簡介
Trojan/Omal
病毒類型：木馬
危害等級：*
影響平台：Win9X/2000/XP/NT/Me/2003
Trojan/OMAL通過訪問惡意網頁安裝木馬，此惡意網頁利用IE漏洞執行Content.php檔案(惡意CHM檔案)從而重定向用戶請求頁面，並在企業網際網路地帶添加特定的Web伺服器地址。
特徵
傳播過程及特徵：
1.修改註冊表：
添加213.159.118.226信息到註冊表
【HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1】
2.重定向request請求到213.159.118.226，通過修改Hosts檔案達到目的：
213.159.118.226 1-se.com
213.159.118.226 58q.com
213.159.118.226 aifind.cc
213.159.118.226 aifind.info
213.159.118.226 allneedsearch.com
213.159.118.226 approvedlinks.com
213.159.118.226 auto.ie.searchforge.com
213.159.118.226 awebfind.biz
213.159.118.226 best.royalsearch.net
213.159.118.226 cracks.am
213.159.118.226 default-homepage-network.com
213.159.118.226 find.microgirls.com
213.159.118.226 find4u.net
213.159.118.226 freshvideogals.com
213.159.118.226 i-lookup.com
213.159.118.226 ie-search.com
213.159.118.226 in.webcounter.cc
213.159.118.226 itseasy.us
213.159.118.226 just.find-itnow.com
213.159.118.226 link.startmake.com
213.159.118.226 mysearchnow.com
213.159.118.226 nativehardcore.com
213.159.118.226 qwertysearch123.biz
213.159.118.226 search.ieplugin.com
213.159.118.226 search.psn.cn
213.159.118.226 searchbar.findthewebsiteyouneed.com
213.159.118.226 searchcentrix.com
213.159.118.226 searchmyrequest.com
213.159.118.226 super-spider.com
213.159.118.226 t.rack.cc
213.159.118.226 teen-biz.com
213.159.118.226 teenhqpics.com
213.159.118.226 tits.hardcore4ever.net
213.159.118.226 webcoolsearch.com
213.159.118.226 wmmse.com
213.159.118.226 www.008i.com
213.159.118.226 www.2fastsearch.net
213.159.118.226 www.8095.com
213.159.118.226 www.alfa-search.com
213.159.118.226 www.boredlife.com
213.159.118.226 www.couldnotfind.com
213.159.118.226 www.cracks.am
213.159.118.226 www.daum.net
213.159.118.226 www.dreamwiz.com
213.159.118.226 www.find-itnow.com
213.159.118.226 www.find-itnow.com
213.159.118.226 www.find4u.net
213.159.118.226 www.firstbookmark.com
213.159.118.226 www.gajai.com
213.159.118.226 www.hand-book.com
213.159.118.226 www.hao123.com
213.159.118.226 www.hotsearchbox.com
213.159.118.226 www.hotwebsearch.com
213.159.118.226 www.hugesearch.net
213.159.118.226 www.iquicksearch.com
213.159.118.226 www.lookfor.cc
213.159.118.226 www.maxxxhosters.com
213.159.118.226 www.naver.com
213.159.118.226 www.nkvd.us
213.159.118.226 www.novafuck.com
213.159.118.226 www.ohcorea.com
213.159.118.226 www.omega-search.com
213.159.118.226 www.onet.pl
213.159.118.226 www.power-search.info
213.159.118.226 www.rightfinder.net
213.159.118.226 www.search-1.net
213.159.118.226 www.search-and-go.com
213.159.118.226 www.search-dot.com
213.159.118.226 www.search-space.com
213.159.118.226 www.searchforge.com
213.159.118.226 www.searching-the-net.com
213.159.118.226 www.searchv.com
213.159.118.226 www.searchxl.com
213.159.118.226 www.seznam.cz
213.159.118.226 www.slotch.com
213.159.118.226 www.spidersearch.com
213.159.118.226 www.startium.com
213.159.118.226 www.therealsearch.com
213.159.118.226 www.ttjj.com
213.159.118.226 www.viewpornkey.com
213.159.118.226 www.wazzupnet.com
213.159.118.226 www.websearch.com
213.159.118.226 www.windowws.cc
213.159.118.226 www.xgmm.com
213.159.118.226 xwebsearch.biz
213.159.118.226 yourbookmarks.ws
註：%Windir%為變數，一般為C:\Windows 或 C:\Winnt；
%System%為變數，一般為C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000),
或 C:\Windows\System32 (Windows XP)。
