Win32.TrojDownloader.Baser.W.37888

病毒行为:

该病毒是木马下载者.当病毒运行时会通过网络下载其他的木马文件至本机并执行.另外,病毒运行后还会衍生病毒文件至本机，创建服务，和在每个盘的根目录下.

1.生成文件:

%sys32dir%servver.exe

另外病毒会在每个盘的根目录下创建隐藏文件AutoRun.inf文件和servver.exe文件.以达到双击打开盘符时运行病毒.

2.修改注册表，生成服务项.

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindowsms

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindowsms

Type = dword:00000110

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindowsms

Start = dword:00000002

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindowsms

ErrorControl = dword:00000000

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindowsms

ImagePath = hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,73,65,72,76,76,65,72,2e,65,78,65,00,

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindowsms

DisplayName = "Telephots google"

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindowsms

ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindowsms

Description = "为即插即用设备提供支持"

3.病毒运行后会创建进程servver.exe,等待网络可用时从指定网站下载其他木马病毒至本机并运行.

4.病毒会从网络上下载以下木马文件至本机并运行:

http://ads.ga*****.com/100.exe

http://ads.ga*****.com/101.exe

http://ads.ga*****.com/102.exe

http://ads.ga*****.com/103.exe

http://ads.ga*****.com/104.exe

http://ads.ga*****.com/105.exe

http://ads.ga*****.com/106.exe

http://ads.ga*****.com/107.exe

http://ads.ga*****.com/108.exe

http://ads.ga*****.com/109.exe

http://ads.ga*****.com/110.exe

http://ads.ga*****.com/112.exe

http://ads.ga*****.com/113.exe

http://ads.ga*****.com/114.exe

http://ads.ga*****.com/115.exe

http://ads.ga*****.com/116.exe

http://ads.ga*****.com/117.exe

http://ads.ga*****.com/118.exe

http://ads.ga*****.com/119.exe

• ·Email-Worm.Win32.Klez.d
• ·Backdoor.Win32.Agent.ev
• ·蒋璐霞
• ·Win32.Troj.MhXiYou.hl.1
• ·不耐
• ·定窑人首鱼龙壶
• ·耐穿
• ·Win32.PSWTroj.OnLineGam
• ·耐旱
• ·耐寒