Antivir启发技术分析
Description:
HEUR/Malware
HEUR/Malware is a heuristic detection routine designed to detect common malware characteristics. Avira AntiVir recognizes unknown malware proactively using its AHeAD technology. To achieve this, Avira performs innovative structural analyzing.
HEUR/Malware是一个用来检测常见威胁特征的试探程序。Antivir通过AHeAD技术来侦测未知威胁程序。为了这个目标，Avira完成了创新的结构分析技术。
On the basis of the composition of a file, the sequence of significant code sequences or based on particular behavior patterns, the heuristics can determine with a high probability whether it is dealing with a harmful or virulent file.
在文件的基层结构（不知道怎么翻译-_-||），有意义代码的顺序或者基于特殊的行为特征（还是不知道怎么翻译-_-||），有很高的几率可以启发出文件是否是一个有害的或者含有病毒的文件。
HEUR/Malware in particular is reported when a program seems to contain suspicious functionality.
HEUR/Malware会在当程序具有可疑功能的时候被特别报告
In the unlikely occurrence of a false positives we would kindly ask for your help and send the file to our virus lab using the quarantine functionality of AntiVir.
虽然误报很不受欢迎但是我们真心的希望您的帮助并发送文集那到我们的病毒实验室通过隔离功能（貌似不能用，至少偶不会-_-||）
A heuristic detection might be a false identification if one or more of the following are true:
- The program has been used for a very long time and is known to the user
- The program was installed by the user himself
- The program is from a trustworthy source
一个启发侦测可能是一个误报如果满足下列条件的话:
- 程序已经被使用很长时间而且用户很清楚这个文件
- 程序是被用户自行安装的
- 程序来自一个可以信赖的资源
Please note that even old programs can get infected or replaced by malware without your knowledge. Besides that trustworthy sources might have become compromised themselves.
请注意即使是旧的程序一样可以被病毒感染或调换在您不知道的情况下。除此之外可信赖的资源可能变为威胁。（这话怎么读着这么别扭。。）
In order to enhance detection and reduce the rate of false positives we recommend you to send the file to our virus lab for further analysis.
为了提高侦测和减少误报率我们建议您发送文件到我们的病毒实验室进行进一步分析。
Send a sample via the quarantine manager within the windows product:
废话就不翻译了。。
Upload a sample via the form on our website:
Description:
HEUR/Crypted
HEUR/Crypted is a heuristic detection routine designed to detect common malware characteristics. Avira AntiVir recognizes unknown malware proactively using its AHeAD technology. To achieve this, Avira performs innovative structural analyzing.
HEUR/Crypted是一个用来检测常见威胁特征的试探程序。Antivir通过AHeAD技术来侦测未知威胁程序。为了这个目标，Avira完成了创新的结构分析技术。
On the basis of the composition of a file, the sequence of significant code sequences or based on particular behavior patterns, the heuristics can determine with a high probability whether it is dealing with a harmful or virulent file.
在文件的基层结构，有意义代码的顺序或者基于特殊的行为特征，有很高的几率可以启发出文件是否是一个有害的或者含有病毒的文件。
HEUR/Crypted in particular signals files that have a suspicious structure of the program. Usually such files are protected by encryption mechanisms and are often manipulated afterwards to hide the real functionality.
HEUR/Crypt会特别指出具有可疑结构的程序、通常这种文件被加密保护并经常生成其他文件在运行后以试图隐藏其真实功能（看来这个启发就是为了报壳的，现在才明白-_-||)
Please note that cracks or the cracked program files themselves as well as key generators are often modified with similar techniques. Therefore Avira AntiVir's AHeAD heuristics may detect such files as well. The user should keep in mind that trojans are often disguised as such software.
请注意破解软件或者被破解的程序自身具有的算号器经常用到相似的技术。所以Avira antivir的AHeAD启发可能也会侦测到此类的文件。用户需要记住木马经常伪装成类似的软件。
In the unlikely occurrence of a false positive we would kindly ask for your help, by sending the file to our virus lab.
虽然误报很不受欢迎但是我们真心的希望您的帮助并发送文集那到我们的病毒实验室通过隔离功能
A heuristic detection might be a false identification if one or more of the following are true:
- The program is in use for a very long time and is known to the user
- The program was installed by the user himself
- The program is from a trustworthy source
一个启发侦测可能是一个误报如果满足下列条件的话:
- 程序已经被使用很长时间而且用户很清楚这个文件
- 程序是被用户自行安装的
- 程序来自一个可以信赖的资源
Please note that even old programs can get infected or replaced by malware without your knowledge. Besides that trustworthy sources might have become compromised themselves.
请注意即使是旧的程序一样可以被病毒感染或调换在您不知道的情况下。除此之外可信赖的资源可能变为威胁。
In order to enhance detection and reduce the rate of false positives we recommend that you send the file to our virus lab for further analysis.
为了提高侦测和减少误报率我们建议您发送文件到我们的病毒实验室进行进一步分析。
Send a sample via the quarantine manager within the windows product:
Upload a sample via the form on our website:
另外附上antivir的47种基因识别的基因名称，这应该不是现在最全的，至少前几天我看见的一个新的基因启发还没有出现在列表中，粗略估计现在有40个左右吧，因为没有很详细的注释，就不翻译了，antivir基本每个月都会添加1-2种新的基因，在引擎更新的时候，有兴趣的可以看这里
灰鸽子和威金应该满自豪的，antivir很少为一种类型的病毒专门定制基因的^_^
No. Name Type Danger Added on
1. TR/Crypt.FSPM.Gen Trojan 01 Mar 2007
2. TR/Crypt.XDR.Gen Trojan 01 Mar 2007
3. TR/Crypt.PEC2X.Gen Trojan 01 Mar 2007
4. TR/Crypt.ULPM.Gen Trojan 05 Feb 2007
5. TR/Crypt.XPACK.Gen Trojan 05 Feb 2007
6. Worm/P2P.Kapucen.Gen Worm 15 Dec 2006
7. TR/Dldr.Mondo.Gen Trojan 15 Dec 2006
8. TR/Crypt.PCMM.Gen Trojan 05 Dec 2006
9. TR/Dldr.DNSChanger.Gen Trojan 24 Nov 2006
10. DR/Dldr.DNSChanger.Gen Dropper 24 Nov 2006
11. BDS/Optix.Gen Backdoor Server 21 Nov 2006
12. TR/AntiHosts.Gen Trojan 21 Nov 2006
13. TR/Diamin.Gen Trojan 08 Nov 2006
14. TR/Crypt.YCM.Gen Trojan 08 Nov 2006
15. TR/Crypt.NSPM.Gen Trojan 08 Nov 2006
16. TR/Crypt.Ntpacker.Gen Trojan 08 Nov 2006
17. TR/Crypt.S.Gen Trojan 08 Nov 2006
18. TR/Spy.Viking.Gen Trojan 08 Nov 2006
19. TR/PolyCrypt.Gen Trojan 08 Nov 2006
20. TR/Dldr.Stration.Gen Trojan 26 Oct 2006
21. TR/Wimad.A.Gen Trojan 19 Oct 2006
22. TR/Dldr.Swizzor.Gen Trojan 13 Oct 2006
23. Worm/Feebs.1.Gen.5 Worm 02 Oct 2006
24. TR/Clicker.Small.FU.Gen Trojan 01 Oct 2006
25. TR/Dldr.ConHook.Gen Trojan 01 Oct 2006
26. TR/Crypt.Np.Gen Trojan 01 Oct 2006
27. BDS/Hupigon.Gen Backdoor Server 01 Oct 2006
28. Worm/Stration.Gen Worm 01 Oct 2006
29. DR/Zlob.Gen Dropper 19 Sep 2006
30. TR/Spy.Banker.Gen Trojan 19 Sep 2006
31. TR/Dldr.Zlob.Gen Trojan 19 Sep 2006
32. TR/Crypt.FKM.Gen Trojan 19 Sep 2006
33. TR/Proxy.Horst.Gen Trojan 19 Sep 2006
34. TR/Rootkit.Gen Trojan 19 Sep 2006
35. DR/Shelled.Gen Dropper 19 Sep 2006
36. TR/Java.Downloader.Gen Trojan 19 Sep 2006
37. TR/Delphi.Downloader.Gen Trojan 19 Sep 2006
38. TR/Crypt.F.Gen Trojan 19 Sep 2006
39. DR/Delphi.Gen Dropper 19 Sep 2006
40. TR/Vundo.Gen Trojan 19 Sep 2006
41. HTML/Feebs.Gen Malware 09 Feb 2006
42. Worm/Sober.Gen Worm 30 Jan 2006
43. Worm/Bagle.Gen Worm 29 Jan 2006
44. Worm/Roron.Gen Worm 15 Jun 2004
45. W95/Hybris.Gen.3 Malware 15 Jun 2004
46. W95/Hybris.Gen.2 Malware 15 Jun 2004
47. W95/Hybris.Gen.1 Malware 15 Jun 2004
