MSN相册病毒(IM-Worm.Win32.MSN-Pictures.gen)分析

病毒分析：
         1、文件运行后会释放文件
            %WinDir%\system\csrss.exe       24,576 字节  
            下载文件      
            %WinDir%\My_Pictures2007.zip    24,742 字节
            //压缩包中文件为picture59.jpeg-www.photobucket.com，与csrss.exe为同一文件
            运行后会在以下字符串中随机发送，并传送文件My_Pictures2007.zip给在线好友
            hey man accept my pics. :( i just edited it to look maad funny..Dude i found your picture on                      hotornot.com! Take a look!
            do I look dumb in this picture? I want to put it on myspace.
            hey you got a myspace album? anyways heres my new myspace album :) accept k?
            ok, I DO NOT like my new hair color.. but people on facebook do. what do you think? And no laughing!               lol
            Have you seen me Naked Yet :D
            OMG, i found ur pic on cuteornot.com! Check it out!!!
            Hey just finished new myspace album! :) theres a few kinky ones in there!
            I think this picture is terrible. but my friends on myspace want to see it. please dont show noone.
            Hey accept my pictures, i got a bunch from when i was like a toddler :X
            OMG just accept please its only some pics!!
            do you think this picture is too kinky for Myspace?
            Wanna see my pics before i send em to facebook?
            dude i just got these pictures off my digital for you! Gimme a moment to find em and send
            haha, this guy up my street just slammed his $90k car into a telephone pole! I got a pic of it with
            my  cellphone
            Can you believe somone actually wears this size bra? I could use it for a Tent.
            I've been editing some pics you should def see em loL! accept :)
            Lmfao hey im sending my new pictures! Check em out!
            I cant believe they wanted me to upload this picture to facebook lol. Its terrible. Like my outfit                 tho?
            Take a look at the new pics already! :p
            wanna see this pic of my Boobs?Can i put this pic of you into my new myspace album?
            wow! look at this old picture i found....
            OMFG!!!!!!!! :D
            my crazy sister wants u to see these pics for some reason... take a look
            wow I just dyed my hair... You will never believe the color it is now. lol And dont laugh
            is this pic tooo sexy for photobucket??
            sry about the messup i fixed the pic! Try it one more time pz
            you care if i put this pictuer of you in my new album?
            can i up some of these pics of ya to my myspace profile?
            hey did i ever show you this picture of me?
            haha lets hope your parents dont see this picture of you :D
            Wow i think i found your pic on myspace!
            This picture isnt you... right?
         2、添加注册表项
            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "Server Runtime Server Subsystem"="C:\\WINDOWS\\system\\csrss.exe"
         3、生成%Temp%\_@*.tmp              24,576 字节 //*代表一位至两位数字或是一位大写字母
            并将文件以csrss为镜像名运行
            当在内存中的此进程发现自身文件被删除时，便重新生成一个*的下一个文件
            //例如_@1.tmp 生成_@2.tmp ，_@A.tmp生成_@B.tmp
         4、连接IRC服务器，下载文件并接受远程命令
         5、下载并安装后门，部份文件为：PStore.dll，Advapi.dll
         6、蠕虫文件内含有字符串 “Built on: Sep 9 2007.”

         1、升级超级巡警到最新病毒库，并进行全盘扫描。
         2、下载超级巡警的MSN相册专杀工具，在感染病毒的机器查杀病毒。为保证彻底清除，请重起后再查杀一次。
         3、结束非系统进程的其他csrss.exe //可能会有多个
            删除文件csrss.exe和My_Pictures2007.zip，并清空临时文件夹%Temp%

三、安全建议
     1、立即安装或更新防病毒软件并对内存和硬盘全面扫描(推荐安装超级巡警)。
     2、使用超级巡警的补丁检查功能，检查系统补丁，并及时安装补丁。
     3、不要随便共享文件或文件夹，即使要使用共享，应先设置好权限，另外不建议设置可写或可控制。
     4、不要随便打开不明来历的电子邮件，尤其是邮件附件。
     5、不要随便登陆不明网站，特别不要随意登陆需要自己银行帐号或手机及计算机系统帐号的不明网站。
     6、使用移动存储介质进行数据访问时，先对其进行病毒检查，建议使用超级巡警U盘免疫器进行免疫。
     7、做好系统和重要数据的备份，以便能够进行系统和数据灾难恢复。