病毒名称(中文):
病毒别名:
威胁级别:
★☆☆☆☆
病毒类型:
木马程序
病毒长度:
5808
影响系统:
Win9xWinNT
病毒行为:
这是一个盗取Gamania公司游戏的木马,该木马通过监控用户登陆Gamania页面,记录用户输入的帐户信息,然后发送出去.该木马会结束大量的安全软件,修改host文件,给用户带来很大不便.
1.生成文件:
%systemroot%\java\winlogin.exe
2.添加起始项,使病毒开机运行:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BossIdea
"C:\WINNT\java\winlogin.exe"
3.修改host文件,延长病毒的生命周期:
127.0.0.1 avp.com
127.0.0.1 ca.com
127.0.0.1 customer.symantec.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.kasperksy-labs.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 mast.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 nai.com
127.0.0.1 networkassociates.com
127.0.0.1 rads.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 sophos.com
127.0.0.1 symantec.com
127.0.0.1 trendmicro.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 viruslist.com
127.0.0.1 www.avp.com
127.0.0.1 www.ca.com
127.0.0.1 www.f-secure.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.mcafee.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.symantec.com
127.0.0.1 www.viruslist.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 downloads-eu1.kaspersky-labs.com
127.0.0.1 downloads-us1.kaspersky-labs.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 windowsupdate.microsoft.com
127.0.0.1 downloads5.kaspersky-labs.com
127.0.0.1 ftp.avp.ru
127.0.0.1 updates3.kaspersky-labs.com
127.0.0.1 updates2.kaspersky-labs.com
127.0.0.1 updates1.kaspersky-labs.com
127.0.0.1 ftp.kaspersky.com
127.0.0.1 downloads-us22.kaspersky-labs.com
127.0.0.1 downloads-us1.kaspersky-labs.com
127.0.0.1 downloads-us2l.kaspersky-labs.com
127.0.0.1 downloads-eu2l.kaspersky-labs.com
127.0.0.1 v4.windowsupdate.microsoft.com
127.0.0.1 v5.windowsupdate.microsoft.com
127.0.0.1 windowsupdate.microsoft.com
127.0.0.1 221.215.84.2
127.0.0.1 210.51.23.7
127.0.0.1 www.szadk.com
127.0.0.1 asp3.6to23.com
127.0.0.1 www.akoak.com
127.0.0.1 www.ky173.com
127.0.0.1 www.999sj.com
4.结束以下窗口和进程:
KVMonXP.KXP
KVXP.KXP
噬菌体
svch0st.EXE
test.EXE
ghost.EXE
svchost.EXE
KAVSVC.EXE
KAV.EXE
MAILMON.EXE
EGHOST.EXE
IPARMOR.EXE
KAVPFW.EXE
ZAFrameWnd
ZoneAlarm
TForm1
AfxWnd42
PwrMonitorRunDllWin
KVXP_Monitor
江民杀毒软件：实时监控
KasperskyAnti-VirusPersonal
卡巴斯基反病毒单机版
#32770
天网防火墙企业版
天网防火墙个人版
Tapplication
RavMon.exe
RavMonClass
5.发送邮件到固定地址.
