Worm.NetSky.c

王朝c#·作者佚名  2008-05-31
窄屏简体版  字體: |||超大  

病毒名称:

Worm.NetSky.c

类别: 蠕虫

病毒资料:

破坏方法:

一旦执行,病毒将执行以下操作:

1.本地首先将创建一个名为:"[SkyNet.cz]SystemsMutex."的互斥量来保证只运行病毒的一个副本;

2.复制自己到windows目录下:

%WINDIR%\Winlogon.exe;

3.添加如下键值:

"ICQ Net" = "%WINDIR%\winlogon.exe -stealth"

到注册表键:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows CurrentVersion\Run 下,这是病毒自启动的伎俩;

删除键:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows CurrentVersion\Run

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows CurrentVersion\Run

下的如下键值:

Taskmon

EXPlorer

Windows Services Host

KASPerskyAV

删除键:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows CurrentVersion\Run下的如下键值:

System.

msgsvr32

DELETE ME

service

Sentry

删除键:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows CurrentVersion\Run

下的如下键值:

d3dupdate.exe

au.exe

OLE

删除键:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows CurrentVersion\RunServices

下的如下键值:

System.

删除子键:

HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32

其中键值:

"KasperskyAV"是病毒:"Worm.Mimail.t"的自启动键值;

"Taskmon" 和"Explorer"是病毒:"SCO炸弹"的键值.

4.病毒从带有下列扩展名的文件中搜索Email地址:

.eml

.txt

.PHP

.pl

.htm

.Html

.vbs

.rtf

.uin

.asp

.wab

.doc

.adb

.tbb

.dbx

.sht

.oft

.msg

.shtm

.cgi

.dhtm

5.病毒从C:\到Z:\搜索带有如下字眼的文件夹:

"Shar"

只要该文件夹所在的驱动器不是CD_ROM,病毒就将复制自己到这个文件夹和此文件夹的所有子目录下

文件名可能为下列之一:

Microsoft WinXP Crack.exe

Teen Porn 16.jpg.pif

Adobe Premiere 9.exe

Adobe Photoshop 9 full.exe

Best Matrix Screensaver.scr

Porno Screensaver.scr

Dark Angels.pif

XXX hardcore pic.jpg.exe

Microsoft Office 2003 Crack.exe

Serials.txt.exe

Screensaver.scr

Full album.mp3.pif

Ahead Nero 7.exe

Virii Sourcecode.scr

E-Book Archive.rtf.exe

Doom 3 Beta.exe

How to hack.doc.exe

Learn Programming.doc.exe

WinXP eBook.doc.exe

Win Longhorn Beta.exe

Dictionary English - France.doc.exe

RFC Basics Full Edition.doc.exe

1000 Sex and more.rtf.exe

3D Studio Max 3dsmax.exe

Keygen 4 all appz.exe

Windows Sourcecode.doc.exe

Norton Antivirus 2004.exe

Gimp 1.5 Full with Key.exe

Partitionsmagic 9.0.exe

Star Office 8.exe

Magix Video Deluxe 4.exe

Clone DVD 5.exe

MS Service Pack 5.exe

ACDSee 9.exe

Visual Studio Net Crack.exe

Cracks & Warez Archive.exe

WinAMP 12 full.exe

DivX 7.0 final.exe

Opera.exe

IE58.1 full setup.exe

Smashing the stack.rtf.exe

Ulead Keygen.exe

Lightwave SE Update.exe

The Sims 3 crack.exe

6.病毒使用自带的SMTP引擎向上面搜到的Email地址发送带毒邮件:

邮件带有如下特征:

From: (Spoofed)

标题为下列之一:

Delivery Failed

Status

report

question

trust me

hey

Re: excuse me

read it immediatelly

hi

Re: does it?

Yep

important

hello

dear

Re: unknown

fake?

warning

moin

what's up?

info

Re: information

Here is it

stolen

private?

good morning

illegal...

error

take it

re:

Re: Re: Re: Re:

you?

something for you

exception

Re: hey

excuse me

Re: hi

Re: does it?

Re: important

Re: hello

believe me

Question

denied!

notification

Re:

病毒的清除法:

使用光华反病毒软件,彻底删除。

病毒演示:

病毒FAQ:

Windows下的PE病毒。

发现日期:

2004-2-26

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
 
 
© 2005- 王朝網路 版權所有 導航