Worm.NetSky.c

2008-02-23 09:24:45来源：互联网阅读 ()

病毒名称: Worm.NetSky.c 类别：蠕虫病毒资料：破坏方法：

一旦执行,病毒将执行以下操作:

1.本地首先将创建一个名为:"[SkyNet.cz]SystemsMutex."的互斥量来保证只运行病毒的一个副本;

2.复制自己到windows目录下:

％WINDIR％\Winlogon.exe;

3.添加如下键值:

"ICQ Net" = "％WINDIR％\winlogon.exe -stealth"

到注册表键:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run 下,这是病毒自启动的伎俩;

删除键:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run

下的如下键值:

Taskmon
EXPlorer
Windows Services Host
KASPerskyAV

删除键:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run下的如下键值:

System.
msgsvr32
DELETE ME
service
Sentry

删除键:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run

下的如下键值:

d3dupdate.exe
au.exe
OLE

删除键:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\RunServices

下的如下键值:

System.

删除子键:

HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32

其中键值:
"KasperskyAV"是病毒:"Worm.Mimail.t"的自启动键值;
"Taskmon" 和"Explorer"是病毒:"SCO炸弹"的键值.

4.病毒从带有下列扩展名的文件中搜索Email地址:

.eml
.txt
.PHP
.pl
.htm
.Html
.vbs
.rtf
.uin
.asp
.wab
.doc
.adb
.tbb
.dbx
.sht
.oft
.msg
.shtm
.cgi
.dhtm

5.病毒从C:\到Z:\搜索带有如下字眼的文件夹:

"Shar"

只要该文件夹所在的驱动器不是CD_ROM,病毒就将复制自己到这个文件夹和此文件夹的所有子目录下
文件名可能为下列之一:

Microsoft WinXP Crack.exe
Teen Porn 16.jpg.pif
Adobe Premiere 9.exe
Adobe Photoshop 9 full.exe
Best Matrix Screensaver.scr
Porno Screensaver.scr
Dark Angels.pif
XXX hardcore pic.jpg.exe
Microsoft Office 2003 Crack.exe
Serials.txt.exe
Screensaver.scr
Full album.mp3.pif

Ahead Nero 7.exe
Virii Sourcecode.scr
E-Book Archive.rtf.exe
Doom 3 Beta.exe
How to hack.doc.exe
Learn Programming.doc.exe
WinXP eBook.doc.exe
Win Longhorn Beta.exe
Dictionary English - France.doc.exe
RFC Basics Full Edition.doc.exe
1000 Sex and more.rtf.exe
3D Studio Max 3dsmax.exe
Keygen 4 all appz.exe
Windows Sourcecode.doc.exe
Norton Antivirus 2004.exe
Gimp 1.5 Full with Key.exe
Partitionsmagic 9.0.exe
Star Office 8.exe
Magix Video Deluxe 4.exe
Clone DVD 5.exe
MS Service Pack 5.exe
ACDSee 9.exe
Visual Studio Net Crack.exe
Cracks & Warez Archive.exe
WinAMP 12 full.exe
DivX 7.0 final.exe
Opera.exe
IE58.1 full setup.exe
Smashing the stack.rtf.exe
Ulead Keygen.exe
Lightwave SE Update.exe
The Sims 3 crack.exe

6.病毒使用自带的SMTP引擎向上面搜到的Email地址发送带毒邮件:

邮件带有如下特征:

From: (Spoofed)

标题为下列之一:

Delivery Failed
Status
report
question
trust me
hey
Re: excuse me
read it immediatelly
hi
Re: does it?
Yep
important
hello
dear
Re: unknown
fake?
warning
moin

what's up?
info
Re: information
Here is it
stolen
private?
good morning
illegal...
error
take it
re:
Re: Re: Re: Re:
you?
something for you
exception
Re: hey
excuse me
Re: hi

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有