病毒大百科

这是一个通过共享和即时聊天工具传播的蠕虫病毒，该病毒会把自己拷贝到系统共享目录及流行软件的共享目录。查找即时聊天工具的聊天窗口然后把自己发送出去，修改host文件。

1.生成文件:
%System%\win32svc.exe

2.添加注册表项起始项，使病毒开机启动:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Service Daemon
win32svc.exe

3.添加服务:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Windows Service Daemon
win32svc.exe

4.查找窗口类为AIM_IMessage的窗口;查找窗口类为Ate32Class等窗口,找到设置要发送的内容，内容为以下随即一个:
lol someone is posting with your email address on these forums?http://ce.freedomsnet.net/msnupdate.exe
wow.. is this you?
http://ce.freedomsnet.net/msnupdate.exe
found your picture! is this you? http://ce.freedomsnet.net/msnupdate.exe
haha, this guy got busted so bad.. http://ce.freedomsnet.net/msnupdate.exe
lmao i cant stop laughing at this! http://ce.freedomsnet.net/msnupdate.exe
omg... this doesn"t look right at all! http://ce.freedomsnet.net/msnupdate.exe

5.下载文件:
http://ce.***.net/msnupdate.exe

6.寻找以下共享目录，并且把自己拷贝到该目录下面，然后命名为以下随即一个:

\Program Files\Media\My Shared Folder\
\Program Files\LimeWire\Shared\
\Program Files\eDonkey2000\XINC\

Half Life 2 FULL.exe
How to Hack.exe
IP Changer.exe
Nero 7.exe
Half Life Serial Gen.exe
Visual Studio 2005.exe
Lord of the Rings.exe

7.修改host文件，使被感染机器无法升级安全软件:
127.0.7.33 symantec.com
127.0.7.33 www.symantec.com
127.0.7.33 securityresponse.symantec.com
127.0.7.33 sarc.com
127.0.7.33 www.sarc.com
127.0.7.33 www.sophos.com
127.0.7.33 sophos.com
127.0.7.33 www.mcafee.com
127.0.7.33 mcafee.com
127.0.7.33 liveupdate.symantecliveupdate.com .
127.0.7.33 www.viruslist.com
127.0.7.33 viruslist.com
127.0.7.33 f-secure.com
127.0.7.33 www.f-secure.com
127.0.7.33 f-prot.com
127.0.7.33 www.f-prot.com
127.0.7.33 kaspersky.com
127.0.7.33 kaspersky-labs.com
127.0.7.33 www.avp.com
127.0.7.33 avp.com
127.0.7.33 www.kaspersky.com
127.0.7.33 www.networkassociates.com
127.0.7.33 networkassociates.com
127.0.7.33 www.ca.com
127.0.7.33 ca.com
127.0.7.33 mast.mcafee.com
127.0.7.33 my-etrust.com
127.0.7.33 www.my-etrust.com
127.0.7.33 download.mcafee.com
127.0.7.33 dispatch.mcafee.com
127.0.7.33 secure.nai.com
127.0.7.33 www.nai.com
127.0.7.33 nai.com
127.0.7.33 update.symantec.com
127.0.7.33 updates.symantec.com
127.0.7.33 us.mcafee.com
127.0.7.33 liveupdate.symantec.com
127.0.7.33 customer.symantec.com
127.0.7.33 trendmicro.com
127.0.7.33 rads.mcafee.com
127.0.7.33 housecall.trendmicro.com
127.0.7.33 pandasoftware.com
127.0.7.33 www.pandasoftware.com
127.0.7.33 www.trendmicro.com
127.0.7.33 free.grisoft.com
127.0.7.33 www.grisoft.com
127.0.7.33 grisoft.com
127.0.7.33 clamav.net
127.0.7.33 www.clamav.net
127.0.7.33 free-av.com
127.0.7.33 www.free-av.com
127.0.7.33 www.avast.com
127.0.7.33 avast.com
127.0.7.33 cert.org
127.0.7.33 www.cert.org
127.0.7.33 www.microsoft.com
127.0.7.33 microsoft.com
127.0.7.33 www.virustotal.com
127.0.7.33 virustotal.com
127.0.7.33 update.microsoft.com
127.0.7.33 windowsupdate.microsoft.com