病毒名称:
Worm.Warezov.t
类别： 蠕虫
病毒资料：
中文名称：瓦佐夫
影响系统：Win 9x/ME,Win 2000/NT,Win XP,Win 2003
威胁级别：★★
这是一种通过邮件传播的蠕虫病毒，该病毒通过搜索被感染机器上的邮件地址把自己的拷贝发送出去，并且会尝试下载新病毒变种。
1.生产文件:
％System％\msv1nv4_.dll
％System％\msvfjspr.dll
％System％\daniwshb.dll
％System％\dsoukbda.exe
％System％\acac.dll
2.修改注册表:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
"userinit.dll"
"userinit.dll daniwshb.dll msv1nv4_.dll"
3.添加注册表:
HKLM\SOFTWARE\Microsoft\wuapx9tt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acac
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acac
DllName
"C:\WINNT\System32\acac.dll"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acac
Startup
"WlxStartupEvent"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acac
Shutdown
"WlxShutdownEvent"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acac
Impersonate
dWord:00000000
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acac
Asynchronous
dword:00000000
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acac
Image
"VirusName"
4.在被感染的机器上搜索以下的文件格式:
.wab
.txt
.msg
.htm
.shtm
.stm
.XML
.dbx
.mbx
.mdx
.eml
.nch
.mmf
.ods
.cfg
.ASP
.PHP
.pl
.wsh
.adb
.tbb
.sht
.xls
.oft
.uin
.cgi
.mht
.dhtm
.jsp
5.发信人为以下任意一个:
adam
alice
anna
betty
bob
brenda
brent
brian
carol
claudia
craig
cyber
dan
dave
david
debby
den
Donna
frank
george
gerhard
helen
helen
james
jane
jayson
jerry
jim
joe
john
karen
linda
lisa
mancy
maria
ruth
sandra
sandra
sharon
Susan
6.发信的域名为以下任意一个:
care2.com
email.myway.com
fastmail.fm
gmail.com
goowy.com
hotmail.com
inbox.com
mail.aim.com
mail.com
mail.lycos.com
yahoo.com
7.邮件的内容为以下任意一个:
Mail transaction failed. Partial message is available.
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
The message contains Unicode characters and has been sent as a binary attachment.
病毒的清除法：
使用光华反病毒软件，彻底删除。
病毒演示：
病毒FAQ：
Windows下的PE病毒。
发现日期：
2006-9-12
|
