Need help? Ask the community or hire an expert.
Go to Avira Answers
病毒:Worm/Mytob.LI
发现日期:13/12/2012
类型:蠕虫
广泛传播:
病毒传播个案呈报:低程度
感染/传播能力:中等程度
破坏 / 损害程度:中等程度
静态文件:
文件大小:39.401 字节
MD5 校检和:3F81514863E12ADDF9AE248DCDA65FCB
VDF 版本:7.11.53.216 - 13 Aralık 2012 Perşembe
IVDF 版本:7.11.53.216 - 13 Aralık 2012 Perşembe

 况概描述 传播方法:
   • 电子邮件


别名:
   •  Kaspersky: Net-Worm.Win32.Mytob.bm
   •  TrendMicro: WORM_MYTOB.LO
   •  Sophos: W32/Mytob-FI
   •  Grisoft: I-Worm/Mytob.ACR
   •  VirusBuster: iworm I-Worm.Mytob.NR
   •  Eset: Win32/Mytob.MG
   •  Bitdefender: Win32.Worm.Mytob.BN


平台/操作系统:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


副作用:
   • 阻止对安全网站的访问
   • 关闭安全应用程序
   • 使用自置的电子邮件引擎
   • 降低系统安全设置
   • 注册表修改
   • 窃取信息
   • 第三方控件

 文件 它将本身复制到以下位置:
   • %SYSDIR%\expI0rer.exe

 注册表 会在无限循环中连续添加以下注册表项,以便在重新引导之后运行进程。

–  [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   • "WINDOWS SYSTEM"="expI0rer.exe"

–  [HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices]
   • "WINDOWS SYSTEM"="expI0rer.exe"

 电子邮件 它包含集成的 SMTP 引擎,用于发送电子邮件。 将与目标服务器建立直接连接。 下面说明了它的特征:


发件人:
发件地址是仿冒的。


收件人:
– 在系统上的特定文件中找到的电子邮件地址。
– 从 WAB (Windows 通讯簿) 搜集到的电子邮件地址
– 程序生成的地址


主题:
以下某项内容:
   • *DETECTED* Online User Violation
   • Email Account Suspension
   • IMPORTANT NOTIFICATION
   • Members Support
   • Notice of account limitation
   • SECURITY MEASURES
   • Warning Message: Your services near to be closed.
   • You have successfully updated your password
   • Your Account is Suspended
   • Your Account is Suspended For Security Reasons
   • Your new account password is approved
   • Your password has been successfully updated
   • Your password has been updated

主题可能包含随机字母。


正文:
– 包含 HTML 代码。

 
电子邮件的正文如下所示:

   •
     
     Dear user %电子邮件帐户的用户名%,
     You have successfully updated the password of your %来自电子邮件地址的收件人域名% account.
     If you did not authorize this change or if you need assistance with your account, please contact %来自电子邮件地址的收件人域名% customer service at: %发件人的电子邮件地址%
     Thank you for using %来自电子邮件地址的收件人域名%!
     The %来自电子邮件地址的收件人域名% Support Team
     
     +++ Attachment: No Virus (Clean)
     +++ %来自电子邮件地址的收件人域名% Antivirus - www.%来自电子邮件地址的发件人域名%
     

     

   •
     
     Dear %来自电子邮件地址的收件人域名% Member,
     We have temporarily suspended your email account %收件人的电子邮件地址%.
     This might be due to either of the following reasons:
     1. A recent change in your personal information (i.e. change of address).
     2. Submiting invalid information during the initial sign up process.
     3. An innability to accurately verify your selected option of subscription due to an internal error within our processors.
     See the details to reactivate your %来自电子邮件地址的收件人域名% account.
     Sincerely,The %来自电子邮件地址的收件人域名% Support Team
     
     +++ Attachment: No Virus (Clean)
     +++ %s Antivirus - www.%来自电子邮件地址的收件人域名%
     

     

   •
     
     Dear user %电子邮件帐户的用户名%,
     It has come to our attention that your %来自电子邮件地址的收件人域名% User Profile ( x ) records are out of date. For further details see the attached document.
     Thank you for using %来自电子邮件地址的收件人域名%!
     The %来自电子邮件地址的收件人域名% Support Team
     
     +++ Attachment: No Virus (Clean)
     +++ %s Antivirus - www.%来自电子邮件地址的发件人域名%
     

     

   •
     
     Dear %来自电子邮件地址的收件人域名% Member,
     Your e-mail account was used to send a huge amount of unsolicited spam messages during the recent week. If you could please take 5-10 minutes out of your online experience and confirm the attached document so you will not run into any future problems with the online service.
     If you choose to ignore our request, you leave us no choice but to cancel your membership.
     Virtually yours,
     The %来自电子邮件地址的收件人域名% Support Team
     
     +++ Attachment: No Virus found
     +++ %s Antivirus - www.%来自电子邮件地址的收件人域名%
     

     


附件:
附件的文件名包含以下内容:

   • accepted-password
   • account-details
   • account-info
   • account-password
   • account-report
   • approved-password
   • document
   • email-details
   • email-password
   • important-details
   • new-password
   • readme
   • updated-password
   • %随机字符串%

    使用以下其中项文件扩展名 :
   • zip

该附件是恶意软件本身的副本。


 邮件 搜索地址:
它会在以下文件中搜索电子邮件地址:
   • txt; htm; sht; jsp; cgi; xml; php; asp; dbx; tbb; adb; html; wab


为 TO (“收件人”) 字段生成地址:
为了生成地址,它会使用以下字符串:
   • adam; alex; andrew; anna; bill; bob; bob; brenda; brent; brian;
      claudia; dan; dave; david; debby; frank; fred; george; helen; jack;
      james; jane; jerry; jim; jimmy; joe; john; jose; josh; julie; kevin;
      leo; linda; maria; mary; matt; michael; michael; mike; paul; peter;
      ray; robert; sales; sam; sandra; serg; smith; stan; steve; ted; tom

它会将结果与文件 (之前在该文件中搜索过地址) 中找到的域组合在一起。


为 FROM (“发件人”) 字段生成地址:
为了生成地址,它会使用以下字符串:
   • support
   • administrator
   • mail
   • service
   • admin
   • info
   • register
   • webmaster

它会将结果与文件 (之前在该文件中搜索过地址) 中找到的域组合在一起。


避免地址:
它不会向包含以下某个字符串的地址发送电子邮件:
   • -._!; -._!@; .edu; .gov; .mil; Aberkeley; abuse; accoun; acketst;
      admin; anyone; arin.; Aroot; avp; be_loyal:"; borlan; bsd; bsd; bugs;
      certific; contact; example; fcnz; feste; fido; foo.; fsf.; gnu;
      gold-certs; google; google; gov.; help; hotmail; iana; ibm.com;
      icrosof; icrosoft; ietf; info; inpris; isc.o; isi.e; kernel; linux;
      linux; listserv; math; mit.e; mozilla; msn.; mydomai; nobody; nodomai;
      noone; not; nothing; ntivi; page; panda; pgp; postmaster; privacy;
      rating; rfc-ed; ripe.; ruslis; samples; secur; secur; sendmail;
      service; site; soft; somebody; someone; sopho; spm; submit; support;
      syma; tanford.e; the.bat; unix; unix; usenet; utgers.ed; webmaster;
      www; you; your


前面追加 MX 字符串:
为了获取电子邮件服务器的 IP 地址,它能够在域名前追加以下字符串:
   • mx.
   • mail.
   • smtp.
   • mx1.
   • mxs.
   • mail1.
   • relay.
   • ns.
   • gate.

 IRC 为了提供系统信息和远程控制,它会连接到以下 IRC 服务器:

服务器: pi87.**********
端口: 5190
通道: #friendzzz
昵称: SHIM-%随机字符串%
密码: biggie



– 此恶意软件能够搜集并发送类似如下信息:
    • CPU 速度
    • 当前用户
    • 可用磁盘空间
    • 可用内存
    • 有关网络的信息
    • 内存大小
    • 用户名
    • Windows 操作系统信息


– 而且,它能够进行此般操作:
    • 下载文件
    • 执行文件
    • 加入 IRC 通道
    • 离开 IRC 通道
    • 发送电子邮件
    • 终止恶意软件
    • 自行更新

 主机 会按如下所述对主机文件进行修改:

– 这种情况下,不会修改已存在的项目。

– 阻挡以下域名的访问:
   • www.symantec.com
   • securityresponse.symantec.com
   • symantec.com
   • www.sophos.com
   • sophos.com
   • www.mcafee.com
   • mcafee.com
   • liveupdate.symantecliveupdate.com
   • www.viruslist.com
   • viruslist.com
   • viruslist.com
   • f-secure.com
   • www.f-secure.com
   • kaspersky.com
   • kaspersky-labs.com
   • www.avp.com
   • www.kaspersky.com
   • avp.com
   • www.networkassociates.com
   • networkassociates.com
   • www.ca.com
   • ca.com
   • mast.mcafee.com
   • my-etrust.com
   • www.my-etrust.com
   • download.mcafee.com
   • dispatch.mcafee.com
   • secure.nai.com
   • nai.com
   • www.nai.com
   • update.symantec.com
   • updates.symantec.com
   • us.mcafee.com
   • liveupdate.symantec.com
   • customer.symantec.com
   • rads.mcafee.com
   • trendmicro.com
   • pandasoftware.com
   • www.pandasoftware.com
   • www.trendmicro.com
   • www.grisoft.com
   • www.microsoft.com
   • microsoft.com
   • www.virustotal.com
   • virustotal.com
   • www.amazon.com
   • www.amazon.co.uk
   • www.amazon.ca
   • www.amazon.fr
   • www.paypal.com
   • paypal.com
   • moneybookers.com
   • www.moneybookers.com
   • www.ebay.com
   • ebay.com


 进程终止 被终止进程列表:
   • _AVP32.EXE; _AVPCC.EXE; _AVPM.EXE; ACKWIN32.EXE; ADAWARE.EXE;
      ADVXDWIN.EXE; AGENTSVR.EXE; AGENTW.EXE; ALERTSVC.EXE; ALEVIR.EXE;
      ALOGSERV.EXE; AMON9X.EXE; ANTI-TROJAN.EXE; ANTIVIRUS.EXE; ANTS.EXE;
      APIMONITOR.EXE; APLICA32.EXE; APVXDWIN.EXE; ARR.EXE; ATCON.EXE;
      ATGUARD.EXE; ATRO55EN.EXE; ATUPDATER.EXE; ATUPDATER.EXE; ATWATCH.EXE;
      AU.EXE; AUPDATE.EXE; AUPDATE.EXE; AUTODOWN.EXE; AUTODOWN.EXE;
      AUTO-PROTECT.NAV80TRY.EXE; AUTOTRACE.EXE; AUTOTRACE.EXE;
      AUTOUPDATE.EXE; AUTOUPDATE.EXE; AVCONSOL.EXE; AVE32.EXE; AVGCC32.EXE;
      AVGCTRL.EXE; AVGNT.EXE; AVGSERV.EXE; AVGSERV9.EXE; AVGUARD.EXE;
      AVGW.EXE; AVKPOP.EXE; AVKSERV.EXE; AVKSERVICE.EXE; AVKWCTl9.EXE;
      AVLTMAIN.EXE; AVNT.EXE; AVP.EXE; AVP32.EXE; AVPCC.EXE; AVPDOS32.EXE;
      AVPM.EXE; AVPTC32.EXE; AVPUPD.EXE; AVPUPD.EXE; AVSCHED32.EXE;
      AVSYNMGR.EXE; AVWINNT.EXE; AVWUPD.EXE; AVWUPD32.EXE; AVWUPD32.EXE;
      AVWUPSRV.EXE; AVXMONITOR9X.EXE; AVXMONITORNT.EXE; AVXQUAR.EXE;
      AVXQUAR.EXE; BACKWEB.EXE; BARGAINS.EXE; BD_PROFESSIONAL.EXE;
      BEAGLE.EXE; BELT.EXE; BIDEF.EXE; BIDSERVER.EXE; BIPCP.EXE;
      BIPCPEVALSETUP.EXE; BISP.EXE; BLACKD.EXE; BLACKICE.EXE; BLSS.EXE;
      BOOTCONF.EXE; BOOTWARN.EXE; BORG2.EXE; BPC.EXE; BRASIL.EXE; BS120.EXE;
      BUNDLE.EXE; BVT.EXE; CCAPP.EXE; CCEVTMGR.EXE; CCPXYSVC.EXE; CDP.EXE;
      CFD.EXE; CFGWIZ.EXE; CFIADMIN.EXE; CFIAUDIT.EXE; CFIAUDIT.EXE;
      CFINET.EXE; CFINET32.EXE; CLAW95CF.EXE; CLEAN.EXE; CLEANER.EXE;
      CLEANER3.EXE; CLEANPC.EXE; CLICK.EXE; CMD.EXE; CMD32.EXE; CMESYS.EXE;
      CMGRDIAN.EXE; CMON016.EXE; CONNECTIONMONITOR.EXE; CPD.EXE;
      CPF9X206.EXE; CPFNT206.EXE; CTRL.EXE; CV.EXE; CWNB181.EXE;
      CWNTDWMO.EXE; DATEMANAGER.EXE; DCOMX.EXE; DEFALERT.EXE;
      DEFSCANGUI.EXE; DEFWATCH.EXE; DEPUTY.EXE; DIVX.EXE; DLLCACHE.EXE;
      DLLREG.EXE; DOORS.EXE; DPF.EXE; DPFSETUP.EXE; DPPS2.EXE; DRWATSON.EXE;
      DRWEB32.EXE; DRWEBUPW.EXE; DSSAGENT.EXE; DVP95.EXE; DVP95_0.EXE;
      ECENGINE.EXE; EFPEADM.EXE; EMSW.EXE; ENT.EXE; ESAFE.EXE; ESCANHNT.EXE;
      ESCANV95.EXE; ESPWATCH.EXE; ETHEREAL.EXE; ETRUSTCIPE.EXE; EVPN.EXE;
      EXANTIVIRUS-CNET.EXE; EXE.AVXW.EXE; EXPERT.EXE; EXPLORE.EXE;
      FAMEH32.EXE; FAST.EXE; FCH32.EXE; FIH32.EXE; FINDVIRU.EXE;
      FIREWALL.EXE; FNRB32.EXE; FPROT.EXE; F-PROT.EXE; F-PROT95.EXE;
      FP-WIN.EXE; FP-WIN_TRIAL.EXE; FRW.EXE; FSAA.EXE; FSAV.EXE; FSAV32.EXE;
      FSAV530STBYB.EXE; FSAV530WTBYB.EXE; FSAV95.EXE; FSGK32.EXE; FSM32.EXE;
      FSMA32.EXE; FSMB32.EXE; F-STOPW.EXE; GATOR.EXE; GBMENU.EXE;
      GBPOLL.EXE; GENERICS.EXE; GMT.EXE; GUARD.EXE; GUARDDOG.EXE;
      HACKTRACERSETUP.EXE; HBINST.EXE; HBSRV.EXE; HOTACTIO.EXE;
      HOTPATCH.EXE; HTLOG.EXE; HTPATCH.EXE; HWPE.EXE; HXDL.EXE; HXIUL.EXE;
      IAMAPP.EXE; IAMSERV.EXE; IAMSTATS.EXE; IBMASN.EXE; IBMAVSP.EXE;
      ICLOADNT.EXE; ICMON.EXE; ICSUPP95.EXE; ICSUPPNT.EXE; IDLE.EXE;
      IEDLL.EXE; IEDRIVER.EXE; IEXPLORER.EXE; IFACE.EXE; IFW2000.EXE;
      INETLNFO.EXE; INFUS.EXE; INFWIN.EXE; INIT.EXE; INTDEL.EXE; INTREN.EXE;
      IOMON98.EXE; ISTSVC.EXE; JAMMER.EXE; JDBGMRG.EXE; JEDI.EXE;
      KAVLITE40ENG.EXE; KAVPERS40ENG.EXE; KAVPF.EXE; KAZZA.EXE;
      KEENVALUE.EXE; KERIO-PF-213-EN-WIN.EXE; KERIO-WRL-421-EN-WIN.EXE;
      KERIO-WRP-421-EN-WIN.EXE; KERNEL32.EXE; KILLPROCESSSETUP161.EXE;
      LAUNCHER.EXE; LDNETMON.EXE; LDPRO.EXE; LDPROMENU.EXE; LDSCAN.EXE;
      LNETINFO.EXE; LOADER.EXE; LOCALNET.EXE; LOCKDOWN.EXE;
      LOCKDOWN2000.EXE; LOOKOUT.EXE; LORDPE.EXE; LSETUP.EXE; LUALL.EXE;
      LUALL.EXE; LUAU.EXE; LUCOMSERVER.EXE; LUINIT.EXE; LUSPT.EXE;
      MAPISVC32.EXE; MCAGENT.EXE; MCMNHDLR.EXE; MCSHIELD.EXE; MCTOOL.EXE;
      MCUPDATE.EXE; MCUPDATE.EXE; MCVSRTE.EXE; MCVSSHLD.EXE; MD.EXE;
      MFIN32.EXE; MFW2EN.EXE; MFWENG3.02D30.EXE; MGAVRTCL.EXE; MGAVRTE.EXE;
      MGHTML.EXE; MGUI.EXE; MINILOG.EXE; MMOD.EXE; MONITOR.EXE; MOOLIVE.EXE;
      MOSTAT.EXE; MPFAGENT.EXE; MPFSERVICE.EXE; MPFTRAY.EXE; MRFLUX.EXE;
      MSAPP.EXE; MSBB.EXE; MSBLAST.EXE; MSCACHE.EXE; MSCCN32.EXE;
      MSCMAN.EXE; MSCONFIG.EXE; MSDM.EXE; MSDOS.EXE; MSIEXEC16.EXE;
      MSINFO32.EXE; MSLAUGH.EXE; MSMGT.EXE; MSMSGRI32.EXE; MSSMMC32.EXE;
      MSSYS.EXE; MSVXD.EXE; MU0311AD.EXE; MWATCH.EXE; N32SCANW.EXE; NAV.EXE;
      NAVAP.NAVAPSVC.EXE; NAVAPSVC.EXE; NAVAPW32.EXE; NAVDX.EXE;
      NAVLU32.EXE; NAVNT.EXE; NAVSTUB.EXE; NAVW32.EXE; NAVWNT.EXE;
      NC2000.EXE; NCINST4.EXE; NDD32.EXE; NEC.EXE; NEOMONITOR.EXE;
      NEOWATCHLOG.EXE; NETARMOR.EXE; NETD32.EXE; NETINFO.EXE; NETMON.EXE;
      NETSCANPRO.EXE; NETSPYHUNTER-1.2.EXE; NETSTAT.EXE; NETUTILS.EXE;
      NISSERV.EXE; NISUM.EXE; NMAIN.EXE; NOD32.EXE; NORMIST.EXE;
      NORTON_INTERNET_SECU_3.0_407.EXE; NOTSTART.EXE;
      NPF40_TW_98_NT_ME_2K.EXE; NPFMESSENGER.EXE; NPROTECT.EXE;
      NPSCHECK.EXE; NPSSVC.EXE; NSCHED32.EXE; NSSYS32.EXE; NSTASK32.EXE;
      NSUPDATE.EXE; NT.EXE; NTRTSCAN.EXE; NTVDM.EXE; NTXconfig.EXE; NUI.EXE;
      NUPGRADE.EXE; NUPGRADE.EXE; NVARCH16.EXE; NVC95.EXE; NVSVC32.EXE;
      NWINST4.EXE; NWSERVICE.EXE; NWTOOL16.EXE; OLLYDBG.EXE; ONSRVR.EXE;
      OPTIMIZE.EXE; OSTRONET.EXE; OTFIX.EXE; OUTPOST.EXE; OUTPOST.EXE;
      OUTPOSTINSTALL.EXE; OUTPOSTPROINSTALL.EXE; PADMIN.EXE; PANIXK.EXE;
      PATCH.EXE; PAVCL.EXE; PAVPROXY.EXE; PAVSCHED.EXE; PAVW.EXE;
      PCFWALLICON.EXE; PCIP10117_0.EXE; PCSCAN.EXE; PDSETUP.EXE;
      PERISCOPE.EXE; PERSFW.EXE; PERSWF.EXE; PF2.EXE; PFWADMIN.EXE;
      PGMONITR.EXE; PINGSCAN.EXE; PLATIN.EXE; POP3TRAP.EXE; POPROXY.EXE;
      POPSCAN.EXE; PORTDETECTIVE.EXE; PORTMONITOR.EXE; POWERSCAN.EXE;
      PPINUPDT.EXE; PPTBC.EXE; PPVSTOP.EXE; PRIZESURFER.EXE; PRMT.EXE;
      PRMVR.EXE; PROCDUMP.EXE; PROCESSMONITOR.EXE; PROCEXPLORERV1.0.EXE;
      PROGRAMAUDITOR.EXE; PROPORT.EXE; PROTECTX.EXE; PSPF.EXE; PURGE.EXE;
      QCONSOLE.EXE; QSERVER.EXE; RAPAPP.EXE; RAV7.EXE; RAV7WIN.EXE;
      RAV8WIN32ENG.EXE; RAY.EXE; RB32.EXE; RCSYNC.EXE; REALMON.EXE;
      REGED.EXE; REGEDIT.EXE; REGEDT32.EXE; RESCUE.EXE; RESCUE32.EXE;
      RRGUARD.EXE; RSHELL.EXE; RTVSCAN.EXE; RTVSCN95.EXE; RULAUNCH.EXE;
      RUN32DLL.EXE; RUNDLL.EXE; RUNDLL16.EXE; RUXDLL32.EXE; SAFEWEB.EXE;
      SAHAGENT.EXE; SAVE.EXE; SAVENOW.EXE; SBSERV.EXE; SC.EXE; SCAM32.EXE;
      SCAN32.EXE; SCAN95.EXE; SCANPM.EXE; SCRSCAN.EXE;
      SETUP_FLOWPROTECTOR_US.EXE; SETUPVAMEEVAL.EXE; SFC.EXE; SGSSFW32.EXE;
      SH.EXE; SHELLSPYINSTALL.EXE; SHN.EXE; SHOWBEHIND.EXE; SMC.EXE;
      SMS.EXE; SMSS32.EXE; SOAP.EXE; SOFI.EXE; SPERM.EXE; SPF.EXE;
      SPHINX.EXE; SPOLER.EXE; SPOOLCV.EXE; SPOOLSV32.EXE; SPYXX.EXE;
      SREXE.EXE; SRNG.EXE; SS3EDIT.EXE; SSG_4104.EXE; SSGRATE.EXE; ST2.EXE;
      START.EXE; STCLOADER.EXE; SUPFTRL.EXE; SUPPORT.EXE; SUPPORTER5.EXE;
      SVC.EXE; SVCHOSTC.EXE; SVCHOSTS.EXE; SVSHOST.EXE; SWEEP95.EXE;
      SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE; SYMPROXYSVC.EXE; SYMTRAY.EXE;
      SYSEDIT.EXE; SYSTEM.EXE; SYSTEM32.EXE; SYSUPD.EXE; TASKMG.EXE;
      TASKMGR.EXE; TASKMO.EXE; TASKMON.EXE; TAUMON.EXE; TBSCAN.EXE; TC.EXE;
      TCA.EXE; TCM.EXE; TDS2-NT.EXE; TDS-3.EXE; TEEKIDS.EXE; TFAK.EXE;
      TFAK5.EXE; TGBOB.EXE; TITANIN.EXE; TITANINXP.EXE; TRACERT.EXE;
      TRICKLER.EXE; TRJSCAN.EXE; TRJSETUP.EXE; TROJANTRAP3.EXE; TSADBOT.EXE;
      TVMD.EXE; TVTMD.EXE; UNDOBOOT.EXE; UPDAT.EXE; UPDATE.EXE; UPDATE.EXE;
      UPGRAD.EXE; UTPOST.EXE; VBCMSERV.EXE; VBCONS.EXE; VBUST.EXE;
      VBWIN9X.EXE; VBWINNTW.EXE; VCSETUP.EXE; VET32.EXE; VET95.EXE;
      VETTRAY.EXE; VFSETUP.EXE; VIR-HELP.EXE; VIRUSMDPERSONALFIREWALL.EXE;
      VNLAN300.EXE; VNPC3000.EXE; VPC32.EXE; VPC42.EXE; VPFW30S.EXE;
      VPTRAY.EXE; VSCAN40.EXE; VSCENU6.02D30.EXE; VSCHED.EXE; VSECOMR.EXE;
      VSHWIN32.EXE; VSISETUP.EXE; VSMAIN.EXE; VSMON.EXE; VSSTAT.EXE;
      VSWIN9XE.EXE; VSWINNTSE.EXE; VSWINPERSE.EXE; W32DSM89.EXE; W9X.EXE;
      WATCHDOG.EXE; WEBDAV.EXE; WEBSCANX.EXE; WEBTRAP.EXE; WFINDV32.EXE;
      WHOSWATCHINGME.EXE; WIMMUN32.EXE; WIN32.EXE; WIN32US.EXE;
      WINACTIVE.EXE; WIN-BUGSFIX.EXE; WINDOW.EXE; WINDOWS.EXE; WININETD.EXE;
      WININIT.EXE; WININITX.EXE; WINLOGIN.EXE; WINMAIN.EXE; WINNET.EXE;
      WINPPR32.EXE; WINRECON.EXE; WINSERVN.EXE; WINSSK32.EXE; WINSTART.EXE;
      WINSTART001.EXE; WINTSK32.EXE; WINUPDATE.EXE; WKUFIND.EXE; WNAD.EXE;
      WNT.EXE; WRADMIN.EXE; WRCTRL.EXE; WSBGATE.EXE; WUPDATER.EXE;
      WUPDT.EXE; WYVERNWORKSFIREWALL.EXE; XPF202EN.EXE; ZAPRO.EXE;
      ZAPSETUP3001.EXE; ZATUTOR.EXE; ZONALM2601.EXE; ZONEALARM.EXE


会关闭以下服务:
   • Windows Firewall/Internet Connection Sharing

 文件详细信息 编程语言:
该恶意软件程序是用 MS Visual C++ 编写的。


运行时压缩程序:
为了提高检测难度以及减小文件,它已使用以下运行时压缩程序进行压缩:
   • UPX

Açıklamayı yerleştiren Iulia Diaconescu tarihinde 13 Ekim 2006 Cuma
Açıklamayı güncelleyen: Iulia Diaconescu tarihinde 18 Ekim 2006 Çarşamba

Geri . . . .
https:// Bu pencere güvenlik amacıyla şifrelenmiştir.