恶性蠕虫－"赛舍"(Worm.Zezer)分析报告
发布时间：2019-06-17 19:58:09 所属栏目：编程 来源：蓝点
导读：> 病毒名称: Worm.Zezer 病毒长度: 22016Bytes 发嫡期:2003.10.09 处理赏罚日期:2003.10.09 中文名称: 赛舍 病毒别名: I-Worm.Zezer[AVP], W32.Zezer.Worm[Symantec] 病毒范例: 蠕虫 受影响体系: Win9xWin2KWinXP 威胁级别: 3B 该蠕虫操作邮件快速撒播，并
|
> 病毒名称:Worm.Zezer 病毒长度:22016Bytes 发嫡期:2003.10.09 处理赏罚日期:2003.10.09 中文名称:赛舍 病毒别名: I-Worm.Zezer[AVP], W32.Zezer.Worm[Symantec] 病毒范例:蠕虫 受影响体系: Win9xWin2KWinXP 威胁级别:3B 该蠕虫操作邮件快速撒播，并以微软的名义发送带毒邮件。病毒在宿主呆板上伪装成MSN的补丁安装措施来疑惑用户。 技能特性： 1、复制本身为： WindowsRoot%Mscsgs.exe、 %WindowsRoot%SystemMscsgs32.exe、 %WindowsRoot%Msn_inst.exe、 启动目次msnexec.exe 注：%WindowsRoot%为体系安装目次，凡是为"windows"或"winnt"。启动目次为“开始”菜单中“措施”组里的“启动”项。 2、禁用体系成果： HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem "DisableRegistryTools" = 1 以使Regedit.exe不能打开注册表。 3、添加启动项随机启动： HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun Mscsgs "%WindowsRoot%Mscsgs.exe" HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion RunServices "%WindowsRoot%SYSTEMMscsgs32.exe" 4、建设如下注册表项生涯病毒所需的信息： HKEY_CURRENT_USERSoftwareZedDozer Dozer "W32/Dozer by Zed" HKEY_CURRENT_USERSoftwareZedDozerMSNContacts 5、病毒假意如下邮箱地点向MSN接洽人发送带毒邮件： winpatch@microsoft.com services@microsoft.com msnsupport@microsoft.com helpdesk@microsoft.com security@microsoft.com windowsupdate@microsoft.com 附件名称："Msn_inst.exe" 邮件主题："Windows Update ( MSN Messenger Update 6 MSN Messenger vulnerability)" 邮件正文："Attention All Microsoft Users: A patch has been issued to correct a vulnerability in MSN Messenger which can be performed by a malicious user in order to gain unauthorized access to compromised computers. Windows users who have MSN Messenger 4.x and higher versions are affected by this vulnerability and must download and install the patch labeled , which is attached to this email message. For any support regarding this patch please contact support@microsoft.com for more information." (注，发送邮件行使worldcomputers.com这个处事器(不要写到消息稿中)) 6、封锁很多反病毒软件、收集防火墙、病毒防火墙： "_AVP.EXE" "_AVP32.EXE" "_AVPCC.EXE" "_AVPM.EXE" "ACKWIN32.EXE" "ANTI-TROJAN.EXE" "APVXDWIN.EXE" "AUTODOWN.EXE" "AVCONSOL.EXE" "AVE32.EXE" "AVGCTRL.EXE" "AVKSERV.EXE" "AVNT.EXE" "AVP.EXE" "AVP32.EXE" "AVPCC.EXE" "AVPDOS32.EXE" "AVPM.EXE" "AVPMON.EXE" "AVPNT.EXE" "AVPTC32.EXE" "AVPUPD.EXE" "AVSCHED32.EXE" "AVWIN95.EXE" "AVWUPD32.EXE" "BLACKD.EXE" "BLACKICE.EXE" "CCAPP.EXE" "CFIADMIN.EXE" "ESAFE.EXE" "CFIAUDIT.EXE" "CFIND.EXE" "CFINET.EXE" "CFINET32.EXE" "CLAW95.EXE" "CLAW95CF.EXE" "CLAW95CT.EXE" "CLEANER.EXE" "CLEANER3.EXE" "DV95.EXE" "DV95_O.EXE" "DVP95.EXE" "DVP95_0.EXE" "ECENGINE.EXE" "EFINET32.EXE" "ESPWATCH.EXE" "F-AGNT95.EXE" "FINDVIRU.EXE" "FPROT.EXE" "F-PROT.EXE" "FPROT95.EXE" "F-PROT95.EXE" "FP-WIN.EXE" "FRW.EXE" "F-STOPW.EXE" "IAMAPP.EXE" "IAMSERV.EXE" "IBMASN.EXE" "IBMAVSP.EXE" "ICLOAD95.EXE" "ICLOADNT.EXE" "ICMON.EXE" "ICMOON.EXE" "ICSSUPPNT.EXE" "ICSUPP95.EXE" "ICSUPPNT.EXE" "IFACE.EXE" "IOMON98.EXE" "JED.EXE" "JEDI.EXE" "KPF.EXE" "KPFW32.EXE" "LOCKDOWN2000.EXE" "LOOKOUT.EXE" "LUALL.EXE" "MOOLIVE.EXE" "MPFTRAY.EXE" "N32SCAN.EXE" "N32SCANW.EXE" "NAVAPW32.EXE" "NAVLU32.EXE" "NAVNT.EXE" "NAVSCHED.EXE" "NAVW.EXE" "NAVW32.EXE" "NAVWNT.EXE" "NISUM.EXE" "NMAIN.EXE" "NORMIST.EXE" "NUPGRADE.EXE" "NVC95.EXE" "OUTPOST.EXE" "PADMIN.EXE" "PAVCL.EXE" "PAVSCHED.EXE" "PAVW.EXE" "PCCWIN98.EXE" "PCFWALLICON.EXE" "PERSFW.EXE" "RAV7.EXE" "RAV7WIN.EXE" "RESCUE.EXE" "SAFEWEB.EXE" "SCAN32.EXE" "SCAN95.EXE" "SCANPM.EXE" "SCRSCAN.EXE" "SERV95.EXE" "SMC.EXE" "SPHINX.EXE" "SWEEP95.EXE" "TBSCAN.EXE" "TCA.EXE" "TDS2-98.EXE" "TDS2-NT.EXE" "VCONTROL.EXE" "VET32.EXE" "VET95.EXE" "VET98.EXE" "VETTRAY.EXE" "VSCAN40.EXE" "VSECOMR.EXE" "VSHWIN32.EXE" "VSSCAN40.EXE" "VSSTAT.EXE" "WEBSCAN.EXE" "WEBSCANX.EXE" "WFINDV32.EXE" "ZAPRO.EXE" "ZONEALARM.EXE" 7、操作体系收集配置来盗取存储于体系中的帐号及暗码 办理方案: 1、不要信托微软发送的补丁邮件，微软是不会以邮件方法发送补丁措施的，请行使Windows Update举办补丁进级； 2、为防备该病毒的入侵请尽快进级毒霸到最新，10月9日病毒库可处理赏罚该病毒； 3、手工破除要领： 对付WIN9X用户可以在纯DOS模式下删除以下病毒文件： %WindowsRoot%Mscsgs.exe、 %WindowsRoot%SystemMscsgs32.exe、 %WindowsRoot%Msn_inst.exe、 启动目次msnexec.exe 对付Win2000/WinXP用户，请行使历程打点器竣事名为：“Mscsgs.exe、Mcsgs32.exe、Msn_inst.exe、msnexec.exe”的历程，然后删除以下文件： %WindowsRoot%Mscsgs.exe、 %WindowsRoot%SystemMscsgs32.exe、 %WindowsRoot%Msn_inst.exe、 启动目次msnexec.exe 请下载金山毒霸的注册表修复器材( http://www.duba.net/download/3/8.shtml )，回恢对体系成果的限定，然后删除病毒在注册表中添加的项目： HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun Mscsgs "%WindowsRoot%Mscsgs.exe" HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion RunServices "%WindowsRoot%SYSTEMMscsgs32.exe" HKEY_CURRENT_USERSoftwareZedDozer Dozer "W32/Dozer by Zed" HKEY_CURRENT_USERSoftwareZedDozerMSNContacts 最后，将生涯在体系中的暗码都修改一次。好比：MSN的登录暗码，某些网站的登录暗码、邮箱的登录暗码等等。 作者：金山毒霸安详资讯网 （编辑：湖南网） 【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容! |
