Trojan/PSW.QQKdw.45

王朝百科·作者佚名  2010-01-30  
宽屏版  字体: |||超大  

Trojan/PSW.QQKdw.45

病毒类型:木马

危害等级:*

影响平台:Win9X/2000/XP/NT/Me/2003

Trojan/PSW.QQKdw.45是盗取qq密码的木马程序。

传播过程及特征:

1.病毒运行后,将创建下列文件:

%System%winsocks.dll, 36864字节

%WinDir%system.dat, 2719776字节

%WinDir%win.ini, 8294字节

%WinDir%desktopwdwej.exe, 16384字节

%WinDir%desktop

.exe, 12288字节

%WinDir%desktopl.exe, 77824字节

%WinDir%ytsgfvz.exe, 434176字节

%WinDir%intren0t.exe, 36864字节

2.修改WIN.INI文件:

在WIN.INI中添加 run=c:windowskir.exe

3.修改注册表:

在注册表中添加下列启动项:

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

"ytsgfvz" = %WinDir%ytsgfvz.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

"golci" = %program files%golci.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

"bbh" = %WinDir%bh.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

"INDEX" = %WinDir%desktopindex.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

"Intren0t" = %WinDir%intren0t.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices]

"ytsgfvz" = %WinDir%ytsgfvz.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices]

"golci" = %program files%golci.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices]

"bbh" = %WinDir%bh.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices]

"INDEX" = %WinDir%desktopindex.exe

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices]

"Intren0t" = %WinDir%intren0t.exe

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]

"ytsgfvz" = %WinDir%ytsgfvz.exe

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]

"golci" = %program files%golci.exe

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]

"bbh" = %WinDir%bh.exe

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]

"INDEX" = %WinDir%desktopindex.exe

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRunservices]

"ytsgfvz" = %WinDir%ytsgfvz.exe

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRunservices]

"golci" = %program files%golci.exe

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRunservices]

"bbh" = %WinDir%bh.exe

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRunservices]

"INDEX" = %WinDir%desktopindex.exe

这样,在Windows启动时,病毒就可以自动执行。

 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
 
© 2005- 王朝百科 版权所有