TrojanDownloader.Tooncom.h
TrojanDownloader.Tooncom.h
TrojanDownloader.Tooncom.h是一个由Loader.exe和iedll.exe两个文件组成的木马。当iedll.exe 文件运行时，会搜索一些文件并将之删除，文件为C:WindowsSystem32DriversEtcHosts
C:WindowsHosts
C:WinntSystem32DriversEtcHosts
C:WinntHosts
D:WindowsSystem32DriversEtcHosts
D:WindowsHosts
D:WinntSystem32DriversEtcHosts
D:WinntHosts；删除后用66.40.16.131 livesexlist.com
66.40.16.131 lanasbigboobs.com
66.40.16.131 thumbnailpost.com
66.40.16.131 adult-series.com
66.40.16.131 www.livesexlist.com
66.40.16.131 www.lanasbigboobs.com
66.40.16.131 www.thumbnailpost.com
66.40.16.131 www.adult-series.com代替，导致用户在访问这些网站时被重定向至66.40.16.131；此外还尝试从tooncomics.com下载并执行文件Loader.exe。
当Loader.exe 文件被执行后，病毒会在注册表HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorer下添加"loader2"="1" "loaderGUID"="CLSID"键值，且修改注册表HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainSearch Page
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainSearch Bar
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainStart Page
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerSearchURL
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerSearchSearchAssistant下的数值，将IE首页更改为http:/ /thesten.com/main/sp.html；最后尝试从thesten.com下载并执行iedll.exe文件。并在用户喜欢的文件夹下添加
Series Hardcore Pics Sets and Movies.url
New Porn Pics everyday.url
Fully categories porn database. Enjoy.url信息。