|
文件名称：winsvr.exe
文件大小：83456 字节
AV命名：(Backdoor.Win32.IRCBot.bzr) Kaspersky
加壳方式：EXECryptor 2.2/2.3
文件MD5：f3e0d520951efb80e6aec58fec415d7f
病毒类型：Msn蠕虫
行为分析：
1、释放文件：
C:\WINDOWS\system32\winsvr.exe 83456 字节
2、添加启动：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
(注册表值) Windows Server! = "winsvr.exe"
3、重启删除旧文件：
Registry Group: System Critical Object: Registry key: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager Registry value: PendingFileRenameOperations Type: REG_MULTI_SZ Value: \??\C:\DOCUME~1\孤独更~1\桌面\MYPHOT~1.COM
4、链接IRC服务器: IRC@ser***8.core.net,相应命令
5、查找MSN好友，并发送病毒副本和一些文字：
checkout my newest pic before I upload!! hey over there... check out my new photo! when youre around accept.. its my new default pic. u seen this crazy shit? holy shit this new pic is hot as fuck! I just made this design for a friend. U like it? I think I had sex with them :X What should i do? You don''t think I had sex with them... rite? Is it horrible if I only remember the sex? Is this really a pic of you? Would you have had a threesome with them? Wow! I can''t believe I had a threesome with them! You see these crazy people? Almost havin sex on the dance floor! How hot is this? Damn this is sexy! u want to see something really funny? Take a look! I cant stop laughing! do you like this picture I took? could I have had sex with them? new party pictures :) WOW it was insane! You want to see something insanely funny? accept this. OMG :) Do you like sexyness? accept this and you will find out ;) Beer-More Beer-dancing is a bad idea. Look what happaned! want to see my new pics? Take a look. I just found this nasty pic.. its just wrong, but you need to see it! Just look at the new shirt I got ;) This is my newest webcam.. The pic quality on it alrite? I think I just found an old picture of you...want it? here it is! dont freakout when you see this picture you might scream when you see this picture lol plz dont kill me for sending you this picture, you''ve got to see it! haha this picture of you is HILARIOUS! let me introduce you to my newest friend :) accept already Wow I got so fucked last night. Just look at the pic! just found new myspace pics! here crazy facebook pics accept ;] You didn''t have sex with them... or did u? I think I slept with them! Could I have slept with them? this person looks like you. It''s just freaky. watch out.. this picture im sending you is sooooo nasty!! do I look good with this new mix? Hey! ya wanna see my new pic? Someone just tagged me in this picture. Man am I wasted. did I send you my new pic? if not here it is :) How do we look together? this picture is so amazing I cannot believe it!!! want me to tag you in this picture on facebook? Fucks sake this is really you? can I add your picture to my new album? Does my new hair style look good? checkout the newest faster car.. it is incredible! do I look good in this picture? Hi, remember this picture of you? I think u were wasted :X You look so sexy in this picture! do you like dogs? Just look at the one my parents adopted. Damn this is some good pole dancing! can I post this picture of us to my new blog? This is so hot I want it badly, just look already! I got a new car!! look at the pics! Man this girl got soo fucked last night! do you know this person on this picture? I think you do ;) I think you will faint when you see this pic I was so drunk at this party.. check it out lol I can''t believe I am in this picture look! My lord last night was crazy. Look at the pic I snapped! haha you''re gonna laugh hard when you see this I took this pic on my vacation:) this is so nasty... I''m pretty sure I just slept with them :X What do i do? I look so fat in this pic :( your mom is in this picture lol I like this picture of you a lot :)
解决方法：
1、断开网络连接，打开注册表至(开始菜单－运行－输入“regedit”进入注册表依次找到说明选项并按提示操作)：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
删除“Windows Server!”键。
也可以用SREng删除（可到down.45it.com下载）。
2、重启计算机，删除文件：
C:\WINDOWS\system32 (文件) winsvr.exe |