病毒名稱
Worm.Beagle.ay病毒別名：諾頓W32.Beagle.AZ@mm
處理時間：
威脅級別：★★★
中文名稱：
病毒類型：蠕蟲
影響系統：Win9x / WinNT
病毒行為
該病毒為Beagle系列的一個新變種,它會瘋狂的在用戶系統中找郵件地址並傳送帶毒郵件到找到的郵件地址中.並該帶毒郵件極具欺騙性,可能導致更多的用戶感染該病毒.建議用戶開啟病毒防火牆來防止該病毒的感染.當用戶感染該病毒時,它會在用戶機器下作以下操作:
1.刪除註冊表
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
和
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
下的"My AV" "ICQ Net" 鍵值
2.在系統目錄下創建以下檔案:
%System%\sysformat.exe
%System%\sysformat.exeopen
%System%\sysformat.exeopenopen
3.嘗試查找並結束用戶系統中的以下進程:
apvxdwin.exe
ATUPDATER.EXE
AUPDATE.EXE
AUTODOWN.EXE
AUTOTRACE.EXE
AUTOUPDATE.EXE
avconsol.exe
AVENGINE.EXE
AVPUPD.EXE
avsynmgr.exe
AVWUPD32.EXE
AVXQUAR.EXE
bawindo.exe
blackd.exe
ccapp.exe
ccevtmgr.exe
ccproxy.exe
ccpxysvc.exe
CFIAUDIT.EXE
DefWatch.exe
DRWEBUPW.EXE
ESCANH95.EXE
ESCANHNT.EXE
FIREWALL.EXE
FrameworkService.exe
ICSSUPPNT.EXE
ICSUPP95.EXE
luall.exe
LUCOMS~1.EXE
mcagent.exe
mcshield.exe
MCUPDATE.EXE
mcvsescn.exe
mcvsrte.exe
mcvsshld.exe
navapsvc.exe
navapw32.exe
nisum.exe
nopdb.exe
nprotect.exe
NUPGRADE.EXE
outpost.exe
pavfires.exe
pavProxy.exe
Pavsrv50.exe
rtvscan.exe
rulaunch.exe
SAVScan.exe
SHSTAT.EXE
sndsrvc.exe
symlcsvc.exe
UPDATE.EXE
updaterui.exe
vshwin32.exe
vsstat.exe
VsTskMgr.exe
3.查找系統中資料夾名中包含"shar"字元串的資料夾並自身複製到找到的目錄下,檔案名稱可能為以下字元串:
1.exe
2.exe
3.exe
4.exe
5.scr
6.exe
7.exe
8.exe
9.exe
10.exe
Ahead Nero 7.exe
Windown Longhorn Beta Leak.exe
Opera 8 New!.exe
XXX hardcore images.exe
WinAmp 6 New!.exe
WinAmp 5 Pro Keygen Crack Update.exe
Adobe Photoshop 9 full.exe
Matrix 3 Revolution English Subtitles.exe
ACDSee 9.exe
4.從以下擴展名的檔案中搜尋Email地址:
.adb
.asp
.cfg
.cgi
.dbx
.dhtm
.eml
.htm
.jsp
.mbx
.mdx
.mht
.mmf
.msg
.nch
.ods
.oft
.php
.pl
.sht
.shtm
.stm
.tbb
.txt
.uin
.wab
.wsh
.xls
.xml
5.用自的SMTP引擎傳送帶毒郵件到上面找到的信箱地址
6.該帶毒郵件具有如下特徵:
主題:(以下之一)
Delivery by mail
Delivery service mail
Is delivered mail
Registration is accepted
You are made active
正文:(以下之一)
Before use read the help
Thanks for use of our software.
附屬檔案檔案名稱:(以下之一)
Jol03
guupd02
siupd02
upd02
viupd02
wsd01
zupd02
附屬檔案擴展名:(以下之一)
.com
.cpl
.exe
.scr
7.該病毒不會將帶毒郵件傳送到包含以下字元串的信箱中:
@avp.
@foo
@iana
@messagelab
@microsoft
abuse
admin
anyone@
bsd
bugs@
cafee
certific
contract@
f-secur
feste
free-av
gold-certs@
help@
icrosoft
info@
kasp
linux
listserv
local
news
nobody@
noone@
noreply
ntivi
panda
pgp
postmaster@
rating@
root@
samples
sopho
spam
support
unix
update
winrar
winzip
8.嘗試從以下網站上下載re_file.exe檔案
www.24-7-transportation.com
www.DarrkSydebaby.com
www.FritoPie.NET
www.adhdtests.com
www.aegee.org
www.aimcenter.net
www.alupass.lu
www.amanit.ru
www.andara.com
www.angelartsanctuary.com
www.anthonyflanagan.com
www.approved1stmortgage.com
www.argontech.net
www.asianfestival.nl
www.atlantisteste.hpg.com.br
www.aviation-center.de
www.bbsh.org
www.bga-gsm.ru
www.boneheadmusic.com
www.bottombouncer.com
www.bradster.com
www.buddyboymusic.com
www.bueroservice-it.de
www.calderwoodinn.com
www.capri-frames.de
www.celula.com.mx
www.ceskyhosting.cz
www.chinasenfa.com
www.cntv.info
www.compsolutionstore.com
www.coolfreepages.com
www.corpsite.com
www.couponcapital.net
www.cpc.adv.br
www.crystalrose.ca
www.cscliberec.cz
www.curtmarsh.com
www.customloyal.com
www.deadrobot.com
www.dontbeaweekendparent.com
www.dragcar.com
www.ecofotos.com.br
www.elenalazar.com
www.ellarouge.com.au
www.esperanzaparalafamilia.com
www.eurostavba.sk
www.everett.wednet.edu
www.fcpages.com
www.featech.com
www.fepese.ufsc.br
www.firstnightoceancounty.org
www.flashcorp.com
www.fleigutaetscher.ch
www.fludir.is
www.freeservers.com
www.gamp.pl
www.gci-bln.de
www.gcnet.ru
www.generationnow.net
www.gfn.org
www.giantrevenue.com
www.glass.la
www.handsforhealth.com
www.hartacorporation.com
www.himpsi.org
www.idb-group.net
www.immonaut.sk
www.ims-i.com
www.innnewport.com
www.irakli.org
www.irinaswelt.de
www.jansenboiler.com
www.jasnet.pl
www.jhaforpresident.7p.com
www.jimvann.com
www.jldr.ca
www.justrepublicans.com
www.kencorbett.com
www.knicks.nl
www.kps4parents.com
www.kradtraining.de
www.kranenberg.de
www.lasermach.com
www.leonhendrix.com
www.magicbottle.com.tw
www.mass-i.kiev.ua
www.mepbisu.de
www.mepmh.de
www.metal.pl
www.mexis.com
www.mongolische-renner.de
www.mtfdesign.com
www.oboe-online.com
www.ohiolimo.com
www.onepositiveplace.org
www.oohlala-kirkland.com
www.orari.net
www.pankration.com
www.pe-sh.com
www.pfadfinder-leobersdorf.com
www.pipni.cz
www.polizeimotorrad.de
www.programmierung2000.de
www.pyrlandia-boogie.pl
www.raecoinc.com
www.realgps.com
www.redlightpictures.com
www.reliance-yachts.com
www.relocationflorida.com
www.rentalstation.com
www.rieraquadros.com.br
www.scanex-medical.fi
www.sea.bz.it
www.selu.edu
www.sigi.lu
www.sljinc.com
www.smacgreetings.com
www.soloconsulting.com
www.spadochron.pl
www.srg-neuburg.de
www.ssmifc.ca
www.sugardas.lt
www.sunassetholdings.com
www.szantomierz.art.pl
www.the-fabulous-lions.de
www.tivogoddess.com
www.tkd2xcell.com
www.topko.sk
www.transportation.gov.bh
www.travelchronic.de
www.traverse.com
www.uhcc.com
www.ulpiano.org
www.uslungiarue.it
www.vandermost.de
www.vbw.info
www.velezcourtesymanagement.com
www.velocityprint.com
www.vikingpc.pl
www.vinirforge.com
www.wecompete.com
www.worest.com.ar
www.woundedshepherds.com
www.wwwebad.com
www.wwwebmaster.com
