病毒大百科

这是一个远程控制木马。它会映像劫持许多主流安全软件的进程，令它们瘫痪，然后连接到病毒作者指定的远程地址。此毒还可利用AUTO技术进行迅速传播。

在磁盘中释放出以下文件:
C:\WINDOWS\system\36Otray.exe
C:\autorun.inf
C:\ntldr.exe
N:\autorun.inf
N:\ntldr.exe

在注册表中创建了以下信息:
"HKLM\Software\logogo"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo_1.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NMain.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.EXE"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVFW.EXE"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSvcUI.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.EXE"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVwsc.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVsvc.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchUI.EXE"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe"

在注册表中设置了以下信息:
"HKLM\Software\logogo" "setup" "yes"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo_1.exe" "Debugger" "C:\WINDOWS\system\36Otray.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe" "Debugger" "C:\WINDOWS\system\36Otray.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe" "Debugger" "C:\WINDOWS\system\36Otray.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NMain.exe" "Debugger" "C:\WINDOWS\system\36Otray.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.EXE" "Debugger" "C:\WINDOWS\system\36Otray.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVFW.EXE" "Debugger" "C:\WINDOWS\system\36Otray.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSvcUI.exe" "Debugger" "C:\WINDOWS\system\36Otray.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.EXE" "Debugger" "C:\WINDOWS\system\36Otray.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp" "Debugger" "C:\WINDOWS\system\36Otray.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe" "Debugger" "C:\WINDOWS\system\36Otray.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVwsc.exe" "Debugger" "C:\WINDOWS\system\36Otray.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVsvc.exe" "Debugger" "C:\WINDOWS\system\36Otray.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchUI.EXE" "Debugger" "C:\WINDOWS\system\36Otray.exe"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe" "Debugger" "C:\WINDOWS\system\36Otray.exe"

在注册表中修改了以下信息:
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe" "Debugger" "C:\WINDOWS\system\36Otray.exe"

病毒会连接作者指定的网址:
域名:"**tp.m**l.ru" 端口:25 (TCP)

在系统中创建了以下进程:
"EXPLORER"
病毒尝试使用[SeDebugPrivilege]权限枚举进程
病毒尝试枚举系统进程，可能会对一些安全进程进行关闭操作
"36Otray.exe"