2004年裡的病毒大佬--Mydoom看來是不希望廣大人民群眾過一個安樂祥和的踏實年了，隨著在年度十世界毒王的評選中一舉勝出之後，才休息沒多久，便易容重現江湖。 新變種依然依靠從受感染計算機中查找郵件地址，然後使用自帶的SMTP引擎，大規模的郵件發送來進行傳播。 其它命名：MyDoom.AI [F-Secure], W32/MyDoom-AA [Sophos], W32/Mydoom.ap@MM [McAfee] 病毒類型：蠕蟲 病毒長度：31，744字節 受影響系統：Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP 威脅程度：低 破壞能力：中 傳播能力：中 綜合評價：二級 病毒發作時： 1，創建如下文件： %system%\lsasrv.exe(病毒的拷貝) %system%\version.ini(一個無害的文本文件) %system%\hsery.sys(一個無害的二進制文件) 2，然後，自學教程，創建如下注冊表項： HEKY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersionRun\"lsass"="%system%\lsasrv.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersionWinlogon"Shell"="explorer.exe %system%\lsasrv.exe" 3，隨後，病毒在用戶的臨時文件夾下創建名為Mes#wtelw.txt文件，文件只包含垃圾數據，病毒使用記事本打開它，在它上面顯示垃圾內容。 4，隨後病毒從Windows地址薄以及帶有如下擴展名的文件中收集郵件地址： .adb .asa .asc .asm .asp .cgi .con .csp .dbx .dlt .dwt .edm .hta .htc .htm .inc .jsp .jst .lbi .php .rdf .rss .sht .ssi .stm .tbb .tpl .txt .vbp .vbs .wab .wml .xht .xml .xsd .xst 5，病毒不會將自己發送到含有如下字符串的郵件地址中去： accoun certific listserv ntivi support icrosoft admin page the.bat gold-certs feste submit not help service privacy ... ... 6，郵件內容： 病毒將使用如下域名之一來創建一個虛假的地址： - 來源： compuserve.com juno.com earthlink.net yahoo.co.uk hotmail.com yahoo.com msn.com aol.com 使用如下標題之一： Attention!!! Do not reply to this email Error Good day hello Mail Delivery System Mail Transaction Failed Server Report Status 附件有如下幾個命名： body message docs data file rules doc readme document 附件擴展名為如下之一： .bat .cmd .exe .scr .pif .zip 郵件文本內容如下： The message contains Unicode characters and has been sent as a binary attachment. The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment. Mail transaction failed. Partial message is available. Here are your documents you are requested. Thank you for registering at WORLDXXXPASS.COM All your payment info, login and password you can find in the attachment file. It's a real good choise to go to WORLDXXXPASS.COM Attention! New self-spreading virus! Be careful, a new self-spreading virus called "RTSW.Smash" spreading very fast via e-mail and P2P networks. It's about two million people infected and it will be more. To avoid your infection by this virus and to stop it we provide you with full information how to protect yourself against it and also including free remover. Your can find it in the attachment. c 2004 Networks Associates Technology, Inc. All Rights Reserved New terms and conditions for credit card holders Here a new terms and conditions for credit card holders using a credit cards for making purchase in the Internet in the attachment. Please, read it carefully. If you are not agree with new terms and conditions do not use your credit card in the World Wide Web. Thank you, The World Bank Group c 2004 The World Bank Group, All Rights Reserved Attention! Your IP was logged by The Internet Fraud Complaint Center Your IP was logged by The Internet Fraud Complaint Center. There was a fraud attempt logged by The Internet Fraud Complaint Center from your IP. This is a serious crime, so all records was sent to the FBI. All information you can find in the attachment. Your IP was flagged and if there will be anover attemption you will be busted. This message is brought to you by the Federal Bureau of Investigation and the National White Collar Crime Center
7，它將自己拷貝到名為Kazaa,morpheus,iMesh,eDonkey或者是LimeWire的共享文件夾中，文件擴展名為：.bat,.pif或者.exe： ·porno ·NeroBROM6.3.1.27 ·avpprokey ·Ad-awareref01R349 ·winxp_patch ·adultpasswds ·dcom_patches ·K-LiteCodecPack2.34a ·activation_crack ·icq2004-final ·winamp5 8，同時，它也嘗試去終止如下的進程，5自學網，包含防火牆及反病毒程序： i11r54n4.exe irun4.exe d3dupdate.exe rate.exe ssate.exe winsys.exe winupd.exe SysMonXP.exe bbeagle.exe Penis32.exe teekids.exe MSBLAST.exe mscvb32.exe sysinfo.exe PandaAVEngine.exe taskmon.exe wincfg32.exe outpost.exe zonealarm.exe navapw32.exe navw32.exe zapro.exe msblast.exe netstat.exe 9，下載或者。 10，將如下條目添加到%system%\drivers\etc\hosts文件夾中，以阻止用戶訪問反病毒網站： 127.0.0.1 127.0.0.1 securityresponse.symantec.com 127.0.0.1 symantec.com 127.0.0.1 127.0.0.1 sophos.com 127.0.0.1 127.0.0.1 mcafee.com 127.0.0.1 liveupdate.symantecliveupdate.com 127.0.0.1 127.0.0.1 viruslist.com 127.0.0.1 127.0.0.1 f-secure.com 127.0.0.1 kaspersky.com 127.0.0.1 kaspersky-labs.com 127.0.0.1 127.0.0.1 avp.com 127.0.0.1 127.0.0.1 127.0.0.1 networkassociates.com 127.0.0.1 127.0.0.1 ca.com 127.0.0.1 mast.mcafee.com 127.0.0.1 127.0.0.1 my-etrust.com 127.0.0.1 download.mcafee.com 127.0.0.1 dispatch.mcafee.com 127.0.0.1 secure.nai.com 127.0.0.1 127.0.0.1 nai.com 127.0.0.1 update.symantec.com 127.0.0.1 updates.symantec.com 127.0.0.1 us.mcafee.com 127.0.0.1 liveupdate.symantec.com 127.0.0.1 customer.symantec.com 127.0.0.1 rads.mcafee.com 127.0.0.1 127.0.0.1 trendmicro.com 127.0.0.1 127.0.0.1 grisoft.com
