病毒名称(中文):
病毒别名:
威胁级别:
★☆☆☆☆
病毒类型:
风险程序
病毒长度:
115165
影响系统:
Win9xWin2000WinXP
病毒行为:
这是一个恶意软件,它运行之后会在系统目录下生成一个文件夹和两个文件.它会创建一个浏览器加载项,文件指向恶意软件生成的DLL文件.
1.生成文件夹
C:\ProgramFiles\CommonFiles\CPUSH
2.生成文件
C:\ProgramFiles\CommonFiles\CPUSH\cpush.dll
C:\ProgramFiles\CommonFiles\CPUSH\Uninst.exe
3.生成CLSID组件
HKEY_CLASSES_ROOT\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}
HKEY_CLASSES_ROOT\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}
Default="CAdLogicObject"
HKEY_CLASSES_ROOT\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}
AppID=""
HKEY_CLASSES_ROOT\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\InprocServer32
Default="C:\ProgramFiles\CommonFiles\CPUSH\cpush.dll"
HKEY_CLASSES_ROOT\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\InprocServer32
ThreadingModel="apartment"
HKEY_CLASSES_ROOT\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}
HKEY_CLASSES_ROOT\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}
Default="CToolbarDetectorObject"
HKEY_CLASSES_ROOT\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}
AppID""
HKEY_CLASSES_ROOT\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\InprocServer32
Default="C:\ProgramFiles\CommonFiles\CPUSH\cpush.dll"
HKEY_CLASSES_ROOT\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\InprocServer32
ThreadingModel="apartment"
HKEY_CLASSES_ROOT\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}
HKEY_CLASSES_ROOT\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}
Defautl="CPopupBlockObject"
HKEY_CLASSES_ROOT\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}
AppID""
HKEY_CLASSES_ROOT\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\InprocServer32
Default="C:\ProgramFiles\CommonFiles\CPUSH\cpush.dll"
HKEY_CLASSES_ROOT\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\InprocServer32
ThreadingModel="apartment"
4.生成注册表其他项
HKEY_CLASSES_ROOT\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}
HKEY_CLASSES_ROOT\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}
HKEY_CLASSES_ROOT\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}
HKEY_CLASSES_ROOT\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}
HKEY_LOCAL_MACHINE\SOFTWARE\cpush
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MultimediumPopup.XDLogic
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewMacroMediumsPop.PopupBlock
5.生成浏览器加载项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowserHelperObjects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowserHelperObjects\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowserHelperObjects\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}
