|
1.针对查杀熊猫最猛烈的超级巡警 2.同样的文件名(GameSetup.exe),这点很明显,感染熊猫的共享木马下必有这个文件,杀软报的也就这个 3.猜解字典一样 4.Autorun模式一样
每隔2秒改写一次主页:www.51.vc 每隔6秒关闭以下服务: Schedule sharedaccess RsCCenter RsRavMon KVWSC KVSrvXP kavsvc AVP McAfeeFramework McShield McTaskManager 删除以下注册表: SOFTWARE/Microsoft/Windows/CurrentVersion/Run/RavTask SOFTWARE/Microsoft/Windows/CurrentVersion/Run/KvMonXP SOFTWARE/Microsoft/Windows/CurrentVersion/Run/kav SOFTWARE/Microsoft/Windows/CurrentVersion/Run/KAVPersonal50 SOFTWARE/Microsoft/Windows/CurrentVersion/Run/McAfeeUpdaterUI SOFTWARE/Microsoft/Windows/CurrentVersion/Run/Network Associates Error Reporting Service SOFTWARE/Microsoft/Windows/CurrentVersion/Run/ShStatEXE SOFTWARE/Microsoft/Windows/CurrentVersion/Run/YLive.exe( :D) SOFTWARE/Microsoft/Windows/CurrentVersion/Run/yassistse 停止并删除以下服务: RsCCenter RsRavMon KVWSC KVSrvXP AVP kavsvc McAfeeFramework McShield McTaskManager navapsvc wscsvc KPfwSvc SNDSrvc ccProxy ccEvtMgr ccSetMgr SPBBCSvc Symantec Core LC NPFMntor MskService FireSvc 每隔20分钟弹出IE,地址:www.51.vc 创建线程,关闭以下窗口: VirusScan NOD32 系统配置实用程序 Symantec AntiVirus Windows 任务管理器 esteem procs System Safety Monitor System Repair Engineer Wrapped gift Killer Winsock Expert 游戏木马检测大师 超级巡警 pjf(ustc) msctls_statusbar32 IceSword 天网防火墙 进程 网镖 杀毒 毒霸 瑞星 木马清道夫 注册表编辑器 Duba 卡巴斯基反病毒 绿鹰PC 木马辅助查找器 噬菌体 密码防盗 超级兔子 黄山IE 木馬清道夫 关闭以下程序: Mcshieid.exe VsTskMgr.exe naPrdMgr.exe UpdaterUI.exe TBMon.exe scan32.exe Ravmond.exe CCenter.exe RavTask.exe Rav.exe Ravmon.exe RavmonD.exe RavStub.exe KVXP.kxp KvMonXP.kxp KVCenter.kxp KVSrvXP.exe KRegEx.exe UIHost.exe TrojDie.kxp FrogAgent.exe Logo1_.exe Logo_1.exe Rundl132.exe 使用以下弱密码探测共享并试图传自己为GameSetup.exe过去: password 1234 6969 harley 123456 golf pussy mustang 1111 shadow 1313 fish 5150 7777 qwerty baseball 2112 letmein 12345678 12345 ccc admin 5201314 qq520 1 12 123 1234567 123456789 654321 54321 111 000000 abc pw 11111111 88888888 pass passwd database abcd abc123 sybase 123qwe server computer 520 super 123asd 0 ihavenopass godblessyou enable xp 2002 2003 2600 alpha 110 111111 121212 123123 1234qwer 123abc 007 a aaa patrick pat administrator root sex god foobar secret test test123 temp temp win pc asdf qwer yxcv zxcv home xxx owner login Login pw123 love mypc mypc123 admin123 mypass mypass123 901100 Administrator Guest admin Root
把自己复制到: /Documents and Settings/All Users/「开始」菜单/程序/启动/ /Documents and Settings/All Users/Start Menu/Programs/Startup/ /WINDOWS/Start Menu/Programs/Startup/ /WINNT/Profiles/All Users/Start Menu/Programs/Startup/ 连接: http://www.ac86.cn/88/down/up.txt 其中包括熊猫烧香 http://update.whboy.net/ie.txt 已无法访问 下载文件中的病毒程序
每隔8秒死循环访问如下网站: tom.com 163.com souhu.com google.com yahoo.com
每隔6秒向各盘根目录下释放如下文件 autorun.inf 内容: [AutoRun] OPEN=setup.exe shellexecute=setup.exe shell/Auto/command=setup.exe setup.exe(自己的安装exe) |
|
|