查看完整版本: V8 引擎更新集中帖

V8 引擎更新集中帖

[img]http://www.wilderssecurity.com/attachment.php?attachmentid=199240&stc=1&d=1208187777[/img]

V8引擎的第一次升级8.01.00.32
- Added: EMF exploit detection
   EXP/CVE-2008-1087
   EXP/EMF.Damaged
- Updated: Heuristic detections
   HEUR/HTML.Malware
   HEUR/Exploit.HTML
- Fixed: false positives
   HEUR/HTML.Malware
   HEUR/Exploit.HTML
   EXP/CVE-2006-453

[[i] 本帖最後由 skyboy1101 於 2008-4-25 18:22 編輯 [/i]]

新的引擎版本号是AV8 8.1.0.32 (2008-4-19)
以下是已做的改变：
- 增加: EMF 使用侦测
EXP/CVE-2008-1087
EXP/EMF.Damaged
- 更新: 启发式侦测
HEUR/HTML.Malware
HEUR/Exploit.HTML
- 修正: 误报
HEUR/HTML.Malware
HEUR/Exploit.HTML
EXP/CVE-2006-453

This is the version number of the new engine:
AV7 7.8.0.10 / AV8 8.1.0.35  (25 Apr 2008)


The following changes were done:

-  更新: 启发和基因侦测
   HEUR/HTML.Malware
   HEUR/Exploit.HTML
   HTML/Shellcode.Gen
   ADSPY/AdSpy.Gen
   BDS/Backdoor.Gen
   DR/Delphi.Gen
   TR/BHO.Gen
   TR/Crypt.CFI.Gen
   TR/Crypt.ULPM.Gen
   TR/Crypt.XDR.Gen
   TR/Crypt.XPACK.Gen
   TR/Dldr.Delphi.Gen
   TR/Downloader.Gen
   TR/Dropper.Gen
   TR/Hijacker.Gen
   TR/PWS.Sinowal.Gen
   TR/Proxy.Gen
   TR/Rootkit.Gen
   TR/Spy.Banker.Gen
   TR/Spy.Gen
   TR/Vundo.Gen
   WORM/Bagle.Gen
   WORM/Zhelatin.Gen
   
- 修正: 误报
   HEUR/HTML.Malware
   HEUR/Exploit.HTML
   HEUR/Malware

[img]http://i283.photobucket.com/albums/kk316/skyboy7001/0-18.jpg?t=1209466504[/img]

         
There was an Engine Update today.
The version number of the new engine is AV8 8.1.0.36.

The following changes have been done:
- Updated: Improvements and fixes in ARJ, BZ2, CAB, LHA, RAR, ZIP,
MSCompress and ZOO.

Engine Update Notification (Engine AV7 7.8.0.11 / AV8 8.1.0.37)
引擎更新（V7 7.8.0.11/V8 8.1.0.37）
-修复：误报
   HEUR/HTML.Malware
   HEUR/Exploit.HTML
   HEUR/ELF.Malformed
   HEUR/Malware

[img]http://i283.photobucket.com/albums/kk316/skyboy7001/1-12.jpg[/img]
Engine Update AV8 8.1.0.39 / AV7 7.8.0.14 (2008-05-07)

The following changes have been done:
- Added: Detection of polymorphic viruses

      W32/DunDun
      W32/Sality
      W32/Zazel.A
      W32/Vorcan

新的引擎版本号为：AV8 8.1.0.42 / AV7 7.8.0.17[09/05/08]

引擎做了如下改变：
- 新增: 通用基因侦测
TR/ATRAPS.Gen

- 更新： 启发式和通用基因检测
ADSPY/AdSpy.Gen
BDS/Backdoor.Gen
BDS/Hupigon.Gen
DR/Delphi.Gen
DR/Dldr.DnsChanger.Gen
DR/PcClient.Gen
DR/Shelled.Gen
TR/BHO.Gen
TR/Crypt.CFI.Gen
TR/Crypt.Morphine.Gen
TR/Crypt.NSPI.Gen
TR/Crypt.NSPM.Gen
TR/Crypt.ULPM.Gen
TR/Crypt.TPM.Gen
TR/Crypt.XPACK.Gen
TR/Dldr.Delphi.Gen
TR/Dldr.Swizzor.Gen
TR/Downloader.Gen
TR/Dropper.Gen
TR/Hijacker.Gen
TR/Proxy.Gen
TR/Rootkit.Gen
TR/Spy.Gen
TR/Vundo.Gen
WORM/Bagle.Gen
HTML/RCE.Gen
HTML/Spoofing.Gen
HTML/Infected.WebPage.Gen
HEUR/Malware
HEUR/Crypted
HEUR/HTML.Malware
HEUR/Exploit.HTML

- 修正: 误报
HEUR/Malware
HEUR/HTML.Malware
HEUR/Exploit.HTML
HTML/Spoofing.Gen
HTML/Infected.WebPage.Gen

[img]http://i283.photobucket.com/albums/kk316/skyboy7001/0-48.jpg?t=1210877944[/img]

Engine Update AV8 8.1.0.46 / AV7 7.8.0.19 (2008-05-15)
- 更新： 启发式和通用基因检测
  ADSPY/AdSpy.Gen
  BDS/Backdoor.Gen
  DR/Delphi.Gen
  TR/ATRAPS.Gen
  TR/BHO.Gen
  TR/Crypt.XPACK.Gen
  TR/Dldr.Zlob.Gen
  TR/Dropper.Gen
  TR/Hijacker.Gen
  TR/Rootkit.Gen
  TR/Spy.Gen
  TR/Vundo.Gen
  HTML/Infected.WebPage.Gen
  HTML/Rce.Gen
  HTML/Crypted.Gen
  HEUR/HTML.Malware
  HEUR/Exploit.HTML

- 修正: 误报
  TR/ATRAPS.Gen
  TR/Backdoor.Gen
  TR/BHO.Gen
  TR/Downloader.Gen
  TR/Crypt.CFI.Gen
  TR/Crypt.NSPM.Gen
  TR/Crypt.ULPM.Gen
  TR/Crypt.XPACK.Gen
  TR/Dropper.Gen
  HTML/Infected.WebPage.Gen
  HTML/Rce.Gen
  HEUR/Malware
  HEUR/Crypted
  HEUR/HTML.Malware
  HEUR/Exploit.HTML

Engine Update AV8 8.1.0.49 / AV7 7.8.0.24 (2008-05-29)

[img]http://i283.photobucket.com/albums/kk316/skyboy7001/1-28.jpg?t=1212069957[/img]

The version number of the new engine is AV8 8.1.0.49 / AV7 7.8.0.24.

The following changes have been done:
- Added: Detection for Adobe Flash Player exploits
  EXP/Flash.Gen

- Updated: Heuristic and generic detections
  HTML/Infected.WebPage.Gen
  HTML/Rce.Gen
  HTML/Crypted.Gen
  HEUR/HTML.Malware
  HEUR/Exploit.HTML

- Fixed: False positives
  HTML/Infected.WebPage.Gen
  HTML/Rce.Gen
  HEUR/Crypted
  HEUR/HTML.Malware
  HEUR/Exploit.HTML
  HEUR/ELF.Malformed

(Engine AV7 7.8.0.25 / AV8 8.1.0.50), 30 May 2008

[img]http://i283.photobucket.com/albums/kk316/skyboy7001/1-34.jpg?t=1212154202[/img]

This is the version number of the new engine:
AV7 7.8.0.25 / AV8 8.1.0.50


The following changes were done:

- Added: Detection for malicious Adobe Flash Player files
  HTML/FlashFrame.Gen

- Updated: Heuristic and generic detections
  HTML/Crypted.Gen
  HEUR/HTML.Malware
  EXP/Flash.Gen


HTML/FlashFrame.Gen
************************

A generic routine designed to detect malicious IFRAMEs attached toAdobe Flash Files. These can for example be added to otherwiselegitimate Flash files as a result of automated hacker attacks on webservers.

(Engine AV7 7.8.0.26 / AV8 8.1.0.51), 30 May 2008

[img]http://i283.photobucket.com/albums/kk316/skyboy7001/1-36.jpg?t=1212177902[/img]
This is the version number of the new engine:
AV7 7.8.0.26 / AV8 8.1.0.51


The following changes were done:

- Updated: Heuristic and generic detections
  EXP/Flash.Gen

(Engine AV7 8.1.0.55 / AV8 8.1.0.55), 6 Jun 2008

This is the version number of the new engine:
AV7 8.1.0.55 / AV8 8.1.0.55  

The following changes were done:
- Updated: Heuristic and generic detections  
EXP/Flash.Gen  
HTML/Shellcode.Gen  
HEUR/HTML.Malware  
W32/Sality

- Fixed: False positives  
TR/Crypt.XPACK.Gen  
TR/Dropper.Gen  
HTML/ADODB.Exploit.Gen  
HTML/Infected.WebPage.Gen  
HTML/Spoofing.Gen  
EXP/MS06-001.WMF  
HEUR/HTML.Malware  
HEUR/ELF.Malformed

avira官方引擎版本公布有误
昨晚，avira再次更新引擎。
我第一时间去看了一下。发现公布为这样：
Engine Update AV8   8.1.0.55 / AV7   8.1.0.55 (2008-06-06)

当时我就在群里说估计是德国人又犯错误了。因为针对AV7版本，其引擎版本应该是7.8.0.xx。
为了验证此问题，我于7日凌晨下载了其已经更新了的离线包。发现其v7引擎果然是7.8.0.55

v7专业升级包我立即制作，早晨发布。有需要下载的请去查看我的v7专帖。
特此帮avira更正说明，希望他们自己能发现此问题。

This is the version number of the new engine:
AV7 7.8.1.11 / AV8 8.1.1.11


The following changes were done:

- - Updated: Heuristic and generic detections
  HEUR/HTML.Malware
  HEUR/Malware
  TR/Vundo.Gen

- - Fixed: False positives
  DR/OLE.HiddenExe.Gen
  HEUR/HTML.Malware
  HEUR/Malware
  HTML/ADODB.Exploit.Gen
  HTML/Rce.Gen
  HTML/Spoofing.Gen

Engine Update AV8 8.1.1.12 / AV7 7.8.1.12 (24.07.2008)

[url=http://forum.avira.com/wbb/index.php?page=Thread&threadID=71947]The new engine, the version number AV8 8.1.1.12 / AV7 7.8.1.12.[/url]
There are the following changes:
-- - Added: detection of polymorphic viruses
W32/Sality.AH

-- - Updated: Heuristic and generic detection
HEUR/malware
TR/Vundo.Gen

-- - Fixed: false positive
HEUR/malware

Engine Update AV8 8.1.1.15 / AV7 7.8.1.15 (31.07.2008)

[url=http://forum.avira.com/wbb/index.php?page=Thread&postID=657689]The new engine, the version number AV8 8.1.1.15 / AV7 7.8.1.15.[/url]

There are the following changes:
-- - Updated: detection of polymorphic viruses
W32/Sality

-- - Fixed: false positive
HEUR/HTML.Malware
HEUR/HTML/Infected.WebPage.Gen

Engine Update AV8 8.1.1.19 / AV7 7.8.1.19 (06.08.2008)

[url=http://forum.avira.com/wbb/index.php?page=Thread&threadID=72699]The new engine, the version number AV8 8.1.1.19 / AV7 7.8.1.19.[/url]

There are the following changes:
-- - Added: generic detection
SPR/ASF.GetCodec.Gen

-- - Updated: detection of polymorphic viruses
W32/Sality.J
W32/Sality.Y

-- - Updated: Heuristic and generic detection
ADSPY/AdSpy.Gen
BDS/Backdoor.Gen
BDS/Hupigon.Gen
DR/Delphi.Gen
DR/Dldr.DnsChanger.Gen
DR/Zlob.Gen
TR/ATRAPS.Gen
TR/BHO.Gen
TR/Crypt.CFI.Gen
TR/Crypt.FKM.Gen
TR/Crypt.Morphine.Gen
TR/Crypt.PEPM.Gen
TR/Crypt.TPM.Gen
TR/Crypt.XPACK.Gen
TR/Dldr.Delphi.Gen
TR/Dldr.Zlob.Gen
TR/Downloader.Gen
TR/Dropper.Gen
TR/Hijacker.Gen
TR/PWS.Sinowal.Gen
TR/Rootkit.Gen
TR/Spy.Gen
TR/Vundo.Gen
WORM/Bagle.Gen
HEUR/HTML.Malware
HTML/Rce.Gen
HTML/Malicious.ActiveX.Gen
HTML/Downloader.Gen
HTML/Spoofing.Gen
HTML/Crypted.Gen
HTML/Infected.WebPage.Gen
HTML/Silly.Gen
HTML/Shellcode.Gen

-- - Fixed: false positive
HEUR/HTML.Malware
HTML/Infected.WebPage.Gen
HTML/Rce.Gen

Engine Update AV8 8.1.1.23 / AV7 7.8.1.23 (2008-08-18)

The version number of the new engine is [url=http://forum.avira.com/wbb/index.php?page=Thread&threadID=73286]AV8 8.1.1.23 / AV7 7.8.1.23.[/url]

The following changes have been done:
- - Updated: Detection of polymorphic viruses
W32/Sality.Z

- - Updated: Improved detection for PDF Exploits

- - Updated: Heuristic and generic detections
HEUR/HTML.Malware
HTML/Spoofing.Gen
HTML/Silly.Gen
TR/Crypt.XPACK.Gen
TR/Dropper.Gen
TR/Dldr.Swizzor.Gen

- - Fixed: False positives
HEUR/HTML.Malware
HTML/Spoofing.Gen
HTML/Silly.Gen

Engine Update AV8 8.1.1.28 / AV7 7.8.1.28 (2008-09-03)


这次更新包含以下内容:
- - 修复: 误报
HEUR/Malware
HEUR/HTML.Malware
HTML/Spoofing.Gen
HTML/ADODB.Exploit.Gen
HTML/Zones.Gen
HTML/Rce.Gen
HTML/Silly.Gen
HTML/Infected.WebPage.Gen

- - 修复: 特定压缩配置下可能导致的文件处理泄露

The version number of the new engine is AV8 8.1.1.34 / AV7 7.8.1.34.

The following changes have been done:
- Added: Generic detection
GAME/Casino.Gen

- Updated: Heuristic and generic detections
DIAL/Dialer.Gen
BDS/Backdoor.Gen
BDS/Bifrose.Gen
DIAL/Dialer.Gen
DR/Delphi.Gen
DR/MicroJoiner.Gen
TR/ATRAPS.Gen
TR/BHO.Gen
TR/Crypt.CFI.Gen
TR/Crypt.FKM.Gen
TR/Crypt.TPM.Gen
TR/Crypt.ULPM.Gen
TR/Crypt.XDR.Gen
TR/Crypt.XPACK.Gen
TR/Crypt.FSPM.Gen
TR/Crypt.PEPM.Gen
TR/Dldr.Delphi.Gen
TR/Dldr.Swizzor.Gen
TR/Dldr.Zlob.Gen
TR/Downloader.Gen
TR/Dropper.Gen
TR/Hijacker.Gen
TR/Rootkit.Gen
TR/Spy.Banker.Gen
TR/Spy.Gen
TR/Vundo.Gen
WORM/Bagle.Gen
WORM/Zhelatin.Gen
HTML/Crypted.Gen
HEUR/HTML.Malware

- Fixed: False positives
HEUR/HTML.Malware
HTML/ADODB.Exploit.Gen

[img]http://i283.photobucket.com/albums/kk316/skyboy7001/0-89.jpg?t=1222276280[/img]
This is the version number of the new engine:
AV8 8.1.1.35 / AVPACK7 7.6.1.7


The following changes were done:

- Improved: Parsing of MIME files.
- Fixed: Specially crafted CHM files could cause crash in unpacking engine

很久 引擎没升级啦:fdqyt:

Engine Update AV8 8.2.0.4 / AV7 7.9.0.4 (2008-10-15)
There was an Engine Update today.

The version number of the new engine is AV8 8.2.0.4 / AV7 7.9.0.4.

The following changes have been done:
- Added: Performance improvements

- Added: Detection of polymorphic viruses
W32/KME.Gen

- Added: Heuristic and generic detections
DR/FakePic.Gen
DR/Gifar.Gen

- Updated: Detection of polymorphic viruses
W32/Virut.Gen

- Updated: Heuristic and generic detections
HTML/Shellcode.Gen (PDF exploits)

- Updated: Renamed SPR/ASF.GetCodec.Gen to EXP/ASF.GetCodec.Gen

- Fixed: False positives
HEUR/Elf.Malware
HEUR/HTML.Malware
HEUR/Spoofing.Gen

[quote]原帖由 [i]skyboy1101[/i] 於 2008-10-15 14:01 發表 [url=http://www.avpclub.ddns.info/discuz/redirect.php?goto=findpost&pid=114465&ptid=10150][img]http://www.avpclub.ddns.info/discuz/images/common/back.gif[/img][/url]
很久 引擎没升级啦:fdqyt:

Engine Update AV8 8.2.0.4 / AV7 7.9.0.4 (2008-10-15)
There was an Engine Update today.

The version number of the new engine is AV8 8.2.0.4 / AV7 7.9.0.4.
... [/quote]
The version number of the new engine is AV8 8.2.0.4 / AV7 7.9.0.4.

The following changes have been done:
- 改善了扫描效率

- 增加对以下变形病毒检测
W32/KME.Gen

- 增加以下启发式/通用检测
DR/FakePic.Gen
DR/Gifar.Gen

- 更新对以下变形病毒检测
W32/Virut.Gen

- 更新以下启发式和通用检测
HTML/Shellcode.Gen (PDF exploits)

- 更新，将SPR/ASF.GetCodec.Gen修改为EXP/ASF.GetCodec.Gen

- 修正以下误报
HEUR/Elf.Malware
HEUR/HTML.Malware
HEUR/Spoofing.Gen

Engine Update AV8 8.2.0.5 / AV7 7.9.0.5 (2008-10-16)

There was an Engine Update today.

The version number of the new engine is AV8 8.2.0.5 / AV7 7.9.0.5.

The following changes have been done:
- Fixed: False positives
HEUR/HTML.Malware

Engine Update AV8 8.2.0.7 / AV7 7.9.0.7 (2008-10-23)

The version number of the new engine is [url=http://forum.avira.com/wbb/index.php?page=Thread&threadID=76388]AV8 8.2.0.7 / AV7 7.9.0.7[/url].

The following changes have been done:
- Updated: Heuristic and generic detections
ADSPY/AdSpy.Gen
BDS/Backdoor.Gen
BDS/Hupigon.Gen
DIAL/Dialer.Gen
DR/Delphi.Gen
DR/Dldr.DnsChanger.Gen
DR/Zlob.Gen
GAME/Casino.Gen
HEUR/Malware
SPR/mIRC.Gen
TR/ATRAPS.Gen
TR/BHO.Gen
TR/Crypt.ASPM.Gen
TR/Crypt.CFI.Gen
TR/Crypt.FKM.Gen
TR/Crypt.PEPM.Gen
TR/Crypt.TPM.Gen
TR/Crypt.ULPM.Gen
TR/Crypt.UPKM.Gen
TR/Crypt.XDR.Gen
TR/Crypt.XPACK.Gen
TR/Dldr.Delphi.Gen
TR/Dldr.Swizzor.Gen
TR/Dldr.Zlob.Gen
TR/Downloader.Gen
TR/Dropper.Gen
TR/Rootkit.Gen
TR/Spy.Gen
TR/Vundo.Gen
WORM/Bagle.Gen

- Fixed: False positives
HEUR/Malware

馬上又更新.....:fdqyt:
訂電子報收到的

This is the version number of the new engine:
AV7 7.9.0.9 / AV8 8.2.0.9


The following changes were done:

- Fixed: False positive
  DR/Gifar.Gen

[[i] 本帖最後由 megakotaro 於 2008-10-24 23:27 編輯 [/i]]

最近每当更新过后的第2天终是有第2次更新:fdqyt: 感谢提醒更新

Guard跟Scheduler 10/24也更新了，不過不知道內容為何。

Engine Update AV8 8.2.0.10 / AV7 7.9.0.10 (2008-10-28)

There was an Engine Update today.

The version number of the new engine is AV8 8.2.0.10 / AV7 7.9.0.10.

The following changes have been done:
- Fixed: Internal setting of archive recursion limit

Engine Update AV8 8.2.0.26 / AV7 7.9.0.26 (2008-11-05)

The version number of the new engine is AV8 8.2.0.26 / AV7 7.9.0.26.

The following changes have been done:
- Updated: Detection of polymorphic viruses
W32/Virut.Gen

- Fixed: False positives
HEUR/Malware
HEUR/HTML.Malware
HTML/Silly.Gen
HTML/Infected.WebPage.Gen
HTML/Rce.Gen
HTML/Crypted.Gen
HTML/ADODB.Exploit.Gen
HTML/Spoofing.Gen
HTML/Downloader.Gen
HTML/Psyme.Gen
HTML/Feebs.Gen
HTML/MHT.Gen

Engine Update AV8 8.2.0.29 / AV7 7.9.0.29 (2008-11-07)

The version number of the new engine is AV8 8.2.0.29 / AV7 7.9.0.29.

The following changes have been done:
- Added: Repair for W32/Alman.BB

- Updated: Heuristic and generic detections
ADSPY/AdSpy.Gen
BDS/Backdoor.Gen
BDS/Hupigon.Gen
DIAL/Dialer.Gen
DR/Delphi.Gen
DR/Zlob.Gen
GAME/Casino.Gen
SPR/mIRC.Gen
TR/ATRAPS.Gen
TR/BHO.Gen
TR/Crypt.ASPM.Gen
TR/Crypt.CFI.Gen
TR/Crypt.FKM.Gen
TR/Crypt.MWPM.Gen
TR/Crypt.NSPM.Gen
TR/Crypt.PEPM.Gen
TR/Crypt.TPM.Gen
TR/Crypt.ULPM.Gen
TR/Crypt.UPKM.Gen
TR/Crypt.XPACK.Gen
TR/Dldr.Delphi.Gen
TR/Dldr.DnsChanger.Gen
TR/Dldr.Swizzor.Gen
TR/Dldr.Zlob.Gen
TR/Downloader.Gen
TR/Dropper.Gen
TR/Hijacker.Gen
TR/PWS.Sinowal.Gen
TR/Rootkit.Gen
TR/Spy.Banker.Gen
TR/Spy.Gen
TR/Vundo.Gen
WORM/Bagle.Gen

- Fixed: False positives
HEUR/Malware
HEUR/ELF.Malformed

Avira Newsletter (Engine AV7 7.9.0.30 / AV8 8.2.0.30), 11 Nov 2008

This is the version number of the new engine:
AV7 7.9.0.30 / AV8 8.2.0.30


The following changes were done:

- Fixed: False positives
  HEUR/HTML.Malware
  HTML/Infected.WebPage.Gen

- Fixed: Endless loop in NSIS files

今天早上點了一下紅傘更新，因為要測樣本，結果居然更新了，嚇一跳，因為昨天半夜已經是德國當地最後發布的病毒碼了，原來引擎又更新了。

This is the version number of the new engine:
AV7 7.9.0.31 / AV8 8.2.0.31


The following changes were done:

- Fixed: False positive
  HTML/Spoofing.Gen

UPDATE AGAIN:'( 最近更新过后好像出现很多误报:'(

更新了RELEASED NOTE 還沒出來
[img]http://img355.imageshack.us/img355/1673/imageputscreenshotzz1.jpg[/img][img]http://img201.imageshack.us/img201/597/imageputscreenshottr5.jpg[/img][img]http://img201.imageshack.us/img201/8601/imageputscreenshotde9.jpg[/img]

We would like to announce you that a new Avira engine update took place.

This is the version number of the new engine:
AV7 7.9.0.34 / AV8 8.2.0.34


The following changes were done:

- Updated: PDF exploit detection
  HEUR/PDF.Obfuscated