Worm.Beagle.cs

该病毒是恶鹰病毒的一个加载器。该病毒运行时，会释放随机生成病毒名的恶鹰病毒，然后执行恶鹰，释放文件%system%\winshost.exe和%system%\wiwshost，并执行。添加注册表启动项，使能开机运行。该病毒会关闭大量杀毒软件及升级程序，更改大量安全软件的名字，删除大量安全软件的启动项，达到使安全软件崩溃的目的。然后下载另一个病毒文件，使能够通过邮件传播。

1，生成文件
%windows%\随机文件名.exe
%system%\winshost.exe
%system%\wiwshost.exe

2，添加注册表
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"winshost.exe"="%system%\winshost.exe"
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"winshost.exe"="%system%\winshost.exe"

3，删除注册表
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"SymantecNetDriverMonitor"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"ccApp"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"NAVCfgWiz"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"SSC_UserPrompt"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"McAfeeGuardian"
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"McAfee.InstantUpdate.Monitor"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"APVXDWIN"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"KAV50"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"avg7_cc"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"avg7_emc"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"ZoneLabsClient"
HKLM\SOFTWARE\Symantec
HKLM\SOFTWARE\McAfee
HKLM\SOFTWARE\KasperskyLab
HKLM\SOFTWARE\Agnitum
HKLM\SOFTWARE\PandaSoftware
HKLM\SOFTWARE\ZoneLabs

4，阻止服务
wuauserv
PAVSRV
PAVFNSVR
PSIMSVC
Pavkre
PavProt
PREVSRV
PavPrSrv
SharedAccess
navapsvc
NPFMntor
OutpostFirewall
SAVScan
SBService
SymantecCoreLC
ccEvtMgr
SNDSrvc
ccPwdSvc
ccSetMgr.exe
SPBBCSvc
KLBLMain
avg7alrt
avg7updsvc
vsmon
CAISafe
avpcc
fsbwsys
backwebclient-4476822
backwebclient-4476822
fsdfwd
F-SecureGatekeeperHandlerStarter
FSMA
KAVMonitorService
navapsvc
NProtectService
NortonAntivirusServer
VexiraAntivirus
dvpinit
dvpapi
schscnt
BackWebClient-7681197
F-SecureGatekeeperHandlerStarter
FSMA
AVPCC
KAVMonitorService
NormanNJeeves
NVCScheduler
nvcoas
NormanZANDA
PASSRV
SweepNet
SWEEPSRV.SYS
NOD32ControlCenter
NOD32Service
PCCPFW
Tmntsrv
AvxIni
XCOMM
ravmon8
SmcService
BlackICE
PersFW
McAfeeFirewall
OutpostFirewall
NWService
alerter
sharedaccess
NISUM
NISSERV
vsmon
nwclnth
nwclntg
nwclnte
nwclntf
nwclntd
nwclntc
wuauserv
navapsvc
SymantecCoreLC
SAVScan
kavsvc
DefWatch
SymantecAntiVirusClient
NSCTOP
SymantecCoreLC
SAVScan
SAVFMSE
ccEvtMgr
navapsvc
ccSetMgr
VisNeticAntiVirusPlug-in
McShield
AlertManger
McAfeeFramework
AVExch32Service
AVUPDService
McTaskManager
NetworkAssociatesLogService
OutbreakManager
MCVSRte
mcupdmgr.exe
AvgServ
AvgCore
AvgFsh
awhost32
AhnlabtaskScheduler
MonSvcNT
V3MonNT
V3MonSvc
FSDFWD

5，改名文件
CCSETMGR.EXE
CCEVTMGR.EXE
NAVAPSVC.EXE
NPFMNTOR.EXE
symlcsvc.exe
SPBBCSvc.exe
SNDSrvc.exe
ccApp.exe
ccl30.dll
ccvrtrst.dll
LUALL.EXE
AUPDATE.EXE
Luupdate.exe
LUINSDLL.DLL
RuLaunch.exe
CMGrdian.exe
Mcshield.exe
outpost.exe
Avconsol.exe
Vshwin32.exe
VsStat.exe
Avsynmgr.exe
kavmm.exe
Up2Date.exe
KAV.exe
avgcc.exe
avgemc.exe
zonealarm.exe
zatutor.exe
zlavscan.dll
zlclient.exe
isafe.exe
cafix.exe
vsvault.dll
av.dll
vetredir.dll
分别改名为
C1CSETMGR.EXE
CC1EVTMGR.EXE
NAV1APSVC.EXE
NPFM1NTOR.EXE
s1ymlcsvc.exe
SP1BBCSvc.exe
SND1Srvc.exe
ccA1pp.exe
cc1l30.dll
ccv1rtrst.dll
LUAL1L.EXE
AUPD1ATE.EXE
Luup1date.exe
LUI1NSDLL.DLL
RuLa1unch.exe
CM1Grdian.exe
Mcsh1ield.exe
outp1ost.exe
Avc1onsol.exe
Vshw1in32.exe
Vs1Stat.exe
Av1synmgr.exe
kav12mm.exe
Up222Date.exe
K2A2V.exe
avgc3c.exe
avg23emc.exe
zonealarm.exe
zatutor.exe
zlavscan.dll
zo3nealarm.exe
zatu6tor.exe
zl5avscan.dll
zlcli6ent.exe
is5a6fe.exe
c6a5fix.exe
vs6va5ult.dll
a5v.dll
ve6tre5dir.dll

6，结束进程
NUPGRADE.EXE
MCUPDATE.EXE
ATUPDATER.EXE
AUPDATE.EXE
AUTOTRACE.EXE
AUTOUPDATE.EXE
FIREWALL.EXE
ATUPDATER.EXE
LUALL.EXE
DRWEBUPW.EXE
AUTODOWN.EXE
NUPGRADE.EXE
OUTPOST.EXE
ICSSUPPNT.EXE
ICSUPP95.EXE
ESCANH95.EXE
AVXQUAR.EXE
ESCANHNT.EXE
UPGRADER.EXE
AVXQUAR.EXE
AVWUPD32.EXE
AVPUPD.EXE
CFIAUDIT.EXE
UPDATE.EXE

7，从大量网址下载名为osa5.gif的病毒，保存到本地_re_file.exe执行，用来传播病毒