分享
 
 
 

Worm.Ahker.b

王朝other·作者佚名  2008-08-14
窄屏简体版  字體: |||超大  

病毒名称(中文):

艾克

病毒别名:

WORM_AHKER.B[趋势]Email-Worm.Ahker.a[AVP]

威胁级别:

★★☆☆☆

病毒类型:

蠕虫病毒

病毒长度:

14366

影响系统:

Win9xWinNT

病毒行为:

该病毒通过电子邮件进行传播。它伪装为WindowsXPSP2的补丁,诱使用户运行邮件附件。该病毒会禁止用户的注册表编辑器、记事本、写字板、自动更新、MSN等应用程序。它还通过修改Host文件,以禁止访问一些闻名网站。

1、将自身复制到以下目录:

%System%\Services.exe

2、在C盘生成以下配置文件

C:\NortonAntiVirus.txt

3、在注册表中:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

"NortonAuto-Protect"="SERVICES.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\AutoUpdate

"默认"="SERVICES.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\runservices-

"WindowsService"="SERVICES.exe"

以在开机时自动运行。

4、通过修改以下键值禁止常见软件或功能执行

①禁止任务治理器和注册表工具

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

"DisableTaskMgr"=""dword:00000001"

"DisableRegistryTools"="dword:00000001"

②禁止运行

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

"NoRun"="dword:00000001"

"DisallowRun"="1"

③WindowsXPSp2会停止自动更新

HKEY_CURRENT_USER\Software\Microsoft\securitycenter

UpdatesDisableNotify="dword:00000001"

AntiVirusDisableNotify="dword:00000001"

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsUpdate\AU

NoAutoUpdate="dword:00000001"

④禁止运行以下程序

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun

"1"="regedit.exe"

"2"="notepad.exe"

"3"="wordpad.exe"

"4"="write.exe"

"5"="wuauclt.exe"

"6"="wupdmgr.exe"

"7"="C:\ProgramFiles\MSNMessenger\msnmsgr.exe"

5、尝试从以下网站下载含有自身的压缩包

http://geocities.com/

并保存到

C:\Fix_SP2.zip

6、尝试通过OutLook地址薄查找电子邮件,并向找到邮件发送以下内容的邮件:

主题:

ServicePack2BUG!!

内容:

DearuserIhavebeeninformedthatetherewasaBUGinWindowsServicePack2whichwasfixedIrecommendyoutodownloadthisPatchversionwhichwillfixsthebugandkeepyoursystemsafe.YouwillfindthePatchfileintheattachment,fealfreetosendittoanyone.I"llbeintouchwithyouassoonanotherbugisfound.

Regards,

A.H

附件:

Fix_SP2.zip(内有一个名为Fix_SP2.exe的可执行文件,即病毒本身)

7、修改Host文件,以禁止用户访问这些网站

127.0.0.1www.astalavista.com

127.0.0.1www.cnn.com

127.0.0.1www.coderheaven.com

127.0.0.1www.fbi.gov

127.0.0.1www.gamerevolution.com

127.0.0.1www.geocities.com

127.0.0.1www.google.com

127.0.0.1www.hackers.com

127.0.0.1www.hotmail.com

127.0.0.1www.idm.com

127.0.0.1www.messenger.msn.com

127.0.0.1www.microsoft.com

127.0.0.1www.msn.com

127.0.0.1www.norton.com

127.0.0.1www.rohitab.com

127.0.0.1www.symantec.com

127.0.0.1www.worldsex.com

127.0.0.1www.wwe.com

127.0.0.1www.yahoo.com

8、病毒利用了以下漏洞:

诺顿反病毒软件脚本禁止拒绝服务漏洞(2004.06)

9、在注册表中添加病毒版本信息:

HKEY_LOCAL_MACHINE\SOFTWARE\CurrentVersion"ProductId"="AgentHacker"

HKEY_LOCAL_MACHINE\SOFTWARE\CurrentVersion\AgentHacker"默认"="W32.Ahker.B@mm"

"Version"="B"

"CodeIn"="VisualBasci6.0"

"CodeBy"="AgentHacker"

"Spread"="VIAOutlook"

"Exploit"="SymantecNortonAntivirusScriptBlockerDenialOfServiceVulnerability"

10、病毒尝试关闭以下进程:

AGENTSVR.exe

ANTIVIRUS.exe

ANTS.EXE

APIMONITOR.EXE

APLICA32.EXE

ATCON.EXE

ATRO55EN.EXE

ATUPDATER

ATUPDATER.exe

ATWATCH.EXE

AUPDATE.exe

AUTODOWN.exe

AUTOTRACE.exe

AUTOUPDATE.exe

AVCONSOL.EXE

AVGSERV9.EXE

AVLTMAIN.exe

AVPUPD.exe

AVSYNMGR.EXE

AVWUPD32.exe

AVXQUAR.exe

AVprotect9x.exe

Ackwin32.exe

Alogserv.exe

Amon.exe

Anti-trojan.exe

Apvxdwin.exe

Atguard.exe

Au.exe

Ave32.exe

Avkserv.exe

Avnt.exe

Avpcc.exe

Avpm.exe

Avwin95.exe

BD_PROFESSIONAL.EXE

BIDEF.EXE

BIDSERVER.EXE

BIPCP.EXE

BISP.EXE

BLACKD.EXE

BOOTWARN.EXE

BORG2.EXE

BS120.EXE

BlackIce.exe

CDP.EXE

CFGWIZ.EXE

CFIADMIN.EXE

CFIAUDIT.exe

CFINET.EXE

CFINET32.EXE

CLEAN.EXE

CLEANER.EXE

CLEANER3.EXE

CLEANPC.EXE

CMGRDIAN.EXE

CMON016.EXE

CPD.EXE

CPF9X206.EXE

CPFNT206.EXE

CV.EXE

CWNB181.EXE

CWNTDWMO.EXE

Claw95cf.exe

Cmgrdian.exe

D3dupdate.exe

DEFWATCH.EXE

DEPUTY.EXE

DPF.EXE

DPFSETUP.EXE

DRWATSON.EXE

DRWEBUPW.EXE

DRWEBUPW.exe

ENT.EXE

ESCANH95.EXE

ESCANHNT.EXE

ESCANV95.EXE

EXANTIVIRUS-CNET.EXE

Ecengine.exe

Esafe.exe

F-prot95.exe

FAST.EXE

FIREWALL.EXE

FLOWPROTECTOR.EXE

FP-WIN_TRIAL.EXE

FRW.EXE

FSAV.EXE

FSAV530STBYB.EXE

FSAV530WTBYB.EXE

FSAV95.EXE

Findviru.exe

Fp-win.exe

Fprot.exe

GBMENU.EXE

GBPOLL.EXE

GUARD.EXE

Guarddog.exe

HACKTRACERSETUP.EXE

HTLOG.EXE

HWPE.EXE

IAMAPP.EXE

IAMSERV.EXE

ICLOAD95.EXE

ICLOADNT.EXE

ICMON.EXE

ICSSUPPNT.EXE

ICSSUPPNT.exe

ICSUPP95.EXE

ICSUPP95.exe

ICSUPPNT.EXE

IFW2000.EXE

IPARMOR.EXE

IRIS.EXE

Iamapp.exe

Iomon98.exe

JAMMER.EXE

KAVLI00003A74

KAVPERS40ENG.EXE

KERIO-PF-213-EN-WIN.EXE

KERIO-WRL-421-EN-WIN.EXE

KERIO-WRP-421-EN-WIN.EXE

KILLPROCESSSETUP161.EXE

LDPRO.EXE

LOCALNET.EXE

LOCKDOWN.EXE

LOCKDOWN2000.EXE

LSETUP.EXE

LUALL.exe

LUCOMSERVER.EXE

LUINIT.EXE

Lookout.exe

MCAGENT.EXE

MCUPDATE.EXE

MCUPDATE.exe

MFW2EN.EXE

MFWENG3.02D30.EXE

MGUI.EXE

MINILOG.EXE

MOOLIVE.EXE

MRFLUX.EXE

MSCONFIG.EXE

MSINFO32.EXE

MSSMMC32.EXE

MU0311AD.EXE

NAV80TRY.EXE

NAVAPSvc.exe

NAVDX.EXE

NAVSTUB.EXE

NC2000.EXE

NCINST4.EXE

NDD32.EXE

NEOMONITOR.EXE

NETARMOR.EXE

NETINFO.EXE

NETMON.EXE

NETSCANPRO.EXE

NETSPYHUNTER-1.2.EXE

NETSTAT.EXE

NISSERV.EXE

NISUM.EXE

NMAIN.EXE

NORTON_INTERNET_SECU_3.0_407.EXE

NPF40_TW_98_NT_ME_2K.EXE

NPFMESSENGER.EXE

NSCHED32.EXE

NTVDM.EXE

NUPGRADE.exe

NUPGRADE.exe

NVARCH16.EXE

NWINST4.EXE

NWTOOL16.EXE

Navapsvc.exe

Navapw32.exe

Navt.exe

Navw32.exe

Navwnt.exe

Navwt.exe

Nod32.exe

Nsplugin.exe

OSTRONET.EXE

OUTPOST.EXE

OUTPOSTINSTALL.EXE

OUTPOSTPROINSTALL.EXE

Ogrc.exe

Outpost.exe

PADMIN.EXE

PANIXK.EXE

PAVPROXY.EXE

PCC2002S902.EXE

PCC2K_76_1436.EXE

PCCIOMON.EXE

PCDSETUP.EXE

PCFWALLICON.EXE

PCIP10117_0.EXE

PDSETUP.EXE

PERISCOPE.EXE

PERSFW.EXE

PF2.EXE

PFWADMIN.EXE

PINGSCAN.EXE

PLATIN.EXE

POPROXY.EXE

POPSCAN.EXE

PORTDETECTIVE.EXE

PPINUPDT.EXE

PPTBC.EXE

PPVSTOP.EXE

PROCEXPLORERV1.0.EXE

PROPORT.EXE

PROTECTX.EXE

PSPF.EXE

PURGE.EXE

PVIEW95.EXE

QCONSOLE.EXE

QSERVER.EXE

RAV8WIN32ENG.EXE

RESCUE.EXE

RESCUE32.EXE

RRGUARD.EXE

RSHELL.EXE

RTVSCN95.EXE

RULAUNCH.EXE

Rav7.exe

Rulaunch.exe

SAFEWEB.EXE

SAVScan.exe

SBSERV.EXE

SD.EXE

SETUPVAMEEVAL.EXE

SETUP_FLOWPROTECTOR_US.EXE

SFC.EXE

SGSSFW32.EXE

SHELLSPYINSTALL.EXE

SHN.EXE

SMC.EXE

SPF.EXE

SPHINX.EXE

SPYXX.EXE

SS3EDIT.EXE

ST2.EXE

SUPFTRL.EXE

SUPPORTER5.EXE

SYMPROXYSVC.EXE

SYSEDIT.EXE

Scan32.exe

Smss.exe

Spider.exe

TASKMON.EXE

TAUMON.EXE

TAUSCAN.EXE

TC.EXE

TCA.EXE

TCM.EXE

TDS-3.EXE

TDS2-98.EXE

TDS2-NT.EXE

TFAK5.EXE

TGBOB.EXE

TITANIN.EXE

TITANINXP.EXE

TRACERT.EXE

TRJSCAN.EXE

TRJSETUP.EXE

TROJANTRAP3.EXE

UNDOBOOT.EXE

UPDATE.EXE

UPDATE.exe

VBCMSERV.EXE

VBCONS.EXE

VBUST.EXE

VBWIN9X.EXE

VBWINNTW.EXE

VCSETUP.EXE

VFSETUP.EXE

VIRUSMDPERSONALFIREWALL.EXE

VNLAN300.EXEVNPC3000.EXE

VPC42.EXE

VPFW30S.EXE

VPTRAY.EXE

VSCENU6.02D30.EXE

VSECOMR.EXE

VSHWIN32.EXE

VSISETUP.EXE

VSMAIN.EXE

VSMON.EXE

VSSTAT.EXE

VSWIN9XE.EXE

VSWINNTSE.EXE

VSWINPERSE.EXE

Vet95.exe

Vettray.exe

Vsmain.exe

W32DSM89.EXE

W9X.EXE

WATCHDOG.EXE

WEBSCANX.EXE

WGFE95.EXE

WHOSWATCHINGME.EXE

WINRECON.EXE

WNT.EXE

WRADMIN.EXE

WRCTRL.EXE

WYVERNWORKSFIREWALL.EXE

XPF202EN.EXE

ZAPRO.EXE

ZAPSETUP3001.EXE

ZATUTOR.EXE

ZAUINST.EXE

ZONALM2601.EXE

ZONEALARM.EXE

Zonalarm.exe

_Avpcc.exe

_avpm.exe

_findviru.exe

avserve2.exe

ccApp.exe

dfw.exe

fsav32.exe

fsbwsys.exe

fsgk32.exe

fsm32.exe

fssm32.exe

fvprotect.exe

mcagent.exe

msblast.exe

navdx.exe

navstub.exe

nc2000.exe

ndd32.exe

netarmor.exe

netinfo.exe

netmon.exe

nmain.exe

nprotect.exe

ntvdm.exe

ostronet.exe

pccguide.exe

pcciomon.exe

regedit.exe

regedit32.exe

taskmgr.exe

tnbutil.exe

vbcons.exe

vbsntw.exe

vbust.exe

vsmain.exe

vsmon.exe

vsstat.exe

winlogon.exe

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
2023年上半年GDP全球前十五强
 百态   2023-10-24
美众议院议长启动对拜登的弹劾调查
 百态   2023-09-13
上海、济南、武汉等多地出现不明坠落物
 探索   2023-09-06
印度或要将国名改为“巴拉特”
 百态   2023-09-06
男子为女友送行,买票不登机被捕
 百态   2023-08-20
手机地震预警功能怎么开?
 干货   2023-08-06
女子4年卖2套房花700多万做美容:不但没变美脸,面部还出现变形
 百态   2023-08-04
住户一楼被水淹 还冲来8头猪
 百态   2023-07-31
女子体内爬出大量瓜子状活虫
 百态   2023-07-25
地球连续35年收到神秘规律性信号,网友:不要回答!
 探索   2023-07-21
全球镓价格本周大涨27%
 探索   2023-07-09
钱都流向了那些不缺钱的人,苦都留给了能吃苦的人
 探索   2023-07-02
倩女手游刀客魅者强控制(强混乱强眩晕强睡眠)和对应控制抗性的关系
 百态   2020-08-20
美国5月9日最新疫情:美国确诊人数突破131万
 百态   2020-05-09
荷兰政府宣布将集体辞职
 干货   2020-04-30
倩女幽魂手游师徒任务情义春秋猜成语答案逍遥观:鹏程万里
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案神机营:射石饮羽
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案昆仑山:拔刀相助
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案天工阁:鬼斧神工
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案丝路古道:单枪匹马
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:与虎谋皮
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:李代桃僵
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:指鹿为马
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案金陵:小鸟依人
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案金陵:千金买邻
 干货   2019-11-12
 
推荐阅读
 
 
 
>>返回首頁<<
 
靜靜地坐在廢墟上,四周的荒凉一望無際,忽然覺得,淒涼也很美
© 2005- 王朝網路 版權所有