病毒名称(中文):
袋子
病毒别名:
威胁级别:
★★☆☆☆
病毒类型:
蠕虫病毒
病毒长度:
157203
影响系统:
Win9xWinNT
病毒行为:
该病毒通过邮件传播，它通过自身的发信模块发送信件，信件的标题、内容和附件名都是可变的，附件是一个扩展名为exe或zip的文件。
该病毒还会修改本地hosts文件，使用户访问不了包括各大杀毒软件厂商网站在内的站点及微软公司的技术支持站点，无法更新安全程序。
另外，该病毒还会禁止一些安全软件的执行。
a.病毒启动后会创建如下文件：
%system%\rpc32.exe
%system%\run32.exe
%system%\sysboot.doc.exe
b.向系统中添加一个服务：
服务名称：RPC32
显示名称：NetworkExplorer
描述：Startsandconfiguresaccessibilitytoolsfromonewindow
可执行文件路径：%system%\rpc32.exe
c.病毒会删除包含如下文件的服务、注册表项。以达到阻止防病毒软件等安全软件启动的目的。
mpfagent.exe
mpfconsole.exe
mpfservice.exe
mpftray.exe
mpfui.dll
mpfupdchk.dll
mpfwizard.exe
mvtx.exe
dunzip32.dll
mcappins.exe
mcinfo.exe
mghtml.exe
804mbd1.chk
804mbd1.img
appinit.ini
ashldres.dll
edisk.dll
emscnres.dll
ftscnres.dll
imscnbin.inf
imscnres.inf
mcavtsub.dll
mcmnhdlr.exe
mcscan32.dll
mcshield.exe
mcurial.dll
mcvsctl.dll
mcvsescn.exe
mcvsftsn.exe
mcvsmap.exe
mcvsrte.exe
mcvsscrp.dll
mcvsshl.dll
mcvsshld.exe
mcvsskt.dll
mcvsworm.dll
naiann.dll
naievent.dll
ntclient.dll
outscan.dll
outscres.dll
patchw32.dll
scan.dat
scanserv.dll
scrpres.dll
scrpsbin.inf
scrstres.inf
shextbin.inf
shextres.inf
shlres.dll
vsagntui.dll
mcshield.dll
vsoui.dll
vsoupd.dll
vsowow.dll
wormres.dll
alert.zap
email.zap
filter.zap
firewall.zap
framewrk.dll
idlock.zap
programs.zap
security.zap
tutorwiz.dll
zatutor.exe
zauninst.exe
zav.zap
zlclient.exe
zl_priv.htm
zonealarm.exe
camupd.dll
cerbprovider.pvx
ssleay32.dll
vsavpro.dll
vsdb.dll
vsmon.exe
vsruledb.dll
vsvault.dll
zlparser.dll
aboutplg.dll
apwcmdnt.dll
apwutil.dll
avcompbr.dll
avres.dll
bootwarn.exe
ccavmail.dll
ccimscan.dll
ccimscn.exe
cfgwiz.exe
cfgwzres.dll
defalert.dll
djsalert.dll
ltchkres.dll
n32call.dll
n32exclu.dll
navap32.dll
navapscr.dll
navapsvc.exe
navapw32.dll
navapw32.exe
navcfgwz.dll
navcomui.dll
naverror.dll
navevent.dll
navlcom.dll
navlnch.dll
navlogv.dll
navlucbk.dll
navntutl.dll
navoptrf.dll
navopts.dll
navprod.dll
navshext.dll
navstats.dll
navstub.exe
navtasks.dll
navtskwz.dll
navui.dll
navui.nsi
navuihtm.dll
navw32.exe
navwnt.exe
netbrext.dll
oeheur.dll
officeav.dll
opscan.exe
patch25d.dll
probegse.dll
ptchinst.dll
qconres.dll
qconsole.exe
qspak32.dll
quar32.dll
quarantine
quaropts.dat
s32integ.dll
s32navo.dll
savrt.sys
savrt32.dll
savrtpel.sys
savscan.exe
scandlvr.dll
scandres.dll
scanmgr.dll
scriptui.dll
sdpck32i.dll
sdsnd32i.dll
sdsok32i.dll
sdstp32i.dll
statushp.dll
symnavo.dll
ashavast.exe
ashbug.exe
ashchest.exe
ashdisp.exe
ashlogv.exe
ashmaisv.exe
ashpopwz.exe
ashquick.exe
ashserv.exe
ashsimpl.exe
ashskpcc.exe
ashskpck.exe
aswboot.exe
aswregsvr.exe
aswupdsv.exe
sched.exe
persfw.exe
pfwadmin.exe
d.向用户的hosts文件中添加如下项目，导致用户无法访问一些安全站点，并阻止一些安全软件的更新
127.0.0.1ad.doubleclick.net
127.0.0.1ad.fastclick.net
127.0.0.1ads.fastclick.net
127.0.0.1ar.atwola.com
127.0.0.1atdmt.com
127.0.0.1avp.ch
127.0.0.1avp.com
127.0.0.1avp.ru
127.0.0.1awaps.net
127.0.0.1banner.fastclick.net
127.0.0.1banners.fastclick.net
127.0.0.1ca.com
127.0.0.1click.atdmt.com
127.0.0.1clicks.atdmt.com
127.0.0.1dispatch.mcafee.com
127.0.0.1download.mcafee.com
127.0.0.1download.microsoft.com
127.0.0.1downloads.microsoft.com
127.0.0.1engine.awaps.net
127.0.0.1fastclick.net
127.0.0.1f-secure.com
127.0.0.1ftp.f-secure.com
127.0.0.1ftp.sophos.com
127.0.0.1go.microsoft.com
127.0.0.1liveupdate.symantec.com
127.0.0.1mast.mcafee.com
127.0.0.1mcafee.com
127.0.0.1media.fastclick.net
127.0.0.1msdn.microsoft.com
127.0.0.1my-etrust.com
127.0.0.1nai.com
127.0.0.1networkassociates.com
127.0.0.1office.microsoft.com
127.0.0.1phx.corporate-ir.net
127.0.0.1secure.nai.com
127.0.0.1securityresponse.symantec.com
127.0.0.1service1.symantec.com
127.0.0.1sophos.com
127.0.0.1spd.atdmt.com
127.0.0.1support.microsoft.com
127.0.0.1symantec.com
127.0.0.1update.symantec.com
127.0.0.1updates.symantec.com
127.0.0.1us.mcafee.com
127.0.0.1vil.nai.com
127.0.0.1viruslist.ru
127.0.0.1windowsupdate.microsoft.com
127.0.0.1www.avp.ch
127.0.0.1www.avp.com
127.0.0.1www.avp.ru
127.0.0.1www.awaps.net
127.0.0.1www.ca.com
127.0.0.1www.fastclick.net
127.0.0.1www.f-secure.com
127.0.0.1www.kaspersky.ru
127.0.0.1www.mcafee.com
127.0.0.1www.my-etrust.com
127.0.0.1www.nai.com
127.0.0.1www.networkassociates.com
127.0.0.1www.sophos.com
127.0.0.1www.symantec.com
127.0.0.1www.trendmicro.com
127.0.0.1www.viruslist.ru
127.0.0.1www3.ca.com
e.从如下扩展名的文件中收集邮件地址：TBB、tbb、TBI、tbi、DBX、dbx、HTM、htm、TXT、txt，向收集到的地址发送邮件。
发送时，会避免向如下字符串的地址发送邮件：
winzip
winrar
webmaster@
update
unix
support@
support
spam
sopho
samples
root@
rating@
postmaster@
pgp
panda
ntivi
noreply
noone@
nobody@
news
netadmin@
local
listserv
linux
kasp
info@
icrosoft
hostmaster@
help@
gold-certs@
gold-
free-av
feste
f-secur
contract@
contact@
certs@
certific
cafee
bugs@
bsd
anyone@
all@
administrator@
admin
abuse
@microsoft
@messagelab
@iana
@foo
@avp
f.向上一步收集到的邮件地址发信，
信的标题可能为如下之一：
Att
Allert!
re:order
re:please
re:Andrey
Vasia
text
Warning
Administrator
bestregards
waiting
attach
attachments
Amirecans
Russian"s
Hello
Haveaniceday
office
Money
contract
toxic
urgent
Readthis
pleaseresponce
ASAP
信的内容可能为如下之一：
Hi
DidyougetthepreviousdocumentIattachedforyou?
Iresentitinthisemailjustincase,becauseI
reallyneedyoutocheckitoutasap.
BestRegards
Hi
Imadeamistakeandforgottoclickattach
onthepreviousemailIsentyou.Pleasegiveme
youropiniononthisopportunitywhenyougetachance.
BestRegards
Hi
Iwassupposedtosendyouthisdocumentyesterday.
Sorryforthedelay,pleaseforwardthistoyourfamilyifpossible.
Itcontainsimportantinfoforbothofyou.
Hi
Sorry,Iforgottosendanimportant
documenttoyouinthatlastemail.Ihadanimportantphonecall.
Pleasecheckoutattacheddocfilewhenyouhaveamoment.
BestRegards
Hi
IwasinarushandIforgottoattachanimportant
document.Pleaseseeattacheddocfile.
BestRegards,
Sorrytobotheryou,butIamhavingaproblemreceivingyouremails.
Iamrespondingtoyourlastemailintheattachedfile.
Pleasegetbacktomeifthereisanyproblemreadingtheattachment.
Iamrespondingtoyourlastemailintheattachedfile.
Ihadadeliveryproblemwithyourinbox,somaybeyou"llreceivethis
now.
CanyoupleasecheckouttheemailIhaveattached?
Forsomereason,Ireceivedonlypartofyourlastseveralemails.
Iwanttomakesurethattherearenoproblemswitheitherofour
accounts.
Thisemailisbeingsentasattachmentbecause
itwaspreviouslyblockedbyyouremailfilters.
Pleaseviewtheattachmentandrespond.
Thanks
Iresentthisemailasattachmentbecause
itwaspreviouslyblockedbyyouremailfilters.
Pleasereadtheattachmentandrespond.
Thanks
Iapologize,butIneedyoutoverify
thatIhavethecorrectcontactinfoforyou.
Mysystemcrashedlastweekendand
Ilostmostofmyfriendsandworkcontacts.
Pleasechecktheattached(.pdf)and
pleaseletmeknowifyourinfoiscurrent.
Mylastemailtoyouwasreturned.
ThereasonisthatIamnotcurrently
addedtoyourallowedcontactlist.
Pleaseaddmyupdatedcontactinfo
providedintheattached(.pdf)file
soIcansendyouemailsinthefuture.
Sincerely
Ihaveupdatedmyemailaddress
Seethe(.pdf)fileattachedand
pleaserespondifyouhaveanyquestions.
Wehavemaderecentupdatestoourdatabase.
Pleaseverifyyourmailingaddressonfileiscorrect.
Wehaveattacheda(.pdf)sheetforyoutouseforyourresponse.
Hello
Ourcontactinformationhaschanged.
Seetheattached(.pdf)sheetfordetails.
Sincerely,
***URGENT:SERVICESHUTDOWNNOTICE***
Duetoyourfailuretocomplywithouremail
RulesandRegulations,youremailaccounthasbeen
temporarilysuspendedfor24hoursunlesswearecontactedregarding
thissituation.
Youmustreadtheattacheddocumentforfurther
instructions.Failuretocomplywillresultinterminationofyour
account.
Regards,
NetOperator
***URGENT:SERVICESHUTDOWNNOTICE***
***ATTENTION:YOUREMAILISNOTBEINGDELIVERED!***
Youarecurrentlyunabletosendemails.
Thismaybeabillingissue.
Pleasecallthebillingcenter.
The#forthebillingofficeislocatedintheattached
contactlistforyourconvenience.
***ATTENTION:YOUREMAILISNOTBEINGDELIVERED!***
***YOURMESSAGEHASBEENRECOGNIZEDASSPAM***
Hello,
Thepreviousemailyousenthasbeenrecognizedasspam.
Thismeansyouremailwasnotdeliveredtoyourfriendorclient.
Youmustopentheattachedfiletoreceivemoreinformation.
***YOURMESSAGEHASBEENRECOGNIZEDASSPAM***
Hello,
Whatversionofwindowsyouareusing?
ThislastdocumentIreceivedfromyoucameoutweird.
Pleaseseetheattachedwordfileandresendthefiletome.
Manythanks,
User
Hello,
MyPCcrashedwhileIwassendingthatlastemail.
Ihavere-attachedthedocumentofyoursthatIdiscovered.
PleasereadattacheddocumentandrespondASAP.
Sincerely,
User
Hello,
YouremailwassentinanINVALIDformat.
Toverifythisemailwassentfromyou,
simplyopentheattachedemail(.eml)file
andclickyesinthesenderoptionsbox.
ThankYou,
User
Hello,
Youremailwasreceived.
YOURREPLYISURGENT!
Pleaseviewtheattachedtextfileforinstructions.
Regards,
User
Hello,
IwasinahurryandIforgottoattachanimportant
document.Pleaseseeattached.
BestRegards,
User
Hello,
Iresentthisemailasattachmentbecause
itwaspreviouslyblockedbyyouremailfilters.
Pleasereadtheattachmentandrespond.
Thanks,User
Hello,
Sorry,Iforgottoattachthenewcontactinformation.
Pleaseviewtheattached(.pdf)contactsheet.
Sincerely,
User
信的附件名可能为如下名称之一（这些文件在发送时会在%System%目录生成）：
backup.zip
admin.zip
archivator.zip
about.zip
readme.zip
help.zip
photos.zip
payment.zip
archives.zip
manual.zip
inbox.zip
outbox.zip
save.zip
rar.zip
zip.zip
ataches.zip
documentation.zip
docs.zip
backup.doc.exe
admin.doc.exe
archivator.doc.exe
about.doc.exe
readme.doc.exe
help.doc.exe
photos.doc.exe
payment.doc.exe
archives.doc.exe
manual.doc.exe
inbox.doc.exe
outbox.doc.exe
save.doc.exe
rar.doc.exe
zip.doc.exe
ataches.doc.exe
documentation.doc.exe
docs.doc.exe
sysboot.doc.exe
