病毒信息
　　病毒名称:Worm.Beagle.c
　　中文名称: 恶鹰变种C
　　威胁级别: 3A
　　病毒别名:
　　贝革热
　　雏鹰 [江民]
　　病毒类型: 蠕虫、后门
　　受影响系统: Win9x/Win2000/WinXP/Win2003

技术特点：
　　1、传染条件
　　利用邮件高速传播。
　　2、发作条件
　　检查计算机日期，如果当前日期是在2004年3月25日之后，病毒将卸载自己并退出。

　　3、系统修改
　　A、拷贝病毒自身到%System%下为i1ru54n4.exe

　　B、创建如下文件:
　　%System%\go54o.exe
　　%System%\ii5nj4.exe
　　%System%\i1ru54n4.exeopen

　　C、将go54o.exe当做dll插入到explorer.exe的地址空间中，完成邮件发送功能。

　　D、添加如下注册表项：
　　HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
　　"rate.exe"="%System%\i1ru54n4.exe"

　　HKEY_CURRENT_USER\SOFTWARE\winword "frun"="1"

　　4、技术特征
　　A、搜索本地磁盘的如下后缀文件中的email地址，发送带毒邮件：
　　.adb ;.asp ;.cfg ;.dbx ;.eml ;.htm ;.mdx ;.mmf ;.nch ;.ods ;.php ;.pl ;
.sht ;.tbb ;.txt ;.wab ;.xml

　　B、病毒使用自己的邮件发送引擎发送邮件，发送邮件的格式如下：
　　可能为如下主题：
　　^_^ meay-meay! ; ^_^ mew-mew (-: ; Aline ;Anna ;Audra ;Bad girl ;
Barbi ;beautiful ;Caitie ;caroline ;ello! =)) ;Fotograf ;Gallery photos ;
groom ;Hey, ;ude, it's me ^_^ :P ;Hey, ya! =)) ;Hi! :-) ;Hokki =) ;Jammie ;
Juli ;Julie ;kate ;Katrina ; Kelley ; kleopatra ;Lisa ;Mandy ;Mary ;
Mary-Anne ;My beautiful person ;My Name is Frenk ;My photoalbum ;
My photos ;Myphotos ;Photoalbum ;rebecca ;Rena ;Sara ;stacy ;ammy ;
Wau... beautiful (-: ; Weah, hello! :-) ; Weeeeee! ;)));

　　正文为如下随机一条：
　　Body: (Chosen randomly from:)
　　Argh, i don't like the plaintext :)
　　Fell free to chat with me I accept all ages. Don''''t worry I don''''t
bite........hope to hear from you soon!
　　Hey people whats goin on? If there is anything you want to know about me
ask me... I am pretty easygoing I won't bite....not at first anywayz hahaa.....one thing I will say on here tho I am not into the Cyber thing
so don't even ask.....Ciao...
　　Hey, guys! by the way, I have no problems with my sexual life,
so it's absolutly useless try to have icq sex or things like that. Thanks
Hi! My name is Shreya and I am a goof off!!! So, If you love the outdoors,
travelling, books, music, movies, laffing, teasing and/or can poke fun at
yourself... please come a hollerin'!!
　　I am from Taiwan but I study in Camden, New Jersey now. I like to know
people from different places .
　　I enjoy clean conversations but am open to conversing with women and men
with little ones as well. I am very open-minded. All authorization requests
will be denied if I don't receive messages and get to know you first.
　　I like to be in a company of smart, delicate, and with a good sense of
humor people. I am Bulgarian, currently getting my Master's in International
Business in USA. Favorite actor: Michael Dudikoff
　　I love camping, dirt track racing, going for walks, and I have 2
cats - HotRod and Deebo (named from the movie 'Friday' and he lives up
to it!). Life is ever changing, never always easy...
　　I love meeting new people and making new friends. I am a Mary Kay Beauty
Consultant. I am married to a wonderful man. We have no children, exept for
a minature schnauzer that thinks he is a child. Looking forward to meeting
you. i love to chat to just about anyone!!
I love to dance, read poetry, make people laugh, and hug as many people a day
as i can.
　　I sit with elders of a gentle race, whose world is seldom seen.Who sit
and talk of days for which they wait, when all will be revealed. These are
song lyrics.
　　If I'm online, it problably means I'm pretty bored....so feel free to
message me and say hi or whatever else comes to mind at the moment.
If you are going to make me cry, at least be there to wipe away the tears
*Right now the worst thing for you to tell me that I can find someone
better than you, especially when you are all I want
　　I'm a social butterfly and a natural flirt. Very hard to get my complete
attention. Very open and will answer almost anything. But please don't piss
me off. I can be sweet and cuddly or a whatever mood I am in that day so everyday
　　I'm an open minded person and enjoy chatting w/ other people. I'm free
and willing to chat about anything. So feel free to Imed me if you wanna chat.
　　I'm married and I stay at home. And I don't do cyber sex so leave me
the fuck alone
　　i'm tall and skiny I'm studying in Pharm. D program in FL. i like music,
movie, dancing, sports, SCUBA diving, traveling and make a lot friends.
　　Looking forward for a response :P
　　Love the outdoors, literature, writing, and athletics
　　My hobbies include crochet, sewing, painting lead figures and playing
AD&D. 　　Favorite activities include fishing and camping. I love cats,
unicorns(go figure), and fantasy in general.
　　Nice friends, nice men, nice sex and feeling great. I don't mind the odd
bout of cybersex as I love to use my imagination when I masterbate.
　　Single Mom of 3, Full time college student, Graduate in December with
an Associates of Applied Science in Computer Information Systems Love the internet.
When The Trust is Gone So Is The Love That Fades Like the Rain Washing Away
All The Sorrows Of Yesterday Why I Ask Myself Must It End Like This Tomorrow,
I Tell Myself, I'll Be Okay For Now, I'll Just Live In The Memories Of Our
Life Together
　　You don't know what you've got till it's gone *You hurt me more than I
deserve, how can you be so cruel? I love you more than you deserve, how can
I be such a fool?

　　如果病毒选择了加密的ZIP压缩包做附件，正文中会包含如下字符串之一：
　　archive password: %s
　　password: %s
　　pass: %s
　　password for archive: %s

　　可能的附件名称为：
　　Aline ;Anna ;Audra ;Bad girl ;Barbi ;Caitie ;caroline ;Gallery ;It_I ;
Jammie ;Juli ;Julie ;kate ;Katrina ;Kelley ;kleopatra ;Lisa ;Mandy ;Mary ;
Mary-Anne ;myfotos ;Photoalbum ;hotomontage ;Picture ;rebecca ;Rena ;Sara ;
stacy ;Tammy

　　病毒不发送任何邮件到包含有如下字符串的邮件地址中去：
　　@avp.
　　@hotmail.com
　　@microsoft
　　@msn.com
　　local
　　noreply
　　postmaster@
　　root@

　　C、病毒会通过网络文件共享传播，病毒会复制自己到名字包含有"shar"的文件夹中去, 文件名为如下名称：
　　ACDSee 9.exe
　　Adobe Photoshop 9 full.exe
　　Ahead Nero 7.exe
　　Matrix 3 Revolution English Subtitles.exe
　　Microsoft Office 2003 Crack, Working!.exe
　　Microsoft Office XP working Crack, Keygen.exe
　　Microsoft Windows XP, WinXP Crack, working Keygen.exe
　　Opera 8 New!.exe
　　Porno pics arhive, xxx.exe
　　Porno Screensaver.scr
　　Porno, sex, oral, anal cool, awesome!!.exe
　　Serials.txt.exe
　　WinAmp 5 Pro Keygen Crack Update.exe
　　WinAmp 6 New!.exe
　　Windown Longhorn Beta Leak.exe
　　Windows Sourcecode update.doc.exe
　　XXX hardcore images.exe

　　5、发作现象:
　　病毒主程序使用“文件夹”文件的图标，如下图：
　　 　　

解决方案:
　　A、金山毒霸已经于3月1日对该病毒进行了应急处理，请升级最新版可完全查该病毒；

　　B、请一定留意收到的邮件，如果有附件，请不要打开附件，更不要执行附件中的可执行程序，注意病毒程序伪装的图标，不要轻信图标为“电子表格、文本文件、文件夹”的附件。

　　C、该病毒不易手工清楚，会造成清楚不干净的现象，请升级毒霸到2004年3月1日的病毒库可处理该病毒。如没有安装金山毒霸，可以登录http://online.kingsoft.net使用金山毒霸的在线查毒或是金山毒霸下载版来防止该病毒的入侵；或可以选择登录到http://www.duba.net下载“恶鹰”专杀工具，以防止该病毒的肆虐。金山公司的为广大用户提供反病毒咨询，求助热线为：010-82326868。