该蠕虫病毒会疯狂复制到磁盘中的所有目录，并在某些系统目录中反复复制，大量消耗系统资源和磁盘空间。并在可写的逻辑磁盘的根目录生成autorun.inf文件，每次用户打开磁盘的时候病毒就悄悄地自动运行了。该病毒修改注册表将自己加到自启动项，并禁止系统还原。

病毒信息

病毒行为

发作过程(疯狂复制自身 修改注册表 邮件感染扩散 磁盘感染扩散 其它)

病毒信息

病毒别名：Email-Worm.Win32.Salga.a[AVP]

处理时间：

威胁级别：★★

中文名称：撒伽

病毒类型：蠕虫

影响系统：Win9x / WinNT

病毒行为

然后该蠕虫病毒搜索Outlook地址薄中的电子邮箱地址，将自己以附件的形式发送出去，以感染更多机器，附件名字颇有诱惑力的，由于名字中带有多个

“.”，使得扩展名“exe”可能被隐藏，一不小心就能中招。病毒还将自身复制到局域网中可写网络磁盘以传播，然后给局域网中所有用户发

送一条虚假信息以诱骗别的用户点击该病毒副本。该病毒还会显示一些对话框，以交友和给系统打补丁为诱饵窃取用户的电子邮箱以及密码。

发作过程

疯狂复制自身

1)

%SystemRoot%\\system\\system copy.exe

%SystemRoot%\\acdsee demo.exe

%SystemRoot%\\system32\\egywormo[gen1].exe

c:\\Britny spears marrage with Bnladensun.zip

c:\\hard core hook from web

c:\\hard core hook from web\\setup.zip.exe

%SystemRoot%\\All Users\\Desktop\\sex cam

%SystemRoot%\\All Users\\Desktop\\sex cam\\sex photoes of monika.zip.exe

%SystemRoot%\\All Users\\Start Menu\\Programs\\StartUp\\ana~1.exe

%SystemRoot%\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\egy~1

%SystemRoot%\\Start Menu\\inter net speeder.zip.exe

%SystemRoot%\\start menu\\programs\ew chat prog.zip.exe

C:\\Documents and Settings\\All Users\\DESKTOP\\holywood stuff film.zip.exe

C:\\Documents and Settings\\All Users\\Start Menu\icole kidman sexy cam.zip.exe

C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\your sexy cam.zip.exe

C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Accessories\\magic graphices maker.zip.exe

C:\\Program Files\\Accessories\\BRITNY SPEARS MARRAGE.zip...............exe

C:\\Program Files\\Accessories\\Details of new friends.zip...............exe

C:\\Program Files\\Accessories\\Details.zip...............exe

C:\\Program Files\\Accessories\\hard sex files.zip...............exe

C:\\Program Files\\Accessories\\Is Bnladen realy cow boy.zip...............exe

C:\\Program Files\\Accessories\\kasper2005.zip...............exe

C:\\Program Files\\Accessories\icole kidman.zip...............exe

d:\\autorun.inf

＃＃＃＃＃＃＃＃

[autorun]

open=FUN.ZIP.EXE

＃＃＃＃＃＃＃＃

d:\\FUN.ZIP.EXE

d:\\girlfriends emails.zip.exe

d:\\hook all sex movies from webs

d:\\hook all sex movies from webs\\setup.zip.exe

d:\ew computer worm alert

d:\ew computer worm alert\\virus alert.txt

d:\EW PROGRAMS

e:\\autorun.inf

＃＃＃＃＃＃＃＃

[autorun]

open=Messenger 9.00.ZIP.EXE

＃＃＃＃＃＃＃＃

e:\\Messenger 9.00.ZIP.EXE

e:\\blood of fetch sex.zip.exe

e:\\real sex telephones

e:\\real sex telephones\\call from me.zip.exe

2)

创建共享目录以及共享文件：

C:\\Britny

c:\\Britny\EW FILM.ZIP.EXE

3)

搜索磁盘中地所有目录和文件，如搜到一个文件或目录为A，则在磁盘中同一位置生成病毒的副本A.exe.

不停地尝试复制自身到以下目录，复制后的文件名随机生成：

<系统盘>\\<系统目录名><随机数字>.exe

c:\\program files\\

%SystemRoot%\\system\\

修改注册表

HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\

"windows"="%SystemRoot%\\system\\system copy.exe"

HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\

"system xp"="%SystemRoot%\\acdsee demo.exe"

HKEY_CURRENT_USER\\Software\\Kazaa\\Transfer\\

"StartKazaa -SilentRun"="C:\\Program Files\\Kazaa\\My Shared Folder\\Shared"

HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore

"DisableConfig"=dword:1

"DisableSR"=dword:1

邮件感染扩散

3.搜索OutLook地址薄中的邮件地址，将自己以附件的形式发送出去，以感染更多机器。附件可能为以下名字：

huge sexy brests program v 1.7.00.zip.exe

3d msn version 10.1.zip................exe

this files is very secret files.zip.........exe

new film.zip.........exe

i robot.zip.........exe

anti virus.zip.........exe

fire wall.zip.........exe

news.zip.........exe

yahoo.zip.........exe

aol.zip.........exe

mirc.zip.........exe

hack.zip.........exe

virus.zip.........exe

animal photos.zip.........exe

USA secrets.zip.........exe

photo shop.zip.........exe

deutsh programs.zip.........exe

wwf.zip.........exe

tourism.zip.........exe

fear.zip.........exe

autocade.zip.........exe

3dstoudio.zip.........exe

scince of water.zip.........exe

office 2005.zip.........exe

antibiotics.zip.........exe

viagra.zip.........exe

visual basic projects.zip.........exe

FBI secrets.zip.........exe

FOOTBALL IN ENGLAND.zip.........exe

TOY 2006.zip.........exe

Britny Spears.zip.........exe

Dracola.zip.........exe

pebsi.zip.........exe

news paper.zip.........exe

cocacola.zip.........exe

songs.zip.........exe

norton 2005.zip.........exe

xxl plus.zip.........exe

lesbien.zip.........exe

hard core.zip.........exe

sex plus.zip.........exe

computers in 2010.zip.........exe

ssParis_Hilton_(Nude Screen Saver).scr.............exe

Win32System_Tweaks_v1.0.zip.........exe

ms games.zip.........exe

Virtual_3D_Pinball.zip.........exe

ssPamela_Anderson_(Naked Screen Saver).scr.........exe

Game_Crack_Genie_v0.5.zip.........exe

MsDos_PortScanner.zip.........exe

Wmplayer_Celebrity_Skins.zip.........exe

Shockwave Flash.zip.........exe

SWF_Movie.zip.........exe

FlashMovie.zip.........exe

XXX video.zip.........exe

Cat attacks child.zip.........exe

SWF.zip.........exe

Comedy video.zip.........exe

Simpsons Episode (#)..zip.........exe

Tutorial Video on Hacking.........exe

MacroMedia Flash 6.0.zip.........exe

[SWF] - The Fast and the Furious.zip.........exe

[SWF] - Swordfish.........exe

[SWF] - Harry Potter and the philosophers stone.zip.........exe

big one in the world.zip.........exe

new film.zip.........exe

Iraq war.zip.................exe

USA discvered water in mars yesterday.doc.zip.................exe

Britny spears and Madona sex viedio in 24 min only.zip.................exe

strong fire wall allover the world with thelast update of norton.zip.................exe

last messengers versions.zip.................exe

learn photo shop in 3 days only.zip.................exe

new girls emails with there phone numbers.zip.................exe

new cupied photos.zip.................exe

邮件主题：

Sir new victem

邮件内容：

Hi:sir i'm your server Egywormo[gen1] this is new victem who has own outlook machine i caputre his contacts and go there to infect them.... ok i'll go now and see you soon when i infect more ......bibi sir

磁盘感染扩散

将自身复制到可写的网络磁盘中，以感染更多机器：

c$\\windows\\system32\\pass word of hotmail store.zip................exe

c$\\documment and settings\\all users\\documents\\secret documents.zip......................exe

c$\\money generator very dengerous and secrt.zip..........................exe

c$\\shared\\my sallary every mmonth increaser.................................exe

ipc$\\secret photoes from my chat.zip...............................exe

c$\\winnt\\systemm32\\speial films links in net.zip.............................exe

admin$\\system32\\see this it is very intersting.zip...................................exe

其它

向局域网中的所有用户发送一下消息：

hi welcome in our net cafe you can see the new film of Britny spears from the computer which shown it is very interesting film or see it from any shared folder <>

尝试访问网络中图片并显示。显示2个对话框，提示用户系统需要打补丁，欺骗用户去下载并运行病毒。另一个以交友为诱饵窃取用户的电子

邮箱和密码发送到指定电子邮箱。