Worm.Kelvir.bm

病毒名称(中文):

病毒别名:

威胁级别:

★☆☆☆☆

病毒类型:

蠕虫病毒

病毒长度:

6535

影响系统:

Win9xWinMeWinNTWin2000WinXPWin2003

病毒行为:

这是一个通过msn传播的蠕虫病毒，该病毒能自动查找msn窗口，给用户的所有好友发送特定信息和病毒文件的链接，欺骗好友点击。一旦点击就回中毒。

1，发送下列消息给msn好友：

Checkthisnakedscreensaver,wow,it"ssocool!!

Lookwhatmydadgaveme!!

Thisguyhasonebigcock,lol!

Wow,whatachick,sheissobeautiful

Checkme,imadethis,veryeasyhaha!

huhuhuvingerindiepoepert

和下列链接:

***.com/4uqjx

***.com/6qqmv

***.com/5q2c2

***.com/5f49e

***.com/6o2e

2，一旦点击，便释放病毒文件到下列目录

"%Windows%\Service.exe

3，添加注册表项目；

HKEY_CURRENT_USER\SOFTWARE\Microsoft\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CurrentVersion\Run

"WindowsScreensaver"="%Windows%\Service.exe"

4，关闭下列安全软件：

Zonealarm

TrueVectorInternetMonitor

NortonAntiVirusClient

NortonAntivirusAutoProtectService

NortonInternetSecurityAccountsManager

NortonInternetSecurityProxyService

NortonInternetSecurityService

NortonAntiVirusServerNortonAntiVirusAutoProtectService

CFINET32

SymantecAntiVirusClient

McShield

IPSECPolicyAgent

DefWatch

WMDMPMSPService

SymantecProxyService

SymantecEventManager

NortonAntiVirusCorporateEdition

ViRobotProfessionalMonitoring

AVP.EXE

ViRobotExpertMonitoring

savroam

symantecantivirus

ViRobotLiteMonitoring

PC-cillinPersonalFirewall

TrendMicroProxyService

TrendNTRealtimeService

McAfee.comMcShield

等等