Mydoom:病毒大佬变脸再现江湖

2004年里的病毒大佬--Mydoom看来是不希望广大人民群众过一个安乐祥和的踏实年了，随着在年度十世界毒王的评选中一举胜出之后，才休息没多久，便易容重现江湖。

新变种依然依靠从受感染计算机中查找邮件地址，然后使用自带的SMTP引擎，大规模的邮件发送来进行传播。

其它命名：MyDoom.AI [F-Secure], W32/MyDoom-AA [Sophos], W32/Mydoom.ap@MM [McAfee]

病毒类型：蠕虫

病毒长度：31，744字节

受影响系统：Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

威胁程度：低

破坏能力：中

传播能力：中

综合评价：二级

病毒发作时：

1，创建如下文件：

    %system%\lsasrv.exe(病毒的拷贝)
    %system%\version.ini(一个无害的文本文件)
    %system%\hsery.sys(一个无害的二进制文件)

2，然后，创建如下注册表项：

HEKY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
Run\"lsass"="%system%\lsasrv.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\
Winlogon"Shell"="explorer.exe %system%\lsasrv.exe"

3，随后，病毒在用户的临时文件夹下创建名为Mes#wtelw.txt文件，文件只包含垃圾数据，病毒使用记事本打开它，在它上面显示垃圾内容。

4，随后病毒从Windows地址薄以及带有如下扩展名的文件中收集邮件地址：

.adb
.asa
.asc
.asm
.asp
.cgi
.con
.csp
.dbx
.dlt
.dwt
.edm
.hta
.htc
.htm
.inc
.jsp
.jst
.lbi
.php
.rdf
.rss
.sht
.ssi
.stm
.tbb
.tpl
.txt
.vbp
.vbs
.wab
.wml
.xht
.xml
.xsd
.xst

5，病毒不会将自己发送到含有如下字符串的邮件地址中去：

accoun
certific
listserv
ntivi
support
icrosoft
admin
page
the.bat
gold-certs
feste
submit
not
help
service
privacy
somebody
soft
contact
site
rating
bugs
you
your
someone
anyone
nothing
nobody
noone
webmaster
postmaster
samples

info
root
mozilla
utgers.ed
tanford.e
pgp
acketst
secur
isc.o
isi.e
ripe.
arin.
sendmail
rfc-ed
ietf
iana
usenet
fido
linux
kernel
google
ibm.com
fsf.
gnu
mit.e
bsd
math
unix
berkeley
foo.
.mil
gov.
.gov
ruslis
nodomai
mydomai
example
inpris
borlan
sopho
panda
hotmail
msn.
icrosof
syma
avp
.edu
abuse
www
fcnz
spm
病毒将使用自带的SMTP引擎，将自己发送到查找到的邮箱地址，它将使用如下的名字与姓氏创建来源地址：

名字：

adam
alex
alice
andrew
anna
bill
bob
brenda
brent
brian
claudia
dan
dave
david
debby
fred
george
helen
jack
james
jane
jerry
jim
jimmy
joe
john
jose
julie
kevin
leo
linda
maria
mary
matt
michael
mike
peter
ray
robert
sam
sandra
serg
smith
stan
steve
ted
tom

姓氏：

Abdulrazak
Ackerman
Adams
Addison
Adelstein
Adibe
Adorno
Ahlers
Alavi
Alcorn
Alda
Aleks
Allison
Alongi
Altavilla
Altenberger
Altenhofen
Amaral
Amatangelo
Ameer
Amsden
Anand
Andel
Ando
Andrelus
Andron
Anfinrud
Ansley
Anthony
Antos
Arbia
Arduini
Arellano
Aristotle
Arjas
Arky
Atkins
Augustus
Aurelius
Axelrod
Axworthy
Ayiemba
Aykroyd
Ayling
Azima
Bachmuth
Backus
Bady
Baglivo
Bagnold
Bailar
Bakanowsky
Baleja
Ballatori
Ballew
Baltz
Banta
Barabesi
Barajas
Baranczak
Baranowska
Barberi
Barbetti
Barneson
Barnett
Barriola
Barry
Bartholomew
Bartolome
Bartoo
Basavappa
Bashevis
Batchelder
Baumiller
Bayles
Bayo
Beacon
Beal
Bean
Beckman
Beder
Bedford
Behenna
Belanger
Belaoussof
Belfer
Belin-Collart
Bellavance
Bellhouse
Bellini
Belloc
Benedict-Dye
Bergson
Berke-Jenkins
Bernardo
Bernassola
Bernston
Berrizbeitia
Betti
Beynart
Biagioli
Bickel
Binion
Bir
Bisema
Bisho
Blackbourn
Blackwell
Blagg
Blakemore
Blanke
Bliss
Blizard
Bloch
Bloembergen
Bloemhof
Bloxham
Blyth
Bolger
Bolick
Bollinger
Bologna
Boner
Bonham
Boniface
Bontempo
Book
Bookbinder
Boone
Boorstin
Borack
Borden
Bossi
Bothman
Botosh
Boudin
Boudrot
Bourneuf
Bowers
Boxer
Boyajian
Boyes
Boyland
Boym
Boyne
Bracalente
Bradac
Bradach
Brecht
Breed
Brenan
Brennan
Brewer
Bridgeman
Bridges
Brinton
Britz
Broca
Brook
Brzycki
Buchan
Budding
Bullard
Bunton
Burden
Burdzy
Burke
Burridge
Busetta
Byatt
Byerly
Byrd
Cage
Calnan
Cammelli
Cammilleri
Canley
Capanni
Caperton
Capocaccia
Capodilupo
Cappuccio
Capursi
Caratozzolo
Carayannopoulos
Carlin
Carlos
Carlyle
Carmichael
Caroti
Carper
Cartmill
Cascio
Case
Caspar
Castelda
Cavanagh
Cavell
Ceniceros
Cerioli
Chapman
Charles
Cheang
Cherry
Chervinsky
Chiassino
Chien
Childress
Childs
Chinipardaz
Chinman
Christenson
Christian
Christiano
Christie
Christopher
Chu
Chupasko
Church
Ciampaglia
Cicero
Cifarelli
Claffey
Clancy
Clark
Clement
Clifton
Clow
Coblenz
Coito
Coldren
Colella
Collard
Collis
Compton
Comstock
Concino
Condodina
Connors
Corey
Cornish
Cosmides
Counter
Coutaux
Crawford
Crocker
Croshaw
Croxen
Croxton
Cui
Cunningham
Currier
Cutler
Cvek
Cyders
D'Ambra
D'arcangelo
D'fini
D'souza
Daldalian
Daly
Danieli
Dante
Dapice
Das
Dasgupta
daSilva
Daskalu
David
Dawkins
Debroff
Dees
Defeciani
DeGennaro
del'Enclos
DeLaPena
Delattre
Deleon-Rendon
Delger
Dell'acqua
Deming
Dempster
Demusz
Denault
Denham
Denison
deRousse
Desombre
Deutsch
Dicks
Diefenbach
Difabio
Difronzo
Dilworth
Dionysius
Dirksen
Dockery
Doherty
Donahue
Donner
Doonan
Dore
Dorf
Dosi
Doty
Doug
Dowsland
Drinker
Duffin
Durrett
Dussault
Dwyer
Eardley
Ebeling
Eckel
Edley
Edner
Edward
Eickenhorst
Eliasson
Elmendorf
Elmerick
Elvis
Encinas
Enyeart
Eppling
Erbach
Erdman
Erdos
Erez
Espinoza
Estes
Etter
Euripides
Everett
Fabbris
Fagan
Faioes
Falco-Acosta
Falorsi
Faris
Farone
Farren
Fasso'
Fates
Feigenbaum
Fejzo
Feldman
Fernald
Fernandes
Ferrante
Ferriell
Feuer
Fido
Field
Fink
Finkelstein
Finnegan
Fiorina
Fisk
Fitzmaurice
Flier
Flores
Folks
Forester
Fortes
Fortier
Fossey
Fossi
Francisco
Franklin-Kenea
Franz
Frazier-Davis
Freid
Freundlich
Fried
Friedland
Frisken
Frowiss
Fryberger
Frye
Fujii-Abe
Fuller
Furth
Fusaro
Gabrielli
Gaggiotti
Galeotti
Galwey
Gambini
Garfield
Garman
Garonna
Geller
Gemberling
Georgi
Gerrett
Ghorai
Gibbens
Gibson
Gilbert
Gili
Gill
Gillispie
Gist
Gleason
Glegg
Glendon
Goldfarb
Goncalves
Gonzalez
Good
Goodearl
Goody
Gozzi
Gravell
Greenberg
Greenfeld
Griffiths
Grigoletto
Grummell
Gruner
Gruppe
Guenthart
Gunn
Guo
Haar
Hackman
Hackshaw
Haley
Halkias
Hallowell
Halpert
Hambarzumjan
Hamer
Hammerness
Hand
Hanssen
Harding
Hargraves
Harlow
Harrigan
Hartman
Hartmann
Hartnett
Harwell
Haviaras
Hawkes
Hayes
Haynes
Hazlewood
Heermans
Heft
Heiland
Hellman
Hellmiss
Helprin
Hemphill
Henery
Henrichs
Hernandez
Herrera
Hester
Heubert
Heyeck
Himmelfarb
Hind
Hirst
Hitchcock
Hoang
Hock
Hoffer
Hoffman
Hokanson
Hokoda
Holmes
Holoien
Holter
Holway
Holzman
Hooker
Hopkins
Horsley
Hoshida
Hostage
Hottle
Howard
Hoy
Huey
Huidekoper
Hungerford
Huntington
Hupp
Hurtubise
Hutchings
Hyde
Iaquinta
Ichikawa
Igarashi
Inamura
Inniss
Isaac
Isaievych
Isbill
Isserman
Iyer
Jacenko
Jackson
Jagers
Jagger
Jagoe
Jain
Jamil
Janjigian
Jarnagin
Jarrell
Jay
Jeffers
Jellis
Jenkins
Jespersen
Jewett
Johannesson
Johannsen
Johns
Jolly
Jorgensen
Jucks
Juliano
Julious
Kabbash
Kaboolian
Kafadar
Kalbfleisch
Kaligian
Kalil
Kalinowski
Kalman
Kamel
Kangis
Karpouzes
Kassower
Kasten
Kawachi
Kee
Keenan
Keepper
Keith
Kelker
Kelsey
Kempton
Kemsley
Kendall
Kerry
Keul
Khong
Kimmel
Kimmett
Kimura
Kindall
Kinsley
Kippenberger
Kirscht
Kittridge
Kleckner
Kleiman
Kleinfelder
Klemperer
Kling
Klinkenborg
Klint
Knuff
Kobrick
Koch
Kohn
Koivumaki
Kommer
Koniaris
Konrad
Kool
Korzybski
Kotter
Kovaks
Kraemer
Krailo
Krasney
Kraus
Kroemer
Krysiak
Kuenzli
Kumar
Kusman
Kuwabara
l'Enclos
Labunka
Lafler
Laing
Lallemant
Landes
Lankes
Lantieri
Lanzit
Laserna
Lashley
Lawless
Lecar
Lecce
Leclercq
Leite
Lenard
Lesser
Lessi
Liakos
Lidano
Liem
Light
Lightfoot
Lim
Linares
Linda
Linder
Line
Linehan
Linzee
Lippmann
Lipponen
Little
Litvak
Livernash
Livi
Livolsi
Lizardo

Locatelli
Longworth
Loss
Loveman
Lowenstein
Loza
Lubin
Lucas
Luciano
Luczkow
Luecke
Lunetta
Luoma
Lussier
Lutcavage
Luzader
Maccormac
Macdonald
Maceachern
Macintyre
Mackenney
MacMillan
Macy
Madigan
Maggio
Mahony
Maier
Maine-Hershey
Maisano
Malatesta
Maller
Malova
Manalis
Mandel
Manganiello
Mantovan
March
Marchbanks
Marcus
Margalit
Margetts
Marques
Martinez
Martochio
Marton
Marubini
Mass
Matalka
Matarazzo
Matsukata
Mattson
Mauzy
Mazzali
Mazziotta
Mcbride
Mccaffery
Mccall
Mcclearn
Mcdowell
Mcelroy
McFadden
Mcghee
Mcgoldrick
McIlroy
Mcintosh
Mckenna
Mclane
Mclaren
Mcnealy
Mcnulty
Meccariello
Memisoglu
Menzies
Merikoski
Merlani
Merminod
Merseth
Merz
Metelka
Metropolis
Meurer
Michelman
Middle
Mieher
Mills
Minh
Mini
Minichiello
Mitropoulos
Mittal
Mocroft
Modestino
Moeller
Mohr
Moiamedi
Monque
Montilio
MooreDeCh.
Morani
Moreton
Morrison
Morrow
Mortimer
Mosher
Mosler
Mostafavi
Motooka
Mudarri
Muello
Mugnai
Mulkern
Mulroy
Mumford
Mussachio
Naddeo
NapolitanNardi
Nardone
Naviaux
Nayduch
Nelson
Nenna
Nesci
Neuman
Newfeld
Newlin
Nickerson
Nickoloff
Nisenson
Nitabach
Notman
Nuzum
O'hagan
O'malley
O'meara
Ocougne
Ogata
Oldford
Olsen
Olson
Olszewski
Oman
Opel
Oray
Orfield
Orsi
Ospina
Ostrowski
Ottaviani
Otten
Ouchida
Ovid
PaesDealmeida
Paine
Palayoor
Palepu
Pallara
Palmitesta
Panadero
Panizzon
Pantilla
Paoletti
Parmeggiani
Parris
Partridge
Pascucci
Patefield
Patrick
Pattullo
Pavetti
Pavlon
Pawloski
Paynter
Peabody
Pearlberg
Pederson
Peishel
Penny
Pereira
Perko
Perlak
Perlman
Perna
Perone
Perrimon
Peters
Petruzello
Pettibone
Pettit
Pfister
Pilbeam
Pinot
Plancon
Plant
Plasket
Plous
Pocobene
Poincaire
Pointer
Poirier
Polak
Polanyi
Politis
Poma
Poolman
Powers
Presper
Preucel
Prevost
Pritchard
Pritz
Proietti
Prothrow-Stith
Puccia
Pugh
Pynchon
Quaday
Quetin
Rabe
Rabkin
Radeke
Rajagopalan
Raney
Rangan
Rankin
Rapple
Rayport
Redden-Tyler
Reedquist
Reinold
Remak
Renick
Repetto
Resnik
Rhea
Richmond
Rielly
Rindos
Rineer
Rish
Rivera
Robinson
Rocha
Roesler
Rogers
Ronen
Row
Royal
Ruan
Ruderman
Ruescher
Rush
Ryu
Sabatello
Sadler
Safire
Sahu
Sali
Samson
Sanchez-Ramirez
Sanna
Sapers
Sarin
Sartore
Sase
Satin
Satta
Satterthwaite
Sawtell
Sayied
Scarponi
Scepan
Scharf
Scharlemann
Scheiner
Schiano
Schifini
Schilling
Schmitt
Schossberger
Schuman
Schutte
Schuyler
Schwan
Schwickrath
Scovel
Scudder
Seaton
Seeber
Segal
Sekler
Selvage
Sen
Sennett
Seterdahl
Sexton
Seyfert
Shaikh
Shakis
Shankland
Shanley
Shar
Shatrov
Shavelson
Shea
Sheats
Shepherd
Sheppard
Shepstone
Shesko
Shia
Shibata
Shimon
Siesto
Sigalot
Sigini
Signa
Silverman
Silvetti
Sinsabaugh
Sirilli
Sites
Skane
Skerry
Skoda
Sloan
Slowe
Smilow
Sniffen
Snodgrass
Socolow
Solon
Somers
Sommariva
Sorabella
Sorg
Sottak
Soukup
Soule
Soultanian
Spanier
Sparrow
Spaulding
Speizer
Spence
Sperber
Spicer
Spiegelhalter
Spiliotis
Spinrad
Stalvey
Stam
Stang
Stassinopolus
States
Statlender
Stefani
Steiner
Stephanian
Stepniewska
Stewart-Oaten
Stiepock
Stillwell
StMartin
Stock
Stockton
Stockwell
Stolzenberg
Stonich
Storer
Stott
Strange
Strauch
Streiff
Stringer
Sullivan
Sumner
Suo
Surdam
Sweeting
Sweetser
Swindle
Tagiuri
Tai
Talaugon
Tambiah
Tandler
Tanowitz
Tatar
Taveras
Tawn
Tcherepnin
Teague
Temes
Temmer
Tenney
Terracini
Than
Thavaneswaran
Theodos
Thibault
Thisted
Thomsen
Throop
Tierney
Till
Timmons
Tofallis
Tollestrup
Tolls
Tolman
Tomford
Toomer
Topulos
Torresi
Torske
Towler
Toye
Traebert
Trenga
Trewin
Tringali
Troiani
Troy
Truss
Tsiatis
Tsomides
Tsukurov
Tuck
Tudge
Tukan
Turano
Turek
Tuttle
Twells
Tzamarias
Ullman
Untermeyer
Upsdell
Urban
Urdang-Brown
Usdan
Uzuner
Vacca
Valberg
Valencia
vanAllen
Vandenberg
Vanheeckeren
VanZwet
Vasquez
Velasquez
Venne
Verghese
Viana
Viano
Viens
Vignola
Villarreal
Vitali
Viviani
Voigt
VonHoffman
Vorhaus
Votey
Waite
Wales
Wallenberg
Walter
Warshafsky
Wasowska
Waugh
Weighart
Weingarten
Weinhaus
Weissbourd
Weissman
Welles
Welsh
Wengret
Wescott
Wetzel
Whately
Whilton
White
Whitla
Whittaker
Wiedersheim
Wiener
Wilder
Wilhelm
Wilk
Wilkin
Wilkinson
Willstatter
Wilson
Wolk
Woo
Wooden
Woods
Woods-Powell
Yacono
Yamane
Yankee
Yarchuk
Yates
Ybarra
Yedidia
Yesson
Yetiv
Yoffe
Yoo
Youk-See
Zachary
Zahedi
Zangwill
Zegans
Zerbini
Zoldak
Zucconi
Zurn
Zwiers
Zytowski 6，邮件内容：
病毒将使用如下域名之一来创建一个虚假的地址：
- 来源：
compuserve.com
juno.com
earthlink.net
yahoo.co.uk
hotmail.com
yahoo.com
msn.com
aol.com

使用如下标题之一：
Attention!!!
Do not reply to this email
Error
Good day
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
附件有如下几个命名：
body
message
docs
data
file
rules
doc
readme
document
附件扩展名为如下之一：
.bat
.cmd
.exe
.scr
.pif
.zip

邮件文本内容如下：
The message contains Unicode characters and has been sent as a binary attachment.

The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.

Mail transaction failed. Partial message is available.

Here are your documents you are requested.

Thank you for registering at WORLDXXXPASS.COM
All your payment info, login and password you can find in the attachment file.
It's a real good choise to go to WORLDXXXPASS.COM

Attention! New self-spreading virus!
Be careful, a new self-spreading virus called "RTSW.Smash" spreading very fast via e-mail and P2P networks. It's about two million people infected and it will be more.
To avoid your infection by this virus and to stop it we provide you with full information how to protect yourself against it and also including free remover. Your can find it in the attachment.
c 2004 Networks Associates Technology, Inc. All Rights Reserved
New terms and conditions for credit card holders
Here a new terms and conditions for credit card holders using a credit cards for making purchase in the Internet in the attachment. Please, read it carefully. If you are not agree with new terms and conditions do not use your credit card in the World Wide Web.
Thank you,
The World Bank Group
c 2004 The World Bank Group, All Rights Reserved
Attention! Your IP was logged by The Internet Fraud Complaint Center
Your IP was logged by The Internet Fraud Complaint Center. There was a fraud attempt logged by The Internet Fraud Complaint Center from your IP. This is a serious crime, so all records was sent to the FBI.
All information you can find in the attachment. Your IP was flagged and if there will be anover attemption you will be busted.
This message is brought to you by the Federal Bureau of Investigation and the National White Collar Crime Center

7，它将自己拷贝到名为Kazaa,morpheus,iMesh,eDonkey或者是LimeWire的共享文件夹中，文件扩展名为：.bat,.pif或者.exe：

    ·porno
    ·NeroBROM6.3.1.27
    ·avpprokey
    ·Ad-awareref01R349
    ·winxp_patch
    ·adultpasswds
    ·dcom_patches
    ·K-LiteCodecPack2.34a
    ·activation_crack
    ·icq2004-final
    ·winamp5

8，同时，它也尝试去终止如下的进程，包含防火墙及反病毒程序：
i11r54n4.exe
irun4.exe
d3dupdate.exe
rate.exe
ssate.exe
winsys.exe
winupd.exe
SysMonXP.exe
bbeagle.exe
Penis32.exe
teekids.exe
MSBLAST.exe
mscvb32.exe
sysinfo.exe
PandaAVEngine.exe
taskmon.exe
wincfg32.exe
outpost.exe
zonealarm.exe
navapw32.exe
navw32.exe
zapro.exe
msblast.exe
netstat.exe
9，下载http://nermasteno.com/com.txt或者http://www.opsanted.com/com.txt。

10，将如下条目添加到%system%\drivers\etc\hosts文件夹中，以阻止用户访问反病毒网站：
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 www.f-secure.com
127.0.0.1 f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 www.my-etrust.com
127.0.0.1 my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 www.nai.com
127.0.0.1 nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 www.trendmicro.com
127.0.0.1 trendmicro.com
127.0.0.1 www.grisoft.com
127.0.0.1 grisoft.com