标题：Win32.Troj.Zdesnado.y
基本信息
病毒别名：Trojan-Downloader.Win32.Zdesnado.y[AVP]
处理时间：
威胁级别：★★
中文名称：
病毒类型：木马
影响系统：Win9x / WinNT
病毒行为
创建创建互斥体kakogo_cherta_tebe_zdes_nado，防止运行病毒的多个实例。
自身复制将自身复制到%System%\Software\software.exe，修改文件%System%\drivers\etc\hosts，在该文件后面追加一下内容：
127.0.0.1 www.iframedollars.biz
127.0.0.1 iframedollars.biz
127.0.0.1 www.allforadult.com
127.0.0.1 allforadult.com
127.0.0.1 www.vesbiz.biz
127.0.0.1 vesbiz.biz
127.0.0.1 www.aaasexypics.com
127.0.0.1 aaasexypics.com
127.0.0.1 www.virgin-tgp.net
127.0.0.1 virgin-tgp.net
127.0.0.1 www.5sec.biz
127.0.0.1 5sec.biz
127.0.0.1 www.avp.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 www.symantec.com
127.0.0.1 networkassociates.com
127.0.0.1 secure.nai.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 downloads-us1.kaspersky-labs.com
127.0.0.1 downloads-eu1.kaspersky-labs.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.networkassociates.com
127.0.0.1 us.mcafee.com
127.0.0.1 f-secure.com
127.0.0.1 avp.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.f-secure.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 update.symantec.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 viruslist.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 updates.symantec.com
127.0.0.1 kaspersky.com
127.0.0.1 www.trendmicro.com
127.0.0.1 conyc.com
下载网页文件到：%system%\ysb.exe
创建目录%SystemRoot%\test
修改注册表修改注册表：
添加表项：
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
"Software"="%System%\Software\software.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
"Start Page"="<变化的值>"
"FlagStop"=dword:1
或者
"FlagInstall"=dword:1
修改表项：
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
"1001"=dword:46
"Flags"=dword:0
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
"1001"=dword:47
"Flags"=dword:0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
"1001"=dword:0
"Flags"=dword:1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
"1001"=dword:0
"Flags"=dword:1
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
"Trust Warning Level"="No Security"
"Safety Warning Level"="SucceedSilent"
"CodeDownload"="Yes"
"Security_RunActiveXControls"
"Security_RunScripts"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
"Trust Warning Level"="No Security"
"Safety Warning Level"="SucceedSilent"
"CodeDownload"="Yes"
"Security_RunActiveXControls"
"Security_RunScripts"
HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Security
"Trust Warning Level"="No Security"
"Safety Warning Level"="SucceedSilent"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults
"http"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
"Trusted"
"CurrentLevel"
"RecommendedLevel"
"MinLevel"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
"Trusted"
"CurrentLevel"
"RecommendedLevel"
"MinLevel"
定期启动通过设置4个时钟，它会每隔一定时间做以下操作：定时修改启动项，是自己能够开机运行，并且到指定网址取得配置文件用来下载新的病毒；定时终止某些进程，可以是反病毒软件防火墙；定时修改host文件，使得很多反病毒软件不能正常升级；定时修改用户的主页指向某个网页，使得用户打开浏览器时首先访问病毒设置的网页，从而感染病毒。
终止的进程：
ir.exe
intron.exe
printer32.exe
ykyrtws.exe
loadclean.exe
telnet.exe
lpt.exe
systime.exe
toolbar.exe
mstasks1.exe
mstasks2.exe
mstasks3.exe
loadadv.exe