简介

病毒行为

简介

病毒别名：

处理时间：

威胁级别：★★

中文名称：

病毒类型：VBS病毒

影响系统：Win9x / WinNT

病毒行为

该脚本病毒在每月的2，7，14，21号会删除win9x用户的WINDOWS目录，导致系统瘫痪，winnt用户不受影响，系统的界面设置将被修改，病毒会隐藏磁盘图标，禁止注册表编辑，禁止任务管理器，禁止系统自动升级，将IE的安全级别将最低，win9x用户在开机之后会立即自动关机，病毒还会结束一下常用软件进程：

"vsmon.exe"

"zonealarm.exe"

"PNTIOMON.exe"

"pccntupd.exe"

"WebTrap*.exe"

"Pop3trap.exe"

"MWSOEMON.exe"

"avpcc.exe"

"AvpM.exe"

"RapApp.exe"

"blackice.exe"

"blackd.exe"

"xcommsrv.exe"

"avxgui.exe"

"avxlive.exe"

"lmgui.exe"

"Iface.exe"

"Pavsrv*.exe"

"Avengine.exe"

"UPDATE.EXE"

"NUPGRADE.EXE"

"MCUPDATE.EXE"

"LUALL.EXE"

"ICSUPP95.EXE"

"ICSSUPPNT.EXE"

"DRWEBUPW.EXE"

"CFIAUDIT.EXE"

"DRWEBUPW.EXE"

"AVXQUAR.EXE"

"AVWUPD32.EXE"

"AVPUPD.EXE"

"AVLTMAIN.EXE"

"AUTOUPDATE.EXE"

"AUTOTRACE.EXE"

"AUTODOWN.EXE"

"AUPDATE.EXE"

"ATUPDATER.EXE"

"nod32krn.exe"

"nod32kui.exe"

"_avp*"

"ackwin32*"

"anti-trojan*"

"aplica32*"

"apvxdwin*"

"autodown*"

"avconsol*"

"ave32*"

"avgcc32*"

"avgctrl*"

"avgw*"

"avkserv*"

"avnt*"

"avp*"

"avsched32*"

"avwin95*"

"avwupd32*"

"blackd*"

"blackice*"

"bootwarn*"

"ccapp*"

"ccshtdwn*"

"cfiadmin*"

"cfiaudit*"

"cfind*"

"cfinet*"

"claw95*"

"dv95*"

"ecengine*"

"efinet32*"

"esafe*"

"espwatch*"

"f-agnt95*"

"findviru*"

"fprot*"

"f-prot*"

"fprot95*"

"f-prot95*"

"fp-win*"

"frw*"

"f-stopw*"

"gibe*"

"iamapp*"

"iamserv*"

"ibmasn*"

"ibmavsp*"

"icload95*"

"icloadnt*"

"icmon*"

"icmoon*"

"icssuppnt*"

"icsupp*"

"iface*"

"iomon98*"

"jedi*"

"kpfw32*"

"lockdown2000*"

"lookout*"

"luall*"

"moolive*"

"mpftray*"

"msconfig*"

"nai_vs_stat*"

"navapw32*"

"navlu32*"

"navnt*"

"navsched*"

"navw*"

"nisum*"

"nmain*"

"normist*"

"nupdate*"

"nupgrade*"

"nvc95*"

"outpost*"

"padmin*"

"pavcl*"

"pavsched*"

"pavw*"

"pcciomon*"

"pccmain*"

"pccwin98*"

"pcfwallicon*"

"persfw*"

"pop3trap*"

"pview*"

"rav*"

"regedit*"

"rescue*"

"safeweb*"

"serv95*"

"sphinx*"

"sweep*"

"tca*"

"tds2*"

"vcleaner*"

"vcontrol*"

"vet32*"

"vet95*"

"vet98*"

"vettray*"

"vscan*"

"vsecomr*"

"vshwin32*"

"vsstat*"

"webtrap*"

"wfindv32*"

"zapro*"

"zonealarm*"

"McVSEscn*"

"mcvsrte*"

"mcvsftsn*"

"mcvsshld*"

"AntiTroj*"

"smc*"

"doors*"

"dpf*"

"drwatson*"

"drweb32*"

"fameh32*"

"fast*"

"findviru*"

"fix-it*"

"flowprotector*"

"fnrb32*"

"fsaa*"

"fsav530stbyb*"

"fsav530wtbyb*"

"fsm32*"

"guard*"

"guarddog*"

"iamstats*"

"ifw2000*"

"iomon98*"

"jed*"

"jammer*"

"kerio-pf-213-en-win*"

"kerio-wrl-421-en-win*"

"kerio-wrp-421-en-win*"

"kavlite40eng*"

"kavpers40eng*"

"killprocesssetup161*"

"kpf*"

"kpfw32*"

"ldpro*"

"ldpromenu*"

"ldscan*"

"localnet*"

"lucomserver*"

"mfweng3.02d30*"

"mfw2en*"

"monsys32*"

"monsysnt*"

"msblast*"

"mrflux*"

"mspatch*"

"mssmmc32*"

"nav80try*"

"navengnavex15*"

"nc2000*"

"norton_internet_secu_3.0_407*"

"amon9x*"

"antivirus*"

"ants*"

"autotrace*"

"azonealarm*"

"bd_professional*"

"bidef*"

"bidserver*"

"bipcp*"

"mxtask*"

"nai_vs_stat*"

"navauto-protect*"

"navengnavex15*"

"nc2000*"

"ncinst4*"

"ndd32*"

"neomonitor*"

"netinfo*"

"nsched32*"

"pcip10117_0*"

"Ad-aware*"

"SpybotSD*"

"ntxconfig*"

"panixk*"

"pathping*"

"zonalm2601*"

"xpf202en*"

"wyvernworksfirewall*"

"symproxysvc*"

"rav8win32eng*"

"EXANTIVIRUS-CNET*"

"Fast*"

"Nav80try*"

"Cleaner*"

"Tgbob*"

"Titanin*"

"TitaninXp*"

"Tracert*"

"Trjscan*"

"Trojantrap3*"

"AVprotect9x*"

"Bisp*"

"Ostronet*"

"Nwinst4*"

"Nwtool16*"

"Periscope*"

"Regedt32*"

"Qserver*"

"Integrator*"

"Moolive*"