病毒名称:
Worm.Keco.a
类别: 蠕虫
病毒资料:
破坏方法:
一个蠕虫病毒
病毒行为:
病毒运行后将自己复制到%system%目录下,文件名为:WinShellb.exe
并在system.ini文件的[boot] shell=中加入自己WinShellb.exe以达到随系统启动的目的。
病毒还将显示一个消息框“Now this will try to send a mail to Askel ;D”
病毒将在c:\下生成一个名为的Coke.txt文件。
该文件包含以下字符串信息:
Coke worm is here [Version 2 :)]
Coke worm is here to join the party
Notice to others :
FUCk you Bagel Your just a lucky ScriptKiddie
Fuck you MyDoom Your just a lame retard
Fuck you SkyNet You had luck to get into F-Sec mail-list, nothing special tho.
The virus-scene lost a great coder. Later Benny/29A
You cant code worms, your not worth to be called coders.
You lame niggers.
邮件传播:
病毒读取当前系统注册表中的smtp服务器地址,并尝试用自己的引擎发送邮件。
邮件特征:包含以下字串
RaredMusic,Your_Numbers,Your_Application,Your_Info,Your_CardNumber
PornZip,RaredPorn,Can you please test this?,Check the attachment :),
Test the attachment :),Ive added some documents,Ive added a document,
Someone sent you a eCard,Check the added file,Open the attachment :D
Please, i cant find the error, can you check the file,
......
病毒的清除法:
使用光华反病毒软件,彻底删除。
病毒演示:
病毒FAQ:
Windows下的PE病毒。
发现日期:
2004-3-9