病毒名称(中文):
安哥变种BV
病毒别名:
Backdoor.Agobot.v[AVP]
威胁级别:
★★☆☆☆
病毒类型:
黑客程序
病毒长度:
206848
影响系统:
Win9xWinNTWin2000WinXPWin2003
病毒行为:
安哥家族
编写工具:
vc编写,upx压缩
传染条件:
利用了DCOMRPC漏洞和RPC溢出两个漏洞进行传播,同时也利用弱密码攻击进行传播.
发作条件:
运行后将在本机开设后门等待黑客的远程连接和控制.
系统修改:
1,拷贝自身到
%System%spoolsrv32.exe.
2,添加下列注册表键值:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices
"MSSecurityHotfix"="spoolsrv32.exe"
3,在随机端口开设后门,等待黑客的连接.
4,连接预定的IRc频道,等待黑客通过irc命令进行远程控制.
5,通过TCP135端口进行DCOMRPC(同冲击波病毒)攻击远程的其它机器,或者通过TCP445端口进行RPClocator(同震荡波病毒)溢出攻击进行传播.
6,对局域网机器进行弱密码攻击,进而传播
用户名:
Admin
admin
Administrateur
Administrador
administrator
Administrator
qwer
asdf
win
temp
test
home
Dell
x
xyz
a
abc
aaa
Inviter
Gast
Guest
Test
Owner
owner
User
Standard
mgmt
Default
login
pc
密码:
admin
Admin
mypass
mypc
love
pwd
xxx
zxcv
yxcv
secret
foobar
god
sex
root
pat
patrick
alpha
007
123abc
1234qwer
123123
121212
111111
110
2600
2002
2003
enable
godblessyou
ihavenopass
123asd
super
Internet
computer
server
123qwe
sybase
oracle
abcd
database
passwd
pass
88888888
11111111
00000000
000000
111
54321
654321
123456789
12345678
1234567
123456
12345
1234
123
Password
password
7,偷取下列游戏的cd-key:
WarcraftIII
SoldierofFortuneII-DoubleHelix
Neverwinter
WestwoodNox
TiberianSun
RedAlert2
RedAlert
ProjectIGI2
Command&ConquerGenerals
Battlefield1942SecretWeaponsofWWII
Battlefield1942TheRoadtoRome
Battlefield1942
RainbowSixIIIRavenShield
NascarRacing2003
NascarRacing2002
NHL2003
NHL2002
FIFA2003
FIFA2002
NeedForSpeedHotPursuit2
TheGladiators
UnrealTournament2003
LoMaM
Counter-Strike
Half-Life
8,结束掉以下反病毒软件的进程:
WFINDV32.EXE
WEBSCANX.EXE
VSSTAT.EXE
VSHWIN32.EXE
VSECOMR.EXE
VSCAN40.EXE
VETTRAY.EXE
VET95.EXE
TDS2-NT.EXE
TDS2-98.EXE
TCA.EXE
TBSCAN.EXE
SWEEP95.EXE
SPHINX.EXE
SMC.EXE
SERV95.EXE
SCRSCAN.EXE
SCANPM.EXE
SCAN95.EXE
SCAN32.EXE
SAFEWEB.EXE
RESCUE.EXE
RAV7WIN.EXE
RAV7.EXE
PERSFW.EXE
PCFWALLICON.EXE
PCCWIN98.EXE
PAVW.EXE
PAVSCHED.EXE
PAVCL.EXE
PADMIN.EXE
OUTPOST.EXE
NVC95.EXE
NUPGRADE.EXE
NORMIST.EXE
NMAIN.EXE
NISUM.EXE
NAVWNT.EXE
NAVW32.EXE
NAVNT.EXE
NAVLU32.EXE
NAVAPW32.EXE
N32SCANW.EXE
MPFTRAY.EXE
MOOLIVE.EXE
LUALL.EXE
LOOKOUT.EXE
LOCKDOWN2000.EXE
JEDI.EXE
IOMON98.EXE
IFACE.EXE
ICSUPPNT.EXE
ICSUPP95.EXE
ICMON.EXE
ICLOADNT.EXE
ICLOAD95.EXE
IBMAVSP.EXE
IBMASN.EXE
IAMSERV.EXE
IAMAPP.EXE
FRW.EXE
FPROT.EXE
FP-WIN.EXE
FINDVIRU.EXE
F-STOPW.EXE
F-PROT95.EXE
F-PROT.EXE
F-AGNT95.EXE
ESPWATCH.EXE
ESAFE.EXE
ECENGINE.EXE
DVP95_0.EXE
DVP95.EXE
CLEANER3.EXE
CLEANER.EXE
CLAW95CF.EXE
CLAW95.EXE
CFINET32.EXE
CFINET.EXE
CFIAUDIT.EXE
CFIADMIN.EXE
BLACKICE.EXE
BLACKD.EXE
AVWUPD32.EXE
AVWIN95.EXE
AVSCHED32.EXE
AVPUPD.EXE
AVPTC32.EXE
AVPM.EXE
AVPDOS32.EXE
AVPCC.EXE
AVP32.EXE
AVP.EXE
AVNT.EXE
AVKSERV.EXE
AVGCTRL.EXE
AVE32.EXE
AVCONSOL.EXE
AUTODOWN.EXE
APVXDWIN.EXE
ANTI-TROJAN.EXE
ACKWIN32.EXE
_AVPM.EXE
_AVPCC.EXE
_AVP32.EXE
ZONEALARM.EXE
9,同时结束掉以下敌对病毒的进程:
mspatch.exe
penis32.exe
msblast.exe
scvhosl.exe
winhlpp32.exe
tftpd.exe
dllhost.exe
winppr32.exe
发作现象:
防火墙退出或失效,机器向外大量发送数据包.
非凡说明:
利用两个重大漏洞进行传播
