基本介紹
- 中文名：Worm.ToyPet.xme
- 威脅級別 ： ★
- 處理時間 ： 2006-08-29
- 病毒類型 ： 蠕蟲
病毒別名：
中文名稱：玩偶之怒 影響系統：Win 9x/ME,Win 2000/NT,Win XP,Win 2003
1.創建互斥量:
"PeyotCodedByHALT"
2.添加註冊表:
HKLC\Software\Microsoft\Windows\CurrentVersion\Run
mfcapi32u
mfcapi32u.exe
3.生成檔案:
%WINNT%\System32\mfcapi32u.exe
%TEMP%\hack.txt
4.病毒運行時運行notpad.exe顯示 this is the joke
5.把自己加到防火牆允許裡面
SYSTEM\ControlSet001
\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
6.修改註冊表:
Software\MailPeyot
7.下載檔案:
http://traffall.biz/adv/***/win32.exe
到 "c:\autoexeck.exe"
8.傳送郵件:
主題為:
Thank you for your purchase in Bolero!
Thank you for your registration!
Pay for your credits!
It's important!!! You still have not paid a fine!
Tank you for your charity
內容為:
Hello!
Thank you for your purchase in our Internet-shop. We always appreciate to meet you there and
would like to inform you that money was successfully transferred from your credit card to our account.
Further information you can find enclosed.Sincerely yours, Bolero Inetshop Administration
Hello!
Thank you for your rewrite in our mail server. The confirmation of you new login and password
you can find enclosed.Sincerely yours, Mail Administration Service / Mail Support Service
Hello!
We have to remain you that your credit payment period will be expiring next week. If you will
not make your payment till that time we will have to withdraw your savings from your bank account.
All
details you can find enclosed.USA Credit Group.
Hello!
We remain you that you still have not paid a parking violation fine. You should to pay it till
the next week or we will have to reach trial the deal.We are sending you herewith all necessary
documents.Sincerely yours, Regional Police Department Management / Administration
Hello!
The St. Patrick Home thanks you for your donation. We are very obliged for your assistance
with our St. Patrick's Found and acknowledge the receipt of your transfer for its account. Further to
our letter we are sending you full estimate of that transfer.
發件人為:
Michel Madsen
Nick Convers
Jane Hoocks
Fred Dowland
Emely Hard
John Heckman
Piet Roslen
Oliver Simpson
Patrick Roberts
Lorence Newman
發件人地址為以下兩部分組合:
night
bsd
sys
mr
big
bob
white
dark
black
oliver
yanli
brain
chan
katamoro
tsungli
killer
bug
bug
sun
tr0n
lion
bandit
andi
alert
02
03
2003
2001
2004
2002
2000
2006
m4n
man
chubakka
obivan
presli
songking
yantchi
smitt
westford
goldgong
manager
bengamin
cristofer
albert
antony
martin
enigma
aleph
elvis
john
robin
ghost
郵件域:
mail.com
msn.com
hotmail.com
gmail.com
