BackDoor.SdBot.aje

2008-02-23 09:11:19来源：互联网阅读 ()

病毒名称: BackDoor.SdBot.aje 类别：后门病毒病毒资料：破坏方法：

后门程序

此病毒启动后在后台隐藏运行，此病毒会在后台启动多个线程，并且会监听网络端口，此病毒还会盗取下列游戏的
CDKEY：

Command & Conquer Generals，
FIFA 2003，
Need For Speed Hot Pursuit 2，
Soldier of Fortune II - Double Helix，
Rainbow Six III RavenShield，
Battlefield 1942 Road To Rome，
Battlefield 1942，
IGI 2 Retail，
Unreal Tournament 2003，
Half-Life

此病毒可以通过聊天软件IRC被控制控制，此病毒还会在局域网内通过猜解密码的方式向其他计算机感染，所猜解的密码如下：

"Administrator"
"administrator"
"fubar""bla"
"GUEST"
"ROOT"
"root"
"ADMIN"
"PASSWord"
"TEMP"
"SHARE"
"WRITE"
"FULL"
"ladeda"
"BOTH"
"READ"
"FILES"
"DEMO"
"OWNER"
"Owner"
"edu"
"TEST"
"Access"
"USER"
"BACKUP"
"SYSTEM"
"SERVER"
"pepsi"
"LOCAL"
"unix"
"Linux"

"changeme"
"Changeme"
"temp123"
"1"
"12"
"123"
"1234"
"12345"
"123456"
"1234567"
"12345678"
"123456789"
"654321"
"54321"
"111"
"11111111"
"88888888"
"pass"
"passwd"
"database"
"abcd"
"abc123"
"Oracle"
"sybase"
"123qwe"
"computer"
"Internet"
"super"
"123asd"
"ihavenopass"
"godblessyou"
"enable"
"XP"
"2002"
"2003"
"2600"
"110"
"111111"
"121212"
"123123"
"1234qwer"
"123abc"
"007"
"alpha"
"patrick"
"pat"
"sex"
"god"
"Foobar"
"Nilez"
"devil"
"netdevil"
"net-devil"
"0wned"
"owned"
"irule"
"netfUCk"
"fucked"
"crash"
"a"
"aaa"
"abc"
"test123"
"win"
"pc"
"asdf"
"secret"
"qwer"
"yxcv"
"zxcv"
"home"

"login"
"pwd"
"love"
"mypc"
"mypc123"
"admin123"
"pw123"
"mypass"
"mypass123"
"pw"
"Mat"
"Matt"
"Matthew"
"gobo"
"satan"
"satanik"
"satanic"
"spaceman"
"heaven"
"w00t"
"0wn3d"
"killer"
"leet"
"l33t"
"l337"
"hacker"
"hax0r"
"script"
"scriptkiddie"
"kiddie"
"mirc"
"uwontguessme"
; "youwontguessme"
"guessme"
"x"
"xx"
"xxx"
"xxxx"
"xxxxx"
"xxxxxx"
"xxxxxxx"
"xxxxxxxx"
"xxxxxxxxx"
"0"
"00"
"death"
"testing"
"000"
"0000"
"00000"
"000000"
"academia"
"academic"
"accept"
"account"
"action"
"adam"
"adrian"
"adrianna"
"adult"
"aerobics"
"aids"
"airplane"
"alaska"
"albany"
"albatros"
"albert"
"alert"
"alex"
"Alexande"
"algebra"
"alias"
"aliases"
"alice"
"alicia"
"alisa"
"alison"
"allison"

"allow"
"alphabet"
"amadeus"
"amanda"
"amber"
"america"
"amorphou"
"anal"
"analog"
"anarchis"
"anarchy"
"anchor"
"andrea"
"android"
"andromac"
"andy"
"anfo".....................
因此如果计算机中存在这些密码的话就会被此病毒感染。

1.修改注册表:

1
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
\Currentversion\Run
"System Information Manager" : NTSYS.EXE

2
HKEY_CURRENT_USER\Software\Microsoft\Windows
\Currentversion\Run
"System Information Manager" : NTSYS.EXE

3
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有