Worm.Bagle.bw

Worm.Bagle.bw，該病毒通過郵件進行傳播,病毒會嘗試關閉計算機內的大量的軟體,並從網上下載檔案等。

基本介紹

• 中文名：惡鷹bw
• 外文名：Worm.Bagle.bw
• 類別：病毒
• 病毒類型：蠕蟲
• 處理時間：2005-08-10
• 威脅級別：★★
• 影響系統：Win 9x/ME,Win 2000/NT,Win XP,Win 2003

病毒行為

該病毒通過郵件進行傳播,病毒會嘗試關閉計算機內的大量的軟體,並從網上下載檔案，並且會在受感染的機器的檔案中搜尋電子郵件地址，並向搜尋到的地址傳送郵件。通過傳送各種軟體的序列號來誘惑用戶打開運行病毒程式。該病毒會向外傳送大量的帶毒郵件，嚴重影響到用戶的安全。

其他信息

生成檔案

C:\WINNT\System32\winhost.exe

添加起始項,使病毒開機運行

:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

嘗試下載下面的檔案

http://www.cardgoods.com/img/3.exe

搜尋

用戶計算機上的有效信箱地址,向外面傳送檔案:

郵件的傳送者通過一下組合:

域名為一下隨機一個:

@msn

@microsoft

@foo

@messagelab

@iana

@messagelab

@avp

傳送著為一下隨機一個:

rating@

f-secur

news

update

anyone@

bugs@

contract@

feste

gold-certs@

help@

info@

nobody@

noone@

kasp

admin

microsoft

support

ntivi

unix

bsd

linux

listserv

certific

sopho

free-av

winzip

google

winrar

samples

abuse

panda

cafee

spam

pgp noreply

local

root@

postmaster@

shar

郵件內容為一下隨機一段:

Read the attach.

Your file is attached.

Try this.

More info is in attach

See attach.

Please, have a look at the attached file.

Your document is attached.

Please, read the document.

Attach tells everything.

Attached file tells everything.

Check attached file for details.

Check attached file.

Pay attention at the attach.

See the attached file for details.

Message is in attach

Here is the file.

附屬檔案為病毒本身,命名為一下隨機一個:

Microsoft Office 2003 Crack, Working!.exe

Microsoft Windows XP, WinXP Crack, working Keygen.exe

Microsoft Office XP working Crack, Keygen.exe

Porno, sex, oral, anal cool, awesome!!.exe

Porno Screensaver.scr

Kaspersky Antivirus 5.0.exe

Porno pics arhive, xxx.exe

Windows Sourcecode update.doc.exe

Ahead Nero 7.exe

Windown Longhorn Beta Leak.exe

New document.doc.exe

XXX hardcore images.exe

WinAmp 6 New!.exe

hardcore arhive.exe

install.exe

important.exe

important update.exe

update.exe

patch.exe

New patch.exe

setup.exe

message.msg.exe

關閉一下軟體

OUTPOST.EXE

SAVSCAN.EXE

navapsvc.exe

NPROTECT.EXE

ccApp.exe

ccEvtMgr.exe

SymWSC.exe

NavShExt.dll

NMAIN.EXE

NORTON_INTERNET_SECU_3.0_407.EXE

NPF40_TW_98_NT_ME_2K.EXE

NPFMESSENGER.EXE

NPROTECT.EXE

NSCHED32.EXE

NTVDM.EXE

NVARCH16.EXE

KERIO-WRP-421-EN-WIN.EXE

KILLPROCESSSETUP161.EXE

LDPRO.EXE

LOCALNET.EXE

LOCKDOWN.EXE

LOCKDOWN2000.EXE

LSETUP.EXE

CLEANPC.EXE

AVprotect9x.exe

CMGRDIAN.EXE

CMON016.EXE

CPF9X206.EXE

CPFNT206.EXE

CV.EXE

CWNB181.EXE

CWNTDWMO.EXE

ICSSUPPNT.EXE

DEFWATCH.EXE

DEPUTY.EXE

DPF.EXE

PFSETUP.EXE

DRWATSON.EXE

ENT.EXE

ESCANH95.EXE

AVXQUAR.EXE

ESCANHNT.EXE

ESCANV95.EXE

AVPUPD.EXE

EXANTIVIRUS-CNET.EXE

FAST.EXE

FIREWALL.EXE

FLOWPROTECTOR.EXE

FP-WIN_TRIAL.EXE

FRW.EXE

FSAV.EXE

AUTODOWN.EXE

FSAV530STBYB.EXE

FSAV530WTBYB.EXE

FSAV95.EXE

GBMENU.EXE

GBPOLL.EXE

GUARD.EXE

GUARDDOG.EXE

HACKTRACERSETUP.EXE

HTLOG.EXE

HWPE.EXE

IAMAPP.EXE

IAMAPP.EXE

IAMSERV.EXE

ICLOAD95.EXE

ICLOADNT.EXE

ICMON.EXE

ICSUPP95.EXE

ICSUPPNT.EXE

IFW2000.EXE

IPARMOR.EXE

IRIS.EXE

JAMMER.EXE

ATUPDATER.EXE

AUPDATE.EXE

KAVLITE40ENG.EXE

KAVPERS40ENG.EXE

KERIO-PF-213-EN-WIN.EXE

KERIO-WRL-421-EN-WIN.EXE

BORG2.EXE

BS120.EXE

CDP.EXE

CFGWIZ.EXE

CFIADMIN.EXE

CFIAUDIT.EXE

AUTOUPDATE.EXE

CFINET.EXE

NAVAPW32.EXE

NAVDX.EXE

NAVSTUB.EXE

NAVW32.EXE

NC2000.EXE

NCINST4.EXE

AUTOTRACE.EXE

NDD32.EXE

NEOMONITOR.EXE

NETARMOR.EXE

NETINFO.EXE

NETMON.EXE

NETSCANPRO.EXE

NETSPYHUNTER-1.2.EXE

NETSTAT.EXE

NISSERV.EXE

NISUM.EXE

CFIAUDIT.EXE

LUCOMSERVER.EXE

AGENTSVR.EXE

ANTI-TROJAN.EXE

ANTI-TROJAN.EXE

ANTIVIRUS.EXE

ANTS.EXE

APIMONITOR.EXE

APLICA32.EXE

APVXDWIN.EXE

ATCON.EXE

ATGUARD.EXE

ATRO55EN.EXE

ATWATCH.EXE

AVCONSOL.EXE

AVGSERV9.EXE

AVSYNMGR.EXE

BD_PROFESSIONAL.EXE

BIDEF.EXE

BIDSERVER.EXE

BIPCP.EXE

BIPCPEVALSETUP.EXE

BISP.EXE

BLACKD.EXE

BLACKICE.EXE

BOOTWARN.EXE

NWINST4.EXE

NWTOOL16.EXE

OSTRONET.EXE

OUTPOSTINSTALL.EXE

OUTPOSTPROINSTALL.EXE

PADMIN.EXE

PANIXK.EXE

PAVPROXY.EXE

DRWEBUPW.EXE

PCC2002S902.EXE

PCC2K_76_1436.EXE

PCCIOMON.EXE

PCDSETUP.EXE

PCFWALLICON.EXE

PCFWALLICON.EXE

PCIP10117_0.EXE

PDSETUP.EXE

PERISCOPE.EXE

PERSFW.EXE

PF2.EXE

AVLTMAIN.EXE

PFWADMIN.EXE

PINGSCAN.EXE

PLATIN.EXE

POPROXY.EXE

POPSCAN.EXE

PORTDETECTIVE.EXE

PPINUPDT.EXE

PPTBC.EXE

PPVSTOP.EXE

PROCEXPLORERV1.0.EXE

PROPORT.EXE

PROTECTX.EXE

PSPF.EXE

WGFE95.EXE

WHOSWATCHINGME.EXE

AVWUPD32.EXE

NUPGRADE.EXE

WHOSWATCHINGME.EXE

WINRECON.EXE

WNT.EXE

WRADMIN.EXE

WRCTRL.EXE

WSBGATE.EXE

WYVERNWORKSFIREWALL.EXE

XPF202EN.EXE

ZAPRO.EXE

ZAPSETUP3001.EXE

ZATUTOR.EXE

CFINET32.EXE

CLEAN.EXE

CLEANER.EXE

CLEANER3.EXE

CLEANPC.EXE

CMGRDIAN.EXE

CMON016.EXE

CPD.EXE

CFGWIZ.EXE

CFIADMIN.EXE

PURGE.EXE

PVIEW95.EXE

QCONSOLE.EXE

QSERVER.EXE

RAV8WIN32ENG.EXE

REGEDT32.EXE

REGEDIT.EXE

UPDATE.EXE

RESCUE.EXE

RESCUE32.EXE

RRGUARD.EXE

RSHELL.EXE

RTVSCN95.EXE

RULAUNCH.EXE

SAFEWEB.EXE

SBSERV.EXE

SD.EXE

SETUP_FLOWPROTECTOR_US.EXE

SETUPVAMEEVAL.EXE

SFC.EXE

SGSSFW32.EXE

SH.EXE

SHELLSPYINSTALL.EXE

SHN.EXE

SMC.EXE

SOFI.EXE

SPF.EXE

SPHINX.EXE

SPYXX.EXE

ST2.EXE

SUPFTRL.EXE

LUALL.EXE

SUPPORTER5.EXE

SYMPROXYSVC.EXE

SYSEDIT.EXE

TASKMON.EXE

TAUMON.EXE

TAUSCAN.EXE

TC.EXE

TCA.EXE

TCM.EXE

TDS2-98.EXE

TDS2-NT.EXE

TDS-3.EXE

TFAK5.EXE

TGBOB.EXE

TITANIN.EXE

TITANINXP.EXE

TRACERT.EXE

TRJSCAN.EXE

TRJSETUP.EXE

TROJANTRAP3.EXE

UNDOBOOT.EXE

VBCMSERV.EXE

VBCONS.EXE

VBUST.EXE

VBWIN9X.EXE

VBWINNTW.EXE

VCSETUP.EXE

VFSETUP.EXE

VIRUSMDPERSONALFIREWALL.EXE

VNLAN300.EXE

VNPC3000.EXE

VPC42.EXE

VPFW30S.EXE

VPTRAY.EXE

VSCENU6.02D30.EXE

VSECOMR.EXE

VSHWIN32.EXE

VSISETUP.EXE

VSMAIN.EXE

VSMON.EXE

VSSTAT.EXE

VSWIN9XE.EXE

VSWINNTSE.EXE

VSWINPERSE.EXE

W32DSM89.EXE

W9X.EXE

WATCHDOG.EXE

WEBSCANX.EXE

CFIAUDIT.EXE

CFINET.EXE

ICSUPP95.EXE

MCUPDATE.EXE

CFINET32.EXE

CLEAN.EXE

CLEANER.EXE

LUINIT.EXE

MCAGENT.EXE

MCUPDATE.EXE

MFW2EN.EXE

MFWENG3.02D30.EXE

MGUI.EXE

MINILOG.EXE

MOOLIVE.EXE

MRFLUX.EXE

MSCONFIG.EXE

MSINFO32.EXE

MSSMMC32.EXE

MU0311AD.EXE

NAV80TRY.EXE

ZAUINST.EXE

ZONALM2601.EXE

ZONEALARM.EXE