病毒名称(中文):
病毒别名:
威胁级别:
★☆☆☆☆
病毒类型:
蠕虫病毒
病毒长度:
29495
影响系统:
Win9xWinMeWinNTWin2000WinXPWin2003
病毒行为:
这是一个通过电子邮件传播的蠕虫病毒。
该病毒能在特定文件中搜索电子邮件地址，利用自带的smtp引擎，发送大量带病毒链接的电子邮件到这些邮件地址，假如用户点击链接，便会自动下载病毒样本。并会自动过滤掉一些安全厂商的邮件地址，避免自身被反病毒厂商搜集到。该病毒还会进一步修改host文件，导导致用户无法通过浏览器打开特定网站，如微软网站，反病毒厂商的网站，等等。同时，病毒会试图关闭大量软件，如安全软件，系统工具，注册表编辑器等等，会用户手动清除病毒带来难度。
1，邮件内容：
Sincerely,%sSecurityDepartment
DearValuedMember,
Accordingtoourtermsofservices,youwillhavetoconfirmyoure-mailbythe
followinglink,oryouraccountwillbesuspendedwithin24hoursforsecurity
reasons.
Afterfollowingtheinstructionsinthesheet,youraccountwillnotbe
interruptedandwillcontinueasnormal.
Thanksforyourattentiontothisrequest.Weapologizeforanyinconvenience.
发送下列病毒链接：
http://84.94.228.177/~nesher/Confirmation_Sheet
2，关闭下列软件：
ALEVIR
ALOGSERV
AMON9X
ANTI-TROJAN
ANTIVIRUS
ANTS
APLICA32
APIMONITOR
APVXDWIN
ARR
ATCON
ATGUARD
ATRO55EN
ATUPDATER
ATWATCH
AUTOUPDATE
AVGNT
AVGSERV
AVKSERVICE
AVPM
AVXQUAR
BISP
CDP
CFIADMIN
等等
3,修改host文件：
127.0.0.1ad.doubleclick.net
127.0.0.1ad.fastclick.net
127.0.0.1ads.fastclick.net
127.0.0.1ar.atwola.com
127.0.0.1atdmt.com
127.0.0.1avp.ch
127.0.0.1avp.com
127.0.0.1avp.com
127.0.0.1avp.ru
127.0.0.1awaps.net
127.0.0.1banner.fastclick.net
127.0.0.1banners.fastclick.net
127.0.0.1ca.com
127.0.0.1ca.com
127.0.0.1click.atdmt.com
127.0.0.1clicks.atdmt.com
127.0.0.1customer.symantec.com
127.0.0.1dispatch.mcafee.com
127.0.0.1dispatch.mcafee.com
127.0.0.1download.mcafee.com
127.0.0.1download.mcafee.com
127.0.0.1download.mcafee.com
127.0.0.1download.microsoft.com
127.0.0.1downloads.microsoft.com
127.0.0.1downloads1.kaspersky-labs.com
127.0.0.1downloads1.kaspersky-labs.com
127.0.0.1downloads1.kaspersky-labs.com/updates
127.0.0.1downloads2.kaspersky-labs.com
127.0.0.1downloads3.kaspersky-labs.com
127.0.0.1downloads4.kaspersky-labs.com
127.0.0.1downloads-us1.kaspersky-labs.com
127.0.0.1downloads-us2.kaspersky-labs.com
127.0.0.1downloads-us3.kaspersky-labs.com
127.0.0.1engine.awaps.net
127.0.0.1fastclick.net
127.0.0.1f-secure.com
127.0.0.1f-secure.com
127.0.0.1ftp.avp.ch
127.0.0.1ftp.downloads2.kaspersky-labs.com
127.0.0.1ftp.f-secure.com
127.0.0.1ftp.kasperskylab.ru
127.0.0.1ftp.sophos.com
127.0.0.1go.microsoft.com
127.0.0.1ids.kaspersky-labs.com
127.0.0.1kaspersky.com
127.0.0.1kaspersky-labs.com
127.0.0.1liveupdate.symantec.com
127.0.0.1liveupdate.symantec.com
127.0.0.1liveupdate.symantec.com
127.0.0.1liveupdate.symantecliveupdate.com
127.0.0.1liveupdate.symantecliveupdate.com
等等