Backdoor.Agobot.3.gen.a_病毒数据库

病毒名称: Backdoor.Agobot.3.gen.a 类别：后门病毒病毒资料：      破坏方法：

    后门程序，启动后将自己安装到系统目录下，在后台隐藏运行，并在注册表中添加以下的键值以达到自启动的目的。

    1
    HKEY_LOCAL_MACHINE\Software\Microsoft
    \Windows\Currentversion\Run
    Windows Update : winupdate.exe

    2
    HKEY_LOCAL_MACHINE\Software\Microsoft
    \Windows\Currentversion\Run
    Services
    Windows Update : winupdate.exe

    此病毒还会将自己注册成系统的服务程序，服务显示名为Windows Update

    此病毒在后台运行时会恶意结束一下的反病毒软件的进程

    zonealarm.EXE
    zapro.EXE
    vsmon.EXE
    vshwin32.EXE
    vbcmserv.EXE
    sbserv.EXE
    rtvscan.EXE
    rapapp.EXE
    pcscan.EXE
    pccwin97.EXE
    pccntmon.EXE
    pavproxy.EXE
    nvsvc32.EXE
    ntrtscan.EXE
    npscheck.EXE
    notstart.EXE
    lockdown2000.EXE
    iamserv.EXE
    iamapp.EXE
    gbpoll.EXE
    gbmenu.EXE
    fsmb32.EXE
    fsma32.EXE
    fsm32.EXE
    fsgk32.EXE
    fsav32.EXE
    fsaa.EXE
    fnrb32.EXE
    fih32.EXE
    fch32.EXE
    fameh32.EXE
    f-stopw.EXE
    defscangui.EXE
    defalert.EXE
    cpd.EXE
    cleaner3.EXE
    cleaner.EXE
    ccPxySvc.EXE
    ccEvtMgr.EXE
    ccApp.EXE
    blackd.EXE
    avpm.EXE

    avkwctl9.EXE
    avkservice.EXE
    avkpop.EXE
    apvxdwin.EXE
    agentw.EXE
    _AVPM.EXE
    _AVPCC.EXE
    _AVP32.EXE
    ZONEALARM.EXE
    ZONALM2601.EXE
    ZAUINST.EXE
    ZATUTOR.EXE
    ZAPSETUP3001.EXE
    ZAPRO.EXE
    XPF202EN.EXE
    WrCtrl.EXE
    WrAdmin.EXE
    WYVERNWORKSFIREWALL.EXE
    WSBGATE.EXE
    WRCTRL.EXE
    WRADMIN.EXE
    WNT.EXE
    WINRECON.EXE
    WIMMUN32.EXE
    WHOSWATCHINGME.EXE
    WGFE95.EXE
    WFINDV32.EXE
    WEBTRAP.EXE
    WEBSCANX.EXE
    WATCHDOG.EXE
    W9X.EXE
    W32DSM89.EXE
    VetTray.EXE
    Vet95.EXE
    VbCons.EXE
    VSWINPERSE.EXE
    VSWINNTSE.EXE
    VSWIN9XE.EXE
    VSSTAT.EXE
    VSMON.EXE
    VSMAIN.EXE
    VSISETUP.EXE
    VSECOMR.EXE
    VSCHED.EXE
    VSCENU6.02D30.EXE
    VSCAN40.EXE
    VPTRAY.EXE
    VPFW30S.EXE
    VPC42.EXE
    VPC32.EXE
    VNPC3000.EXE
    VNLAN300.EXE
    VIRUSMDPERSONALFIREWALL.EXE
    VIR-HELP.EXE
    VFSETUP.EXE
    VETTRAY.EXE
    VET95.EXE
    VET32.EXE
    VCSETUP.EXE
    VBWINNTW.EXE
    VBWIN9X.EXE
    VBUST.EXE
    VBCONS.EXE
    VBCMSERV.EXE
    UPDATE.EXE
    UNDOBOOT.EXE
    TROJANTRAP3.EXE
    TRJSETUP.EXE

    TRJSCAN.EXE
    TRACERT.EXE
    TITANINXP.EXE
    TITANIN.EXE
    TGBOB.EXE
    TFAK5.EXE
    TFAK.EXE
    TDS2-NT.EXE
    TDS2-98.EXE
    TDS-3.EXE
    TCM.EXE
    TCA.EXE
    TBSCAN.EXE
    TAUMON.EXE
    TASKMON.EXE
    SymProxySvc.EXE
    SweepNet.SWEEPSRV.SYS.SWNETSUP.EXE
    Sphinx.EXE
    SYSEDIT.EXE
    SYMTRAY.EXE
    SYMPROXYSVC.EXE
    SWEEP95.EXE
    SUPPORTER5.EXE
    SUPFTRL.EXE
    ST2.EXE
    SS3EDIT.EXE
    SPYXX.EXE
    SPHINX.EXE
    SPF.EXE
    SOFI.EXE
    SMC.EXE
    SHN.EXE
    SHELLSPYINSTALL.EXE
    SGSSFW32.EXE
    SFC.EXE
    SETUP_FLOWPROTECTOR_US.EXE
    SETUPVAMEEVAL.EXE
    SERV95.EXE
    SCRSCAN.EXE
    SCANPM.EXE
    SCAN95.EXE
    SCAN32.EXE
    SBSERV.EXE
    SAFEWEB.EXE
    RULAUNCH.EXE
    RTVSCN95.EXE
    RSHELL.EXE
    RRGUARD.EXE
    RESCUE32.EXE
    RESCUE.EXE
    REGEDT32.EXE
    REGEDIT.EXE
    REALMON.EXE
    RAV8WIN32ENG.EXE
    RAV7WIN.EXE
    RAV7.EXE
    QSERVER.EXE
    QCONSOLE.EXE
    PVIEW95.EXE
    PURGE.EXE
    PSPF.EXE
    PROTECTX.EXE
    PROPORT.EXE
    PROGRAMAUDITOR.EXE
    PROCEXPLORERV1.0.EXE
    PROCESSMONITOR.EXE
    PPVSTOP.EXE
    PPTBC.EXE
    PPINUPDT.EXE
    PORTMONITOR.EXE
    PORTDETECTIVE.EXE
    POPSCAN.EXE
    POPROXY.EXE

    POP3TRAP.EXE
    PLATIN.EXE
    PINGSCAN.EXE
    PFWADMIN.EXE
    PF2.EXE
    PERSWF.EXE
    PERSFW.EXE
    PERISCOPE.EXE
    PDSETUP.EXE
    PCIP10117_0.EXE
    PCFWALLICON.EXE
    PCDSETUP.EXE
    PCCWIN98.EXE
    PCCIOMON.EXE
    PCC2K_76_1436
病毒的清除法：使用光华反病毒软件，彻底删除。病毒演示：病毒FAQ：      Windows下的PE病毒。
发现日期： 2003-12-15