usnsrv.exe,NewYears2008!.zip,msn新年病毒

usnsrv.exe,NewYears2008!.zip,msn新年病毒

文件名称：NewYears2008!.zip

文件大小：70144 byte

AV命名：N/A

加壳方式：EXECryptor

编写语言：VC

文件MD5：035104450a29738daaedeee65ad69c61

行为分析：

1、 释放病毒副本：

C:\Documents and Settings\User\Local Settings\Temp\NewYears2008!.zip 73898 字节
C:\WINDOWS\system32\usnsrv.exe  70144 字节

2、 添加注册表，开机启动：

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
 (注册表值) Userfile Sharing Serv = REG_SZ, "usnsrv.exe"

3、 连接IRC服务器：server**.core.net，加入pool频道。

用户名为感染计算机的系统版本，密码为gsaxx00登入。

4、 下载一个木马：http://holieb.com/***/03.exe。其实就是usnsrv.exe。

5、 向MSN好友发送临时文件夹下的NewYears2008!.zip 还有一些言语。

可能是下面的一条（http://www.timbercreeksoftware.com/pages/xx3.txt）：

look at what happaned to my room after New Years!
How long do you think it is going to take to clean this up?
Damn I really shouldn't have gotten this drunk.
I think this was the best New Years Crew ever!
Could this really be real?
I vaguely remember seeing this person, then woke up next to them... Oh my!
Wow this was a CRAZY night. I don't even remember it!
I just edited this picture to be an AWESOME wallpaper!
Does my new style look hot?
Is it bad if I only remember the sex, and nothing else?
How do we look together?
Could I throw this picture of you in my album?
Could I have really had sex with them?
Is this really a pic of you?
We had sex, but it never went any further... What did I do wrong?
you don't think I had sex with them... right?
I think this looks horrible, what do you think?
It's too bad you missed out on this party!
How bad does this look? I just snapped it with new camera.
Would you have had a threesome with them?
Does this look good enough for my default picture?
Look at this crazyness! Two people are making out on the table!
Damn I could barely walk when someone took this pic!
Can I upload this picture of you to my profile?
You get any action on New Years? I sure did! ;)
This picture of you looks realllly freaky!
damn New Years was crazy, I think I had sex with this person!
Does my new style look hot?
Is it bad if I had sex with someone, and all I have is their picture?
Someone took this picture right before I passed out...
Is it bad if I had a threesome with them?
You wouldn't care if I uploaded this picture of us, right?
I can't believe I gave it up soo easy on New Years. Atleast they were hot.
Oh my lord, I think we trashed the place!
No way, this can't be you... Or is it?

解决方法：

1、 下载SREng，断开网络连接。

2、 打开SREng，删除病毒启动项“Userfile Sharing Serv”

3、 重启计算机，清空临时文件夹，删除硬盘文件：

C:\Documents and Settings\User\Local Settings\Temp\NewYears2008!.zip   73898 字节
C:\WINDOWS\system32\usnsrv.exe  70144 字节