Worm.Saros.a是一种蠕虫病毒，中文名称为萨露丝，能影响的系统有Win9x/WinNT/Win2K/WinXP/Win2003，它通过mIrc发送Love-ScreenSaver.cab(病毒)给其它mIrc用户。

病毒行为(1.复制自身到以下文件: 2..建立文件 3..显示消息 4.建立WINDOWSsystem32 5.文件修改 6.发送病毒)

发作现象

病毒行为

1.复制自身到以下文件:

WINDOWSsystem32NonYou.exe

WINDOWSsystem32Love-ScreenSaver.scr

WINDOWSsystem32MSOutlookInternetUpdate.exe

progra~1KazaaMy Shared FolderRosy.exe

progra~1KazaaMy Shared FolderPipponoto.exe

progra~1KazaaMy Shared FolderAnastacia - Left Outside Alone.mp3.exe

progra~1KazaaMy Shared FolderThe Rasmus - In The Shadows.mp3.exe

progra~1KazaaMy Shared Folder50 Cent - In da Club.mp3.exe

progra~1KazaaMy Shared FolderVanessa Carltron - Ordinary Day.mp3.exe

progra~1KazaaMy Shared FolderHaiducii - Dragostea Din Tei.mp3.exe

progra~1KazaaMy Shared FolderBlack Eyed Peas - Hey Mama.mp3.exe

progra~1KazaaMy Shared FolderRaf - In tutti i miei giorni.mp3.exe

progra~1KazaaMy Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe

progra~1KazaaMy Shared FolderLionel Richie - Just For You.mp3.exe

progra~1Kazaa LiteMy Shared FolderRosy.exe

progra~1Kazaa LiteMy Shared FolderPipponoto.exe

progra~1Kazaa LiteMy Shared FolderAnastacia - Left Outside Alone.mp3.exe

progra~1Kazaa LiteMy Shared FolderThe Rasmus - In The Shadows.mp3.exe

progra~1Kazaa LiteMy Shared Folder50 Cent - In da Club.mp3.exe

progra~1Kazaa LiteMy Shared FolderVanessa Carltron - Ordinary Day.mp3.exe

progra~1Kazaa LiteMy Shared FolderHaiducii - Dragostea Din Tei.mp3.exe

progra~1Kazaa LiteMy Shared FolderBlack Eyed Peas - Hey Mama.mp3.exe

progra~1Kazaa LiteMy Shared FolderRaf - In tutti i miei giorni.mp3.exe

progra~1Kazaa LiteMy Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe

progra~1Kazaa LiteMy Shared FolderLionel Richie - Just For You.mp3.exe

progra~1Kazaa Lite K++My Shared FolderRosy.exe

progra~1Kazaa Lite K++My Shared FolderPipponoto.exe

progra~1Kazaa Lite K++My Shared FolderAnastacia - Left Outside Alone.mp3.exe

progra~1Kazaa Lite K++My Shared FolderThe Rasmus - In The Shadows.mp3.exe

progra~1Kazaa Lite K++My Shared Folder50 Cent - In da Club.mp3.exe

progra~1Kazaa Lite K++My Shared FolderVanessa Carltron - Ordinary Day.mp3.exe

progra~1Kazaa Lite K++My Shared FolderHaiducii - Dragostea Din Tei.mp3.exe

progra~1Kazaa Lite K++My Shared FolderHaiducii - Dragostea din tei.mp3.exe

progra~1Kazaa Lite K++My Shared FolderRaf - In tutti i miei giorni.mp3.exe

progra~1Kazaa Lite K++My Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe

progra~1Kazaa Lite K++My Shared FolderLionel Richie - Just For You.mp3.exe

progra~1ICQShared FolderRosy.exe

progra~1ICQShared FolderPipponoto.exe

progra~1ICQShared FolderAnastacia - Left Outside Alone.mp3.exe

progra~1ICQShared FolderThe Rasmus - In The Shadows.mp3.exe

progra~1ICQShared Folder50 Cent - In da Club.mp3.exe

progra~1ICQShared FolderVanessa Carltron - Ordinary Day.mp3.exe

progra~1ICQShared FolderHaiducii - Dragostea Din Tei.mp3.exe

progra~1ICQShared FolderBlack Eyed Peas - Hey Mama.mp3.exe

progra~1ICQShared FolderRaf - In tutti i miei giorni.mp3.exe

progra~1ICQShared FolderVasco Rossi - Buoni e cattivi.mp3.exe

progra~1ICQShared FolderLionel Richie - Just For You.mp3.exe

progra~1GroksterMy GroksterRosy.exe

progra~1GroksterMy GroksterPipponoto.exe

progra~1GroksterMy GroksterAnastacia - Left Outside Alone.mp3.exe

progra~1GroksterMy GroksterThe Rasmus - In The Shadows.mp3.exe

progra~1GroksterMy Grokster50 Cent - In da Club.mp3.exe

progra~1GroksterMy GroksterVanessa Carltron - Ordinary Day.mp3.exe

progra~1GroksterMy GroksterHaiducii - Dragostea Din Tei.mp3.exe

progra~1GroksterMy GroksterBlack Eyed Peas - Hey Mama.mp3.exe

progra~1GroksterMy GroksterRaf - In tutti i miei giorni.mp3.exe

progra~1GroksterMy GroksterVasco Rossi - Buoni e cattivi.mp3.exe

progra~1GroksterMy GroksterLionel Richie - Just For You.mp3.exe

progra~1BearshareSharedRosy.exe

progra~1BearshareSharedPipponoto.exe

progra~1BearshareSharedAnastacia - Left Outside Alone.mp3.exe

progra~1BearshareSharedThe Rasmus - In The Shadows.mp3.exe

progra~1BearshareShared50 Cent - In da Club.mp3.exe

progra~1BearshareSharedVanessa Carltron - Ordinary Day.mp3.exe

progra~1BearshareSharedHaiducii - Dragostea Din Tei.mp3.exe

progra~1BearshareSharedBlack Eyed Peas - Hey Mama.mp3.exe

progra~1BearshareSharedRaf - In tutti i miei giorni.mp3.exe

progra~1BearshareSharedVasco Rossi - Buoni e cattivi.mp3.exe

progra~1BearshareSharedLionel Richie - Just For You.mp3.exe

progra~1eDonkey2000IncomingRosy.exe

progra~1eDonkey2000IncomingPipponoto.exe

progra~1eDonkey2000IncomingAnastacia - Left Outside Alone.mp3.exe

progra~1eDonkey2000IncomingThe Rasmus - In The Shadows.mp3.exe

progra~1eDonkey2000Incoming50 Cent - In da Club.mp3.exe

progra~1eDonkey2000IncomingVanessa Carltron - Ordinary Day.mp3.exe

progra~1eDonkey2000IncomingHaiducii - Dragostea Din Tei.mp3.exe

progra~1eDonkey2000IncomingBlack Eyed Peas - Hey Mama.mp3.exe

progra~1eDonkey2000IncomingRaf - In tutti i miei giorni.mp3.exe

progra~1eDonkey2000IncomingVasco Rossi - Buoni e cattivi.mp3.exe

progra~1eDonkey2000IncomingLionel Richie - Just For You.mp3.exe

progra~1eMuleIncomingRosy.exe

progra~1eMuleIncomingPipponoto.exe

progra~1eMuleIncomingAnastacia - Left Outside Alone.mp3.exe

progra~1eMuleIncomingThe Rasmus - In The Shadows.mp3.exe

progra~1eMuleIncoming50 Cent - In da Club.mp3.exe

progra~1eMuleIncomingVanessa Carltron - Ordinary Day.mp3.exe

progra~1eMuleIncomingHaiducii - Dragostea Din Tei.mp3.exe

progra~1eMuleIncomingBlack Eyed Peas - Hey Mama.mp3.exe

progra~1eMuleIncomingRaf - In tutti i miei giorni.mp3.exe

progra~1eMuleIncomingVasco Rossi - Buoni e cattivi.mp3.exe

progra~1eMuleIncomingLionel Richie - Just For You.mp3.exe

progra~1MorpheusMy Shared FolderRosy.exe

progra~1MorpheusMy Shared FolderPipponoto.exe

progra~1MorpheusMy Shared FolderAnastacia - Left Outside Alone.mp3.exe

progra~1MorpheusMy Shared FolderThe Rasmus - In The Shadows.mp3.exe

progra~1MorpheusMy Shared Folder50 Cent - In da Club.mp3.exe

progra~1MorpheusMy Shared FolderVanessa Carltron - Ordinary Day.mp3.exe

progra~1MorpheusMy Shared FolderHaiducii - Dragostea Din Tei.mp3.exe

progra~1MorpheusMy Shared FolderBlack Eyed Peas - Hey Mama.mp3.exe

progra~1MorpheusMy Shared FolderRaf - In tutti i miei giorni.mp3.exe

progra~1MorpheusMy Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe

progra~1MorpheusMy Shared FolderLionel Richie - Just For You.mp3.exe

progra~1LimeWireSharedRosy.exe

progra~1LimeWireSharedPipponoto.exe

progra~1LimeWireSharedAnastacia - Left Outside Alone.mp3.exe

progra~1LimeWireSharedThe Rasmus - In The Shadows.mp3.exe

progra~1LimeWireShared50 Cent - In da Club.mp3.exe

progra~1LimeWireSharedVanessa Carltron - Ordinary Day.mp3.exe

progra~1LimeWireSharedHaiducii - Dragostea Din Tei.mp3.exe

progra~1LimeWireSharedBlack Eyed Peas - Hey Mama.mp3.exe

progra~1LimeWireSharedRaf - In tutti i miei giorni.mp3.exe

progra~1LimeWireSharedVasco Rossi - Buoni e cattivi.mp3.exe

progra~1LimeWireSharedLionel Richie - Just For You.mp3.exe

progra~1TeslaFilesRosy.exe

progra~1TeslaFilesPipponoto.exe

progra~1TeslaFilesAnastacia - Left Outside Alone.mp3.exe

progra~1TeslaFilesThe Rasmus - In The Shadows.mp3.exe

progra~1TeslaFiles50 Cent - In da Club.mp3.exe

progra~1TeslaFilesVanessa Carltron - Ordinary Day.mp3.exe

progra~1TeslaFilesHaiducii - Dragostea Din Tei.mp3.exe

progra~1TeslaFilesBlack Eyed Peas - Hey Mama.mp3.exe

progra~1TeslaFilesRaf - In tutti i miei giorni.mp3.exe

progra~1TeslaFilesVasco Rossi - Buoni e cattivi.mp3.exe

progra~1TeslaFilesLionel Richie - Just For You.mp3.exe

progra~1WinMXSharedRosy.exe

progra~1WinMXSharedPipponoto.exe

progra~1WinMXSharedAnastacia - Left Outside Alone.mp3.exe

progra~1WinMXSharedThe Rasmus - In The Shadows.mp3.exe

progra~1WinMXShared50 Cent - In da Club.mp3.exe

progra~1WinMXSharedVanessa Carltron - Ordinary Day.mp3.exe

progra~1WinMXSharedHaiducii - Dragostea Din Tei.mp3.exe

progra~1WinMXSharedBlack Eyed Peas - Hey Mama.mp3.exe

progra~1WinMXSharedRaf - In tutti i miei giorni.mp3.exe

progra~1WinMXSharedVasco Rossi - Buoni e cattivi.mp3.exe

progra~1WinMXSharedLionel Richie - Just For You.mp3.exe

2..建立文件

WINDOWSsystem32About.hta

3..显示消息

标题: Microsoft Windows Update

内容: Click Yes For Update Microsoft Outlook via E-mail

4.建立WINDOWSsystem32

stdnrdll32.vbs文件

该VBS文件作如下工作:

a.在注册表主键"HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun

ldr32"下，

添加如下键值："default"="WINDOWSsystem32NonYou.exe"

b.在注册表主键"HKEY_CURRENT_USERSoftwareMicrosoftOffice8.0OutlookSecurity"下，

添加如下键值："Level1Remove"="exe"

c.在注册表主键"HKEY_CURRENT_USERSoftwareMicrosoftOffice9.0OutlookSecurity"下，

添加如下键值："Level1Remove"="exe"

d.在注册表主键"HKEY_CURRENT_USERSoftwareMicrosoftOffice10.0OutlookSecurity"下，

添加如下键值："Level1Remove"="exe"

e.在注册表主键"HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunoncewincomp32"下，

添加如下键值："default"="WINDOWSsystem32

stdnrdll32.vbs"

f.建立文件WINDOWSsystem32Love-ScreenSaver.cab,它包含蠕虫本身

g.如果当前日期是11号或23号,则把IE的默认页改为:　并用浏览器打开WINDOWSsystem32About.hta

h.根据outlook地址簿Email地址发送带毒邮件

该邮件主题为:Microsoft Outlook News

内容:Microsoft Outlook Update / Bug Fixed - Contact: 附件:MSOutlookInternetUpdate.exe(该附件为病毒本身)

i.打开

5.文件修改

在Program FilesmIRCmirc.ini文件中的rfiles节中增加：n2 = tdll32.dll

6.发送病毒

发作现象

检查当前日期是否为11号或23号

如果是则显示如下两条消息:

标题: NonYou

内容: Rosy Ti Amo - Saro & Rosy Forever

标题: Gedzac Group 2004

内容:

NonYou.a Gedzac Labs Productions

Coded by Sarosoft - Dedicated to my Love Ros

Gedzac Group 2004 - Gedzac

The Virus Crew