病毒概述
病毒別名：
處理時間：2005-03-08
威脅級別：★★★
中文名稱：性感雞變種G
病毒類型：蠕蟲
影響系統：Win9x / WinNT
病毒行為:
該病毒為性感雞變種G,它通過MSN和已分享資料夾傳播,當用戶感染該病毒後,該病毒會修改hosts檔案,使眾多安全及反病毒公司網站地址重定位到MSN網站,有可能導致DDos攻擊,且無法正常這此安全公司的網站;禁止運行一些系統程式(如:任務管理器,msconfig.exe等),嚴重影響用戶的正常工作.
病毒特性
1.複製自身到系統目錄%System32%下:
svosm.exe
sysup.exe
2.複製自身到%SystemRoot%下:
msmpatch.exe
3.在系統盤根目錄下創建以下檔案:
Crazy.Html
dsm.exe
One Eye Granny pic!.pif
Me drunk at The Sea!.pif
Punk Lives! lol.pif
Me Love You Long Time.pif
Me pic.pif
hillbilly Chick lol.pif
Dumb Looking Goth Chick.pif
Hot Blonde!.pif
Modelling Her New Bikini.pif
Crazy Japanese man kicks crazy frog!.pif
Funny Hitler parody!.pif
My birthday pic!.pif
4.調用IE打開Crazy.Html檔案,該病毒有個計數器來統計有多少用戶感染了該病毒,如下圖:
5.修改註冊表使自身隨計算機啟而自動運行
DsmSer = "%System32%\svosm.exe"
AvSer = "%System32%\sysup.exe"
rollbk = "%SystemRoot%\msmpatch.exe"
HKEY_CURRENT_USER\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
6.修改hosts檔案,使眾多安全及反病毒公司網站重定向到MSN網站,有可能導致DDos攻擊,且無法正常登錄下列公司的網站:
213.199.154.54 www.symantec.com
213.199.154.54 www.sophos.com
213.199.154.54 www.mcafee.com
213.199.154.54 www.viruslist.com
213.199.154.54 www.f-secure.com
213.199.154.54 www.avp.com
213.199.154.54 www.kaspersky.com
213.199.154.54 www.networkassociates.com
213.199.154.54 www.ca.com
213.199.154.54 www.my-etrust.com
213.199.154.54 www.nai.com
213.199.154.54 www.trendmicro.com
213.199.154.54 www.grisoft.com
213.199.154.54 securityresponse.symantec.com
213.199.154.54 symantec.com
213.199.154.54 sophos.com
213.199.154.54 mcafee.com
213.199.154.54 liveupdate.symantecliveupdate.com
213.199.154.54 viruslist.com
213.199.154.54 f-secure.com
213.199.154.54 kaspersky.com
213.199.154.54 kaspersky-labs.com
213.199.154.54 avp.com
213.199.154.54 networkassociates.com
213.199.154.54 ca.com
213.199.154.54 mast.mcafee.com
213.199.154.54 my-etrust.com
213.199.154.54 download.mcafee.com
213.199.154.54 dispatch.mcafee.com
213.199.154.54 secure.nai.com
213.199.154.54 nai.com
213.199.154.54 update.symantec.com
213.199.154.54 updates.symantec.com
213.199.154.54 us.mcafee.com
213.199.154.54 liveupdate.symantec.com
213.199.154.54 customer.symantec.com
213.199.154.54 rads.mcafee.com
213.199.154.54 trendmicro.com
213.199.154.54 grisoft.com
213.199.154.54 sandbox.norman.no
213.199.154.54 www.pandasoftware.com
213.199.154.54 uk.trendmicro-europe.com
7.結束安全軟體和禁止運行一些系統程式(如:任務管理器,msconfig.exe等):
8.向MSN線上好友傳送病毒檔案
9.通網路已分享資料夾(如eMule)傳播自身,可能的檔案名稱如下:
MSN Display picture stealer.exe
MSN Messenger 7.exe
MSN Avatar Creator.exe
10.關閉包含以下字元串的視窗,從而達到保護病毒自身的目的:
ADWARE,ALERTS,ANTI,AUTOSTARTED,Avg,BENIGN,BLOCKER,BUG,BullGuard,BUSTER,CENTER,
CILLIN,CLEANER,CMD,Command,DESTROY,DETECTION,DOCTOR,EARTHLINK,EDITOR,ELIMINATE,
EYE,FIGHT,Filter,FIREWALL,FIX,FIXING,HEAL,HELP,HUNTER,KERIO,Kill,LABS,LIVEUPDATE,MALWARE,
MALWHERE,MCAFEE,NETCOP,NOD32,NORTON,PANDA,PROMPT,PROTECTOR,REGISTRY,REMOVAL,
RESTORE,SANDBOX,SCAN,SECURE,SECURITY,SOPHOS,SPY,SPYBOT,SPYWARE,STOPPER,
SWEEPER,TASK,TOOL,TREND,Update,VCATCH,VIRUS,WATCH,WORM,PROCESS ,
