MD5: 546DA8

自由

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\样本.rar'
C:\Documents and Settings\Administrator\My Documents\
  样本.rar
  样本.rar:Zone.Identifier
    [0] Archive type: RAR
    --> Xorer.exe
        [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

傻猪猪米走鸡

E:\virus\样本2.16 » RAR » Xorer.exe - probably a variant of Win32/Genetik trojan - was a part of the deleted object
E:\virus\样本2.16 - probably a variant of Win32/Genetik trojan - deleted - quarantined

sb

瑞星反正挂了

woai_jolin

看看主防挂没有挂

Scan Log
Version of virus signature database: 2880 (20080215)
Date: 2008/2/16  Time: 13:06:07
Scanned disks, folders and files: G:\v\样本.rar
G:\v\样本.rar » RAR » Xorer.exe - probably a variant of Win32/Genetik trojan - was a part of the deleted object
Number of scanned objects: 2
Number of threats found: 1
Time of completion: 13:06:08  Total scanning time: 1 sec (00:00:01)

spatra

微点无视

啊弥陀佛

微点砍掉

spatra

LS什么版本，我的预升级没报

gho

卡巴，咖啡miss

sharkkong

呵呵，卡巴还有主防呢，呵呵，是磁碟机吧
2008-2-16 13:44:36 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 可疑操作，试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL  值:  数据:)。
2008-2-16 13:44:47 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL  值:  数据:)被允许。
2008-2-16 13:44:48 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 可疑操作，试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI  值:  数据:)。
2008-2-16 13:44:56 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI  值:  数据:)被允许。
2008-2-16 13:44:56 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 可疑操作，试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS  值:  数据:)。
2008-2-16 13:45:04 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS  值:  数据:)被允许。
2008-2-16 13:45:05 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 可疑操作，试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents  值:  数据:)。
2008-2-16 13:45:07 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 试图删除系统启动时的自动执行模块列表 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Run\OptionalComponents  值:  数据:)被允许。
2008-2-16 13:45:09 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 可疑操作，试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced  值:ShowSuperHidden  数据:0x00000000 (0))。
2008-2-16 13:45:11 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced  值:ShowSuperHidden  数据:0x00000000 (0))被允许。
2008-2-16 13:45:12 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 可疑操作，试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer  值:NoDriveTypeAutoRun  数据:0x00000091 (145))。
2008-2-16 13:45:14 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer  值:NoDriveTypeAutoRun  数据:0x00000091 (145))被允许。
2008-2-16 13:45:15 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 可疑操作，试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden  值:Type  数据:72 00 61 00 64 00 69 00 6f 00 00 00 6f 00 78 00 00 00 00 00 62 00 00 00 6f 00 00 00 78 00 00 00 00 00 00 00 57 00 69 00 6e 00 52 00 41 00 52 00 5c 00 57 00 69 00 6e 00 52 00 41 00 52 00 2e 00 65 00 78 00 65 00 22 00 20 00 22 00 25 00 31 00 22 00 00 00 52 00 00 00 41 00 00 00 52 00 00 00 5c 00 00 00 57 00 00 00 69 00 00 00 6e 00 00 00 52 00 00 00 41 00 00 00 52 00 00 00 2e 00 00 00 65 00 00 00 78 00 00 00 65 00 00 00 22 00 00 00 20 00 00 00 22 00 00 00 25 00 00 00 31 00 00 00 22 00 00 00 00 00 00 00 52 00 00 00 45 00 00 00 2e 00 00 00 45 00 00 00 58 00 00 00 45 00 00 00 22 00 00 00 20 00 00 00 25 00 00 00 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)。
2008-2-16 13:45:18 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 试图创建计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\machine\software\microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden  值:Type  数据:72 00 61 00 64 00 69 00 6f 00 00 00 6f 00 78 00 00 00 00 00 62 00 00 00 6f 00 00 00 78 00 00 00 00 00 00 00 57 00 69 00 6e 00 52 00 41 00 52 00 5c 00 57 00 69 00 6e 00 52 00 41 00 52 00 2e 00 65 00 78 00 65 00 22 00 20 00 22 00 25 00 31 00 22 00 00 00 52 00 00 00 41 00 00 00 52 00 00 00 5c 00 00 00 57 00 00 00 69 00 00 00 6e 00 00 00 52 00 00 00 41 00 00 00 52 00 00 00 2e 00 00 00 65 00 00 00 78 00 00 00 65 00 00 00 22 00 00 00 20 00 00 00 22 00 00 00 25 00 00 00 31 00 00 00 22 00 00 00 00 00 00 00 52 00 00 00 45 00 00 00 2e 00 00 00 45 00 00 00 58 00 00 00 45 00 00 00 22 00 00 00 20 00 00 00 25 00 00 00 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)被允许。
2008-2-16 13:45:19 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 可疑操作，试图删除计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C749DF39-AADA-4507-A1CB-21EA09151AE3}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer  值:  数据:)。
2008-2-16 13:45:20 进程 C:\Sandbox\紫枫\DefaultBox\user\current\Local Settings\Temp\Rar$EX01.906\Xorer.exe （PID: 3208）: 试图删除计算机安全设置 (键:HKEY_USERS\SANDBOX_紫枫_DEFAULTBOX\user\current\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C749DF39-AADA-4507-A1CB-21EA09151AE3}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer  值:  数据:)被允许。
2008-2-16 13:45:45 进程  （PID 3208） 试图访问卡巴斯基反病毒软件进程（PID 1612），该操作已被自我保护功能阻止，您不需要采取任何动作。
2008-2-16 13:45:45 进程  （PID 3208） 试图访问卡巴斯基反病毒软件进程（PID 264），该操作已被自我保护功能阻止，您不需要采取任何动作。
2008-2-16 13:46:02 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\Com\netcfg.dll//PE_Patch.UPX//UPX: 检测到病毒
“Virus.Win32.Xorer.du”。
2008-2-16 13:46:02 已检测到安全威胁，建议您立即进行处理。
2008-2-16 13:46:19 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\Com\netcfg.dll: 已删除。
2008-2-16 13:46:30 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\smss.exe: 检测到病毒
“Virus.Win32.Xorer.dt”。
2008-2-16 13:46:30 已检测到安全威胁，建议您立即进行处理。
2008-2-16 13:46:35 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\netcfg.000//PE_Patch.UPX//UPX: 检测到病毒
“Virus.Win32.Xorer.du”。
2008-2-16 13:46:39 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\smss.exe: 已删除。
2008-2-16 13:46:40 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\Com\netcfg.000//PE_Patch.UPX//UPX: 检测到病毒
“Virus.Win32.Xorer.du”。
2008-2-16 13:46:45 进程  （PID 3368） 试图访问卡巴斯基反病毒软件进程（PID 1612），该操作已被自我保护功能阻止，您不需要采取任何动作。
2008-2-16 13:46:45 进程  （PID 3368） 试图访问卡巴斯基反病毒软件进程（PID 264），该操作已被自我保护功能阻止，您不需要采取任何动作。
2008-2-16 13:46:56 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\com\netcfg.000: 已删除。
2008-2-16 13:46:56 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\Com\smss.exe: 检测到病毒
“Virus.Win32.Xorer.dt”。
2008-2-16 13:46:56 已检测到安全威胁，建议您立即进行处理。
2008-2-16 13:46:59 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\Com\netcfg.000: 已删除。
2008-2-16 13:46:59 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\Com\smss.exe: 已删除。
2008-2-16 13:47:00 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\dnsq.dll//PE_Patch.UPX//UPX: 检测到病毒
“Virus.Win32.Xorer.du”。
2008-2-16 13:47:00 已检测到安全威胁，建议您立即进行处理。
2008-2-16 13:47:05 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\dnsq.dll: 已删除。
2008-2-16 13:47:10 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\Com\netcfg.dll//PE_Patch.UPX//UPX: 检测到病毒
“Virus.Win32.Xorer.du”。
2008-2-16 13:47:10 已检测到安全威胁，建议您立即进行处理。
2008-2-16 13:47:15 文件 C:\Sandbox\紫枫\DefaultBox\drive\C\WINDOWS\system32\Com\netcfg.dll: 已删除。

[ 本帖最后由 sharkkong 于 2008-2-16 13:53 编辑 ]