词条 | Worm.Korgo.p |
释义 | 病毒别名:I-Worm.Korgo.p.58CFC05B.V [AVP] 处理时间: 威胁级别:★★★ 中文名称:考格兄弟变种P 病毒类型:蠕虫 影响系统:Win9x/WinMe/WinNT/Win2000/WinXP 病毒行为: 编写工具: 传染条件: 发作条件: 系统修改: 从注册表主键HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun 删除如下键值: MS Config v13 avserve2.exeUpdate Service avserve.exe Windows Update Service WinUpdate SysTray Bot Loader System Restore Service Disk Defragmenter Windows Security Manager 在注册表主键HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun 修改键值"Windows Update"="%System%*.exe" (注: *表示该文件名是随机生成的) 在注册表主键HKEY_LOCAL_MACHINESOFTWARESoftwareMicrosoftWireless 添加键值"ID"="*" (注: *表示一随机的字符串) 在注册表主键HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsConnections 添加键值"DefaultConnectionSettings"= hex:3c,00,00,00,01,00,00,00,09,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 在注册表主键HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsConnections 添加键值"SavedLegacySettings"= hex:3c,00,00,00,03,00,00,00,09,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 将自身拷贝到%System%*.exe (注: *表示该文件名是随机生成的) 发作现象: 特别说明: 该病毒会从指定URL下载某个exe文件并在受感染系统上运行 |
随便看 |
百科全书收录4421916条中文百科知识,基本涵盖了大多数领域的百科知识,是一部内容开放、自由的电子版百科全书。