病毒名称(中文):
病毒别名:
威胁级别:
★☆☆☆☆
病毒类型:
木马程序
病毒长度:
21568
影响系统:
Win9xWinMeWinNTWin2000WinXPWin2003
病毒行为:
该病毒是一个修改浏览器主页的木马病毒。该病毒运行后不停地添加启动项，修改浏览器主页，严重影响了系统的性能；该病毒还会会屏蔽大量站点，给网民造成了很大的不便。
1，生成文件
%Current%\network.sys
2，添加启动项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"UserSystem"="%CurrentFile%"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
"UserSystem"="%CurrentFile%"
3，修改主页
HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Main
"StartPage"="http://smartsearch.ws"
HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Main
"Default_Page_URL"="http://smartsearch.ws"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\Main
"StartPage"="http://smartsearch.ws"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\Main
"Default_Page_URL"="http://smartsearch.ws"
HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Main
"SearchPage"="http://smartsearch.ws/?q="
HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Main
"SearchBar"="http://smartsearch.ws/?q="
HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer\Main
"Default_Search_URL"="http://smartsearch.ws/?q="
HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer
"SearchURL"="http://smartsearch.ws/?q="
HKEY_CURRENT_USER\Software\Microsoft\InternetExplorer
"Search"="http://smartsearch.ws/?q="
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\Main
"SearchPage"="http://smartsearch.ws/?q="
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\Main
"SearchBar"="http://smartsearch.ws/?q="
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\Main
"Default_Search_URL"="http://smartsearch.ws/?q="
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer
"SearchURL"="http://smartsearch.ws/?q="
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer
"Search"="http://smartsearch.ws/?q="
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"default"="http://smartsearch.ws/?q="
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes
"www"="http://smartsearch.ws/?q="
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\Search
"SearchAssistant"="http://smartsearch.ws/?q="
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\Search
"CustomizeSearch"="http://smartsearch.ws/?q="
3，通过改写hosts文件屏蔽以下网站
127.0.0.1forums.spywareinfo.com
127.0.0.1www.spywareinfo.com
127.0.0.1www.merijn.org
127.0.0.1merijn.org
127.0.0.1spywareinfo.com
127.0.0.1www.computercops.biz
127.0.0.1computercops.biz
127.0.0.1dslreports.com
127.0.0.1www.dslreports.com
127.0.0.1www.lavasoftsupport.com
127.0.0.1lavasoftsupport.com
127.0.0.1www.lurkhere.com
127.0.0.1lurkhere.com
127.0.0.1forums.net-integration.net
127.0.0.1www.pctalk.info
127.0.0.1pctalk.info
127.0.0.1www.suggestafix.com
127.0.0.1suggestafix.com
127.0.0.1forums.thiefware.com
127.0.0.1www.tomcoyote.org
127.0.0.1tomcoyote.org
127.0.0.1www.wilderssecurity.com
127.0.0.1wilderssecurity.com
127.0.0.1www.winguides.com
127.0.0.1winguides.com
127.0.0.1www.spybot-spyware.com
127.0.0.1spybot-spyware.com
127.0.0.11spybot.com
127.0.0.1www.1spybot.com
127.0.0.1www.lavasoftusa.com
127.0.0.1lavasoftusa.com
127.0.0.1www.spychecker.com
127.0.0.1spychecker.com
127.0.0.1www.grc.com
127.0.0.1grc.com
127.0.0.1www.cexx.org
127.0.0.1cexx.org
127.0.0.1security.kolla.de
127.0.0.1www.security.kolla.de
127.0.0.1simplythebest.net
127.0.0.1www.simplythebest.net
127.0.0.1www.spywareguide.com
127.0.0.1spywareguide.com
127.0.0.1www.spyware.co.uk
127.0.0.1spyware.co.uk
127.0.0.1www.lavasoft.de
127.0.0.1lavasoft.de
127.0.0.1www.webopedia.com
127.0.0.1webopedia.com
127.0.0.1www.ZeroSpyWare.com
127.0.0.1ZeroSpyWare.com
127.0.0.1www.spectorsoft.com
127.0.0.1spectorsoft.com
127.0.0.1www.Spy--Software.com
127.0.0.1Spy--Software.com
127.0.0.1www.sunbelt-software.com
127.0.0.1sunbelt-software.com
127.0.0.1www.spycleaner.net
127.0.0.1spycleaner.net
127.0.0.1www.EnigmaSoftwareGroup.com
127.0.0.1EnigmaSoftwareGroup.com
127.0.0.1www.no-spybot.com
127.0.0.1no-spybot.com
