本病毒所有命名：

影响系统：
Win9x,WinMe,Linux

简介：
1.生成文件. %Windir%FuckAvAndDelMe.bat %Sys32dir%autorun.inf %Sys32dir%drivers tcfg.sys %Sys32dir%driverswinmons.sys

行为分析：
该毒是个木马下载器。病毒运行后在后台悄悄下载大量的木马病毒文件并运行。此病毒在所有磁盘分区的根目录下创建AUTO病毒，以便快速传播自己。它还利用映像劫持令安全软件失效。

描述：
1.生成文件.

%Windir%FuckAvAndDelMe.bat

%Sys32dir%autorun.inf

%Sys32dir%drivers
tcfg.sys

%Sys32dir%driverswinmons.sys

还会在各个盘的根目录下生成一个winsvcui.exe和autorun.inf文件.



2.修改文件.

C:WINDOWSsystem32dllcacheeep.sys

C:WINDOWSsystem32driverseep.sys



3.增加注册表生成三个服务,达到开机自启动.

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinCsrssDrv

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinCsrssDrv Type dword:00000001

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinCsrssDrv Start dword:00000003

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinCsrssDrv ErrorControl dword:00000001

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinCsrssDrv ImagePath hex(2):5c,3f,3f,5c,43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,44,72,69,76,65,72,73,5c,6e,74,63,66,67,2e,73,79,73,00,

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinCsrssDrv DisplayName "WinCsrssDrv"



HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinMonitors

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinMonitors Type dword:00000001

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinMonitors Start dword:00000003

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinMonitors ErrorControl dword:00000001

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinMonitors ImagePath hex(2):5c,3f,3f,5c,43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,44,72,69,76,65,72,73,5c,77,69,6e,6d,6f,6e,73,2e,73,79,73,00,

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinMonitors DisplayName "WinMonitors"



HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinUtfConv

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinUtfConv Type dword:00000001

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinUtfConv Start dword:00000003

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinUtfConv ErrorControl dword:00000001

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinUtfConv ImagePath hex(2):5c,3f,3f,5c,43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,44,72,69,76,65,72,73,5c,75,74,66,38,2e,73,79,73,00,

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinUtfConv DisplayName "WinUtfConv"



4.修改注册表HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options下的键值,利用映像劫持令部分安全软件无法启动,例如:毒霸,360,卡巴,QQ医生,nod32,filemon等.



5.会创建隐藏的病毒进程,保护病毒文件不被删除.



6.病毒会从以下地址下载其他的病毒文件并运行:

http://www.*******ier.cn/downq/