Worm.Myfip.h

病毒名称(中文):

病毒别名:

Worm.Win32.Myfib.h[avp]

威胁级别:

★★☆☆☆

病毒类型:

蠕虫病毒

病毒长度:

82944

影响系统:

Win9xWinNT

病毒行为:

该病毒是蠕虫病毒，通过局域网传播播病毒，它会试图用某些口令连结到以"Administrator"身份登录到局域网中其它机子偷取资料，它还会试图感染"explorer.exe"文件，蠕虫常驻程序被退出时，还是会重新启动

1。将自己复制到%system32%目录下，文件名为"kernel32dll.exe"。

2。创建名为"Meteo/EA[DCA]"的互斥量，以确保只有一个病毒文件在运行。

3。修改注册表以下键值以达到其自启动的目的。

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run

增加数据项："DistributedFileSystem"

数据值为："kernel32dll.exe"

4。查找"explorer.exe"进程，并在该进程中创建远程线程用于守护病毒进程。

5。搜索局域网中的其他计算机，并尝试用系统治理员用户名以及以下密码登录这些计算机

"Administrator"

"administrator"

"admin"

"Admin"

"administrator123"

"admin123456"

"administrator123456"

"administratorpasswd"

"adminpasswd"

"adminpwd"

"adminpasswd"

"password"

"Password"

"1234"

"12345"

"123456"

"1234567"

"12345678"

"123456789"

"87654321"

"7654321"

"654321"

"54321"

"000000"

"passwd"

"Passwd"

"00000000"

"0007"

"007007"

"0246"

"0249"

"#$％^"

"!@#$％^&"

"!@#$％^&*"

"root"

"daemon"

"bin"

"sys"

"adm"

"nobody"

"noaccess"

"freedom"

"1a2b3c"

"1p2o3i"

"1q2w3e"

"1qw23e"

"1sanjose"

"2004"

"2222"

"4444"

"love"

"4runner"

"7777"

"888888"

"99999999"

"#$％^&"

"a12345"

"a1b2c3"

"a1b2c3d4"

"aaaaaa"

"abby"

"abc123"

"abcd"

"abcd1234"

"abcde"

"abcdef"

"abcdefg"

"access"

"action"

"active"

"adam"

"mypc"

"mypc123"

"admin123"

"pw123"

"mypass"

"mypass123"

"asdf"

"asdfg"

"asdfgh"

"asdfghjk"

"asdfjkl"

"asdfjkl;"

"hacker"

"zxcvb"

"zxcvbnm"

"xxxx"

"test"

"test1"

……

6。假如登录成功，病毒将会把自己复制到该计算机的%system32%目录下，文件名为"Dfsvc.exe"。