标题：Worm.Salga.a
病毒信息
病毒别名：Email-Worm.Win32.Salga.a[AVP]
处理时间：
威胁级别：★★
中文名称：撒伽
病毒类型：蠕虫
影响系统：Win9x / WinNT
病毒行为
然后该蠕虫病毒搜索Outlook地址薄中的电子邮箱地址，将自己以附件的形式发送出去，以感染更多机器，附件名字颇有诱惑力的，由于名字中带有多个
“.”，使得扩展名“exe”可能被隐藏，一不小心就能中招。病毒还将自身复制到局域网中可写网络磁盘以传播，然后给局域网中所有用户发
送一条虚假信息以诱骗别的用户点击该病毒副本。该病毒还会显示一些对话框，以交友和给系统打补丁为诱饵窃取用户的电子邮箱以及密码。
发作过程
疯狂复制自身1)
%SystemRoot%\system\system copy.exe
%SystemRoot%\acdsee demo.exe
%SystemRoot%\system32\egywormo[gen1].exe
c:\Britny spears marrage with Bnladensun.zip
c:\hard core hook from web
c:\hard core hook from web\setup.zip.exe
%SystemRoot%\All Users\Desktop\sex cam
%SystemRoot%\All Users\Desktop\sex cam\sex photoes of monika.zip.exe
%SystemRoot%\All Users\Start Menu\Programs\StartUp\ana~1.exe
%SystemRoot%\Documents and Settings\All Users\Start Menu\Programs\Startup\egy~1
%SystemRoot%\Start Menu\inter net speeder.zip.exe
%SystemRoot%\start menu\programs\new chat prog.zip.exe
C:\Documents and Settings\All Users\DESKTOP\holywood stuff film.zip.exe
C:\Documents and Settings\All Users\Start Menu\nicole kidman sexy cam.zip.exe
C:\Documents and Settings\All Users\Start Menu\Programs\your sexy cam.zip.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\magic graphices maker.zip.exe
C:\Program Files\Accessories\BRITNY SPEARS MARRAGE.zip...............exe
C:\Program Files\Accessories\Details of new friends.zip...............exe
C:\Program Files\Accessories\Details.zip...............exe
C:\Program Files\Accessories\hard sex files.zip...............exe
C:\Program Files\Accessories\Is Bnladen realy cow boy.zip...............exe
C:\Program Files\Accessories\kasper2005.zip...............exe
C:\Program Files\Accessories\Nicole kidman.zip...............exe
d:\autorun.inf
＃＃＃＃＃＃＃＃
[autorun]
open=FUN.ZIP.EXE
＃＃＃＃＃＃＃＃
d:\FUN.ZIP.EXE
d:\girlfriends emails.zip.exe
d:\hook all sex movies from webs
d:\hook all sex movies from webs\setup.zip.exe
d:\new computer worm alert
d:\new computer worm alert\virus alert.txt
d:\NEW PROGRAMS
e:\autorun.inf
＃＃＃＃＃＃＃＃
[autorun]
open=Messenger 9.00.ZIP.EXE
＃＃＃＃＃＃＃＃
e:\Messenger 9.00.ZIP.EXE
e:\blood of fetch sex.zip.exe
e:\real sex telephones
e:\real sex telephones\call from me.zip.exe
2)
创建共享目录以及共享文件：
C:\Britny
c:\Britny\NEW FILM.ZIP.EXE
3)
搜索磁盘中地所有目录和文件，如搜到一个文件或目录为A，则在磁盘中同一位置生成病毒的副本A.exe.
不停地尝试复制自身到以下目录，复制后的文件名随机生成：
<系统盘>\<系统目录名><随机数字>.exe
c:\program files\
%SystemRoot%\system\修改注册表HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
"windows"="%SystemRoot%\system\system copy.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
"system xp"="%SystemRoot%\acdsee demo.exe"
HKEY_CURRENT_USER\Software\Kazaa\Transfer\
"StartKazaa -SilentRun"="C:\Program Files\Kazaa\My Shared Folder\Shared"
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
"DisableConfig"=dword:1
"DisableSR"=dword:1邮件感染扩散3.搜索OutLook地址薄中的邮件地址，将自己以附件的形式发送出去，以感染更多机器。附件可能为以下名字：
huge sexy brests program v 1.7.00.zip.exe
3d msn version 10.1.zip................exe
this files is very secret files.zip.........exe
new film.zip.........exe
i robot.zip.........exe
anti virus.zip.........exe
fire wall.zip.........exe
news.zip.........exe
yahoo.zip.........exe
aol.zip.........exe
mirc.zip.........exe
hack.zip.........exe
virus.zip.........exe
animal photos.zip.........exe
USA secrets.zip.........exe
photo shop.zip.........exe
deutsh programs.zip.........exe
wwf.zip.........exe
tourism.zip.........exe
fear.zip.........exe
autocade.zip.........exe
3dstoudio.zip.........exe
scince of water.zip.........exe
office 2005.zip.........exe
antibiotics.zip.........exe
viagra.zip.........exe
visual basic projects.zip.........exe
FBI secrets.zip.........exe
FOOTBALL IN ENGLAND.zip.........exe
TOY 2006.zip.........exe
Britny Spears.zip.........exe
Dracola.zip.........exe
pebsi.zip.........exe
news paper.zip.........exe
cocacola.zip.........exe
songs.zip.........exe
norton 2005.zip.........exe
xxl plus.zip.........exe
lesbien.zip.........exe
hard core.zip.........exe
sex plus.zip.........exe
computers in 2010.zip.........exe
ssParis_Hilton_(Nude Screen Saver).scr.............exe
Win32System_Tweaks_v1.0.zip.........exe
ms games.zip.........exe
Virtual_3D_Pinball.zip.........exe
ssPamela_Anderson_(Naked Screen Saver).scr.........exe
Game_Crack_Genie_v0.5.zip.........exe
MsDos_PortScanner.zip.........exe
Wmplayer_Celebrity_Skins.zip.........exe
Shockwave Flash.zip.........exe
SWF_Movie.zip.........exe
FlashMovie.zip.........exe
XXX video.zip.........exe
Cat attacks child.zip.........exe
SWF.zip.........exe
Comedy video.zip.........exe
Simpsons Episode (#)..zip.........exe
Tutorial Video on Hacking.........exe
MacroMedia Flash 6.0.zip.........exe
[SWF] - The Fast and the Furious.zip.........exe
[SWF] - Swordfish.........exe
[SWF] - Harry Potter and the philosophers stone.zip.........exe
big one in the world.zip.........exe
new film.zip.........exe
Iraq war.zip.................exe
USA discvered water in mars yesterday.doc.zip.................exe
Britny spears and Madona sex viedio in 24 min only.zip.................exe
strong fire wall allover the world with thelast update of norton.zip.................exe
last messengers versions.zip.................exe
learn photo shop in 3 days only.zip.................exe
new girls emails with there phone numbers.zip.................exe
new cupied photos.zip.................exe
邮件主题：
Sir new victem
邮件内容：
Hi:sir i'm your server Egywormo[gen1] this is new victem who has own outlook machine i caputre his contacts and go there to infect them.... ok i'll go now and see you soon when i infect more ......bibi sir磁盘感染扩散将自身复制到可写的网络磁盘中，以感染更多机器：
c$\windows\system32\pass word of hotmail store.zip................exe
c$\documment and settings\all users\documents\secret documents.zip......................exe
c$\money generator very dengerous and secrt.zip..........................exe
c$\shared\my sallary every mmonth increaser.................................exe
ipc$\secret photoes from my chat.zip...............................exe
c$\winnt\systemm32\speial films links in net.zip.............................exe
admin$\system32\see this it is very intersting.zip...................................exe其它向局域网中的所有用户发送一下消息：
hi welcome in our net cafe you can see the new film of Britny spears from the computer which shown it is very interesting film or see it from any shared folder <>
尝试访问网络中图片并显示。显示2个对话框，提示用户系统需要打补丁，欺骗用户去下载并运行病毒。另一个以交友为诱饵窃取用户的电子
邮箱和密码发送到指定电子邮箱。