一種電腦病毒。病毒別名:W32.HLLW.Polybot, Phatbot, W32/Polybot.l!irc [McAfee], WORM_AGOBOT.HM [Trend], Backdoor.Agobot.hm [K
基本介紹
簡介,詳解,
簡介
影響系統:Win9x/WinMe/WinNT/Win2000/WinXp/Win2003
詳解
系統修改:
A、在系統目錄拷貝其自身為以下檔案之一:
%System%soundman.exe
%System%confgldr.exe
%System%spoolsvc.exe
%System%winwork.exe
%System%winhelp.exe
%System%csrs.exe
B、在註冊表主鍵:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices
下添加如下鍵值之一:
"^`d}qZxu" = "~`d}qzxu3zYF"
"Configuration Loader"="confgldr.exe"
"Video Process"="sysconf.exe"
"Service Host Process"="spoolsvc.exe"
"Winmsg"="winwork.exe"
"svchost"="winhelp.exe"
"csrs"="csrs.exe"
C、以以下名稱之一建立一個服務:
Configuration Loader
SoundMan
Service Host Process
D、隱藏包含字元"soun."的所有檔案;
E、在%System%driversetchosts檔案中添加以下行: