病毒名称(中文):
狂妄猎手
病毒别名:
威胁级别:
★★☆☆☆
病毒类型:
蠕虫病毒
病毒长度:
44544
影响系统:
Win9xWinNT
病毒行为:
这是一个通过邮件附件的方式传播的蠕虫,他会破坏用户计算机的保护措施,如,关闭防火墙,常见杀毒软件等,禁用注册表编辑器,还有一些恶意行为,如禁用开始菜单中的运行,隐藏硬盘分区,禁止用户进入Windows2000的MS-DOS方式,禁止显示"远程治理",等为其他的病毒做铺垫。
1.生成文件:
IExplore.exe
MSLARISSA.pif
CmdPrompt32.pif
SP00Lsv32.pif
C:\WINDOWS\WinVBS.vbs
C:\MESSAGE_TO_USER.txt
C:\MESSAGE_TO_AVs.txt
C:\MESSAGE_TO_BROPIA.txt
2.注册表:
增加键值:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
MSLARISSA:MSLARISSA.pif
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CommandPrompt32:CmdPrompt32.pif
增加启动项,使病毒开机运行。
修改键值:
Software\Microsoft\Windows\CurrentVersion\Explorer\Sheelfol
设置病毒本身和IE的关联,做到一打开IE的同时病毒就被打开。
3.下载文件http://www.geocities.com/mslarissac/WindowsSecurityUpdate.zip
4.生成文件C:\MESSAGE_TO_USER.txt的内容
Greetztoinfecteduser!Iwillsurvive,Inthismomentintime."Yourcomputerwillcrash,So,youwillbemine.Iwillnotcrash,Iwillnotfail.So,inthismomentintime,Iwillsurvive...
-LARISSAAUTHOR:2-24-05
C:\MESSAGE_TO_AVs.txt的内容
GreetztoAVs!
IwannabeinAVindustrywhenIgrowup:-)
LARISSAAUTHOR:2-24-05
C:\MESSAGE_TO_BROPIA.txt
HeyBropia..stopmakingMSNwormsit",27h"sstupid......lol--LarissaAntiBropia...--SavingtheworldfromBROPIA!!!
-LARISSAAUTHOR:2-24-05
5.邮件的内容为下面的随机一洌?
Themessageislocatedintheattachments.
Theletteryourequestedisintheattachments.
Informationattached.
KindlyreadandreplytomyLOVELETTERintheattachments:-)
Thedocumentsyourequestedareintheattachments.
InforeguardingyourEmailaccountisintheattachments.
DearWindowsUserPleasedownloadthewindowsupdateincludedintheattachmen
Myletterisintheattachments.
Youremailaccountisabouttoexpire,pleasechecktheattachmentsfordetails.
6.邮件的随机主题
Re:Message
Re:Letter
Re:Information
ILOVEYOU
Re:YourDocuments
Re:AccountInfo
WindowsUpdate
Re:MyLetter
Re:Docs
Re:YourEmailInfo
7.邮件附件的随机名称:
Message.exe
Letter.exe
Information.exe
LOVE_LETTER_FOR_YOU.exe
Documents.exe
Attached_Message.exe
Microsoft_Update.exe
Private_Letter.exe
Private_Document.exe
Important_Message.exe
8.把病毒自己复制到下面目录里面:
"b:"
"c:"
"d:"
"e:"
"f:"
"g:"
"h:"
"i:"
"j:"
"k:"
"l:"
"m:"
"n:"
"o:"
"q:"
"r:"
"s:"
"t:"
"u:"
"v:"
"w:"
"x:"
"y:"
"z:"
9.病毒会关闭一些保护软件,也会关闭一些病毒
"AGENTSVR.EXE"
"ANTI-TROJAN.EXE"
"ANTIVIRUS.EXE"
"ANTS.EXE"
"APIMONITOR.EXE"
"APLICA32.EXE"
"APVXDWIN.EXE"
"ATCON.EXE"
"ATGUARD.EXE"
"ATRO55EN.EXE"
"ATUPDATER.EXE"
"ATWATCH.EXE"
"ZAPRO.EXE"
"ZAPSETUP3001.EXE"
"ZATUTOR.EXE"
"ZAUINST.EXE"
"ZONALM2601.EXE"
"ZONEALARM.EXE"
"AUPDATE.EXE"
"AUTODOWN.EXE"
"AUTOTRACE.EXE"
"AUTOUPDATE.EXE"
"AVCONSOL.EXE"
"AVGSERV9.EXE"
"AVLTMAIN.EXE"
"AVPUPD.EXE"
"AVSYNMGR.EXE"
"AVWUPD32.EXE"
"AVXQUAR.EXE"
"AVprotect9x.exe"
"Au.exe"
"BD_PROFESSIONAL.EXE"....