China DOS Union

Viruses like 威金 and Panda Burning Incense infect executable files across the whole disk, but quite a few of the techniques they use are just bundling. How can batch files be used to restore these infected files?

Geez, using batch files.....

Never mind whether it can be done or not, just waiting for it would take forever..

Might as well write one in C++ instead..

So what would the general batch-file approach be?

Open the file in binary mode.... things like the file header... just give up on P.

Then...... let's try a different idea:
For many variants like 威金, they drop one or several virus files into the system folder. If we create a folder with the same name in the same location and set it with special attributes (so it can't be deleted), then run those infected files, they should be restored. So, how can I use a batch file to run files across the whole disk (and then immediately terminate their processes)?

What an expert. You can tell from the idea he was born in the 70s and only knows how to use DOS.

Originally posted by chinaman at 2007-5-4 08:39 AM:
Then...... let's try a different idea:
For many variants like 威金, they drop one or several virus files into the system folder. If we create a folder with the same name in the same location and set it with special attributes (purpose ...

There is a similar method, which is to use image hijacking IFEO so that the dropped virus file cannot run, thereby recovering the original file;

But this method is ineffective against some variants, because when an exe infected by those variants runs, it will only drop the virus file and will not also drop the original file. I've also seen some that additionally drop a batch file which deletes the dropped original file after it runs...

So this method is not very broadly applicable

I admire the subject line in the post above ```

Watching this...

Originally posted by qaz1223 at 2007-6-14 03:03:
Watching this...

Watching how to use batch files to repair a space station hit by space junk?