Win32.Troj.Downloader.fr

病毒行為

該病毒是一個下載木馬。它會下載並安廣告軟體。建議電腦用戶升級病毒庫查殺該病毒，以免中毒受害。

1、生成的檔案

C:\Documents and Settings\All Users\Templates\temp.exe

C:\Program Files\Common Files\System\Update.dat

C:\Program Files\Common Files\System\Update.exe

C:\WINNT\system32\rundllfromwin2000.exe

C:\WINNT\system32\wbem\ocmor.dll

C:\WINNT\system32\wbem\mnevno40.dll

C:\WINNT\system32\Score.txt

C:\WINNT\system32\advport.dll

C:\WINNT\system32\tbcaqm26.dll

C:\Documents and Settings\administrator\Favorites\多特軟體站-最安全放心的軟體站.url

2、添加註冊表啟動項

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

"System" = "C:\Program Files\Common Files\System\Update.exe"

3、添加偽系統服務和驅動

HKLM\System\CurrentControlSet\Services\DATEING

"Type" = "0x10"

HKLM\System\CurrentControlSet\Services\DATEING

"Start" = "0x2"

HKLM\System\CurrentControlSet\Services\DATEING

"ImagePath" = "C:\WINNT\SYSTEM32\RUNDLLFROMWIN2000.EXE C:\WINNT\SYSTEM32\WBEM\MNEVNO40.DLL,Export 1087"

HKLM\System\CurrentControlSet\Services\paraudio

"Type" = "0x1"

HKLM\System\CurrentControlSet\Services\paraudio

"Start" = "0x2"

HKLM\System\CurrentControlSet\Services\paraudio

"ImagePath" = "\??\C:\WINNT\system32\drivers\paraudio.sys"