happy2008 virus specifically kill happy2008 virus _ virus

File name: Happy2008-card.com\svchost.exe

File size: 26014 byte

Name of AV: (rising) backdoor.win32.pbot.b

Adding shell mode: Unknown

Writing language: VC

File md5:66951f5a5c5211d60b811c018a849f96

Virus type: IRCBot

Behavioral Analysis:

1. Release virus copy:

C:\WINDOWS\Happy2008.zip 26148 bytes (virus compression package)

C:\WINDOWS\svchost.exe 26014 bytes

2, add the registry, boot:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


(registry value) Windows svchost = "Svchost.exe"

3, connect IRC server (random named ID connection):

Irc.p***.com

www.unkn***.eu

id@unkn***.eu

Join the following channels:

#happy2008

#spam. MSN

#bot. Killer

4, look for the process containing the "MSNMSGR" string, which may be used to determine whether MSN is in the running state.

If MSN is found, the message + ZIP sent command is executed.

"Message" may be one of the following:

Check Theese out, Christmas + New year!
Hey, have u seen these Christmas images?
You gotta to this, me in my noughty Santa suit!! :P
New year + Christmas pictures! :D
Happy New Year xd! :D
Heeey:) <3 Check out Theese New year photos!

"Zip sent" is definitely happy2008.zip.

Workaround:

1. Disconnect the network and close the unwanted process.

2, open the registry (start-run-regedit), expand to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Deletes the "Windows svchost" key value.

(can also be deleted by Sreng (can be downloaded to down.45it.com))

3, restart the computer, restart after the removal of hard disk files (such as when prompted not to delete files, to down.45it.com download the Trojan forced Delete tool to force Delete):

C:\WINDOWS\Happy2008.zip 26148 bytes (virus compression package)

C:\WINDOWS\svchost.exe 26014 bytes