病毒名称:
Worm.BBeagle.aj
类别： 蠕虫
病毒资料：
破坏方法：
这是蠕虫病毒“恶鹰”新变种，病毒采用UPX压缩，使用32位汇编编写。
一旦运行病毒将执行如下操作：
1.病毒将显示一个虚假的错误信息；
2.病毒将创建多个互斥量：
MuXxXxTENYKSDesignedAsTheFollowerOfSkynet-D
'D'r'o'p'p'e'd'S'k'y'N'e't'
-oOaxX-+S+-+k+-+y+-+N+-+e+-+t+-XxKOo-_
[SkyNet.cz]SystemsMutex
AdmSkynetJklS003
_---U
_-oO]xX-S-k-y-N-e-t-Xx[Oo-_
这些互斥量是其前一些版本创建的，病毒利用此来禁止其它变种的运行；
2.病毒将删除键：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft Windows\CurrentVersion\Run
下的如下键值：
"My AV"
"Zone Labs Client Ex"
"9XHtProtect"
"Antivirus"
"Special Firewall Service"
"service"
"Tiny AV"
"ICQNet"
"HtProtect"
"NetDy"
"Jammer2nd"
"FirewallSvr"
"MsInfo"
"SysMonXP"
"EasyAV"
"PandaAVEngine"
"Norton Antivirus AV"
"KASPerskyAVEng"
"SkynetsRevenge"
"ICQ Net"
3.病毒释放如下文件：
％WINDIR％\cplstub.exe
％SYSDIR％\loader_name.exe
％SYSDIR％\loader_name.exeopen
％SYSDIR％\loader_name.exeopenopen
4.病毒向注册表添加如下值来自启动：
HKEY_CURRENT_USER\Software\Microsoft\Windows CurrentVersion\Run "reg_key" = "％System％\loader_name.exe"
5.病毒打开一个后门监听 TCP 端口 1234
6.病毒将试图复制到带有字符串："shar"的目录下，文件名可能为：
Microsoft Office 2003 Crack, Working!.exe
Microsoft Windows XP, WinXP Crack, working Keygen.exe
Microsoft Office XP working Crack, Keygen.exe
Porno, sex, oral, anal cool, awesome!!.exe
Porno Screensaver.scr
Serials.txt.exe
KAV 5.0
Kaspersky Antivirus 5.0
Porno pics arhive, xxx.exe
Windows Sourcecode update.doc.exe
Ahead Nero 7.exe
Windown Longhorn Beta Leak.exe
Opera 8 New!.exe
XXX hardcore images.exe
WinAMP 6 New!.exe
WinAmp 5 Pro Keygen Crack Update.exe
Adobe Photoshop 9 full.exe
Matrix 3 Revolution English SuBTitles.exe
ACDSee 9.exe
7.病毒将从如下扩展名的文件中搜索EMAIL地址：
.wab
.txt
.msg
.htm
.shtm
.stm
.XML
.dbx
.mbx
.mdx
.eml
.nch
.mmf
.ods
.cfg
.asp
.PHP
.pl
.wsh
.adb
.tbb
.sht
.xls
.oft
.uin
.cgi
.mht
.dhtm
.jsp
病毒将使用自己的 SMTP 引擎来发送EMAIL到上面搜到的EMAIL地址，EMAIL特征如下：
发送邮件地址:
主题:
Changes..
Encrypted document
Fax Message
Forum notify
Incoming message
Notification
Protected message
Re: Document
Re: Hello
Re: Hi
Re: Incoming Message
RE: Incoming Msg
RE: Message Notify
Re: Msg reply
RE: Protected message
RE: Text message
Re: Thank you!
Re: Thanks :)
Re: Yahoo!
Site changes
Update
正文:
Attach tells everything.
Attached file tells everything.
Check attached file for details.
Check attached file.
Here is the file.
Message is in attach
More info is in attach
Pay attention at the attach.
Please, have a look at the attached file.
Please, read the document.
Read the attach.
See attach.
See the attached file for details.
Your document is attached.
Your file is attached.
附件名 ：
Information
Details
text_document
Updates
Readme
Document
Info
MoreInfo
Message
附件名扩展名：
.hta
.vbs
.exe
.scr
.com
.cpl
.zip
病毒的清除法：
使用光华反病毒软件，彻底删除。
病毒演示：
病毒FAQ：
WINDOWS下的PE病毒。
发现日期：
2004-7-6
