病毒名称:
Worm.Blare.enc
类别： 蠕虫病毒
病毒资料：
破坏方法：
VB写的蠕虫病毒，采用UPX压缩，是一个通过Outlook邮件和IRC聊天软件进行传播的病毒。
一旦运行，将禁止使用注册表工具，隐藏任务条，建立自启动键值，同时将使用ping对：www.number-10.gov.uk发动拒绝服务攻击。病毒将显示下列消息：
Dear Tony Blair,
INFECTED BY: WIN32.SORT-IT-OUT-BLAIR
Why are you spending all our taxes on illegal immigrants!?!
How about you stop worrying about other countries and worry about ours???
Stop spending money on immigrants and spend it on things like OAP's who
fought to keep this country free but are now getting treated worst than illegal
immigrants!
edUCation system!?!
Think about it Mr Blair.
Your career depends on it.
We've had enough.
创建一个文本文件到：C:\WIN32.SORT-IT-OUT-BLAIR.TXT，这个文件包含字符串：
Infected by the WIN32.SORT-IT-OUT-BLAIR Virus!
并将其复制到如下目录：
c:\inetpub\wwwroot\default.ASP
c:\inetpub\wwwroot\default.htm
c:\inetpub\wwwroot\default.Html
c:\inetpub\wwwroot\index.asp
c:\inetpub\wwwroot\index.htm
c:\inetpub\wwwroot\index.html
病毒也将复制自身到如下目录：
c:\Program Files\mIRC\chain_mail_world_record.irc
c:\mIRC\chain_mail_world_record.irc
生成一个IRC脚本到如下目录：
c:\Program Files\mIRC
c:\mIRC
这个脚本用来传播病毒
病毒通过邮件传播时发送的邮件内容为：
标题可能为:
Your Account Infomation.
Your Account is on hold.
Your Account has been suspended.
Account Infomation.
Account Invoice.
Email Account Infomation.
This quaters invoice.
Regards, Support Team.
Account Billing Information.
YOUR ACCOUNT REF:
Account, is on hold.
ORDER CONFIRMATION:
正文为:
Dear Sir,
Please can you check that your account information is up to date.
Your details are attached to this email.
Regards, Billing Team.
Dear Sir,
Please can you confirm that your account information is correct.
Your current details are attached to this email.
Regards, Billing Team.
Dear Sir,
Please find attached this quaters invoice for your Internet Account.
Regards, Billing Team.
Please find your details attached.
Thank you
Details are attached to this email.
Thank you
附件名:
Account Invoice.Doc
Your Account.Doc
Account Details.Doc
Your Account Info.Doc
Account Information.Doc
Billing Information.Doc
Invoice.Doc
Account Update.Doc
Account Status.Doc
Your Account Status.Doc
病毒也能终止大部分流行的反病毒软件
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
\CurrentVersion\Run
"Windows Task Manager"="c:\progra~1\ACCOUNT_DETAILS.DOC.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows
\CurrentVersion\Policies\System
"DisableTaskMgr"="0x00000001 (1)"
HKEY_CURRENT_USER\Software\Microsoft\Windows
\CurrentVersion\Policies\System
"DisableRegistryTools"="0x00000001 (1)"
病毒的清除法：
使用光华反病毒软件，彻底删除。
病毒演示：
病毒FAQ：
Windows下的PE病毒。
发现日期：
2003-9-5