标题：TrojanDownloader.Ject
病毒简介
病毒长度：变长 
病毒类型：木马
危害等级：*
影响平台：Win9X/2000/XP/NT/Me/2003
病毒行为
TrojanDownloader.Ject是一个变种类下载木马，通过IE的两个漏洞(MS04-013)下载文件并执行。
传播过程及特征：
1.利用Outlook Express MHTML URL处理漏洞从特定网站(www.vikord.com)下载文件。
2.利用ADODB.Stream组件漏洞下载可执行文件，并保存为：
C:\Programmer\Windows Media Player\wmplayer.exe 
C:\Program\Windows Media Player\wmplayer.exe 
C:\Programme\Windows Media Player\wmplayer.exe 
C:\Programmi\Windows Media Player\wmplayer.exe 
C:\Programfiler\Windows Media Player\wmplayer.exe 
C:\Programas\Windows Media Player\wmplayer.exe 
C:\Archivos de programa\Windows Media Player\wmplayer.exe 
C:\Program Files\Windows Media Player\wmplayer.exe
3.当wmplayer.exe文件后，生成下列文件：
%System%\doriot.exe 
%System%\gdqfw.exe 
4.修改注册表：
[HKEY_CURRENT_USER\Microsoft\Windows\CurrentVersion\Run]
"wersds" = "%System%\doriot.exe"
[HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Run]
"wersds" = "%System%\doriot.exe"
5.将gdqfw.exe作为线程嵌入到进程exeplorer.exe中，达到以下目的：
停止服务"haredAccess"
终止一些安全类软件的自动运行(通过停止相关进程运行实现)
从下列网站下载文件，并保存为%Windir%_re_file.exe，然后执行此文件：
allianzsp.sk 
coolweb.psg.sk 
cryofthespirit.com 
dollypop.com 
execpage.com 
helpdemos.com 
helpingyouth.org 
jamesbronner.com 
koti.pl 
miracle.v6.cz 
mountainwings.com 
mountainwings4.com 
naturalpros.com 
oracal.pl 
shock.evernet.com.pl 
SportLine.go.ro 
stroipolymer.ru 
theonlineword.com 
virtualchurch.com 
visionforsouls.org 
wingsoverlife.com 
www.1800thewoman.com 
www.1944.pl 
www.45partsdepot.com 
www.7pe.friko.pl 
www.air-computers.com.ar 
www.ametist.spb.ru 
www.apodis.pl 
www.arrasy.pl 
www.arthurspeaks.com 
www.astermed.pl 
www.atomique.pl 
www.atw.hu 
www.avatar.ee 
www.avers.com.pl 
www.baltexpo.spb.ru 
www.bomart.cz 
www.bravo.gliwice.pl 
www.bronnerbros.com 
www.buycare.com 
www.cumparacd.go.ro 
www.da-rom.co.il 
www.domu.net 
www.eastandard.co.ke 
www.elblu.republika.pl 
www.elcorsy.com 
www.elite-style.com 
www.enduser1.fast.net 
www.enitex.by 
www.enitex-m.by 
www.eris.pl 
www.europharm.pl 
www.extreme-racing.lg.ua 
www.fotel.pl 
www.fotolab.sk 
www.frater.hu 
www.gardameditech.com 
www.generex.de 
www.goldgates.com 
www.goodboy.dem.ru 
www.hards.pl 
www.healthcometh.com 
www.holz-studio.at 
www.ibplus.sk 
www.icpnet.pl 
www.icpnet.pl 
www.inlan.sk 
www.jamesbronner.com 
www.jbplus.cz 
www.justmatchit.com 
www.kubtelecom.ru 
www.kuda.com.ua 
www.lacittadifiorenzuola.it 
www.lotusdog.net 
www.ltvo.spb.ru 
www.master.pl 
www.members.aon.at 
www.moteplassen1.com 
www.mountainwings2.com 
www.multifoto.sk 
www.nadodrze.pl 
www.nairobiwebspace.com 
www.nameitright.com 
www.nardo.bbe.pl 
www.netland.gda.pl 
www.netta.pl 
www.nikola.piwko.pl 
www.ntrlab.com 
www.nustep.sk 
www.octava.pl 
www.odevnictvo.sk 
www.oftza.friko.pl 
www.oktbroiler.ru 
www.online40.com 
www.online50.com 
www.oto.lv 
www.pancoopzsv.co.yu 
www.pay5495.com 
www.pc-hard.com.ua 
www.perfect-beauty.at 
www.pharmag.pl 
www.polsl.katowice.pl 
www.prophetcollins.com 
www.propi.cz 
www.pursuit.rv.ua 
www.pyrlandia-boogie.pl 
www.quatro.sk 
www.r-bazar.ru 
www.roszkowski.pl 
www.silvic.ro 
www.sincron.go.ro 
www.skylive.pl 
www.smgkrc.pl 
www.soulring.com 
www.star-max.it 
www.sunbud.com.pl 
www.swez.net 
www.system5electronics.com 
www.tcvwebtv.com.ar 
www.thewoman.com 
www.tivis.cz 
www.ukpl.pl 
www.vacation-network.net 
www.wyspian.iap.pl 
www.zasada-rowery.pl