番茄某帖挖的[MD5: 9E0C7C 54ECEC 4A2FE5 E5137F E18A86 D89719 678432]

promised

FBAV

风暴胜者V2 贺岁精简网络版本
_________您的安全是我们的责任_______________
作者：Sanhuan222@163.com   TM:469428271
个人Blog：http://hi.baidu.com/迅者/

===============================================
   ___________病毒查杀结果__________________

===============================================
2007年5月9日13时10分56秒 开始查杀C:\Documents and Settings\Administrator\桌面\virus\C444
****************************
您应该引起注意的文件:
-----------------------------------------

=========================================
_________文件性质分析结果________________
"带壳"仅指文件性质,仅供专业人员分析使用。

-----------------------------------------
2007年5月9日13时10分56秒收起线程…100% 查杀完毕！
扫描文件：8查杀病毒：0

[ 本帖最后由 FBAV 于 2007-8-9 13:11 编辑 ]

xxwpk007

已检测到: 木马程序 Backdoor.Win32.RAdmin.j        文件: G:\样本\C\AdmDll.dll
已检测到: 病毒 Email-Worm.Win32.Bagle.it        文件: G:\样本\C\dxinstall.exe//PE_Patch.Morphine//Morphine
已检测到: 病毒 Email-Worm.Win32.Bagle.it        文件: G:\样本\C\mdmi386.exe//PE_Patch.Morphine//Morphine
已检测到: 病毒 Packed.Win32.Morphine.a (变种)        文件: G:\样本\C\mshelper.exe
已检测到: 木马程序 Backdoor.Win32.RA-based.ag        文件: G:\样本\C\msofficer.exe//PE_Patch.Morphine//Morphine//PE_Patch.UPX//UPX
已检测到: 风险软件 not-a-virus:RemoteAdmin.Win32.RAdmin.21        文件: G:\样本\C\service.exe






Starting the file scan:

Begin scan in 'G:\样本\C'
G:\样本\C\
  AdmDll.dll
      [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/RAdmin.V Backdoor server programs
      [INFO]      The file was deleted!
  dxinstall.exe
      [DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
      [INFO]      The file was deleted!
  mdmi386.exe
      [DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
      [INFO]      The file was deleted!
  mshelper.exe
      [DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
      [INFO]      The file was deleted!
  msofficer.exe
      [DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
      [INFO]      The file was deleted!
  mswapi.dll
  service.exe
      [DETECTION] Is the Trojan horse TR/Drop.RAdmin.J.2
      [INFO]      The file was deleted!
  win1ogon.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      The file was moved to '4728a25a.qua'!

saga3721

根据我听音辨位，小红伞报了7个，终止一次

The EQs

Scan performed at: 2007-8-9 13:14:18
Scanning Log
NOD32 version 2445 (20070808) NT
Command line: C:\Documents and Settings\EQ2\桌面\C.zip
Operating memory - is OK

Date: 9.8.2007  Time: 13:14:26
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\C.zip
C:\Documents and Settings\EQ2\桌面\C.zip ?ZIP ?AdmDll.dll - Win32/RemoteAdmin application - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\C.zip ?ZIP ?dxinstall.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\C.zip ?ZIP ?mdmi386.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\EQ2\桌面\C.zip ?ZIP ?mshelper.exe - a variant of Win32/TrojanProxy.Daemonize trojan
C:\Documents and Settings\EQ2\桌面\C.zip ?ZIP ?msofficer.exe - a variant of Win32/Radmin.J trojan
C:\Documents and Settings\EQ2\桌面\C.zip ?ZIP ?mswapi.dll - a variant of Win32/Spy.Iespy trojan
C:\Documents and Settings\EQ2\桌面\C.zip ?ZIP ?service.exe - Win32/RemoteAdmin application - was a part of the deleted object
C:\Documents and Settings\EQ2\桌面\C.zip ?ZIP ?win1ogon.exe - a variant of Win32/Spy.Iespy trojan
Number of scanned files: 9
Number of threats found: 8
Number of files cleaned: 1
Time of completion: 13:14:27 Total scanning time: 1 sec (00:00:01)

Notes:
[7] File is probably infected with an unknown virus.

woai_jolin

kv all pass

lsyer

报了一堆壳。。。

saga3721

壳即是毒，二而一也

uhthn2002

vba32

taihuxian

Scan performed at: 2007-8-9 18:50:52
Scanning Log
NOD32 version 2445 (20070808) NT
Command line: C:\Documents and Settings\Administrator\×ÀÃæ\C.zip
Operating memory - is OK

Date: 9.8.2007  Time: 18:50:57
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Administrator\×ÀÃæ\C.zip
C:\Documents and Settings\Administrator\×ÀÃæ\C.zip ?ZIP ?AdmDll.dll - Win32/RemoteAdmin application - was a part of the deleted object
C:\Documents and Settings\Administrator\×ÀÃæ\C.zip ?ZIP ?dxinstall.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\Administrator\×ÀÃæ\C.zip ?ZIP ?mdmi386.exe - probably unknown NewHeur_PE virus [7]
C:\Documents and Settings\Administrator\×ÀÃæ\C.zip ?ZIP ?mshelper.exe - a variant of Win32/TrojanProxy.Daemonize trojan
C:\Documents and Settings\Administrator\×ÀÃæ\C.zip ?ZIP ?msofficer.exe - a variant of Win32/Radmin.J trojan
C:\Documents and Settings\Administrator\×ÀÃæ\C.zip ?ZIP ?mswapi.dll - a variant of Win32/Spy.Iespy trojan
C:\Documents and Settings\Administrator\×ÀÃæ\C.zip ?ZIP ?service.exe - Win32/RemoteAdmin application - was a part of the deleted object
C:\Documents and Settings\Administrator\×ÀÃæ\C.zip ?ZIP ?win1ogon.exe - a variant of Win32/Spy.Iespy trojan
Number of scanned files: 9
Number of threats found: 8
Number of files cleaned: 1
Time of completion: 18:50:59 Total scanning time: 2 sec (00:00:02)

Notes:
[7] File is probably infected with an unknown virus.