晕了～趋势又回复了～不到一小时-_-|||

hddgmon

我报了一些样本，不到一小时就回复了，而且还挺详细！
我怀疑他们的分析师很悠闲啊！
http://www.trendmicro.com/vinfo/zh-cn/
/*页面左侧有 可疑文件提交*/

下面是回复：
Thank you for contacting TrendLabs!

1 out of the 8 files you have sent has been verified to be non-malicious:3 25.rar/stormupd.dll


1 out of the 8 files that you have submitted have been verified. The following are their corresponding detections:3 25.rar/svchost.exe                PE_LOOKED.XT-O

The following have been verified to be malicious:3 25.rar/45aTq2V13X.exe
3 25.rar/CCG1.exe
3 25.rar/getmonkkkk.exe
3 25.rar/Happy99.exe
3 25.rar/xc60.exe


The following files need further analysis:3 25.rar/Clsmn.exe


第二封：
Greetings!

We analyzed the files that you submitted and verified these to be malicious. Trend Micro will soon detect these malicious files as follows:

install[1].exe (19,968 bytes) as TSPY_LINEAGE.ERN
pe.exe (28,914 bytes) as TROJ_AGENT.LBS

Here's TSPY_LINEAGE.ERN system modification

[Added file]

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\Ghook.dll
CRC: 637D79D0
TYPE: VSDT_DLL_W32

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\del.bat
CRC: CF680CE4
TYPE: VSDT_ASCII

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\svchost.exe
CRC: CAF55C12
TYPE: VSDT_EXE_W32

C:\virus\0325077002.0003.BD989F67
CRC: 1A503617
TYPE: VSDT_EXE_W32

[Memory Resident]

2007/03/26 08:50:37.824 System-wide Hook: C:\Documents and Settings\Administrato r\Local Settings\Temporary Internet Files\Ghook.dll

[Create Process]

2007/03/26 08:50:37.293 API: CreateProcess is invoked. [Command Line: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\svchost.exe]
2007/03/26 08:50:37.309 API: CreateProcess is invoked. [Command Line: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\svchost.exe]
2007/03/26 08:50:37.481 API: CreateProcess is invoked. [Command Line: C:\litemars\tools\Explorer.exe]
2007/03/26 08:50:37.887 API: CreateProcess is invoked. [Command Line: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\del.bat]
2007/03/26 08:50:37.902 API: CreateProcess is invoked. [Command Line: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\del.bat]

The EQs

下回将样本发送给他们分析。。。。。LZ也加入到偶的ATCC吧

观弈书童

趋势杀毒能力不敢恭维

hddgmon

啊？偶见识比较短浅 atcc是什么东西？

The EQs

antivirus testing center of China

黑衣~魂

第一封是已分析的回覆~也就是已經公佈又有回報的~

難不成歧視我的樣本

hddgmon

还有次组织？ 强！！
算我一个

The EQs

我们组织在5月份会正式评测

黑衣~魂

評測 大概是評測哪些部分呢?

期待你們的測試報告~!!

zjkzjy

真是羡慕趋势的上报回复速度啊！ 不像＂破船＂（驱逐舰）还什么＂太平洋舰队＂（驱逐舰粉丝总称）那个上报回复速度基本都是，那个病毒＂报废＂了它才回复你～～让人