今天一个游戏网友发给我一个压缩文件,说是她的照片.叫我打开
我看是批处理的图标,就怀疑了.
用右键查看,晕啊,一堆乱码`````
里面找到一些木马的行为````
比如过主动,删除,由于我也是刚刚学习批处理,没什么语言基础,所以看不懂
希望哪个高手帮忙看下,最好能揪出他的木马````并告诉我BAT的内容,最好解了那些乱码````
谢谢了
我上传到我空间了,
特别声明:没点杀毒基础的别打开,我不包没木马的
http://zhouxuan.020online.com/mmbat.rar
Install End, Exit... Start Install... 上线分组:%s
用户名:%s
密码:%s
域名:%s
备用域名:%s
服务名:%s
服务显示名:%s
服务描述:%s
备注:%s
文件名:%s
user web error... No Find RedGirl Server,Installing... \ !*seven-eleven*! Relase Plugin Success... DLL %s\%s.dat open EXT_FILE SeDebugPrivilege \Services.exe Can't Find Service "%ws".
The Service "%ws" Is Hidden Successfully.
Can't Find ServiceDatabase.
Services.exe %s error: %d RedGirl
%d-%d-%d %d:%d:%d \RedGirl.dbg echo on :delete echo off if exist "%s" goto delete \tmp.bat del "%s" kernel32 LoadLibraryA 被控端安装成功 网络红娘V2007 Show Success MessageBox... Install Service Success,Ready Execute Work Thread... Description SYSTEM\CurrentControlSet\Services\ -service OpenSCManager ERROR... No Find Service,Ready Install Service... DispatchTable... -service Load Library ERROR... SOFTWARE\Microsoft\Windows\CurrentVersion\Run RegisterServiceProcess KERNEL32 NO NT System Operate... Inject Code Error... Hide Service Error... Hide Service Success... Ready Hide Service:%s... Inject Code Success... %s Inject To Browser... winsta0\default \alg.exe \wuauclt.exe \spoolsv.exe \ctfmon.exe \lsass.exe \services.exe \winlogon.exe \conime.exe \rundll32.exe \svchost.exe %s 用户浏览器 Program Files\Internet Explorer\IEXPLORE.EXE htmlfile\shell\open\command !*_*->seven-eleven<-*_*! € %02x Enter your password: Blowfish requires the input to be a multiple of 8 bytes (64 bits) to work.
Unexpected option header size.
File does not have MZ header
ZwQuerySystemInformation NtUnmapViewOfSection NtMapViewOfSection NtOpenSection RtlFreeUnicodeString RtlInitAnsiString RtlAnsiStringToUnicodeString ntdll.dll \device\physicalmemory Failed to map physical memory view of length %X at %X! Unmapping view failed!
ntoskrnl.exe \ntdll.dll KeServiceDescriptorTable \ntoskrnl.exe CURRENT_USER \ D e v i c e \ P h y s i c a l M e m o r y ntdll 卡巴斯基互联网安全套装 6.0 文件保护 警告 跳过(&S) 跳过 主动防御 警告 允许(&A) 允许 主动防御 警报 主动防御 信息 确定 下次采取相同策略 添加为可信程序 不删除 放行 微点主动防御软件 avp.exe OpenProcessToken Error: %d
Possibly KiServiceLimit==%08X
%08X
