病毒名稱
I-Worm.Bagle.at【AVP】
病毒介紹
處理時間：2004-10-29
威脅級別：★★★
中文名稱：惡鷹變種at
病毒類型：蠕蟲
影響系統：Win9x/ WinNT
病毒行為:
該病毒通過郵件進行傳播，用戶運行郵件附屬檔案後，會嘗試關閉計算機內的反病毒軟體，並從網上下載一個後門。該蠕蟲，還會在受感染的機器的檔案中搜尋電子郵件，並向搜尋到的地址傳送郵件。誘惑用戶打開運行病毒程式。該病毒會向外傳送大量的帶毒郵件，嚴重的堵塞用戶網路。建議用戶開啟防火牆來防止該病毒的侵入。
1.創建以下幾個互斥量來防止netsky病毒運行：
MuXxXxTENYKSDesignedAsTheFollowerOfSkynet-D
'D'r'o'p'p'e'd'S'k'y'N'e't'
_-oOaxX|-+S+-+k+-+y+-+N+-+e+-+t+-|XxKOo-_
【SkyNet.cz】SystemsMutex
AdmSkynetJklS003
____--->>>>U<<<<--____
_-oO】xX|-S-k-y-N-e-t-|Xx【Oo-_
2.在被感染的機器上創建以下檔案：
%System%\bawindo.exe
%System%\bawindo.exeopen
%System%\bawindo.exeopenopen
%System%\re_file.exe
3.在註冊表HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run中
增加"wingo"="%System%\wingo.exe"來確保自身能隨計算機啟動
4.從HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
刪除包含以下字元串的鍵值：
My AV
Zone Labs Client Ex
9XHtProtect
Antivirus
Special Firewall Service
service
Tiny AV
ICQNet
HtProtect
NetDy
Jammer2nd
FirewallSvr
MsInfo
SysMonXP
EasyAV
PandaAVEngine
Norton Antivirus AV
KasperskyAVEng
SkynetsRevenge
ICQ Net
5.在包含"shar"字元串的目錄下創建檔案，檔案名稱可能為下列字元：
Microsoft Office 2003 Crack, Working!.exe
Microsoft Windows XP, WinXP Crack, working keygen.exe
Microsoft Office XP working Crack, Keygen.exe
PORNO, sex, oral, anal cool, awesome!!.exe
Porno Screensaver.scr
Serials.txt.exe
KAV 5.0
Kaspersky Antivirus 5.0
Porno PICS arhive, xxx.exe
Windows Sourcecode update.doc.exe
Ahead Nero 7.exe
Windown Longhorn Beta Leak.exe
Opera 8 New!.exe
XXX hardcore images.exe
WinAmp 6 New!.exe
WinAmp 5 Pro Keygen Crack update.exe
Adobe Photoshop 9 full.exe
Matrix 3 Revolution English Subtitles.exe
ACDSee 9.exe
6.搜尋以下列字元串為擴展名的檔案來獲得Email地址，並用自帶的SMTP引擎傳送帶毒郵件
adb
.asp
.cfg
.cgi
.dbx
.dhtm
.eml
.htm
.jsp
.mbx
.mdx
.mht
.mmf
.msg
.NCH
.ods
.oft
.php
.pl
.sht
.shtm
.stm
.TBB
.txt
.UIN
.wab
.wsh
.xls
.xml
7.病毒傳送的帶毒郵件具有如下特徵：
發件人：偽造的
主題：
Re:
Re: Hello
Re: Thank you!
Re: Thanks :)
Re: Hi
正文：
:)
:))
附屬檔案：
檔案名稱可能為：
Price
price
Joke
擴展名可能為：
.com/.scr/.cpl
8.該病毒不會向包含以下字元串的郵件地址傳送郵件
@avp.
@foo
@hotmail
@iana
@messagelab
@microsoft
@msn
abuse
admin
anyone@
bsd
bugs@
cafee
certific
contract@
f-secur
feste
free-av
gold-certs@
google
help@
icrosoft
info@
kasp
linux
listserv
local
news
nobody@
noone@
noreply
ntivi
panda
pgp
postmaster@
rating@
root@
samples
sopho
spam
support
unix
update
winrar
winzip
9.嘗試從下列網站下載檔案
www.bottombouncer.com
www.bottombouncer.com
www.anthonyflanagan.com
www.bradster.com
www.traverse.com
www.ims-i.com
www.realgps.com
www.aviation-center.de
www.gci-bln.de
www.pankration.com
www.jansenboiler.com
www.corpsite.com
www.everett.wednet.edu
www.onepositiveplace.org
www.raecoinc.com
www.wwwebad.com
www.corpsite.com
www.wwwebmaster.com
www.wwwebad.com
www.dragcar.com
www.wwwebad.com
www.oohlala-kirkland.com
www.calderwoodinn.com
www.buddyboymusic.com
www.smacgreetings.com
www.tkd2xcell.com
www.curtmarsh.com
www.dontbeaweekendparent.com
www.soloconsulting.com
www.lasermach.com
www.generationnow.net
www.flashcorp.com
www.kencorbett.com
www.FritoPie.NET
www.leonhendrix.com
www.transportation.gov.bh
www.transportation.gov.bh
www.jhaforpresident.7p.com
www.DarrkSydebaby.com
www.cntv.info
www.sugardas.lt
www.adhdtests.com
www.argontech.net
www.customloyal.com
www.ohiolimo.com
www.topko.sk
www.alupass.lu
www.sigi.lu
www.redlightpictures.com
www.irinaswelt.de
www.bueroservice-it.de
www.kranenberg.de
www.kranenberg.de
www.the-fabulous-lions.de
www.the-fabulous-lions.de
www.mongolische-renner.de
www.mongolische-renner.de
www.capri-frames.de
www.capri-frames.de
www.aimcenter.net
www.boneheadmusic.com
www.fludir.is
www.sljinc.com
www.tivogoddess.com
www.fcpages.com
www.andara.com
www.freeservers.com
www.programmierung20d 0a0.de
www.asianfestival.nl
www.aviation-center.de
www.gci-bln.de
www.mass-i.kiev.ua
www.jasnet.pl
www.atlantisteste.hpg.com.br
www.fludir.is
www.rieraquadros.com.br
www.metal.pl
www.handsforhealth.com
www.angelartsanctuary.com
www.firstnightoceancounty.org
www.chinasenfa.com
www.chinasenfa.com
www.ulpiano.org
www.gamp.pl
www.vikingpc.pl
www.woundedshepherds.com
www.cpc.adv.br
www.velocityprint.com
www.esperanzaparalafamilia.com
www.celula.com.mx
www.mexis.com
www.wecompete.com
www.vbw.info
www.gfn.org
www.aegee.org
www.deadrobot.com
www.cscliberec.cz
www.ecofotos.com.br
www.amanit.ru
www.bga-gsm.ru
www.innnewport.com
www.knicks.nl
www.srg-neuburg.de
www.mepmh.de
www.mepbisu.de
www.kradtraining.de
www.polizeimotorrad.de
www.sea.bz.it
www.uslungiarue.it
www.gcnet.ru
www.aimcenter.net
www.vandermost.de
www.vandermost.de
www.szantomierz.art.pl
www.immonaut.sk
www.eurostavba.sk
www.spadochron.pl
www.pyrlandia-boogie.pl
www.kps4parents.com
www.pipni.cz
www.selu.edu
www.travelchronic.de
www.fleigutaetscher.ch
www.irakli.org
www.oboe-online.com
www.oboe-online.com
www.pe-sh.com
www.idb-group.net
www.ceskyhosting.cz
www.ceskyhosting.cz
www.hartacorporation.com
www.glass.la
www.glass.la
www.24-7-transportation.com
www.fepese.ufsc.br
www.ellarouge.com.au
www.bbsh.org
www.boneheadmusic.com
www.sljinc.com
www.tivogoddess.com
www.fcpages.com
www.szantomierz.art.pl
www.elenalazar.com
www.ssmifc.ca
www.reliance-yachts.com
www.worest.com.ar
www.kps4parents.com
www.coolfreepages.com
www.scanex-medical.fi
www.jimvann.com
www.orari.net
www.himpsi.org
www.mtfdesign.com
www.jldr.ca
www.relocationflorida.com
www.rentalstation.com
www.approved1stmortgage.com
www.velezcourtesymanagement.com
www.sunassetholdings.com
www.compsolutionstore.com
www.uhcc.com
www.justrepublicans.com
www.pfadfinder-leobersdorf.com
www.featech.com
www.vinirforge.com
www.magicbottle.com.tw
www.giantrevenue.com
www.couponcapital.net
www.crystalrose.ca
www.crystalrose.ca
www.crystalrose.ca
www.crystalrose.ca
