Worm.4HorseMan.b

2008-02-23 09:18:37来源：互联网阅读 ()

病毒名称: Worm.4HorseMan.b 类别：蠕虫病毒病毒资料：破坏方法：

通过Outlook邮件和文件共享传播的蠕虫病毒

安装：

病毒通过替换windows的资源管理器eXPlorer.exe来使自己能够自启动，同时将原来的explorer.exe复制到其它地方。

行为：

1.病毒能够终止内存中运行包含下列字符串的的进程：

avp,kav,nav,scan,anti,alert,mon,
check,prot,vir,safe,guard,alarm,
detect,clean,
等

2.通过IRC软件传播是消息一般为：

Watch this, it's very simple and can add a lot of things into your pIRCh!
Hi! try this useful program, it helped me a lot!
mIRC_Utilities.exe

3.通过outlook发送邮件时信息一般为：

New update! Interesting file
Update your system
A windows patch
Very important!
Try this patch that i've found yesterday, it's very useful!
this Windows update is very simple and powerful!It helped me a lot!
Check out this program, it has a lot of functions!
Install this useful program, and tell me what you think about it! Greets!
WindowsPatch
Updater
WinTool
BugFixer
Upgrade_Installer
Microsoft_patch_720
附件即病毒

4.病毒复制到P2P共享目录使得文件名一般为：

Porn_Downloader.exe
Soccer game.exe
WinBugsFixInstaller.exe
AIM passWord stealer.exe

Norton AntiVirus Crack.exe
Easy_Crack_creator.exe
Christina Aguilera fUCked.exe
Pamela Anderson Sex.exe
Saddam-Alive.exe
Bin Laden-The truth.exe
Hotmail password stealer.exe
RegCleaner_Setup.exe
病毒的清除法：使用光华反病毒软件，彻底删除。病毒演示：病毒FAQ： Windows下的PE病毒。
发现日期： 2003-6-13

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有