标题：Worm.surconfluge
病毒简述
病毒别名：
处理时间：
威胁级别：★★
中文名称：破坏之神
病毒类型：蠕虫
影响系统：Win9x / WinNT
病毒性质
这是一个通过邮件,P2P和IRC传播的蠕虫病毒,该病毒在被感染的计算机上实施一系列的严重的破坏活动,使用户无法正常使用计算机.
病毒行为
1.生成文件
%Windows%\TASKMANAGER.exe
%Program Files%\Windows Media Player\wmlaunch.exe
%Program Files%\Internet Explorer\Firewall.exe
%Program Files%\Internet Explorer\WWE Divas.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\XPStart.exe
C:\Torrie&Stacy.exe
C:\Program Files\Torrie&Stacy.exe
2.增加启动项,使病毒开机运行.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
键Firewall键值 "%Program Files%\Windows Media Player\wmlaunch.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
键Protection 键值"%Program Files%\Internet Explorer\Firewall.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
键SysRes 键值 "%Windows%\TASKMANAGER.exe"
3.搜索Windows地址簿中所有的地址,并发送邮件
发件人：
administrator@wwe.com
邮件主题：
WWE Admninistrator
邮件内容：
Free WWE Torrie Wilson and Sable Screan Saver
邮件附件：
WWE DIVAS.exe 
4.P2P传播方式:
病毒通过把本身拷贝到以下P2P软件的共享目录,来达到传播的目的.包括KMD, Kazaa, Morpheus, Grokster, Bearshare and Edonkey2000。
C:\Program Files\BearShare\Shared\WWE Torrie and Sable Screan Saver.exe
C:\Program Files\Edonkey2000\Incoming\WWE Torrie and Sable Screan Saver.exe
C:\Program Files\Grokster\My Grokster\WWE Torrie and Sable Screan Saver.exe
C:\Program Files\KMD\My Shared Folder\WWE Torrie and Sable Screan Saver.exe
C:\Program Files\KaZaA Lite\My Shared Folder\WWE Torrie and Sable Screan Saver.exe
C:\Program Files\Kazaa\My Shared Folder\WWE Torrie and Sable Screan Saver.exe
C:\Program Files\Morpheus\My Shared Folder\WWE Torrie and Sable Screan Saver.exe 
5.通过IRC传播
为了通过IRC传播，蠕虫会复制到以下位置：
C:\Program Files\mIRC\Downloads\WWE DIVAS.exe
6.蠕虫会终止LSASS.exe进程,导致一部分计算机不断重启.
7.蠕虫会终止以下的进程
DAP.exe 
VB6.exe 
msgmsgr.exe 
ccapp.exe 
regedit.com 
mdm.exe 
iexplore.exe 
smss.exe 
dllhost.exe
SVCHOST.exe 
8.修改Hosts,禁止用户访问以下网站:
http://oe.msn.msnmail.hotmail.com/cgi-bin/hmdata
http://services.msn.com/svcs/hotmail/httpmail.asp
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=hotmail
messenger.hotmail.com
raw.wwe.com
smackdown.wwe.com
www.about.com
www.alltheweb.com
www.altavista.com
www.download.com
www.emp3finder.com
www.geocities.com
www.google.com
www.guitar-pro.com
www.hdpvidz.com
www.hotmail.com
www.kazaa.com
www.mcafee.com 
www.microsoft.com
www.msn.com
www.mysongbook.com
www.nero.com
www.net2phone.com
www.regedit.com
www.rohitab.com
www.roxio.com
www.symantec.com
www.themetsource.com
www.trendmicro.com
www.urbanchaosvideos.com
www.vbcode.com
www.wwe.com
www.yahoo.com 
9.删除文件：
%Program Files%\common files\symantec shared\Script Blocking\scrblock.dll
10.病毒会通过修改注册表,破坏用户使用以下功能:
禁止“运行”菜单
禁止“关闭”菜单
禁止"查找"命令
禁止系统恢复
禁止使用cmd命令模式
禁止使用注册表程序regedit.exe
设置计算机名为surconfluge
11.病毒会禁止使用以下100种程序:
notepad.exe,
wordpad.exe,
msnmsgr.exe,
winzip.exe,
CLEAN_NOTEPAD.EXE,
moviemk.exe,
defrag.exe,
netstat.exe,
netstat.exe,
sndvol32.exe,
sndrec32.exe,
CCIMSCN.exe,
shutdown.exe,
sndvol32.exe,
write.exe,
dxdiag.exe,
ntbackup.exe,
dialer.exe,
dllhost.exe,
print.exe,
trendmicro.com,
UPXiT.exe,
vb6.exe,
NMain.exe,
NAVW32.exe,
NAVWNT.exe,
NAVSTUB.exe,
navui.nsi
,MSDEV.exe,
chktrust.exe,
apssm.exe,
SNDSrvc.exe
NMain.exe
Ra2.exe,
vfp6.exe,
setup.exe,
install.exe,
savscan.exe,
ad-aware.exe,
remove.exe,
uninstall.exe,
NeroStartSmart.exe,
uninst.exe,
isuninst.exe,
aawsepersonal.exe,
keygen.exe,cmd.exe,
project1.exe,
1.exe,
file.exe,
browser.exe
UNWISE.exe,
play.exe
directcd.exe
bind.exe
VPC32.exe
VPDN_LU.exe,
VPTray.exe
DefWatch.exe
DoScan.exe
Integrator.exe
swdoctor.exe
.exe......
12.蠕虫会使防病毒,windows升级,防火墙软件失效.
13.共享C、D、E盘。
14.蠕虫会生成"C:\Virus Detected.txt"文本文件，包含以下内容：
"Worm is detected on your computer (W32.surconfluge.A@mm), update your Virus Definition to protect your computer from the lastest viruses and worms."