病毒别名： 处理时间：2006-08-29 威胁级别：★

中文名称：玩偶之怒 病毒类型：蠕虫 影响系统：Win 9x/ME,Win 2000/NT,Win XP,Win 2003

病毒行为:

这是一个通过邮件传播的蠕虫病毒，该病毒会搜索被感染机器上的邮件地址并且把自己发送出去，会尝试下载该蠕虫的其他木马病毒。

1.创建互斥量:

"PeyotCodedByHALT"

2.添加注册表:

HKLC\\Software\\Microsoft\\Windows\\CurrentVersion\\Run

mfcapi32u

mfcapi32u.exe

3.生成文件:

%WINNT%\\System32\\mfcapi32u.exe

%TEMP%\\hack.txt

4.病毒运行时运行notpad.exe显示 this is the joke

5.把自己加到防火墙允许里面

SYSTEM\\ControlSet001

\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List

6.修改注册表:

Software\\MailPeyot

7.下载文件:

http://traffall.biz/adv/***/win32.exe

到 "c:\\autoexeck.exe"

8.发送邮件:

主题为:

Thank you for your purchase in Bolero!

Thank you for your registration!

Pay for your credits!

It's important!!! You still have not paid a fine!

Tank you for your charity

内容为:

Hello!

Thank you for your purchase in our Internet-shop. We always appreciate to meet you there and

would like to inform you that money was successfully transferred from your credit card to our account.

Further information you can find enclosed.Sincerely yours, Bolero Inetshop Administration

Hello!

Thank you for your rewrite in our mail server. The confirmation of you new login and password

you can find enclosed.Sincerely yours, Mail Administration Service / Mail Support Service

Hello!

We have to remain you that your credit payment period will be expiring next week. If you will

not make your payment till that time we will have to withdraw your savings from your bank account.

All

details you can find enclosed.USA Credit Group.

Hello!

We remain you that you still have not paid a parking violation fine. You should to pay it till

the next week or we will have to reach trial the deal.We are sending you herewith all necessary

documents.Sincerely yours, Regional Police Department Management / Administration

Hello!

The St. Patrick Home thanks you for your donation. We are very obliged for your assistance

with our St. Patrick's Found and acknowledge the receipt of your transfer for its account. Further to

our letter we are sending you full estimate of that transfer.

发件人为:

Michel Madsen

Nick Convers

Jane Hoocks

Fred Dowland

Emely Hard

John Heckman

Piet Roslen

Oliver Simpson

Patrick Roberts

Lorence Newman

发件人地址为以下两部分组合:

night

bsd

sys

mr

big

bob

white

dark

black

oliver

yanli

brain

chan

katamoro

tsungli

killer

bug

bug

sun

tr0n

lion

bandit

andi

alert

02

03

2003

2001

2004

2002

2000

2006

m4n

man

chubakka

obivan

presli

songking

yantchi

smitt

westford

goldgong

manager

bengamin

cristofer

albert

antony

martin

enigma

aleph

elvis

john

robin

ghost

邮件域:

mail.com

msn.com

hotmail.com

gmail.com