والملفات المرفقة لهذا الفيروس عادة تكون بهذه المسميات والامتدادات
The_Best.scr
Codeproject.scr
SQL_4_Free.scr
I_Love_You.scr
Stone.scr
Sex.scrSoccer.scr
Real.scr
Plus6.scr
Plus2.scr
Playboy.scr
Hardcore4Free.scr
xxx4Free.scr
Screensavers.scr
Peace.scr
Body_Building.scr
Services.scr
VXer_The_LoveStory.scr
Hacker_The_LoveStory.scr
World_Tour.scr
up_life.scr
Sweetheart.scr
Sexy_Jenna.scr
Jenna_Jemson.scr
zDenka.scr
Ravs.scr
Free_Love_Screensavers.scr
Romeo_Juliet.scr
Hacker.scr
KOF_Fighting.exe
KOF_Sample.exe
KOF_Demo.exe
KOF_The_Game.exe
KOF2002.exe
King_of_Figthers.exe
KOF.exe
My_Sexy_Pic.scr
MyProfile.scr
Ways_To_Earn_Money.exe
Beautifull.scr
Valentines_Day.scr
zXXX_BROWSER.exe
Britney_Sample.scr
THEROCK.scr
FreakOut.exe
MyPic.scr
Notes.exe
Cupid.scr
FixElkern.com
FixKlez.com
Romantic.scr
Project.exe
Love.scr
friendship_funny.scr
Colour_of_life.scr
Life.scr
Best_friend.scr
Friend_happy.scr
True_love.scr
Gc_messenger_exe
Dance.scr
I_like_you.scr
Friend_finder_exe
Be_happy.scr
Sweet.scr
Shake.scr
World_of_friendship.scr
Friendship.scr
Funny.scr
Hotmail_hack_exe.scr
وعادة يكون اسم المرسل بهذه المسميات
Klein Anderson
Codeproject
SQL Library
me2K
Rocking Stone
Super Soccer
Sexy Screensavers
Real Inc.
Plus 6
Plus 2
Playboy Inc.
Hardcore Screensavers
XXX Screensavers
Nomadic Screensavers
Keanu Stevenson
Nicolas Schwarzeneggar
admin@hackersclub.com
admin@viruswriters.com
admin@hackers.com
Paul Owen
Benting
Veronica Anderson
Club Jenna
Jenna Jameson
Zdenka Podkapova
Raveena Pusanova
Screensavers of Love
Romeo & Juliet
Jaucques Antonio Barkinstein
Cathy Kindergarten
KOF Online
Omega Rugal
Terry Bogard
Iori Yagami
Kyo Kusanagi
Clark Steel
Ralph Jones
Jasmine Stevens
Ross Anderson
John Vandervochich
American Beauty
Valentine Screensavers
Lovers Screensavers
zporNstarS
britneyspears.org
The Rock
Noopman
Susan
Jonathan
Cupid
McAfee Inc.
Norton Antivirus
Trend Micro
Romantic Screensavers
Jericho
Love Inc.
and
info@flashyat.com
kl@aminoprojects.com
admin@codeproject.com
free@sql.library.com
me@me2K.com
stone@esterplaza.com
marketing@suppersoccer.com
free@sexyscreensavers.com
sales@real.com
plus@real.com
sales@playboy.com
free@hardcorescreensavers.com
free@xxxscreensavers.com
kkn@k2k.comscreensavers@nomadic.com
nics@nomadic.com
paul@kqscore.com
btq@263.com
services@tcsonline.com
admin@clubjenna.com
jenna@jennajameson.com
zdenka@zpornstars.com
ravs@go2pussy.com
love@lovescreensavers.com
DNA_seraph@163.com
super@21cn.com
cathy@21cn.com
admin@kofonline.com
zhouyuye@citiz.net
lubing@7135.com
hamada@seikosangyo.com
luoairong@21cn.com
valentinescreensavers@t2k.com
screensavers@lovers.com
admin@zpornstars.com
newsletters@britneyspears.org
therock@wwe.com
ericpan@online.com.pk
samsun@online.sh.cn
yjworks@online.sh.cn
cupid@freescreensavers.com
av_patch@mcafee.com
av_patch@norton.com
av_patch@trendmicro.com
romanticscreensavers@love.com
caijob@online.sh.cn
loverscreensavers@love.com
اذا كان تاريخ جهازك هوه 25 مارس او 22 مايو راح تظهر لك رسالة تقول
Happy Birthday Dear
واذا كان يوم الجهاز هو الخميس راح يقوم الفيروس بعمل الاتي
اولا يقوم بعمل عشوائي لوضع الصفحة الرئيسية للمتصفح وذلك بالتحكم في الرجستري
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
to one of these:
على احد هذه العناوين
http:/ /www.unixhideout.com
http:/ /www.hirosh.tk
http:/ /www.neworder.box.sk
http:/ /www.blacksun.box.sk
http:/ /www.coderz.net
http:/ /www.hackers.com/html/neohaven.html
http:/ /www.ankitfadia.com
http:/ /www.hrvg.tk
http:/ /www.hackersclub.up.to
http:/ /geocities.com/snak33y3s
استعادة محتويات المستندات الخاصة بالمستخدم
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Shell Folders
عمل ملف تكست على سطح المكتب وبحالة مخفية وارشيف ويحتوي الملف على الاتي
================================================== ==========
r0xx pReSaNt$ W32.@YerH$.B (all r1ght$ re$erv3d..
)
w3 aRe tHe gRe@t 1nD1aN$..
------------------------------------------------------
m@iN mIssIoN iS t0 sPreAd tHe nAmE @YerH$
s00 mUch t0 c0me..
iNclUdEd DDoS c0mp0neNtS c@usE oF sHiT p@kI l@meRs
eXp3ct th3 uNeXp3ctEd
dEdic@t3d t0 : mY b3$t fRi3nD
================================================== ==========
>>
qph@hackermail.com
or
==================================================
W32.@YerH$.B,Made in India,
wE aRe thE greAt iNdIaNs..
----------------------------
aBouT mE :
jUst a c0mputEr gEEk..
i tHinK i aM sTill a ****** kiddiE..
eDucAtiOn : sCh00l sTudEnt..
aBouT @YerH$.B:
n0 dEstrucTivE paYload$ f0r inFecTeD c0mpUteRs.
teRminAtioN oF aV + FireWaLL f0r sUrvIvaL.
tImE dEfiNed tRigErRinG.. jUst f0r fUn.. n0 paYloaD.
c0ntAinS bUg iN rEpliCation c0de.. no tIme t0 fiX.
g0nNa fiX iT iN nExt rElEase..
n0 m0rE $hiT
================================================== =
>>
qph@hackermail.com
or
==================================================
W32.@YerH$.B,Made in India,
wE aRe thE greAt iNdIaNs..
----------------------------
spEciAl 10x to c0bra..
f0r inSpirAtIon + c0dIng hElp..
==================================================
>>
qph@hackermail.com
or
================================================== ====
W32.@YerH$.B,Made in India
wE aRe thE greAt iNdIaNs..
----------------------------
wAnT peAce aNd pr0speRity in InDiA ?..
f**k tHe c0rruptEd p0litiCian$..no shit$ nEEdeD..
mErA bhAraT mAhaN ??.. n0t yeT..wE nEEd t0 mAkE iT..
talenT & hArd w0rK shOulD be rEspEctEd..
sElf stYleD a**H***$ mUsT bE eLimInatEd....
n0 m0re $hiT m0n0p0lY..
================================================== ====
>>
qph@hackermail.com
or
=================================================
W32.@YerH$.B,Made in India.
wE aRe thE greAt iNdiAnS.
----------------------------
iNdiAn hAckeRs + vXerS teAm up...
aNd kicK lamEr a**
no m0re pAk shIT..
itZ oUr tiMe to shOw tHem, the p0wer of teaM w0rk.
f**k AIC,GFORCE,SILVERLORDS,WFD..f*****g k1dd1es..
no sHit bUsineSS iN heRe aNd
nO lamE stuFF..
=================================================
>>
qph@hackermail.com
يتتتتتتبع
