TrojanDownloader.Agent.h
TrojanDownloader.Agent.h
病毒长度:15,800 Bytes
病毒类型:木马
危害等级:*
TrojanDownloader.Agent.h是一个木马程序,此木马在安装过程中,会出现EULA让用户进行选择安装,它试图列出系统中安装的adware和spyware程序表单。
传播过程及特征:
1.修改注册表:
HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\SPYWARE NUKER下添加键值:"camp" = ""
HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\SPYWARE NUKER\\Path下添加键值:"Install" = "%Program Files%\\TREK BLUE\\SPYWARE NUKER"
HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\SPYNUKER.exe下添加键值:"(Default)" = "%Program Files%\\Trek Blue\\Spyware Nuker\\SPYNUKER.exe "
2.生成下列文件夹及文件:
%Program Files%\\Trek Blue\\Spyware Nuker\\excludelist.txt
%Program Files%\\Trek Blue\\Spyware Nuker\\exmodule.dll
%Program Files%\\Trek Blue\\Spyware Nuker\\LSPFix.exe
%Program Files%\\Trek Blue\\Spyware Nuker\\Setting.ini
%Program Files%\\Trek Blue\\Spyware Nuker\\SPYNUKER.exe
%Program Files%\\Trek Blue\\Spyware Nuker\\UnInstaller.exe
%Program Files%\\Trek Blue\\Spyware Nuker\\zlib.dll
3.在桌面上放置一个名为Spyware Nuker 的快捷图标,此文件不是自动激活的。