Worm.Agobot.3.j.enc_病毒数据库

病毒名称: Worm.Agobot.3.j.enc 类别：蠕虫病毒病毒资料：      破坏方法：

    这是一个利用IRC传播的病毒。该病毒运行后，开辟45个线程，疯狂地扫描本地网段的所有IP的135、445通讯端口，猜测连接密码，消耗大量系统和网络资源。

    一、修改注册表如下：

    1.
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
    \CurrentVersion\Run
    Config Loader : scvhost.exe

    2.
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
    \CurrentVersion\RunServices
    Config Loader : scvhost.exe

    二、使用下列字符串猜测密码

    locator
    print$
    admin$
    mypass
    Login
    owner
    secret
    Foobar
    patrick
    alpha
    123abc
    1234qwer
    123123
    121212
    111111
    enable
    godblessyou
    ihavenopass
    123asd
    super
    Internet
    computer
    server
    123qwe
    sybase
    Oracle
    database
    passwd
    88888888
    11111111
    00000000
    000000
    54321
    654321
    123456789
    12345678
    1234567
    123456
    12345
    PassWord
    password
    Admin

    Inviter
    Guest
    Owner
    Administrador
    Standard
    Default
    Administrateur
    administrator
    admin
    Administrator
    netbios
    default

    三、终止下列进程，都是反病毒软件

    ZONEALARM.EXE
    WFINDV32.EXE
    WEBSCANX.EXE
    VSSTAT.EXE
    VSHWIN32.EXE
    VSECOMR.EXE
    VSCAN40.EXE
    VETTRAY.EXE
    VET95.EXE
    TDS2-NT.EXE
    TDS2-98.EXE
    TCA.EXE
    TBSCAN.EXE
    SWEEP95.EXE
    SPHINX.EXE
    SMC.EXE
    SERV95.EXE
    SCRSCAN.EXE
    SCANPM.EXE
    SCAN95.EXE
    SCAN32.EXE
    SAFEWEB.EXE
    RESCUE.EXE
    RAV7WIN.EXE
    RAV7.EXE
    PERSFW.EXE
    PCFWALLICON.EXE
    PCCWIN98.EXE
    PAVW.EXE
    PAVSCHED.EXE
    PAVCL.EXE
    PADMIN.EXE
    OUTPOST.EXE
    NVC95.EXE
    NUPGRADE.EXE
    NORMIST.EXE
    NMAIN.EXE
    NISUM.EXE
    NAVWNT.EXE
    NAVW32.EXE
    NAVNT.EXE
    NAVLU32.EXE
    NAVAPW32.EXE
    N32SCANW.EXE
    MPFTRAY.EXE
    MOOLIVE.EXE
    LUALL.EXE
    LOOKOUT.EXE
    LOCKDOWN2000.EXE
    JEDI.EXE
    IOMON98.EXE
    IFACE.EXE
    ICSUPPNT.EXE
    ICSUPP95.EXE
    ICMON.EXE
    ICLOADNT.EXE
    ICLOAD95.EXE
    IBMAVSP.EXE

    IBMASN.EXE
    IAMSERV.EXE
    IAMAPP.EXE
    FRW.EXE
    FPROT.EXE
    FP-WIN.EXE
    FINDVIRU.EXE
    F-STOPW.EXE
    F-PROT95.EXE
    F-PROT.EXE
    F-AGNT95.EXE
    ESPWATCH.EXE
    ESAFE.EXE
    ECENGINE.EXE
    DVP95_0.EXE
    DVP95.EXE
    CLEANER3.EXE
    CLEANER.EXE
    CLAW95CF.EXE
    CLAW95.EXE
    CFINET32.EXE
    CFINET.EXE
    CFIAUDIT.EXE
    CFIADMIN.EXE
    BLACKICE.EXE
    BLACKD.EXE
    AVWUPD32.EXE
    AVWIN95.EXE
    AVSCHED32.EXE
    AVPUPD.EXE
    AVPTC32.EXE
    AVPM.EXE
    AVPDOS32.EXE
    AVPCC.EXE
    AVP32.EXE
    AVP.EXE
    AVNT.EXE
    AVKSERV.EXE
    AVGCTRL.EXE
    AVE32.EXE
    AVCONSOL.EXE
    AUTODOWN.EXE
    APVXDWIN.EXE
    ANTI-TROJAN.EXE
    ACKWIN32.EXE
    _AVPM.EXE
    _AVPCC.EXE
    _AVP32.EXE
病毒的清除法：使用光华反病毒软件，彻底删除。病毒演示：病毒FAQ：      Windows下的PE病毒。
发现日期： 2003-10-31