[讨论]：近段时间老是有恶意邮件带有病毒Worm.NetSky.c，你遇到吗？

菜丁

近段时间老是有恶意邮件带有病毒Worm.NetSky.c，你遇到吗？

ctiger

也是每天都收到,而且是几封.

XDSoft

最初由 菜丁 发布
[B]近段时间老是有恶意邮件带有病毒Worm.NetSky.c，你遇到吗？ [/B]

我每天都有好几百封，找到有用的信太不容易了。

自由的鱼

我以前每天也收到好多，现在我设置了过滤，情况好多了！

武陵山人

最初由 ctiger 发布
[B]也是每天都收到,而且是几封. [/B]

这么少？我的163邮箱每天都是600封，找有用的邮件眼都看花-:(

popxi

我的一邮箱也是，最近老有病毒邮件，以前没发现过。我怀疑我的邮箱地址是那个800兆的网上活动硬盘（ http://www2.chinamofile.com/save.jsp ）散布出去的。建议大家少用为好。

alwaysbin

非常同情5楼的遭遇，这是一个木马病毒，是netsky的一个变种。

一旦执行,病毒将执行以下操作:

1.本地首先将创建一个名为:"[SkyNet.cz]SystemsMutex."的互斥量来保证只运行病毒的一个副本;

2.复制自己到windows目录下:

%WINDIR%\Winlogon.exe;

3.添加如下键值:

"ICQ Net" = "%WINDIR%\winlogon.exe -stealth"

到注册表键:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 下,这是病毒自启动的伎俩;



删除键:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

下的如下键值:

Taskmon
Explorer
Windows Services Host
KasperskyAV

删除键:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

下的如下键值:

System.
msgsvr32
DELETE ME
service
Sentry

删除键:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

下的如下键值:

d3dupdate.exe
au.exe
OLE

删除键:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

下的如下键值:

System.

删除子键:

HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32

其中键值:
"KasperskyAV"是病毒:"Worm.Mimail.t"的自启动键值;
"Taskmon" 和"Explorer"是病毒:"SCO炸弹"的键值.

4.病毒从带有下列扩展名的文件中搜索Email地址:

.eml
.txt
.php
.pl
.htm
.html
.vbs
.rtf
.uin
.asp
.wab
.doc
.adb
.tbb
.dbx
.sht
.oft
.msg
.shtm
.cgi
.dhtm

5.病毒从C:\到Z:\搜索带有如下字眼的文件夹:

"Shar"

只要该文件夹所在的驱动器不是CD_ROM,病毒就将复制自己到这个文件夹和此文件夹的所有子目录下
文件名可能为下列之一:

Microsoft WinXP Crack.exe
Teen Porn 16.jpg.pif
Adobe Premiere 9.exe
Adobe Photoshop 9 full.exe
Best Matrix Screensaver.scr
Porno Screensaver.scr
Dark Angels.pif
XXX hardcore pic.jpg.exe
Microsoft Office 2003 Crack.exe
Serials.txt.exe
Screensaver.scr
Full album.mp3.pif
Ahead Nero 7.exe
Virii Sourcecode.scr
E-Book Archive.rtf.exe
Doom 3 Beta.exe
How to hack.doc.exe
Learn Programming.doc.exe
WinXP eBook.doc.exe
Win Longhorn Beta.exe
Dictionary English - France.doc.exe
RFC Basics Full Edition.doc.exe
1000 Sex and more.rtf.exe
3D Studio Max 3dsmax.exe
Keygen 4 all appz.exe
Windows Sourcecode.doc.exe
Norton Antivirus 2004.exe
Gimp 1.5 Full with Key.exe
Partitionsmagic 9.0.exe
Star Office 8.exe
Magix Video Deluxe 4.exe
Clone DVD 5.exe
MS Service Pack 5.exe
ACDSee 9.exe
Visual Studio Net Crack.exe
Cracks & Warez Archive.exe
WinAmp 12 full.exe
DivX 7.0 final.exe
Opera.exe
IE58.1 full setup.exe
Smashing the stack.rtf.exe
Ulead Keygen.exe
Lightwave SE Update.exe
The Sims 3 crack.exe


6.病毒使用自带的SMTP引擎向上面搜到的Email地址发送带毒邮件:

邮件带有如下特征:

From: (Spoofed)

标题为下列之一:

Delivery Failed
Status
report
question
trust me
hey
Re: excuse me
read it immediatelly
hi
Re: does it?
Yep
important
hello
dear
Re: unknown
fake?
warning
moin
what's up?
info
Re: information
Here is it
stolen
private?
good morning
illegal...
error
take it
re:
Re: Re: Re: Re:
you?
something for you
exception
Re: hey
excuse me
Re: hi
Re: does it?
Re: important
Re: hello
believe me
Question
denied!
notification
Re: <5664ddff?$??o2>
lol
last chance!
I'm back!
its me
notice!


消息正文为下列之一:




what means that?
help attached
<...>
ok...

that is interesting...
i wait for your comment about it.
such as yours?
read the details.
gonna?
here is the document.
*lol*
read it immediately!
i found that about you!
your hero in the picture?
yours?
here is it.
illegal st. of you?
is that true?
account?
is that your name?
picture?
message?
is that your account?
pwd?
I wait for an answer!
abuse?
is that yours?
you are a bad writer
I don't know your document!

I have your password!
you won the rk!
something about you!
classroom test of you?
kill the writer of this document!
old photos about you?
i hope thats not true!
your name is wrong!
does it match?
i found this document about you.
time to fear?
really?
do you know this????
i know your

litie123

谢了，我也老遇到这种情况

BlueFox

我遇到的是另一个变种，把我的OFFICE文档都删掉了