标题：Worm.Saros.a
病毒行为
1.复制自身到以下文件:WINDOWSsystem32NonYou.exe 
WINDOWSsystem32Love-ScreenSaver.scr 
WINDOWSsystem32MSOutlookInternetUpdate.exe 
progra~1KazaaMy Shared FolderRosy.exe 
progra~1KazaaMy Shared FolderPipponoto.exe 
progra~1KazaaMy Shared FolderAnastacia - Left Outside Alone.mp3.exe 
progra~1KazaaMy Shared FolderThe Rasmus - In The Shadows.mp3.exe 
progra~1KazaaMy Shared Folder50 Cent - In da Club.mp3.exe 
progra~1KazaaMy Shared FolderVanessa Carltron - Ordinary Day.mp3.exe 
progra~1KazaaMy Shared FolderHaiducii - Dragostea Din Tei.mp3.exe 
progra~1KazaaMy Shared FolderBlack Eyed Peas - Hey Mama.mp3.exe 
progra~1KazaaMy Shared FolderRaf - In tutti i miei giorni.mp3.exe 
progra~1KazaaMy Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe 
progra~1KazaaMy Shared FolderLionel Richie - Just For You.mp3.exe 
progra~1Kazaa LiteMy Shared FolderRosy.exe 
progra~1Kazaa LiteMy Shared FolderPipponoto.exe 
progra~1Kazaa LiteMy Shared FolderAnastacia - Left Outside Alone.mp3.exe 
progra~1Kazaa LiteMy Shared FolderThe Rasmus - In The Shadows.mp3.exe 
progra~1Kazaa LiteMy Shared Folder50 Cent - In da Club.mp3.exe 
progra~1Kazaa LiteMy Shared FolderVanessa Carltron - Ordinary Day.mp3.exe 
progra~1Kazaa LiteMy Shared FolderHaiducii - Dragostea Din Tei.mp3.exe 
progra~1Kazaa LiteMy Shared FolderBlack Eyed Peas - Hey Mama.mp3.exe 
progra~1Kazaa LiteMy Shared FolderRaf - In tutti i miei giorni.mp3.exe 
progra~1Kazaa LiteMy Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe 
progra~1Kazaa LiteMy Shared FolderLionel Richie - Just For You.mp3.exe 
progra~1Kazaa Lite K++My Shared FolderRosy.exe 
progra~1Kazaa Lite K++My Shared FolderPipponoto.exe 
progra~1Kazaa Lite K++My Shared FolderAnastacia - Left Outside Alone.mp3.exe 
progra~1Kazaa Lite K++My Shared FolderThe Rasmus - In The Shadows.mp3.exe 
progra~1Kazaa Lite K++My Shared Folder50 Cent - In da Club.mp3.exe 
progra~1Kazaa Lite K++My Shared FolderVanessa Carltron - Ordinary Day.mp3.exe 
progra~1Kazaa Lite K++My Shared FolderHaiducii - Dragostea Din Tei.mp3.exe 
progra~1Kazaa Lite K++My Shared FolderHaiducii - Dragostea din tei.mp3.exe 
progra~1Kazaa Lite K++My Shared FolderRaf - In tutti i miei giorni.mp3.exe 
progra~1Kazaa Lite K++My Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe 
progra~1Kazaa Lite K++My Shared FolderLionel Richie - Just For You.mp3.exe 
progra~1ICQShared FolderRosy.exe 
progra~1ICQShared FolderPipponoto.exe 
progra~1ICQShared FolderAnastacia - Left Outside Alone.mp3.exe 
progra~1ICQShared FolderThe Rasmus - In The Shadows.mp3.exe 
progra~1ICQShared Folder50 Cent - In da Club.mp3.exe 
progra~1ICQShared FolderVanessa Carltron - Ordinary Day.mp3.exe 
progra~1ICQShared FolderHaiducii - Dragostea Din Tei.mp3.exe 
progra~1ICQShared FolderBlack Eyed Peas - Hey Mama.mp3.exe 
progra~1ICQShared FolderRaf - In tutti i miei giorni.mp3.exe 
progra~1ICQShared FolderVasco Rossi - Buoni e cattivi.mp3.exe 
progra~1ICQShared FolderLionel Richie - Just For You.mp3.exe 
progra~1GroksterMy GroksterRosy.exe 
progra~1GroksterMy GroksterPipponoto.exe 
progra~1GroksterMy GroksterAnastacia - Left Outside Alone.mp3.exe 
progra~1GroksterMy GroksterThe Rasmus - In The Shadows.mp3.exe 
progra~1GroksterMy Grokster50 Cent - In da Club.mp3.exe 
progra~1GroksterMy GroksterVanessa Carltron - Ordinary Day.mp3.exe 
progra~1GroksterMy GroksterHaiducii - Dragostea Din Tei.mp3.exe 
progra~1GroksterMy GroksterBlack Eyed Peas - Hey Mama.mp3.exe 
progra~1GroksterMy GroksterRaf - In tutti i miei giorni.mp3.exe 
progra~1GroksterMy GroksterVasco Rossi - Buoni e cattivi.mp3.exe 
progra~1GroksterMy GroksterLionel Richie - Just For You.mp3.exe 
progra~1BearshareSharedRosy.exe 
progra~1BearshareSharedPipponoto.exe 
progra~1BearshareSharedAnastacia - Left Outside Alone.mp3.exe 
progra~1BearshareSharedThe Rasmus - In The Shadows.mp3.exe 
progra~1BearshareShared50 Cent - In da Club.mp3.exe 
progra~1BearshareSharedVanessa Carltron - Ordinary Day.mp3.exe 
progra~1BearshareSharedHaiducii - Dragostea Din Tei.mp3.exe 
progra~1BearshareSharedBlack Eyed Peas - Hey Mama.mp3.exe 
progra~1BearshareSharedRaf - In tutti i miei giorni.mp3.exe 
progra~1BearshareSharedVasco Rossi - Buoni e cattivi.mp3.exe 
progra~1BearshareSharedLionel Richie - Just For You.mp3.exe 
progra~1eDonkey2000IncomingRosy.exe 
progra~1eDonkey2000IncomingPipponoto.exe 
progra~1eDonkey2000IncomingAnastacia - Left Outside Alone.mp3.exe 
progra~1eDonkey2000IncomingThe Rasmus - In The Shadows.mp3.exe 
progra~1eDonkey2000Incoming50 Cent - In da Club.mp3.exe 
progra~1eDonkey2000IncomingVanessa Carltron - Ordinary Day.mp3.exe 
progra~1eDonkey2000IncomingHaiducii - Dragostea Din Tei.mp3.exe 
progra~1eDonkey2000IncomingBlack Eyed Peas - Hey Mama.mp3.exe 
progra~1eDonkey2000IncomingRaf - In tutti i miei giorni.mp3.exe 
progra~1eDonkey2000IncomingVasco Rossi - Buoni e cattivi.mp3.exe 
progra~1eDonkey2000IncomingLionel Richie - Just For You.mp3.exe 
progra~1eMuleIncomingRosy.exe 
progra~1eMuleIncomingPipponoto.exe 
progra~1eMuleIncomingAnastacia - Left Outside Alone.mp3.exe 
progra~1eMuleIncomingThe Rasmus - In The Shadows.mp3.exe 
progra~1eMuleIncoming50 Cent - In da Club.mp3.exe 
progra~1eMuleIncomingVanessa Carltron - Ordinary Day.mp3.exe 
progra~1eMuleIncomingHaiducii - Dragostea Din Tei.mp3.exe 
progra~1eMuleIncomingBlack Eyed Peas - Hey Mama.mp3.exe 
progra~1eMuleIncomingRaf - In tutti i miei giorni.mp3.exe 
progra~1eMuleIncomingVasco Rossi - Buoni e cattivi.mp3.exe 
progra~1eMuleIncomingLionel Richie - Just For You.mp3.exe 
progra~1MorpheusMy Shared FolderRosy.exe 
progra~1MorpheusMy Shared FolderPipponoto.exe 
progra~1MorpheusMy Shared FolderAnastacia - Left Outside Alone.mp3.exe 
progra~1MorpheusMy Shared FolderThe Rasmus - In The Shadows.mp3.exe 
progra~1MorpheusMy Shared Folder50 Cent - In da Club.mp3.exe 
progra~1MorpheusMy Shared FolderVanessa Carltron - Ordinary Day.mp3.exe 
progra~1MorpheusMy Shared FolderHaiducii - Dragostea Din Tei.mp3.exe 
progra~1MorpheusMy Shared FolderBlack Eyed Peas - Hey Mama.mp3.exe 
progra~1MorpheusMy Shared FolderRaf - In tutti i miei giorni.mp3.exe 
progra~1MorpheusMy Shared FolderVasco Rossi - Buoni e cattivi.mp3.exe 
progra~1MorpheusMy Shared FolderLionel Richie - Just For You.mp3.exe 
progra~1LimeWireSharedRosy.exe 
progra~1LimeWireSharedPipponoto.exe 
progra~1LimeWireSharedAnastacia - Left Outside Alone.mp3.exe 
progra~1LimeWireSharedThe Rasmus - In The Shadows.mp3.exe 
progra~1LimeWireShared50 Cent - In da Club.mp3.exe 
progra~1LimeWireSharedVanessa Carltron - Ordinary Day.mp3.exe 
progra~1LimeWireSharedHaiducii - Dragostea Din Tei.mp3.exe 
progra~1LimeWireSharedBlack Eyed Peas - Hey Mama.mp3.exe 
progra~1LimeWireSharedRaf - In tutti i miei giorni.mp3.exe 
progra~1LimeWireSharedVasco Rossi - Buoni e cattivi.mp3.exe 
progra~1LimeWireSharedLionel Richie - Just For You.mp3.exe 
progra~1TeslaFilesRosy.exe 
progra~1TeslaFilesPipponoto.exe 
progra~1TeslaFilesAnastacia - Left Outside Alone.mp3.exe 
progra~1TeslaFilesThe Rasmus - In The Shadows.mp3.exe 
progra~1TeslaFiles50 Cent - In da Club.mp3.exe 
progra~1TeslaFilesVanessa Carltron - Ordinary Day.mp3.exe 
progra~1TeslaFilesHaiducii - Dragostea Din Tei.mp3.exe 
progra~1TeslaFilesBlack Eyed Peas - Hey Mama.mp3.exe 
progra~1TeslaFilesRaf - In tutti i miei giorni.mp3.exe 
progra~1TeslaFilesVasco Rossi - Buoni e cattivi.mp3.exe 
progra~1TeslaFilesLionel Richie - Just For You.mp3.exe 
progra~1WinMXSharedRosy.exe 
progra~1WinMXSharedPipponoto.exe 
progra~1WinMXSharedAnastacia - Left Outside Alone.mp3.exe 
progra~1WinMXSharedThe Rasmus - In The Shadows.mp3.exe 
progra~1WinMXShared50 Cent - In da Club.mp3.exe 
progra~1WinMXSharedVanessa Carltron - Ordinary Day.mp3.exe 
progra~1WinMXSharedHaiducii - Dragostea Din Tei.mp3.exe 
progra~1WinMXSharedBlack Eyed Peas - Hey Mama.mp3.exe 
progra~1WinMXSharedRaf - In tutti i miei giorni.mp3.exe 
progra~1WinMXSharedVasco Rossi - Buoni e cattivi.mp3.exe 
progra~1WinMXSharedLionel Richie - Just For You.mp3.exe2..建立文件WINDOWSsystem32About.hta3..显示消息标题: Microsoft Windows Update
内容: Click Yes For Update Microsoft Outlook via E-mail4.建立WINDOWSsystem32stdnrdll32.vbs文件
该VBS文件作如下工作:
a.在注册表主键"HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
ldr32"下，
添加如下键值："default"="WINDOWSsystem32NonYou.exe"
b.在注册表主键"HKEY_CURRENT_USERSoftwareMicrosoftOffice8.0OutlookSecurity"下，
添加如下键值："Level1Remove"="exe"
c.在注册表主键"HKEY_CURRENT_USERSoftwareMicrosoftOffice9.0OutlookSecurity"下，
添加如下键值："Level1Remove"="exe"
d.在注册表主键"HKEY_CURRENT_USERSoftwareMicrosoftOffice10.0OutlookSecurity"下，
添加如下键值："Level1Remove"="exe"
e.在注册表主键"HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunoncewincomp32"下，
添加如下键值："default"="WINDOWSsystem32
stdnrdll32.vbs"
f.建立文件WINDOWSsystem32Love-ScreenSaver.cab,它包含蠕虫本身
g.如果当前日期是11号或23号,则把IE的默认页改为:　　并用浏览器打开WINDOWSsystem32About.hta 
h.根据outlook地址簿Email地址发送带毒邮件
该邮件主题为:Microsoft Outlook News 
内容:Microsoft Outlook Update / Bug Fixed - Contact: 　　附件:MSOutlookInternetUpdate.exe(该附件为病毒本身)
i.打开5.文件修改在Program FilesmIRCmirc.ini文件中的rfiles节中增加：n2 = tdll32.dll6.发送病毒
发作现象
检查当前日期是否为11号或23号
如果是则显示如下两条消息:
标题: NonYou
内容: Rosy Ti Amo - Saro & Rosy Forever 
标题: Gedzac Group 2004
内容: 
NonYou.a Gedzac Labs Productions
Coded by Sarosoft - Dedicated to my Love Ros
Gedzac Group 2004 - 　　Gedzac 
The Virus Crew