Worm.Salga.a

该蠕虫病毒会疯狂复制到磁盘中的所有目录，并在某些系统目录中反复复制，大量消耗系统资源和磁盘空间。并在可写的逻辑磁盘的根目录生
成autorun.inf文件，每次用户打开磁盘的时候病毒就静静地自动运行了。该病毒修改注册表将自己加到自启动项，并禁止系统还原。然后该蠕
虫病毒搜索Outlook地址薄中的电子邮箱地址，将自己以附件的形式发送出去，以感染更多机器，附件名字颇有诱惑力的，由于名字中带有多个
“.”，使得扩展名“exe”可能被隐藏，一不小心就能中招。病毒还将自身复制到局域网中可写网络磁盘以传播，然后给局域网中所有用户发
送一条虚假信息以诱骗别的用户点击该病毒副本。该病毒还会显示一些对话框，以交友和给系统打补丁为诱饵窃取用户的电子邮箱以及密码。

1.疯狂复制自身：
1)
%SystemRoot%\system\systemcopy.exe
%SystemRoot%\acdseedemo.exe
%SystemRoot%\system32\egywormo[gen1].exe

c:\BritnyspearsmarragewithBnladensun.zip
c:\hardcorehookfromweb
c:\hardcorehookfromweb\setup.zip.exe

%SystemRoot%\AllUsers\Desktop\sexcam
%SystemRoot%\AllUsers\Desktop\sexcam\sexphotoesofmonika.zip.exe
%SystemRoot%\AllUsers\StartMenu\Programs\StartUp\ana~1.exe
%SystemRoot%\DocumentsandSettings\AllUsers\StartMenu\Programs\Startup\egy~1

%SystemRoot%\StartMenu\internetspeeder.zip.exe
%SystemRoot%\startmenu\programs\newchatprog.zip.exe

C:\DocumentsandSettings\AllUsers\DESKTOP\holywoodstufffilm.zip.exe
C:\DocumentsandSettings\AllUsers\StartMenu\nicolekidmansexycam.zip.exe
C:\DocumentsandSettings\AllUsers\StartMenu\Programs\yoursexycam.zip.exe
C:\DocumentsandSettings\AllUsers\StartMenu\Programs\Accessories\magicgraphicesmaker.zip.exe

C:\ProgramFiles\Accessories\BRITNYSPEARSMARRAGE.zip...............exe
C:\ProgramFiles\Accessories\Detailsofnewfriends.zip...............exe
C:\ProgramFiles\Accessories\Details.zip...............exe
C:\ProgramFiles\Accessories\hardsexfiles.zip...............exe
C:\ProgramFiles\Accessories\IsBnladenrealycowboy.zip...............exe
C:\ProgramFiles\Accessories\kasper2005.zip...............exe
C:\ProgramFiles\Accessories\Nicolekidman.zip...............exe

d:\autorun.inf
＃＃＃＃＃＃＃＃
[autorun]
open=FUN.ZIP.EXE
＃＃＃＃＃＃＃＃

d:\FUN.ZIP.EXE
d:\girlfriendsemails.zip.exe
d:\hookallsexmoviesfromwebs
d:\hookallsexmoviesfromwebs\setup.zip.exe
d:\newcomputerwormalert
d:\newcomputerwormalert\virusalert.txt
d:\NEWPROGRAMS

e:\autorun.inf
＃＃＃＃＃＃＃＃
[autorun]
open=Messenger9.00.ZIP.EXE
＃＃＃＃＃＃＃＃

e:\Messenger9.00.ZIP.EXE
e:\bloodoffetchsex.zip.exe
e:\realsextelephones
e:\realsextelephones\callfromme.zip.exe

2)
创建共享目录以及共享文件：
C:\Britny
c:\Britny\NEWFILM.ZIP.EXE

3)
搜索磁盘中地所有目录和文件，如搜到一个文件或目录为A，则在磁盘中同一位置生成病毒的副本A.exe.

不停地尝试复制自身到以下目录，复制后的文件名随机生成：
<系统盘>\<系统目录名><随机数字>.exe
c:\programfiles\
%SystemRoot%\system\

2.修改注册表。
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
"windows"="%SystemRoot%\system\systemcopy.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
"systemxp"="%SystemRoot%\acdseedemo.exe"

HKEY_CURRENT_USER\Software\Kazaa\Transfer\
"StartKazaa-SilentRun"="C:\ProgramFiles\Kazaa\MySharedFolder\Shared"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsNT\SystemRestore
"DisableConfig"=dword:1
"DisableSR"=dword:1

3.搜索OutLook地址薄中的邮件地址，将自己以附件的形式发送出去，以感染更多机器。附件可能为以下名字：
hugesexybrestsprogramv1.7.00.zip.exe
3dmsnversion10.1.zip................exe
thisfilesisverysecretfiles.zip.........exe
newfilm.zip.........exe
irobot.zip.........exe
antivirus.zip.........exe
firewall.zip.........exe
news.zip.........exe
yahoo.zip.........exe
aol.zip.........exe
mirc.zip.........exe
hack.zip.........exe
virus.zip.........exe
animalphotos.zip.........exe
USAsecrets.zip.........exe
photoshop.zip.........exe
deutshprograms.zip.........exe
wwf.zip.........exe
tourism.zip.........exe
fear.zip.........exe
autocade.zip.........exe
3dstoudio.zip.........exe
scinceofwater.zip.........exe
office2005.zip.........exe
antibiotics.zip.........exe
viagra.zip.........exe
visualbasicprojects.zip.........exe
FBIsecrets.zip.........exe
FOOTBALLINENGLAND.zip.........exe
TOY2006.zip.........exe
BritnySpears.zip.........exe
Dracola.zip.........exe
pebsi.zip.........exe
newspaper.zip.........exe
cocacola.zip.........exe
songs.zip.........exe
norton2005.zip.........exe
xxlplus.zip.........exe
lesbien.zip.........exe
hardcore.zip.........exe
sexplus.zip.........exe
computersin2010.zip.........exe
ssParis_Hilton_(NudeScreenSaver).scr.............exe
Win32System_Tweaks_v1.0.zip.........exe
msgames.zip.........exe
Virtual_3D_Pinball.zip.........exe
ssPamela_Anderson_(NakedScreenSaver).scr.........exe
Game_Crack_Genie_v0.5.zip.........exe
MsDos_PortScanner.zip.........exe
Wmplayer_Celebrity_Skins.zip.........exe
ShockwaveFlash.zip.........exe
SWF_Movie.zip.........exe
FlashMovie.zip.........exe
XXXvideo.zip.........exe
Catattackschild.zip.........exe
SWF.zip.........exe
Comedyvideo.zip.........exe
SimpsonsEpisode(#)..zip.........exe
TutorialVideoonHacking.........exe
MacroMediaFlash6.0.zip.........exe
[SWF]-TheFastandtheFurious.zip.........exe
[SWF]-Swordfish.........exe
[SWF]-HarryPotterandthephilosophersstone.zip.........exe
bigoneintheworld.zip.........exe
newfilm.zip.........exe
Iraqwar.zip.................exe
USAdiscveredwaterinmarsyesterday.doc.zip.................exe
BritnyspearsandMadonasexviedioin24minonly.zip.................exe
strongfirewallallovertheworldwiththelastupdateofnorton.zip.................exe
lastmessengersversions.zip.................exe
learnphotoshopin3daysonly.zip.................exe
newgirlsemailswiththerephonenumbers.zip.................exe
newcupiedphotos.zip.................exe

邮件主题：
Sirnewvictem

邮件内容：
Hi:siri"myourserverEgywormo[gen1]thisisnewvictemwhohasownoutlookmachineicaputrehiscontactsandgotheretoinfectthem....oki"llgonowandseeyousoonwheniinfectmore......bibisir

4.将自身复制到可写的网络磁盘中，以感染更多机器：
c$\windows\system32\passwordofhotmailstore.zip................exe
c$\docummentandsettings\allusers\documents\secretdocuments.zip......................exe
c$\moneygeneratorverydengerousandsecrt.zip..........................exe
c$\shared\mysallaryeverymmonthincreaser.................................exe
ipc$\secretphotoesfrommychat.zip...............................exe
c$\winnt\systemm32\speialfilmslinksinnet.zip.............................exe
admin$\system32\seethisitisveryintersting.zip...................................exe

5.向局域网中的所有用户发送一下消息：
hiwelcomeinournetcafeyoucanseethenewfilmofBritnyspearsfromthecomputerwhichshownitisveryinterestingfilmorseeitfromanysharedfolder<

6.尝试访问网络中图片并显示。显示2个对话框，提示用户系统需要打补丁，欺骗用户去下载并运行病毒。另一个以交友为诱饵窃取用户的电子
邮箱和密码发送到指定电子邮箱。