞回信：
Dear Sir or Madam,
Thank you for your email to Avira's virus lab.
Tracking number: INC00345153.
We received the following archive files:
| File ID | ?Filename | Size (Byte) | Result | | 25409197 | game.zip | 14.83 KB | OK |
A listing of files contained inside archives alongside their results can be found below:
| File ID | ?Filename | Size (Byte) | Result | | 25409198 | game.exe | 40 KB | MALWARE |
Please find a detailed report concerning each individual sample below:
| ?Filename | Result | | game.exe | MALWARE |
The file 'game.exe' has been determined to be 'MALWARE'.
Our analysts discovered that the file is a Dropper. In general this kind of programs do not contain harmul functions by themselves. However they usually create other harmful programs and execute them right away. Detection will be added to our virus definition file (VDF) with one of the next updates.
Alternatively you can see the analysis result here:
http://analysis.avira.com/samples/details.php?uniqueid=YPId7J3FW2zm1D4Tf8871GzwnU1tdNMr&incidentid=345153
An overview of all your submissions can be found here:
http://analysis.avira.com/samples/details.php?uniqueid=YPId7J3FW2zm1D4Tf8871GzwnU1tdNMr
We recommend to use our upload form for further submissions. In case the result is known it will be shown in realtime to you. Furthermore files which are considered to be false positive suspictions can only be submitted using this method. http://analysis.avira.com/samples/index.php?lang=en
Please note: If you have specific questions please address them to support@avira.com
Kind regards
Avira Virus Lab
---------------------------------------------
Avira GmbH
Lindauer Str. 21, D-88069 Tettnang, Germany
Phone: +49 (0) 7542-500 0
Fax: +49 (0) 7542-525 10
Internet: http://www.avira.com
CEO: Tjark Auerbach
Headquarter: Tettnang
Commercial register: AG Ulm HRB 630992
--------------------------------------------------------------------------
7月24日(星期五) 下午5:44McAfee回信：
Avert Sample Analysis
Issue Number: 5426113
Virus Researcher: Pandiarajan Karuppiyah
McAfee Avert Labs, Bangalore, India
Identified: Generic.TRA
Thank you for submitting your suspicious file.
Synopsis -
Attached is a file for extra detection, which will be included in a future DAT set.
EXTRA.DAT
The file should be copied into the directory where the other DAT files reside (with default installation, C:\Program Files\Common Files\McAfee\Engine).
Otherwise, use the find/search utility on your computer search to for the following file:
McScan32.dll
Then copy the Extra.dat we have sent you to the same folder where one of the above is located.
Once you have copied the file, reboot the system for the driver to be loaded.
Further information about Extra.DATs can be found at http://vil.mcafeesecurity.com/vil/systemhelpdocs/extradat.aspx.
Solution -
To ensure that you have the maximum available capability of detecting and cleaning this malware on your system, please make sure you have the latest engine.
DAT updates are available at: http://www.mcafee.com/apps/downloads/security_updates/dat.asp
Support -
Virus Research accepts file-samples for analysis and possible inclusion into AV signature DAT sets. We are also prepared to answer general virus questions.
All product-related questions and comments can be addressed through technical support and customer service, including:
* Product installation and update questions
* Product usage questions
* Specific operating system/version questions
* Assistance with detection and cleaning or removal of viruses or trojans
Please use the following link to reach our technical support group for McAfee products.
Corporate Customers:
<http://www.mcafee.com/us/support/index.html>
Single User/Retail Customers:
<http://service.mcafee.com/default.aspx>
Regards,
Pandiarajan Karuppiyah
McAfee Avert Labs
A division of McAfee, Inc.
--------------------------
McAfee Avert Labs Blog <http://www.avertlabs.com/research/blog/>
AudioParasitics - The Official PodCast of McAfee Avert Labs <http://podcasts.mcafee.com/audioparasitics>
--------------------------
Safe online? Avoid dangerous web sites using McAfee SiteAdvisor - a FREE download from http://www.siteadvisor.com?cid=27092. Don't search or surf without it!
*Disclaimer*
Avert Labs researchers subject extra.dat files to a careful automatic test suite to verify their detection, and in order to reduce the possibility of "false alarm" detections or other issues and to improve their overall reliability. Note, however, that the McAfee Quality Assurance team has NOT tested or approved these files for release. McAfee Makes no warranty that these files will be free from errors or other interruptions or that they will meet your requirements. To the maximum extent permitted by applicable law, MCAFEE DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT WITH RESPECT TO THESE FILES. Some states and jurisdictions do not allow limitations on implied warranties, so the above limitation may not apply to you. The foregoing provisions shall be enforceable to the maximum extent permitted by applicable law.
--------------------------------------------------------------------------
7月24日下午4:40 上报给赛门铁克
(通过https://submit.symantec.com/websubmit/retail.cgi上报，
[TRACKING]: Symantec Security Response Automation: Tracking #11999666 )
至现在，杳无音讯。。。。
卡巴斯基响应及入库速度：十六小时四十三分钟
小红伞响应及入库速度：一小时四十八分
McAfee响应速度：两小时三十六分
McAfee入库速度：目前已超过二十八小时五十分钟
赛门铁克响应及入库速度：目前已超过二十八小时五十分钟
给赛门铁克上报过的朋友们，赛门铁克的响应及入库有这么长时间么？
Ps.我上报后最新的扫描结果在19楼，有兴趣的可以去看看
PPs.其实这次我也同时上报了很多公司，但反应速度都让我很失望，这里补上其他公司的反应：
瑞星上报后说不是病毒，eset，microsoft，dr.web，BitDefender，江民，金山，熊猫，趋势，Sophos至今没有回复，只有Sophos回复并入库
PPPs.个人对小红伞的反应最满意，不仅反应快，入库快，而且还有简要的分析报告，你可以知道你上报的病毒的工作原理（英文好的可以看看红伞的回信）
[ 本帖最后由 hanjiangli2000 于 2009-7-25 23:18 编辑 ] |
发表于 2009-7-25 21:31:03
发表于 2009-7-25 21:32:24
，没给norton上报过病毒
