Worm.Agobot.3.j

病毒名称:

Worm.Agobot.3.j

类别： 蠕虫病毒

病毒资料：

破坏方法：

这是一个利用IRC传播的病毒。该病毒运行后，开辟45个线程，疯狂地扫描本地网段的所有IP的135、445通讯端口，猜测连接密码，消耗大量系统和网络资源。

一、修改注册表如下：

1.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

\CurrentVersion\Run

Config Loader : scvhost.exe

2.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

\CurrentVersion\RunServices

Config Loader : scvhost.exe

二、使用下列字符串猜测密码

locator

print$

admin$

mypass

Login

owner

secret

Foobar

patrick

alpha

123abc

1234qwer

123123

121212

111111

enable

godblessyou

ihavenopass

123asd

super

Internet

computer

server

123qwe

sybase

Oracle

database

passwd

88888888

11111111

00000000

000000

54321

654321

123456789

12345678

1234567

123456

12345

PassWord

password

Admin

Inviter

Guest

Owner

Administrador

Standard

Default

Administrateur

administrator

admin

Administrator

netbios

default

三、终止下列进程，都是反病毒软件

ZONEALARM.EXE

WFINDV32.EXE

WEBSCANX.EXE

VSSTAT.EXE

VSHWIN32.EXE

VSECOMR.EXE

VSCAN40.EXE

VETTRAY.EXE

VET95.EXE

TDS2-NT.EXE

TDS2-98.EXE

TCA.EXE

TBSCAN.EXE

SWEEP95.EXE

SPHINX.EXE

SMC.EXE

SERV95.EXE

SCRSCAN.EXE

SCANPM.EXE

SCAN95.EXE

SCAN32.EXE

SAFEWEB.EXE

RESCUE.EXE

RAV7WIN.EXE

RAV7.EXE

PERSFW.EXE

PCFWALLICON.EXE

PCCWIN98.EXE

PAVW.EXE

PAVSCHED.EXE

PAVCL.EXE

PADMIN.EXE

OUTPOST.EXE

NVC95.EXE

NUPGRADE.EXE

NORMIST.EXE

NMAIN.EXE

NISUM.EXE

NAVWNT.EXE

NAVW32.EXE

NAVNT.EXE

NAVLU32.EXE

NAVAPW32.EXE

N32SCANW.EXE

MPFTRAY.EXE

MOOLIVE.EXE

LUALL.EXE

LOOKOUT.EXE

LOCKDOWN2000.EXE

JEDI.EXE

IOMON98.EXE

IFACE.EXE

ICSUPPNT.EXE

ICSUPP95.EXE

ICMON.EXE

ICLOADNT.EXE

ICLOAD95.EXE

IBMAVSP.EXE

IBMASN.EXE

IAMSERV.EXE

IAMAPP.EXE

FRW.EXE

FPROT.EXE

FP-WIN.EXE

FINDVIRU.EXE

F-STOPW.EXE

F-PROT95.EXE

F-PROT.EXE

F-AGNT95.EXE

ESPWATCH.EXE

ESAFE.EXE

ECENGINE.EXE

DVP95_0.EXE

DVP95.EXE

CLEANER3.EXE

CLEANER.EXE

CLAW95CF.EXE

CLAW95.EXE

CFINET32.EXE

CFINET.EXE

CFIAUDIT.EXE

CFIADMIN.EXE

BLACKICE.EXE

BLACKD.EXE

AVWUPD32.EXE

AVWIN95.EXE

AVSCHED32.EXE

AVPUPD.EXE

AVPTC32.EXE

AVPM.EXE

AVPDOS32.EXE

AVPCC.EXE

AVP32.EXE

AVP.EXE

AVNT.EXE

AVKSERV.EXE

AVGCTRL.EXE

AVE32.EXE

AVCONSOL.EXE

AUTODOWN.EXE

APVXDWIN.EXE

ANTI-TROJAN.EXE

ACKWIN32.EXE

_AVPM.EXE

_AVPCC.EXE

_AVP32.EXE

病毒的清除法：

使用光华反病毒软件，彻底删除。

病毒演示：

病毒FAQ：

Windows下的PE病毒。

发现日期：

2003-10-31

• ·Worm.generic.h
• ·Worm.Dumaru.c
• ·Worm.Dumaru.b
• ·Worm.Nihilit.s
• ·Worm.Sober
• ·Worm.Win32.Fernando
• ·Worm.Raleka.a.enc
• ·Dropper.LMir.Gate.enc
• ·Bat.CrazyMd
• ·Worm.Atale.a.enc