安哥變種fa是一種利用共享網路和beagle,mydoom等蠕蟲遺留下來的後門進行傳播的黑客程式。
Win32.Hack.Agobot-概述,Win32.Hack.Agobot-系統修改,
Win32.Hack.Agobot-概述
病毒別名：Backdoor.Agobot.gen【AVP】
處理時間：
威脅級別：★★
中文名稱：安哥變種fa
病毒類型：黑客程式
影響系統：Win9x/WinNT/Win2K/WinXP/Win2003
病毒行為:
編寫工具:
vc編寫,upx壓縮
傳染條件:
利用共享網路和beagle,mydoom等蠕蟲遺留下來的後門進行傳播
發作條件:
會開設後門等待攻擊者的遠程連線
Win32.Hack.Agobot-系統修改
1,拷貝自身到:
%System%msiwin84.exe
%System%Microsoft.exe
%System%WinMsrv32.exe
%System%soundcontrl.exe
%System%msawindows.exe
2,添加註冊表鍵值:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices
"Microsoft Update"="msiwin84.exe"
"Microsoft Update"="Microsoft.exe"
"WinMsrv32"="WinMsrv32.exe"
"soundcontrl"="soundcontrl.exe"
"Microsoft Update"="msawindows.exe"
3,修改hosts檔案
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
4,結束下列病毒的進程:
irun4.exe
Ssate.exe
i11r54n4.exe
winsys.exessgrate.exe
d3dupdate.exe
bbeagle.exerate.exe
5,在隨機tcp連線埠開設後門
6,可對預定的地址發動dos攻擊
7,對區域網路機器進行弱密碼攻擊:
%System%msiwin84.exe
%System%Microsoft.exe
%System%WinMsrv32.exe
%System%soundcontrl.exe
%System%msawindows.exe
2,添加註冊表鍵值:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices
"Microsoft Update"="msiwin84.exe"
"Microsoft Update"="Microsoft.exe"
"WinMsrv32"="WinMsrv32.exe"
"soundcontrl"="soundcontrl.exe"
"Microsoft Update"="msawindows.exe"
3,修改hosts檔案
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
4,結束下列病毒的進程:
irun4.exe
Ssate.exe
i11r54n4.exe
winsys.exessgrate.exe
d3dupdate.exe
bbeagle.exerate.exe
5,在隨機tcp連線埠開設後門
6,可對預定的地址發動dos攻擊
7,對區域網路機器進行弱密碼攻擊:
