深度號稱 (劲！微点克星！卡巴受不了。。) 的 磁碟機病毒

Nblock

   期待更强的新版573

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\Update.rar'
C:\Documents and Settings\Administrator\桌面\Update.rar
  [0] Archive type: RAR
  --> Update.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [INFO]      The file was deleted!

jhdcboy

费尔可以搞定

无尽藏海

D:\Downloads\样本\Update.rar » RAR » Update.exe - a variant of Win32/Xorer virus

欠妳緈諨

D:\病毒测试\未解压样本\Update.rar » RAR » Update.exe - a variant of Win32/Xorer virus

欠妳緈諨

Win32:Agent-PPS [Drp]

长空之鹰

KIS 7.0129 无视

长空之鹰

File Update.rar received on 01.15.2008 05:26:44 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED

Result: 15/32 (46.88%)

Loading server information...
Your file is queued in position: 4.
Estimated start time is between 47 and 68 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.

Compact
Print results

Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position:
) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.  

Email:

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.1.15.10	2008.01.14	-
AntiVir	7.6.0.46	2008.01.14	TR/Crypt.XDR.Gen
Authentium	4.93.8	2008.01.13	-
Avast	4.7.1098.0	2008.01.14	Win32:Agent-PPS
AVG	7.5.0.516	2008.01.14	Generic9.APEN
BitDefender	7.2	2008.01.15	-
CAT-QuickHeal	9.00	2008.01.14	-
ClamAV	0.91.2	2008.01.14	-
DrWeb	4.44.0.09170	2008.01.14	Trojan.Rox
eSafe	7.0.15.0	2008.01.14	suspicious Trojan/Worm
eTrust-Vet	31.3.5456	2008.01.14	-
Ewido	4.0	2008.01.14	-
FileAdvisor	1	2008.01.15	-
Fortinet	3.14.0.0	2008.01.15	-
F-Prot	4.4.2.54	2008.01.14	W32/BadBHO.A.gen!Eldorado
F-Secure	6.70.13030.0	2008.01.14	-
Ikarus	T3.1.1.20	2008.01.15	Virus.Win32.Agent.PPS
Kaspersky	7.0.0.125	2008.01.15	-
McAfee	5206	2008.01.14	W32/Fujacks
Microsoft	1.3109	2008.01.15	Virus:Win32/Xorer.A
NOD32v2	2791	2008.01.14	a variant of Win32/Xorer
Norman	5.80.02	2008.01.15	-
Panda	9.0.0.4	2008.01.14	Suspicious file
Prevx1	V2	2008.01.15	-
Rising	20.27.02.00	2008.01.14	-
Sophos	4.24.0	2008.01.14	Mal/Packer
Sunbelt	2.2.907.0	2008.01.15	-
Symantec	10	2008.01.15	W32.Pagipef.I!inf
TheHacker	6.2.9.187	2008.01.13	-
VBA32	3.12.2.5	2008.01.13	-
VirusBuster	4.3.26:9	2008.01.14	Packed/FSG
Webwasher-Gateway	6.6.2	2008.01.14	Trojan.Crypt.XDR.Gen

Additional information

File size: 389072 bytes

MD5: 968cc1af3e1457ebb1220e97a4b85adb

SHA1: 9a008780c7f6af6c3d89bf26939f9b78fb2628e2

PEiD: -

packers: UPX

packers: UPX

packers: UPX

packers: PE_Patch.UPX, UPX

Palkia

还轮不到微点呢~费尔的动态防御就报了~
危险进程(PID:692): C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.719\Update.exe

产品名称: 无
文件版本: 无
公司名称: 无
文件描述: 无
数字签名: 没有发现签名

危险级别: 中
级别评分: 36.408880
状态: 进程已被结束，但还没有清除，等待进一步处理。

建议: 如果能确认这个文件是安全的可以信任它，如果能确认是不安全的可以删除它，如果是正常的程序被意外的终止，可以暂时信任然后再重新运行一次。

如果无法确认它是否安全，建议使用在线扫描得到进一步的建议。

Nblock

那啥磁碟男。。  微点是你的克星