病毒特征:
fO:]?)"v >48=$g2 A. 通过邮件进行穿鼻,会 自动搜集感染者的邮件地址,并假冒发件人名称发送带毒邮件;
1MBRpX! myx4dy B. 感染附件类型:".doc", ".txt",".avi", ".mpeg"等;
M,wTuS1" n@BUIcH8 C. 感染系统目录%systemroot%\,并以csrss.exe命名自身。
3FROcI
~= VE=i%^*L (真正csrss.exe位于%systemroot%\system32\下)
&W?I[j[T ~l[q+P}W D.注入进程services.exe?svchost.exe,且会模仿windows文件保护机制,
CNfid;{v| ~+Y@DkK 防止csrss.exe被清除;
(.P={/H]$ WB@rDtc E.通过感染svchost.exe ,自动扫描邮件地址进行感染,并感染以下已知文件名结
fvWv5WF |-&I WWl 尾的文件:
[wi;D' fVPFB$ adb.asp.cfg.cgi.mra.dbx.dhtm.eml.htm.html.jsp.mbx.mdx.mht.mmf.msg.
u'z8XU Q^7$?8>+@[ nch.ods.oft.php.pl.sht.shtm.stm.tbb.txt.uin.wab.wsh.xls.xml.dhtml
L^d%!*y( f{s}zr1Y F.如果邮件地址含有以下字符串则不感染:
pz${wk 7P~ /S}88=`08 "@example." "Mailer-Daemon@" "-0"
Sg(V7 "2003" "@subscribe" ".00"
#
&RV5C "2004" "kasp" "@."
fJEr "2005" "admin" "---"
}yn8E "2006" "icrosoft" "abuse"
vKauo[t "@hotmail" "support" "panda"
,4;%E%x3p "@msn" "ntivi" "cafee"
wO&6+g]T "@microsoft" "unix" "spam"
f!wA.Qd "rating@" "bsd" "pgp"
R|k[mcsE "f-secur" "linux" "@avp."
2$HKF1$ "news" "listserv" "noreply"
7[Qg "update" "certific" "local"
Kh \, ".qmail" "torvalds@" "root@"
-V]JgG8f ".gif" "sopho" "postmaster@"
MBUnuf6u "anyone@" "@foo" ".0"
_8n}@kV "bugs@" "@iana" ".1"
.c'?AR:MU "contract@" "free-av" ".2"
]45 -Hz S "feste" "@messagelab" ".3"
tjwq&w'jA' "gold-certs@" "winzip" ".4"
av|ablH "help@" "google" ".5"
=.@<PJ/?! "info@" "winrar" ".6"
V 04N0n?C "nobody@" "samples" ".7"
"{nn^ "noone@" "spm111@" ".8"
B)*LtI/[v! "0000" ".." ".9"
DP)r]SJu Y}hx5-t p^\5.b'y 发作症状:
Is^}:~{2 (,E93Dfq; 1、感染该病毒后,会自动从http: // 85.249.23.43 /下载新的病毒文件,并执行。
;h.{y'grf =md8Ojnwg 2、或从加密网址
http://85.249.23.35/m2/ g.php
http://207.46.250.119/g/ m.php
http://84.22.161.192/s/ f.php 获取下载列表,下载指定文件。
.kh9,,% L0AJ"! 3、该病毒将修改以下注册表项添加自启动项:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image文件执行
zmsf(/wSy" h&ZJL$x Options\explorer.exe Debugger="C:\WINDOWS\csrss.exe"
pDAm6"| S
svhH ;_/E]Jjn5O 'Y?0v&DJ 受感染的系统包括:
~F;$G1
IXs 6P.RO1 4fY&iss~ -Windows 9X/ME: C:\Windows
FBa=Pzz1 ooA5
) -Windows NT/2000 : C:\Winnt\
LI $4/~9f t?h!J/X -Windows XP : C:\Windows\
Q !}RjZnd 0v/fhGA