病毒名称(中文):
挂牌
病毒别名:
威胁级别:
★☆☆☆☆
病毒类型:
蠕虫病毒
病毒长度:
23442
影响系统:
Win9xWinMeWinNTWin2000WinXPWin2003
病毒行为:
这是一个通过共享和即时聊天工具传播的蠕虫病毒，该病毒会把自己拷贝到系统共享目录及流行软件的共享目录。查找即时聊天工具的聊天窗口然后把自己发送出去，修改host文件。
1.生成文件:
%System%\win32svc.exe
2.添加注册表项起始项，使病毒开机启动:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
WindowsServiceDaemon
win32svc.exe
3.添加服务:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
WindowsServiceDaemon
win32svc.exe
4.查找窗口类为AIM_IMessage的窗口;查找窗口类为Ate32Class等窗口,找到设置要发送的内容，内容为以下随即一个:
lolsomeoneispostingwithyouremailaddressontheseforums?http://ce.freedomsnet.net/msnupdate.exe
wow..isthisyou?
http://ce.freedomsnet.net/msnupdate.exe
foundyourpicture!isthisyou?http://ce.freedomsnet.net/msnupdate.exe
haha,thisguygotbustedsobad..http://ce.freedomsnet.net/msnupdate.exe
lmaoicantstoplaughingatthis!http://ce.freedomsnet.net/msnupdate.exe
omg...thisdoesn"tlookrightatall!http://ce.freedomsnet.net/msnupdate.exe
5.下载文件:
http://ce.***.net/msnupdate.exe
6.寻找以下共享目录，并且把自己拷贝到该目录下面，然后命名为以下随即一个:
\ProgramFiles\Media\MySharedFolder\ProgramFiles\LimeWire\Shared\ProgramFiles\eDonkey2000\XINCHalfLife2FULL.exe
HowtoHack.exe
IPChanger.exe
Nero7.exe
HalfLifeSerialGen.exe
VisualStudio2005.exe
LordoftheRings.exe
7.修改host文件，使被感染机器无法升级安全软件:
127.0.7.33symantec.com
127.0.7.33www.symantec.com
127.0.7.33securityresponse.symantec.com
127.0.7.33sarc.com
127.0.7.33www.sarc.com
127.0.7.33www.sophos.com
127.0.7.33sophos.com
127.0.7.33www.mcafee.com
127.0.7.33mcafee.com
127.0.7.33liveupdate.symantecliveupdate.com.
127.0.7.33www.viruslist.com
127.0.7.33viruslist.com
127.0.7.33f-secure.com
127.0.7.33www.f-secure.com
127.0.7.33f-prot.com
127.0.7.33www.f-prot.com
127.0.7.33kaspersky.com
127.0.7.33kaspersky-labs.com
127.0.7.33www.avp.com
127.0.7.33avp.com
127.0.7.33www.kaspersky.com
127.0.7.33www.networkassociates.com
127.0.7.33networkassociates.com
127.0.7.33www.ca.com
127.0.7.33ca.com
127.0.7.33mast.mcafee.com
127.0.7.33my-etrust.com
127.0.7.33www.my-etrust.com
127.0.7.33download.mcafee.com
127.0.7.33dispatch.mcafee.com
127.0.7.33secure.nai.com
127.0.7.33www.nai.com
127.0.7.33nai.com
127.0.7.33update.symantec.com
127.0.7.33updates.symantec.com
127.0.7.33us.mcafee.com
127.0.7.33liveupdate.symantec.com
127.0.7.33customer.symantec.com
127.0.7.33trendmicro.com
127.0.7.33rads.mcafee.com
127.0.7.33housecall.trendmicro.com
127.0.7.33pandasoftware.com
127.0.7.33www.pandasoftware.com
127.0.7.33www.trendmicro.com
127.0.7.33free.grisoft.com
127.0.7.33www.grisoft.com
127.0.7.33grisoft.com
127.0.7.33clamav.net
127.0.7.33www.clamav.net
127.0.7.33free-av.com
127.0.7.33www.free-av.com
127.0.7.33www.avast.com
127.0.7.33avast.com
127.0.7.33cert.org
127.0.7.33www.cert.org
127.0.7.33www.microsoft.com
127.0.7.33microsoft.com
127.0.7.33www.virustotal.com
127.0.7.33virustotal.com
127.0.7.33update.microsoft.com
127.0.7.33windowsupdate.microsoft.com
