Worm.Korgo.p

病毒别名：I-Worm.Korgo.p.58CFC05B.V [AVP]

处理时间：

威胁级别：★★★

中文名称：考格兄弟变种P

病毒类型：蠕虫

影响系统：Win9x/WinMe/WinNT/Win2000/WinXP

病毒行为:

编写工具:

传染条件:

发作条件:

系统修改:

从注册表主键HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun

删除如下键值:

MS Config v13

avserve2.exeUpdate Service

avserve.exe

Windows Update Service

WinUpdate

SysTray

Bot Loader

System Restore Service

Disk Defragmenter

Windows Security Manager

在注册表主键HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun

修改键值"Windows Update"="%System%*.exe" (注: *表示该文件名是随机生成的)

在注册表主键HKEY_LOCAL_MACHINESOFTWARESoftwareMicrosoftWireless

添加键值"ID"="*" (注: *表示一随机的字符串)

在注册表主键HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsConnections

添加键值"DefaultConnectionSettings"=

hex:3c,00,00,00,01,00,00,00,09,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00

在注册表主键HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsConnections

添加键值"SavedLegacySettings"=

hex:3c,00,00,00,03,00,00,00,09,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00

将自身拷贝到%System%*.exe (注: *表示该文件名是随机生成的)

发作现象:

特别说明:

该病毒会从指定URL下载某个exe文件并在受感染系统上运行