Worm.Sower
病毒别名： 处理时间：2006-08-03 威胁级别：★★
中文名称：索尔 病毒类型：蠕虫 影响系统：Win 9x/ME,Win 2000/NT,Win XP,Win 2003
病毒行为:
这是一个可以通过多种方式传播的蠕虫病毒。该病毒的主要危害是结束大量反病毒软件，降低系统的安全等级。
1，生成文件
%system%RAVMOND.exe
%system%IEXPLORE.EXE
%system%kernel66.dll
%system%msjdbc11.dll
%system%MSSIGN30.DLL
%windows%SYSTRA.EXE
2，添加启动项
HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWindows
"run" = "RAVMOND.exe"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
"VFW Encoder/Decoder Settings" = "RUNDLL32.EXE MSSIGN30.DLL ondll_reg"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
unServices
"SystemTra" = "%windows%SYSTRA.EXE"
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices\_reg
"ImagePath" = "Rundll32.exe msjdbc11.dll ondll_server"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
"Program In Windows" = "%system%IEXPLORE.EXE"
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindows Management Protocol v.0 (experimental)
"ImagePath" = "Rundll32.exe msjdbc11.dll ondll_server"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
"Protected Storage" = "RUNDLL32.EXE MSSIGN30.DLL ondll_reg"
3，结束含有下列字符串的进程
RISING
SKYNET
SYMANTEC
MCAFEE
GATE
RFW.EXE
RAVMON.EXE
KILL
NAV
DUBA
KAV
KV
4，通过可移动磁盘传播
枚举磁盘驱动器，拷贝下列病毒文件到磁盘根目录
随机文件名
PassWord
book
letter
bak
WORK
Important
TEST 666
TEST
exe_start
Anti_virus_v99
随机后缀名
.ZIP
.RAR
.scr
.pif
.com
.exe
command.exe
autorun.inf
autorun.inf内容
[AUTORUN]
Open="%c:COMMAND.EXE"
5，通过p2p文件共享软件传播
拷贝下列病毒文件到共享目录
Thank you.doc.exe
3D Flash Animator.rar.bat
SWF Browser2.93.txt.exe
Download.exe
Panda Crack.zip.exe
WinRAR V3.2.0 Beta 2.exe
Swish2.00.pif
AAdobe Photoshop7.0 creak.pif
You_Life.JPG.pif
CloneCD crack.exe
WinZip v9.0 Beta Build 5480 crack.exe
Real-DRAW PRO v3.10.exe
Star Wars Downloader.exe
HyperSnap-DX v5.20.01.exe
Adobe Photoshop6.0.zip.exe
HyperSnap-DX v4.51.01.exe
6，通过弱口令攻击传播
系统弱帐号及弱口令如下：
Guest
Administrator
zxcv
yxcv
xxx
xp
win
test123
test
temp123
temp
sybase
super
sex
secret
pwd
pw123
pw
pc
Password
owner
oracle
mypc123
mypc
mypass123
mypass
love
login
Login
Internet
home
godblessyou
god
enable
database
computer
alpha
admin123
Admin
abcd
aaa
a
88888888
2600
2003
2002
123asd
123abc
123456789
1234567
123123
121212
12
11111111
110
007
00000000
000000
0
pass
54321
12345
password
passwd
server
sql
!@#$%^&*
!@#$%^&
!@#$%^
!@#$%
asdfgh
asdf
!@#$
1234
111
1
root
abc123
12345678
abcdefg
abcdef
abc
888888
666666
111111
admin
administrator
guest
654321
123456
321
123
7，邮件传播
邮件内容：
If you can keep your head when all about you
Are losing theirs and blaming it on you;
If you can trust yourself when all men doubt you,
But make allowance for their doubting too;
If you can wait and not be tired by waiting,
Or, being lied about,don't deal in lies,
Or, being hated, don't give way to hating,
And yet don't look too good, nor talk too wise;
... ... more look to the attachment.
附件名：
the hardcore game-.pif
Sex in Office.rm.scr
Deutsch BloodPatch!.exe
s3msong.MP3.pif
Me_nude.AVI.pif
How to Crack all gamez.exe
Macromedia Flash.scr
SETUP.EXE
Shakira.zip.exe
dreamweaver MX (crack).exe
StarWars2 - CloneAttack.rm.scr
Industry Giant II.exe
DSL Modem Uncapper.rar.exe
joke.pif
Britney spears nude.exe.txt.exe
I am For u.doc.exe