×

新导航介绍,点击查看

色情伪装下载器

发表日期:2008-05-11 摄影器材: 点击数: 投票数:
病毒类型:
木马下载器
影响系统:
Win9x WinMe WinNT Win2000 WinXP Win2003
病毒行为:

这是一个木马下载器程序。它会自动调用IE浏览器,下载大量病毒到用户机器上,同时还会擅自登录Google页面搜索色情视频,让用户以为它是个色情广告软件。

1.程序运行后,生成文件
C:smp.bat
C:Documents and SettingsfishCookiesfish@google[1].txt
C:Documents and SettingsfishCookiesfish@google[2].txt
C:Documents and SettingsfishLocal SettingsHistoryHistory.IE5MSHist012008050620080507
C:Documents and SettingsfishLocal SettingsHistoryHistory.IE5MSHist012008050620080507index.dat
C:Documents and SettingsfishLocal SettingsTempA10-tmpaoi.exe
C:Documents and SettingsfishLocal SettingsTempPerflib_Perfdata_6e8.dat
C:Documents and SettingsfishLocal SettingsTemporary Internet FilesContent.IE52PF3QNZEsU0He6l7Lhs[1].js
C:Documents and SettingsfishLocal SettingsTemporary Internet FilesContent.IE5C4DGV5NIdrv32[1].data
C:Documents and SettingsfishLocal SettingsTemporary Internet FilesContent.IE5C4DGV5NInav_logo3[1].png
C:Documents and SettingsfishLocal SettingsTemporary Internet FilesContent.IE5R146ZVU7search[1]
C:Documents and SettingsfishLocal SettingsTemporary Internet FilesContent.IE5R146ZVU7search[1].htm
C:Documents and SettingsfishLocal SettingsTemporary Internet FilesContent.IE5TIH5F1C8gcn[1].png
C:WINDOWStokry.dll

2.病毒修改注册表的系统设置
HKEY_CURRENT_USERSoftwareMicrosoftBind comment '3913170'
HKEY_CURRENT_USERSoftwareMicrosoftBind comment2 'f'
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{95E1D855-9232-48F7-80D9-1ADB65B7939C} @ ''

3.病毒会生成文件C:smp.bat,去运行下载病毒。

 4.病毒首次运行时,会自动联网去网上下载x**@google[1].txt,x**@google[2].txt病毒列表,然后去下载病毒.

关键词:木马

作者:豺狼DDOS攻击

《色情伪装下载器》


下一篇:没有了

最 新:
没有其它新的作品了

更多豺狼DDOS攻击的POCO作品...

评论