病毒特征:
YdUY:JR Ha5Ut2n A. 通过邮件进行穿鼻,会 自动搜集感染者的邮件地址,并假冒发件人名称发送带毒邮件;
9.pd^&}#w ZNwW)_E B. 感染附件类型:".doc", ".txt",".avi", ".mpeg"等;
w$:bU*18 wE,4uP C. 感染系统目录%systemroot%\,并以csrss.exe命名自身。
yeAG)8 :j,/( _C (真正csrss.exe位于%systemroot%\system32\下)
x4.nf] YvmQD$8n D.注入进程services.exe?svchost.exe,且会模仿windows文件保护机制,
@GGA5G ojO}/R0U 防止csrss.exe被清除;
_x 3zeaD vclO[; E.通过感染svchost.exe ,自动扫描邮件地址进行感染,并感染以下已知文件名结
QSGxjE* k</SF4/l 尾的文件:
f0[]0- 6Qbj <&V adb.asp.cfg.cgi.mra.dbx.dhtm.eml.htm.html.jsp.mbx.mdx.mht.mmf.msg.
_'Fe5 n o&1`nmF8 nch.ods.oft.php.pl.sht.shtm.stm.tbb.txt.uin.wab.wsh.xls.xml.dhtml
T\5O\ @3c}V", F.如果邮件地址含有以下字符串则不感染:
@3s,i+C K$][f> "@example." "Mailer-Daemon@" "-0"
PJ'|==yf` "2003" "@subscribe" ".00"
6]blyig "2004" "kasp" "@."
FQ]<y.( "2005" "admin" "---"
c% o[K=.w "2006" "icrosoft" "abuse"
TML3!^~QV "@hotmail" "support" "panda"
t5t-qOp "@msn" "ntivi" "cafee"
zM^D7), "@microsoft" "unix" "spam"
|/fw|Ul- "rating@" "bsd" "pgp"
-USuF"Y\> "f-secur" "linux" "@avp."
vi~)cUF@ "news" "listserv" "noreply"
QZgmy(=[ "update" "certific" "local"
1K= z0R .L ".qmail" "torvalds@" "root@"
qQ7#emXlT ".gif" "sopho" "postmaster@"
i/JFgk+ "anyone@" "@foo" ".0"
Y/Q+{@*-} "bugs@" "@iana" ".1"
&c%JQSG "contract@" "free-av" ".2"
SXmv>= "feste" "@messagelab" ".3"
4B=dnH "gold-certs@" "winzip" ".4"
xks Y& "help@" "google" ".5"
bB4?W5b5 "info@" "winrar" ".6"
-n pse{ "nobody@" "samples" ".7"
cR]4yoh "noone@" "spm111@" ".8"
!
$[k-.p "0000" ".." ".9"
R%*L!:RY }[knB,EX W+=4rh 发作症状:
gqXb0*^b JqmTKCJFx 1、感染该病毒后,会自动从http: // 85.249.23.43 /下载新的病毒文件,并执行。
i
pa$ 998\*|)n 2、或从加密网址
http://85.249.23.35/m2/ g.php
http://207.46.250.119/g/ m.php
http://84.22.161.192/s/ f.php 获取下载列表,下载指定文件。
)F!RBz `19u6# 3、该病毒将修改以下注册表项添加自启动项:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image文件执行
R]EX:#m PC`j[ Options\explorer.exe Debugger="C:\WINDOWS\csrss.exe"
QG#\6/GPF |#+.Er Qh2;j+1M5 <N e^UmJ 受感染的系统包括:
eH*Iezo: G8R/9~d0 &}Wm6W3d.! -Windows 9X/ME: C:\Windows
U+[3/z7@ 2[<X1A-BO -Windows NT/2000 : C:\Winnt\
SRBtf? ^f GdWj6$~: -Windows XP : C:\Windows\
aZ+1/TI LCVZ{gHO*