TrojanDownloader.Tooncom.h

TrojanDownloader.Tooncom.h是一个由Loader.exe和iedll.exe两个文件组成的木马。当iedll.exe 文件运行时，会搜索一些文件并将之删除，文件为C:WindowsSystem32DriversEtcHosts

C:WindowsHosts

C:WinntSystem32DriversEtcHosts

C:WinntHosts

D:WindowsSystem32DriversEtcHosts

D:WindowsHosts

D:WinntSystem32DriversEtcHosts

D:WinntHosts；删除后用66.40.16.131 livesexlist.com

66.40.16.131 lanasbigboobs.com

66.40.16.131 thumbnailpost.com

66.40.16.131 adult-series.com

66.40.16.131 www.livesexlist.com

66.40.16.131 www.lanasbigboobs.com

66.40.16.131 www.thumbnailpost.com

66.40.16.131 www.adult-series.com代替，导致用户在访问这些网站时被重定向至66.40.16.131；此外还尝试从tooncomics.com下载并执行文件Loader.exe。

当Loader.exe 文件被执行后，病毒会在注册表HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorer下添加"loader2"="1" "loaderGUID"="CLSID"键值，且修改注册表HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainSearch Page

HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainSearch Bar

HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainStart Page

HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerSearchURL

HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerSearchSearchAssistant下的数值，将IE首页更改为http:/ /thesten.com/main/sp.html；最后尝试从thesten.com下载并执行iedll.exe文件。并在用户喜欢的文件夹下添加

Series Hardcore Pics Sets and Movies.url

New Porn Pics everyday.url

Fully categories porn database. Enjoy.url信息。