|
| 病毒预警：光华反病毒资讯(01月29日－02月04日) |
| 来源：网络 时间：2007-2-1 |
|
来源：北京日月光华
光华反病毒研究中心近日进行病毒特征码更新，请用户尽快到光华网站http://www.viruschina.com下载升级包，以下是几个重要病毒的简介：
一、木马病毒：Trojan.Peacomm 危害级别：★★★★★
根据光华反病毒研究中心专家介绍，这是一个木马病毒，感染 Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP 系统。它隐藏自身并且下载远程文件，当收到、打开此病毒时，有以下危害：
A 在系统目录下生成文件wincom32.sys
B 注册以下特性的系统驱动程序
名称：wincom32
位置： ％System％\wincom32.sys
C 修改注册表安装服务程序
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wincom32
使得病毒每次开机后自动执行
D 使用安装设备驱动程序功能搜索services.exe 进程，掺入病毒模块
E 隐藏设备驱动和相关模块
F 根据系统情况，第一次安装后可能重启计算机
G 生成以下配置文件
peers.ini
wincom32.ini
H 打开UDP端口 4000、7871 和 11271，和其他计算机进行加密通信
I 注册本机作为端点进行点对点通信
J 搜索点对点网络中的的一个哈希值，找到后进行下载执行
K 收集本地信息通过点对点网络发布，进行自身更新等
L 下载执行以下文件
http://217.107.217.187/[已删除]/game0.exe
http://81.177.3.169/[已删除]/game1.exe
http://81.177.3.169/[已删除]/game2.exe
http://81.177.3.169/[已删除]/game4.exe
M 通过邮件传播，特征如下
主题（以下之一）：
A killer at 11, he’s free at 21 and kill again!
U.S. Secretary of State Condoleezza Rice has kicked German Chancellor Angela Merkel
British Muslims Genocide
Naked teens attack home director.
230 dead as storm batters Europe.
Re: Your text
Radical Muslim drinking enemies’s blood.
Chinese missile shot down Russian satellite
Chinese missile shot down Russian aircraft
Chinese missile shot down USA aircraft
Chinese missile shot down USA satellite
Russian missile shot down USA aircraft
Russian missile shot down USA satellite
Russian missile shot down Chinese aircraft
Russian missile shot down Chinese satellite
Saddam Hussein safe and sound!
Saddam Hussein alive!
Venezuelan leader: "Let’s the War beginning".
Fidel Castro dead.
附件（以下之一）：
FullVideo.exe
Full Story.exe
Video.exe
Read More.exe
FullClip.exe
GreetingPostcard.exe
MoreHere.exe
FlashPostcard.exe
GreetingCard.exe
ClickHere.exe
ReadMore.exe
FlashPostcard.exe
FullNews.exe
光华反病毒软件已经对这种病毒进行了处理，请用户升级后，使用光华反病毒软件清除。
二 邮件病毒 W32.Miprinc@mm 危害级别：★★☆☆☆
根据光华反病毒研究中心专家介绍，W32.Miprinc@mm 是一个邮件病毒，长度 93,896 字节，感染 Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP 系统，通过自带的邮件引擎传播，感染本地硬盘、网络影射盘、U盘、移动硬盘。当收到、打开此病毒时，主要有以下危害：
A 生成以下文件到根目录
Autorun.inf
Desktop.ini
Mr_CoolFace.scr （病毒本身）
B 常见目录Mr_CF到以下位置
所有驱动器根目录
％UserProfile％\Application Data
％UserProfile％\Local Settings\Application Data
C 在目录内繁殖文件
Folder.htt
Mr_CF.exe （病毒本身）
D 复制自身到以下文件
％SystemRoot％\EXPLORER.EXE
％System％\Mr_CoolFace.scr
％System％\[RANDOM].exe
％System％\msvbvm60.dll
％Windir％\Negeri Serumpun Sebalai.pif.bat.com.scr.exe
％UserProfile％\Start Menu\Programs\Startup\winlogon.exe
％UserProfile％\Application Data\Mutant.exe
％UserProfile％\Application Data\SMA Negeri 1 Pangkalpinang.exe
％UserProfile％\Application Data\Sahang.exe
％UserProfile％\Application Data\Timah.exe
％UserProfile％\Application Data\explorer.exe
％UserProfile％\Desktop\Message For My Princess.scr
％UserProfile％\Local Settings\Application Data\Polymorph1.exe
％UserProfile％\Local Settings\Application Data\Polymorph2.exe
％UserProfile％\Local Settings\DNALSI_AKGNAB.exe
％UserProfile％\Local Settings\DNALSI_AKGNAB.exe.mutant
％UserProfile％\Local Settings\Mr_CF_Mutation.Excalibur
％UserProfile％\Local Settings\[随机].exe
E 增加键值"[RANDOM CHARACTERS]" = "[随机].EXE"
到 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
使得病毒每次开机后自动执行
F 增加键值
"Shell" = "explorer.exe "％SystemRoot％\explorer.exe"
"Userinit:" = "C:\WINDOWS\System32\userinit.exe, ％SystemRoot％\explorer.exe"
到 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
使得病毒每次开机后自动执行
G 修改HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
的键值"DisableConfig" = "1"
"DisableSR" = "1"
关闭系统还原
H 修改HKEY_CLASSES_ROOT\exefile
HKEY_CLASSES_ROOT\scrfile
的键值 "Hidden" = "2"
"HideFileExt" = "1"
I 修改HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
的键值 "(Default)" = "JPEG Image"
J 搜索以下扩展名的文件
.SWF
.swf
.GIF
.gif
.BMP
.bmp
.BAT
.bat
.INF
.inf
.htm
.Avi
.AVI
.avi
.3Gp
.3GP
.3gp
.Mpg
.MPG
.mpg
.MIDI
.Midi
.midi
.Wmv
.WMV
.wmv
.Wma
.WMA
.wma
.Mp4
.MP4
.mp4
.Mp3
.MP3
.mp3
.Mid
.MID
.mid
.Mov
.MOV
.mov
.Jpeg
.JPEG
.jpeg
.Jpg
.JPG
.jpg
K 改变找到的文件属性为系统隐藏
L 将自身复制为].scr的文件
M 禁止键盘和鼠标输入到含有以下内容标题的窗口上
RUN
NOTEPAD
UNTITLED
N 改变窗口标题为
Message For My Princess
Mr_CoolFace Has Come !
O 感染本地硬盘、网络影射盘、U盘、移动硬盘
P 复制 .exe 到所有驱动器
Q 通过以下特性的邮件传播自身
主题（以下之一）：
Re:
I don’t wish to lost you again!
Please Come Back!
Rindu Yang Tak Tertahankan
Remember Our Past?
Don’t Forget Me,please!
Shall I Be The One For You ?
I Miss You So Much !
Please Remember Me.
Still Remember???
I miss U
Ketika Kangen bertemu Rindu
Lama Tak Jumpa
Ketika Rindu bertemu Kangen
内容（以下之一）：
I wanna be you friend. So I give you a little present ^_^
Ehm,....would you like to be my friend ?
Please check, tell me if you like it ^_^.
Will I meet You my old friend...
I miss You, I give you a file that will remind you...
Dear My Sweetie..
Here is the file, Thank you for your friendship.
Please, don’t forget me...Ok! Take a look at the attacment, you will remember me.
I am missing you, please come back...
I give you the proof that I miss you so much!
Shall I be the one for you?
Still remember me ???
Do you remember me?
Dear My Friend..
Here is the file, Thank you for your cooperative.
Take this, please tell me if there’s an error.
Please check, told me if there’s a mistake.
Sorry, I forget to send you the document.
I’m oversleep.
Finally, I found the data !, what do you think ??
Here, the file that you want
附件（以下之一）：
Rindu dan Kangen bersatu.txt[SEVERAL SPACE CHARACTERS]pif
Kangen dan Rindu bersatu.tmp[SEVERAL SPACE CHARACTERS]pif
SweetMemory.doc[SEVERAL SPACE CHARACTERS].pif
Friend Reminder.doc[SEVERAL SPACE CHARACTERS].exe
www.lovestory.com
MyMind.doc[SEVERAL SPACE CHARACTERS].pif
CuteGame3.0 Installer.com
LoveGame.bmp[SEVERAL SPACE CHARACTERS].exe
My_Beloved.doc[SEVERAL SPACE CHARACTERS].exe
Love_U_So_Much.txt[SEVERAL SPACE CHARACTERS].pif
Our_Memory.ppt[SEVERAL SPACE CHARACTERS].pif
I_Miss_U.doc[SEVERAL SPACE CHARACTERS].pif
Rindu.doc[SEVERAL SPACE CHARACTERS].exe
Kenangan Cinta.doc[SEVERAL SPACE CHARACTERS].pif
www.Hacking_Tool.bat
Namo7.0_Installer.com
NetMeeting.com
MindMap.exe
Mahasiswi Cantik.scr
Crack.exe
Tutorial.ppt[SEVERAL SPACE CHARACTERS].pif
Data.doc[SEVERAL SPACE CHARACTERS].pif
Keygen.exe
Beauty ScreenSaver.scr
R 结束含有以下内容的进程：
0GrtMultikiller
2rellikitluM
AD-AWARE
ADNAP
ANVIE
AnVir
ANVIR
AVIRA
BACA BRO
BITDEF
BLACKICE
CabinetW
CASTLECOP
CHRIS PC
CILIN
CITSITSCANNING STATISTIC
CLEANER
COMMAND BRO
COMPACTBYTE
CONFIGURATION UTILITY
ConsoleW
COPYING..
CURR PROCESS
CurrProcess
CURRPROCESS
DELETING..
EARTHLINK PROTECTION
ERTANTO
explorer.exe
EXTENSION TEST
FLAMMING WALL
FOLDER OPTION
FORCE
FREECELL
F-SECURE
GEOBLACK
GRISOFT
HACKER
HEARTS
HIJACK
HtrGPANDA
I KNOW
IDI0T
IDIOT
IKNOW
JAMILA
KASPERSKY
LUKE FILEWALKER
MACHINE
MALWARE
MCAFEE
MEDIA PLAYER
MIGHTY CHICKEN
MIGHTYCHICKEN
MINESWEEPER
MOVING..
Mr_CoolFace
Multikiller2
MY DOCUMENTS
NORMAN
NORTON
NOTESXP
OPTIX PRO
PCMAV
PCSUMMARIZER
PINBALL
POP3TRAP
POWER TOOL
POWERDVD
POWERTOOL
PrcView
PROCESS EXPLORER
PROCESS INFO
PROCESS MANAGER
PROCESS MONITOR
PROCESS VIEWER
Process Viewer
PROCESSINFO
PROCESSMANAGER
PROCESSMONITOR
PROCESSVIEWER
PROCEXP
PROCEXPL
REALPLAYER
REG FIX
REGCURE
RegEdit
REGFIX
REGISTRY
Registry Editor
REMOVA
REMOVER
REMOVI
RESULT DETAIL
SEARCH RESULTS
SECUNIA
SECURITY TASK
SIKUP
SOLITAIRE
SOPHOS
SPIDER
SPYWARE
STARTUP ORGANIZER
SYMANTEC
SYSINTERNAL
System Configuration Utility
System Restore
SYSTEM32
TASK INFO
TASK MANAGER
TASKGUARDIAN
TASKINFO
TASKMANAGER
TASKS MANAGER
TForm1
ThunderRT
TmainF
TMainF
TREND
TROJAN
TShowSplash
TSystemCleaner
TWEAK
VAKSIN
VIROLOG
VIRUS
WANTI
Warecase
WASHER
WAV V
WIN TASK
WINDOWS FILE PROTECTION
WINHEX
WINPATROL
WINTASK
wITNA
wProcess Explorer
YOHAN
ZANDA
Zanda’s little helper
北京日月光华软件公司网站（http://www.viruschina.com）每日进行病毒特征码更新，光华反病毒研究中心专家提醒您：请尽快到光华安全网站在线订购光华反病毒软件来防范病毒的入侵，时刻保护您的电脑安全。光华反病毒软件用户升级到1月29日的病毒库(免费下载地址为：http://www.viruschina.com/html/update.htm)就可以完全查杀这些病毒。
|
|
|
|
|
