病毒简介

病毒行为

病毒简介

病毒长度：变长

病毒类型：木马

危害等级：*

影响平台：Win9X/2000/XP/NT/Me/2003

病毒行为

TrojanDownloader.Ject是一个变种类下载木马，通过IE的两个漏洞(MS04-013)下载文件并执行。

传播过程及特征：

1.利用Outlook Express MHTML URL处理漏洞从特定网站(www.vikord.com)下载文件。

2.利用ADODB.Stream组件漏洞下载可执行文件，并保存为：

C:\\Programmer\\Windows Media Player\\wmplayer.exe

C:\\Program\\Windows Media Player\\wmplayer.exe

C:\\Programme\\Windows Media Player\\wmplayer.exe

C:\\Programmi\\Windows Media Player\\wmplayer.exe

C:\\Programfiler\\Windows Media Player\\wmplayer.exe

C:\\Programas\\Windows Media Player\\wmplayer.exe

C:\\Archivos de programa\\Windows Media Player\\wmplayer.exe

C:\\Program Files\\Windows Media Player\\wmplayer.exe

3.当wmplayer.exe文件后，生成下列文件：

%System%\\doriot.exe

%System%\\gdqfw.exe

4.修改注册表：

[HKEY_CURRENT_USER\\Microsoft\\Windows\\CurrentVersion\\Run]

"wersds" = "%System%\\doriot.exe"

[HKEY_LOCAL_MACHINE\\Microsoft\\Windows\\CurrentVersion\\Run]

"wersds" = "%System%\\doriot.exe"

5.将gdqfw.exe作为线程嵌入到进程exeplorer.exe中，达到以下目的：

停止服务"haredAccess"

终止一些安全类软件的自动运行(通过停止相关进程运行实现)

从下列网站下载文件，并保存为%Windir%_re_file.exe，然后执行此文件：

allianzsp.sk

coolweb.psg.sk

cryofthespirit.com

dollypop.com

execpage.com

helpdemos.com

helpingyouth.org

jamesbronner.com

koti.pl

miracle.v6.cz

mountainwings.com

mountainwings4.com

naturalpros.com

oracal.pl

shock.evernet.com.pl

SportLine.go.ro

stroipolymer.ru

theonlineword.com

virtualchurch.com

visionforsouls.org

wingsoverlife.com

www.1800thewoman.com

www.1944.pl

www.45partsdepot.com

www.7pe.friko.pl

www.air-computers.com.ar

www.ametist.spb.ru

www.apodis.pl

www.arrasy.pl

www.arthurspeaks.com

www.astermed.pl

www.atomique.pl

www.atw.hu

www.avatar.ee

www.avers.com.pl

www.baltexpo.spb.ru

www.bomart.cz

www.bravo.gliwice.pl

www.bronnerbros.com

www.buycare.com

www.cumparacd.go.ro

www.da-rom.co.il

www.domu.net

www.eastandard.co.ke

www.elblu.republika.pl

www.elcorsy.com

www.elite-style.com

www.enduser1.fast.net

www.enitex.by

www.enitex-m.by

www.eris.pl

www.europharm.pl

www.extreme-racing.lg.ua

www.fotel.pl

www.fotolab.sk

www.frater.hu

www.gardameditech.com

www.generex.de

www.goldgates.com

www.goodboy.dem.ru

www.hards.pl

www.healthcometh.com

www.holz-studio.at

www.ibplus.sk

www.icpnet.pl

www.icpnet.pl

www.inlan.sk

www.jamesbronner.com

www.jbplus.cz

www.justmatchit.com

www.kubtelecom.ru

www.kuda.com.ua

www.lacittadifiorenzuola.it

www.lotusdog.net

www.ltvo.spb.ru

www.master.pl

www.members.aon.at

www.moteplassen1.com

www.mountainwings2.com

www.multifoto.sk

www.nadodrze.pl

www.nairobiwebspace.com

www.nameitright.com

www.nardo.bbe.pl

www.netland.gda.pl

www.netta.pl

www.nikola.piwko.pl

www.ntrlab.com

www.nustep.sk

www.octava.pl

www.odevnictvo.sk

www.oftza.friko.pl

www.oktbroiler.ru

www.online40.com

www.online50.com

www.oto.lv

www.pancoopzsv.co.yu

www.pay5495.com

www.pc-hard.com.ua

www.perfect-beauty.at

www.pharmag.pl

www.polsl.katowice.pl

www.prophetcollins.com

www.propi.cz

www.pursuit.rv.ua

www.pyrlandia-boogie.pl

www.quatro.sk

www.r-bazar.ru

www.roszkowski.pl

www.silvic.ro

www.sincron.go.ro

www.skylive.pl

www.smgkrc.pl

www.soulring.com

www.star-max.it

www.sunbud.com.pl

www.swez.net

www.system5electronics.com

www.tcvwebtv.com.ar

www.thewoman.com

www.tivis.cz

www.ukpl.pl

www.vacation-network.net

www.wyspian.iap.pl

www.zasada-rowery.pl