误报?

ck893210

avg报,瑞星不报,大家看看是不是误报

tracydk

AVAST不报

tracydk

AVG的误报很高的

The EQs

AVG。。。。。误报和飞塔有的一拼。。。

wangjay1980

肯定也不是什么好东西，随机字母.SYS

rasis

33410375.rar
  [0] Archive type: RAR
  --> 33410375.exe
      [DETECTION] Contains suspicious code HEUR/Malware

mhj144007

ID 378095
Comment Automated Samples: 70e53f74357e35d155f049f98527d09e.exe
Flag 1

Analysis Summary:

Analysis Date 3/30/2007 2:34:11 PM
Sandbox Version 1.115
Filename 70e53f74357e35d155f049f98527d09e.exe

Technical Details:

Analysis Number 1
Parent ID 0
Process ID 1760
Filename c:\70e53f74357e35d155f049f98527d09e.exe
Filesize 28672 bytes
MD5 70e53f74357e35d155f049f98527d09e
Start Reason AnalysisTarget
Termination Reason NormalTermination
Start Time 00:00.125
Stop Time 00:01.094
Detection - (Authentium Command Antivirus - EngVer: 4.92.123.35 - SigVer: 20070111 35)
- (BitDefender Antivirus - EngVer: 7.0.0.2311 - SigVer: 7.10873)
- (CounterSpy - EngVer: 2.1.628.0 - SigVer: 469)
- (Microsoft Malware Protection - EngVer: 1.1.1904.0 - SigVer: Thu Jan 11 14:31:06 2007)
- (Norton AntiVirus - EngVer: 20061.3.0.12 - SigVer: 20070110 16:48:12)

DLL-Handling Loaded DLLs
c:\70e53f74357e35d155f049f98527d09e.exe
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\USER32.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\oleaut32.dll
C:\WINDOWS\system32\ole32.dll
C:\WINDOWS\system32\comctl32.dll
C:\WINDOWS\system32\wsock32.dll
C:\WINDOWS\system32\WS2_32.dll
C:\WINDOWS\system32\WS2HELP.dll
C:\WINDOWS\system32\pstorec.dll
C:\WINDOWS\system32\ATL.DLL
C:\WINDOWS\system32\Wship6.dll
C:\WINDOWS\system32\Secur32.dll


Filesystem New Files
C:\WINDOWS\system32\Drivers\155859.sys


Deleted Files
C:\WINDOWS\system32\Drivers\155859.sys

Chronological order
Set File Attributes: C:\WINDOWS\system32\Drivers\155859.sys Flags: (FILE_ATTRIBUTE_NORMAL,SECURITY_ANONYMOUS)
Delete File: C:\WINDOWS\system32\Drivers\155859.sys
Create File: C:\WINDOWS\system32\Drivers\155859.sys
Find File: C:\WINDOWS\system32\Drivers\155859.sys
Move File: c:\70e53f74357e35d155f049f98527d09e.exe to


Process Management Kill Process - Filename () CommandLine: () Target PID: (1760) As User: () Creation Flags: ()

Service Management Open Service Manager - Name: "SCM"

System Info Get System Directory


Analysis Number 2
Parent ID 0
Process ID 712
Filename  
Filesize -1 bytes
MD5  
Start Reason SCM
Termination Reason Unknown
Start Time 00:00.938
Stop Time 00:00.000

7506318

Antivirus Version Update Result
AhnLab-V3 2007.5.31.2 06.01.2007  no virus found
AntiVir 7.4.0.29 06.01.2007 HEUR/Malware
Authentium 4.93.8 05.23.2007  no virus found
Avast 4.7.997.0 06.01.2007  no virus found
AVG 7.5.0.467 06.01.2007  no virus found
BitDefender 7.2 06.02.2007  no virus found
CAT-QuickHeal 9.00 06.01.2007  no virus found
ClamAV devel-20070416 06.02.2007 Trojan.Dropper-833
DrWeb 4.33 06.02.2007  no virus found
eSafe 7.0.15.0 05.31.2007 Win32.Trojan
eTrust-Vet 30.7.3684 06.02.2007  no virus found
Ewido 4.0 06.02.2007 Trojan.Small
FileAdvisor 1 06.02.2007  no virus found
Fortinet 2.85.0.0 06.02.2007  no virus found
F-Prot 4.3.2.48 06.01.2007  no virus found
F-Secure 6.70.13030.0 06.01.2007  no virus found
Ikarus T3.1.1.8 06.02.2007 Trojan.StartPage.1865
Kaspersky 4.0.2.24 06.02.2007  no virus found
McAfee 5044 06.01.2007  no virus found
Microsoft 1.2503 06.02.2007  no virus found
NOD32v2 2305 06.01.2007  no virus found
Norman 5.80.02 06.01.2007  no virus found
Panda 9.0.0.4 06.02.2007 Trj/Agent.EDW
Prevx1 V2 06.02.2007 Trojan.Nudos
Sophos 4.18.0 06.01.2007  no virus found
Sunbelt 2.2.907.0 05.30.2007  no virus found
Symantec 10 06.02.2007 Trojan Horse
TheHacker 6.1.6.128 05.31.2007  no virus found
VBA32 3.12.0 06.01.2007 Trojan.StartPage.1865
VirusBuster 4.3.23:9 06.01.2007  no virus found
Webwasher-Gateway 6.0.1 06.02.2007 Heuristic.Malware

也有好几个都报了阿

mhj144007

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

&#26700 : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS

[ General information ]
    * Accesses executable file from resource section.
    * File length:        28672 bytes.
    * MD5 hash: 70e53f74357e35d155f049f98527d09e.

[ Changes to filesystem ]
    * Deletes file C:\WINDOWS\SYSTEM32\Drivers\74981.sys.
    * Creates file C:\WINDOWS\SYSTEM32\Drivers\74981.sys.

[ Changes to registry ]
    * Creates key "HKLM\System\CurrentControlSet\Services\74981".
    * Sets value "ImagePath"="C:\WINDOWS\SYSTEM32\Drivers\74981.sys" in key "HKLM\System\CurrentControlSet\Services\74981".
    * Sets value "DisplayName"="74981" in key "HKLM\System\CurrentControlSet\Services\74981".

[ Process/window information ]
    * Creates service "74981 (74981)" as "C:\WINDOWS\SYSTEM32\Drivers\74981.sys".



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************