MD5: 36B05F

自由

磁碟机的变种，在我硬盘有一段时间了。能报是正常的，不报的上报。
挂磁碟机的地方据我所知不少于4个。我重装系统都没了。不要问我我也不知道在那了。想找自己挖吧。
最后一个，以后不发了。

[ 本帖最后由 自由 于 2008-1-13 11:22 编辑 ]

Graybird

Starting the file scan:

Begin scan in 'E:\����.rar'
E:\����.rar
  [0] Archive type: RAR
  --> lsass.exe
      [DETECTION] Is the Trojan horse TR/Xorer.DF.2
  --> pagefile.pif
      [DETECTION] Is the Trojan horse TR/Xorer.DF.2
      [INFO]      The file was deleted!

redvoilin

eav3.0

zwl2828

C:\Users\Wesley\Downloads\桌面.rar
  [0] Archive type: RAR
  --> lsass.exe
      [DETECTION] Is the Trojan horse TR/Xorer.DF.2
  --> pagefile.pif
      [DETECTION] Is the Trojan horse TR/Xorer.DF.2

冷冷

衍生物 [MD5: 744969 ECC52A D41D8C 3F51B8 D3777F 8E3369 C08BA4 106B53 36B05F]

PS：不小心按错键了。。。

[ 本帖最后由 冷_冷 于 2008-1-13 12:00 编辑 ]

Graybird

Starting the file scan:

Begin scan in 'E:\Sample.rar'
E:\Sample.rar
  [0] Archive type: RAR
  --> smss.exe
      [DETECTION] Is the Trojan horse TR/Xorer.DF.2
  --> ~
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
  --> netcfg.dll
      [DETECTION] Is the Trojan horse TR/BHO.adz
  --> AUTORUN.INF
      [DETECTION] Is the Trojan horse TR/Harnig.WA
  --> 037589.log
      [DETECTION] Is the Trojan horse TR/Xorer.DF.2
      [WARNING]   The file was ignored!

The file 'pagefile.pif' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

The file 'NetApi00.sys' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

Nblock

0037可以试试看

[ 本帖最后由 Nblock 于 2008-1-14 10:07 编辑 ]

观弈书童

lsass.exe - Win32/Xorer 病毒的变种
pagefile.pif - Win32/Xorer 病毒的变种

scottxzt

LZ的那个运行就直接重起系统.微点挂了

Nblock 给个密码.
.

leonfg

原帖由 冷_冷 于 2008-1-13 11:57 发表
183445183446183447183448183449183450183451183452

183453 衍生物 [MD5: 744969 ECC52A D41D8C 3F51B8 D3777F 8E3369 C08BA4 106B53 36B05F]

PS：不小心按错键了。。。  

C:\Documents and Settings\GUNDAM\桌面\Sample.rar » RAR » ~ - a variant of Win32/Xorer virus
C:\Documents and Settings\GUNDAM\桌面\Sample.rar » RAR » AUTORUN.INF - INF/Autorun virus
C:\Documents and Settings\GUNDAM\桌面\Sample.rar » RAR » 037589.log - a variant of Win32/Xorer virus