The code is very simple, and I don't know much.
I still need to learn from everyone a lot
Welcome to join DOS Empire Community: 2097500
[ Last edited by chengbiner on 2006-12-4 at 02:43 AM ]
I still need to learn from everyone a lot
@Echo Off
color 0a
title logo1_.exe Virus Immunity Tool (Biner)
TASKKILL /F /IM logo1_.exe
TASKKILL /F /IM rundl132.exe
:0
cls
@echo off
color 0a
echo.
echo.
echo logo1_exe Virus Immunity logo1_exe Virus Trivia
echo.
echo.
echo. logo1_exe Virus Immunity Removal Clear All _desktop.ini Files
echo (DOS Empire Community: 2097500)
Set /P Choice= Please enter your choice:
Echo.
If '%Choice%'=='' goto 0
If /I '%Choice%'=='1' GOTO 1
If /I '%Choice%'=='2' GOTO 2
If /I '%Choice%'=='3' GOTO 3
If /I '%Choice%'=='4' GOTO cb
Goto 0
:1
cls
color 05
If Exist %windir%\logo1_.exe Del /F /S /Q %windir%\logo1_.exe>nul 2>nul
md %windir%\logo1_.exe\>nul 2>nul
md %windir%\logo1_.exe\Forbidding logo1 to Create Virus..\>nul 2>nul
attrib +s +h +r %windir%\logo1_.exe>nul 2>nul
If Exist %windir%\rundl132.exe Del /F /S /Q %windir%\rundl132.exe>nul 2>nul
md %windir%\rundl132.exe\>nul 2>nul
md %windir%\rundl132.exe\Forbidding rundl132 to Create Virus..\>nul 2>nul
attrib +s +h +r %windir%\rundl132.exe>nul 2>nul
cls
Echo.
echo Congratulations! logo1_.exe virus immunity is successful!
echo.
echo.
echo.
echo You will see folders named logo1_.exe and rundl132.exe under window
echo Please do not delete, actually you can't delete them!
ping 127.1 -n 5 >nul
del /f /s /q "%Temp%\*.bat"
goto 0
:2
cls
echo This virus is a compound virus integrated with executable file infection, network infection, downloading trojans, backdoor programs or other viruses under the Windows platform. After the virus runs, it disguises itself as a normal system file to confuse users. It modifies the registry items so that the virus can run automatically when the computer starts. At the same time, the virus bypasses the monitoring of the firewall through thread injection technology, connects to the website specified by the virus author to download specific trojans or other viruses. At the same time, after the virus runs, it enumerates all available shares in the internal network and tries to attack other machines through weak passwords, thereby infecting the target computer.>>logo.txt
echo During the running process, it infects the executable files on the user's machine, causing the user's machine to run slowly, destroying the executable files on the user's machine, and posing a threat to the user's security.>>logo.txt
echo The virus is mainly spread through shared directories, file bundling, running infected virus programs, virus-carrying email attachments and other methods.>>logo.txt
echo 1. After the virus runs, it copies itself to the Windows folder, and the file name is:>>logo.txt
echo %Windir%\rundl132.exe>>logo.txt
echo 2. After running the infected file, the virus copies the virus body to the following file:>>logo.txt
echo %Windir%\logo_1.exe>>logo.txt
echo 3. At the same time, the virus will generate in the virus folder:>>logo.txt
echo %Current Virus Directory%\vidll.dll>>logo.txt
echo 4. The virus searches for all exe files in all available partitions starting from drive Z, and then infects all executable files with a size of 27kb-10mb. After infection, it generates in the infected folder:>>logo.txt
echo _desktop.ini (file attributes: system, hidden.)>>logo.txt
echo 5. The virus will try to modify the %SysRoot%\system32\drivers\etc\hosts file.>>logo.txt
echo 6. The virus realizes that the virus starts automatically when the computer starts by adding the following registry items:>>logo.txt
echo >>logo.txt
echo "load"="%Windir%\rundl132.exe">>logo.txt
echo >>logo.txt
echo "load"="%Windir%\rundl132.exe">>logo.txt
echo 7. When the virus runs, it tries to find the program with the form name "RavMonClass", and sends a message to close the program after finding the form.>>logo.txt
echo 8. Enumerate the following anti-virus software process names, and terminate their processes after finding them:>>logo.txt
echo Ravmon.exe>>logo.txt
echo Eghost.exe>>logo.txt
echo Mailmon.exe>>logo.txt
echo KAVPFW.EXE>>logo.txt
echo IPARMOR.EXE>>logo.txt
echo Ravmond.exe>>logo.txt
echo regsvc.exe>>logo.txt
echo RavMon.exe>>logo.txt
echo mcshield.exe>>logo.txt
echo 9. At the same time, the virus tries to terminate the relevant anti-virus software using the following commands:>>logo.txt
echo net stop "Kingsoft AntiVirus Service">>logo.txt
echo 10. Send ICMP probe data "Hello, World", judge the network status, when the network is available,>>logo.txt
echo Enumerate all shared hosts in the internal network, and try to connect to shared directories such as \\IPC$ and \admin$ with weak passwords. After successful connection, perform network infection.>>logo.txt
echo 11. Infect the exe files on the user's machine, but do not infect the files in the following folders:>>logo.txt
echo system>>logo.txt
echo system32>>logo.txt
echo windows>>logo.txt
echo Documents and settings>>logo.txt
echo system Volume Information>>logo.txt
echo Recycled>>logo.txt
echo winnt>>logo.txt
echo Program Files>>logo.txt
echo Windows NT>>logo.txt
echo WindowsUpdate>>logo.txt
echo Windows Media Player>>logo.txt
echo Outlook Express>>logo.txt
echo Internet Explorer>>logo.txt
echo ComPlus Applications>>logo.txt
echo NetMeeting>>logo.txt
echo Common Files>>logo.txt
echo Messenger>>logo.txt
echo Microsoft Office>>logo.txt
echo InstallShield Installation Information>>logo.txt
echo MSN>>logo.txt
echo Microsoft Frontpage>>logo.txt
echo Movie Maker>>logo.txt
echo MSN Gaming Zone>>logo.txt
echo 12. Enumerate system processes, and try to selectively inject the virus dll (vidll.dll) into the processes corresponding to the following process names:>>logo.txt
echo Explorer >>logo.txt
echo Iexplore>>logo.txt
echo After finding the process that meets the conditions, randomly inject one of the above two processes.>>logo.txt
echo 13. When the external network is available, the injected dll file tries to connect to the following websites to download and run relevant programs:>>logo.txt
echo http://www.flysky168.com/han/xz/11.exe>>logo.txt
echo http://www.flysky168.com/han/xz/22.exe>>logo.txt
echo http://www.flysky168.com/han/xz/33.exe>>logo.txt
echo http://www.flysky168.com/han/xz/44.exe>>logo.txt
echo http://www.flysky168.com/han/xz/55.exe>>logo.txt
echo http://www.flysky168.com/han/xz/66.exe>>logo.txt
echo 14. After the virus is downloaded successfully, write the following registry items:>>logo.txt
echo >>logo.txt
echo "auto"="1">>logo.txt
notepad logo.txt
del logo.txt
goto 0
:3
cls
color 04
echo.
echo.
echo.
echo There will be a risk of infecting the logo1_.exe virus if you remove it!!!!!
echo.
echo.
Set /P Choice= If you want to continue the operation, please choose:
If /I '%Choice%'=='Y' GOTO Y
If /I '%Choice%'=='N' GOTO 0
PAUSE >NUL
:Y
If Exist %windir%\logo1_.exe Del /F /S /Q %windir%\logo1_.exe>nul 2>nul
rd %windir%\logo1_.exe\>nul 2>nul
rd %windir%\logo1_.exe\Forbidding logo1 to Create Virus..\>nul 2>nul
attrib -s -h -r %windir%\logo1_.exe>nul 2>nul
rd %windir%\logo1_.exe
If Exist %windir%\rundl132.exe Del /F /S /Q %windir%\rundl132.exe>nul 2>nul
rd %windir%\rundl132.exe\>nul 2>nul
rd %windir%\rundl132.exe\Forbidding rundl132 to Create Virus..\>nul 2>nul
attrib -s -h -r %windir%\rundl132.exe>nul 2>nul
rd %windir%\rundl132.exe
cls
Echo.
echo.
echo.
echo.
echo Congratulations! logo1_.exe virus immunity removal is successful!
ping 127.1 -n 3 >nul
goto 0
:cb
cls
@echo off
color 06
echo.
echo.
echo.
echo.
echo Scanning _desktop.ini files……
if exist "%tmp%\note.txt" del /a "%tmp%\note.txt" >nul 2>nul
set num=0
setlocal enabledelayedexpansion
for %%i in (c d e f g h i j k l m n o p q r s t u v w x y z) do (
if exist %%i: (
cd\
for /f "tokens=*" %%a in ('dir /s /a-d /b %%i:\_desktop.ini') do (
echo %%a>>"%tmp%\note.txt"
set /a num=!num!+1
del /q /a /f "%%a"
)
)
)
cls
echo Total files deleted: %num%
if not "%num%"=="0" start "" "%tmp%\note.txt"
echo Congratulations! All _desktop.ini files have been deleted!
ping 127.1 -n 3 >nul
goto 0Welcome to join DOS Empire Community: 2097500
[ Last edited by chengbiner on 2006-12-4 at 02:43 AM ]
