China DOS Union

The kill.bat in the attachment is encrypted and cannot be learned or studied.
I hope someone can help decrypt it. Thank you


────────────────　Moderator's Note　────────────────
　　This attachment is the special killing tool for Panda Burning Incense virus. The kill.bat in it is not a real batch processing file, but a PE format exe executable file. It is impractical to operate in the way of decrypting batch processing files.
────────────────　Moderator's Note　────────────────


[ Last edited by namejm on 2007-1-26 at 10:24 AM ]

This KILL.BAT is not a batch file. It is an executable file. Renaming it to KILL.EXE can still make it run.

Yes, it is an executable file

Oh! It's too dark! You tricked me so badly!
Thanks to the third floor and the two brothers on the second floor!

This is to prevent being infected as soon as downloaded. EXE files can also run when renamed to BAT.

At that time, I also thought there was such an amazing encryption method, and I even wanted to learn about the encryption method.

Bump

Hehe, today I found the same file in Yongyou's Financial Messenger. A file named "MSDEStp2000.bat" is actually an executable program. The execution environments of.exe and.bat are different. Why can they achieve the effect of being able to execute after changing the suffixes? What's the reason?

Not bad, not bad,,, very powerful! I like it.

Originally posted by maya0su at 2007-10-20 09:58 PM:

The execution environments of .exe and .bat are different. Why can they achieve the effect of being able to run after changing the file extensions?

What is the reason?

After looking at the following display results, I believe everyone can understand a little bit

ftype|find "batfile"
batfile="%1" %*
ftype|find "exefile"
exefile="%1" %*

By the same token, changing the exe to the following file types with the same extension should also be able to run

batfile="%1" %*
cmdfile="%1" %*
comfile="%1" %*
exefile="%1" %*
piffile="%1" %*

Extension:

If you run the following lines of commands:

ftype PPdos="%1" %*

assoc .cn-dos=PPdos

assoc .ppdos=PPdos

Even if you change that kill.exe to kill.cn-dos or kill.ppdos, it can still run

I wonder if the code mentioned by the person upstairs already exists in the file. It can modify the file type association by itself. Before opening, modify:
ftype|find "batfile"
batfile="%1" %*
After using, change it back:
ftype|find "exefile"
exefile="%1" %*

Hey there, upstairs. If it's really like this, the antivirus software will go wild.