newfacebook.com.zip（勿加“荐”）
文件名称：msmgslive.exe
文件大小：71680 byte
AV命名：Backdoor.Win32.IRCBot.azo(AVP)
加壳方式：EXECryptor
文件MD5：04fd8beae32250498a2340a65e5cc8bf
病毒类型：IRCbot
行为分析：
1、释放病毒副本：
C:\Documents and Settings\User\Local Settings\Temp\newfacebook.com.zip（病毒压缩包）
C:\WINDOWS\system32\msmgslive.exe 71680 字节
2、添加RUN项：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
(注册表值) Windows Live Messenger Servicer = "msmgslive.exe"
3、登入欧洲IRC服务器（server9.cor**.net），加入pool频道。
以感染该病毒的计算机系统版本为用户名，密码为gsaxx00连接。
允许对下列命令做出响应：
PART
JOIN
QUIT
KICK
PONG
PING
PRIVMSG
JOIN
QUIT
KICK
PONG
PING
PRIVMSG
............
4、查找MSBLWindowClass类名？可能是用来判断MSN是否在运行状态。
假设存在，则向MSN好友发送病毒压缩包和下面的一条文字：
look at what happaned to my room after New Years! How long do you think it is going to take to clean this up? Damn I really shouldn't have gotten this drunk. No way this is really your picture... or is it?! How do you think my new look is, Good? Bad? Ugly? I think this was the best New Years Crew ever! here, this is the new computer I wanna get. Nice huh? Could this really be real? I vaguely remember seeing this person, then woke up next to them... Oh my! Wow this was a CRAZY night. I don't even remember it! here, this picure is PERFECT for your desktop wallpaper. Can I show my friends this picture of you??? hey, look at this picture from ebay. Its a necklace I want so badly. Can you tag me in this picture on Facebook? Is it bad if I only remember the sex, and nothing else? Oh my this isn't you right?? this is my dream house. look at the pool. Damn! ok, ok here. but please dont send it to noone. I dont like the way i look in that one. This picture isn't too sexy for Facebook right?!? It alright if I use this picture of you in my profile? Could I throw this picture of you in my album? Could I have really had sex with them? hey i found your picture on hotornot.com! I swear its you! OMG, i found ur pic on cuteornot.com! im not kidding either!!! Is this really a pic of you? We had sex, but it never went any further... What did I do wrong? you don't think I had sex with them... right? It's too bad you missed out on this party! omg I look so dumb in this pic its funny.. dont show anyone. EVER Would you have had a threesome with them? Do you care if I up this picture of us to my profile? Can I add this picture of you to my new album? I think I found your picture on adultfriendfinder!!! Does this look good enough for my default picture? Look at this crazyness! Two people are making out on the table! sry about the messup i fixed the pic! Try it one more time plz This picture isn't too sexy for Facebook right?!? Damn I could barely walk when someone took this pic! HAHA! this is funnny! here, read this guys shirt. hey did i ever show you this picture of me? Picture editing sure is a lot of work! Look what I made. Can I upload this picture of you to my profile? I just found the strangest picture of you on Facebook! You get any action on New Years? I sure did! ;) Don't let your parents see this pic!! This picture of you looks realllly freaky! damn New Years was crazy, I think I had sex with this person! Does my new style look hot? do you think I look ugly in this pic? its one of my new ones too :( Is it bad if I had sex with someone, and all I have is their picture? Someone took this picture right before I passed out... Is it bad if I had a threesome with them? My hair looks like a bomb went off. Don't you think? OMG look at this!!! do you think this picture is too kinky for Myspace? tell me honestly. Just got a new webcam, the picture I took looks great! this picture of me looks hilarious! Dont show anyone pleaze! look at this picture from hotornot.com , I would NOT describe any of them as HOT. lol You wouldn't care if I uploaded this picture of us, right? dang, this person really looks like you! This is my dream car right here! I can't believe I gave it up soo easy on New Years. Atleast they were hot. Can I add this picture of you to my new album? Oh my lord, I think we trashed the place!
5、可能通过IRC命令下载其他木马，不过测试时未实现。
6、调用CMD和添加注册表PendingFileRenameOperations删除自身。
解决方法：
1、关闭MSN和其他聊天工具（如果有）并断开网络连接，下载：
[url]http://www.kingzoo.com/tools/[/url]孤独更可靠/sreng2.5.zip
（复制网址的完整路径）
下载不了的去：
[url]http://gudugengkekao.ys168.com[/url]或[url]http://gudugengkekao1.ys168.com[/url]
2、打开SREng，删除注册表启动：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
(注册表值) Windows Live Messenger Servicer = "msmgslive.exe"
此主题相关图片如下：
3、重启计算机，然后清空系统临时文件，并删除（要先显示隐藏文件）：
C:\WINDOWS\system32\msmgslive.exe 71680 字节
AD：上述方法无法清除或有其他变种，麻烦把病毒压缩包发到：