病毒名称(中文):
病毒别名:
威胁级别:
★☆☆☆☆
病毒类型:
木马程序
病毒长度:
20480
影响系统:
Win9xWinMeWinNTWin2000WinXPWin2003
病毒行为:
该病毒是一个下载木马。它会下载并安广告软件。建议电脑用户升级病毒库查杀该病毒，以免中毒受害。
1、生成的文件
C:\DocumentsandSettings\AllUsers\Templates\temp.exe
C:\ProgramFiles\CommonFiles\System\Update.dat
C:\ProgramFiles\CommonFiles\System\Update.exe
C:\WINNT\system32\rundllfromwin2000.exe
C:\WINNT\system32\wbem\ocmor.dll
C:\WINNT\system32\wbem\mnevno40.dll
C:\WINNT\system32\Score.txt
C:\WINNT\system32\advport.dll
C:\WINNT\system32\tbcaqm26.dll
C:\DocumentsandSettings\administrator\Favorites\多特软件站-最安全放心的软件站.url
2、添加注册表启动项
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"System"="C:\ProgramFiles\CommonFiles\System\Update.exe"
3、添加伪系统服务和驱动
HKLM\System\CurrentControlSet\Services\DATEING
"Type"="0x10"
HKLM\System\CurrentControlSet\Services\DATEING
"Start"="0x2"
HKLM\System\CurrentControlSet\Services\DATEING
"ImagePath"="C:\WINNT\SYSTEM32\RUNDLLFROMWIN2000.EXEC:\WINNT\SYSTEM32\WBEM\MNEVNO40.DLL,Export1087"
HKLM\System\CurrentControlSet\Services\paraudio
"Type"="0x1"
HKLM\System\CurrentControlSet\Services\paraudio
"Start"="0x2"
HKLM\System\CurrentControlSet\Services\paraudio
"ImagePath"="\??\C:\WINNT\system32\drivers\paraudio.sys"
HKLM\System\CurrentControlSet\Services\paraudio
"DisplayName"="paraudio"
HKLM\System\CurrentControlSet\Services\License
"Type"="0x20"
HKLM\System\CurrentControlSet\Services\License
"Start"="0x2"
HKLM\System\CurrentControlSet\Services\License
"ImagePath"="%SystemRoot%\System32\svchost.exe-knetsvcs"
HKLM\SYSTEM\CurrentControlSet\Services\License
"DisplayName"="WindowsGateway"
HKLM\SYSTEM\CurrentControlSet\Services\License
"Description"="防火墙保护机制，为Internet连接共享和Windows防火墙提供高效的保护支持。无法终止此服务。"
HKLM\SYSTEM\CurrentControlSet\Services\License
"Parameters"=ServiceDll"C:\WINNT\system32\tbcaqm26.dll"
5、添加注册表信息
HKCU\SOFTWARE\Microsoft\InternetExplorer\typedUrls
"url5"="http://www.3839.com/index.html"
6、添加卸载程序，实则并不存在卸载
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\coolsign
"DisplayName"="CoolSign"
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\coolsign
"UninstallString"="C:\ProgramFiles\coolsign\uninst.exe"
