Hack.Win32.AgoBot.lq

电脑病毒，又名W32.Gaobot.ZX Symantec，中文别名安哥变种lq。是属于安哥家族系例黑客程序。通过特定的微软漏洞进行主动传播，还可以通过弱密码攻击远程系统进行主动传播。影响系统有WinNT/Win2000/WinXP/Win2003。

编写工具

传染条件

发作条件

发作现象

编写工具

VC6.0

传染条件

A、该病毒通过已知的以下微软漏洞进行主动传播：

Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) 缓冲区溢出漏洞（MS03-26）

IIS5/WEBDAV 缓冲区溢出漏洞（MS03-07）

The Workstation service buffer overrun 漏洞（MS03-49）

The Microsoft Messenger Service 缓冲区溢出漏洞（MS03-43）

The Locator service 漏洞（MS03-001）

The UPnP 漏洞（MS01-059）

Microsoft SQL Server 2000 或 MSDE 2000 audit 内的漏洞 （MS02-61）

B、病毒还可以通过弱密码攻击远程系统进行主动传播

C、可利用mIRC软件进行远程控制或是传播

D、通过恶鹰留下的后端口进行传播

发作条件

系统修改:

A、在注册表主键:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices

中添加如下键值：

"Norton Wizzard" = "nwiz.exe"

以便病毒可以自启动

B、拷贝自身到系统目录：

%System%

wiz.exe

C、使用以下用户和密码攻击远程系统，攻击成功，则会上传病毒

用户名：

Admin

admin

administrador

Administrador

Administrat

Administrateur

administrator

Administrator

admins

computer

Convidado

Coordinatore

database

Default

default

Guest

Inviter

kanri

kanri-sha

login

mysql

netbios

Ospite

OWNER

owner

Owner

server

Standard

student

teacher

Verwalter

wwwadmin

密码：

000000

00000000

111111

11111111

121212

123123

12345

123456

1234567

12345678

123456789

1234qwer

123abc

123asd

123qwe

54321

654321

88888888

abc123

admin123

alpha

asdfghjkl

changeme

enable

foobar

godblessyou

homework

ihavenopass

Internet

Login

metal

mybaby

mybox

mypass

oracle

passwd

Password

password

password123

patrick

penis

poiuytrewq

private

pussy

qwerty

qwertyuiop

red123

school

secret

secrets

super

superman

supersecret

sybase

test123

vagina

werty

xxyyzz

zxcvbnm

D、可允许有恶意的用户利用这些被感染的系统进行DoS（拒绝服务）式攻击，可自动对以下地址随机进行攻击

yahoo.co.jp

www.nifty.com

www.d1asia.com

www.st.lib.keio.ac.jp

www.lib.nthu.edu.tw

www.above.net

www.level3.com

nitro.ucsc.edu

www.burst.net

www.cogentco.com

www.rit.edu

www.nocster.com

www.verio.com

www.stanford.edu

www.xo.net

de.yahoo.com

www.belwue.de

www.switch.ch

www.1und1.de

verio.fr

www.utwente.nl

www.schlund.net

E、修改%systme%driversetchosts文件，让大部份反病毒软件的网址重定向到本机，致使这些反病毒软件不能升级。

127.0.0.1 www.trendmicro.com

127.0.0.1 trendmicro.com

127.0.0.1 rads.mcafee.com

127.0.0.1 customer.symantec.com

127.0.0.1 liveupdate.symantec.com

127.0.0.1 us.mcafee.com

127.0.0.1 updates.symantec.com

127.0.0.1 update.symantec.com

127.0.0.1 www.nai.com

127.0.0.1 nai.com

127.0.0.1 secure.nai.com

127.0.0.1 dispatch.mcafee.com

127.0.0.1 download.mcafee.com

127.0.0.1 www.my-etrust.com

127.0.0.1 my-etrust.com

127.0.0.1 mast.mcafee.com

127.0.0.1 ca.com

127.0.0.1 www.ca.com

127.0.0.1 networkassociates.com

127.0.0.1 www.networkassociates.com

127.0.0.1 avp.com

127.0.0.1 www.kaspersky.com

127.0.0.1 www.avp.com

127.0.0.1 kaspersky.com

127.0.0.1 www.f-secure.com

127.0.0.1 f-secure.com

127.0.0.1 viruslist.com

127.0.0.1 www.viruslist.com

127.0.0.1 liveupdate.symantecliveupdate.com

127.0.0.1 mcafee.com

127.0.0.1 www.mcafee.com

127.0.0.1 sophos.com

127.0.0.1 www.sophos.com

127.0.0.1 symantec.com

127.0.0.1 securityresponse.symantec.com

127.0.0.1 www.symantec.com

F、盗取WINDOWS和一些游戏的正版序例号

G、使用随机的端口号，创建FTP服务器在被感染的系统中

H、利用IRC软件开启后门，等待黑客连接

I、病毒嗅探网络中的数据

发作现象

A、终止并删除以下程序，这些程序为“冲击波”及其变种、“冲击波克星”的病毒主程序：

irun4.exe

i11r54n4.exe

winsys.exe

bbeagle.exe

taskmon.exe

B、终止大量反病毒软件的病毒防火墙和杀毒主程、升级程序，以及网络防火墙

AVP32.EXE

_AVPCC.EXE

_AVPM.EXE

AckWin32.EXE

ACKWIN32.EXE

ADVXDWIN.EXE

AGENTSVR.EXE

agentw.EXE

ALERTSVC.EXE

ALOGSERV.EXE

AMON9X.EXE

ANTI-TROJAN.EXE

ANTIVIRUS.EXE

ANTS.EXE

APIMONITOR.EXE

APLICA32.EXE

apvxdwin.EXE

APVXDWIN.EXE

ATCON.EXE

ATGUARD.EXE

ATRO55EN.EXE

ATUPDATER.EXE

ATWATCH.EXE

AUPDATE.EXE

AUTODOWN.EXE

AutoTrace.EXE

AUTOUPDATE.EXE

AVCONSOL.EXE

AVE32.EXE

AVGCC32.EXE

Avgctrl.EXE

AVGCTRL.EXE

AVGNT.EXE

AvgServ.EXE

AVGSERV.EXE

AVGSERV9.EXE

AVGUARD.EXE

AVGW.EXE

avkpop.EXE

AvkServ.EXE

avkservice.EXE

avkwctl9.EXE

AVNT.EXE

AVP.EXE

AVP32.EXE

AVPCC.EXE

AVPDOS32.EXE

avpm.EXE

AVPM.EXE

AVPTC32.EXE

AVPUPD.EXE

Avsched32.EXE

AvSynMgr.AVSYNMGR.EXE

AVWIN95.EXE

AVWINNT.EXE

AVWUPD32.EXE

AVWUPSRV.EXE

AVXMONITOR9X.EXE

AVXMONITORNT.EXE

AVXQUAR.EXE

BD_PROFESSIONAL.EXE

BIDEF.EXE

BIDSERVER.EXE

BIPCP.EXE

BIPCPEVALSETUP.EXE

BISP.EXE

blackd.EXE

BLACKD.EXE

BlackICE.EXE

BLACKICE.EXE

BOOTWARN.EXE

BORG2.EXE

BS120.EXE

ccApp.EXE

ccEvtMgr.EXE

ccPxySvc.EXE

CDP.EXE

CFGWIZ.EXE

CFIADMIN.EXE

CFIAUDIT.EXE

CFINET.EXE

CFINET32.EXE

Claw95.EXE

Claw95cf.EXE

CLAW95CF.EXE

CLEAN.EXE

cleaner.EXE

CLEANER.EXE

cleaner3.EXE

CLEANER3.EXE

CLEANPC.EXE

CMGRDIAN.EXE

CMON0EXE

CONNECTIONMONITOR.EXE

cpd.EXE

CPD.EXE

CPF9X206.EXE

CPFNT206.EXE

CTRL.EXE

CV.EXE

CWNB181.EXE

CWNTDWMO.EXE

defalert.EXE

defscangui.EXE

DEFWATCH.EXE

DEPUTY.EXE

DOORS.EXE

DPF.EXE

DPFSETUP.EXE

DRWATSON.EXE

DRWEB32.EXE

DVP95.EXE

DVP95_0.EXE

ECENGINE.EXE

EFPEADM.EXE

ENT.EXE

ESAFE.EXE

ESCANH95.EXE

ESCANHNT.EXE

ESCANV95.EXE

ESPWATCH.EXE

ETRUSTCIPE.EXE

EVPN.EXE

EXANTIVIRUS-CNET.EXE

EXE.AVXW.EXE

EXPERT.EXE

F-AGNT95.EXE

fameh32.EXE

FAST.EXE

fch32.EXE

fih32.EXE

FINDVIRU.EXE

FIREWALL.EXE

FLOWPROTECTOR.EXE

fnrb32.EXE

FPROT.EXE

F-PROT.EXE

F-PROT95.EXE

FP-WIN.EXE

FP-WIN_TRIAL.EXE

FRW.EXE

fsaa.EXE

FSAV.EXE

fsav32.EXE

FSAV530STBYB.EXE

FSAV530WTBYB.EXE

FSAV95.EXE

fsgk32.EXE

fsm32.EXE

fsma32.EXE

fsmb32.EXE

f-stopw.EXE

F-STOPW.EXE

gbmenu.EXE

GBMENU.EXE

gbpoll.EXE

GBPOLL.EXE

GENERICS.EXE

GUARD.EXE

GUARDDOG.EXE

HACKTRACERSETUP.EXE

HTLOG.EXE

HWPE.EXE

iamapp.EXE

IAMAPP.EXE

iamserv.EXE

IAMSERV.EXE

IAMSTATS.EXE

IBMASN.EXE

IBMAVSP.EXE

ICLOAD95.EXE

ICLOADNT.EXE

ICMON.EXE

ICSUPP95.EXE

ICSUPPNT.EXE

IFACE.EXE

IFW2000.EXE

IOMON98.EXE

IPARMOR.EXE

IRIS.EXE

ISRV95.EXE

JAMMER.EXE

JEDI.EXE

KAVLITE40ENG.EXE

KAVPERS40ENG.EXE

KAVPF.EXE

KERIO-PF-213-EN-WIN.EXE

KERIO-WRL-421-EN-WIN.EXE

KERIO-WRP-421-EN-WIN.EXE

KILLPROCESSSETUP161.EXE

LDNETMON.EXE

LDPRO.EXE

LDPROMENU.EXE

LDSCAN.EXE

LOCALNET.EXE

LOCKDOWN.EXE

lockdown2000.EXE

LOCKDOWN2000.EXE

LOOKOUT.EXE

LSETUP.EXE

LUALL.EXE

LUAU.EXE

LUCOMSERVER.EXE

LUINIT.EXE

LUSPT.EXE

MCAGENT.EXE

MCMNHDLR.EXE

Mcshield.EXE

MCTOOL.EXE

MCUPDATE.EXE

MCVSRTE.EXE

MCVSSHLD.EXE

MFW2EN.EXE

MFWENG3.02D30.EXE

MGAVRTCL.EXE

MGAVRTE.EXE

MGHTML.EXE

MGUI.EXE

MINILOG.EXE

Monitor.EXE

MONITOR.EXE

MOOLIVE.EXE

MPFAGENT.EXE

MPFSERVICE.EXE

MPFTRAY.EXE

MRFLUX.EXE

MSCONFIG.EXE

MSINFO32.EXE

MSSMMC32.EXE

MU0311AD.EXE

MWATCH.EXE

N32SCANW.EXE

NAV Auto-Protect.NAV80TRY.EXE

NAVAP.navapsvc.EXE

NAVAPSVC.EXE

NAVAPW32.EXE

NAVDX.EXE

NAVENGNAVEXNAVLU32.EXE

NAVLU32.EXE

NAVNT.EXE

NAVSTUB.EXE

Navw32.EXE

NAVW32.EXE

NAVWNT.EXE

NC2000.EXE

NCINST4.EXE

NDD32.EXE

NEOMONITOR.EXE

NeoWatchLog.EXE

NETARMOR.EXE

NETINFO.EXE

NETMON.EXE

NETSCANPRO.EXE

NETSPYHUNTER-1.2.EXE

NETSTAT.EXE

NETUTILS.EXE

NISSERV.EXE

NISUM.EXE

NMAIN.EXE

NOD32.EXE

NORMIST.EXE

NORTON_INTERNET_SECU_3.0_407.EXE

notstart.EXE

NPF40_TW_98_NT_ME_2K.EXE

NPFMESSENGER.EXE

NPROTECT.EXE

npscheck.EXE

NPSSVC.EXE

NSCHED32.EXE

ntrtscan.EXE

NTVDM.EXE

NTXconfig.EXE

Nui.EXE

Nupgrade.EXE

NVARCHEXE

NVC95.EXE

nvsvc32.EXE

NWINST4.EXE

NWService.EXE

NWTOOLEXE

OSTRONET.EXE

OUTPOST.EXE

OUTPOSTINSTALL.EXE

OUTPOSTPROINSTALL.EXE

PADMIN.EXE

PANIXK.EXE

PAVCL.EXE

pavproxy.EXE

PAVPROXY.EXE

PAVSCHED.EXE

PAVW.EXE

PCC2002S902.EXE

PCC2K_76_1436.EXE

PCCIOMON.EXE

pccntmon.EXE

pccwin97.EXE

PCCWIN98.EXE

PCDSETUP.EXE

PCFWALLICON.EXE

PCIP10117_0.EXE

pcscan.EXE

PDSETUP.EXE

PERISCOPE.EXE

PERSFW.EXE

PERSWF.EXE

PF2.EXE

PFWADMIN.EXE

PINGSCAN.EXE

PLATIN.EXE

POP3TRAP.EXE

POPROXY.EXE

POPSCAN.EXE

PORTDETECTIVE.EXE

PORTMONITOR.EXE

PPINUPDT.EXE

PPTBC.EXE

PPVSTOP.EXE

PROCESSMONITOR.EXE

PROCEXPLORERV1.0.EXE

PROGRAMAUDITOR.EXE

PROPORT.EXE

PROTECTX.EXE

PSPF.EXE

PURGE.EXE

PVIEW95.EXE

QCONSOLE.EXE

QSERVER.EXE

rapapp.EXE

RAV7.EXE

RAV7WIN.EXE

RAV8WIN32ENG.EXE

REALMON.EXE

REGEDIT.EXE

REGEDT32.EXE

RESCUE.EXE

RESCUE32.EXE

RRGUARD.EXE

RSHELL.EXE

rtvscan.EXE

RTVSCN95.EXE

RULAUNCH.EXE

SAFEWEB.EXE

sbserv.EXE

SBSERV.EXE

SCAN32.EXE

SCAN95.EXE

SCANPM.EXE

SCRSCAN.EXE

SD.EXE

SERV95.EXE

SETUP_FLOWPROTECTOR_US.EXE

SETUPVAMEEVAL.EXE

SFC.EXE

SGSSFW32.EXE

SH.EXE

SHELLSPYINSTALL.EXE

SHN.EXE

SMC.EXE

SOFI.EXE

SPF.EXE

Sphinx.EXE

SPHINX.EXE

SPYXX.EXE

SS3EDIT.EXE

ST2.EXE

SUPFTRL.EXE

SUPPORTER5.EXE

SWEEP95.EXE

SweepNet.SWEEPSRV.SYS.SWNETSUP.EXE

SymProxySvc.EXE

SYMPROXYSVC.EXE

SYMTRAY.EXE

SYSEDIT.EXE

TASKMON.EXE

TAUMON.EXE

TBSCAN.EXE

TC.EXE

TCA.EXE

TCM.EXE

TDS2-98.EXE

TDS2-NT.EXE

TDS-3.EXE

TFAK.EXE

TFAK5.EXE

TGBOB.EXE

TITANIN.EXE

TITANINXP.EXE

TRACERT.EXE

TRJSCAN.EXE

TRJSETUP.EXE

TROJANTRAP3.EXE

UNDOBOOT.EXE

UPDATE.EXE

vbcmserv.EXE

VBCMSERV.EXE

VbCons.EXE

VBCONS.EXE

VBUST.EXE

VBWIN9X.EXE

VBWINNTW.EXE

VCSETUP.EXE

VET32.EXE

Vet95.EXE

VET95.EXE

VetTray.EXE

VETTRAY.EXE

VFSETUP.EXE

VIR-HELP.EXE

VIRUSMDPERSONALFIREWALL.EXE

VNLAN300.EXE

VNPC3000.EXE

VPC32.EXE

VPC42.EXE

VPFW30S.EXE

VPTRAY.EXE

VSCAN40.EXE

VSCENU6.02D30.EXE

VSCHED.EXE

VSECOMR.EXE

vshwin32.EXE

VSISETUP.EXE

VSMAIN.EXE

vsmon.EXE

VSMON.EXE

VSSTAT.EXE

VSWIN9XE.EXE

VSWINNTSE.EXE

VSWINPERSE.EXE

W32DSM89.EXE

W9X.EXE

WATCHDOG.EXE

WEBSCANX.EXE

WEBTRAP.EXE

WFINDV32.EXE

WGFE95.EXE

WHOSWATCHINGME.EXE

WIMMUN32.EXE

WINRECON.EXE

WNT.EXE

WrAdmin.EXE

WRADMIN.EXE

WrCtrl.EXE

WRCTRL.EXE

WSBGATE.EXE

WYVERNWORKSFIREWALL.EXE

XPF202EN.EXE

zapro.EXE

ZAPRO.EXE

ZAPSETUP3001.EXE

ZATUTOR.EXE

ZAUINST.EXE

ZONALM2601.EXE

zonealarm.EXE

ZONEALARM.EXE