最近疯传的 MSDOS.bat 病毒最新版本

xxl

Kaspersky Lab
拒绝访问
无法返回请求的网页

试图访问的网页：

http://bbs.kafan.cn/attachment.php?aid=
500066&k=11b2f47bf2dddfef42055be205eddd4
0&t=1238433732

发生下列错误：

请求的对象被感染，发现下列病毒 Worm.Win32.AutoRun.yze


如有疑问，请联系您的技术支持
创建日期：
Tue Mar 31 01:22:25 2009
Kaspersky Lab

kingsheet

卡巴   The requested URL http://bbs.kafan.cn/attachment.p ... 00&t=1238461028 is infected with Worm.Win32.AutoRun.yze virus

nanhezzb

体积小，因为是加壳的文件，用超级巡警脱壳之后就会看见有900多KB。

rowland

蠕虫+下载器+AV killer

cruiyong

有没有EQ情报..

点点长

这个东西太恐怖了哦·~

will

Multi Command-Line Scanner Report
-------------------------------------------------------------------------
C:\Documents and Settings\Administrator\桌面\s\MSDOS.bat
MD5 Hash: 476F8BA41F54238BA132DEC7B6C0B183

A-squared ----- Worm.Win32.AutoRunIK
Avast ----- Win32:AutoRun-ANP [Wrm]
AntiVir V7 ----- Worm/Otwycal.g
BitDefender ----- Win32.Worm.Otwycal.AC
ClamWin -----Nothing
Dr.Web V5 ----- Win32.Wycao.1
F-Secure ----- Worm.Win32.AutoRun.yze
Gdata ----- Win32.Worm.Otwycal.AC
Jiangmin ----- Worm/AutoRun.nf
Kingsoft ----- Win32.Troj.Downloader.cf.978944
VBA32 ----- Win32.HLLW.Autoruner.1881

*** 10/11 antivirus engines found virus in this file ***
-------------------------------------------------------------------------

Task done @ 2009-03-31 星期二 13:10:46.04
Note: The results might be different from that of the GUI version.

hddu

2009-03-31 13:09:47    创建文件      操作:阻止并结束进程
进程路径:E:\2009年3月30日病毒样本（四中）\MSDOS.bat
文件路径:C:\WINDOWS\Tasks\0x01xx8p.exe
触发规则:所有程序规则->WINDOWS_2->%windir%\Tasks\*.exe

ledled

Name: Packed/Upack
Type: Sequence

Description:


Files:
c:\users\administrator\desktop\新建文件夹\0.exe

黑衣~魂

DR.WEB
MSDOS.bat - infected with Win32.Wycao.1
autorun.inf - infected with Win32.HLLW.Autoruner.1864
0.exe - infected with Trojan.MulDrop.29419
5.exe - probably infected with DLOADER.Trojan