概述
病毒別名：I-Worm.saros.a【AVP】
處理時間：
威脅級別：★★
中文名稱：薩露絲
病毒類型：蠕蟲
影響系統：Win9x/WinNT/Win2K/WinXP/Win2003
病毒行為:
編寫工具:
傳染條件:
Email
發作條件:
系統修改:
1.複製自身到以下檔案:
WINDOWSsystem32NonYou.exe
WINDOWSsystem32Love-ScreenSaver.scr
WINDOWSsystem32MSOutlookInternetUpdate.exe
progra~1KazaaMy Shared FolderRosy.exe
progra~1KazaaMy Shared FolderPipponoto.exe
progra~1KazaaMy Shared FolderAnastacia - Left Outside Alone.mp3.exe
progra~1KazaaMy Shared FolderThe Rasmus - In The Shadows.mp3.exe
progra~1KazaaMy Shared Folder50 Cent - In da Club.mp3.exe
progra~1KazaaMy Shared FolderVanessa Carltron - Ordinary Day.mp3.exe
progra~1KazaaMy Shared FolderHaiducii - Dragostea Din Tei.mp3.exe
progra~1KazaaMy Shared FolderBlack Eyed Peas - Hey Mama.mp3.exe
progra~1KazaaMy Shared FolderRaf - In tutti i miei giorni.mp3.exe
progra~1KazaaMy Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe
progra~1KazaaMy Shared FolderLionel Richie - Just For You.mp3.exe
progra~1Kazaa LiteMy Shared FolderRosy.exe
progra~1Kazaa LiteMy Shared FolderPipponoto.exe
progra~1Kazaa LiteMy Shared FolderAnastacia - Left Outside Alone.mp3.exe
progra~1Kazaa LiteMy Shared FolderThe Rasmus - In The Shadows.mp3.exe
progra~1Kazaa LiteMy Shared Folder50 Cent - In da Club.mp3.exe
progra~1Kazaa LiteMy Shared FolderVanessa Carltron - Ordinary Day.mp3.exe
progra~1Kazaa LiteMy Shared FolderHaiducii - Dragostea Din Tei.mp3.exe
progra~1Kazaa LiteMy Shared FolderBlack Eyed Peas - Hey Mama.mp3.exe
progra~1Kazaa LiteMy Shared FolderRaf - In tutti i miei giorni.mp3.exe
progra~1Kazaa LiteMy Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe
progra~1Kazaa LiteMy Shared FolderLionel Richie - Just For You.mp3.exe
progra~1Kazaa Lite K++My Shared FolderRosy.exe
progra~1Kazaa Lite K++My Shared FolderPipponoto.exe
progra~1Kazaa Lite K++My Shared FolderAnastacia - Left Outside Alone.mp3.exe
progra~1Kazaa Lite K++My Shared FolderThe Rasmus - In The Shadows.mp3.exe
progra~1Kazaa Lite K++My Shared Folder50 Cent - In da Club.mp3.exe
progra~1Kazaa Lite K++My Shared FolderVanessa Carltron - Ordinary Day.mp3.exe
progra~1Kazaa Lite K++My Shared FolderHaiducii - Dragostea Din Tei.mp3.exe
progra~1Kazaa Lite K++My Shared FolderHaiducii - Dragostea din tei.mp3.exe
progra~1Kazaa Lite K++My Shared FolderRaf - In tutti i miei giorni.mp3.exe
progra~1Kazaa Lite K++My Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe
progra~1Kazaa Lite K++My Shared FolderLionel Richie - Just For You.mp3.exe
progra~1ICQShared FolderRosy.exe
progra~1ICQShared FolderPipponoto.exe
progra~1ICQShared FolderAnastacia - Left Outside Alone.mp3.exe
progra~1ICQShared FolderThe Rasmus - In The Shadows.mp3.exe
progra~1ICQShared Folder50 Cent - In da Club.mp3.exe
progra~1ICQShared FolderVanessa Carltron - Ordinary Day.mp3.exe
progra~1ICQShared FolderHaiducii - Dragostea Din Tei.mp3.exe
progra~1ICQShared FolderBlack Eyed Peas - Hey Mama.mp3.exe
progra~1ICQShared FolderRaf - In tutti i miei giorni.mp3.exe
progra~1ICQShared FolderVasco Rossi - Buoni e cattivi.mp3.exe
progra~1ICQShared FolderLionel Richie - Just For You.mp3.exe
progra~1GroksterMy GroksterRosy.exe
progra~1GroksterMy GroksterPipponoto.exe
progra~1GroksterMy GroksterAnastacia - Left Outside Alone.mp3.exe
progra~1GroksterMy GroksterThe Rasmus - In The Shadows.mp3.exe
progra~1GroksterMy Grokster50 Cent - In da Club.mp3.exe
progra~1GroksterMy GroksterVanessa Carltron - Ordinary Day.mp3.exe
progra~1GroksterMy GroksterHaiducii - Dragostea Din Tei.mp3.exe
progra~1GroksterMy GroksterBlack Eyed Peas - Hey Mama.mp3.exe
progra~1GroksterMy GroksterRaf - In tutti i miei giorni.mp3.exe
progra~1GroksterMy GroksterVasco Rossi - Buoni e cattivi.mp3.exe
progra~1GroksterMy GroksterLionel Richie - Just For You.mp3.exe
progra~1BearshareSharedRosy.exe
progra~1BearshareSharedPipponoto.exe
progra~1BearshareSharedAnastacia - Left Outside Alone.mp3.exe
progra~1BearshareSharedThe Rasmus - In The Shadows.mp3.exe
progra~1BearshareShared50 Cent - In da Club.mp3.exe
progra~1BearshareSharedVanessa Carltron - Ordinary Day.mp3.exe
progra~1BearshareSharedHaiducii - Dragostea Din Tei.mp3.exe
progra~1BearshareSharedBlack Eyed Peas - Hey Mama.mp3.exe
progra~1BearshareSharedRaf - In tutti i miei giorni.mp3.exe
progra~1BearshareSharedVasco Rossi - Buoni e cattivi.mp3.exe
progra~1BearshareSharedLionel Richie - Just For You.mp3.exe
progra~1eDonkey2000IncomingRosy.exe
progra~1eDonkey2000IncomingPipponoto.exe
progra~1eDonkey2000IncomingAnastacia - Left Outside Alone.mp3.exe
progra~1eDonkey2000IncomingThe Rasmus - In The Shadows.mp3.exe
progra~1eDonkey2000Incoming50 Cent - In da Club.mp3.exe
progra~1eDonkey2000IncomingVanessa Carltron - Ordinary Day.mp3.exe
progra~1eDonkey2000IncomingHaiducii - Dragostea Din Tei.mp3.exe
progra~1eDonkey2000IncomingBlack Eyed Peas - Hey Mama.mp3.exe
progra~1eDonkey2000IncomingRaf - In tutti i miei giorni.mp3.exe
progra~1eDonkey2000IncomingVasco Rossi - Buoni e cattivi.mp3.exe
progra~1eDonkey2000IncomingLionel Richie - Just For You.mp3.exe
progra~1eMuleIncomingRosy.exe
progra~1eMuleIncomingPipponoto.exe
progra~1eMuleIncomingAnastacia - Left Outside Alone.mp3.exe
progra~1eMuleIncomingThe Rasmus - In The Shadows.mp3.exe
progra~1eMuleIncoming50 Cent - In da Club.mp3.exe
progra~1eMuleIncomingVanessa Carltron - Ordinary Day.mp3.exe
progra~1eMuleIncomingHaiducii - Dragostea Din Tei.mp3.exe
progra~1eMuleIncomingBlack Eyed Peas - Hey Mama.mp3.exe
progra~1eMuleIncomingRaf - In tutti i miei giorni.mp3.exe
progra~1eMuleIncomingVasco Rossi - Buoni e cattivi.mp3.exe
progra~1eMuleIncomingLionel Richie - Just For You.mp3.exe
progra~1MorpheusMy Shared FolderRosy.exe
progra~1MorpheusMy Shared FolderPipponoto.exe
progra~1MorpheusMy Shared FolderAnastacia - Left Outside Alone.mp3.exe
progra~1MorpheusMy Shared FolderThe Rasmus - In The Shadows.mp3.exe
progra~1MorpheusMy Shared Folder50 Cent - In da Club.mp3.exe
progra~1MorpheusMy Shared FolderVanessa Carltron - Ordinary Day.mp3.exe
progra~1MorpheusMy Shared FolderHaiducii - Dragostea Din Tei.mp3.exe
progra~1MorpheusMy Shared FolderBlack Eyed Peas - Hey Mama.mp3.exe
progra~1MorpheusMy Shared FolderRaf - In tutti i miei giorni.mp3.exe
progra~1MorpheusMy Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe
progra~1MorpheusMy Shared FolderLionel Richie - Just For You.mp3.exe
progra~1LimeWireSharedRosy.exe
progra~1LimeWireSharedPipponoto.exe
progra~1LimeWireSharedAnastacia - Left Outside Alone.mp3.exe
progra~1LimeWireSharedThe Rasmus - In The Shadows.mp3.exe
progra~1LimeWireShared50 Cent - In da Club.mp3.exe
progra~1LimeWireSharedVanessa Carltron - Ordinary Day.mp3.exe
progra~1LimeWireSharedHaiducii - Dragostea Din Tei.mp3.exe
progra~1LimeWireSharedBlack Eyed Peas - Hey Mama.mp3.exe
progra~1LimeWireSharedRaf - In tutti i miei giorni.mp3.exe
progra~1LimeWireSharedVasco Rossi - Buoni e cattivi.mp3.exe
progra~1LimeWireSharedLionel Richie - Just For You.mp3.exe
progra~1TeslaFilesRosy.exe
progra~1TeslaFilesPipponoto.exe
progra~1TeslaFilesAnastacia - Left Outside Alone.mp3.exe
progra~1TeslaFilesThe Rasmus - In The Shadows.mp3.exe
progra~1TeslaFiles50 Cent - In da Club.mp3.exe
progra~1TeslaFilesVanessa Carltron - Ordinary Day.mp3.exe
progra~1TeslaFilesHaiducii - Dragostea Din Tei.mp3.exe
progra~1TeslaFilesBlack Eyed Peas - Hey Mama.mp3.exe
progra~1TeslaFilesRaf - In tutti i miei giorni.mp3.exe
progra~1TeslaFilesVasco Rossi - Buoni e cattivi.mp3.exe
progra~1TeslaFilesLionel Richie - Just For You.mp3.exe
progra~1WinMXSharedRosy.exe
progra~1WinMXSharedPipponoto.exe
progra~1WinMXSharedAnastacia - Left Outside Alone.mp3.exe
progra~1WinMXSharedThe Rasmus - In The Shadows.mp3.exe
progra~1WinMXShared50 Cent - In da Club.mp3.exe
progra~1WinMXSharedVanessa Carltron - Ordinary Day.mp3.exe
progra~1WinMXSharedHaiducii - Dragostea Din Tei.mp3.exe
progra~1WinMXSharedBlack Eyed Peas - Hey Mama.mp3.exe
progra~1WinMXSharedRaf - In tutti i miei giorni.mp3.exe
progra~1WinMXSharedVasco Rossi - Buoni e cattivi.mp3.exe
progra~1WinMXSharedLionel Richie - Just For You.mp3.exe
2..建立WINDOWSsystem32About.hta檔案
3..顯示訊息
標題: Microsoft Windows Update
內容: Click Yes For Update Microsoft Outlook via E-mail
4.建立WINDOWSsystem32
stdnrdll32.vbs檔案
該VBS檔案作如下工作:
a.在註冊表主鍵"HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
ldr32"下，
添加如下鍵值："default"="WINDOWSsystem32NonYou.exe"
b.在註冊表主鍵"HKEY_CURRENT_USERSoftwareMicrosoftOffice8.0OutlookSecurity"下，
添加如下鍵值："Level1Remove"="exe"
c.在註冊表主鍵"HKEY_CURRENT_USERSoftwareMicrosoftOffice9.0OutlookSecurity"下，
添加如下鍵值："Level1Remove"="exe"
d.在註冊表主鍵"HKEY_CURRENT_USERSoftwareMicrosoftOffice10.0OutlookSecurity"下，
添加如下鍵值："Level1Remove"="exe"
e.在註冊表主鍵"HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunoncewincomp32"下，
添加如下鍵值："default"="WINDOWSsystem32
stdnrdll32.vbs"
f.建立檔案WINDOWSsystem32Love-ScreenSaver.cab,它包含蠕蟲本身
g.如果當前日期是11號或23號,則把IE的默認頁改為:www.gedzac.tk
並用瀏覽器打開WINDOWSsystem32About.hta
h.根據outlook地址簿Email地址傳送帶毒郵件
該郵件主題為:Microsoft Outlook News
內容:Microsoft Outlook Update / Bug Fixed - Contact: [email protected]附屬檔案:MSOutlookInternetUpdate.exe(該附屬檔案為病毒本身)
i.打開 www.windowsupdate.com
5.在Program FilesmIRCmirc.ini檔案中的rfiles節中增加
n2 = tdll32.dll
6.通過mIrc傳送Love-ScreenSaver.cab(病毒)給其它mIrc用戶
發作現象:
檢查當前日期是否為11號或23號
如果是則顯示如下兩條訊息:
標題: NonYou
內容: Rosy Ti Amo - Saro & Rosy Forever
標題: Gedzac Group 2004
內容:
NonYou.a Gedzac Labs Productions
Coded by Sarosoft - Dedicated to my Love Ros
Gedzac Group 2004 - http://www.gedzac.tk
Gedzac
The Virus Crew
特別說明:
