Worm.Beagle.bb

病毒名稱

Worm.Beagle.bb
病毒別名：E-mail-Worm.Win32.Bagle.bd【AVP】
處理時間：2005-03-01
威脅級別：★★★
中文名稱：惡鷹bb
病毒類型：蠕蟲
影響系統：Win9x/ WinNT

病毒行為

該病毒通過郵件進行傳播，用戶運行郵件附屬檔案後，會嘗試關閉計算機內的反病毒軟體，並從網上下載一個後門。該蠕蟲，還會在受感染的機器的檔案中搜尋電子郵件，並向搜尋到的地址傳送郵件。誘惑用戶打開運行病毒程式。該病毒會向外傳送大量的帶毒郵件，嚴重的堵塞用戶網路。
病毒傳送的郵件
病毒偽裝成記事本圖示：
1、刪除註冊表
①刪除註冊表
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
中的以下鍵：
Symantec NetDriver Monitor
ccApp
NAV CfgWiz
SSC_UserPrompt
McAfee Guardian
APVXDWIN
KAV50
avg7_cc
avg7_emc
Zone Labs Client
②刪除註冊表
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
中的以下鍵
McAfee.InstantUpdate.Monitor
③刪除以下註冊表鍵
HKLM\SOFTWARE\Symantec
HKLM\SOFTWARE\McAfee
HKLM\SOFTWARE\kasperskyLab
HKLM\SOFTWARE\Agnitum
HKLM\SOFTWARE\Panda Software
HKLM\SOFTWARE\Zone Labs
以阻止安全軟體運行
2、添加註冊表項：
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"winshost.exe" = "%system%\winshost.exe"
3、病毒生成以下檔案：
%System%\winshost.exe（病毒本身）
%System%\wiwshost.exe
4、嘗試遠程注入Explorer.exe，以隱藏進程
5、嘗試關閉進程名中含有以下字元的進程
wuauserv
PAVSRV
PAVFNSVR
PSIMSVC
Pavkre
PavProt
PREVSRV
PavPrSrv
SharedAccess
navapsvc
NPFMntor
Outpost Firewall
SAVScan
SBService
Symantec Core LC
ccEvtMgr
SNDSrvc
ccPwdSvc
ccSetMgr.exe
SPBBCSvc
KLBLMain
avg7alrt
avg7updsvc
vsmon
CAISafe
avpcc
fsbwsys
backweb client - 4476822
backweb client-4476822
fsdfwd
F-Secure Gatekeeper Handler Starter
FSMA
KAVMonitorService
navapsvc
NProtectService
Norton Antivirus Server
VexiraAntivirus
dvpinit
dvpapi
schscnt
BackWeb Client - 7681197
F-Secure Gatekeeper Handler Starter
FSMA
AVPCC
KAVMonitorService
Norman NJeeves
NVCScheduler
nvcoas
Norman ZANDA
PASSRV
SweepNet
SWEEPSRV.SYS
NOD32ControlCenter
NOD32Service
PCCPFW
Tmntsrv
AvxIni
XCOMM
ravmon8
SmcService
BlackICE
PersFW
McAfee Firewall
OutpostFirewall
NWService
alerter
sharedaccess
NISUM
NISSERV
vsmon
nwclnth
nwclntg
nwclnte
nwclntf
nwclntd
nwclntc
wuauserv
navapsvc
Symantec Core LC
SAVScan
kavsvc
DefWatch
Symantec AntiVirus Client
NSCTOP
Symantec Core LC
SAVScan
SAVFMSE
ccEvtMgr
navapsvc
ccSetMgr
VisNetic AntiVirus Plug-in
McShield
AlertManger
McAfeeFramework
AVExch32Service
AVUPDService
McTaskManager
Network Associates Log Service
Outbreak Manager
MCVSRte
mcupdmgr.exe
AvgServ
AvgCore
AvgFsh
awhost32
Ahnlab task Scheduler
MonSvcNT
V3MonNT
V3MonSvc
FSDFWD
6、修改Host檔案，以阻止防毒軟體升級：
127.0.0.1 localhost
127.0.0.1 ad.doubleclick.net
127.0.0.1 ad.fastclick.net
127.0.0.1 ads.fastclick.net
127.0.0.1 ar.atwola.com
127.0.0.1 atdmt.com
127.0.0.1 avp.ch
127.0.0.1 avp.com
127.0.0.1 avp.ru
127.0.0.1 awaps.net
127.0.0.1 banner.fastclick.net
127.0.0.1 banners.fastclick.net
127.0.0.1 ca.com
127.0.0.1 click.atdmt.com
127.0.0.1 clicks.atdmt.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 download.microsoft.com
127.0.0.1 downloads.microsoft.com
127.0.0.1 engine.awaps.net
127.0.0.1 fastclick.net
127.0.0.1 f-secure.com
127.0.0.1 ftp.f-secure.com
127.0.0.1 ftp.sophos.com
127.0.0.1 go.microsoft.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 mast.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 media.fastclick.net
127.0.0.1 msdn.microsoft.com
127.0.0.1 my-etrust.com
127.0.0.1 nai.com
127.0.0.1 networkassociates.com
127.0.0.1 office.microsoft.com
127.0.0.1 phx.corporate-ir.net
127.0.0.1 secure.nai.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 service1.symantec.com
127.0.0.1 sophos.com
127.0.0.1 spd.atdmt.com
127.0.0.1 support.microsoft.com
127.0.0.1 symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 vil.nai.com
127.0.0.1 viruslist.ru
127.0.0.1 windowsupdate.microsoft.com
127.0.0.1 www.avp.ch
127.0.0.1 www.avp.com
127.0.0.1 www.avp.ru
127.0.0.1 www.awaps.net
127.0.0.1 www.ca.com
127.0.0.1 www.fastclick.net
127.0.0.1 www.f-secure.com
127.0.0.1 www.kaspersky.ru
127.0.0.1 www.mcafee.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.nai.com
127.0.0.1 www.networkassociates.com
127.0.0.1 www.sophos.com
127.0.0.1 www.symantec.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.viruslist.ru
127.0.0.1 ftp://ftp.kasperskylab.ru/updates/
127.0.0.1 ftp://ftp.avp.ch/updates/
127.0.0.1 http://www.kaspersky.ru/updates/
127.0.0.1 http://updates1.kaspersky-labs.com/updates/
127.0.0.1 http://updates3.kaspersky-labs.com/updates/
127.0.0.1 http://updates4.kaspersky-labs.com/updates/
127.0.0.1 http://updates2.kaspersky-labs.com/updates/
127.0.0.1 http://updates5.kaspersky-labs.com/updates/
127.0.0.1 http://downloads1.kaspersky-labs.com/updates/
127.0.0.1 http://www.kaspersky-labs.com/updates/
127.0.0.1 ftp://updates3.kaspersky-labs.com/updates/
127.0.0.1 ftp://downloads1.kaspersky-labs.com/updates/
127.0.0.1 www3.ca.com
127.0.0.1 ids.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 download.mcafee.com
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
7、嘗試從以下網站下載後門
http://www.***nit.ru/zo2.jpg
http://www.***honyflanagan.com/zo2.jpg
http://www.***roved1stmortgage.com/zo2.jpg
http://www.***ument.h12.ru/zo2.jpg
http://www.***ebek.de/zo2.jpg
http://www.***ek.org/zo2.jpg
http://www.***anfestival.nl/zo2.jpg
http://www.***ergut.at/zo2.jpg
http://www.***ation-center.de/zo2.jpg
http://www.***h.org/zo2.jpg
http://www.***ino.com/zo2.jpg
http://www.***tbuy.de/zo2.jpg
http://www.***a.mtw.ru/zo2.jpg
http://www.***-gsm.ru/zo2.jpg
http://www.***ssino.com/zo2.jpg
http://www.***eeyeinc.com/zo2.jpg
http://www.***aklight.be/zo2.jpg
http://www.***esko.net.pl/zo2.jpg
http://www.***system.com.kg/zo2.jpg
http://www.***partner.com.pl/zo2.jpg
http://www.***kyhosting.cz/zo2.jpg
http://www.***nneland.com/zo2.jpg
http://www.***psolutionstore.com/zo2.jpg
http://www.***cept.kg/zo2.jpg
http://www.***psite.com/zo2.jpg
http://www.***poncapital.net/zo2.jpg
http://www.***rkSydebaby.com/zo2.jpg
http://www.***ut-westerhoven.nl/zo2.jpg
http://www.***.kg/zo2.jpg
http://www.***rollendedisco.de/zo2.jpg
http://www.***cobaradventure.be/zo2.jpg
http://www.***fo.com/zo2.jpg
http://www.***ower.com.cn/zo2.jpg
http://www.***bank.kg/zo2.jpg
http://www.***nalazar.com/zo2.jpg
http://www.***cbiz.com/zo2.jpg
http://www.***opa.kg/zo2.jpg
http://www.***rett.wednet.edu/zo2.jpg
http://www.***ernet.hu/zo2.jpg
http://www.***ester.kg/zo2.jpg
http://www.***ocliparts.de/zo2.jpg
http://www.***onw.org/zo2.jpg
http://www.***esites.com.br/zo2.jpg
http://www.***bunker.de/zo2.jpg
http://www.***world.tv/zo2.jpg
[email protected]/zo2.jpg>http://www.***[email protected]/zo2.jpg
http://www.***-bln.de/zo2.jpg
http://www.***et.ru/zo2.jpg
http://www.***ntrevenue.com/zo2.jpg
http://www.***psi.org/zo2.jpg
http://www.***vr.com/zo2.jpg
http://www.***gmart.net/zo2.jpg
http://www.***-group.net/zo2.jpg
http://www.***usionoflife.net/zo2.jpg
http://www.***ocuspromo.com/zo2.jpg
http://www.***naswelt.de/zo2.jpg
http://www.***senboiler.com/zo2.jpg
http://www.***net.pl/zo2.jpg
http://www.***ibeiro.com/zo2.jpg
http://www.***elleryamberproducts.com/zo2.jpg
http://www.***vann.com/zo2.jpg
http://www.***r.ca/zo2.jpg
http://www.***danramey.net/zo2.jpg
http://www.***-musik-sound.de/zo2.jpg
http://www.***trepublicans.com/zo2.jpg
http://www.***el.kg/zo2.jpg
http://www.***cks.nl/zo2.jpg
http://www.***bers.pl/zo2.jpg
http://www.***aionon.com/zo2.jpg
http://www.***us.kg/zo2.jpg
http://www.***dtraining.de/zo2.jpg
http://www.***nenberg.de/zo2.jpg
http://www.***nenberg.de:113547@/zo2.jpg
http://www.***rus.com.pl/zo2.jpg
http://www.***online.de/zo2.jpg
http://www.***elaino.com/zo2.jpg
http://www.***form.com.au/zo2.jpg
http://www.***texgroup.com/zo2.jpg
http://www.***hrak.de/zo2.jpg
http://www.***hrak.de:prophets@/zo2.jpg
http://www.***oseiten.de/zo2.jpg
http://www.***icbottle.com.tw/zo2.jpg
http://www.***server.cz/zo2.jpg
http://www.***a-spass.com/zo2.jpg
http://www.***a.kg/zo2.jpg
http://www.***bisu.de/zo2.jpg
http://www.***mh.de/zo2.jpg
http://www.***design.com/zo2.jpg
http://www.***ansit.kg/zo2.jpg
http://www.***tech.kg/zo2.jpg
http://www.***onfotoshare.com/zo2.jpg
http://www.***osti.kg/zo2.jpg
http://www.***kg/zo2.jpg
http://www.***positiveplace.org/zo2.jpg
http://www.***ine.kg/zo2.jpg
http://www.***ngesuburban.5u.com/zo2.jpg
http://www.***.ch/zo2.jpg
http://www.***eantpage.com/zo2.jpg
http://www.***kration.com/zo2.jpg
http://www.***a-agility.com/zo2.jpg
http://www.***racing.net/zo2.jpg
http://www.***dfinder-leobersdorf.com/zo2.jpg
http://www.***ni.cz/zo2.jpg
http://www.***stk.edu.pl/zo2.jpg
http://www.***izeimotorrad.de/zo2.jpg
http://www.***way-consulting.com/zo2.jpg
http://www.***etsoundyc.org/zo2.jpg
http://www.***landia-boogie.pl/zo2.jpg
http://www.***oto.co.za/zo2.jpg
http://www.***coinc.com/zo2.jpg
http://www.***lgps.com/zo2.jpg
http://www.***lty.kg/zo2.jpg
http://www.***lightpictures.com/zo2.jpg
http://www.***iance-yachts.com/zo2.jpg
http://www.***ocationflorida.com/zo2.jpg
http://www.***talstation.com/zo2.jpg
http://www.***raquadros.com.br/zo2.jpg
http://www.***ming.kg/zo2.jpg
http://www.***ohalle.be/zo2.jpg
http://www.***nex-medical.fi/zo2.jpg
http://www.***ping4success.com/zo2.jpg
http://www.***t.ru/zo2.jpg
http://www.***i.lu/zo2.jpg
http://www.***dochron.pl/zo2.jpg
http://www.***.kg/zo2.jpg
http://www.***ifc.ca/zo2.jpg
http://www.***dtmeyers.de/zo2.jpg
http://www.***dtmeyers.de:R2D2c3po@/zo2.jpg
http://www.***rlingirb.com/zo2.jpg
http://www.***assetholdings.com/zo2.jpg
http://www.***ntomierz.art.pl/zo2.jpg
http://www.***sa.pl/zo2.jpg
http://www.***bourenvereine.ch/zo2.jpg
http://www.***now.opoka.org.pl/zo2.jpg
http://www.***muraene.com/zo2.jpg
http://www.***muraene.com:hunter@/zo2.jpg
http://www.***royalregistry.com/zo2.jpg
http://www.***nsportation.gov.bh/zo2.jpg
http://www.***ar.kg/zo2.jpg
http://www.***guska.hu/zo2.jpg
http://www.***keyhomes.com/zo2.jpg
http://www.***keyhomes.com@/zo2.jpg
http://www.***iano.org/zo2.jpg
http://www.***city.pl/zo2.jpg
http://www.***.info/zo2.jpg
http://www.***ezcourtesymanagement.com/zo2.jpg
http://www.***rix.com/zo2.jpg
http://www.***park.pl/zo2.jpg
http://www.***ompete.com/zo2.jpg
http://www.***pl/zo2.jpg
http://www.***ebad.com/zo2.jpg
http://www.***ger321.wz.cz/zo2.jpg
http://www.***diamonds.com/zo2.jpg
http://www.***der-yachting.com/zo2.jpg