病毒大百科

该病毒是一个黑客病毒。运行该病毒会在系统留下后门，
等待黑客的控制指令，同时它会的弹出一些色情网页。
建议电脑用户升级杀毒软件和打开防火墙，以免中毒受害。

1、第一阶段生成的文件
%SystemRoot%\system32\winrnt.exe
%SystemRoot%\system32\idbg32.exe
%SystemRoot%\system32\aset32.exe

2、第二阶段生成的文件
%SystemRoot%\system32\rmass.exe
%SystemRoot%\system32\ntdbg.exe
%SystemRoot%\system32\ahuy.exe
%SystemRoot%\system32\RECOVER32.DLL

3、病毒运行后的第一阶段，该病毒运行时先自身拷贝为系统文件夹winrnt.exe文件，
然后由winrnt.exe进程维护自身并释放idbg32.exe、aset32.exe两个文件和不断的
尝试下载并运行另一个病毒rmass.exe。

4、病毒运行后的第二阶段，rmass.exe病毒下载并运行后它会结束winrnt.exe进程，
并删除第一阶段病毒生成的三个文件和释放ntdbg.exe、ahuy.exe、RECOVER32.DLL三个文件。
然后就疯狂的访问一些色情web服务器，并不停的弹出一些色情网页。

5、第二阶段病毒弹出的广告页面
http://jlo.t0p**0.com/
http://aguilera.ft**0.net/
http://czech-s**.com/include/popup/czech-sex.html
http://amateur.multitop**st.com/?id=kair
http://www.adult-sex-special-of**r.com/naughty_amateur.html
http://tits.multitop**st.com/?ref=noexit

6、在一轮疯狂的访问后，病毒会平静下来，只是偶尔访问mailrelay.**.website.ws服务器，
但该病毒会一直打开并监听一10**的udp端口，等待黑客的指令。

7、第一阶段对%System%\driver\etc\host文件的修改，添加域名解释地址：
69.31.81.22 www.google.mu google.ci www.google.ie espanol.search.yahoo.com
search.msn.com google.com.ua search.msn.com.sg
69.31.81.22 www.google.pl www.google.co.il google.com.sg
www.google.fi google.com.do google.as www.google.com.ni
69.31.81.22 google.co.nz beta.search.msn.at www.google.com.my
google.ie google.de www.google.co.ve google.com.vc
69.31.81.22 www.google.com.hk google.dj toolbar.search.msn.com
google.com.mt google.co.jp google.ch search.msn.dk
69.31.81.22 www.google.ru beta.search.sympatico.msn.ca google.com.py
google.com.my www.google.rw www.google.hn www.google.kz
69.31.81.22 www.google.uz cf.search.yahoo.com search.msn.de
google.com.br www.google.sm google.co.uk beta.search.msn.ch
69.31.81.22 google.ae www.google.co.uk www.google.com.mt
www.google.com.tr google.mn www.google.com.pr www.google.co.kr
69.31.81.22 www.google.be www.google.com.fj www.google.com.ar
google.co.kr google.com.ec www.google.co.nz www.google.co.hu
69.31.81.22 www.google.mn google.se www.google.sk www.google.co.in
google.gg google.fr www.google.nl
69.31.81.22 google.li www.google.lv www.google.mw www.google.tm
uk.search.yahoo.com google.com.tr google.com.fj
69.31.81.22 google.com.cu google.ro www.google.com.br www.google.es
google.ru search.msn.at www.google.co.ug
69.31.81.22 www.google.com.do google.ca google.nl google.ms
google.co.cr google.cl google.sh
69.31.81.22 www.google.co.th www.google.co.jp www.google.gl google.dk
google.mw www.google.at google.kz
69.31.81.22 google.cg www.google.td mx.search.yahoo.com www.google.gg
ct.search.yahoo.com google.com google.at
69.31.81.22 beta.search.msn.no www.google.com.gt www.google.li
www.google.se google.mu beta.search.msn.dk www.google.fm
69.31.81.22 google.rw www.google.pn beta.search.msn.se google.bi
www.google.com search.msn.it www.google.lu
69.31.81.22 google.es www.google.co.cr www.google.as google.pl
www.google.com.au google.az www.google.cd
69.31.81.22 google.com.uy www.google.ms google.am www.google.ch
google.com.au ar.search.yahoo.com google.com.hk
69.31.81.22 beta.search.msn.co.uk www.google.com.vn www.google.gm
google.td www.google.com.na www.google.com.ec www.google.cg
69.31.81.22 beta.search.msn.co.in google.lv www.google.com.sv
google.com.ni google.off.ai www.google.pt google.tt
69.31.81.22 google.cd google.co.il google.fm fr.search.yahoo.com
br.search.yahoo.com google.co.ls search.msn.fi
69.31.81.22 www.google.vg google.sm search.msn.ch search.msn.co.in
beta.search.msn.com.sg www.google.tt google.be
69.31.81.22 search.msn.fr www.google.co.ke beta.search.ninemsn.com.au
search.ninemsn.com.au google.com.co beta.search.msn.be www.google.com.uy
69.31.81.22 beta.search.msn.co.za search.msn.no www.google.com.pa
www.google.co.ls www.google.ae google.com.ly www.google.bi
69.31.81.22 www.google.am google.tm beta.search.msn.fr google.co.je
www.google.com.py beta.search.msn.nl search.msn.nl
69.31.81.22 search.yahoo.com google.com.np google.com.gr google.it
www.google.com.vc www.google.com.sa google.co.th
69.31.81.22 google.com.tw google.uz google.com.gi www.google.sh
google.com.vn search.sympatico.msn.ca au.search.yahoo.com
69.31.81.22 www.google.com.mx google.com.sa www.google.com.gi google.gm
www.google.com.ph google.fi search.msn.co.uk
69.31.81.22 beta.search.msn.de www.google.de google.pn search.msn.es
google.com.pa www.google.az google.com.gt
69.31.81.22 google.lu google.co.ke it.search.yahoo.com google.co.hu
google.pt google.gl ca.search.yahoo.com
69.31.81.22 www.google.com.cu www.google.com.pk google.com.sv
www.google.no google.com.pe www.google.com.ag www.google.com.tw
69.31.81.22 search.msn.be google.com.na google.com.nf google.vg
de.search.yahoo.com search.msn.se google.com.ar
69.31.81.22 www.google.ro google.co.ve beta.search.xtramsn.co.nz
google.com.pr www.google.com.ua google.com.ph google.sk
69.31.81.22 www.google.com.gr www.google.it google.lt uk.search.msn.com
www.google.fr google.hn www.google.ci
69.31.81.22 search.xtramsn.co.nz www.google.com.pe www.google.cl
www.google.lt google.com.ag google.co.ug www.google.com.sg
69.31.81.22 www.google.co.je google.com.pk www.google.dj
beta.search.msn.it www.google.dk www.google.ca search.msn.co.za
69.31.81.22 beta.search.msn.es www.google.off.ai google.no
www.google.com.np www.google.com.co www.google.com.ly beta.search.msn.com
69.31.81.22 beta.search.msn.fi google.com.mx google.co.in
www.google.com.nf auto.search.msn.com

8、第二阶段对%System%\driver\etc\host文件的修改
删除第一阶段添加的域名解释，只添加另外一个域名解释地址
127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.com