Win32.TrojDownloader.Baser.W.37888

病毒名称(中文):

病毒别名:

威胁级别:

★☆☆☆☆

病毒类型:

木马下载器

病毒长度:

37888

影响系统:

Win9xWin2000WinXP

病毒行为:

该病毒是木马下载者.当病毒运行时会通过网络下载其他的木马文件至本机并执行.另外,病毒运行后还会衍生病毒文件至本机，创建服务，和在每个盘的根目录下.

1.生成文件:

%sys32dir%\servver.exe

另外病毒会在每个盘的根目录下创建隐藏文件AutoRun.inf文件和servver.exe文件.以达到双击打开盘符时运行病毒.

2.修改注册表，生成服务项.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms

Type=dword:00000110

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms

Start=dword:00000002

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms

ErrorControl=dword:00000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms

ImagePath=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,73,65,72,76,76,65,72,2e,65,78,65,00,

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms

DisplayName="Telephotsgoogle"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms

ObjectName="LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windowsms

Description="为即插即用设备提供支持"

3.病毒运行后会创建进程servver.exe,等待网络可用时从指定网站下载其他木马病毒至本机并运行.

4.病毒会从网络上下载以下木马文件至本机并运行:

http://ads.ga*****.com/100.exe

http://ads.ga*****.com/101.exe

http://ads.ga*****.com/102.exe

http://ads.ga*****.com/103.exe

http://ads.ga*****.com/104.exe

http://ads.ga*****.com/105.exe

http://ads.ga*****.com/106.exe

http://ads.ga*****.com/107.exe

http://ads.ga*****.com/108.exe

http://ads.ga*****.com/109.exe

http://ads.ga*****.com/110.exe

http://ads.ga*****.com/112.exe

http://ads.ga*****.com/113.exe

http://ads.ga*****.com/114.exe

http://ads.ga*****.com/115.exe

http://ads.ga*****.com/116.exe

http://ads.ga*****.com/117.exe

http://ads.ga*****.com/118.exe

http://ads.ga*****.com/119.exe