基本介紹
- 中文名：袋子變種H
- 外文名：Worm.Bagz.h
- 別名：Email-Worm.Win32.Bagz.h [AVP]
- 病毒類型：蠕蟲
- 影響系統：Win9x / WinNT
- 威脅級別：★★
病毒行為
1)將病毒拷貝到%System%\hicom.exe，並將其進程註冊為系統服務Working Network Connections。
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\TY164
"Type"=0x20
"Start"=0x2
"ErrorControl"=0x0
"ImagePath"="%System%\hicom.exe"
"DisplayName"="Working Network Connections"
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\TY164\Security
"Security"=01 00 14 80 A0 00 00 00 ...
"ObjectName"="LocalSystem"
"Description"="Manages this out config test"
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_TY164
"NextInstance"=0x1
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_TY164\0000\Control
"*NewlyCreated*"=0x0
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_TY164\0000
"Service"="TY164"
"Legacy"=0x1
"ConfigFlags"=0x0
"Class"="LegacyDriver"
"ClassGUID"=""
"DeviceDesc"="Working Network Connections"
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\TY164\Enum
"0"="Root\LEGACY_TY164\0000"
"Count"=0x1
"NextInstance"=0x1
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent
(Default)=0x8
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_TY164\0000\Control
ActiveService="TY164"
2)嘗試連線到預定的站點
3)開啟一個隱蔽的代理，並通過染毒機器傳送郵件
郵件傳送人：
姓：
Alexander
Alpert
Albert
Horowitz
Hollaender
Hohenemser
Hoch
Hirsch
Himmelfarb
Hillel
Herzog
Hersch
Herzberg
Herman
Hellman
Heller
Heck
Hecht
Handler
Halpern
Halperin
Gysi
Gunzberg
Gr1nberg
Gruber
Grossman
Greenberg
Gralnick
Gould
Gottlieb
Goldwyn
Goldenson
Goldberg
Glucksman
Glickman
Glazer
Gershwin
Gersh
Gelbman
Geffen
Friedman
Fried
Freud
Frankel
Fleisher
Fleischer
Fishbein
Fisch
Fish
Finkelstein
Finkbein
Finkel
Fink
Feldman
Feinberg
Feidelberg
Farber
Emmanuel
Ellison
Ellis
Adorno
Adler
Abrahams
名：
Kelly
Ingrid
Helen
Giselle
Fran
Erica
Ellen
Yvonne
Winnie
Wilma
Wendy
Vivian
Vicki
Ursula
Tori
Terri
Samantha
Sarah
Randi
Roxanne
Patty
Paula
Nicole
Norah
Melanie
Maureen
Lindsey
Linda
Laura
Kelly
Kate
Katherine
Jennifer
Julia
Ingrid
Helen
Diane
Debbie
Carolyn
Cathy
Barbara
Brenda
Anne
Allison
Amanda
Sally
Gina
Martha
Lynda
