概述编辑本段回目录
病毒行为:编辑本段回目录
这是一个木马下载器，用于下载并执行木马。它是通过读取两个网页配置文件去下载并运行木马的。比一般的木马下载器更加灵活，危害也更大。通过设置4个时钟，它会每隔一定时间做以下操作：定时修改启动项，是自己能够开机运行，并且到指定网址取得配置文件用来下载新的病毒；定时终止某些进程，可以是反病毒软件防火墙；定时修改host文件，使得很多反病毒软件不能正常升级；定时修改用户的主页指向某个网页，使得用户打开浏览器时首先访问病毒设置的网页，从而感染病毒。
1.创建互斥体kakogo_cherta_tebe_zdes_nado，防止运行病毒的多个实例。
2.将自身复制到%System%Softwaresoftware.exe，修改文件%System%driversetchosts，在该文件后面追加一下内容：
127.0.0.1 www.iframedollars.biz
127.0.0.1 iframedollars.biz
127.0.0.1 www.allforadult.com
127.0.0.1 allforadult.com
127.0.0.1 www.vesbiz.biz
127.0.0.1 vesbiz.biz
127.0.0.1 www.aaasexypics.com
127.0.0.1 aaasexypics.com
127.0.0.1 www.virgin-tgp.net
127.0.0.1 virgin-tgp.net
127.0.0.1 www.5sec.biz
127.0.0.1 5sec.biz
127.0.0.1 www.avp.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 www.symantec.com
127.0.0.1 networkassociates.com
127.0.0.1 secure.nai.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 downloads-us1.kaspersky-labs.com
127.0.0.1 downloads-eu1.kaspersky-labs.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.networkassociates.com
127.0.0.1 us.mcafee.com
127.0.0.1 f-secure.com
127.0.0.1 avp.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.f-secure.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 update.symantec.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 viruslist.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 updates.symantec.com
127.0.0.1 kaspersky.com
127.0.0.1 www.trendmicro.com
127.0.0.1 conyc.com
下载网页文件到：%system%ysb.exe
创建目录%SystemRoot%test
2.修改注册表：
添加表项：
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
"Software"="%System%Softwaresoftware.exe"
HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerMain
"Start Page"="<变化的值>"
"FlagStop"=dword:1
或者
"FlagInstall"=dword:1
修改表项：
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones2
"1001"=dword:47
"Flags"=dword:0
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones2
"1001"=dword:47
"Flags"=dword:0
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones3
"1001"=dword:0
"Flags"=dword:1
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones3
"1001"=dword:0
"Flags"=dword:1
HKEY_USERS.DefaultSoftwareMicrosoftWindowsCurrentVersionInternet Settings
"Trust Warning Level"="No Security"
"Safety Warning Level"="SucceedSilent"
"CodeDownload"="Yes"
"Security_RunActiveXControls"
"Security_RunScripts"
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings
"Trust Warning Level"="No Security"
"Safety Warning Level"="SucceedSilent"
"CodeDownload"="Yes"
"Security_RunActiveXControls"
"Security_RunScripts"
HKEY_USERS.DefaultSoftwareMicrosoftInternet ExplorerSecurity
"Trust Warning Level"="No Security"
"Safety Warning Level"="SucceedSilent"
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZoneMapProtocolDefaults
"http"
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZoneMapDomains
"Trusted"
"CurrentLevel"
"RecommendedLevel"
"MinLevel"
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInternet SettingsZoneMapDomains
"Trusted"
"CurrentLevel"
"RecommendedLevel"
"MinLevel"
3.通过设置4个时钟，它会每隔一定时间做以下操作：定时修改启动项，是自己能够开机运行，并且到指定网址取得配置文件用来下载新的病毒；定时终止某些进程，可以是反病毒软件防火墙；定时修改host文件，使得很多反病毒软件不能正常升级；定时修改用户的主页指向某个网页，使得用户打开浏览器时首先访问病毒设置的网页，从而感染病毒。
终止的进程：
ir.exe
intron.exe
printer32.exe
ykyrtws.exe
loadclean.exe
telnet.exe
lpt.exe
systime.exe
toolbar.exe
mstasks1.exe
mstasks2.exe
mstasks3.exe
loadadv.exe
1.创建互斥体kakogo_cherta_tebe_zdes_nado，防止运行病毒的多个实例。
2.将自身复制到%System%Softwaresoftware.exe，修改文件%System%driversetchosts，在该文件后面追加一下内容：
127.0.0.1 www.iframedollars.biz
127.0.0.1 iframedollars.biz
127.0.0.1 www.allforadult.com
127.0.0.1 allforadult.com
127.0.0.1 www.vesbiz.biz
127.0.0.1 vesbiz.biz
127.0.0.1 www.aaasexypics.com
127.0.0.1 aaasexypics.com
127.0.0.1 www.virgin-tgp.net
127.0.0.1 virgin-tgp.net
127.0.0.1 www.5sec.biz
127.0.0.1 5sec.biz
127.0.0.1 www.avp.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 www.symantec.com
127.0.0.1 networkassociates.com
127.0.0.1 secure.nai.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 downloads-us1.kaspersky-labs.com
127.0.0.1 downloads-eu1.kaspersky-labs.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.networkassociates.com
127.0.0.1 us.mcafee.com
127.0.0.1 f-secure.com
127.0.0.1 avp.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.f-secure.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 update.symantec.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 viruslist.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 updates.symantec.com
127.0.0.1 kaspersky.com
127.0.0.1 www.trendmicro.com
127.0.0.1 conyc.com
下载网页文件到：%system%ysb.exe
创建目录%SystemRoot%test
2.修改注册表：
添加表项：
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
"Software"="%System%Softwaresoftware.exe"
HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerMain
"Start Page"="<变化的值>"
"FlagStop"=dword:1
或者
"FlagInstall"=dword:1
修改表项：
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones2
"1001"=dword:47
"Flags"=dword:0
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones2
"1001"=dword:47
"Flags"=dword:0
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones3
"1001"=dword:0
"Flags"=dword:1
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones3
"1001"=dword:0
"Flags"=dword:1
HKEY_USERS.DefaultSoftwareMicrosoftWindowsCurrentVersionInternet Settings
"Trust Warning Level"="No Security"
"Safety Warning Level"="SucceedSilent"
"CodeDownload"="Yes"
"Security_RunActiveXControls"
"Security_RunScripts"
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings
"Trust Warning Level"="No Security"
"Safety Warning Level"="SucceedSilent"
"CodeDownload"="Yes"
"Security_RunActiveXControls"
"Security_RunScripts"
HKEY_USERS.DefaultSoftwareMicrosoftInternet ExplorerSecurity
"Trust Warning Level"="No Security"
"Safety Warning Level"="SucceedSilent"
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZoneMapProtocolDefaults
"http"
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZoneMapDomains
"Trusted"
"CurrentLevel"
"RecommendedLevel"
"MinLevel"
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInternet SettingsZoneMapDomains
"Trusted"
"CurrentLevel"
"RecommendedLevel"
"MinLevel"
3.通过设置4个时钟，它会每隔一定时间做以下操作：定时修改启动项，是自己能够开机运行，并且到指定网址取得配置文件用来下载新的病毒；定时终止某些进程，可以是反病毒软件防火墙；定时修改host文件，使得很多反病毒软件不能正常升级；定时修改用户的主页指向某个网页，使得用户打开浏览器时首先访问病毒设置的网页，从而感染病毒。
终止的进程：
ir.exe
intron.exe
printer32.exe
ykyrtws.exe
loadclean.exe
telnet.exe
lpt.exe
systime.exe
toolbar.exe
mstasks1.exe
mstasks2.exe
mstasks3.exe
loadadv.exe
