病毒别名：W32.Netsky.Q@mm [Symantec] W32/Netsky.p@MM [McAfee] Win32.Netsky.P [Computer Associates] NetSky.P [F

处理时间：

威胁级别：★★★

中文名称：

病毒类型：蠕虫

影响系统：Win9x/WinMe/WinNT/Win2000/WinXP/Win2003

病毒行为:

编写工具:FSG压缩

传染条件:通过网络大量发送邮件传播

发作条件:利用系统漏洞Incorrect MIME Header Can Cause IE to Execute E-mail Attachment来获得自动运行

系统修改:

A、创建一个名为"_-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_"的互斥体，来确定只运行它的一个进程；

B、拷贝其本身至系统安装目录：

%Windir%FVProtect.exe

C、在系统安装目录释放和创建如下文件：

%Windir%userconfig9x.dll

%Windir%ase64.tmp (40,520 bytes): MIME-encoded version of the executable

%Windir%zip1.tmp (40,882 bytes): MIME-encoded version of worm in a .zip archive

%Windir%zip2.tmp (40,894 bytes): MIME-encoded version of worm in a .zip archive

%Windir%zip3.tmp (40,886 bytes): MIME-encoded version of worm in a .zip archive

%Windir%zipped.tmp (29,834 bytes): Worm in a .zip archive

D、在注册表主键：

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun

下添加如下键值：

"Norton Antivirus AV"="%Windir%FVProtect.exe"

在注册表主键：

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun

下删除如下键值：

Explorer

system.

msgsvr32

winupd.exe

direct.exe

jijbl

service

Sentry

在注册表主键：

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices

下删除如下键值：

system

Video

在注册表主键：

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun

下删除以下键值：

Explorer

au.exe

direct.exe

d3dupdate.exe

OLE

gouday.exe

rate.exe

Taskmon

Windows Services Host

sysmon.exe

srate.exe

ssate.exe

winupd.exe

删除以下子键：

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerPINF

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWksPatch

HKEY_CLASSES_ROOTCLSIDCLSIDInProcServer32

E、扫描被感染系统硬盘上的包含以下字符串的文件夹：

bear

donkey

download

ftp

htdocs

http

icq

kazaa

lime

morpheus

mule

my shared folder

shar

shared files

upload

然后将其本身用以下名字拷贝至搜索出的文件夹中：

"1001 Sex and more.rtf.exe"

"3D Studio Max 6 3dsmax.exe"

"ACDSee 10.exe"

"Adobe Photoshop 10 crack.exe"

"Adobe Photoshop 10 full.exe"

"Adobe Premiere 10.exe"

"Ahead Nero 8.exe"

"Altkins Diet.doc.exe"

"American Idol.doc.exe"

"Arnold Schwarzenegger.jpg.exe"

"Best Matrix Screensaver new.scr"

"Britney sex xxx.jpg.exe"

"Britney Spears and Eminem porn.jpg.exe"

"Britney Spears blowjob.jpg.exe"

"Britney Spears cumshot.jpg.exe"

"Britney Spears fuck.jpg.exe"

"Britney Spears full album.mp3.exe"

"Britney Spears porn.jpg.exe"

"Britney Spears Sexy archive.doc.exe"

"Britney Spears Song text archive.doc.ex"...

"Britney Spears.jpg.exe"

"Britney Spears.mp3.exe"

"Clone DVD 6.exe"

"Cloning.doc.exe"

"Cracks & Warez Archiv.exe"

"Dark Angels new.pif"

"Dictionary English 2004 - France.doc.ex"...

"DivX 8.0 final.exe"

"Doom 3 release 2.exe"

"E-Book Archive2.rtf.exe"

"Eminem blowjob.jpg.exe"

"Eminem full album.mp3.exe"

"Eminem Poster.jpg.exe"

"Eminem sex xxx.jpg.exe"

"Eminem Sexy archive.doc.exe"

"Eminem Song text archive.doc.exe"

"Eminem Spears porn.jpg.exe"

"Eminem.mp3.exe"

"Full album all.mp3.pif"

"Gimp 1.8 Full with Key.exe"

"Harry Potter 1-6 book.txt.exe"

"Harry Potter 5.mpg.exe"

"Harry Potter all e.book.doc.exe"

"Harry Potter e book.doc.exe"

"Harry Potter game.exe"

"Harry Potter.doc.exe"

"How to hack new.doc.exe"

"Internet Explorer 9 setup.exe"

"Kazaa Lite 4.0 new.exe"

"Kazaa new.exe"

"Keygen 4 all new.exe"

"Learn Programming 2004.doc.exe"

"Lightwave 9 Update.exe"

"Magix Video Deluxe 5 beta.exe"

"Matrix.mpg.exe"

"Microsoft Office 2003 Crack best.exe"

"Microsoft WinXP Crack full.exe"

"MS Service Pack 6.exe"

"netsky source code.scr"

"Norton Antivirus 2005 beta.exe"

"Opera 11.exe"

"Partitionsmagic 10 beta.exe"

"Porno Screensaver britney.scr"

"RFC compilation.doc.exe"

"Ringtones.doc.exe"

"Ringtones.mp3.exe"

"Saddam Hussein.jpg.exe"

"Screensaver2.scr"

"Serials edition.txt.exe"

"Smashing the stack full.rtf.exe"

"Star Office 9.exe"

"Teen Porn jpg.pif"

"The Sims 4 beta.exe"

"Ulead Keygen 2004.exe"

"Visual Studio Net Crack all.exe"

"Win Longhorn re.exe"

"WinAmp 13 full.exe"

"Windows 2000 Sourcecode.doc.exe"

"Windows 2003 crack.exe"

"Windows XP crack.exe"

"WinXP eBook newest.doc.exe"

"XXX hardcore pics.jpg.exe"

发作现象:

特别说明:

A、在系统C-Z盘具有以下后缀的文件中查找Email地址：

.adb

.asp

.cgi

.dbx

.dhtm

.doc

.eml

.htm

.html

.jsp

.msg

.oft

.php

.pl

.rtf

.sht

.shtm

.tbb

.txt

.uin

.vbs

.wab

.wsh

.xml

B、用其自带的SMT引擎向查到的Email地址中发信，具有以下特征：

发件人：<随机的具有诱惑性的名字>

主题：<以下字符串中任选一个>：

Re: Encrypted Mail

Re: Extended Mail

Re: Status

Re: Notify

Re: SMTP Server

Re: Mail Server

Re: Delivery Server

Re: Bad Request

Re: Failure

Re: Thank you for delivery

Re: Test

Re: Administration

Re: Message Error

Re: Error

Re: Extended Mail System

Re: Secure SMTP Message

Re: Protected Mail Request

Re: Protected Mail System

Re: Protected Mail Delivery

Re: Secure delivery

Re: Delivery Protection

Re: Mail Authentification

Mail Delivery (failure )

正文：<以下字符串中任选一个>：

Please see the attached file for details

Please read the attached file!

Your document is attached.

Please read the document.

Your file is attached.

Your document is attached.

Please confirm the document.

Please read the important document.

See the file.

Requested file.

Authentication required.

Your document is attached to this mail.

I have attached your document.

I have received your document. The corrected document is attached.

Your document.

Your details.

该病毒还会将以下文件放入文件正文后：

+++ Attachment: No Virus found

+++ MessageLabs AntiVirus - www.messagelabs.com

+++ Attachment: No Virus found

+++ Bitdefender AntiVirus - www.bitdefender.com

+++ Attachment: No Virus found

+++ MC-Afee AntiVirus - www.mcafee.com

+++ Attachment: No Virus found

+++ Kaspersky AntiVirus - www.kaspersky.com

+++ Attachment: No Virus found

+++ Panda AntiVirus - www.pandasoftware.com

++++ Attachment: No Virus found

++++ Norman AntiVirus - www.norman.com

++++ Attachment: No Virus found

++++ F-Secure AntiVirus - www.f-secure.com

++++ Attachment: No Virus found

++++ Norton AntiVirus - www.symantec.de

附件名:<为以下字符串中的一个>:

document05

websites03

game_xxo

your_document

后跟以下字符串中的一个：

.txt <很长的空白空间>

.doc <很长的空白空间>

最后的后缀名为以下字符串中的一个：

.exe

.pif

.scr

.zip

如果文件后缀为.zip，那么里面为以下文件中的一个：

document.txt .exe

data.rtf .scr

details.txt .pif

C、该病毒将不会给包含以下字符串的Email地址发送邮件：

@antivi

@avp

@bitdefender

@fbi

@f-pro

@freeav

@f-secur

@kaspersky

@mcafee

@messagel

@microsof

@norman

@norton

@pandasof

@skynet

@sophos

@spam

@symantec

@viruslis

abuse@

noreply@

ntivir

reports@

spam@