病毒行为:

该病毒是木马下载者.当病毒运行时会通过网络下载其他的木马文件至本机并执行.另外,病毒运行后还会衍生病毒文件至本机，创建服务，和在每个盘的根目录下.

1.生成文件:

%sys32dir%\\servver.exe

另外病毒会在每个盘的根目录下创建隐藏文件AutoRun.inf文件和servver.exe文件.以达到双击打开盘符时运行病毒.

2.修改注册表，生成服务项.

HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Windowsms

HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Windowsms

Type = dword:00000110

HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Windowsms

Start = dword:00000002

HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Windowsms

ErrorControl = dword:00000000

HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Windowsms

ImagePath = hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,73,65,72,76,76,65,72,2e,65,78,65,00,

HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Windowsms

DisplayName = "Telephots google"

HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Windowsms

ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Windowsms

Description = "为即插即用设备提供支持"

3.病毒运行后会创建进程servver.exe,等待网络可用时从指定网站下载其他木马病毒至本机并运行.

4.病毒会从网络上下载以下木马文件至本机并运行:

http://ads.ga*****.com/100.exe

http://ads.ga*****.com/101.exe

http://ads.ga*****.com/102.exe

http://ads.ga*****.com/103.exe

http://ads.ga*****.com/104.exe

http://ads.ga*****.com/105.exe

http://ads.ga*****.com/106.exe

http://ads.ga*****.com/107.exe

http://ads.ga*****.com/108.exe

http://ads.ga*****.com/109.exe

http://ads.ga*****.com/110.exe

http://ads.ga*****.com/112.exe

http://ads.ga*****.com/113.exe

http://ads.ga*****.com/114.exe

http://ads.ga*****.com/115.exe

http://ads.ga*****.com/116.exe

http://ads.ga*****.com/117.exe

http://ads.ga*****.com/118.exe

http://ads.ga*****.com/119.exe