病毒名称(中文):
病毒别名:
威胁级别:
★☆☆☆☆
病毒类型:
木马下载器
病毒长度:
37888
影响系统:
Win9xWin2000WinXP
病毒行为:
该病毒是木马下载者.当病毒运行时会通过网络下载其他的木马文件至本机并执行.另外,病毒运行后还会衍生病毒文件至本机，创建服务，和在每个盘的根目录下.
1.生成文件:
%sys32dir%\servver.exe
另外病毒会在每个盘的根目录下创建隐藏文件AutoRun.inf文件和servver.exe文件.以达到双击打开盘符时运行病毒.
2.修改注册表，生成服务项.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
Type=dword:00000110
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
Start=dword:00000002
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
ErrorControl=dword:00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
ImagePath=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,73,65,72,76,76,65,72,2e,65,78,65,00,
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
DisplayName="Telephotsgoogle"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
ObjectName="LocalSystem"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms
Description="为即插即用设备提供支持"
3.病毒运行后会创建进程servver.exe,等待网络可用时从指定网站下载其他木马病毒至本机并运行.
4.病毒会从网络上下载以下木马文件至本机并运行:
http://ads.ga*****.com/100.exe
http://ads.ga*****.com/101.exe
http://ads.ga*****.com/102.exe
http://ads.ga*****.com/103.exe
http://ads.ga*****.com/104.exe
http://ads.ga*****.com/105.exe
http://ads.ga*****.com/106.exe
http://ads.ga*****.com/107.exe
http://ads.ga*****.com/108.exe
http://ads.ga*****.com/109.exe
http://ads.ga*****.com/110.exe
http://ads.ga*****.com/112.exe
http://ads.ga*****.com/113.exe
http://ads.ga*****.com/114.exe
http://ads.ga*****.com/115.exe
http://ads.ga*****.com/116.exe
http://ads.ga*****.com/117.exe
http://ads.ga*****.com/118.exe
http://ads.ga*****.com/119.exe
