搜索
查看: 2589|回复: 19
收起左侧

晕了~趋势又回复了~不到一小时-_-|||

[复制链接]
hddgmon
发表于 2007-3-25 21:19:51 | 显示全部楼层 |阅读模式
我报了一些样本,不到一小时就回复了,而且还挺详细!
我怀疑他们的分析师很悠闲啊!
http://www.trendmicro.com/vinfo/zh-cn/
/*页面左侧有 可疑文件提交*/

下面是回复:
Thank you for contacting TrendLabs!

1 out of the 8 files you have sent has been verified to be non-malicious:3 25.rar/stormupd.dll


1 out of the 8 files that you have submitted have been verified. The following are their corresponding detections:3 25.rar/svchost.exe                PE_LOOKED.XT-O

The following have been verified to be malicious:3 25.rar/45aTq2V13X.exe
3 25.rar/CCG1.exe
3 25.rar/getmonkkkk.exe
3 25.rar/Happy99.exe
3 25.rar/xc60.exe


The following files need further analysis:3 25.rar/Clsmn.exe


第二封:
Greetings!

We analyzed the files that you submitted and verified these to be malicious. Trend Micro will soon detect these malicious files as follows:

install[1].exe (19,968 bytes) as TSPY_LINEAGE.ERN
pe.exe (28,914 bytes) as TROJ_AGENT.LBS

Here's TSPY_LINEAGE.ERN system modification

[Added file]

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\Ghook.dll
CRC: 637D79D0
TYPE: VSDT_DLL_W32

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\del.bat
CRC: CF680CE4
TYPE: VSDT_ASCII

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\svchost.exe
CRC: CAF55C12
TYPE: VSDT_EXE_W32

C:\virus\0325077002.0003.BD989F67
CRC: 1A503617
TYPE: VSDT_EXE_W32

[Memory Resident]

2007/03/26 08:50:37.824 System-wide Hook: C:\Documents and Settings\Administrato r\Local Settings\Temporary Internet Files\Ghook.dll

[Create Process]

2007/03/26 08:50:37.293 API: CreateProcess is invoked. [Command Line: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\svchost.exe]
2007/03/26 08:50:37.309 API: CreateProcess is invoked. [Command Line: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\svchost.exe]
2007/03/26 08:50:37.481 API: CreateProcess is invoked. [Command Line: C:\litemars\tools\Explorer.exe]
2007/03/26 08:50:37.887 API: CreateProcess is invoked. [Command Line: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\del.bat]
2007/03/26 08:50:37.902 API: CreateProcess is invoked. [Command Line: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\del.bat]
The EQs
发表于 2007-3-25 21:21:03 | 显示全部楼层
下回将样本发送给他们分析。。。。。LZ也加入到偶的ATCC吧
观弈书童
发表于 2007-3-25 21:24:29 | 显示全部楼层
趋势杀毒能力不敢恭维
hddgmon
 楼主| 发表于 2007-3-25 21:24:29 | 显示全部楼层

回复 #2 EQ2 的帖子

啊?偶见识比较短浅 atcc是什么东西?
The EQs
发表于 2007-3-25 21:25:48 | 显示全部楼层
antivirus testing center of China
黑衣~魂
发表于 2007-3-25 21:26:54 | 显示全部楼层
第一封是已分析的回覆~也就是已經公佈又有回報的~

難不成歧視我的樣本
hddgmon
 楼主| 发表于 2007-3-25 21:28:08 | 显示全部楼层

回复 #5 EQ2 的帖子

还有次组织? 强!!
算我一个
The EQs
发表于 2007-3-25 21:29:16 | 显示全部楼层
我们组织在5月份会正式评测
黑衣~魂
发表于 2007-3-25 21:31:56 | 显示全部楼层

回复 #8 EQ2 的帖子

評測 大概是評測哪些部分呢?

期待你們的測試報告~!!
zjkzjy
发表于 2007-3-25 21:33:57 | 显示全部楼层
真是羡慕趋势的上报回复速度啊! 不像"破船"(驱逐舰)还什么"太平洋舰队"(驱逐舰粉丝总称)那个上报回复速度基本都是,那个病毒"报废"了它才回复你~~让人
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛|卡饭乐购| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 苏ICP备07004770号 ) GMT+8, 2019-11-22 14:17 , Processed in 0.091159 second(s), 18 queries .

快速回复 返回顶部 返回列表