“网络天空”最新变种Ｐ(NetSky.P)分析报告 -天瑞科技，深圳电脑维修，深圳电脑维护

病毒信息：

　　病毒名称: Worm.NetSky.P
　　中文名称: 网络天空变种P
　　威胁级别: 3A
　　病毒别名: W32.Netsky.P@mm [Symantec]
　　　　　　　 W32/Netsky.p@MM [McAfee]
　　　　　　　 Win32.Netsky.P [Computer Associates]
　　　　　　　 NetSky.P [F-Secure]
　　　　　　　 W32/Netsky.P.worm [Panda]
　　　　　　　 W32/Netsky-P [Sophos]
　　　　　　　 WORM_NETSKY.P [Trend]
　　病毒类型: 蠕虫、后门
　　受影响系统:Win9x/WinMe/WinNT/Win2000/WinXP/Win2003
　　能处理的毒霸版本: 2004年3月23日

　　技术特点：

　　· 破坏方法：

　　　 1、通过网络大量发送邮件传播，浪费网络资源，阻塞邮件服务器；
　　　 2、利用Internet Explorer(以下缩写为IE)的漏洞“不正确的MIME头部可使IE自动执行邮件的
　　　　　附件”（http://www.microsoft.com/technet/security/bulletin/MS01-020.mspx），让用
　　　　　户在收到病毒邮件后，只是预览邮件也会感染上该病毒

　　· 系统修改：（点击查看详情）

A、创建一个名为"_-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_"的互斥体，来确定只运行它的一个进程；

B、拷贝其本身至系统安装目录：
%Windir%\FVProtect.exe

C、在系统安装目录释放和创建如下文件：
%Windir%\userconfig9x.dll
%Windir%\base64.tmp (40,520 bytes): MIME-encoded version of the executable
%Windir%\zip1.tmp (40,882 bytes): MIME-encoded version of worm in a .zip archive
%Windir%\zip2.tmp (40,894 bytes): MIME-encoded version of worm in a .zip archive
%Windir%\zip3.tmp (40,886 bytes): MIME-encoded version of worm in a .zip archive
%Windir%\zipped.tmp (29,834 bytes): Worm in a .zip archive

D、在注册表主键：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
下添加如下键值：
"Norton Antivirus AV"="%Windir%\FVProtect.exe"

在注册表主键：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
下删除如下键值：
Explorer
system.
msgsvr32
winupd.exe
direct.exe
jijbl
service
Sentry

在注册表主键：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
下删除如下键值：
system
Video

在注册表主键：
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
下删除以下键值：
Explorer
au.exe
direct.exe
d3dupdate.exe
OLE
gouday.exe
rate.exe
Taskmon
Windows Services Host
sysmon.exe
srate.exe
ssate.exe
winupd.exe

删除以下子键：
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\PINF
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WksPatch
HKEY_CLASSES_ROOT\CLSID\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32

E、扫描被感染系统硬盘上的包含以下字符串的文件夹：
bear
donkey
download
ftp
htdocs
http
icq
kazaa
lime
morpheus
mule
my shared folder
shar
shared files
upload

然后将其本身用以下名字拷贝至搜索出的文件夹中：
"1001 Sex and more.rtf.exe"
"3D Studio Max 6 3dsmax.exe"
"ACDSee 10.exe"
"Adobe Photoshop 10 crack.exe"
"Adobe Photoshop 10 full.exe"
"Adobe Premiere 10.exe"
"Ahead Nero 8.exe"
"Altkins Diet.doc.exe"
"American Idol.doc.exe"
"Arnold Schwarzenegger.jpg.exe"
"Best Matrix Screensaver new.scr"
"Britney sex xxx.jpg.exe"
"Britney Spears and Eminem porn.jpg.exe"
"Britney Spears blowjob.jpg.exe"
"Britney Spears cumshot.jpg.exe"
"Britney Spears fuck.jpg.exe"
"Britney Spears full album.mp3.exe"
"Britney Spears porn.jpg.exe"
"Britney Spears Sexy archive.doc.exe"
"Britney Spears Song text archive.doc.ex"...
"Britney Spears.jpg.exe"
"Britney Spears.mp3.exe"
"Clone DVD 6.exe"
"Cloning.doc.exe"
"Cracks & Warez Archiv.exe"
"Dark Angels new.pif"
"Dictionary English 2004 - France.doc.ex"...
"DivX 8.0 final.exe"
"Doom 3 release 2.exe"
"E-Book Archive2.rtf.exe"
"Eminem blowjob.jpg.exe"
"Eminem full album.mp3.exe"
"Eminem Poster.jpg.exe"
"Eminem sex xxx.jpg.exe"
"Eminem Sexy archive.doc.exe"
"Eminem Song text archive.doc.exe"
"Eminem Spears porn.jpg.exe"
"Eminem.mp3.exe"
"Full album all.mp3.pif"
"Gimp 1.8 Full with Key.exe"
"Harry Potter 1-6 book.txt.exe"
"Harry Potter 5.mpg.exe"
"Harry Potter all e.book.doc.exe"
"Harry Potter e book.doc.exe"
"Harry Potter game.exe"
"Harry Potter.doc.exe"
"How to hack new.doc.exe"
"Internet Explorer 9 setup.exe"
"Kazaa Lite 4.0 new.exe"
"Kazaa new.exe"
"Keygen 4 all new.exe"
"Learn Programming 2004.doc.exe"
"Lightwave 9 Update.exe"
"Magix Video Deluxe 5 beta.exe"
"Matrix.mpg.exe"
"Microsoft Office 2003 Crack best.exe"
"Microsoft WinXP Crack full.exe"
"MS Service Pack 6.exe"
"netsky source code.scr"
"Norton Antivirus 2005 beta.exe"
"Opera 11.exe"
"Partitionsmagic 10 beta.exe"
"Porno Screensaver britney.scr"
"RFC compilation.doc.exe"
"Ringtones.doc.exe"
"Ringtones.mp3.exe"
"Saddam Hussein.jpg.exe"
"Screensaver2.scr"
"Serials edition.txt.exe"
"Smashing the stack full.rtf.exe"
"Star Office 9.exe"
"Teen Porn 15.jpg.pif"
"The Sims 4 beta.exe"
"Ulead Keygen 2004.exe"
"Visual Studio Net Crack all.exe"
"Win Longhorn re.exe"
"WinAmp 13 full.exe"
"Windows 2000 Sourcecode.doc.exe"
"Windows 2003 crack.exe"
"Windows XP crack.exe"
"WinXP eBook newest.doc.exe"
"XXX hardcore pics.jpg.exe"

　　· 病毒邮件特征：（点击查看详情）

A、在系统C-Z盘具有以下后缀的文件中查找Email地址：
.adb 　.asp 　.cgi 　.dbx 　.dhtm 　.doc 　.eml 　.htm 　.html 　.jsp 　.msg
.oft 　.php 　.pl 　 .rtf 　.sht 　 .shtm 　.tbb 　.txt 　.uin 　.vbs 　.wab
.wsh 　.xml

B、用其自带的SMT引擎向查到的Email地址中发信，具有以下特征：
发件人：<随机的具有诱惑性的名字>

主题：<以下字符串中任选一个>：
Re: Encrypted Mail
Re: Extended Mail
Re: Status
Re: Notify
Re: SMTP Server
Re: Mail Server
Re: Delivery Server
Re: Bad Request
Re: Failure
Re: Thank you for delivery
Re: Test
Re: Administration
Re: Message Error
Re: Error
Re: Extended Mail System
Re: Secure SMTP Message
Re: Protected Mail Request
Re: Protected Mail System
Re: Protected Mail Delivery
Re: Secure delivery
Re: Delivery Protection
Re: Mail Authentification
Mail Delivery (failure )

正文：<以下字符串中任选一个>：
Please see the attached file for details
Please read the attached file!
Your document is attached.
Please read the document.
Your file is attached.
Your document is attached.
Please confirm the document.
Please read the important document.
See the file.
Requested file.
Authentication required.
Your document is attached to this mail.
I have attached your document.
I have received your document. The corrected document is attached.
Your document.
Your details.

该病毒还会将以下文件放入文件正文后：
+++ Attachment: No Virus found
+++ MessageLabs AntiVirus - www.messagelabs.com

+++ Attachment: No Virus found
+++ Bitdefender AntiVirus - www.bitdefender.com

+++ Attachment: No Virus found
+++ MC-Afee AntiVirus - www.mcafee.com

+++ Attachment: No Virus found
+++ Kaspersky AntiVirus - www.kaspersky.com

+++ Attachment: No Virus found
+++ Panda AntiVirus - www.pandasoftware.com

++++ Attachment: No Virus found
++++ Norman AntiVirus - www.norman.com

++++ Attachment: No Virus found
++++ F-Secure AntiVirus - www.f-secure.com

++++ Attachment: No Virus found
++++ Norton AntiVirus - www.symantec.de

附件名:<为以下字符串中的一个>:
document05
websites03
game_xxo
your_document

后跟以下字符串中的一个：
.txt <很长的空白空间>
.doc <很长的空白空间>

最后的后缀名为以下字符串中的一个：
.exe
.pif
.scr
.zip

如果文件后缀为.zip，那么里面为以下文件中的一个：
document.txt .exe
data.rtf .scr
details.txt .pif

C、该病毒将不会给包含以下字符串的Email地址发送邮件：
@antivi
@avp
@bitdefender
@fbi
@f-pro
@freeav
@f-secur
@kaspersky
@mcafee
@messagel
@microsof
@norman
@norton
@pandasof
@skynet
@sophos
@spam
@symantec
@viruslis
abuse@
noreply@
ntivir
reports@
spam@

　　解决方案:

　　· 金山毒霸已经于3月23日对该病毒进行了应急处理，请升级最新版可完全查该病毒；

　　· 请一定留意收到的邮件，如果有附件，请不要打开附件，更不要执行附件中的可执行程序，注
　　　意病毒程序伪装的图标，不要轻信图标为“电子表格、文本文件、文件夹”的附件。如果有必
　　　要打开附件，请使用反病毒软件检测以后再打开。；

　　· 该病毒不易手工清除，会造成清楚不干净的现象，请升级毒霸到2004年3月19日的病毒库可处理
　　　该病毒。如没有安装金山毒霸，可以登录http://online.kingsoft.net使用金山毒霸的在线查
　　　毒或是金山毒霸下载版来防止该病毒的入侵；或可以选择登录到
　　　 http://www.duba.net/download/3/107.shtml下载“网络天空”专杀工具，以防止该病毒的肆
　　　虐。