病毒名称(中文):盗号虫34304
病毒别名:
威胁级别:★☆☆☆☆
病毒类型:蠕虫病毒
病毒长度:34304
影响系统:Win9x WinMe WinNT Win2000 WinXP Win2003
病毒行为:
这是一个蠕虫盗号者。会在磁盘中释放出文件，会修改注册表，会创建盗号系统服务。
在磁盘中释放出以下文件:
C:\WINDOWS\System32\WinNt32.dll
C:\WINDOWS\System32\drivers\Aaa00.sys
在注册表中创建了以下信息:
"HKLM\Software\
Microsoft\
Windows NT\CurrentVersion\Winlogon\Notify\WinNt32"
"HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Aaa00.sys"
"HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Aaa00.sys"
"HKLM\System\CurrentControlSet\Services\Aaa00"
在注册表中设置了以下信息:
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinNt32" "DLLName" "WinNt32.dll"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinNt32" "StartShell" "WLEventStartShell"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinNt32" "Impersonate" ""
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinNt32" "Asynchronous" ""
"HKLM\System\CurrentControlSet\Services\Aaa00" "ImagePath" "C:\WINDOWS\System32\drivers\Aaa00.sys"
"HKLM\System\CurrentControlSet\Services\Aaa00" "DisplayName" ""
病毒会连接作者指定的网址:
http://www.g****e.com/search?q=free video
域名:"www.g****e.com" 端口:80 (TCP)
www.g****e.com/search?q=free
在系统中创建了以下服务:
服务名: "Aaa00 (NULL)"
映像路径: "C:\WINDOWS\System32\drivers\Aaa00.sys"
