A 显示信息提示
标题: WinZip Self-Extractor
内容: Error: CRC not complete
B 复制自身到WINDOWS目录的csrss.exe 、WinSecurity\services.exe 、WinSecurity\smss.exe
C 创建文件WinSecurity\socket1.ifo到WINDOWS目录，这是个使用 MIME 编码，具有.zip扩展名的文件，内容是病毒自身
D 创建以下文件到WINDOWS目录
WinSecurity\mssock1.dli
WinSecurity\mssock2.dli
WinSecurity\mssock3.dli
WinSecurity\winmem1.ory
WinSecurity\winmem2.ory
WinSecurity\winmem3.ory
WinSecurity\sysonce.tst
WinSecurity\starter.run
WinSecurity\nexttroj.tro
E 创建以下文件到系统目录
bbvmwxxf.hml
langeinf.lin
nonrunso.ber
rubezahl.rub
F 增加注册表项"_Windows" = "％Windir％\WinSecurity\services.exe"到注册表的
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
使得病毒每次开机后自动执行
G 检查网络连接,从以下NTP服务器中获取日期
Rolex.PeachNet.edu
clock.psu.edu
cUCkoo.nevada.edu
gandalf.theunixman.com
nist1.datum.com
ntp-1.ece.cmu.edu
ntp-2.ece.cmu.edu
ntp-sop.inria.fr
ntp.lth.se
ntp.massayonet.com.br
ntp.metas.ch
ntp.pads.ufrj.br
ntp0.cornell.edu
ntp1.arnes.si
ntp1.theremailer.net
ntp2.ien.it
ntp2b.mcc.ac.uk
ntp2c.mcc.ac.uk
ntp3.fau.de
ntps1-1.uni-erlangen.de
ptBTime2.ptb.de
rolex.usg.edu
st.ntp.carnet.hr
sundial.columbia.edu
swisstime.ethz.ch
tick.greyware.com
time-a.timefreq.bldrdoc.gov
time-ext.missouri.edu
time.chu.nrc.ca
time.ien.it
time.kfki.hu
time.mit.edu
time.nist.gov
time.nrc.ca
time.windows.com
time.xmission.com
timelord.uregina.ca
tock.keso.fi
utcnist.colorado.edu
vega.cbk.poznan.pl
H 从以下扩展名的文件中收集邮件地址
.abc
.abd
.abx
.adb
.ade
.adp
.adr
.ASP
.bak
.bas
.cfg
.cgi
.cls
.cms
.csv
.ctl
.dbx
.dhtm
.doc
.dsp
.dsw
.eml
.fdb
.frm
.hlp
.imb
.imh
.imh
.imm
.inbox
.ini
.jsp
.ldb
.ldif
.log
.mbx
.mda
.mdb
.mde
.mdw
.mdx
.mht
.mmf
.msg
.nab
.nch
.nfo
.nsf
.nws
.ods
.oft
.PHP
.phtm
.pl
.pmr
.pp
.ppt
.pst
.rtf
.sHtml
.slk
.sln
.stm
.tbb
.txt
.uin
.vap
.vbs
.vcf
.wab
.wsh
.xhtml
.xls
.XML
I 排除掉含有以下内容的邮件地址
-dav
.dial.
.kundenserver.
.ppp.
.qmail@
.sul.t-
@arin
@avp
@ca.
@example.
@foo.
@from.
@gmetref
@iana
@ikarus.
@kaspers
@messagelab
@nai.
@panda
@smtp.
@sophos
@www
abuse
announce
antivir
anyone
anywhere
bellcore.
bitdefender
clock
detection
domain.
emsisoft
ewido.
free-av
freeav
FTP.
gold-certs
host.
icrosoft.
ipt.aol
law2
Linux
mailer-daemon
mozilla
mustermann@
nlpmail01.
noreply
nothing
ntp-
ntp.
ntp@
Office
passWord
postmas
reciver@
secure
service
smtp-
somebody
someone
spybot
sql.
subscribe
文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!
