病毒名称(中文):
图片下载器339968
病毒别名:
威胁级别:
★☆☆☆☆
病毒类型:
木马下载器
病毒长度:
339968
影响系统:
Win9xWinMeWinNTWin2000WinXPWin2003
病毒行为:
这是一个下载者病毒。它伪装为jpg格式的图片文件，欺骗用户点击。运行起来后，会修改系统日期，造成一些杀毒软件失效。然后就下载并运行大量其它病毒。
1.释放病毒文件
C:\WINDOWS\system32\vq201a5.dll
C:\WINDOWS\system32\drivers\7zotrcmy.sys
C:\WINDOWS\system32\drivers\p0s7tw6r.sys
2.创建键值，建立服务，可以自启动
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\7zotrcmy
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\7zotrcmyTypedword:00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\7zotrcmyStartdword:00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\7zotrcmyErrorControldword:00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\7zotrcmyImagePathhex(2):53,79,73,74,65,6d,33,32,5c,44,52,49,56,45,52,53,5c,37,7a,6f,74,72,63,6d,79,2e,73,79,73,00,
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\7zotrcmyDisplayName"7zotrcmy"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p0s7tw6r
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p0s7tw6rTypedword:00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p0s7tw6rStartdword:00000002
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p0s7tw6rErrorControldword:00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p0s7tw6rImagePathhex(2):5c,3f,3f,5c,43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,64,72,69,76,65,72,73,5c,70,30,73,37,74,77,36,72,2e,73,79,73,00,
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p0s7tw6rDisplayName"p0s7tw6r"
3.病毒会用cmd命令删除自身
4.伪装为jpg图片文件类型，点击后运行起来，系统日期被更改，杀毒软件失效，下载大量病毒，然后运行下载病毒。