病毒名称：W32.Chet@mm

　　别名：W32/Chet@MM [McAfee], W32/Chet-A [Sophos], Win32.Chet [CA], WORM_CHET.A [Trend], I-Worm.Chet [AVP]

　　发现日期：2002-09-10

　　病毒类型：蠕虫

　　感染长度：26,628字节

　　危害级别：低

　　传播速度：低

　　受影响系统：Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me

　　不受影响系统：Macintosh, Unix, Linux

　　病毒危害：

　　1.发送大量病毒邮件：感染后会将自身发送给Windows地址簿中的所有联系人；

　　2.泄露机密信息：会将被感染用户所有联系人的邮件地址、被感染机器IP地址及机器名等信息发送给黑客。

　　邮件特征：

　　From:main@world.com

　　主题：All people!!

　　正文：Dear ladies and gentlemen!

　　The given letter does not contain viruses, and is not Spam.

　　We ask you to be in earnest to this letter. As you know America and

　　England have begun bombardment of Iraq, cause of its threat for all the world.

　　It isn‘t the truth. The real reason is in money laundering and also to cover up tracesafter acts of terrorism September, 11, 2001. Are real proofs of connection betweenBush and Al-Qaeda necessary for you? Please! There is a friendly dialogue betweenBin Laden and the secretary of a state security of USA in the given photos.

　　In the following photo you‘ll see, how FBI discusses how to strike over New York to losepeople as much as possible. And the document representing the super confidentialagreement between CIA and Al-Qaeda is submitted to your attention. All this

　　circus was specially played to powder brains!! You‘ll find out the truth.

　　Naked truth, instead of TV showed.

　　For your convenience, and to make letter less, all documentary materials

　　(photos and MS Word documents) are located in one EXE file. Open it, and all materials will be

　　installed on your computer. You will receive the freshest and classified

　　documents automatically from our site.

　　It isn‘t a virus! You can trust us absolutely. We hope, that it will open your

　　eyes on many things occurring in this world.

　　附件：11september.exe

　　注意：附件的文件名末尾有一个空格

　　技术特征：

　　该邮件蠕虫运行后，会：

　　1.将自己复制成C:%system%Synchost1.exe；

　　2.添加键值ICQ1 C:%system%synchost1.exe

　　至注册表HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun中，使得病毒在每次启动Windows时会自动运行；

　　3.创建文件C:Boot.txt，文件长度为零字节；

　　4.搜索注册表，以查找Windows地址簿文件的位置，然后将自己发送给地址簿中的所有联系人。