概述
病毒別名：Trojan-Downloader.Win32.Small.abt【AVP】處理時間：
威脅級別：★★
中文名稱：
病毒類型：木馬
影響系統：Win9x / WinNT
病毒行為:
這是一個木馬下載器，用於下載並執行木馬。1.在系統目錄%system%\下創建檔案：
cmd64.exe（本身）
systems32.exe
driver64.exe（Trojan.Win32.Dialer.gd）
mutlo.exe（Trojan.Serpo.a）
commandos.exe（Trojan-Dropper.Win32.Small.ol）
popup_bl.dll（Trojan-Dropper.Win32.Small）
systr.dll
在病毒當前目錄下創建檔案：
1.dat（systems32.exe）
2.dat（Trojan.Win32.Dialer.gd）
3.dat（Trojan.Serpo.a）
4.dat（Trojan-Dropper.Win32.Small.ol）
gigasoft.dll
2.修改註冊表：
添加註冊表項：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"ControlPanel"="C:\WINNT\System32\cmd64.exe internat.dll,LoadKeyboardProfile"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
"Sysctl Desktop Handler"=""
HKEY_CLASSES_ROOT\CLSID\\InProcServer32
"默認"="C:\\WINNT\\System32\\systr.dll"
"ThreadingModel"="Apartment"
3.訪問某些預定的網址，下載木馬程式並運行。
4.修改主頁，並添加某些網址到收藏夾：
%Favorites%\Computers and Privacy\
Adware Removal.url
Broadband.url
Cable.url
Domain Hosting.url
Domain Names.url
DSL.url
E Commerce.url
Internet Access.url
Popup Blocker.url
Spyware Removal.url
Web Design.url
%Favorites%\Finance\
Bad Credit.url
Credit Cards.url
Debt Consolidation.url
Fast Cash.url
Home Business.url
Home Mortgage.url
Home Refinance.url
Investerment.url
Payday Loan.url
Student Loan.url
%Favorites%\Real Estate\
Commercial Mortgage.url
Condominiums.url
Home Business.url
Home Equity Loan.url
Home Improvement.url
Home Insurance.url
Home Mortgage.url
Interior Design.url
Mortgage Quote.url
Mortgage Refinancing.url
%Favorites%\Sport\
Baseball Betting.url
Basketball Betting.url
Fishing.url
Fitness.url
Football Betting.url
Golf.url
Horse Racing.url
Personal Trainers.url
Sport Cars.url
Sportsbook.url
%Favorites%\Dating\
Adult Dating.url
Chat Dating.url
Chat Flirt.url
Dating.url
Marriage.url
Matchmaking.url
Personals.url
Romance.url
Singles.url
Wedding.url
%Favorites%\Gambling\
Baccarat.url
Betting.url
Bingo.url
Blackjack.url
Horse Racing.url
Online Casinos.url
Online Roulette.url
Poker.url
Slot Machines.url
Sportsbook.url
%Favorites%\Pharmacy\
Acne Control.url
Breast Enhancement.url
Diet Patch.url
Human Growth Hormone.url
Penis Enlargement.url
Tramadol.url
Valium.url
Viagra.url
Vicodin.url
Weight.url
%Favorites%\Shopping\
Auto.url
Books.url
Clothing.url
Computers subaff.url
Cosmetics.url
Electronics.url
Gifts.url
Laptops.url
Printers.url
Skin Care.url
Trade Shows.url
Wedding Gift.url
%Favorites%\Travel\
Air Flight.url
Caribbean Cruises.url
Cruise Travel.url
Discount Travel.url
Hawaii Vacation.url
Hotels.url
Rental Cars.url
Carnival Cruises.url
Travel Insurance.url
Vacation Packages.url
5.在桌面上添加連結Adware Remover，Home Mortgages，Online Dating，Online Pharmacy，Poker。
