Mydoom:病毒大佬变脸再现江湖

2004年里的病毒大佬--Mydoom看来是不希望广大人民群众过一个安乐祥和的踏实年了，随着在年度十世界毒王的评选中一举胜出之后，才休息没多久，便易容重现江湖。

新变种依然依靠从受感染计算机中查找邮件地址，然后使用自带的SMTP引擎，大规模的邮件发送来进行传播。

其它命名：MyDoom.AI [F-Secure], W32/MyDoom-AA [Sophos], W32/Mydoom.ap@MM [McAfee]

病毒类型：蠕虫

病毒长度：31，744字节

受影响系统：Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

威胁程度：低

破坏能力：中

传播能力：中

综合评价：二级

病毒发作时：

1，创建如下文件：

%system%\lsasrv.exe(病毒的拷贝)

%system%\version.ini(一个无害的文本文件)

%system%\hsery.sys(一个无害的二进制文件)

2，然后，创建如下注册表项：

HEKY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersionRun\"lsass"="%system%\lsasrv.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersionWinlogon"Shell"="explorer.exe %system%\lsasrv.exe"

3，随后，病毒在用户的临时文件夹下创建名为Mes#wtelw.txt文件，文件只包含垃圾数据，病毒使用记事本打开它，在它上面显示垃圾内容。

4，随后病毒从Windows地址薄以及带有如下扩展名的文件中收集邮件地址：

.adb

.asa

.asc

.asm

.asp

.cgi

.con

.csp

.dbx

.dlt

.dwt

.edm

.hta

.htc

.htm

.inc

.jsp

.jst

.lbi

.php

.rdf

.rss

.sht

.ssi

.stm

.tbb

.tpl

.txt

.vbp

.vbs

.wab

.wml

.xht

.xml

.xsd

.xst

5，病毒不会将自己发送到含有如下字符串的邮件地址中去：

accoun

certific

listserv

ntivi

support

icrosoft

admin

page

the.bat

gold-certs

feste

submit

not

help

service

privacy

... ...

6，邮件内容：

病毒将使用如下域名之一来创建一个虚假的地址：

- 来源：

compuserve.com

juno.com

earthlink.net

yahoo.co.uk

hotmail.com

yahoo.com

msn.com

aol.com

使用如下标题之一：

Attention!!!

Do not reply to this email

Error

Good day

hello

Mail Delivery System

Mail Transaction Failed

Server Report

Status

附件有如下几个命名：

body

message

docs

data

file

rules

doc

readme

document

附件扩展名为如下之一：

.bat

.cmd

.exe

.scr

.pif

.zip

邮件文本内容如下：

The message contains Unicode characters and has been sent as a binary attachment.

The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.

Mail transaction failed. Partial message is available.

Here are your documents you are requested.

Thank you for registering at WORLDXXXPASS.COM

All your payment info, login and password you can find in the attachment file.

It's a real good choise to go to WORLDXXXPASS.COM

Attention! New self-spreading virus!

Be careful, a new self-spreading virus called "RTSW.Smash" spreading very fast via e-mail and P2P networks. It's about two million people infected and it will be more.

To avoid your infection by this virus and to stop it we provide you with full information how to protect yourself against it and also including free remover. Your can find it in the attachment.

c 2004 Networks Associates Technology, Inc. All Rights Reserved

New terms and conditions for credit card holders

Here a new terms and conditions for credit card holders using a credit cards for making purchase in the Internet in the attachment. Please, read it carefully. If you are not agree with new terms and conditions do not use your credit card in the World Wide Web.

Thank you,

The World Bank Group

c 2004 The World Bank Group, All Rights Reserved

Attention! Your IP was logged by The Internet Fraud Complaint Center

Your IP was logged by The Internet Fraud Complaint Center. There was a fraud attempt logged by The Internet Fraud Complaint Center from your IP. This is a serious crime, so all records was sent to the FBI.

All information you can find in the attachment. Your IP was flagged and if there will be anover attemption you will be busted.

This message is brought to you by the Federal Bureau of Investigation and the National White Collar Crime Center

7，它将自己拷贝到名为Kazaa,morpheus,iMesh,eDonkey或者是LimeWire的共享文件夹中，文件扩展名为：.bat,.pif或者.exe：

?porno

?NeroBROM6.3.1.27

?avpprokey

?Ad-awareref01R349

?winxp_patch

?adultpasswds

?dcom_patches

?K-LiteCodecPack2.34a

?activation_crack

?icq2004-final

?winamp5

8，同时，它也尝试去终止如下的进程，包含防火墙及反病毒程序：

i11r54n4.exe

irun4.exe

d3dupdate.exe

rate.exe

ssate.exe

winsys.exe

winupd.exe

SysMonXP.exe

bbeagle.exe

Penis32.exe

teekids.exe

MSBLAST.exe

mscvb32.exe

sysinfo.exe

PandaAVEngine.exe

taskmon.exe

wincfg32.exe

outpost.exe

zonealarm.exe

navapw32.exe

navw32.exe

zapro.exe

msblast.exe

netstat.exe

9，下载http://nermasteno.com/com.txt或者http://www.opsanted.com/com.txt。

10，将如下条目添加到%system%\drivers\etc\hosts文件夹中，以阻止用户访问反病毒网站：

127.0.0.1 www.symantec.com

127.0.0.1 securityresponse.symantec.com

127.0.0.1 symantec.com

127.0.0.1 www.sophos.com

127.0.0.1 sophos.com

127.0.0.1 www.mcafee.com

127.0.0.1 mcafee.com

127.0.0.1 liveupdate.symantecliveupdate.com

127.0.0.1 www.viruslist.com

127.0.0.1 viruslist.com

127.0.0.1 www.f-secure.com

127.0.0.1 f-secure.com

127.0.0.1 kaspersky.com

127.0.0.1 kaspersky-labs.com

127.0.0.1 www.avp.com

127.0.0.1 avp.com

127.0.0.1 www.kaspersky.com

127.0.0.1 www.networkassociates.com

127.0.0.1 networkassociates.com

127.0.0.1 www.ca.com

127.0.0.1 ca.com

127.0.0.1 mast.mcafee.com

127.0.0.1 www.my-etrust.com

127.0.0.1 my-etrust.com

127.0.0.1 download.mcafee.com

127.0.0.1 dispatch.mcafee.com

127.0.0.1 secure.nai.com

127.0.0.1 www.nai.com

127.0.0.1 nai.com

127.0.0.1 update.symantec.com

127.0.0.1 updates.symantec.com

127.0.0.1 us.mcafee.com

127.0.0.1 liveupdate.symantec.com

127.0.0.1 customer.symantec.com

127.0.0.1 rads.mcafee.com

127.0.0.1 www.trendmicro.com

127.0.0.1 trendmicro.com

127.0.0.1 www.grisoft.com

127.0.0.1 grisoft.com