病毒名称:
I-Worm.Salga.a
类别： 蠕虫病毒
病毒资料：
破坏方法：
该病毒是一个Visual Basic写的蠕虫病毒
一旦运行，该病毒将复制到下列目录：
C:\WINNT\system32\egywormo[gen1].exe
C:\Program Files\Accessories\Nicole kidman.zip...............exe
C:\hard core hook from web
C:\WINNT\All Users\Desktop\sex cam
\sex photoes of monika.zip.exe
C:\Documents and Settings\All Users\DESKTOP
\holywood stuff film.zip.exe
C:\Documents and Settings\All Users\Start Menu
\nicole kidman sexy cam.zip.exe
C:\Documents and Settings\All Users\Start Menu
\Programs\your sexy cam.zip.exe
C:\Documents and Settings\All Users\Start Menu
\Programs\Accessories\magic
graphices maker.zip
C:\WINNT\Start Menu\inter net speeder.zip.exe
C:\WINNT\start menu\programs\new chat prog.zip.exe
C:\Tools\system copy.exe
C:\Program Files\Accessories\BRITNY SPEARS MARRAGE.zip...............exe
C:\Program Files\Accessories\Is Bnladen realy cow boy.zip...............exe
C:\Program Files\Accessories\Details.zip...............exe
C:\Program Files\Accessories\Details
of new friends.zip...............exe
C:\Program Files\Accessories\kASPer2005.zip...............exe
C:\Program Files\Accessories\hard sex files.zip...............exe
...（有删节）
该病毒通过向Outlook联系人发送带毒邮件来传播，邮件可能包含内容如 "Hi:miss or mr you can contact new friends all ever the world deatails in attachmment file"
"New version of kasper fire wall"
"This attachmment contain very hard sexy photos with part of sexy films interest and replay us" 等等
它还能通过mIRC的文件共享传播（使用DCC 发送病毒体）
修改如下注册表键值：
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
"windows" = "％SYSDIR％\system copy.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
"system XP" = "％WINDIR％\acdsee demo.exe"
病毒的清除法：
使用光华反病毒软件，彻底删除。
病毒演示：
病毒FAQ：
Windows下的PE病毒。
发现日期：
2004-12-23
