簡介
威脅級別：★
病毒類型：木馬
影響系統：Win 9x/ME,Win 2000/NT,Win XP,Win 2003
病毒行為:
該病毒是一個下載木馬。它會下載並安廣告軟體。建議電腦用戶升級病毒庫查殺該病毒，以免中毒受害。
內容
1、生成的檔案
C:\Documents and Settings\All Users\Templates\temp.exe
C:\Program Files\Common Files\System\Update.dat
C:\Program Files\Common Files\System\Update.exe
C:\WINNT\system32\rundllfromwin2000.exe
C:\WINNT\system32\wbem\ocmor.dll
C:\WINNT\system32\wbem\mnevno40.dll
C:\WINNT\system32\Score.txt
C:\WINNT\system32\advport.dll
C:\WINNT\system32\tbcaqm26.dll
C:\Documents and Settings\administrator\Favorites\多特軟體站-最安全放心的軟體站.url
2、添加註冊表啟動項
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"System" = "C:\Program Files\Common Files\System\Update.exe"
3、添加偽系統服務和驅動
HKLM\System\CurrentControlSet\Services\DATEING
"Type" = "0x10"
HKLM\System\CurrentControlSet\Services\DATEING
"Start" = "0x2"
HKLM\System\CurrentControlSet\Services\DATEING
"ImagePath" = "C:\WINNT\SYSTEM32\RUNDLLFROMWIN2000.EXE C:\WINNT\SYSTEM32\WBEM\MNEVNO40.DLL,Export 1087"
HKLM\System\CurrentControlSet\Services\paraudio
"Type" = "0x1"
HKLM\System\CurrentControlSet\Services\paraudio
"Start" = "0x2"
HKLM\System\CurrentControlSet\Services\paraudio
"ImagePath" = "\??\C:\WINNT\system32\drivers\paraudio.sys"
HKLM\System\CurrentControlSet\Services\paraudio
"DisplayName" = "paraudio"
HKLM\System\CurrentControlSet\Services\License
"Type" = "0x20"
HKLM\System\CurrentControlSet\Services\License
"Start" = "0x2"
HKLM\System\CurrentControlSet\Services\License
"ImagePath" = "%SystemRoot%\System32\svchost.exe -k netsvcs"
HKLM\SYSTEM\CurrentControlSet\Services\License
"DisplayName" = "Windows Gateway"
HKLM\SYSTEM\CurrentControlSet\Services\License
"Description" = "防火牆保護機制，為 Internet 連線共享和 Windows 防火牆提供高效的保護支持。無法終止此服務。"
HKLM\SYSTEM\CurrentControlSet\Services\License
"Parameters" = ServiceDll"C:\WINNT\system32\tbcaqm26.dll"
5、添加註冊表信息
HKCU\SOFTWARE\Microsoft\Internet Explorer\typedUrls
"url5" = "http://www.3839.com/index.html"
6、添加卸載程式，實則並不存在卸載
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\coolsign
"DisplayName" = "CoolSign"
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\coolsign
"UninstallString" = "C:\Program Files\coolsign\uninst.exe"
