标题：Worm.Mydoom.t
病毒简述
病毒别名：I-Worm.Mydoom.t[AVP]
处理时间：
威胁级别：★★
中文名称：诺威格变种T
病毒类型：蠕虫
影响系统：Win9x/WinNT/Win2K/WinXP/Win2003
病毒行为:
编写工具:
传染条件:
发作条件:
病毒对系统的修改
系统修改:
1.在注册表主键"HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun"下，
添加如下键值："WinSPF"="%System%windrv32.exe"
2.在注册表主键"HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun"下，
添加如下键值："WinSPF"="%System%windrv32.exe"
3.在注册表主键"HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsUserAgent"下
，添加如下键值："Version"="FrankenShteiN"
4.在注册表主键"HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsUserAgent"下，
添加如下键值："Version"="FrankenShteiN"
5.在注册表主键"HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionInternet Settings5.0UserAgent"下，
添加如下键值："Version"="FrankenShteiN"
6.在注册表主键"HKEY_LOCAL_MACHINEMicrosoftWindowsCurrentVersionInternet Settings5.0UserAgent"下，
添加如下键值："Version"="FrankenShteiN"
7.在注册表主键"HKEY_CURRENT_USERSOFTWAREMicrosoftInternet Explorer"下，
添加如下键值："FuckedInst"="1"
8.从下列网站下载一个后门程序,并执行该后门程序
www.llc.unibo.it 
www.surrenderzeeland.nl 
www.mercyships.de 
www.hiw.kuleuven.ac.be 
www.ach.ch 
vugs.geog.uu.nl 
www.planetboredom.net 
guttorm.hveem.no
9.创建一个名为"WWWdefacedWWW"的互斥量,确保当前系统中只有病毒的一份副本在运行
10.从以下几个途径取得Email地址:
A.Outlook地址本
B.从这些文件中搜索地址(.wab .xls 
.vbs 
.uin 
.txt 
.tbb 
.stm 
.sht 
.php 
.msg 
.mht 
.jsp 
.htm 
.eml 
.dht 
.dbx 
.cgi 
.cfg 
.asp
11.该病毒不会把Email发送到包含以下字符串的邮箱中:
gold-certs 
feste 
submit 
help 
service 
privacy 
somebody 
contact 
site 
someone 
anyone 
nothing 
nobody 
noreply 
noone 
webmaster 
news 
rating 
postmaster 
samples 
info 
root 
www 
upport 
abuse 
accoun 
certific 
listserv 
bsd 
ntivi 
admin 
icq.com 
mozilla 
utgers.ed 
tanford.e 
pgp 
acketst 
secur 
isc.o 
isi.e 
ripe. 
arin. 
sendmail 
rfc-ed 
ietf 
iana 
usenet 
fido 
kernel 
google 
ibm.com 
fsf. 
gnu 
mit.e 
math 
berkeley 
support 
messagelabs 
antivi 
kasp 
linux 
unix 
spam 
@iana 
@foo. 
.mil 
gov. 
.gov 
icrosoft 
ruslis 
nodomai 
mydomai 
example 
inpris 
borlan 
sopho 
panda 
icrosof 
syman 
avp.
该病毒的邮件相关信息如下:
From:
这个信息是病毒假造的
它会查询注册表
HKEY_CURRENT_USERSoftwareMicrosoftOfficeOutlookOMI Account ManagerAccouts 
HKEY_CURRENT_USERSoftwareMicrosoftInternet Account ManagerAccounts
如果查询失败则随机选取以下字符串为名:
Leon 
Tommy 
Lloyd 
Bill 
Ronnie 
Jon 
Alex 
Calvin 
Tom 
Jim 
Jay 
Oscar 
Miguel 
Clifford 
Theodore 
Micheal 
Marcus 
Francisco 
Leroy 
Mario 
Bernard 
Alexander 
Barry 
Randall 
Troy 
Ricky 
Carl 
Henry 
Douglas 
Harold 
Peter 
Patrick 
Walter 
Dennis 
Jerry 
Joshua 
Gregory 
Raymond 
Andrew 
Stephen 
Eric 
Scott 
Frank 
Jeffrey 
Larry 
Jose 
Timothy 
Gary 
Matthew 
Jason 
Kevin 
Anthony 
Ronald 
Brian 
Edward 
Steven 
Kenneth 
George 
Donald 
Mark 
Paul 
Daniel 
Christopher 
Thomas 
Joseph 
Charles 
Richard 
David 
William 
Michael 
Robert 
John 
James
且随机选取下面的字符串为姓:
Porter 
Tucker 
Stevens 
Simpson 
Webb 
Wells 
Freeman 
Murray 
Gomez 
Ortiz 
Marshall 
Cruz 
Parker 
Campbell 
Phillips 
Turner 
Roberts 
Perez 
Mitchell 
Carter 
Nelson 
Gonzalez 
Baker 
Adams 
Green 
Hill 
Lopez 
Wright 
King 
Hernandez 
Young 
Allen 
Hall 
Walker 
Lee 
Lewis 
Rodriguez 
Clark 
Robinson 
Martinez 
Garcia 
Thompson 
Martin 
Harris 
White 
Jackson 
Anderson 
Taylor 
Moore 
Wilson 
Miller 
Davis 
Brown 
Jones 
Williams 
Johnson 
Smith
且随机选取以下字符串为域名:
cox.net 
yahoo.com 
msn.com 
yahoo.co.uk 
t-online.de 
gmx.net 
hotmail.com 
aol.com 
mail.com 
dailymail.co.uk
Subject:(随机)
You win! 
thanks! 
Thank you! 
read it immediately 
Re: Your document 
Re: Status 
Re: Question 
Re: Proof of concept 
Re: Message 
Re: Hi 
Re: Hello 
Private document 
Notice again 
News 
Information 
important 
Hi! 
here 
hello
Body:(随机)
screensaverlol! 
fun photos 
New game 
relax 
Virus removal tool 
You are infected by virus. Run this exe 
apply this patch! 
apply patch. 
game 
fun game! 
fun! 
lol! 
See the file. 
See attached file for details. 
Please read the important document. 
Please read the attached file. 
Please confirm the document. 
I have attached document. 
Your requested mail has been attached. 
Your archive is attached. 
Waiting for a Response. Please read the attachment. 
Thanks! 
Please see the attached file for details 
Please read the document. 
Please read the attached file! 
Please confirm! 
Please answer quickly! 
Monthly news report. 
For more details see the attachment. 
For further details see the attachment. 
Can you confirm it?
Attachment:(附件有可能是.zip或可执行文件)
如果是.zip则附件可能为:
message,.zip 
letter.zip 
information.zip 
info.zip 
file.zip 
details.zip 
data.zip 
bill.zip 
new.zip 
report.zip 
doc.zip 
document.zip
该.zip文件可能包含以下文件:(随机)
Message.html .pif 
rep.txt .pif 
bill.txt .pif 
review.txt .pif 
report.txt .pif 
mesg.txt .pif 
doc.txt .pif 
bill.rtf .pif 
review.rtf .pif 
report.rtf .pif 
mesg.rtf .pif 
doc.rtf .pif 
bill.doc .pif 
review.doc .pif 
report.doc .pif 
mesg.doc .pif 
doc.doc .pif 
document.doc .pif
如果为可执行程序文件
则可能为:
lol.scr 
fun.scr 
antivirus.exe 
patch.exe 
new.exe 
pic.exe 
photo.exe 
game.exe 
file.exe
发作现象:
特别说明: