[原创]Backdoor.Win32.IRCBot.azo - 德化论坛

文件名称：msmgslive.exe

文件大小：71680 byte

AV命名：Backdoor.Win32.IRCBot.azo(AVP)

加壳方式：EXECryptor

文件MD5：04fd8beae32250498a2340a65e5cc8bf

病毒类型：IRCbot

行为分析：

1、释放病毒副本：

C:\Documents and Settings\User\Local Settings\Temp\newfacebook.com.zip（病毒压缩包）

C:\WINDOWS\system32\msmgslive.exe 71680 字节

2、添加RUN项：

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

(注册表值) Windows Live Messenger Servicer = "msmgslive.exe"

3、登入欧洲IRC服务器（server9.cor**.net），加入pool频道。

以感染该病毒的计算机系统版本为用户名，密码为gsaxx00连接。

允许对下列命令做出响应：

PART

JOIN

QUIT

KICK

PONG

PING

PRIVMSG

............

4、查找MSBLWindowClass类名？可能是用来判断MSN是否在运行状态。

假设存在，则向MSN好友发送病毒压缩包和下面的一条文字：

look at what happaned to my room after New Years!

How long do you think it is going to take to clean this up?

Damn I really shouldn't have gotten this drunk.

No way this is really your picture... or is it?!

How do you think my new look is, Good? Bad? Ugly?

I think this was the best New Years Crew ever!

here, this is the new computer I wanna get. Nice huh?

Could this really be real?

I vaguely remember seeing this person, then woke up next to them... Oh my!

Wow this was a CRAZY night. I don't even remember it!

here, this picure is PERFECT for your desktop wallpaper.

Can I show my friends this picture of you???

hey, look at this picture from ebay. Its a necklace I want so badly.

Can you tag me in this picture on Facebook?

Is it bad if I only remember the sex, and nothing else?

Oh my this isn't you right??

this is my dream house. look at the pool. Damn!

ok, ok here. but please dont send it to noone. I dont like the way i look in that one.

This picture isn't too 性感 for Facebook right?!?

It alright if I use this picture of you in my profile?

Could I throw this picture of you in my album?

Could I have really had sex with them?

hey i found your picture on hotornot.com! I swear its you!

OMG, i found ur pic on cuteornot.com! im not kidding either!!!

Is this really a pic of you?

We had sex, but it never went any further... What did I do wrong?

you don't think I had sex with them... right?

It's too bad you missed out on this party!

omg I look so dumb in this pic its funny.. dont show anyone. EVER

Would you have had a threesome with them?

Do you care if I up this picture of us to my profile?

Can I add this picture of you to my new album?

I think I found your picture on adultfriendfinder!!!

Does this look good enough for my default picture?

Look at this crazyness! Two people are making out on the table!

sry about the messup i fixed the pic! Try it one more time plz