W32/Surnova-D_病毒数据库

病毒名称: W32/Surnova-D 类别：蠕虫病毒资料：      技术特征：

    该蠕虫可通过KaZaA网络及MSN即时聊天工具进行传播。感染此蠕虫后，它首先会将自身以如下名字之一拷贝至Windows文件夹下：

    Alles-ist-vorbei.exe

    Desktop-shooting.exe

    Hello-Kitty.exe

    BigMac.exe

    Cheese-Burger.exe

    Blaargh.exe

    接着，设置注册表启动键HKLMSoftwareMicrosoftWindowsCurrenVersionRunSupernova 使得自己随Windows的启动而启动。

    若病毒第一次运行，它会弹出假的报错对话框：

    "Application attempted to read memory at 0xFFFFFFFFh Terminating application".

    另外，它通过设置如下注册表键使得病毒能借助KaZaA网络上的共享文件夹传播：

    HKLMSoftwareKaZaALocalContent

    假如该键值未找到，病毒就会使用 C:Media文件夹，然后在此文件夹下创建如下名称的共七十个病毒副本：

    Windows XP key generator.exe

    Windows XP serial generator.exe

    Key generator for all windows XP versions.exe

    Warcraft 3 ONLINE key generator.exe

    Half-life ONLINE key generator.exe

    Quake 4 BETA.exe

    Grand theft auto 3 CD1 crack.exe

    GTA3 crack.exe

    Battle.net key generator (WORKS!!).exe

    Warcraft 3 battle.net serial generator.exe

    Half-life WON key generator.exe

    Star wars episode 2 downloader.exe


    WinZip 8.0 + serial.exe

    WinRAR + crack.exe

    Britney spears nude.exe

    Macromedia MX key generator (all prodUCts).exe

    KaZaA media desktop v2.0 UNOFFICIAL.exe

    Microsoft key generator, works for ALL microsoft products!!.exe

    Microsoft Windows XP crack pack.exe

    Hack into any computer!!.exe

    DivX codec v6.0.exe

    DivX newest version.exe

    DivX.exe

    DivX pro key generator.exe

    Key generator for over 1,000 applications (really!).exe

    DivX patch - Increases quality.exe

    KaZaA spyware remover.exe

    Age of empires 2 crack.exe

    Norton antivirus 2002.exe

    Macromedia Dreamweaver MX Key Generator.exe

    Macromedia Flash MX Key Generator.exe

    Neverwinter nights crack.exe

    Microsoft Office XP (english) key generator.exe

    Microsoft Office XP.iso.exe

    CloneCD + crack.exe

    CloneCD all-versions key generator.exe

    XBOX emulator (WORKS!!).exeGamecube Emulator (WORKS!!).exeXbox.info.exeGrand Prix 4 crack.exe

    Nokia simlock remover (includes new models).exe

    Norton antivirus 2002.exe

    Macromedia Dreamweaver MX Key Generator.exe


    Macromedia Flash MX Key Generator.exe

    Neverwinter nights crack.exe

    Microsoft Office XP (english) key generator.exe

    Microsoft Office XP.iso.exe

    CloneCD + crack.exe

    CloneCD all-versions key generator.exe

    XBOX emulator (WORKS!!).exe

    Gamecube Emulator (WORKS!!).exe

    Xbox.info.exe

    Grand Prix 4 crack.exe

    Nokia simlock remover (includes new models).exe

    Britney spears hard porn (REAL!).exe

    Christina Aguilera fuck (REAL!).exe

    Kiddy child incest porn.exe

    Doom 3 preview!!.exe

    Crazy taxi crack.exe

    Copy protection remover.exe

    Sex.exe

    Jedi Knight 2 crack.exe

    Warcraft 3 trainer.exe

    Cable modem uncapper.exe

    Grand theft auto 3 trainer.exe

    KaZaA hack.exe

    KaZaA lite.exe

    Dragonball Z.exe

    Dragonball Z COMPLETE episode guide.exe

    Dragonball Z shootout.exe

    Dragonball Z episode 1.exe

    J-LO Nude (REAL!!).exe

    Doom 3 screenshots.exe

    Resident Evil [DivX].exe

    Shrek.exe

    Starcraft 2 preview!.exe

    Starcraft battle.net key generator.exe

    Starcraft ONLINE crack.exe

    它同时还会偿试将自身发送给受感染用户的MSN好友，可能以如下形式出现：


    Hehe, check this out :-)

    Funny, check it out (h)

    LOL!! See this :D

    LOL!! Check this out :)

    Hehe, this is fun :-)

    病毒还会在Windows文件夹中新建一个文本文件，文件名是由随机生成的数字组成，内容如下：

    W32.Supernova - Ban religion

    Religion = War

    Religion = Based on fairytales

    Wars based on fairytales?

    Ban religion, welcome to the truth
病毒的清除法：使用光华反病毒软件，彻底删除。病毒演示：病毒FAQ：      借KaZaA传播新蠕虫“Surnova-D”。
发现日期： 2003-7-20