文件名稱：msmgslive.exe
文件大小：71680 byte
AV命名：Backdoor.Win32.IRCBot.azo(AVP)
加殼方式：EXECryptor
文件MD5：04fd8beae32250498a2340a65e5cc8bf
病毒類型：IRCbot
行爲分析：
1、釋放病毒副本：
C:\Documents and Settings\User\Local Settings\Temp\newfacebook.com.zip（病毒壓縮包）
C:\WINDOWS\system32\msmgslive.exe 71680 字節
2、添加RUN項：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
(註冊表值) Windows Live Messenger Servicer = "msmgslive.exe"
3、登入歐洲IRC服務器（server9.cor**.net），加入pool頻道。
以感染該病毒的計算機系統版本爲用戶名，密碼爲gsaxx00連接。
允許對下列命令做出響應：
PART
JOIN
QUIT
KICK
PONG
PING
PRIVMSG
JOIN
QUIT
KICK
PONG
PING
PRIVMSG
............
4、查找MSBLWindowClass類名？可能是用來判斷MSN是否在運行狀態。
假設存在，則向MSN好友發送病毒壓縮包和下面的一條文字：
look at what happaned to my room after New Years! How long do you think it is going to take to clean this up? Damn I really shouldn't have gotten this drunk. No way this is really your picture... or is it?! How do you think my new look is, Good? Bad? Ugly? I think this was the best New Years Crew ever! here, this is the new computer I wanna get. Nice huh? Could this really be real? I vaguely remember seeing this person, then woke up next to them... Oh my! Wow this was a CRAZY night. I don't even remember it! here, this picure is PERFECT for your desktop wallpaper. Can I show my friends this picture of you??? hey, look at this picture from ebay. Its a necklace I want so badly. Can you tag me in this picture on Facebook? Is it bad if I only remember the sex, and nothing else? Oh my this isn't you right?? this is my dream house. look at the pool. Damn! ok, ok here. but please dont send it to noone. I dont like the way i look in that one. This picture isn't too sexy for Facebook right?!? It alright if I use this picture of you in my profile? Could I throw this picture of you in my album? Could I have really had sex with them? hey i found your picture on hotornot.com! I swear its you! OMG, i found ur pic on cuteornot.com! im not kidding either!!! Is this really a pic of you? We had sex, but it never went any further... What did I do wrong? you don't think I had sex with them... right? It's too bad you missed out on this party! omg I look so dumb in this pic its funny.. dont show anyone. EVER Would you have had a threesome with them? Do you care if I up this picture of us to my profile? Can I add this picture of you to my new album? I think I found your picture on adultfriendfinder!!! Does this look good enough for my default picture? Look at this crazyness! Two people are making out on the table! sry about the messup i fixed the pic! Try it one more time plz This picture isn't too sexy for Facebook right?!? Damn I could barely walk when someone took this pic! HAHA! this is funnny! here, read this guys shirt. hey did i ever show you this picture of me? Picture editing sure is a lot of work! Look what I made. Can I upload this picture of you to my profile? I just found the strangest picture of you on Facebook! You get any action on New Years? I sure did! ;) Don't let your parents see this pic!! This picture of you looks realllly freaky! damn New Years was crazy, I think I had sex with this person! Does my new style look hot? do you think I look ugly in this pic? its one of my new ones too :( Is it bad if I had sex with someone, and all I have is their picture? Someone took this picture right before I passed out... Is it bad if I had a threesome with them? My hair looks like a bomb went off. Don't you think? OMG look at this!!! do you think this picture is too kinky for Myspace? tell me honestly. Just got a new webcam, the picture I took looks great! this picture of me looks hilarious! Dont show anyone pleaze! look at this picture from hotornot.com , I would NOT describe any of them as HOT. lol You wouldn't care if I uploaded this picture of us, right? dang, this person really looks like you! This is my dream car right here! I can't believe I gave it up soo easy on New Years. Atleast they were hot. Can I add this picture of you to my new album? Oh my lord, I think we trashed the place!
5、可能通過IRC命令下載其他***，不過測試時未實現。
6、調用CMD和添加註冊表PendingFileRenameOperations刪除自身。
解決方法：
1、關閉MSN和其他聊天工具（如果有）並斷開網絡連接，下載：
[url]http://www.kingzoo.com/tools/[/url]孤獨更可靠/sreng2.5.zip
（複製網址的完整路徑）
下載不了的去：
[url]http://gudugengkekao.ys168.com[/url]或[url]http://gudugengkekao1.ys168.com[/url]
2、打開SREng，刪除註冊表啓動：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
(註冊表值) Windows Live Messenger Servicer = "msmgslive.exe"
此主題相關圖片如下：
3、重啓計算機，然後清空系統臨時文件，並刪除（要先顯示隱藏文件）：
C:\WINDOWS\system32\msmgslive.exe 71680 字節
AD：上述方法無法清除或有其他變種，麻煩把病毒壓縮包發到：