病毒名称(中文):
病毒别名:
威胁级别:
★☆☆☆☆
病毒类型:
木马程序
病毒长度:
9042
影响系统:
Win9xWinMeWinNTWin2000WinXPWin2003
病毒行为:
这是一个通过电子邮件传播的蠕虫病毒，该病毒会以邮件附件的形式发送到用户机器上，诱使用户运行该病毒。一旦运行，病毒会释放病毒文件anti_troj.exe到系统目录，同时把自身添加到注册表的自启动项。anti_troj.exe是一个常驻内存的病毒文件，它首先从特定网页上下载病毒文件winlog.exe和winlog.dll，并运行。winlog.exe能关闭大量安全软件和常用程序，修改host文件，导致用户无法访问特定网站，该用户带来很大影响。
1，生成下列病毒文件：
%system%\anti_troj.exe
2，从下列地址下载病毒文件：
http://www.*150m.com/b..php
http://www.*encansbelec.com/b..php
http://www.**bakelit.hu/b..php
http://www.**nuclear.com.pl/b..php
http://www.*batlground.com/b..php
http://www.*bbrealservis.sk/b..php
http://www.*befag.ru/b..php
http://www.*benininfo.com/b..php
http://www.*bennylife.com/b..php
http://www.*bestcheapdomainregistration.info/b..php
http://www.*bidsforbaby.com/b..php
http://www.*binhaigolf.com/b..php
http://www.*biotenk.com/b..php
http://www.*bitsolution.ro/b..php
http://www.*nmtltd.com/b..php
http://www.*vnettools.com/b..php
http://www.*boldrussell.com/b..php
http://www.*bronko-m.ru/b..php
http://www.*bulkemailservicenow.com/b..php
http://www.*bulkemaildirectmarketing.com/b..php
http://www.*calidad.biz/b..php
http://www.*cansew.ca/b..php
http://www.*cansultdubai.ae/b..php
http://www.*casaquecanta.com/b..php
http://www.*chilotitomarino.cl/b..php
http://www.*chinaculturedpearl.com/b..php
http://www.*casino-malibu.ru/b..php
http://www.*colin18.com/b..php
http://www.*khonkaenpoc.com/b..php
http://www.*connectesl.com/b..php
http://abtechsafety.com/b..php
http://acentrum.pl/b..php
http://www.*adamant-np.ru/b..php
http://80.146.233.41/b..php
http://www.*leap.co.il/b..php
http://virt33.kei.pl/b..php
http://209.126.128.203/b..php
http://65.108.195.73/b..php
http://www.*ubu.pl/b..php
http://kepter.kz/b..php
http://ahava.cafe24.com/b..php
http://mijusungdo.net/b..php
http://aibsnlea.org/b..php
http://aikidan.com/b..php
http://202.44.52.38/b..php
http://drinkwater.ru/b..php
http://ala-bg.net/b..php
http://allinfo.com.au/b..php
http://eleceltek.com/b..php
http://alevibirligi.ch/b..php
http://alfaclassic.sk/b..php
http://allanconi.it/b..php
http://www.*americarising.com/b..php
http://americasenergyco.com/b..php
http://amerykaameryka.com/b..php
http://amistra.com/b..php
http://analisisyconsultoria.com/b..php
http://calamarco.com/b..php
3，关闭下列安全软件和常用程序：
ATUPDATER.EXE
ATUPDATER.EXE
AUPDATE.EXE
AUTODOWN.EXE
AUTOTRACE.EXE
AUTOUPDATE.EXE
AVLTMAIN.EXE
AVPUPD.EXE
AVWUPD32.EXE
AVXQUAR.EXE
CFIAUDIT.EXE
DRWEBUPW.EXE
ICSSUPPNT.EXE
ICSUPP95.EXE
LUALL.EXE
MCUPDATE.EXE
NUPGRADE.EXE
NUPGRADE.EXE
OUTPOST.EXE
UPDATE.EXE
等等
4，修改host文件：
"ad.doubleclick.net"
"upgrade.bitdefender.com"
"report.bitdefender.com"
"ad.fastclick.net"
"ads.fastclick.net"
"ar.atwola.com"
"atdmt.com"
"avp.ch"
"banner.fastclick.net"
"banners.fastclick.net"
"www.ca.com"
"click.atdmt.com"
"clicks.atdmt.com"
"customer.symantec.com"
"dispatch.mcafee.com"
"downloads-eu1.kaspersky-labs.com"
"downloads-us1.kaspersky-labs.com"
"downloads-us2.kaspersky-labs.com"
"downloads-us3.kaspersky-labs.com"
"downloads.microsoft.com"
"downloads1.kaspersky-labs.com"
"downloads2.kaspersky-labs.com"
"downloads2.kaspersky-labs.com"
"ftp.downloads2.kaspersky-labs.com"
"go.microsoft.com"
"ids.kaspersky-labs.com"
"kaspersky-labs.com"
"liveupdate.symantec.com"
"liveupdate.symantecliveupdate.com"
"mast.mcafee.com"
"mcafee.com"
"media.fastclick.net"
"msdn.microsoft.com"
"my-etrust.com"
"networkassociates.com"
"office.microsoft.com"
"phx.corporate-ir.net"
"support.microsoft.com"
"trendmicro.com"
"updates1.kaspersky-labs.com"
"viruslist.com"
"www.awaps.net"
"www.f-secure.com"
"www.fastclick.net"
"www.kaspersky.com"
"www.symantec.com"
等等
5，把自身添加到boot.ini文件
6，把自身添加注册表项目：
HKLM\SoftWare\Microsoft\Windows\CurrentVersion\Run
anti_troj=%system%\anti_troj.exe
HKLM\software\\firstrrrun
firstrrun=anti_troj.exe
7,修改下列注册表项目：
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,SymantececNetDriverMonitor"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,ccApp"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,NAVCfgWiz"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,APVXDWIN"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,KAV50"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,avg7_cc"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,avg7_emc"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,ZoneLabsClient"
"HKLM\SOFTWARE\Symantec"
"HKLM\SOFTWARE\McAfee"
"HKLM\SOFTWARE\KasperskyLab"
"HKLM\SOFTWARE\Agnitum"
"HKLM\SOFTWARE\PandaSoftware"
"HKLM\SOFTWARE\ZoneLabs"
"HKLM\SOFTWARE\TrendMicro"
8弹出windows自带图片：
ntimage.gif
