病毒名称:
W32/Bagle.AQ@mm
类别： 邮件蠕虫
病毒资料：
病毒类型：蠕虫病毒
这是一个邮件蠕虫病毒和P2P蠕虫病毒。文件大小为19-24K字节，其尺寸通常随垃圾数据的增加而增加。
这个蠕虫病毒利用名称为WINGO.EXE将自身安装到Windows文件夹，并且修改注册表键值指向自己使得启动时运行自己。病毒会搜索名称中带有“shar”字符串的文件夹，找到后会在其中生成自身拷贝，拷贝的文件名如下：
Microsoft Office 2003 Crack, Working!.exe.
Porno, sex, oral, anal cool, awesome!!.exe.
Porno Screensaver.scr.
Serials.txt.exe.
KAV 5.0
KASPersky Antivirus 5.0.
Porno pics arhive, xxx.exe.
Windows Sourcecode update.doc.exe.
Ahead Nero 7.exe.
Opera 8 New!.exe.
XXX hardcore images.exe.
WinAMP 6 New!.exe.
Adobe Photoshop 9 full.exe.
Matrix 3 Revolution English SuBTitles.exe.
ACDSee 9.exe.
修改注册表：
这个蠕虫删除一部分属于其他蠕虫和AV产品的键值：
"My AV" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"My AV" in key
"HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"Zone Labs Client Ex" in key
"HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"Zone Labs Client Ex" in key
"HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"9XHtProtect" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"9XHtProtect" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"Antivirus" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"Antivirus" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"Special Firewall Service" in key
"HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"Special Firewall Service" in key
"HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"service" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"service" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"Tiny AV" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"Tiny AV" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"ICQNet" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"ICQNet" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"HtProtect" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"HtProtect" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"NetDy" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"NetDy" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"Jammer2nd" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"Jammer2nd" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"FirewallSvr" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"FirewallSvr" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"MsInfo" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"MsInfo" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"SysMonXP" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"SysMonXP" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"EasyAV" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"EasyAV" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"PandaAVEngine" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"PandaAVEngine" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"Norton Antivirus AV" in key
"HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"Norton Antivirus AV" in key
"HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"KasperskyAVEng" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"KasperskyAVEng" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"SkynetsRevenge" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"SkynetsRevenge" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
"ICQ Net" in key "
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run".
"ICQ Net" in key "
HKLM\Software\Microsoft\Windows
\CurrentVersion\Run".
并且添加如下键值到启动项：
HKCU\Software\Microsoft\Windows
\CurrentVersion\Run =
"wingo"="\wingo.exe"
病毒的清除法：
使用光华反病毒软件，彻底删除。
病毒演示：
病毒FAQ：
别名: WORM_BAGLE.AT, W32/Bagle.AT@mm, I-Worm.Bagle.at
传播方式：通过邮件或者其他方式传播。
危险级别：高
发现日期：
2004-10-29
|
