Skip to main content
Skip to main content
Microsoft Security Intelligence
Cart 0 items in shopping cart
Sign in
Published Jul 25, 2008 | Updated Sep 15, 2017

Virus:Win32/Xorer.R

Detected by Microsoft Defender Antivirus

Aliases: Win32/Diskgen.X (AhnLab) W32/Xorer.G (Command) Xorer.E (Norman) Win32.Xorer.P (VirusBuster) TR/Drop.Xorer.6181 (Avira) Win32.HLLP.Rox.17 (Dr.Web) Win32/Xorer.FB virus (ESET) Virus.Win32.Xorer (Ikarus) Virus.Win32.Xorer.fb (Kaspersky) W32/Xorer (McAfee) Mal/Xorer-A (Sophos) PE_PAGIPEF.BS (Trend Micro)

Summary

Virus:Win32/Xorer.R is a specific variant of the Xorer family of file infectors. It is a slow file infector, meaning that it lets a certain period of time pass between infecting files. It has worm capabilities by dropping copies of itself in writable drives. It also has rootkit components that enable it to avoid detection in an infected computer.

To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:

Disable Autorun functionality

This threat attempts to spread via removable drives on computers that support Autorun functionality. This is a particularly common method of spreading for many current malware families. For information on disabling Autorun functionality, please see the following article:
http://support.microsoft.com/kb/967715/

Additional remediation steps for this threat

This threat may make lasting changes to infected files that will NOT be restored by detecting and removing this threat. To return an infected computer to its pre-infected state, files infected by this threat must be restored from backup.

In some cases, files may become corrupted when infected by this malware, or by partial or incomplete removal of the malware by other security products. These damaged files should be replaced or restored from backup.

Follow us