Win32.TrojDownloader.Baser.W.37888

新客网 XKER.COM 2007-10-30 收藏本文

病毒行为:
该病毒是木马下载者.当病毒运行时会通过网络下载其他的木马文件至本机并执行.另外,病毒运行后还会衍生病毒文件至本机，创建服务，和在每个盘的根目录下.
1.生成文件:
%sys32dir%\servver.exe
另外病毒会在每个盘的根目录下创建隐藏文件AutoRun.inf文件和servver.exe文件.以达到双击打开盘符时运行病毒.
2.修改注册表，生成服务项.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
Type = dword:00000110
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
Start = dword:00000002
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
ErrorControl = dword:00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
ImagePath = hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,73,65,72,76,76,65,72,2e,65,78,65,00,
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
DisplayName = "Telephots google"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
ObjectName = "LocalSystem"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
Description = "为即插即用设备提供支持"
3.病毒运行后会创建进程servver.exe,等待网络可用时从指定网站下载其他木马病毒至本机并运行.
4.病毒会从网络上下载以下木马文件至本机并运行:
http://ads.ga*****.com/100.exe
http://ads.ga*****.com/101.exe
http://ads.ga*****.com/102.exe
http://ads.ga*****.com/103.exe
http://ads.ga*****.com/104.exe
http://ads.ga*****.com/105.exe
http://ads.ga*****.com/106.exe
http://ads.ga*****.com/107.exe
http://ads.ga*****.com/108.exe
http://ads.ga*****.com/109.exe
http://ads.ga*****.com/110.exe
http://ads.ga*****.com/112.exe
http://ads.ga*****.com/113.exe
http://ads.ga*****.com/114.exe
http://ads.ga*****.com/115.exe
http://ads.ga*****.com/116.exe
http://ads.ga*****.com/117.exe
http://ads.ga*****.com/118.exe
http://ads.ga*****.com/119.exe

• ·Win32.PSWTroj.OnLineGames.
• ·Win32.Troj.MhXiYou.hl.135168
• ·Worm.Win32.Dolod.a
• ·Backdoor.Win32.Agent.evx
• ·VirTool/Paszczus
• ·Email-Worm.Win32.Klez.dc
• ·网游窃贼变种imw
• ·Win32.PSWTroj.OnLineGames.YA.57344