江西广告网

标题: Mydoom:病毒大佬变脸再现江湖 [打印本页]

作者: 雨林    时间: 2008-12-4 10:10
标题: Mydoom:病毒大佬变脸再现江湖

  2004年里的病毒大佬--Mydoom看来是不希望广大人民群众过一个安乐祥和的踏实年了,随着在年度十世界毒王的评选中一举胜出之后,才休息没多久,便易容重现江湖。
  
  新变种依然依靠从受感染计算机中查找邮件地址,然后使用自带的SMTP引擎,大规模的邮件发送来进行传播。
  
  其它命名:MyDoom.AI [F-Secure], W32/MyDoom-AA [Sophos], W32/Mydoom.ap@MM [McAfee]
  
  病毒类型:蠕虫
  
  病毒长度:31,744字节
  
  受影响系统:Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
  
  威胁程度:低
  
  破坏能力:中
  
  传播能力:中
  
  综合评价:二级
  
  病毒发作时:
  
  1,创建如下文件:
  
  %system%\lsasrv.exe(病毒的拷贝)
  %system%\version.ini(一个无害的文本文件)
  %system%\hsery.sys(一个无害的二进制文件)
  
  2,然后,创建如下注册表项:
  
  HEKY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersionRun\"lsass"="%system%\lsasrv.exe"
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersionWinlogon"Shell"="explorer.exe %system%\lsasrv.exe"
  
  3,随后,病毒在用户的临时文件夹下创建名为Mes#wtelw.txt文件,文件只包含垃圾数据,病毒使用记事本打开它,在它上面显示垃圾内容。
  
  4,随后病毒从Windows地址薄以及带有如下扩展名的文件中收集邮件地址:
  .adb
  .asa
  .asc
  .asm
  .asp
  .cgi
  .con
  .csp
  .dbx
  .dlt
  .dwt
  .edm
  .hta
  .htc
  .htm
  .inc
  .jsp
  .jst
  .lbi
  .php
  .rdf
  .rss
  .sht
  .ssi
  .stm
  .tbb
  .tpl
  .txt
  .vbp
  .vbs
  .wab
  .wml
  .xht
  .xml
  .xsd
  .xst
  
  5,病毒不会将自己发送到含有如下字符串的邮件地址中去:
  
  accoun
  certific
  listserv
  ntivi
  support
  icrosoft
  admin
  page
  the.bat
  gold-certs
  feste
  submit
  not
  help
  service
  privacy
  ... ...
  
  6,邮件内容:
  病毒将使用如下域名之一来创建一个虚假的地址:
  - 来源:
  compuserve.com
  juno.com
  earthlink.net
  yahoo.co.uk
  hotmail.com
  yahoo.com
  msn.com
  aol.com
  
  使用如下标题之一:
  Attention!!!
  Do not reply to this email
  Error
  Good day
  hello
  Mail Delivery System
  Mail Transaction Failed
  Server Report
  Status
  附件有如下几个命名:
  body
  message
  docs
  data
  file
  rules
  doc
  readme
  document
  附件扩展名为如下之一:
  .bat
  .cmd
  .exe
  .scr
  .pif
  .zip
  
  邮件文本内容如下:
  The message contains Unicode characters and has been sent as a binary attachment.
  
  The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
  
  Mail transaction failed. Partial message is available.
  
  Here are your documents you are requested.
  
  Thank you for registering at WORLDXXXPASS.COM
  All your payment info, login and password you can find in the attachment file.
  It's a real good choise to go to WORLDXXXPASS.COM
  
  Attention! New self-spreading virus!
  Be careful, a new self-spreading virus called "RTSW.Smash" spreading very fast via e-mail and P2P networks. It's about two million people infected and it will be more.
  To avoid your infection by this virus and to stop it we provide you with full information how to protect yourself against it and also including free remover. Your can find it in the attachment.
  c 2004 Networks Associates Technology, Inc. All Rights Reserved
  New terms and conditions for credit card holders
  Here a new terms and conditions for credit card holders using a credit cards for making purchase in the Internet in the attachment. Please, read it carefully. If you are not agree with new terms and conditions do not use your credit card in the World Wide Web.
  Thank you,
  The World Bank Group
  c 2004 The World Bank Group, All Rights Reserved
  Attention! Your IP was logged by The Internet Fraud Complaint Center
  Your IP was logged by The Internet Fraud Complaint Center. There was a fraud attempt logged by The Internet Fraud Complaint Center from your IP. This is a serious crime, so all records was sent to the FBI.
  All information you can find in the attachment. Your IP was flagged and if there will be anover attemption you will be busted.
  This message is brought to you by the Federal Bureau of Investigation and the National White Collar Crime Center
  
  7,它将自己拷贝到名为Kazaa,morpheus,iMesh,eDonkey或者是LimeWire的共享文件夹中,文件扩展名为:.bat,.pif或者.exe:
  
  ·porno
  ·NeroBROM6.3.1.27
  ·avpprokey
  ·Ad-awareref01R349
  ·winxp_patch
  ·adultpasswds
  ·dcom_patches
  ·K-LiteCodecPack2.34a
  ·activation_crack
  ·icq2004-final
  ·winamp5
  
  8,同时,它也尝试去终止如下的进程,包含防火墙及反病毒程序:
  
  i11r54n4.exe
  irun4.exe
  d3dupdate.exe
  rate.exe
  ssate.exe
  winsys.exe
  winupd.exe
  SysMonXP.exe
  bbeagle.exe
  Penis32.exe
  teekids.exe
  MSBLAST.exe
  mscvb32.exe
  sysinfo.exe
  PandaAVEngine.exe
  taskmon.exe
  wincfg32.exe
  outpost.exe
  zonealarm.exe
  navapw32.exe
  navw32.exe
  zapro.exe
  msblast.exe
  netstat.exe
  
  9,下载http://nermasteno.com/com.txt或者http://www.opsanted.com/com.txt。
  
  10,将如下条目添加到%system%\drivers\etc\hosts文件夹中,以阻止用户访问反病毒网站:
  
  127.0.0.1 www.symantec.com
  127.0.0.1 securityresponse.symantec.com
  127.0.0.1 symantec.com
  127.0.0.1 www.sophos.com
  127.0.0.1 sophos.com
  127.0.0.1 www.mcafee.com
  127.0.0.1 mcafee.com
  127.0.0.1 liveupdate.symantecliveupdate.com
  127.0.0.1 www.viruslist.com
  127.0.0.1 viruslist.com
  127.0.0.1 www.f-secure.com
  127.0.0.1 f-secure.com
  127.0.0.1 kaspersky.com
  127.0.0.1 kaspersky-labs.com
  127.0.0.1 www.avp.com
  127.0.0.1 avp.com
  127.0.0.1 www.kaspersky.com
  127.0.0.1 www.networkassociates.com
  127.0.0.1 networkassociates.com
  127.0.0.1 www.ca.com
  127.0.0.1 ca.com
  127.0.0.1 mast.mcafee.com
  127.0.0.1 www.my-etrust.com
  127.0.0.1 my-etrust.com
  127.0.0.1 download.mcafee.com
  127.0.0.1 dispatch.mcafee.com
  127.0.0.1 secure.nai.com
  127.0.0.1 www.nai.com
  127.0.0.1 nai.com
  127.0.0.1 update.symantec.com
  127.0.0.1 updates.symantec.com
  127.0.0.1 us.mcafee.com
  127.0.0.1 liveupdate.symantec.com
  127.0.0.1 customer.symantec.com
  127.0.0.1 rads.mcafee.com
  127.0.0.1 www.trendmicro.com
  127.0.0.1 trendmicro.com
  127.0.0.1 www.grisoft.com
  127.0.0.1 grisoft.com <




欢迎光临 江西广告网 (http://bbs.jxadw.com/) Powered by Discuz! X3.2