病毒别名：I-Worm.Saros.a[AVP]
处理时间：
威胁级别：★★
中文名称：萨露丝
病毒类型：蠕虫
影响系统：Win9x/WinNT/Win2K/WinXP/Win2003
病毒行为:
编写工具:
传染条件:
发作条件:
系统修改:
1.复制自身到以下文件:
WINDOWSsystem32NonYou.exe
WINDOWSsystem32Love-ScreenSaver.scr
WINDOWSsystem32MSOutlookInternetUpdate.exe
progra~1KazaaMy Shared FolderRosy.exe
progra~1KazaaMy Shared FolderPipponoto.exe
progra~1KazaaMy Shared FolderAnastacia - Left Outside Alone.mp3.exe
progra~1KazaaMy Shared FolderThe Rasmus - In The Shadows.mp3.exe
progra~1KazaaMy Shared Folder50 Cent - In da Club.mp3.exe
progra~1KazaaMy Shared FolderVanessa Carltron - Ordinary Day.mp3.exe
progra~1KazaaMy Shared FolderHaiducii - Dragostea Din Tei.mp3.exe
progra~1KazaaMy Shared FolderBlack Eyed Peas - Hey Mama.mp3.exe
progra~1KazaaMy Shared FolderRaf - In tutti i miei giorni.mp3.exe
progra~1KazaaMy Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe
progra~1KazaaMy Shared FolderLionel Richie - Just For You.mp3.exe
progra~1Kazaa LiteMy Shared FolderRosy.exe
progra~1Kazaa LiteMy Shared FolderPipponoto.exe
progra~1Kazaa LiteMy Shared FolderAnastacia - Left Outside Alone.mp3.exe
progra~1Kazaa LiteMy Shared FolderThe Rasmus - In The Shadows.mp3.exe
progra~1Kazaa LiteMy Shared Folder50 Cent - In da Club.mp3.exe
progra~1Kazaa LiteMy Shared FolderVanessa Carltron - Ordinary Day.mp3.exe
progra~1Kazaa LiteMy Shared FolderHaiducii - Dragostea Din Tei.mp3.exe
progra~1Kazaa LiteMy Shared FolderBlack Eyed Peas - Hey Mama.mp3.exe
progra~1Kazaa LiteMy Shared FolderRaf - In tutti i miei giorni.mp3.exe
progra~1Kazaa LiteMy Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe
progra~1Kazaa LiteMy Shared FolderLionel Richie - Just For You.mp3.exe
progra~1Kazaa Lite K++My Shared FolderRosy.exe
progra~1Kazaa Lite K++My Shared FolderPipponoto.exe
progra~1Kazaa Lite K++My Shared FolderAnastacia - Left Outside Alone.mp3.exe
progra~1Kazaa Lite K++My Shared FolderThe Rasmus - In The Shadows.mp3.exe
progra~1Kazaa Lite K++My Shared Folder50 Cent - In da Club.mp3.exe
progra~1Kazaa Lite K++My Shared FolderVanessa Carltron - Ordinary Day.mp3.exe
progra~1Kazaa Lite K++My Shared FolderHaiducii - Dragostea Din Tei.mp3.exe
progra~1Kazaa Lite K++My Shared FolderHaiducii - Dragostea din tei.mp3.exe
progra~1Kazaa Lite K++My Shared FolderRaf - In tutti i miei giorni.mp3.exe
progra~1Kazaa Lite K++My Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe
progra~1Kazaa Lite K++My Shared FolderLionel Richie - Just For You.mp3.exe
progra~1ICQShared FolderRosy.exe
progra~1ICQShared FolderPipponoto.exe
progra~1ICQShared FolderAnastacia - Left Outside Alone.mp3.exe
progra~1ICQShared FolderThe Rasmus - In The Shadows.mp3.exe
progra~1ICQShared Folder50 Cent - In da Club.mp3.exe
progra~1ICQShared FolderVanessa Carltron - Ordinary Day.mp3.exe
progra~1ICQShared FolderHaiducii - Dragostea Din Tei.mp3.exe
progra~1ICQShared FolderBlack Eyed Peas - Hey Mama.mp3.exe
progra~1ICQShared FolderRaf - In tutti i miei giorni.mp3.exe
progra~1ICQShared FolderVasco Rossi - Buoni e cattivi.mp3.exe
progra~1ICQShared FolderLionel Richie - Just For You.mp3.exe
progra~1GroksterMy GroksterRosy.exe
progra~1GroksterMy GroksterPipponoto.exe
progra~1GroksterMy GroksterAnastacia - Left Outside Alone.mp3.exe
progra~1GroksterMy GroksterThe Rasmus - In The Shadows.mp3.exe
progra~1GroksterMy Grokster50 Cent - In da Club.mp3.exe
progra~1GroksterMy GroksterVanessa Carltron - Ordinary Day.mp3.exe
progra~1GroksterMy GroksterHaiducii - Dragostea Din Tei.mp3.exe
progra~1GroksterMy GroksterBlack Eyed Peas - Hey Mama.mp3.exe
progra~1GroksterMy GroksterRaf - In tutti i miei giorni.mp3.exe
progra~1GroksterMy GroksterVasco Rossi - Buoni e cattivi.mp3.exe
progra~1GroksterMy GroksterLionel Richie - Just For You.mp3.exe
progra~1BearshareSharedRosy.exe
progra~1BearshareSharedPipponoto.exe
progra~1BearshareSharedAnastacia - Left Outside Alone.mp3.exe
progra~1BearshareSharedThe Rasmus - In The Shadows.mp3.exe
progra~1BearshareShared50 Cent - In da Club.mp3.exe
progra~1BearshareSharedVanessa Carltron - Ordinary Day.mp3.exe
progra~1BearshareSharedHaiducii - Dragostea Din Tei.mp3.exe
progra~1BearshareSharedBlack Eyed Peas - Hey Mama.mp3.exe
progra~1BearshareSharedRaf - In tutti i miei giorni.mp3.exe
progra~1BearshareSharedVasco Rossi - Buoni e cattivi.mp3.exe
progra~1BearshareSharedLionel Richie - Just For You.mp3.exe
progra~1eDonkey2000IncomingRosy.exe
progra~1eDonkey2000IncomingPipponoto.exe
progra~1eDonkey2000IncomingAnastacia - Left Outside Alone.mp3.exe
progra~1eDonkey2000IncomingThe Rasmus - In The Shadows.mp3.exe
progra~1eDonkey2000Incoming50 Cent - In da Club.mp3.exe
progra~1eDonkey2000IncomingVanessa Carltron - Ordinary Day.mp3.exe
progra~1eDonkey2000IncomingHaiducii - Dragostea Din Tei.mp3.exe
progra~1eDonkey2000IncomingBlack Eyed Peas - Hey Mama.mp3.exe
progra~1eDonkey2000IncomingRaf - In tutti i miei giorni.mp3.exe
progra~1eDonkey2000IncomingVasco Rossi - Buoni e cattivi.mp3.exe
progra~1eDonkey2000IncomingLionel Richie - Just For You.mp3.exe
progra~1eMuleIncomingRosy.exe
progra~1eMuleIncomingPipponoto.exe
progra~1eMuleIncomingAnastacia - Left Outside Alone.mp3.exe
progra~1eMuleIncomingThe Rasmus - In The Shadows.mp3.exe
progra~1eMuleIncoming50 Cent - In da Club.mp3.exe
progra~1eMuleIncomingVanessa Carltron - Ordinary Day.mp3.exe
progra~1eMuleIncomingHaiducii - Dragostea Din Tei.mp3.exe
progra~1eMuleIncomingBlack Eyed Peas - Hey Mama.mp3.exe
progra~1eMuleIncomingRaf - In tutti i miei giorni.mp3.exe
progra~1eMuleIncomingVasco Rossi - Buoni e cattivi.mp3.exe
progra~1eMuleIncomingLionel Richie - Just For You.mp3.exe
progra~1MorpheusMy Shared FolderRosy.exe
progra~1MorpheusMy Shared FolderPipponoto.exe
progra~1MorpheusMy Shared FolderAnastacia - Left Outside Alone.mp3.exe
progra~1MorpheusMy Shared FolderThe Rasmus - In The Shadows.mp3.exe
progra~1MorpheusMy Shared Folder50 Cent - In da Club.mp3.exe
progra~1MorpheusMy Shared FolderVanessa Carltron - Ordinary Day.mp3.exe
progra~1MorpheusMy Shared FolderHaiducii - Dragostea Din Tei.mp3.exe
progra~1MorpheusMy Shared FolderBlack Eyed Peas - Hey Mama.mp3.exe
progra~1MorpheusMy Shared FolderRaf - In tutti i miei giorni.mp3.exe
progra~1MorpheusMy Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe
progra~1MorpheusMy Shared FolderLionel Richie - Just For You.mp3.exe
progra~1LimeWireSharedRosy.exe
progra~1LimeWireSharedPipponoto.exe
progra~1LimeWireSharedAnastacia - Left Outside Alone.mp3.exe
progra~1LimeWireSharedThe Rasmus - In The Shadows.mp3.exe
progra~1LimeWireShared50 Cent - In da Club.mp3.exe
progra~1LimeWireSharedVanessa Carltron - Ordinary Day.mp3.exe
progra~1LimeWireSharedHaiducii - Dragostea Din Tei.mp3.exe
progra~1LimeWireSharedBlack Eyed Peas - Hey Mama.mp3.exe
progra~1LimeWireSharedRaf - In tutti i miei giorni.mp3.exe
progra~1LimeWireSharedVasco Rossi - Buoni e cattivi.mp3.exe
progra~1LimeWireSharedLionel Richie - Just For You.mp3.exe
progra~1TeslaFilesRosy.exe
progra~1TeslaFilesPipponoto.exe
progra~1TeslaFilesAnastacia - Left Outside Alone.mp3.exe
progra~1TeslaFilesThe Rasmus - In The Shadows.mp3.exe
progra~1TeslaFiles50 Cent - In da Club.mp3.exe
progra~1TeslaFilesVanessa Carltron - Ordinary Day.mp3.exe
progra~1TeslaFilesHaiducii - Dragostea Din Tei.mp3.exe
progra~1TeslaFilesBlack Eyed Peas - Hey Mama.mp3.exe
progra~1TeslaFilesRaf - In tutti i miei giorni.mp3.exe
progra~1TeslaFilesVasco Rossi - Buoni e cattivi.mp3.exe
progra~1TeslaFilesLionel Richie - Just For You.mp3.exe
progra~1WinMXSharedRosy.exe
progra~1WinMXSharedPipponoto.exe
progra~1WinMXSharedAnastacia - Left Outside Alone.mp3.exe
progra~1WinMXSharedThe Rasmus - In The Shadows.mp3.exe
progra~1WinMXShared50 Cent - In da Club.mp3.exe
progra~1WinMXSharedVanessa Carltron - Ordinary Day.mp3.exe
progra~1WinMXSharedHaiducii - Dragostea Din Tei.mp3.exe
progra~1WinMXSharedBlack Eyed Peas - Hey Mama.mp3.exe
progra~1WinMXSharedRaf - In tutti i miei giorni.mp3.exe
progra~1WinMXSharedVasco Rossi - Buoni e cattivi.mp3.exe
progra~1WinMXSharedLionel Richie - Just For You.mp3.exe
2..建立WINDOWSsystem32About.hta文件
3..显示消息
标题: Microsoft Windows Update
内容: Click Yes For Update Microsoft Outlook via E-mail
4.建立WINDOWSsystem32
stdnrdll32.vbs文件
该VBS文件作如下工作:
a.在注册表主键"HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
ldr32"下，
添加如下键值："default"="WINDOWSsystem32NonYou.exe"
b.在注册表主键"HKEY_CURRENT_USERSoftwareMicrosoftOffice8.0OutlookSecurity"下，
添加如下键值："Level1Remove"="exe"
c.在注册表主键"HKEY_CURRENT_USERSoftwareMicrosoftOffice9.0OutlookSecurity"下，
添加如下键值："Level1Remove"="exe"
d.在注册表主键"HKEY_CURRENT_USERSoftwareMicrosoftOffice10.0OutlookSecurity"下，
添加如下键值："Level1Remove"="exe"
e.在注册表主键"HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunoncewincomp32"下，
添加如下键值："default"="WINDOWSsystem32
stdnrdll32.vbs"
f.建立文件WINDOWSsystem32Love-ScreenSaver.cab,它包含蠕虫本身
g.如果当前日期是11号或23号,则把IE的默认页改为:www.gedzac.tk
并用浏览器打开WINDOWSsystem32About.hta
h.根据outlook地址簿Email地址发送带毒邮件
该邮件主题为:Microsoft Outlook News
内容:Microsoft Outlook Update / Bug Fixed - Contact: support@microsoft.com
附件:MSOutlookInternetUpdate.exe(该附件为病毒本身)
i.打开 www.windowsupdate.com
5.在Program FilesmIRCmirc.ini文件中的rfiles节中增加
n2 = tdll32.dll
6.通过mIrc发送Love-ScreenSaver.cab(病毒)给其它mIrc用户
发作现象:
检查当前日期是否为11号或23号
如果是则显示如下两条消息:
标题: NonYou
内容: Rosy Ti Amo - Saro & Rosy Forever
标题: Gedzac Group 2004
内容:
NonYou.a Gedzac Labs Productions
Coded by Sarosoft - Dedicated to my Love Ros
Gedzac Group 2004 - http://www.gedzac.tk
Gedzac
The Virus Crew
特别说明: