NETSKY.C子变种澳州爆发

互联网 | 编辑: 2004-02-27 00:00:00 返回原文

病毒信息

目前在澳大利亚发现了数个经过人为修改的WORM_NETSKY.C变种,该变种在功能上与之前发布的WORM_NETSKY.C完全一致,只是在文件的结构上做了不同的修改。趋势科技为确保客户得到最大限度的防护,对现有的病毒码进行了进一步的增强。

趋势科技于2月26日凌晨发布的全球中度病毒风险警报已经升级为全球高度病毒风险警报,请密切关注[WORM_NETSKY.C]病毒。

Virus Name:

Worm_NETSKY.C

Alias:

Related to:

Virus Type:

蠕虫

Virus Action:

 

File Type:

 

Damage Potential:

 

Place of Origin:

美国

Date of Origin:

2004226

Detected in Engine:

5.600

Detected in Pattern:

779

Language:

英文

Size of Virus:

25,352字节

Encrypted:

Distribution Potential:

 

Platform:

Windows 95, 98, ME, NT, 2000, XP

Memory Resident:

Payload:

 

Trigger Date:

 

Trigger Condition:

 

Symptoms:

 

[DESCRIPTION]

 

 

 

 

WORM_NETSKY的变种感染报告。

SMTP邮件进行传播,在网络共享中生成自身拷贝。

是变化的。

Windows 95, 98, ME, NT, 2000 XP系统上。

病毒分析

[Details]

 

 

 

 

SMTP(Simple Mail Transfer Protocol)邮件进行传播,并通过网络共享产生自身的拷贝。

Windows共享文件夹中生成自身拷贝:

1000 Sex and more.rtf.exe

3D Studio Max 3dsmax.exe

ACDSee 9.exe

Adobe Photoshop 9 full.exe

Adobe Premiere 9.exe

Ahead Nero 7.exe

Best Matrix Screensaver.scr

Clone DVD 5.exe

Cracks & Warez Archive.exe

Dark Angels.pif

Dictionary English - France.doc.exe

DivX 7.0 final.exe

Doom 3 Beta.exe

E-Book Archive.rtf.exe

Full album.mp3.pif

Gimp 1.5 Full with Key.exe

How to hack.doc.exe

IE58.1 full setup.exe

Keygen 4 all appz.exe

Learn Programming.doc.exe

Lightwave SE Update.exe

Magix Video Deluxe 4.exe

Microsoft Office 2003 Crack.exe

Microsoft WinXP Crack.exe

MS Service Pack 5.exe

Norton Antivirus 2004.exe

Opera.exe

Partitionsmagic 9.0.exe

Porno Screensaver.scr

RFC Basics Full Edition.doc.exe

Screensaver.scr 26KB

Serials.txt.exe 26KB

Smashing the stack.rtf.exe

Star Office 8.exe

Teen Porn 16.jpg.pif

The Sims 3 crack.exe

Ulead Keygen.exe

Virii Sourcecode.scr

Visual Studio Net Crack.exe

Win Longhorn Beta.exe

WinAmp 12 full.exe

Windows Sourcecode.doc.exe

WinXP eBook.doc.exe

XXX hardcore pic.jpg.exe

Windows文件夹中生成自身拷贝:

WINLOGON.EXE

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
ICQ Net = "%Windows%\winlogon.exe -stealth"

DLL组件,它还会删除如下注册表键:

HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-
00AA005127ED}\InProcServer32
"%System%\WEBCHECK.DLL"

SMTP引擎进行传播。它发出的电子邮件具有如下细节:

From: <spoofed>

Subject: (any of the following)
• notice!
• its me
• I'm back!
• last chance!
• lol
• Re: <5664ddff?$??º2>
• notification denied!
• Question
• believe me
• Re: hello
• Re: important
• Re: hi
• Re: excuse me
• Re: hey exception
• something for you
• you?
• Re: Re: Re: Re: re: take it error
• illegal...
• goodmorning
• private?
• stolen
• Here is it
• Re: information
• info
• what's up?
• moin
• warning fake?
• Re: unknown dear
• hello
• important
• Yep Re: does it
• ? hi read it immediatelly
• Re: excuse me
• hey trust me
• question
• report
• Status
• Delivery Failed

Message body: (any of the following)
• <Deliver Error>
• <Message Error>
• <Server Error>
• what means that?
• help attached
• <...>
• ok...
• <Attachment from Poland>
• that is interesting...
• i wait for your comment about it.
• such as yours?
• read the details.
• gonna?
• here is the document.
• *lol*
• read it immediately!
• i found that about you!
• your hero in the picture?
• yours?
• here is it.
• illegal st. of you?
• is that true?
• account?
• is that your name?
• picture?
• message?
• is that your account?
• pwd?
• I wait for an answer!
• abuse?
• is that yours?
• you are a bad writer
• I don't know your document!
• <Mail failed>
• I have your password!
• you won the rk!
• something about you!
• classroom test of you?
• kill the writer of this document!
• old photos about you?
• i hope thats not true!
• your name is wrong!
• does it match?
• i found this document about you.
• time to fear?
• really?
• do you know this????
• i know your document!
• did you sent it to me?
• this file is bad!
• why should I?
• pages?
• her.
• another pic, have fun! ... :->
• test it
• child porn?
• greetings
• xxx ?
• stuff about you?
• your document is not good
• something is going wrong!
• your photo is poor
• information about you?
• the information is wrong!
• doc about me?
• kill him on the picture!
• from the chatter (my photo!)
• from your lover ;-)
• love letter?
• here, the serials
• are you a teacherin the picture?
• here, the introduction
• is that criminal?
• here, the cheats
• i like your doc!
• what do you think about it?
• that's a funny text.
• that's not the truth?
• do you have?
• instruct me about this!
• i lost that
• i am speachless about your document!
• is that the reality?
• reply
• msg
• your design is not good!
• important?
• your TAN number?
• take it easy!
• why?
• you are naked in this document!
• thats wrong!
• your icq number?
• i am desperate
• modifications?
• your personal record?
• yes.
• misc. and so on. see you!
• your attachment? verify it.
• you earn money, see the attachment!
• is that your attachment?
• is that your website?
• you feel the same.
• meaning of that?
• possible?
• you have tried to steal!
• did you ask me for that?
• you are bad
• your job? (I found that!)
• is that possible?
• something is going ...
• something is not ok
• did you know from this document?
• wrong calculation! (see the attachment!...
• never!
• poor quality!
• good work!
• excellent!
• great!
• i don't think so.
• pretty pic about you?
• docs?
• schoolfriend?
• <Warning from the Government>
• <09580985869gj>

• i want more...
• here is the next one!
• attachi#
• did you see her already?
• is that your wife?
• is that your creditcard?
• is that your photo?
• do you think so?
• do you have the bug also?
• already?
• forgotten?
• drugs? ...
• does it matter?
• i have received this.
• best?
• the truth?
• your body?
• your eyes?
• your face?
• File is self-decryting.
• File is damaged.
• File is bad.
• i saw you last week!
• xxx service
• your account is expired!
• you cannot hide yourself! (see photo)
• copyright?
• what still?
• who?
• how?
• <bad gateway>
• only encrypted!
• personal message!
• my advice....
• i've found it about you
• <<>>
• <Attached Msg>
• <scanned by norton antivirus>
• great xxx!
• man or women?
• child or adult?
• here is yours!
• a crazy doc about you
• xxx about you?
• i don't want your xxx pics!
• <Failed message available>
• <Automailer>
• doc?
• trial?
• what?
• ;-)
• i need you!
• correct it!
• see this!
• it's a secret!
• this is nothing for kids!
• it's so similar as yours!
• is that your car?
• do not give up!
• great job!
• here is the $%%454$
• you are sexy in this doc!
• incest?
• let it!
• you look like an ape!
• you look like an rat?
• be mad?
• are you cranky?
• bob the builder
• did you know that?
• money?
• is that your car?
• is this information about you?
• is that your privacy?
• is that your TAN?
• is that your message?
• is that your cd?
• is that your finger?
• your are naked?
• is that your porn pic?
• is that your work?
• is that your family?
• is that your beast?
• is that your account?
• is that your slip?
• is that your domain?
• are you the naked one?
• are you the naked person!
• are you the one?
• does it belong to you?
• do you have sex in the picture?
• you have a sexy body in the pic!
• your lie is going around the world!
• <Transfer complete>
• <Antispam complete>
• lets talk about it!
• do you know the thief?
• are you a photographer?
• you have done a mistake in the document...
• its private from me
• do not show this anyone!
• new patch is available!
• this is an attachment message!
• in your mind?
• Microsoft
• fast food...
• Your bill.
• try this patch!
• do you have an orgasm in the picture?
• <Click the attachment to decrypt>
• <Attachment Signature 34933920>
• Transaction failed. Show the doc!
• I 've found your bill!
• see your name!
• You are infected. Read the details!
• here is my advice.
• here is my photo!
• here is the <censored>
• feel free to use it.
• does it belong to you?
• Login required! Read the attachment!
• your document is silly!
• is the pic a fake?
• Antispam is turned off. See file!
• Authentification required. Read the att...
• solve the problem!
• <null>
• do not use my document!
• do not open the attachment!
• do not visit the pages on the list I se...
• explain!
• tell me more about your document!
• Your provider will be disabled!
• Instant patches.

Attachment: (any of the following)
• 454543403
• aboutyou
• associal
• attach2
• attachment
• auction
• bill
• birth
• card
• class_photos
• concert
• creditcard
• death
• description
• details
• dinner
• disco
• doc
• doc_ang
• document
• final
• found
• freaky
• friend
• id
• image
• important
• incest
• information
• injection
• intimate stuff
• jokes
• letter
• location
• mail2
• mails
• masturbation
• material
• me
• message
• misc
• moonlight
• more
• msg
• msg2
• music
• myaunt
• mydate
• naked1
• naked2
• news
• nomoney
• note
• nothing
• number_phone
• object
• old_photos
• part2
• party
• paypal
• pic
• portmoney
• poster
• posting
• privacy
• product
• ps
• ranking
• regards
• regid
• release
• response
• schock
• secrets
• sexual
• sexy
• shower
• story
• stuff
• swimmingpool
• talk
• tear
• textfile
• topseller
• transfer
• trash
• undefinied
• unfolds
• update
• violence
• visa
• warez
• webcam
• website
• wife
• word_doc
• worker
• your_stuff
• yours
• yours

趋势科技正在对该病毒进行深入分析,我们将尽快提供最新信息。

病毒清除

[How to Clean]

辨别病毒程序

在进行病毒清除前,首先辨别该病毒程序。

使用趋势科技的防病毒产品扫描你的系统

记录下检测出的所有 WORM_NETSKY.C 文件

趋势科技的用户在扫描系统前应该下载最新病毒码。其它的网络用户可以使用趋势科技的免费在线病毒扫描器 Housecall

Windows任务管理器
Windows 95/98/ME 系统上, 按下
CTRL+ALT+DELETE
Windows NT/2000/XP 系统上, 按下
CTRL+SHIFT+ESC,
并点击进程标签

Windows版本,按下结束任务或结束进程按钮。

*注意: 系统上运行的如果是Windows 9x/98/ME, 任务管理器可能不会显示某些进程。你需要其它的进程管理器来结束病毒进程。否则,继续下面操作的同时,注意附加提示。

Start>Run, Regedit,然后回车


HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run


ICQ Net = "%Windows%\winlogon.exe -stealth"
: %Windows% 是默认的Windows文件夹,通常是 C:\Windows C:\WinNT.

如果按照上面操作仍不能结束内存中运行的病毒进程,请重启你的系统。

使用趋势科技的防病毒产品扫描所有文件并删除检测出的 WORM_NETSKY.C 最新病毒码。其它的网络用户可以使用趋势科技的免费在线病毒扫描器 Housecall

 

 

返回原文

本文导航

相关阅读

每日精选

点击查看更多

首页 手机 数码相机 笔记本 游戏 DIY硬件 硬件外设 办公中心 数字家电 平板电脑