基本介紹
- 中文名：Worm.Bobax.af
- 病毒類型：：蠕蟲
- 威脅級別：：★★
- 處理時間：：2005-08-18
病毒簡介,病毒行為,
病毒簡介
病毒別名：
中文名稱：
影響系統：Win 2000/NT,Win XP,Win 2003
病毒行為
該病毒是一個惡意的蠕蟲病毒, 能通過MS05-039漏洞,P2P軟體已分享資料夾,郵件等途徑傳播自身,當該病毒運行時,它會結束諸擔白海危多安全軟體的進程肯漏元和服務,並腳淚屑且刪除這些安全軟體,修改hosts檔案刪戲榆,使用戶無法正常登錄Avp的網站.
1.在%SYSTEMROOT%目錄下釋放以下檔案
msdefr.exe
nb32ext2.exe
services.exe
2.修改Hosts檔案,在該檔案後增加
avp .com 127.0.0.1
使得用嚷求鍵戶無法正常登錄avp的網站
3.修改註冊表
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies DisableRegistryTools dword:00000000
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer
IEPsdgxc dword:00000001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer fdfg dword:00000013
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies DisableRegistryTools dword:00000000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RPCserv32g "D:\WINNT\services.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices helloworld "nb32ext2.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit "%System32%\userinit.exe,"%SystemRoot%\services.exe,"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess
Start dword:00000004
4.關閉以下服務並刪除相關檔案
NETSKY"
"navapsvc"雅煉記協
"NProtectService"
"Norton Antivirus Server"
"VexiraAntivirus"
"dvpinit"
"dvpapi"
"schscnt"
"BackWeb Client - 7681197"
"F-Secure Gatekeeper Handler Starter"
"FSMA"
"AVPCC"
"KAVMonitorService"
"Norman NJeeves"
"NVCScheduler"
"nvcoas"
"Norman ZANDA"
"PASSRV"
"SweepNet"
"SWEEPSRV.SYS"
"NOD32ControlCenter"
"NOD32Service"
"PCCPFW"
"Tmntsrv"
"AvxIni"
"XCOMM"
"ravmon8"
"SmcService"
"BlackICE"
"PersFW"
"McAfee Firewall"
"OutpostFirewall"
"NWService"
"NISUM"
"NISSERV"
"vsmon"
5.結束以下進程並刪除相櫻體關檔案
"Lien Van de Kelderrr.exe"
"winshost.exe"
"msnmsgr.exe"
"wfdmgr.exe"
"OUTPOST.EXE"
"IAOIN.EXE"
"RB.EXE"
"b055262c.dll"
"backdoor.rbot.gen.exe"
"backdoor.rbot.gen_(17).exe"
"msssss.exe"
"rasmngr.exe"
"dailin.exe"
"wowpos32.exe"
"wuamgrd.exe"
"taskmanagr.exe"
"wuamga.exe"
"ATUPDATER.EXE"
"AVWUPD32.EXE"
"AVPUPD.EXE"
"LUALL.EXE"
"DRWEBUPW.EXE"
"ICSSUPPNT.EXE"
"ICSUPP95.EXE"
"UPDATE.EXE"
"NUPGRADE.EXE"
"ATUPDATER.EXE"
"AUPDATE.EXE"
"AUTODOWN.EXE"
"AUTOTRACE.EXE"
"AUTOUPDATE.EXE"
"AVXQUAR.EXE"
"CFIAUDIT.EXE"
"MCUPDATE.EXE"
"NUPGRADE.EXE"
"Systra.exe"
"RAVMOND.exe"
"GfxAcc.exe"
"VisualGuard.exe"
"WIN-BUGSFIX.EXE"
"WIN32.EXE"
"WIN32US.EXE"
"WINACTIVE.EXE"
"WINDOW.EXE"
"WINDOWS.EXE"
"WININETD.EXE"
"WININIT.EXE"
"WININITX.EXE"
"WINLOGIN.EXE"
"WINMAIN.EXE"
"WINPPR32.EXE"
"WINRECON.EXE"
"WINSSK32.EXE"
"WINSTART.EXE"
"WINSTART001.EXE"
"WINTSK32.EXE"
"WINUPDATE.EXE"
"WKUFIND.EXE"
"WNAD.EXE"
"WNT.EXE"
"WRADMIN.EXE"
"WRCTRL.EXE"
"WUPDATER.EXE"
"WUPDT.EXE"
"WYVERNWORKSFIREWALL.EXE"
"XPF202EN.EXE"
"ZAPRO.EXE"
"ZAPSETUP3001.EXE"
"ZATUTOR.EXE"
"ZONALM2601.EXE"
"ZONEALARM.EXE"
"_AVP32.EXE"
"_AVPCC.EXE"
"_AVPM.EXE"
"HIJACKTHIS.EXE"
"F-AGOBOT.EXE"
6.向好友傳送帶毒郵件
7.通過MS05-039漏洞攻擊網路上的其它主機,攻擊成功,則被攻擊主機感染上該病毒
"schscnt"
"BackWeb Client - 7681197"
"F-Secure Gatekeeper Handler Starter"
"FSMA"
"AVPCC"
"KAVMonitorService"
"Norman NJeeves"
"NVCScheduler"
"nvcoas"
"Norman ZANDA"
"PASSRV"
"SweepNet"
"SWEEPSRV.SYS"
"NOD32ControlCenter"
"NOD32Service"
"PCCPFW"
"Tmntsrv"
"AvxIni"
"XCOMM"
"ravmon8"
"SmcService"
"BlackICE"
"PersFW"
"McAfee Firewall"
"OutpostFirewall"
"NWService"
"NISUM"
"NISSERV"
"vsmon"
5.結束以下進程並刪除相關檔案
"Lien Van de Kelderrr.exe"
"winshost.exe"
"msnmsgr.exe"
"wfdmgr.exe"
"OUTPOST.EXE"
"IAOIN.EXE"
"RB.EXE"
"b055262c.dll"
"backdoor.rbot.gen.exe"
"backdoor.rbot.gen_(17).exe"
"msssss.exe"
"rasmngr.exe"
"dailin.exe"
"wowpos32.exe"
"wuamgrd.exe"
"taskmanagr.exe"
"wuamga.exe"
"ATUPDATER.EXE"
"AVWUPD32.EXE"
"AVPUPD.EXE"
"LUALL.EXE"
"DRWEBUPW.EXE"
"ICSSUPPNT.EXE"
"ICSUPP95.EXE"
"UPDATE.EXE"
"NUPGRADE.EXE"
"ATUPDATER.EXE"
"AUPDATE.EXE"
"AUTODOWN.EXE"
"AUTOTRACE.EXE"
"AUTOUPDATE.EXE"
"AVXQUAR.EXE"
"CFIAUDIT.EXE"
"MCUPDATE.EXE"
"NUPGRADE.EXE"
"Systra.exe"
"RAVMOND.exe"
"GfxAcc.exe"
"VisualGuard.exe"
"WIN-BUGSFIX.EXE"
"WIN32.EXE"
"WIN32US.EXE"
"WINACTIVE.EXE"
"WINDOW.EXE"
"WINDOWS.EXE"
"WININETD.EXE"
"WININIT.EXE"
"WININITX.EXE"
"WINLOGIN.EXE"
"WINMAIN.EXE"
"WINPPR32.EXE"
"WINRECON.EXE"
"WINSSK32.EXE"
"WINSTART.EXE"
"WINSTART001.EXE"
"WINTSK32.EXE"
"WINUPDATE.EXE"
"WKUFIND.EXE"
"WNAD.EXE"
"WNT.EXE"
"WRADMIN.EXE"
"WRCTRL.EXE"
"WUPDATER.EXE"
"WUPDT.EXE"
"WYVERNWORKSFIREWALL.EXE"
"XPF202EN.EXE"
"ZAPRO.EXE"
"ZAPSETUP3001.EXE"
"ZATUTOR.EXE"
"ZONALM2601.EXE"
"ZONEALARM.EXE"
"_AVP32.EXE"
"_AVPCC.EXE"
"_AVPM.EXE"
"HIJACKTHIS.EXE"
"F-AGOBOT.EXE"
6.向好友傳送帶毒郵件
7.通過MS05-039漏洞攻擊網路上的其它主機,攻擊成功,則被攻擊主機感染上該病毒
