病毒大百科

该病毒是一个下载者病毒。病毒运行后会衍生病毒文件至系统目录下，并将生成的DLL文件注入到进程当中，然后通过互联网下载其它的病毒文件至用户电脑上运行。

1.生成随机名文件至系统目录下
C:\WINDOWS\system32\lyzm7prr.dll
C:\WINDOWS\system32\drivers\8vnag.sys
C:\WINDOWS\system32\drivers\hbbmjb2l4.sys
C:\Documents and Settings\lok\Favorites\收藏.url

2.修改注册表
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IE4
Main = "c328bcbf-38ba-481188456994"

3.修改注册表,添加服务
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\8vnag
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\8vnag
Type = dword:00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\8vnag
Start = dword:00000002
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\8vnag
ErrorControl = dword:00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\8vnag
ImagePath = hex(2):5c,3f,3f,5c,43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,64,72,69,76,65,72,73,5c,38,76,6e,61,67,2e,73,79,73,00,
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\8vnag
DisplayName = "8vnag"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\8vnag
setonce

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hbbmjb2l4
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hbbmjb2l4
Type = dword:00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hbbmjb2l4
Start = dword:00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hbbmjb2l4
ErrorControl = dword:00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hbbmjb2l4
ImagePath = hex(2):53,79,73,74,65,6d,33,32,5c,44,52,49,56,45,52,53,5c,68,62,62,6d,6a,62,32,6c,34,2e,73,79,73,00,
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hbbmjb2l4
DisplayName = "hbbmjb2l4"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hbbmjb2l4
Group = "System Bus Extender"

4.病毒运行后会把DLL文件注入到进程当中.

5.病毒会通过互联网从以下的网站下载其他的病毒文件至客户的机器上:
"http://tmp.f*****.org"