一个用VB编写的蠕虫病毒,采用upx压缩
病毒行为:
病毒运行后将自己复制到％system％目录下,文件名为:Server.exe
病毒会修改一些注册表键值，如:
HKCU\software\Microsoft\Windows\CurrentVersion
\Policies\EXPlorer\DisallowRun
HKCU\Software\Microsoft\Windows\CurrentVersion
\Policies\System\DisableTaskMgr
HKCU\Software\Microsoft\Windows\CurrentVersion
\Policies\System\DisableRegistryTools
HKEY_CURRENT_USER\Software\Microsoft
\Windows\CurrentVersion\Policies\Explorer\NoRun
....
以使用户无法使用注册表编辑工具等...
邮件标题:
Service Pack 2 BUG!!
邮件正文:
Dear user I have been informed that there was a BUG in Windows Service Pack 2 which was fixed I recommend you to download this Patch version which will fix the
bug and keep your system safe.
Body
You will find the Patch file in the attachment, feal free to send it to anyone.
I'll be in toUCh with you as soon as another bug is found.
Regards,
...
修改hosts文件:
病毒在hosts文件中加入以下字串,使当前系统无法访问这些网站.
127.0.0.1 www.symantec.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.wwe.com
127.0.0.1 www.rohitab.com
127.0.0.1 www.coderheaven.com
127.0.0.1 www.astalaVista.com
127.0.0.1 www.Google.com
127.0.0.1 www.yahoo.com
127.0.0.1 www.MSN.com
127.0.0.1 www.messenger.msn.com
127.0.0.1 www.geocities.com
127.0.0.1 www.worldsex.com
127.0.0.1 www.cnn.com
127.0.0.1 www.hackers.com
127.0.0.1 www.fbi.gov
127.0.0.1 www.hotmail.com
127.0.0.1 www.norton.com
127.0.0.1 www.idm.com
....
病毒的清除法： 使用光华反病毒软件，彻底删除。 病毒演示： 病毒FAQ： Windows下的PE病毒。
发现日期： 2005-1-26
文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!
