病毒名称:
Worm.NetSky.c
类别： 蠕虫
病毒资料：
破坏方法：
一旦执行,病毒将执行以下操作:
1.本地首先将创建一个名为:"[SkyNet.cz]SystemsMutex."的互斥量来保证只运行病毒的一个副本;
2.复制自己到windows目录下:
％WINDIR％\Winlogon.exe;
3.添加如下键值:
"ICQ Net" = "％WINDIR％\winlogon.exe -stealth"
到注册表键:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows CurrentVersion\Run 下,这是病毒自启动的伎俩;
删除键:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows CurrentVersion\Run
下的如下键值:
Taskmon
EXPlorer
Windows Services Host
KASPerskyAV
删除键:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows CurrentVersion\Run下的如下键值:
System.
msgsvr32
DELETE ME
service
Sentry
删除键:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows CurrentVersion\Run
下的如下键值:
d3dupdate.exe
au.exe
OLE
删除键:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows CurrentVersion\RunServices
下的如下键值:
System.
删除子键:
HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32
其中键值:
"KasperskyAV"是病毒:"Worm.Mimail.t"的自启动键值;
"Taskmon" 和"Explorer"是病毒:"SCO炸弹"的键值.
4.病毒从带有下列扩展名的文件中搜索Email地址:
.eml
.txt
.PHP
.pl
.htm
.Html
.vbs
.rtf
.uin
.asp
.wab
.doc
.adb
.tbb
.dbx
.sht
.oft
.msg
.shtm
.cgi
.dhtm
5.病毒从C:\到Z:\搜索带有如下字眼的文件夹:
"Shar"
只要该文件夹所在的驱动器不是CD_ROM,病毒就将复制自己到这个文件夹和此文件夹的所有子目录下
文件名可能为下列之一:
Microsoft WinXP Crack.exe
Teen Porn 16.jpg.pif
Adobe Premiere 9.exe
Adobe Photoshop 9 full.exe
Best Matrix Screensaver.scr
Porno Screensaver.scr
Dark Angels.pif
XXX hardcore pic.jpg.exe
Microsoft Office 2003 Crack.exe
Serials.txt.exe
Screensaver.scr
Full album.mp3.pif
Ahead Nero 7.exe
Virii Sourcecode.scr
E-Book Archive.rtf.exe
Doom 3 Beta.exe
How to hack.doc.exe
Learn Programming.doc.exe
WinXP eBook.doc.exe
Win Longhorn Beta.exe
Dictionary English - France.doc.exe
RFC Basics Full Edition.doc.exe
1000 Sex and more.rtf.exe
3D Studio Max 3dsmax.exe
Keygen 4 all appz.exe
Windows Sourcecode.doc.exe
Norton Antivirus 2004.exe
Gimp 1.5 Full with Key.exe
Partitionsmagic 9.0.exe
Star Office 8.exe
Magix Video Deluxe 4.exe
Clone DVD 5.exe
MS Service Pack 5.exe
ACDSee 9.exe
Visual Studio Net Crack.exe
Cracks & Warez Archive.exe
WinAMP 12 full.exe
DivX 7.0 final.exe
Opera.exe
IE58.1 full setup.exe
Smashing the stack.rtf.exe
Ulead Keygen.exe
Lightwave SE Update.exe
The Sims 3 crack.exe
6.病毒使用自带的SMTP引擎向上面搜到的Email地址发送带毒邮件:
邮件带有如下特征:
From: (Spoofed)
标题为下列之一:
Delivery Failed
Status
report
question
trust me
hey
Re: excuse me
read it immediatelly
hi
Re: does it?
Yep
important
hello
dear
Re: unknown
fake?
warning
moin
what's up?
info
Re: information
Here is it
stolen
private?
good morning
illegal...
error
take it
re:
Re: Re: Re: Re:
you?
something for you
exception
Re: hey
excuse me
Re: hi
Re: does it?
Re: important
Re: hello
believe me
Question
denied!
notification
Re:
病毒的清除法：
使用光华反病毒软件，彻底删除。
病毒演示：
病毒FAQ：
Windows下的PE病毒。
发现日期：
2004-2-26
