ÆäËüÃû³Æ£ºW32/Backdoor.HZL (F-Secure), Win32/Robknot.P!Worm, Win32/Robzips, Win32.Robzips.A, Win32/Robzips.A!ZIP, Email-Worm.Win32.Brontok.n (Kaspersky)

²¡¶¾ÌØÐÔ£º
Win32.Robzips.AÊÇÒ»ÖÖͨ¹ýÓʼþ´«²¥µÄÈä³æ¡£ËüÊÇ´óСΪ45,120×Ö½Ú£¬ÒÔUPX¸ñʽ¼Ó¿ÇµÄWin32¿ÉÔËÐгÌÐò¡£²¡¶¾Í¨¹ý·¢ËÍ´øÓдóСΪ3,894×Ö½ÚµÄZIP¸½¼þµÄÓʼþ½øÐд«²¥¡£ZIP¸½¼þÖаüº¬Ò»¸öÏÂÔØÆ÷ºÍÒ»¸öÅú´¦ÀíÎļþ¡£

¸ÐȾ·½Ê½£º
ÔËÐÐʱ£¬Win32.Robzips.AÔÚ%System%Ŀ¼ÖÐÉú³ÉÒ»¸öÈÎÒâÃû³ÆµÄÎļþ¼Ð£¬²¢Ê¹ÓÃÒÔÏÂÎļþÃû¸´ÖƲ¡¶¾µ½Õâ¸öÎļþ¼Ð£º
smss.exe
csrss.exe  
lsass.exe  
services.exe  
winlogon.exe  

ËæºóÔËÐÐÕâЩÎļþ¡£

×¢£º'%System%'ÊÇÒ»¸ö¿É±äµÄ·¾¶¡£²¡¶¾Í¨¹ý²éѯ²Ù×÷ϵͳÀ´¾ö¶¨SystemÎļþ¼ÐµÄλÖá£Windows 2000 and NTĬÈϵÄϵͳ°²×°Â·¾¶ÊÇC:\Winnt\System32; 95,98 ºÍ ME µÄÊÇC:\Windows\System; XP µÄÊÇC:\Windows\System32¡£

Ëü»¹»áʹÓÃÈÎÒâÎļþÃû¸´ÖƵ½Õâ¸öÎļþ¼ÐºÍ%Windows%Ŀ¼ÖУ¬»¹ÓÐÒÔÏÂλÖãº
%Windows%\_default<random value>.pif

Robzips»¹»á¸´ÖƵ½%Application Data%\jalak-93<random value>-bali.com£¬²¢Ìí¼ÓÕâ¸öÎļþµ½Ô¤¶¨ÈÎÎñÁбíÖУ¬ÎªÁËÿÌì11:03 am ºÍ 5:08 pmʱ¼äÔËÐв¡¶¾¡£

×¢£º%Application Data% ÊÇÒ»¸ö¿É±äĿ¼£¬Ò»°ãÔÚÒÔÏÂλÖÃ"C:\Documents and Settings\<user name>\Local Settings\Application Data"¡£
²¡¶¾Éú³ÉÒ»¸öÎı¾Îļþ"C:\Baca Bro !!!.txt"£¬Õâ¸öÎļþ°üº¬ÒÔÏÂÄÚÈÝ£º
 

Óû§´ò¿ªÕâ¸öÎļþä¯ÀÀʱ£¬Robzips»á¹Ø±ÕËü£¬²¢ÏÔʾÏÔʾÒÔÏÂÐÅÏ¢£º
 

 

´«²¥·½Ê½
ͨ¹ýÓʼþ´«²¥
Robzips·¢ËÍÓʼþµÄÓʼþµØÖ·´Ó±¾µØÎļþÖлñÈ¡£¬ËüËÑË÷ÒÔÏÂÀ©Õ¹ÃûµÄÎļþ£º
txt
htm
html
csv
eml
wab
asp
php
cfm
doc
xls
ppt

»ñÈ¡µÄÓʼþµØÖ·±£´æÔÚ"%System%\<random folder name>\Spread.Mail.Bro" and "%System%\<random folder name>\Spread.Sent.Bro"¡£

Robzips.A²»·¢ËÍ°üº¬ÒÔÏÂ×Ö·û´®µÄÓʼþµØÖ·£º
--
-.
-@
-_
.-
..
.@
._
.ASP
.CA.COM
.cfm
.doc
.eml
.EXE
.gif
.HTM
.JS
.pdf
.PHP
.ppt
.txt
.VBS
.xls
@-
@.
@123
@_
@ABC
@MAC
@mm
_-
_.
_@
__
abuse
acer
ADMIN
ADOBE
AHNLAB
ALADDIN
ALERT
ALWIL
anony
ANTIGEN
APACHE
ARCHIEVE
ASDF
ASSOCIATE
AVAST
AVG
AVIRA
BILLING@
BLACK
BLAH
BLEEP
borland
BROWSE
BUG
BUILDER
BUNTU
CANON
CASTLE
chip
CILLIN
CISCO
CLICK
CNET
code
coding
compaq
COMPUSE
COMPUTE
CONTOH
CRACK
DARK
DATABASE
DEMO
detik
DEVELOP
DOMAIN
DOWNLOAD
ELECTRO
ELEKTRO
ESAFE
ESAVE
ESCAN
EXAMPLE
FEEDBACK
FOO@
FREE
FUCK
FUJI
FUJITSU
GATEWAY

GRISOFT
GROUP
guru
HACK
HAURI
HELP
HIDDEN
HP.
IBM.
IEEE
INFO@
INFORMA
INTEL.
IPTEK
IRFANVIEW
jpg
KDE
KOMPUTER
LAB
LINUX
LOOKSMART
LOTUS
LUCENT
MACRO
MASTER
MATH
MICRO
MICROSOFT
MOZILLA
MSDN
MYSQL
NASA
NETSCAPE
NETWORK
NEWS
NOD32
NOKIA
NONE
NORMAN
NORTON
NOVELL
NVIDIA
OPERA
OVERTURE
PANDA
pcmag
pcmedia
pcplus
POSTGRE
PROGRAM
PROLAND
PROMO
PROTECT
PROXY
RECIPIENT
REDHA
REGIST
RELAY
RESPONSE
ROBOT
SALES
script
SECUN
SECURE
SECURITY
SEKUR
SENIOR
SERVER
SERVICE
SIEMENS
SIERRA
SLACK
SMTP
SOFT
SOME
SOURCE
SPAM
SPERSKY
SPYW
STUDIO
SUN.
SUPPORT
SUSE
SYBARI
SYMANTEC
SYNDICAT
TELECOM
TEST
torvald
TRACK
TREND
trovald
TRUST
UPDATE
USERNAME
VAKSIN
VIRUS
W3.
w32
WINRAR
WINZIP
WWW
XANDROS
XEROX
XXX
yahoo
YOUR
ZDNET
ZEND
ZOMBIE

Èä³æ·¢Ë͵ÄÓʼþʹÓÃÓ¢Óï»òÕßIndonesion£¬²¡¶¾ÓʼþÓÐÒÔÏÂÌØÕ÷£º
English
Ö÷Ìâ:
My Best Photo
ÄÚÈÝ:
Hi,
I want to share my photo with you.
Wishing you all the best.
Regards,
¸½¼þ:
Photo.zip

Indonesion
Ö÷Ìâ:
Fotoku yg Paling Cantik
ÄÚÈÝ:
Hi
Aku lg iseng aja pengen kirim foto ke kamu.
Jangan lupain aku ya !.
Thanks
¸½¼þ:
Photo.zip

Zip¸½¼þ°üº¬2¸öÎļþ£¬"Photo.bmp" ºÍ "View-Photo.bat"¡£Photo.bmpÊÇÒ»¸öWin32¿ÉÔËÐгÌÐò£¬ÓÃÀ´´Ó"20mbweb.com"ÓòÏÂÔز¢ÔËÐÐÎļþ£¬Åú´¦ÀíÎļþÓÃÀ´ÔËÐпÉÔËÐÐÎļþ¡£
 

Σº¦
ÖÕÖ¹½ø³Ì
Robzips.AÖÕÖ¹ÒÔÏÂλÖÃÔËÐеÄÈÎÒâ»î¶¯µÄ½ø³Ì£º
%Profiles%\Local Settings\Application Data
%Profiles%\Start Menu\Programs\Startup
%Profiles%\Templates

Ëü»¹»áÖÕÖ¹Ãû×ÖÖаüº¬ÒÔÏÂ×Ö·û´®µÄÈÎÒâ½ø³Ì£º
mcv
poproxy
avg
ash
ccapps
tskmgr
syslove
xpshare
riyani
systray
ashmaisv
aswupdsv
nvcoas
cclaw
njeeves
nipsvc
dkernel
iexplorer
lexplorer
update
vptray
opscan
nopdb
ccapp
ctfmon
services.com
virus
siti
mspatch
Anti
zlh
foto
Dian
Mariana
Alicia
sstray
kangen
untukmu
diary
wscript
Romantic
remove
washer
kill
rontok
rontox
movzx
machine
norton
symantec
norman
bitdef
avast
mcaf
grisoft
cillin
trend
panda
kaspersky
aladdin
sysinter
hijack
nod32
peid
ahnla

ÐÞ¸ÄHostsÎļþ
HostsÎļþ°üº¬IPµØÖ·ºÍ»úÆ÷ÃûµÄÓ³Éä¡£Windows²éѯDNS֮ǰ»á¼ì²éHostsÎļþ¡£ÔÚXP, 2000 ºÍ NT ϵͳÖÐhosts ÎļþλÓÚ%System%\drivers\etc\hosts£»ÔÚ9x ϵͳÖÐhosts ÎļþλÓÚ%Windows%\hosts¡£

Èä³æÐÞ¸ÄHostsÎļþ£¬×èÖ¹·ÃÎÊÒÔÏÂÕ¾µã£º
17tahun.com
17tahun.net
17tahun.org
ae.trendmicro-europe.com
ae.trendmicro-europe.net
ae.trendmicro-europe.org
anti-virus.com
anti-virus.net
anti-virus.org
antivirus.com
antivirus.net
antivirus.org
backup.grisoft.com
backup.grisoft.net
backup.grisoft.org
bhs.com
bhs.net
bhs.org
blog.compactbyte.com
blog.compactbyte.net
blog.compactbyte.org
blogs.compactbyte.com
blogs.compactbyte.net
blogs.compactbyte.org
ca.com
ca.net
ca.org
castlecops.com
castlecops.net
castlecops.org
cheyenne.com
cheyenne.net
cheyenne.org
compactbyte.com
compactbyte.net
compactbyte.org
datafellows.com
datafellows.net
datafellows.org
download.mcafee.com
download.mcafee.net
download.mcafee.org
downloads1.kaspersky-labs.com
downloads1.kaspersky-labs.net
downloads1.kaspersky-labs.org
downloads2.kaspersky-labs.com
downloads2.kaspersky-labs.net
downloads2.kaspersky-labs.org
downloads3.kaspersky-labs.com
downloads3.kaspersky-labs.net
downloads3.kaspersky-labs.org
downloads4.kaspersky-labs.com
downloads4.kaspersky-labs.net
downloads4.kaspersky-labs.org
esafe.com
esafe.net
esafe.org
europe.f-secure.com
europe.f-secure.net
europe.f-secure.org
f-secure.com
f-secure.net
f-secure.org
fajarweb.com
fajarweb.net
fajarweb.org
forum.vaksin.com
forum.vaksin.net
forum.vaksin.org
free-av.com
free-av.net
free-av.org
grisoft.com
grisoft.net
grisoft.org
icubed.com
icubed.net
icubed.org
infokomputer.com
infokomputer.net
infokomputer.org
it.trendmicro-europe.com
it.trendmicro-europe.net
it.trendmicro-europe.org
jasakom.com
jasakom.net
jasakom.org
jeruk.padinet.com
jeruk.padinet.net
jeruk.padinet.org
kaskus.com
kaskus.net
kaskus.org
kaspersky-labs.com
kaspersky-labs.net
kaspersky-labs.org
kaspersky.com
kaspersky.net
kaspersky.org
liveupdate.symantec.com
liveupdate.symantec.net
liveupdate.symantec.org
liveupdate.symantecliveupdate.com
liveupdate.symantecliveupdate.net
liveupdate.symantecliveupdate.org
mcafee.com
mcafee.net
mcafee.org
mcafeeb2b.com
mcafeeb2b.net
mcafeeb2b.org
mcafeesecurity.com
mcafeesecurity.net
mcafeesecurity.org
nai.com
nai.net
nai.org
norman.com
norman.net
norman.org
norton.com
norton.net
norton.org
ontrack.com
ontrack.net
ontrack.org
padinet.com
padinet.net
padinet.org
pandasoftware.com
pandasoftware.net
pandasoftware.org
perantivirus.com
perantivirus.net
perantivirus.org
playboy.com
playboy.net
playboy.org
pornstargals.com
pornstargals.net
pornstargals.org
sands.com
sands.net
sands.org
sarc.com
sarc.net
sarc.org