這是一個惡意軟體,它運行之後會在系統目錄下生成一個資料夾和兩個檔案.它會創建一個瀏覽器載入項,檔案指向惡意軟體生成的DLL檔案。
基本介紹
- 中文名：Win32.Adware.BHO.av.115165
- 病毒類型：風險程式病毒
- 長度：115165
- 影響系統：Win9xWin2000WinXP
病毒行為
1.生成資料夾
C:\ProgramFiles\CommonFiles\CPUSH
2.生成檔案
C:\ProgramFiles\CommonFiles\CPUSH\cpush.dll
C:\ProgramFiles\CommonFiles\CPUSH\Uninst.exe
3.生成CLSID組件
HKEY_CLASSES_ROOT\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}
HKEY_CLASSES_ROOT\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}
Default="CAdLogicObject"
HKEY_CLASSES_ROOT\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}
AppID=""
HKEY_CLASSES_ROOT\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\InprocServer32
Default="C:\ProgramFiles\CommonFiles\CPUSH\cpush.dll"
HKEY_CLASSES_ROOT\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\InprocServer32
ThreadingModel="apartment"
HKEY_CLASSES_ROOT\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}
HKEY_CLASSES_ROOT\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}
Default="CToolbarDetectorObject"
HKEY_CLASSES_ROOT\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}
AppID""
HKEY_CLASSES_ROOT\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\InprocServer32
Default="C:\ProgramFiles\CommonFiles\CPUSH\cpush.dll"
HKEY_CLASSES_ROOT\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\InprocServer32
ThreadingModel="apartment"
HKEY_CLASSES_ROOT\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}
HKEY_CLASSES_ROOT\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}
Defautl="CPopupBlockObject"
HKEY_CLASSES_ROOT\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}
AppID""
HKEY_CLASSES_ROOT\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\InprocServer32
HKEY_CLASSES_ROOT\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\InprocServer32
Default="C:\ProgramFiles\CommonFiles\CPUSH\cpush.dll"
HKEY_CLASSES_ROOT\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\InprocServer32
ThreadingModel="apartment"
4.生成註冊表其他項
HKEY_CLASSES_ROOT\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}
HKEY_CLASSES_ROOT\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}
HKEY_CLASSES_ROOT\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}
HKEY_CLASSES_ROOT\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}
HKEY_LOCAL_MACHINE\SOFTWARE\cpush
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MultimediumPopup.XDLogic
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewMacroMediumsPop.PopupBlock
5.生成瀏覽器載入項
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowserHelperObjects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowserHelperObjects\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowserHelperObjects\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}
