W32/Bagle.AQ@mm

2008-02-23 09:33:51来源：互联网阅读 ()

病毒名称: W32/Bagle.AQ@mm 类别：邮件蠕虫病毒资料：病毒类型：蠕虫病毒

这是一个邮件蠕虫病毒和P2P蠕虫病毒。文件大小为19-24K字节，其尺寸通常随垃圾数据的增加而增加。

这个蠕虫病毒利用名称为WINGO.EXE将自身安装到Windows文件夹，并且修改注册表键值指向自己使得启动时运行自己。病毒会搜索名称中带有“shar”字符串的文件夹，找到后会在其中生成自身拷贝，拷贝的文件名如下：

Microsoft Office 2003 Crack, Working!.exe.
Porno, sex, oral, anal cool, awesome!!.exe.
Porno Screensaver.scr.
Serials.txt.exe.
KAV 5.0
KASPersky Antivirus 5.0.
Porno pics arhive, xxx.exe.
Windows Sourcecode update.doc.exe.
Ahead Nero 7.exe.
Opera 8 New!.exe.
XXX hardcore images.exe.
WinAMP 6 New!.exe.
Adobe Photoshop 9 full.exe.
Matrix 3 Revolution English SuBTitles.exe.
ACDSee 9.exe.

修改注册表：

这个蠕虫删除一部分属于其他蠕虫和AV产品的键值：
"My AV" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".

"My AV" in key
"HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"Zone Labs Client Ex" in key

"HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"Zone Labs Client Ex" in key

"HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"9XHtProtect" in key "

HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"9XHtProtect" in key "

HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"Antivirus" in key "

HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"Antivirus" in key "

HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"Special Firewall Service" in key

"HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"Special Firewall Service" in key

"HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"service" in key "

HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"service" in key "

HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"Tiny AV" in key "

HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"Tiny AV" in key "

HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"ICQNet" in key "

HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"ICQNet" in key "

HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"HtProtect" in key "

HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"HtProtect" in key "

HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"NetDy" in key "

HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"NetDy" in key "

HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"Jammer2nd" in key "

HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"Jammer2nd" in key "

HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"FirewallSvr" in key "

HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"FirewallSvr" in key "

HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"MsInfo" in key "

HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"MsInfo" in key "

HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"SysMonXP" in key "

HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"SysMonXP" in key "

HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"EasyAV" in key "

HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"EasyAV" in key "

HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"PandaAVEngine" in key "

HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"PandaAVEngine" in key "

HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"Norton Antivirus AV" in key

"HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"Norton Antivirus AV" in key

"HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有