第一次发样本（网上收集的）

mikzh

从网上收集的样本。其中几个我进行过分析，也比较有名的，虽然有点老，但是发上来共享一下。

328397663

2009-2-25 16:07:40        检测到威胁: Virus.Win32.Xorer.ew        C:\Documents and Settings\Administrator\桌面\磁碟机\setup.exe/PE_Patch.UPX/UPX               
2009-2-25 16:07:40        检测到威胁: Trojan-GameThief.Win32.OnLineGames.sbg        C:\Documents and Settings\Administrator\桌面\磁碟机\机器狗\病毒\AtiSrv.exe/PE_Patch/UPack               
2009-2-25 16:07:40        检测到威胁: Trojan-Downloader.Win32.Delf.epw        C:\Documents and Settings\Administrator\桌面\磁碟机\机器狗\病毒\baidu.exe/PE_Patch/UPack               
2009-2-25 16:07:45        已删除: Trojan-GameThief.Win32.OnLineGames.sbg        C:\Documents and Settings\Administrator\桌面\磁碟机\机器狗\病毒\AtiSrv.exe               
2009-2-25 16:07:45        已删除: Virus.Win32.Xorer.ew        C:\Documents and Settings\Administrator\桌面\磁碟机\setup.exe               
2009-2-25 16:07:45        已删除: Trojan-Downloader.Win32.Delf.epw        C:\Documents and Settings\Administrator\桌面\磁碟机\机器狗\病毒\baidu.exe               
2009-2-25 16:07:45        检测到威胁: Trojan-GameThief.Win32.OnLineGames.stw        C:\Documents and Settings\Administrator\桌面\磁碟机\机器狗\病毒\Display3D.exe/PE_Patch/UPack               
2009-2-25 16:07:45        已删除: Trojan-GameThief.Win32.OnLineGames.stw        C:\Documents and Settings\Administrator\桌面\磁碟机\机器狗\病毒\Display3D.exe               


上报熊猫烧香...`!

ledled

panda to VB

Sebastian

Starting the file scan:

Begin scan in 'D:\new\�ŵ��.rar'
D:\new\�ŵ��.rar
    [0] Archive type: RAR
    --> setup.exe
      [DETECTION] Is the TR/Xorer.174009 Trojan
    [NOTE]      A backup was created as '49a210fd.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
Begin scan in 'D:\new\熊猫烧香（加壳）.rar'
Begin scan in 'D:\new\机器狗'
D:\new\机器狗\病毒\AtiSrv.exe
      [DETECTION] Is the TR/PSW.OnlineGam.SEA Trojan
    [NOTE]      A backup was created as '4a0e0ffc.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\机器狗\病毒\baidu.exe
      --> Object
        [1] Archive type: RSRC
        --> Object
          [DETECTION] Is the TR/Dldr.Delf.epw.1 Trojan
    [NOTE]      A backup was created as '4a0e0fe9.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!
D:\new\机器狗\病毒\Display3D.exe
      [DETECTION] Is the TR/PSW.OnlineGam.SEA Trojan
    [NOTE]      A backup was created as '4a180ff2.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!


End of the scan: 2009年2月25日  17:29
Used time: 00:07 Minute(s)

The scan has been done completely.

      2 Scanning directories
      7 Files were scanned
      4 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      4 files were deleted
      0 files were repaired
      4 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      3 Files not concerned
      2 Archives were scanned
      0 Warnings
      4 Notes

Sebastian

熊猫烧香
DAMAGED FILE (UNKNOWN)

leonfg

C:\Documents and Settings\GUNDAM\桌面\磁碟机.rar » RAR » setup.exe - Win32/Xorer virus
C:\Documents and Settings\GUNDAM\桌面\机器狗.rar » RAR » 机器狗\病毒\AtiSrv.exe - Win32/TrojanDownloader.Agent.NWA trojan
C:\Documents and Settings\GUNDAM\桌面\机器狗.rar » RAR » 机器狗\病毒\baidu.exe - a variant of Win32/TrojanDownloader.Delf.OBY trojan
C:\Documents and Settings\GUNDAM\桌面\机器狗.rar » RAR » 机器狗\病毒\Display3D.exe - a variant of Win32/TrojanDownloader.Agent.NWE trojan
同样不报熊猫

黑衣~魂

DR.WEB kill all
setup.exe - infected with Win32.HLLP.Rox.21
机器狗\病毒\AtiSrv.exe - infected with Trojan.DownLoader.49495
机器狗\病毒\baidu.exe - infected with Trojan.DownLoader.49224
机器狗\病毒\Display3D.exe - infected with Trojan.DownLoader.47705

熊貓燒香加殼~檔案是無效PE文件
http://www.virustotal.com/analis ... 73bd039562995165cec
不用TO浪費時間,看誰鞭屍

Palkia

1个是损坏文件

wcj20236

熊猫烧香是死的。微点无视。    其余歼灭。










[ 本帖最后由 wcj20236 于 2009-2-25 19:23 编辑 ]

johnny01