标题：Worm.Tanatos.e
病毒概述
病毒别名：I-Worm.Tanatos.e [AVP] WORM_BUGBEAR.D [Trend] Worm.Bugbear.g.enc [瑞星]
处理时间：
威胁级别：★★
中文名称：
病毒类型：蠕虫
影响系统：Win9x/WinMe/WinNT/Win2000/WinXP/Win2003
编写工具
编写工具:VC6.0, UPX压缩
病毒行为
传染条件:通过网络发送邮件高速传播
发作条件:
系统修改:
A、在系统目录下释放如下文件：
%System%OYCACV.EXE
%System%gomamjo.dll
%System%mcyays.dll
%System%kguaupg.dll
B、在注册表主键：
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
下添加以下键值：
"oycacv" = "%System%oycacv.exe"
发作现象:
A、该病毒运行时会弹出以下欺骗性的对话框：
B、该病毒感染后会结束以下进程：
ZONEALARM.EXE 
WFINDV32.EXE 
WEBSCANX.EXE 
VSSTAT.EXE 
VSHWIN32.EXE 
VSECOMR.EXE 
VSCAN40.EXE 
VETTRAY.EXE 
VET95.EXE 
TDS2-NT.EXE 
TDS2-98.EXE 
TCA.EXE 
TBSCAN.EXE 
SWEEP95.EXE 
SPHINX.EXE 
SMC.EXE 
SERV95.EXE 
SCRSCAN.EXE 
SCANPM.EXE 
SCAN95.EXE 
SCAN32.EXE 
SAFEWEB.EXE 
RESCUE.EXE 
RAV7WIN.EXE 
RAV7.EXE 
PERSFW.EXE 
PCFWALLICON.EXE 
PCCWIN98.EXE 
PAVW.EXE 
PAVSCHED.EXE 
PAVCL.EXE 
PADMIN.EXE 
OUTPOST.EXE 
NVC95.EXE 
NUPGRADE.EXE 
NORMIST.EXE 
NMAIN.EXE 
NISUM.EXE 
NAVWNT.EXE 
NAVW32.EXE 
NAVNT.EXE 
NAVLU32.EXE 
NAVAPW32.EXE 
N32SCANW.EXE 
MPFTRAY.EXE 
MOOLIVE.EXE 
LUALL.EXE 
LOOKOUT.EXE 
LOCKDOWN2000.EXE 
JEDI.EXE 
IOMON98.EXE 
IFACE.EXE 
ICSUPPNT.EXE 
ICSUPP95.EXE 
ICMON.EXE 
ICLOADNT.EXE 
ICLOAD95.EXE 
IBMAVSP.EXE 
IBMASN.EXE 
IAMSERV.EXE 
IAMAPP.EXE 
FRW.EXE 
FPROT.EXE 
FP-WIN.EXE 
FINDVIRU.EXE 
F-STOPW.EXE 
F-PROT95.EXE 
F-PROT.EXE 
F-AGNT95.EXE 
ESPWATCH.EXE 
ESAFE.EXE 
ECENGINE.EXE 
DVP95_0.EXE 
DVP95.EXE 
CLEANER3.EXE 
CLEANER.EXE 
CLAW95CF.EXE 
CLAW95.EXE 
CFINET32.EXE 
CFINET.EXE 
CFIAUDIT.EXE 
CFIADMIN.EXE 
BLACKICE.EXE 
BLACKD.EXE 
AVWUPD32.EXE 
AVWIN95.EXE 
AVSCHED32.EXE 
AVPUPD.EXE 
AVPTC32.EXE 
AVPM.EXE 
AVPDOS32.EXE 
AVPCC.EXE 
AVP32.EXE 
AVP.EXE 
AVNT.EXE 
AVKSERV.EXE 
AVGCTRL.EXE 
AVE32.EXE 
AVCONSOL.EXE 
AUTODOWN.EXE 
APVXDWIN.EXE 
ANTI-TROJAN.EXE 
ACKWIN32.EXE 
_AVPM.EXE 
_AVPCC.EXE 
_AVP32.EXE 
特别说明:
A、该病毒感染系统后，会从系统的本地盘中具有以下后缀的文件中扫描Email地址：
.SHT
.ASP
.ODS
.MMF
.MBX
.TBB
.TXT
.HTM
.NCH
.EML
.DBX
B、该病毒感染后会使用其自带的SMTP引擎来向搜索到的 Email地址发送邮件，邮件具有以下特征：
发件人： (从以下字符串中选择一个)
george 
georg 
garry 
gabriele 
funds 
frederic 
franz 
frank 
franco 
francisco 
finance 
fernand 
felix 
ernst 
erika 
erick 
erich 
erica 
emmanuel 
ellen 
elizabeth 
eduardo 
ecommerce 
earth 
e-gold 
dsmith 
douglas 
donna 
dominik 
debby 
david 
daniela 
daniel 
customerservice 
contact 
company 
collins 
colin 
claudia 
claude 
cindy 
christopher 
christoph 
christine 
chris 
check 
center 
catherine 
caroline 
carol 
carlos 
carina 
cards 
calvin 
bruno 
bruce 
brother 
bridge 
brian 
brent 
brenda 
brave 
brandon 
brain 
boris 
bonny 
judge 
jsmith 
johannes 
johann 
johan 
jimmy 
bernhard 
bernard 
becky 
beauty 
beatrice 
beach 
balance 
archives 
antonio 
anton 
anthony 
answer 
another 
anita 
anger 
angelo 
angela 
alive 
alison 
alicia 
kontakt 
kimberly 
kevin 
alice 
alfred 
alexander 
albert 
agree 
agency 
adrian 
accounts 
marcus 
marco 
manuel 
lucia 
lawrence 
gerhard 
gerard 
gerald 
laurence 
laura 
larry 
kristine 
kristin 
krista 
tobias 
allen 
henry 
henrik 
helpdesk 
helmut 
helga 
helene 
helen 
thomas 
terry 
terri 
sylvia 
susan 
support 
steven 
steve 
stephen 
andrew 
andres 
andreas 
stephane 
stefano 
stefan 
sophie 
smith 
simon 
silvia 
silver 
sharon 
service 
serge 
scott 
sandra 
sabine 
sabina 
russell 
rudolf 
rubber 
rsmith 
ronald 
roland 
gordon 
glenn 
gerry 
roger 
roberto 
robert 
robbie 
andrea 
andre 
ricardo 
randy 
ralph 
rachel 
questions 
peter 
pedro 
paulo 
patrick 
patricia 
patrice 
paolo 
pamela 
oliver 
norbert 
nicole 
nicolas 
nicola 
netbank 
nancy 
nadine 
monica 
molly 
miguel 
michel 
michaela 
michael 
metal 
member 
melanie 
melania 
mauro 
maurizio 
maureen 
matti 
wolfgang 
william 
werner 
wendy 
walter 
wagner 
voice 
vladimir 
vincent 
vanessa 
tomas 
matthew 
mathias 
martin 
markus 
marketing 
market 
dominic 
doctor 
diane 
diana 
dennis 
denise 
denis 
marion 
mario 
marina 
marie 
linda 
leopold 
leonardo 
mariano 
marianna 
maria 
margit 
marge 
margaretha 
margareta 
kerry 
kenneth 
kendra 
kelly 
katrin 
katri 
kathy 
kathryn 
kathleen 
karin 
karen 
justin 
julio 
julien 
julie 
julia 
juhani 
juergen 
juerg 
jerry 
jerome 
jennifer 
jason 
joseph 
josef 
jorgen 
jorge 
jonathan 
janne 
janna 
janice 
janet 
james 
isaac 
irina 
irene 
ingrid 
howard 
hernan 
hermann 
herman 
herbert 
heinz 
harrison 
harbor 
harald 
gregory 
gregor 
主题：(以下字符串中选择一个)
Hello! 
trojan 
virus 
lyris 
noreply 
recipients 
undisclosed 
remove 
please,read the attach file. 
See the attached file 
see attachment 
Pease open an attachment to see the message. 
Please see Attachment 
See the attached file for more info 
Take a look to the attachment 
update 
hmm.. 
Payment notices 
Just a reminder 
history screen 
Announcement 
various 
Introduction 
Interesting... 
I need photo!!! 
Stats 
Please Help... 
Report 
Greetings! 
[Fwd: look] ;-) 
Today Only 
New Contests 
Lost & Found 
bad news 
fantastic 
Me nude 
Old photos 
empty account 
photos 
Is that your password? 
I love you! 
new reading 
Friendly 
photo 
Warning! 
You are fat! 
I cannot forget you! 
Sex pictures 
Your Gift 
good news! 
!!! WARNING !!! 
Greets!
附件名：(以下字符串中选择一个)
000032.jpg .scr 
song.wav .scr 
music. mp3 .scr 
video.avi .scr 
photo.jpg .scr 
girls.jpg .scr 
pic.jpg .scr 
message.txt .scr 
image.jpg .scr 
news.doc .scr 
myphoto.jpg .scr 
you.jpg .scr 
love.jpg .scr 
readme.txt .scr
附件中的文件可能为双后缀名，第二个后缀名可能为以下字符串中的一个：
.EXE 
.PIF 
.SCR