病毒预警：光华反病毒资讯(01月29日－02月04日)光华反病毒研究中心近日进行病毒特征码更新，请用户尽快到光华网站http://www.viruschina.com下载升级包，以下是几个重要病毒的简介： 一、木马病毒：Trojan.Peacomm 危害级别：★★★★★ 根据光华反病毒研究中心专家介绍，这是一个木马病毒，感染 Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP 系统。它隐藏自身并且下载远程文件，当收到、打开此病毒时，有以下危害： A 在系统目录下生成文件wincom32.sys B 注册以下特性的系统驱动程序 名称：wincom32 位置： ％System％\wincom32.sys C 修改注册表安装服务程序 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wincom32 使得病毒每次开机后自动执行 D 使用安装设备驱动程序功能搜索services.exe 进程，掺入病毒模块 E 隐藏设备驱动和相关模块 F 根据系统情况，第一次安装后可能重启计算机 G 生成以下配置文件 peers.ini wincom32.ini H 打开UDP端口 4000、7871 和 11271，和其他计算机进行加密通信 I 注册本机作为端点进行点对点通信 J 搜索点对点网络中的的一个哈希值，找到后进行下载执行 K 收集本地信息通过点对点网络发布，进行自身更新等 L 下载执行以下文件 http://217.107.217.187/[已删除]/game0.exe http://81.177.3.169/[已删除]/game1.exe http://81.177.3.169/[已删除]/game2.exe http://81.177.3.169/[已删除]/game4.exe M 通过邮件传播，特征如下 主题（以下之一）： A killer at 11, he's free at 21 and kill again! U.S. Secretary of State Condoleezza Rice has kicked German Chancellor Angela Merkel British Muslims Genocide Naked teens attack home director. 230 dead as storm batters Europe. Re: Your text Radical Muslim drinking enemies's blood. Chinese missile shot down Russian satellite Chinese missile shot down Russian aircraft Chinese missile shot down USA aircraft Chinese missile shot down USA satellite Russian missile shot down USA aircraft Russian missile shot down USA satellite Russian missile shot down Chinese aircraft Russian missile shot down Chinese satellite Saddam Hussein safe and sound! Saddam Hussein alive! Venezuelan leader: "Let's the War beginning". Fidel Castro dead. 附件（以下之一）： FullVideo.exe Full Story.exe Video.exe Read More.exe FullClip.exe GreetingPostcard.exe MoreHere.exe FlashPostcard.exe GreetingCard.exe ClickHere.exe ReadMore.exe FlashPostcard.exe FullNews.exe 光华反病毒软件已经对这种病毒进行了处理，请用户升级后，使用光华反病毒软件清除。 二 邮件病毒 W32.Miprinc@mm 危害级别：★★☆☆☆ 根据光华反病毒研究中心专家介绍，W32.Miprinc@mm 是一个邮件病毒，长度 93,896 字节，感染 Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP 系统，通过自带的邮件引擎传播，感染本地硬盘、网络影射盘、U盘、移动硬盘。当收到、打开此病毒时，主要有以下危害： A 生成以下文件到根目录 Autorun.inf Desktop.ini Mr_CoolFace.scr （病毒本身） B 常见目录Mr_CF到以下位置 所有驱动器根目录 ％UserProfile％\Application Data ％UserProfile％\Local Settings\Application Data C 在目录内繁殖文件 Folder.htt Mr_CF.exe （病毒本身） D 复制自身到以下文件 ％SystemRoot％\EXPLORER.EXE ％System％\Mr_CoolFace.scr ％System％\[RANDOM].exe ％System％\msvbvm60.dll ％Windir％\Negeri Serumpun Sebalai.pif.bat.com.scr.exe ％UserProfile％\Start Menu\Programs\Startup\winlogon.exe ％UserProfile％\Application Data\Mutant.exe ％UserProfile％\Application Data\SMA Negeri 1 Pangkalpinang.exe ％UserProfile％\Application Data\Sahang.exe ％UserProfile％\Application Data\Timah.exe ％UserProfile％\Application Data\explorer.exe ％UserProfile％\Desktop\Message For My Princess.scr ％UserProfile％\Local Settings\Application Data\Polymorph1.exe ％UserProfile％\Local Settings\Application Data\Polymorph2.exe ％UserProfile％\Local Settings\DNALSI_AKGNAB.exe ％UserProfile％\Local Settings\DNALSI_AKGNAB.exe.mutant ％UserProfile％\Local Settings\Mr_CF_Mutation.Excalibur ％UserProfile％\Local Settings\[随机].exe E 增加键值"[RANDOM CHARACTERS]" = "[随机].EXE" 到 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 使得病毒每次开机后自动执行 F 增加键值 "Shell" = "explorer.exe "％SystemRoot％\explorer.exe" "Userinit:" = "C:\WINDOWS\System32\userinit.exe, ％SystemRoot％\explorer.exe" 到 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon 使得病毒每次开机后自动执行 G 修改HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore 的键值"DisableConfig" = "1" "DisableSR" = "1" 关闭系统还原 H 修改HKEY_CLASSES_ROOT\exefile HKEY_CLASSES_ROOT\scrfile 的键值 "Hidden" = "2" "HideFileExt" = "1" I 修改HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced 的键值 "(Default)" = "JPEG Image" J 搜索以下扩展名的文件 .SWF .swf .GIF .gif .BMP .bmp .BAT .bat .INF .inf .htm .Avi .AVI .avi .3Gp .3GP .3gp .Mpg .MPG .mpg .MIDI .Midi .midi .Wmv .WMV .wmv .Wma .WMA .wma .Mp4 .MP4 .mp4 .Mp3 .MP3 .mp3 .Mid .MID .mid .Mov .MOV .mov .Jpeg .JPEG .jpeg .Jpg .JPG .jpg K 改变找到的文件属性为系统隐藏 L 将自身复制为].scr的文件 M 禁止键盘和鼠标输入到含有以下内容标题的窗口上 RUN NOTEPAD UNTITLED N 改变窗口标题为 Message For My Princess Mr_CoolFace Has Come ! O 感染本地硬盘、网络影射盘、U盘、移动硬盘 P 复制 .exe 到所有驱动器 Q 通过以下特性的邮件传播自身 主题（以下之一）： Re: I don't wish to lost you again! Please Come Back! Rindu Yang Tak Tertahankan Remember Our Past? Don't Forget Me,please! Shall I Be The One For You ? I Miss You So Much ! Please Remember Me. Still Remember??? I miss U Ketika Kangen bertemu Rindu Lama Tak Jumpa Ketika Rindu bertemu Kangen 内容（以下之一）： I wanna be you friend. So I give you a little present ^_^ Ehm,....would you like to be my friend ? Please check, tell me if you like it ^_^. Will I meet You my old friend... I miss You, I give you a file that will remind you... Dear My Sweetie.. Here is the file, Thank you for your friendship. Please, don't forget me...Ok! Take a look at the attacment, you will remember me. I am missing you, please come back... I give you the proof that I miss you so much! Shall I be the one for you? Still remember me ??? Do you remember me? Dear My Friend.. Here is the file, Thank you for your cooperative. Take this, please tell me if there's an error. Please check, told me if there's a mistake. Sorry, I forget to send you the document. I'm oversleep. Finally, I found the data !, what do you think ?? Here, the file that you want 附件（以下之一）： Rindu dan Kangen bersatu.txt[SEVERAL SPACE CHARACTERS]pif Kangen dan Rindu bersatu.tmp[SEVERAL SPACE CHARACTERS]pif SweetMemory.doc[SEVERAL SPACE CHARACTERS].pif Friend Reminder.doc[SEVERAL SPACE CHARACTERS].exe www.lovestory.com MyMind.doc[SEVERAL SPACE CHARACTERS].pif CuteGame3.0 Installer.com LoveGame.bmp[SEVERAL SPACE CHARACTERS].exe My_Beloved.doc[SEVERAL SPACE CHARACTERS].exe Love_U_So_Much.txt[SEVERAL SPACE CHARACTERS].pif Our_Memory.ppt[SEVERAL SPACE CHARACTERS].pif I_Miss_U.doc[SEVERAL SPACE CHARACTERS].pif Rindu.doc[SEVERAL SPACE CHARACTERS].exe Kenangan Cinta.doc[SEVERAL SPACE CHARACTERS].pif www.Hacking_Tool.bat Namo7.0_Installer.com NetMeeting.com MindMap.exe Mahasiswi Cantik.scr Crack.exe Tutorial.ppt[SEVERAL SPACE CHARACTERS].pif Data.doc[SEVERAL SPACE CHARACTERS].pif Keygen.exe Beauty ScreenSaver.scr R 结束含有以下内容的进程： 0GrtMultikiller 2rellikitluM AD-AWARE ADNAP ANVIE AnVir ANVIR AVIRA BACA BRO BITDEF BLACKICE CabinetW CASTLECOP CHRIS PC CILIN CITSITSCANNING STATISTIC CLEANER COMMAND BRO COMPACTBYTE CONFIGURATION UTILITY ConsoleW COPYING.. CURR PROCESS CurrProcess CURRPROCESS DELETING.. EARTHLINK PROTECTION ERTANTO explorer.exe EXTENSION TEST FLAMMING WALL FOLDER OPTION FORCE FREECELL F-SECURE GEOBLACK GRISOFT HACKER HEARTS HIJACK HtrGPANDA I KNOW IDI0T IDIOT IKNOW JAMILA KASPERSKY LUKE FILEWALKER MACHINE MALWARE MCAFEE MEDIA PLAYER MIGHTY CHICKEN MIGHTYCHICKEN MINESWEEPER MOVING.. Mr_CoolFace Multikiller2 MY DOCUMENTS NORMAN NORTON NOTESXP OPTIX PRO PCMAV PCSUMMARIZER PINBALL POP3TRAP POWER TOOL POWERDVD POWERTOOL PrcView PROCESS EXPLORER PROCESS INFO PROCESS MANAGER PROCESS MONITOR PROCESS VIEWER Process Viewer PROCESSINFO PROCESSMANAGER PROCESSMONITOR PROCESSVIEWER PROCEXP PROCEXPL REALPLAYER REG FIX REGCURE RegEdit REGFIX REGISTRY Registry Editor REMOVA REMOVER REMOVI RESULT DETAIL SEARCH RESULTS SECUNIA SECURITY TASK SIKUP SOLITAIRE SOPHOS SPIDER SPYWARE STARTUP ORGANIZER SYMANTEC SYSINTERNAL System Configuration Utility System Restore SYSTEM32 TASK INFO TASK MANAGER TASKGUARDIAN TASKINFO TASKMANAGER TASKS MANAGER TForm1 ThunderRT TmainF TMainF TREND TROJAN TShowSplash TSystemCleaner TWEAK VAKSIN VIROLOG VIRUS WANTI Warecase WASHER WAV V WIN TASK WINDOWS FILE PROTECTION WINHEX WINPATROL WINTASK wITNA wProcess Explorer YOHAN ZANDA Zanda's little helper 北京日月光华软件公司网站（http://www.viruschina.com）每日进行病毒特征码更新，光华反病毒研究中心专家提醒您：请尽快到光华安全网站在线订购光华反病毒软件来防范病毒的入侵，时刻保护您的电脑安全。光华反病毒软件用户升级到1月29日的病毒库(免费下载地址为：http://www.viruschina.com/html/update.htm)就可以完全查杀这些病毒。
|
|
热门文章
|
本周
|
本月
|
全部
|