MSN小尾巴完全清楚方案

         

   当W32.Funner(这是人家诺顿老大的命名)病毒执行的时候，它会这样做～：

　　1，拷贝自身为如下文件：

　　%System%\IEXPLORE.EXE
　　%System%\EXPLORE.EXE
　　%Windir%\rundll32.exe
　　%System%\userinit32.exe
　　c:\funny.exe

　　并且执行列表里的前三个文件

　　注意：

　　·这三个文件会确保另外它们始终运行，换句话说，当其中两个被终止的时候，另外一个会将它们重新启动。

　　·这些文件需要MSVBVM60.DLL文件，它是Microsoft Visual Basic 运行时环境组件。

　　·%System%是系统文件夹的变量参数，默认情况下，它是：
　　C:\Windows\System(Windows 95/98/Me)
　　C:\Windows\System32(Windows NT/2000/XP)

　　·%Windir%是Windows安装文件夹变量参数，默认情况下，它是：
　　C:\Windows或C:\Winnt

　　2，创建日志文件，命名为%System%bsfirst2.log(病毒也做日志？寒……)

　　3，在下列注册表分支中：

　　HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

　　加入键值

　　"Userinit"="userinit32.exe,"

　　当启动Windows的时候，将自动运行userinit32.exe(够贼的……NT系统的注册表同样分支里有这样的一个键值，只是名字是userinit32.exe)

　　4，在下列注册表分支中：

　　HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
　　HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
　　HKEY_LOCAL_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

　　加入键值

　　"MMSystem"="%Windir%\rundll32.exe "%System%\mmsystem.dll"", RunDll32"

　　当启动Windows时，自动运行rundll32.exe

　　5，会在SYSTEM.ini文件的[boot]部分添加如下行：

　　Shell=%system%\explorer.exe

　　6，在Windows Messenger即时通信程序中发送c:\funny.exe文件给联系人

　　7，会连接到www.78p.com域并下载病毒组件。

　　8，将如下列表中的条目添加到Hosts文件并指向一个外部IP地址(来，大家跟我一起数……)：

222.89.98.219 www.wo365.com
222.89.98.219 cmfu.com
222.89.98.219 www.cmfu.com
222.89.98.219 9i0.com
222.89.98.219 www.9flash.com
222.89.98.219 9flash.com
222.89.98.219 www.nowok.net
222.89.98.219 nowok.net
222.89.98.219 wisa.com.cn
222.89.98.219 www.sia.com.cn
222.89.98.219 www.wisa.cn
222.89.98.219 wisa.cn
222.89.98.219 www.zhao99.com
222.89.98.219 zhao99.com
222.89.98.219 www.wo123.com
222.89.98.219 wo123.com
222.89.98.219 wo99.com
222.89.98.219 www.wo99.com
222.89.98.219 www.page.com.cn
222.89.98.219 page.com.cn
222.89.98.219 www.432.cn
222.89.98.219 432.cn
222.89.98.219 wysw.com
222.89.98.219 14.com.cn
222.89.98.219 www.14.com.cn
222.89.98.219 cnww.net
222.89.98.219 www.mv99.com
222.89.98.219 mv99.com
222.89.98.219 www.youav.com
222.89.98.219 www.mtvav.com
222.89.98.219 www.98983.com
222.89.98.219 98983.com
222.89.98.219 www.114.com.cn
222.89.98.219 114.com.cn
222.89.98.219 www.net114.com
222.89.98.219 www.skywz.com
222.89.98.219 skywz.com
222.89.98.219 www.hao6.com
222.89.98.219 hao6.com
222.89.98.219 www.678a.com
222.89.98.219 678a.com
222.89.98.219 www.7510.com
222.89.98.219 7510.com
222.89.98.219 www.zzkan.com
222.89.98.219 zzkan.com
222.89.98.219 www.ca183.com
222.89.98.219 ca183.com
222.89.98.219 3tom.com
222.89.98.219 www.yhjm.com
222.89.98.219 yhjm.com
222.89.98.219 www.k369.com
222.89.98.219 www.xxwww.com
222.89.98.219 xxwww.com
222.89.98.219 www.fm1000.net
222.89.98.219 fm1000.net
222.89.98.219 www.ok135.com
222.89.98.219 ok135.com
222.89.98.219 www.link999.com
222.89.98.219 link999.com
222.89.98.219 www.001wz.com
222.89.98.219 001wz.com
222.89.98.219 www.7t7t.com
222.89.98.219 7t7t.com
222.89.98.219 www.7k7k.com
222.89.98.219 7k7k.com
222.89.98.219 www.webcool.net
222.89.98.219 webcool.net
222.89.98.219 www.51sobu.com
222.89.98.219 51sobu.com
222.89.98.219 cy.51sobu.com
222.89.98.219 www.fj3721.com
222.89.98.219 fj3721.com
222.89.98.219 www.msncn.com
222.89.98.219 msncn.com
222.89.98.219 www.6235.com
222.89.98.219 6235.com
222.89.98.219 www.8goo.com
222.89.98.219 8goo.com
222.89.98.219 www.baimin.com
222.89.98.219 baimin.com
222.89.98.219 www.bwwz.com
222.89.98.219 bwwz.com
222.89.98.219 www.howow.net
222.89.98.219 howow.net
222.89.98.219 www.tongchi.com
222.89.98.219 tongchi.com
222.89.98.219 www.65658.com
222.89.98.219 65658.com
222.89.98.219 www.7o7o.com
222.89.98.219 7o7o.com
222.89.98.219 5126.net
222.89.98.219 www.5126.net
222.89.98.219 www.wangzhiku.com
222.89.98.219 wangzhiku.com
222.89.98.219 www.soyeah.com
222.89.98.219 soyeah.com
222.89.98.219 www.sowang.cn
222.89.98.219 sowang.cn
222.89.98.219 www.77177.com
222.89.98.219 77177.com
222.89.98.219 www.look8.net
222.89.98.219 look8.net
222.89.98.219 v222.com
222.89.98.219 www.v222.com
222.89.98.219 www.wblink.com
222.89.98.219 wblink.com
222.89.98.219 www.daguilin.com

222.89.98.219 daguilin.com
222.89.98.219 www.soulang.com
222.89.98.219 soulang.com
222.89.98.219 www.369e.com
222.89.98.219 369e.com
222.89.98.219 www.kuwz.com
222.89.98.219 kuwz.com
222.89.98.219 www.07007.com
222.89.98.219 07007.com
222.89.98.219 www.6cn.com
222.89.98.219 6cn.com
222.89.98.219 www.wyly.cn.gs
222.89.98.219 wyly.cn.gs
222.89.98.219 www.xhoo.net
222.89.98.219 xhoo.net
222.89.98.219 www.365.com
222.89.98.219 www.qoomo.com
222.89.98.219 www.4sohu.com
222.89.98.219 www.top777.com
222.89.98.219 top777.com
222.89.98.219 www.suoyou.com
222.89.98.219 suoyou.com
222.89.98.219 www.dlren.com
222.89.98.219 dlren.com
222.89.98.219 www.cityshe.com
222.89.98.219 www.hao100.com
222.89.98.219 hao100.com
222.89.98.219 www.11wz.com
222.89.98.219 11wz.com
222.89.98.219 www.bszcx.com
222.89.98.219 bszcx.com
222.89.98.219 www.12so.com
222.89.98.219 12so.com
222.89.98.219 www.wguo.com
222.89.98.219 wguo.com
222.89.98.219 www.ku8.com
222.89.98.219 ku8.com
222.89.98.219 www.5i55.com
222.89.98.219 5i55.com
222.89.98.219 www.dlwz.net
222.89.98.219 dlwz.net
222.89.98.219 www.etidc.net
222.89.98.219 etidc.net
222.89.98.219 www.eaol.net
222.89.98.219 eaol.net
222.89.98.219 wz.dabaoku.com
222.89.98.219 dabaoku.com
222.89.98.219 www.dabaoku.com
222.89.98.219 info.west263.com
222.89.98.219 west263.com
222.89.98.219 www.west263.com
222.89.98.219 www.urlall.com
222.89.98.219 urlall.com
222.89.98.219 www.wacn.cn
222.89.98.219 wacn.cn
222.89.98.219 www.uhot.net
222.89.98.219 uhot.net
222.89.98.219 www.lywww.com
222.89.98.219 lywww.com
222.89.98.219 tj8.aofa.cn
222.89.98.219 www.ddvv.cn
222.89.98.219 www.194.cn
222.89.98.219 www.husou.com

[1] [2] [3] [4] [5] [6] 下一页