Xorer

显示全部楼层 · 发表于 2008-3-14 09:29:41

AhnLab-V3 2008.3.14.0 2008.03.13 -
AntiVir 7.6.0.73 2008.03.13 TR/Drop.Xorer.C
Authentium 4.93.8 2008.03.13 -
Avast 4.7.1098.0 2008.03.13 Win32:Xorer-J
AVG 7.5.0.516 2008.03.13 Worm/AutoRun.AR
BitDefender 7.2 2008.03.14 -
CAT-QuickHeal 9.50 2008.03.13 -
ClamAV 0.92.1 2008.03.13 -
DrWeb 4.44.0.09170 2008.03.13 Win32.HLLP.Rox.origin
eSafe 7.0.15.0 2008.03.09 suspicious Trojan/Worm
eTrust-Vet 31.3.5613 2008.03.13 -
Ewido 4.0 2008.03.13 -
FileAdvisor 1 2008.03.14 -
Fortinet 3.14.0.0 2008.03.13 -
F-Prot 4.4.2.54 2008.03.13 -
F-Secure 6.70.13260.0 2008.03.14 -
Ikarus T3.1.1.20 2008.03.14 -
Kaspersky 7.0.0.125 2008.03.14 Heur.Trojan.Generic
McAfee 5251 2008.03.13 -
Microsoft 1.3301 2008.03.13 Virus:Win32/Xorer.F
NOD32v2 2946 2008.03.14 probably a variant of Win32/Xorer
Norman 5.80.02 2008.03.13 -
Panda 9.0.0.4 2008.03.13 Suspicious file
Prevx1 V2 2008.03.14 -
Rising 20.35.32.00 2008.03.13 -
Sophos 4.27.0 2008.03.14 -
Sunbelt 3.0.930.0 2008.03.05 -
Symantec 10 2008.03.14 -
TheHacker 6.2.92.245 2008.03.14 -
VBA32 3.12.6.2 2008.03.13 -
VirusBuster 4.3.26:9 2008.03.13 Win32.Xorer.Gen
Webwasher-Gateway 6.6.2 2008.03.13 Trojan.Drop.Xorer.C

显示全部楼层 · 发表于 2008-3-14 09:38:05

Starting the file scan:

Begin scan in 'F:\Virus\setup.rar'
F:\Virus\setup.rar
  [0] Archive type: RAR
--> setup.exe
   [1] Archive type: RAR SFX (self extracting)
   --> Setup.exe
      [DETECTION] Is the Trojan horse TR/Drop.Xorer.C
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-3-14 09:48:47

ESET
C:\Documents and Settings\GUNDAM\桌面\setup.rar » RAR » setup.exe » RAR » Setup.exe - probably a variant of Win32/Xorer virus

显示全部楼层 · 发表于 2008-3-14 10:12:57

ACCESS DENIED
The requested URL could not be retrieved

--------------------------------------------------------------------------------

While trying to retrieve the URL: http://bbs.kafan.cn/attachment.php?aid=219289

The folowing error was encountered:

The requested object is INFECTED. The following viruses Heur.Trojan.Generic were found

Please contact your service provider if you feel this is incorrect.

--------------------------------------------------------------------------------

Generated Fri Mar 14 10:13:50 2008 by Kaspersky Internet Security 7.0

卡巴能启发磁碟机

显示全部楼层 · 发表于 2008-3-14 10:18:05

又见磁碟机啊 ^_^

显示全部楼层 · 发表于 2008-3-14 10:26:09

木马程序生成以下文件:
1) D:\TEMP\RARSFX0\SETUP.EXE
是否删除木马程序及其衍生物?

显示全部楼层 · 发表于 2008-3-14 10:29:56

已上报ＦＳ！

显示全部楼层 · 发表于 2008-3-14 10:32:29

FS不认识？

显示全部楼层 · 发表于 2008-3-14 11:21:08

Hello,
Thank you for your e-mail.
The file you sent was found to be malicious.
An appropriate detection will be added in one of the next database updates.
Our latest database updates are available here:
http://www.f-secure.com/download-purchase/updates.shtml
Have a nice day!
FS速度呀!

[病毒样本] Xorer

本帖子中包含更多资源