Worm.Ariss.c
病毒名称(中文):
狂妄猎手
病毒别名:
威胁级别:
★★☆☆☆
病毒类型:
蠕虫病毒
病毒长度:
44544
影响系统:
Win9xWinNT
病毒行为:
这是一个通过邮件附件的方式传播的蠕虫，他会破坏用户计算机的保护措施，如，关闭防火墙，常见杀毒软件等，禁用注册表编辑器，还有一些恶意行为，如禁用开始菜单中的运行，隐藏硬盘分区，禁止用户进入Windows2000的MS－DOS方式，禁止显示"远程治理"，等为其他的病毒做铺垫。
1.生成文件：
IExplore.exe
MSLARISSA.pif
CmdPrompt32.pif
SP00Lsv32.pif
C:\WINDOWS\WinVBS.vbs
C:\MESSAGE_TO_USER.txt
C:\MESSAGE_TO_AVs.txt
C:\MESSAGE_TO_BROPIA.txt
2.注册表：
增加键值:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
MSLARISSA:MSLARISSA.pif
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CommandPrompt32：CmdPrompt32.pif
增加启动项，使病毒开机运行。
修改键值：
Software\Microsoft\Windows\CurrentVersion\Explorer\Sheelfol
设置病毒本身和IE的关联，做到一打开IE的同时病毒就被打开。
3.下载文件http://www.geocities.com/mslarissac/WindowsSecurityUpdate.zip
4.生成文件C:\MESSAGE_TO_USER.txt的内容
Greetztoinfecteduser!Iwillsurvive,Inthismomentintime."Yourcomputerwillcrash,So,youwillbemine.Iwillnotcrash,Iwillnotfail.So,inthismomentintime,Iwillsurvive...
-LARISSAAUTHOR:2-24-05
C:\MESSAGE_TO_AVs.txt的内容
GreetztoAVs!
IwannabeinAVindustrywhenIgrowup:-)
LARISSAAUTHOR:2-24-05
C:\MESSAGE_TO_BROPIA.txt
HeyBropia..stopmakingMSNwormsit",27h"sstupid......lol--LarissaAntiBropia...--SavingtheworldfromBROPIA!!!
-LARISSAAUTHOR:2-24-05
5.邮件的内容为下面的随机一洌?
Themessageislocatedintheattachments.
Theletteryourequestedisintheattachments.
Informationattached.
KindlyreadandreplytomyLOVELETTERintheattachments:-)
Thedocumentsyourequestedareintheattachments.
InforeguardingyourEmailaccountisintheattachments.
DearWindowsUserPleasedownloadthewindowsupdateincludedintheattachmen
Myletterisintheattachments.
Youremailaccountisabouttoexpire,pleasechecktheattachmentsfordetails.
6.邮件的随机主题
Re:Message
Re:Letter
Re:Information
ILOVEYOU
Re:YourDocuments
Re:AccountInfo
WindowsUpdate
Re:MyLetter
Re:Docs
Re:YourEmailInfo
7.邮件附件的随机名称：
Message.exe
Letter.exe
Information.exe
LOVE_LETTER_FOR_YOU.exe
Documents.exe
Attached_Message.exe
Microsoft_Update.exe
Private_Letter.exe
Private_Document.exe
Important_Message.exe
8.把病毒自己复制到下面目录里面：
"b:"
"c:"
"d:"
"e:"
"f:"
"g:"
"h:"
"i:"
"j:"
"k:"
"l:"
"m:"
"n:"
"o:"
"q:"
"r:"
"s:"
"t:"
"u:"
"v:"
"w:"
"x:"
"y:"
"z:"
9.病毒会关闭一些保护软件，也会关闭一些病毒
"AGENTSVR.EXE"
"ANTI-TROJAN.EXE"
"ANTIVIRUS.EXE"
"ANTS.EXE"
"APIMONITOR.EXE"
"APLICA32.EXE"
"APVXDWIN.EXE"
"ATCON.EXE"
"ATGUARD.EXE"
"ATRO55EN.EXE"
"ATUPDATER.EXE"
"ATWATCH.EXE"
"ZAPRO.EXE"
"ZAPSETUP3001.EXE"
"ZATUTOR.EXE"
"ZAUINST.EXE"
"ZONALM2601.EXE"
"ZONEALARM.EXE"
"AUPDATE.EXE"
"AUTODOWN.EXE"
"AUTOTRACE.EXE"
"AUTOUPDATE.EXE"
"AVCONSOL.EXE"
"AVGSERV9.EXE"
"AVLTMAIN.EXE"
"AVPUPD.EXE"
"AVSYNMGR.EXE"
"AVWUPD32.EXE"
"AVXQUAR.EXE"
"AVprotect9x.exe"
"Au.exe"
"BD_PROFESSIONAL.EXE"....
