Worm.Beagle.bb

Worm.Beagle.bb

該病毒通過郵件進行傳播，用戶運行郵件附屬檔案後，會嘗試關閉計算機內的反病毒軟體，並從網上下載一個後門。該蠕蟲，還會在受感染的機器的檔案中搜尋電子郵件，並向搜尋到的地址傳送郵件。誘惑用戶打開運行病毒程式。該病毒會向外傳送大量的帶毒郵件，嚴重的堵塞用戶網路。

基本介紹

  • 中文名：惡鷹bb
  • 外文名：Worm.Beagle.bb
  • 影響系統：Win9x / WinNT
  • 病毒長度：34304
病毒名片,病毒行為,刪除註冊表,添加註冊表項,病毒生成以下檔案,隱藏進程,嘗試關閉以下字元進程,修改Host檔案,嘗試下載後門,防範方式,

病毒名片

處理時間：2005-03-01
威脅級別：★★★

病毒行為

刪除註冊表

①刪除註冊表HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run中的以下鍵：
Symantec NetDriver Monitor
ccApp
NAV CfgWiz
SSC_UserPrompt
McAfee Guardian
APVXDWIN
KAV50
avg7_cc
avg7_emc
Zone Labs Client
②刪除註冊表
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
中的以下鍵
McAfee.InstantUpdate.Monitor
③刪除以下註冊表鍵
HKLM\SOFTWARE\Symantec
HKLM\SOFTWARE\McAfee
HKLM\SOFTWARE\KasperskyLab
HKLM\SOFTWARE\Agnitum
HKLM\SOFTWARE\Panda Software
HKLM\SOFTWARE\Zone Labs
以阻止安全軟體運行

添加註冊表項

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"winshost.exe" = "%system%\winshost.exe"

病毒生成以下檔案

%System%\winshost.exe（病毒本身）
%System%\wiwshost.exe

隱藏進程

嘗試遠程注入Explorer.exe，以隱藏進程

嘗試關閉以下字元進程

wuauserv
PAVSRV
PAVFNSVR
PSIMSVC
Pavkre
PavProt
PREVSRV
PavPrSrv
SharedAccess
navapsvc
NPFMntor
Outpost Firewall
SAVScan
SBService
Symantec Core LC
ccEvtMgr
SNDSrvc
ccPwdSvc
ccSetMgr.exe
SPBBCSvc
KLBLMain
avg7alrt
avg7updsvc
vsmon
CAISafe
avpcc
fsbwsys
backweb client - 4476822
backweb client-4476822
fsdfwd
F-Secure Gatekeeper Handler Starter
FSMA
KAVMonitorService
navapsvc
NProtectService
Norton Antivirus Server
VexiraAntivirus
dvpinit
dvpapi
schscnt
BackWeb Client - 7681197
F-Secure Gatekeeper Handler Starter
FSMA
AVPCC
KAVMonitorService
Norman NJeeves
NVCScheduler
nvcoas
Norman ZANDA
PASSRV
SweepNet
SWEEPSRV.SYS
NOD32ControlCenter
NOD32Service
PCCPFW
Tmntsrv
AvxIni
XCOMM
ravmon8
SmcService
BlackICE
PersFW
McAfee Firewall
OutpostFirewall
NWService
alerter
sharedaccess
NISUM
NISSERV
vsmon
nwclnth
nwclntg
nwclnte
nwclntf
nwclntd
nwclntc
wuauserv
navapsvc
Symantec Core LC
SAVScan
kavsvc
DefWatch
Symantec AntiVirus Client
NSCTOP
Symantec Core LC
SAVScan
SAVFMSE
ccEvtMgr
navapsvc
ccSetMgr
VisNetic AntiVirus Plug-in
McShield
AlertManger
McAfeeFramework
AVExch32Service
AVUPDService
McTaskManager
Network Associates Log Service
Outbreak Manager
MCVSRte
mcupdmgr.exe
AvgServ
AvgCore
AvgFsh
awhost32
Ahnlab task Scheduler
MonSvcNT
V3MonNT
V3MonSvc
FSDFWD

修改Host檔案

127.0.0.1 localhost
127.0.0.1 ad.doubleclick.net
127.0.0.1 ad.fastclick.net
127.0.0.1 ads.fastclick.net
127.0.0.1 ar.atwola.com
127.0.0.1 atdmt.com
127.0.0.1 avp.ch
127.0.0.1 avp.com
127.0.0.1 avp.ru
127.0.0.1 awaps.net
127.0.0.1 banner.fastclick.net
127.0.0.1 banners.fastclick.net
127.0.0.1 ca.com
127.0.0.1 click.atdmt.com
127.0.0.1 clicks.atdmt.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 download.microsoft.com
127.0.0.1 downloads.microsoft.com
127.0.0.1 engine.awaps.net
127.0.0.1 fastclick.net
127.0.0.1 f-secure.com
127.0.0.1 ftp.f-secure.com
127.0.0.1 ftp.sophos.com
127.0.0.1 go.microsoft.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 mast.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 media.fastclick.net
127.0.0.1 msdn.microsoft.com
127.0.0.1 my-etrust.com
127.0.0.1 nai.com
127.0.0.1 networkassociates.com
127.0.0.1 office.microsoft.com
127.0.0.1 phx.corporate-ir.net
127.0.0.1 secure.nai.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 service1.symantec.com
127.0.0.1 sophos.com
127.0.0.1 spd.atdmt.com
127.0.0.1 support.microsoft.com
127.0.0.1 symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 vil.nai.com
127.0.0.1 viruslist.ru
127.0.0.1 windowsupdate.microsoft.com
127.0.0.1 www.avp.ch
127.0.0.1 www.avp.com
127.0.0.1 www.avp.ru
127.0.0.1 www.awaps.net
127.0.0.1 www.ca.com
127.0.0.1 www.fastclick.net
127.0.0.1 www.f-secure.com
127.0.0.1 www.kaspersky.ru
127.0.0.1 www.mcafee.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.nai.com
127.0.0.1 www.networkassociates.com
127.0.0.1 www.sophos.com
127.0.0.1 www.symantec.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.viruslist.ru
127.0.0.1 ftp://ftp.kasperskylab.ru/updates/
127.0.0.1 ftp://ftp.avp.ch/updates/
127.0.0.1 http://www.kaspersky.ru/updates/
127.0.0.1 http://updates1.kaspersky-labs.com/updates/
127.0.0.1 http://updates3.kaspersky-labs.com/updates/
127.0.0.1 http://updates4.kaspersky-labs.com/updates/
127.0.0.1 http://updates2.kaspersky-labs.com/updates/
127.0.0.1 http://updates5.kaspersky-labs.com/updates/
127.0.0.1 http://downloads1.kaspersky-labs.com/updates/
127.0.0.1 http://www.kaspersky-labs.com/updates/
127.0.0.1 ftp://updates3.kaspersky-labs.com/updates/
127.0.0.1 ftp://downloads1.kaspersky-labs.com/updates/
127.0.0.1 www3.ca.com
127.0.0.1 ids.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 download.mcafee.com
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com

嘗試下載後門

嘗試從以下網站下載後門
http://www.***nit.ru/zo2.jpg
http://www.***honyflanagan.com/zo2.jpg
http://www.***roved1stmortgage.com/zo2.jpg
http://www.***ument.h12.ru/zo2.jpg
http://www.***ebek.de/zo2.jpg
http://www.***ek.org/zo2.jpg
http://www.***anfestival.nl/zo2.jpg
http://www.***ergut.at/zo2.jpg
http://www.***ation-center.de/zo2.jpg
http://www.***h.org/zo2.jpg
http://www.***ino.com/zo2.jpg
http://www.***tbuy.de/zo2.jpg
http://www.***a.mtw.ru/zo2.jpg
http://www.***-gsm.ru/zo2.jpg
http://www.***ssino.com/zo2.jpg
http://www.***eeyeinc.com/zo2.jpg
http://www.***aklight.be/zo2.jpg
http://www.***esko.net.pl/zo2.jpg
http://www.***system.com.kg/zo2.jpg
http://www.***partner.com.pl/zo2.jpg
http://www.***kyhosting.cz/zo2.jpg
http://www.***nneland.com/zo2.jpg
http://www.***psolutionstore.com/zo2.jpg
http://www.***cept.kg/zo2.jpg
http://www.***psite.com/zo2.jpg
http://www.***poncapital.net/zo2.jpg
http://www.***rkSydebaby.com/zo2.jpg
http://www.***ut-westerhoven.nl/zo2.jpg
http://www.***.kg/zo2.jpg
http://www.***rollendedisco.de/zo2.jpg
http://www.***cobaradventure.be/zo2.jpg
http://www.***fo.com/zo2.jpg
http://www.***ower.com.cn/zo2.jpg
http://www.***bank.kg/zo2.jpg
http://www.***nalazar.com/zo2.jpg
http://www.***cbiz.com/zo2.jpg
http://www.***opa.kg/zo2.jpg
http://www.***rett.wednet.edu/zo2.jpg
http://www.***ernet.hu/zo2.jpg
http://www.***ester.kg/zo2.jpg
http://www.***ocliparts.de/zo2.jpg
http://www.***onw.org/zo2.jpg
http://www.***esites.com.br/zo2.jpg
http://www.***bunker.de/zo2.jpg
http://www.***world.tv/zo2.jpg
http://www.***[email protected]/zo2.jpg
http://www.***-bln.de/zo2.jpg
http://www.***et.ru/zo2.jpg
http://www.***ntrevenue.com/zo2.jpg
http://www.***psi.org/zo2.jpg
http://www.***vr.com/zo2.jpg
http://www.***gmart.net/zo2.jpg
http://www.***-group.net/zo2.jpg
http://www.***usionoflife.net/zo2.jpg
http://www.***ocuspromo.com/zo2.jpg
http://www.***naswelt.de/zo2.jpg
http://www.***senboiler.com/zo2.jpg
http://www.***net.pl/zo2.jpg
http://www.***ibeiro.com/zo2.jpg
http://www.***elleryamberproducts.com/zo2.jpg
http://www.***vann.com/zo2.jpg
http://www.***r.ca/zo2.jpg
http://www.***danramey.net/zo2.jpg
http://www.***-musik-sound.de/zo2.jpg
http://www.***trepublicans.com/zo2.jpg
http://www.***el.kg/zo2.jpg
http://www.***cks.nl/zo2.jpg
http://www.***bers.pl/zo2.jpg
http://www.***aionon.com/zo2.jpg
http://www.***us.kg/zo2.jpg
http://www.***dtraining.de/zo2.jpg
http://www.***nenberg.de/zo2.jpg
http://www.***nenberg.de:113547@/zo2.jpg
http://www.***rus.com.pl/zo2.jpg
http://www.***online.de/zo2.jpg
http://www.***elaino.com/zo2.jpg
http://www.***form.com.au/zo2.jpg
http://www.***texgroup.com/zo2.jpg
http://www.***hrak.de/zo2.jpg
http://www.***hrak.de:prophets@/zo2.jpg
http://www.***oseiten.de/zo2.jpg
http://www.***icbottle.com.tw/zo2.jpg
http://www.***server.cz/zo2.jpg
http://www.***a-spass.com/zo2.jpg
http://www.***a.kg/zo2.jpg
http://www.***bisu.de/zo2.jpg
http://www.***mh.de/zo2.jpg
http://www.***design.com/zo2.jpg
http://www.***ansit.kg/zo2.jpg
http://www.***tech.kg/zo2.jpg
http://www.***onfotoshare.com/zo2.jpg
http://www.***osti.kg/zo2.jpg
http://www.***kg/zo2.jpg
http://www.***positiveplace.org/zo2.jpg
http://www.***ine.kg/zo2.jpg
http://www.***ngesuburban.5u.com/zo2.jpg
http://www.***.ch/zo2.jpg
http://www.***eantpage.com/zo2.jpg
http://www.***kration.com/zo2.jpg
http://www.***a-agility.com/zo2.jpg
http://www.***racing.net/zo2.jpg
http://www.***dfinder-leobersdorf.com/zo2.jpg
http://www.***ni.cz/zo2.jpg
http://www.***stk.edu.pl/zo2.jpg
http://www.***izeimotorrad.de/zo2.jpg
http://www.***way-consulting.com/zo2.jpg
http://www.***etsoundyc.org/zo2.jpg
http://www.***landia-boogie.pl/zo2.jpg
http://www.***oto.co.za/zo2.jpg
http://www.***coinc.com/zo2.jpg
http://www.***lgps.com/zo2.jpg
http://www.***lty.kg/zo2.jpg
http://www.***lightpictures.com/zo2.jpg
http://www.***iance-yachts.com/zo2.jpg
http://www.***ocationflorida.com/zo2.jpg
http://www.***talstation.com/zo2.jpg
http://www.***raquadros.com.br/zo2.jpg
http://www.***ming.kg/zo2.jpg
http://www.***ohalle.be/zo2.jpg
http://www.***nex-medical.fi/zo2.jpg
http://www.***ping4success.com/zo2.jpg
http://www.***t.ru/zo2.jpg
http://www.***i.lu/zo2.jpg
http://www.***dochron.pl/zo2.jpg
http://www.***.kg/zo2.jpg
http://www.***ifc.ca/zo2.jpg
http://www.***dtmeyers.de/zo2.jpg
http://www.***dtmeyers.de:R2D2c3po@/zo2.jpg
http://www.***rlingirb.com/zo2.jpg
http://www.***assetholdings.com/zo2.jpg
http://www.***ntomierz.art.pl/zo2.jpg
http://www.***sa.pl/zo2.jpg
http://www.***bourenvereine.ch/zo2.jpg
http://www.***now.opoka.org.pl/zo2.jpg
http://www.***muraene.com/zo2.jpg
http://www.***muraene.com:hunter@/zo2.jpg
http://www.***royalregistry.com/zo2.jpg
http://www.***nsportation.gov.bh/zo2.jpg
http://www.***ar.kg/zo2.jpg
http://www.***guska.hu/zo2.jpg
http://www.***keyhomes.com/zo2.jpg
http://www.***keyhomes.com@/zo2.jpg
http://www.***iano.org/zo2.jpg
http://www.***city.pl/zo2.jpg
http://www.***.info/zo2.jpg
http://www.***ezcourtesymanagement.com/zo2.jpg
http://www.***rix.com/zo2.jpg
http://www.***park.pl/zo2.jpg
http://www.***ompete.com/zo2.jpg
http://www.***pl/zo2.jpg
http://www.***ebad.com/zo2.jpg
http://www.***ger321.wz.cz/zo2.jpg
http://www.***diamonds.com/zo2.jpg
http://www.***der-yachting.com/zo2.jpg

防範方式

注意收到郵件題目是否有"Re:IncomingMessage"、"Re:Hello"、"Re:Thanks:)"、"Incomingmessage”等文字，附屬檔案名字是否為為"Details"、"Message"、"Readme"、"Info"等，如果有，或者郵件由不明用戶發來的時候，一定要使用最新版的防毒軟體對其進行掃描，以免中毒。

熱門詞條

聯絡我們