标题：Worm.Ariss.e
病毒概述
病毒别名：Email-worm.Win32.Ariss.e[avp]
处理时间：
威胁级别：★★
中文名称：
病毒类型：蠕虫
影响系统：Win9x / WinNT
病毒行为
该病毒会遍历驱动器，把自己复制到各个驱动器下，并且还会查找本机存在的一些其它病毒，同时会删除这些病毒，来保护自己，病毒会为用户到symantec去下载一个对W32.Serflog病毒的专杀，来麻痹用户，以为机子上没有病毒了，来达到病毒长期留在机器上，修改注册表来达到下次启动自己
1。以不同的名字拷贝自身到
C:\MS_LARISSA.pif 
%systemroot%\ISASS32.pif 
%system32%\L4r1$.pif
%system32%\Service.pif 
D:\MS_LARISSA.pif
2。创建一个txt文件，C:\BROPIA_IS_LAMER.txt
内容为：
0MG, BROPIA = N00B hahahaha - u still writing ur w0rmz in VB... LMAO
Whatz wrong cant do C++? L-A-M-E :-) anyone can write wormz in VB
----------------------------------------------
- QUOTE FROM F-SECURE -
The worm's file is a PE executable file about 17 kilobytes long packed with Mew file
compressor. The unpacked file's size is over 155 kilobytes. The worm is written in Visual
Basic.
- END QUOTE - 
hahaha, and u were callen me a n00b? -- LARISSA AUTHOR : 3-7-05
3。修改注册表，来达到下次启动的目的
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run L4r1$ "C:\WINNT\System32\L4r1$.pif"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LSASS 32 "C:\WINNT\ISASS32.pif"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Service "C:\WINNT\System32\Service.pif"
4。删除本机的以下病毒
C:\Drunk_lol.pif
C:\WINDOWS\System32\Drunk_lol.pif
C:\WINDOWS\System\Drunk_lol.pif
C:\Winnt\System\Drunk_lol.pif
C:\Webcam_004.pif
C:\WINDOWS\System32\Webcam_004.pif
C:\WINDOWS\System\Webcam_004.pif
C:\Winnt\System\Webcam_004.pif
C:\sexy_bedroom.pif
C:\WINDOWS\System32\sexy_bedroom.pif
C:\WINDOWS\System\sexy_bedroom.pif
C:\Winnt\System\sexy_bedroom.pif
C:\naked_party.pif
C:\WINDOWS\System32\naked_party.pif
C:\WINDOWS\System\naked_party.pif
C:\Winnt\System\naked_party.pif
C:\love_me.pif
C:\WINDOWS\System32\love_me.pif
C:\WINDOWS\System\love_me.pif
C:\Winnt\love_me.pif
C:\osm.exe
C:\WINDOWS\System32\lexplore.exe
C:\WINDOWS\System\lexplore.exe
C:\Winnt\System\lexplore.exe
C:\LOL.scr
C:\Webcam.pif
C:\hahahaha.pif
C:\me_2005.pif
C:\sister.pif
C:\cz.exe
C:\WINDOWS\System32\winhost.exe
C:\WINDOWS\System\winhost.exe
C:\Winnt\System\winhost.exe
C:\LOL.scr
C:\Webcam.pif
C:\bedroom-thongs.pif
C:\naked_drunk.pif
C:\LMAO.pif
C:\ROFL.pif
C:\underware.pif
C:\Hot.pif
C:\new_webcam.pif
C:\WINDOWS\System32\msnus.exe
C:\WIDNOWS\System\msnus.exe
C:\Winnt\System\msnus.exe
C:\sexy.jpg
C:\WINDOWS\System32\updates.exe
C:\WINDOWS\System\updates.exe
C:\Winnt\System\updates.exe
C:\WINDOWS\System32\msnmsr.exe
C:\WINDOWS\System\msnmsr.exe
C:\Winnt\System\msnsr.exe
C:\Webcam.pif
C:\bedroom-things.pif
C:\naked_drunk.pif
C:\my_pussy.pif
C:\WINDOWS\System32\ISASS.EXE
C:\WINDOWS\System\ISASS.EXE
C:\Winnt\System\ISASS.EXE
C:\Beautiful Ass.pif
C:\John Kerry as Super Chicken.scr
C:\Kool.pif
C:\Me & you pic!.pif
C:\Me Pissed!.pif
C:\sexy.pif
C:\She Could Fit her Ass in a Teacup.pif
C:\she',27h,'s fuckin fit.pif
C:\titanic2.jpg.pif
C:\WINDOWS\System32\winis.exe
C:\WINDOWS\System\winis.exe
C:\Winnt\System\winis.exe
C:\WINDOWS\System32\nvsc32.exe
C:\WINDOWS\System\nvsc32.exe
C:\Winnt\System\nvsc32.exe
C:\Crazy-Frog.Html
C:\Annoying crazy frog getting killed.pif
C:\Crazy frog gets killed by train!.pif
C:\Fat Elvis! lol.pif
C:\How a Blonde Eats a Banana...pif
C:\Jennifer Lopez.scr
C:\LOL that ur pic!.pif
C:\lspt.exe
C:\Me on holiday!.pif
C:\Mona Lisa Wants Her Smile Back.pif
C:\My new photo!.pif
C:\See my lesbian friends.pif
C:\The Cat And The Fan piccy.pif
C:\Topless in Mini Skirt! lol.pif
C:\WINDOWS\System32\formatsys.exe
C:\WINDOWS\System\formatsys.exe
C:\WINDOWS\System32\serbw.exe
C:\WINDOWS\System\serbw.exe
C:\WINDOWS\msmbw.exe
传染方式
通过邮件
病毒发送邮件到所有通过MAPI接触到的地址，它创建的邮件有以下特征：
主题：Re: LOV YA! 或 Re:My Letter 或 Re:Your Documents
内容：
“Kindly read and reply to my LOVE LETTER in attachments :-)”
或Your personal information is included in the attachments.
或The DOCUMENTS you requested are in the attachments.
或Your Administrator settings have been changed, please check the attachments for more details.
或Please read and reply to my LETTER in the attachments!
附件:
LOVE_LETTER_FOR_YOU.exe
6。病毒会访问
为用户下载一个对W32.Serflog病毒的专杀