Win32.Troj.Arvcode

系統修改

1.在註冊表主鍵"HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun"下，

添加如下鍵值："mdetect"=木馬全路徑名

2.該木馬運行時會向Explorer.exe進程注入一遠程執行緒

3.向外傳送大量的垃圾郵件

4.郵件主題是隨機的：

AOL 6.0 for Windows US sub 10551

AOL 7.0 for Windows UK sub 52

AOL 7.0 for Windows US sub 118

Calypso Version 3.20.01.01 (4)

Calypso Version 3.30.00.00

eGroups Message Poster

Internet Mail Service (5.5.2650.21)

MailGate v3.0

Microsoft Internet Mail 4.70.1155

Microsoft Outlook Express 4.72.3110.5

Microsoft Outlook Express 5.00.26200

Microsoft Outlook Express 5.00.2919.6700

Microsoft Outlook Express 5.50.4133.2400

Microsoft Outlook Express 5.50.4522.1200

Microsoft Outlook Express 6.00.2462.0000

Microsoft Outlook Express 6.00.2600.0000

Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)

Microsoft Outlook, Build 10.0.2616

Microsoft Outlook, Build 10.0.2627

MIME-tools 4.104 (Entity 4.116)

MIME-tools 5.503 (Entity 5.501)

Mozilla 4.61 [en]C-CCK-MCD C-UDP; (Win98; I)

Mozilla 4.7 [en] (X11; I; FreeBSD 4.0-20000103-CURRENT i386)

Mozilla/5.0 (X11; U; Linux i586; en-US; rv:1.0.0) Gecko/20020623 Debian/1.0.0-0.woody.1

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0rc2) Gecko/20020513 Netscape/7.0b1

Mutt/1.5.1i

Pegasus Mail for Win32 (v2.53/R1)

PObox II beta1.0