§ 名称

Worm.Beagle.c病毒

§ 相关资料

病毒信息

病毒名称:Worm.Beagle.c

中文名称: 恶鹰变种C

威胁级别: 3A

病毒别名:

贝革热

雏鹰 【江民】

病毒类型: 蠕虫、后门

受影响系统: Win9x/Win2000/WinXP/Win2003

技术特点：

1、传染条件

利用邮件高速传播。

2、发作条件

检查计算机日期，如果当前日期是在2004年3月25日之后，病毒将卸载自己并退出。

3、系统修改

A、拷贝病毒自身到%System%下为i1ru54n4.exe

B、创建如下文件:

%System%\\\\go54o.exe

%System%\\\\ii5nj4.exe

%System%\\\\i1ru54n4.exeopen

C、将go54o.exe当做dll插入到explorer.exe的地址空间中，完成邮件发送功能。

D、添加如下注册表项：

HKEY_CURRENT_USER\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run

"rate.exe"="%System%\\\\i1ru54n4.exe"

HKEY_CURRENT_USER\\\\SOFTWARE\\\\winword "frun"="1"

4、技术特征

A、搜索本地磁盘的如下后缀文件中的email地址，发送带毒邮件：

.adb ;.asp ;.cfg ;.dbx ;.eml ;.htm ;.mdx ;.mmf ;.nch ;.ods ;.php ;.pl ;

.sht ;.tbb ;.txt ;.wab ;.xml

B、病毒使用自己的邮件发送引擎发送邮件，发送邮件的格式如下：

可能为如下主题：

^_^ meay-meay! ; ^_^ mew-mew (-: ; Aline ;Anna ;Audra ;Bad girl ;

Barbi ;beautiful ;Caitie ;caroline ;ello! =)) ;Fotograf ;Gallery photos ;

groom ;Hey, ;ude, it\\'s me ^_^ :P ;Hey, ya! =)) ;Hi! :-) ;Hokki =) ;Jammie ;

Juli ;Julie ;kate ;Katrina ; Kelley ; kleopatra ;Lisa ;Mandy ;Mary ;

Mary-Anne ;My beautiful person ;My Name is Frenk ;My photoalbum ;

My photos ;Myphotos ;Photoalbum ;rebecca ;Rena ;Sara ;stacy ;ammy ;

Wau... beautiful (-: ; Weah, hello! :-) ; Weeeeee! ;)));

正文为如下随机一条：

Body: (Chosen randomly from:)

Argh, i don\\'t like the plaintext :)

Fell free to chat with me I accept all ages. Don\\'\\'\\'\\'t worry I don\\'\\'\\'\\'t

bite........hope to hear from you soon!

Hey people whats goin on? If there is anything you want to know about me

ask me... I am pretty easygoing I won\\'t bite....not at first anywayz hahaa.....one thing I will say on here tho I am not into the Cyber thing

so don\\'t even ask.....Ciao...

Hey, guys! by the way, I have no problems with my sexual life,

so it\\'s absolutly useless try to have icq sex or things like that. Thanks

Hi! My name is Shreya and I am a goof off!!! So, If you love the outdoors,

travelling, books, music, movies, laffing, teasing and/or can poke fun at

yourself... please come a hollerin\\'!!

I am from Taiwan but I study in Camden, New Jersey now. I like to know

people from different places .

I enjoy clean conversations but am open to conversing with women and men

with little ones as well. I am very open-minded. All authorization requests

will be denied if I don\\'t receive messages and get to know you first.

I like to be in a company of smart, delicate, and with a good sense of

humor people. I am Bulgarian, currently getting my Master\\'s in International

Business in USA. Favorite actor: Michael Dudikoff

I love camping, dirt track racing, going for walks, and I have 2

cats - HotRod and Deebo (named from the movie \\'Friday\\' and he lives up

to it!). Life is ever changing, never always easy...

I love meeting new people and making new friends. I am a Mary Kay Beauty

Consultant. I am married to a wonderful man. We have no children, exept for

a minature schnauzer that thinks he is a child. Looking forward to meeting

you. i love to chat to just about anyone!!

I love to dance, read poetry, make people laugh, and hug as many people a day

as i can.

I sit with elders of a gentle race, whose world is seldom seen.Who sit

and talk of days for which they wait, when all will be revealed. These are

song lyrics.

If I\\'m online, it problably means I\\'m pretty bored....so feel free to

message me and say hi or whatever else comes to mind at the moment.

If you are going to make me cry, at least be there to wipe away the tears

*Right now the worst thing for you to tell me that I can find someone

better than you, especially when you are all I want

I\\'m a social butterfly and a natural flirt. Very hard to get my complete

attention. Very open and will answer almost anything. But please don\\'t piss

me off. I can be sweet and cuddly or a whatever mood I am in that day so everyday

I\\'m an open minded person and enjoy chatting w/ other people. I\\'m free

and willing to chat about anything. So feel free to Imed me if you wanna chat.

I\\'m married and I stay at home. And I don\\'t do cyber sex so leave me

the fuck alone

i\\'m tall and skiny I\\'m studying in Pharm. D program in FL. i like music,

movie, dancing, sports, SCUBA diving, traveling and make a lot friends.

Looking forward for a response :P

Love the outdoors, literature, writing, and athletics

My hobbies include crochet, sewing, painting lead figures and playing

AD&D.

Favorite activities include fishing and camping. I love cats,

unicorns(go figure), and fantasy in general.

Nice friends, nice men, nice sex and feeling great. I don\\'t mind the odd

bout of cybersex as I love to use my imagination when I masterbate.

Single Mom of 3, Full time college student, Graduate in December with

an Associates of Applied Science in Computer Information Systems Love the internet.

When The Trust is Gone So Is The Love That Fades Like the Rain Washing Away

All The Sorrows Of Yesterday Why I Ask Myself Must It End Like This Tomorrow,

I Tell Myself, I\\'ll Be Okay For Now, I\\'ll Just Live In The Memories Of Our

Life Together

You don\\'t know what you\\'ve got till it\\'s gone *You hurt me more than I

deserve, how can you be so cruel? I love you more than you deserve, how can

I be such a fool?

如果病毒选择了加密的ZIP压缩包做附件，正文中会包含如下字符串之一：

archive password: %s

password: %s

pass: %s

password for archive: %s

可能的附件名称为：

Aline ;Anna ;Audra ;Bad girl ;Barbi ;Caitie ;caroline ;Gallery ;It_I ;

Jammie ;Juli ;Julie ;kate ;Katrina ;Kelley ;kleopatra ;Lisa ;Mandy ;Mary ;

Mary-Anne ;myfotos ;Photoalbum ;hotomontage ;Picture ;rebecca ;Rena ;Sara ;

stacy ;Tammy

病毒不发送任何邮件到包含有如下字符串的邮件地址中去：

@avp.

@hotmail.com

@microsoft

@msn.com

local

noreply

postmaster@

root@

C、病毒会通过网络文件共享传播，病毒会复制自己到名字包含有"shar"的文件夹中去, 文件名为如下名称：

ACDSee 9.exe

Adobe Photoshop 9 full.exe

Ahead Nero 7.exe

Matrix 3 Revolution English Subtitles.exe

Microsoft Office 2003 Crack, Working!.exe

Microsoft Office XP working Crack, Keygen.exe

Microsoft Windows XP, WinXP Crack, working Keygen.exe

Opera 8 New!.exe

Porno pics arhive, xxx.exe

Porno Screensaver.scr

Porno, sex, oral, anal cool, awesome!!.exe

Serials.txt.exe

WinAmp 5 Pro Keygen Crack Update.exe

WinAmp 6 New!.exe

Windown Longhorn Beta Leak.exe

Windows Sourcecode update.doc.exe

XXX hardcore images.exe

5、发作现象:

病毒主程序使用“文件夹”文件的图标，如《附图》：

解决方案:

A、金山毒霸已经于3月1日对该病毒进行了应急处理，请升级最新版可完全查该病毒；

B、请一定留意收到的邮件，如果有附件，请不要打开附件，更不要执行附件中的可执行程序，注意病毒程序伪装的图标，不要轻信图标为“电子表格、文本文件、文件夹”的附件。

• 李讯
• 李记集团
• 李许生烈士
• 李访生烈士
• 李证
• 李诂
• 李诗福烈士
• 李诗芝烈士
• 李诗谢赋
• 李诗韵
• 李诞宁
• 李该
• 李诩
• 李诫
• 李诫 (?～1110)
• 李诫(?～1110)
• 李诸田烈士
• 李课财烈士
• 李调和
• 李谔
• 李谟信烈士
• 李谟燕烈士
• 李谦
• 李谦烈士
• 李谬