【关键字】：My,Do,AB,MyDoom,AB
【来 源】：网络
MyDoom最新变种AB分析报告（5）
Ollie
Riley
Basil
Donovan
Hiram
Mauricio
Bernardo
Elvis
Jefferson
Reed
Bobbie
Vern
Noe
Rickie
Shelby
Alphonso
Rigoberto
Wiley
Carmen
Stacey
Gerry
Rodrigo
Derick
Gonzalo
Nolan
Williams
Elvin
Norbert
Scotty
Solomon
Anton
Esteban
Roscoe
Kermit
Xavier
Buddy
Gregorio
Ashley
Darwin
Elliot
Desmond
Harlan
Joaquin
Damien
Denis
Vance
Jarrod
Merle
Bradford
Dexter
Percy
Clay
Rolando
Lamar
Cornelius
Phil
Grady
Noah
Pat
Conrad
Ramiro
Elbert
Bert
Devin
Wilson
Sherman
Gregg
Lowell
Cedric
Rodolfo
Cameron
Ernesto
Carlton
Rex
Orlando
Alfonso
Lynn
Matt
Lyle
Shaun
Angelo
Hubert
Kenny
Doug
Gerard
Homer
Luke
Oliver
Trevor
Shannon
Otis
Donnie
Dana
Julius
Marshall
Andy
Virgil
Ross
Daryl
Willard
Clifton
Morris
Isaac
Julian
Byron
Sidney
Johnnie
Ivan
Dave
Alberto
Alfredo
Casey
Jaime
Bob
Ken
Wallace
Ian
Jordan
Everett
Jimmie
Felix
Armando
Dwight
Dwayne
Max
Hugh
Clayton
Guy
Nelson
Allan
Kurt
Kelly
Julio
Cody
Lance
Lonnie
Darren
Tyrone
Mathew
Ted
Clinton
Fernando
Javier
Barry
Randall
Troy
Ricky
Eddie
Don
Edwin
Joel
Ray
Frederick
Herbert
Jesus
Bradley
Francis
Kyle
Alfred
Melvin
Lee
Jacob
Chad
Jeff
Travis
Jeffery
Glenn
Vincent
Marvin
Allen
Norman
Curtis
Rodney
Manuel
Dale
Nathan
Leonard
Stanley
Mike
Luis
Tony
Bryan
Danny
Antonio
Jimmy
Earl
Johnny
Chris
Philip
Sean
Clarence
Shawn
Alan
Craig
Jesse
Todd
Phillip
Ernest
Martin
Victor
Bobby
Russell
Carlos
Eugene
Howard
Randy
Aaron
Jeremy
Louis
Steve
Billy
Wayne
Fred
Harry
Adam
Brandon
Bruce
Benjamin
Roy
Nicholas
Lawrence
Ralph
Willie
Samuel
Keith
Gerald
Terry
Justin
Jonathan
Albert
Jack
Juan
Joe
Roger
RyanLeon
名称组合LastName:
Porter
Tucker
Stevens
Simpson
Webb
Wells
Freeman
Murray
Gomez
Ortiz
Marshall
Cruz
Parker
Campbell
Phillips
Turner
Roberts
Perez
Mitchell
Carter
Nelson
Gonzalez
Baker
Adams
Green
Hill
Lopez
Wright
King
Hernandez
Young
Allen
Hall
Walker
Lee
Lewis
Rodriguez
Clark
Robinson
Martinez
Garcia
Thompson
Martin
Harris
White
Jackson
Anderson
Taylor
Moore
Wilson
Miller
Davis
Brown
Jones
Williams
Johnson
Smith
域名组合:
@ziplink.net
@yahoo.com
@wwc.com
@worldshare.net
@worldcom.com
@wanadoo.com
@verizon.net
@ultimanet.com
@toad.net
@tiscali.com
@t-online.de
@t-online.com
@surfree.com
@ricochet.com
@rcn.com
@pics.com
@peoplepc.com
@pathlink.com
@palm.net
@pacific.net.sg
@netzero.net
@netrox.net
@netcenter.com
@nccw.net
@msn.com
@madriver.com
@macconnect.com
@loa.com
@juno.com
@istep.com
@ispwest.com
@isp.com
@iquest.net
@infoave.net
@inext.fr
@ieway.com
@hiwaay.net
@highstream.net
@globetrotter.net
@globalbiz.net
@gbronline.com
@flex.com
@fcc.net
@fast.net
@excite.com
@ev1.net
@eisa.com
@eclipse.net
@earthlink.net
@dialupnet.com
@cybernex.net
@cox.net
@core.com
@compuserve.com
@chello.com
@ccpc.net
@ccp.com
@cayuse.net
@canada.com
@cais.com
@cableone.net
@att.net
@aristotle.net
@arczip.com
@apci.net
@aol.com
@ameralinx.net
@address.com
@accessus.net
@a1isp.net
@1access.net
@yahoo.co.uk
@gmx.net
@hotmail.com
@mail.com
@dailymail.co.uk
主题:
do you know this girl?
do you know this people?
do you know this ppl?
Is it your photo?
LOOK!
my new photos
with best wishes
a lot of fun.
Hello...Funny pic...hehehe
I've never seen this before. Look at that !
Look :)
Hello!
You've got a postcard. To view this postcard, click on the attached file
have you seen this before?
Loool!! :-)
fun
fun pictures
hi!
look at new photos
Re[2]:fun pictures
Re:fun pictures
FW:fun pictures
Re[2]:COOL!
Re:COOL!
FW:COOL!
Re[2]:cool
Re:cool
FW:cool
Re[2]:
Re:
FW:
:))
FW: Cool
LOOK!
new photos
2 new photos
hi, it's me
it's me
(no subject)
that's me :-D
my photos
hello sweety :>
remember me?..
FW: jenna's photos :)
FW: new photos
FW: 2 new photos
FW: hi, it's me
FW: it's me
FW: (no subject)
FW: that's me :-D
FW: my photos
FW: hello sweety :>
FW: hi
FW: remember me?..
正文:
正文由下面ABC三部分组成
A.(随机选取一条)
-----Original Message-----
From: Jeny K.
Sent: Monday, September 13, 2004 8:57 PM
To: Morpheus
check my new photos
:))
miss you, jeny k
-----Original Message-----
From: Jena K.
Sent: Monday, September 13, 2004 5:23 AM
To: friends
Check Out Archive.. So.. What Do You Think... Am I Hot? :)
Waining For Your Answer
Jena Key
-----Original Message-----
From: jenny k.
Sent: Monday, September 13, 2004 10:23 AM
To: My Tiger (e-mail)
new fotos(archived) you asked
jenny k
-----Original Message-----
From: jenna k. (e-mail)
Sent: Monday, September 13, 2004 11:38 AM
To: Cat
my new fotos archived ))
kiss, jenna k
-----Original Message-----
From: Jeny
Sent: Monday, September 13, 2004 8:57 PM
To: Neo
see the photos in attached archive
:))
kiss you, jeny
-----Original Message-----
From: Jena
Sent: Monday, September 13, 2004 5:23 AM
To: friend
Photos in archive.. So.. Am I Hot? :)
Waining For Your Answer
Jena
-----Original Message-----
From: Jenna Knukles
Sent: Monday, September 13, 2004 9:05 AM
To: Friends Group
in self-extracting archive my photos
Jenna :)
-----Original Message-----
From: jenna (e-mail)
Sent: Monday, September 13, 2004 11:38 AM
To: ma kittie
my photos archived ))
kiss, jenna
fun flash game!
fun flash!
game!
fun game!
Print money at home!
look at atach
-----Original Message-----
From: Jeny K.
Sent: Monday, September 13, 2004 8:57 PM
To: Morpheus
check out the new photos
:))
miss you, jeny k
-----Original Message-----
From: Jena K.
Sent: Monday, September 13, 2004 5:23 AM
To: friends
So.. What Do You Think... Am I Hot? :)
Waining For Your Answer
Jena Key
-----Original Message-----
From: Jenna Knukles
Sent: Monday, September 13, 2004 9:05 AM
in archive my new fotos
Jenna K :)
-----Original Message-----
From: jenny k.
Sent: Monday, September 13, 2004 10:23 AM
To: My Tiger (e-mail)
new fotos you asked
jenny k
-----Original Message-----
From: jenna k. (e-mail)
Sent: Monday, September 13, 2004 11:38 AM
To: Cat
my new fotos zipped ))
kiss, jenna k
-----Original Message-----
From: Jeny
Sent: Monday, September 13, 2004 8:57 PM
To: Neo
see the photos
:))
kiss you, jeny
-----Original Message-----
From: Jena
Sent: Monday, September 13, 2004 5:23 AM
To: friend
So.. Am I Hot? :)
Waining For Your Answer
Jena
-----Original Message-----
From: Jenna Knukles
Sent: Monday, September 13, 2004 9:05 AM
To: Friends Group
in archive my photos
Jenna :)
-----Original Message-----
From: jenny
Sent: Monday, September 13, 2004 10:23 AM
To: Mr.X (e-mail)
photos you asked
jenny
-----Original Message-----
From: jenna (e-mail)
Sent: Monday, September 13, 2004 11:38 AM
To: ma kittie
my photos zipped ))
kiss, jenna
-----Original Message-----
From: Jeny K.
Sent: Tuesday, September 7, 2004 8:57 PM
To: Morpheus
check my new photos
:))
miss you, jeny k
B.
+++ Attachment: No Virus found
+++ [avprod
C.(随机选取一条)
Norton AntiVirus - www.symantec.de
F-Secure AntiVirus - www.f-secure.com
Norman AntiVirus - www.norman.com
Panda AntiVirus - www.pandasoftware.com
Kaspersky AntiVirus - www.kaspersky.com
MC-Afee AntiVirus - www.mcafee.com
Bitdefender AntiVirus - www.bitdefender.com
MessageLabs AntiVirus - www.messagelabs.com
附件:(随机)
myfoto.exe、photos.selfextracting.exe 、photoarchive.exe 、photofile.exe 、arc.exe
my_foto.exe 、fotos.exe 、foto.exe 、photos.exe.safe 、photo_se.exe
new_photos.exe 、newphotos.exe 、myphotos_arc.exe 、my_photos.exe 、photos_arc.exe
myfoto.cpl 、photoarchive.cpl 、photofile.cpl 、arc.cpl 、my_foto.cpl 、fotos.cpl
foto.cpl 、photo_se.cpl 、new_photos.cpl 、newphotos.cpl 、my_photos.cpl
photos_arc.cpl 、arhive.zip 、new_pic.zip 、pic.zip
new_photos.zip 、images.zip 、fotos.zip 、my_photos.zip
myphotos.zip 、photos.zip 、my_photo.jpg .pif 、flowers.jpg .pif 、document.jpg .pif
pic.jpg .pif 、photo.jpg .pif
black.gif .pif 、DCP_0002.JPG .pif 、me_01.jpg .pif 、2004042301.jpg .pif
with_flowers.jpg .pif 、sunny.jpg .pif 、photo08.jpg .pif 、nude_.jpg .pif
marie_dancing.jpg .pif 、julia038.jpg .pif 、dap53 crack.exe 、iMeshV4 crack.exe
icqpro2003b crack.exe 、wrar330 crack.exe 、WinZip 9.0 crack.exe
dap71.exe 、trillian-v2.74h.exe 、wrar330.exe 、LimeWireWin.exe
Morpheus.exe 、zlsSetup_45_538_001.exe 、icqpro2003b.exe 、iMeshV4.exe
WinZip 9.0.exe 、icqlite.exe 、kmd.exe 、trillian 2.0 crack.exe
dap53.exe 、dvdplayer.exe 、opera7.x crack.exe
crazzygirls.scr 、childporno.pif 、opera7.7.exe 、winamp6.exe
eroticgirls2.0.exe 、tropicallagoonss.scr 、nicegirlsshowv12.scr
icq2004-final.exe 、winamp5.exe 、1.exe 、mymusic.pif 、rulezzz.scr
matrix.scr 、newvirus.exe 、mylove.pif 、antibush.scr 、icqcrack.exe
myfack.pif 、hello.pif 、pinguin5.exe 、you the best.scr 、fantasy.scr
coolgame.zip .exe 、mynewphoto.zip .exe 、mult.exe
以上为带毒邮件的特征
但该病毒不会发送邮件到包含以下字符串的邮箱中:
gold-certs 、feste 、submit
help 、service 、privacy 、somebody 、contact
site 、someone 、anyone 、nothing 、nobody 、noreply
noone 、ebmaster 、news 、rating 、postmaster
samples 、info 、root 、www 、upport
abuse 、accoun 、certific 、listserv 、bsd
ntivi 、admin 、icq.com 、mozilla 、utgers.ed
tanford.e 、pgp 、acketst 、secur
isc.o 、isi.e 、ripe. 、arin. 、sendmail 、rfc-ed 、ietf
usenet 、fido 、kernel 、google 、ibm.com
fsf. 、gnu 、mit.e 、math 、berkeley
support 、messagelabs 、antivi 、kasp 、linux
unix 、spam 、@iana 、@foo. 、.mil
gov. 、.gov 、icrosoft 、ruslis 、nodomai
mydomai 、example 、inpris 、borlan
sopho 、panda 、icrosof 、syman 、avp.（完）
|