标题：Worm.Beagle.bb
病毒名片
病毒别名：E-mail-Worm.Win32.Bagle.bd[AVP] 
处理时间：2005-03-01
威胁级别：★★★
中文名称：恶鹰bb
病毒类型：蠕虫
影响系统：Win9x / WinNT
病毒长度：34304
病毒行为
删除注册表①删除注册表HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run中的以下键：
Symantec NetDriver Monitor
ccApp
NAV CfgWiz
SSC_UserPrompt
McAfee Guardian
APVXDWIN
KAV50
avg7_cc
avg7_emc
Zone Labs Client
②删除注册表
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
中的以下键
McAfee.InstantUpdate.Monitor
③删除以下注册表键
HKLM\SOFTWARE\Symantec
HKLM\SOFTWARE\McAfee
HKLM\SOFTWARE\KasperskyLab
HKLM\SOFTWARE\Agnitum
HKLM\SOFTWARE\Panda Software
HKLM\SOFTWARE\Zone Labs
以阻止安全软件运行
添加注册表项HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"winshost.exe" = "%system%\winshost.exe"
病毒生成以下文件%System%\winshost.exe（病毒本身）
%System%\wiwshost.exe
隐藏进程尝试远程注入Explorer.exe，以隐藏进程
尝试关闭以下字符进程wuauserv
PAVSRV
PAVFNSVR
PSIMSVC
Pavkre
PavProt
PREVSRV
PavPrSrv
SharedAccess
navapsvc
NPFMntor
Outpost Firewall
SAVScan
SBService
Symantec Core LC
ccEvtMgr
SNDSrvc
ccPwdSvc
ccSetMgr.exe
SPBBCSvc
KLBLMain
avg7alrt
avg7updsvc
vsmon
CAISafe
avpcc
fsbwsys
backweb client - 4476822
backweb client-4476822
fsdfwd
F-Secure Gatekeeper Handler Starter
FSMA
KAVMonitorService
navapsvc
NProtectService
Norton Antivirus Server
VexiraAntivirus
dvpinit
dvpapi
schscnt
BackWeb Client - 7681197
F-Secure Gatekeeper Handler Starter
FSMA
AVPCC
KAVMonitorService
Norman NJeeves
NVCScheduler
nvcoas
Norman ZANDA
PASSRV
SweepNet
SWEEPSRV.SYS
NOD32ControlCenter
NOD32Service
PCCPFW
Tmntsrv
AvxIni
XCOMM
ravmon8
SmcService
BlackICE
PersFW
McAfee Firewall
OutpostFirewall
NWService
alerter
sharedaccess
NISUM
NISSERV
vsmon
nwclnth
nwclntg
nwclnte
nwclntf
nwclntd
nwclntc
wuauserv
navapsvc
Symantec Core LC
SAVScan
kavsvc
DefWatch
Symantec AntiVirus Client
NSCTOP
Symantec Core LC
SAVScan
SAVFMSE
ccEvtMgr
navapsvc
ccSetMgr
VisNetic AntiVirus Plug-in
McShield
AlertManger
McAfeeFramework
AVExch32Service
AVUPDService
McTaskManager
Network Associates Log Service
Outbreak Manager
MCVSRte
mcupdmgr.exe
AvgServ
AvgCore
AvgFsh
awhost32
Ahnlab task Scheduler
MonSvcNT
V3MonNT
V3MonSvc
FSDFWD
修改Host文件127.0.0.1 localhost
127.0.0.1 ad.doubleclick.net
127.0.0.1 ad.fastclick.net
127.0.0.1 ads.fastclick.net
127.0.0.1 ar.atwola.com
127.0.0.1 atdmt.com
127.0.0.1 avp.ch
127.0.0.1 avp.com
127.0.0.1 avp.ru
127.0.0.1 awaps.net
127.0.0.1 banner.fastclick.net
127.0.0.1 banners.fastclick.net
127.0.0.1 ca.com
127.0.0.1 click.atdmt.com
127.0.0.1 clicks.atdmt.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 download.microsoft.com
127.0.0.1 downloads.microsoft.com
127.0.0.1 engine.awaps.net
127.0.0.1 fastclick.net
127.0.0.1 f-secure.com
127.0.0.1 ftp.f-secure.com
127.0.0.1 ftp.sophos.com
127.0.0.1 go.microsoft.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 mast.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 media.fastclick.net
127.0.0.1 msdn.microsoft.com
127.0.0.1 my-etrust.com
127.0.0.1 nai.com
127.0.0.1 networkassociates.com
127.0.0.1 office.microsoft.com
127.0.0.1 phx.corporate-ir.net
127.0.0.1 secure.nai.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 service1.symantec.com
127.0.0.1 sophos.com
127.0.0.1 spd.atdmt.com
127.0.0.1 support.microsoft.com
127.0.0.1 symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 vil.nai.com
127.0.0.1 viruslist.ru
127.0.0.1 windowsupdate.microsoft.com
127.0.0.1 www.avp.ch
127.0.0.1 www.avp.com
127.0.0.1 www.avp.ru
127.0.0.1 www.awaps.net
127.0.0.1 www.ca.com
127.0.0.1 www.fastclick.net
127.0.0.1 www.f-secure.com
127.0.0.1 www.kaspersky.ru
127.0.0.1 www.mcafee.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.nai.com
127.0.0.1 www.networkassociates.com
127.0.0.1 www.sophos.com
127.0.0.1 www.symantec.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.viruslist.ru
127.0.0.1 ftp://ftp.kasperskylab.ru/updates/
127.0.0.1 ftp://ftp.avp.ch/updates/
127.0.0.1 http://www.kaspersky.ru/updates/
127.0.0.1 http://updates1.kaspersky-labs.com/updates/
127.0.0.1 http://updates3.kaspersky-labs.com/updates/
127.0.0.1 http://updates4.kaspersky-labs.com/updates/
127.0.0.1 http://updates2.kaspersky-labs.com/updates/
127.0.0.1 http://updates5.kaspersky-labs.com/updates/
127.0.0.1 http://downloads1.kaspersky-labs.com/updates/
127.0.0.1 http://www.kaspersky-labs.com/updates/
127.0.0.1 ftp://updates3.kaspersky-labs.com/updates/
127.0.0.1 ftp://downloads1.kaspersky-labs.com/updates/
127.0.0.1 www3.ca.com
127.0.0.1 ids.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 download.mcafee.com
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
尝试下载后门尝试从以下网站下载后门
http://www.***nit.ru/zo2.jpg
http://www.***honyflanagan.com/zo2.jpg
http://www.***roved1stmortgage.com/zo2.jpg
http://www.***ument.h12.ru/zo2.jpg
http://www.***ebek.de/zo2.jpg
http://www.***ek.org/zo2.jpg
http://www.***anfestival.nl/zo2.jpg
http://www.***ergut.at/zo2.jpg
http://www.***ation-center.de/zo2.jpg
http://www.***h.org/zo2.jpg
http://www.***ino.com/zo2.jpg
http://www.***tbuy.de/zo2.jpg
http://www.***a.mtw.ru/zo2.jpg
http://www.***-gsm.ru/zo2.jpg
http://www.***ssino.com/zo2.jpg
http://www.***eeyeinc.com/zo2.jpg
http://www.***aklight.be/zo2.jpg
http://www.***esko.net.pl/zo2.jpg
http://www.***system.com.kg/zo2.jpg
http://www.***partner.com.pl/zo2.jpg
http://www.***kyhosting.cz/zo2.jpg
http://www.***nneland.com/zo2.jpg
http://www.***psolutionstore.com/zo2.jpg
http://www.***cept.kg/zo2.jpg
http://www.***psite.com/zo2.jpg
http://www.***poncapital.net/zo2.jpg
http://www.***rkSydebaby.com/zo2.jpg
http://www.***ut-westerhoven.nl/zo2.jpg
http://www.***.kg/zo2.jpg
http://www.***rollendedisco.de/zo2.jpg
http://www.***cobaradventure.be/zo2.jpg
http://www.***fo.com/zo2.jpg
http://www.***ower.com.cn/zo2.jpg
http://www.***bank.kg/zo2.jpg
http://www.***nalazar.com/zo2.jpg
http://www.***cbiz.com/zo2.jpg
http://www.***opa.kg/zo2.jpg
http://www.***rett.wednet.edu/zo2.jpg
http://www.***ernet.hu/zo2.jpg
http://www.***ester.kg/zo2.jpg
http://www.***ocliparts.de/zo2.jpg
http://www.***onw.org/zo2.jpg
http://www.***esites.com.br/zo2.jpg
http://www.***bunker.de/zo2.jpg
http://www.***world.tv/zo2.jpg
http://www.***eser.com@share.gameser.com/zo2.jpg
http://www.***-bln.de/zo2.jpg
http://www.***et.ru/zo2.jpg
http://www.***ntrevenue.com/zo2.jpg
http://www.***psi.org/zo2.jpg
http://www.***vr.com/zo2.jpg
http://www.***gmart.net/zo2.jpg
http://www.***-group.net/zo2.jpg
http://www.***usionoflife.net/zo2.jpg
http://www.***ocuspromo.com/zo2.jpg
http://www.***naswelt.de/zo2.jpg
http://www.***senboiler.com/zo2.jpg
http://www.***net.pl/zo2.jpg
http://www.***ibeiro.com/zo2.jpg
http://www.***elleryamberproducts.com/zo2.jpg
http://www.***vann.com/zo2.jpg
http://www.***r.ca/zo2.jpg
http://www.***danramey.net/zo2.jpg
http://www.***-musik-sound.de/zo2.jpg
http://www.***trepublicans.com/zo2.jpg
http://www.***el.kg/zo2.jpg
http://www.***cks.nl/zo2.jpg
http://www.***bers.pl/zo2.jpg
http://www.***aionon.com/zo2.jpg
http://www.***us.kg/zo2.jpg
http://www.***dtraining.de/zo2.jpg
http://www.***nenberg.de/zo2.jpg
http://www.***nenberg.de:113547@/zo2.jpg
http://www.***rus.com.pl/zo2.jpg
http://www.***online.de/zo2.jpg
http://www.***elaino.com/zo2.jpg
http://www.***form.com.au/zo2.jpg
http://www.***texgroup.com/zo2.jpg
http://www.***hrak.de/zo2.jpg
http://www.***hrak.de:prophets@/zo2.jpg
http://www.***oseiten.de/zo2.jpg
http://www.***icbottle.com.tw/zo2.jpg
http://www.***server.cz/zo2.jpg
http://www.***a-spass.com/zo2.jpg
http://www.***a.kg/zo2.jpg
http://www.***bisu.de/zo2.jpg
http://www.***mh.de/zo2.jpg
http://www.***design.com/zo2.jpg
http://www.***ansit.kg/zo2.jpg
http://www.***tech.kg/zo2.jpg
http://www.***onfotoshare.com/zo2.jpg
http://www.***osti.kg/zo2.jpg
http://www.***kg/zo2.jpg
http://www.***positiveplace.org/zo2.jpg
http://www.***ine.kg/zo2.jpg
http://www.***ngesuburban.5u.com/zo2.jpg
http://www.***.ch/zo2.jpg
http://www.***eantpage.com/zo2.jpg
http://www.***kration.com/zo2.jpg
http://www.***a-agility.com/zo2.jpg
http://www.***racing.net/zo2.jpg
http://www.***dfinder-leobersdorf.com/zo2.jpg
http://www.***ni.cz/zo2.jpg
http://www.***stk.edu.pl/zo2.jpg
http://www.***izeimotorrad.de/zo2.jpg
http://www.***way-consulting.com/zo2.jpg
http://www.***etsoundyc.org/zo2.jpg
http://www.***landia-boogie.pl/zo2.jpg
http://www.***oto.co.za/zo2.jpg
http://www.***coinc.com/zo2.jpg
http://www.***lgps.com/zo2.jpg
http://www.***lty.kg/zo2.jpg
http://www.***lightpictures.com/zo2.jpg
http://www.***iance-yachts.com/zo2.jpg
http://www.***ocationflorida.com/zo2.jpg
http://www.***talstation.com/zo2.jpg
http://www.***raquadros.com.br/zo2.jpg
http://www.***ming.kg/zo2.jpg
http://www.***ohalle.be/zo2.jpg
http://www.***nex-medical.fi/zo2.jpg
http://www.***ping4success.com/zo2.jpg
http://www.***t.ru/zo2.jpg
http://www.***i.lu/zo2.jpg
http://www.***dochron.pl/zo2.jpg
http://www.***.kg/zo2.jpg
http://www.***ifc.ca/zo2.jpg
http://www.***dtmeyers.de/zo2.jpg
http://www.***dtmeyers.de:R2D2c3po@/zo2.jpg
http://www.***rlingirb.com/zo2.jpg
http://www.***assetholdings.com/zo2.jpg
http://www.***ntomierz.art.pl/zo2.jpg
http://www.***sa.pl/zo2.jpg
http://www.***bourenvereine.ch/zo2.jpg
http://www.***now.opoka.org.pl/zo2.jpg
http://www.***muraene.com/zo2.jpg
http://www.***muraene.com:hunter@/zo2.jpg
http://www.***royalregistry.com/zo2.jpg
http://www.***nsportation.gov.bh/zo2.jpg
http://www.***ar.kg/zo2.jpg
http://www.***guska.hu/zo2.jpg
http://www.***keyhomes.com/zo2.jpg
http://www.***keyhomes.com@/zo2.jpg
http://www.***iano.org/zo2.jpg
http://www.***city.pl/zo2.jpg
http://www.***.info/zo2.jpg
http://www.***ezcourtesymanagement.com/zo2.jpg
http://www.***rix.com/zo2.jpg
http://www.***park.pl/zo2.jpg
http://www.***ompete.com/zo2.jpg
http://www.***pl/zo2.jpg
http://www.***ebad.com/zo2.jpg
http://www.***ger321.wz.cz/zo2.jpg
http://www.***diamonds.com/zo2.jpg
http://www.***der-yachting.com/zo2.jpg
防范方式
注意收到邮件题目是否有"Re:IncomingMessage"、"Re:Hello"、"Re:Thanks:)"、"Incomingmessage”等文字，附件名字是否为为"Details"、"Message"、"Readme"、"Info"等，如果有，或者邮件由不明用户发来的时候，一定要使用最新版的杀毒软件对其进行扫描，以免中毒。