病毒名称:
Worm.Novarg.y
类别： 蠕虫
病毒资料：
破坏方法：
一个蠕虫病毒
病理行为：
病毒运行后将释放一个名为：ABOUT_MYDOOM.TXT的文件在％system％目录下。
该文件描述了病毒的运行形为：
Contain
1- ATTACK www.symantec.com On Sept 29 2004
starting at 2
2- drops yahoo keylogger that open 4321, http://***victim_ip:4321/
3- drops 2 pictures that will not be
showing to the victim
4- drops a downxz.bat which download Bacdoor.
Nemog.c
5- drops services.exe , zincite.a
6- Retrieves email addresses from the Outlook
address book and files on fixed disks,
ram disks, and in the following registry key and folders:
％Userprofile％\Local Settings\Temporary Internet Files
％Userprofile％\Desktop
％Userprofile％\My Documents
％Userprofile％\Application Data , etc
queries
HKEY_CURRENT_USER\Software\Microsoft
\WAB\WAB4\Wab File Name
and searches for emails.
go and detect the other information.
In a difficult world
In a nameless time
I want to survive
So, you will be mine!!,second author
Nemog and ZinCite :P
病毒的清除法：
使用光华反病毒软件，彻底删除。
病毒演示：
病毒FAQ：
Windows下的PE病毒。
发现日期：
2004-9-14
|
