病毒名称(中文):
考格兄弟变种P
病毒别名:
I-Worm.Korgo.p.58CFC05B.V[AVP]
威胁级别:
★★★☆☆
病毒类型:
蠕虫病毒
病毒长度:
9343
影响系统:
Win9xWinMeWinNTWin2000WinXP
病毒行为:
编写工具:
传染条件:
发作条件:
系统修改:
从注册表主键HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
删除如下键值:
MSConfigv13
avserve2.exeUpdateService
avserve.exe
WindowsUpdateService
WinUpdate
SysTray
BotLoader
SystemRestoreService
DiskDefragmenter
WindowsSecurityManager
在注册表主键HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
修改键值"WindowsUpdate"="%System%*.exe"(注:*表示该文件名是随机生成的)
在注册表主键HKEY_LOCAL_MACHINESOFTWARESoftwareMicrosoftWireless
添加键值"ID"="*"(注:*表示一随机的字符串)
在注册表主键HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternetSettingsConnections
添加键值"DefaultConnectionSettings"=
hex:3c,00,00,00,01,00,00,00,09,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
在注册表主键HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternetSettingsConnections
添加键值"SavedLegacySettings"=
hex:3c,00,00,00,03,00,00,00,09,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
将自身拷贝到%System%*.exe(注:*表示该文件名是随机生成的)
发作现象:
非凡说明:
该病毒会从指定URL下载某个exe文件并在受感染系统上运行
