标题：Win32.Troj.FlyBird
概述
病毒别名：
处理时间：2003-12-23
威胁级别：★★
中文名称：烈火凤凰
病毒类型：木马
影响系统：Win9x/Win2000/WinXP
病毒行为:
编写工具：
VC
传染条件:
被欺骗运行，或是人为安装
发作条件:
运行时发作
对系统的修改
A.自我复制到C:windowssystem32目录
NetBios.exe
NetServer.exe
WinNote.exe
WinLoadfile.exe
WinAuto.exe
WinServer.exe
WinProfile.exe
自我复制到C:windowssystem目录
WinConfig.exe
B.在C盘根目录创建以下文件
Autoexec.bat (如果存在该文件，病毒将覆盖该文件）
Config.bat
文件内容为指向病毒复本的指令
C.修改Win9x系统配置文件Win.ini
[files] 
Run=C:windowssystem32WinProfile.exe
Load=C:windowssystem32WinLoadFile.exe
使用病毒可随机启动
D.添加注册表中的以下键和键值，使病毒可随机启动
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
WinServer.exe="C:Windowssystem32WinServer.exe"
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun 
WinBios.exe ="C:Windowssystem32WinBios.exe"
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunSOFTWARE 
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoft 
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoftWindows 
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoftWindowsCurrentVersion 
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoftWindowsCurrentVersionRun 
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoftWindowsCurrentVersionRun 
WinBios.exe="C:Windowssystem32WinBios.exe"
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoftWindowsCurrentVersionRunSOFTWARE 
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoft 
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoftWindows HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoftWindowsCurrentVersion 
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoftWindowsCurrentVersionRunOnce 
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoftWindowsCurrentVersionRunSOFTWAREMicrosoftWindowsCurrentVersionRunOnce 
NetBios.exe="C:Windowssystem32NetBios.exe"
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionWinlogon 
LegalNoticeCaption="烈火凤凰"
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionWinlogon 
LegalNoticeText="欢迎进入魔域之界"
E.添加以下键值修改txt、inf、reg文件关联，当打开这些类型文件时激活病毒
HKEY_LOCAL_MACHINESoftwareCLASSES xtfileshellopencommand 
(默认)="C:Windowssystem32WinNote.exe"
HKEY_LOCAL_MACHINESoftwareCLASSES.reg 
(默认)="txtfile"
HKEY_LOCAL_MACHINESoftwareCLASSES.inf 
(默认)="txtfile"
F.添加改注册表以下内容，禁用系统功能
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem 
DisableRegistryTools=dword:00000000
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer NoRun dword:00000000
NoDrives=dword:00000008
NoRealMode=dword:00000000
NoLogOff=dword:00000000
NoSetTaskBar=dword:00000000
NoChangeStartMenu=dword:00000000
NoStartMenu=dword:00000000
NoSetFolders=dword:00000000
NoFolderOptions=dword:00000000
NoFind=dword:00000000
NoRecentDocsMenu=dword:00000000
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerWinOlaApp D
isable dword:00000001
禁用注册表编辑器，使开始菜单没有“运行、文档、注销等”选项 
发作现象:
每次启动出现提示框，显示：
“欢迎进入魔域之界”
邮于病毒的恶意行为导致系统死机或崩溃。
特别说明: