病毒名稱
介紹
病毒長度：4,096 位元組 , 27,136 位元組
病毒類型：木馬
危害等級：**
影響平台：Win9X/2000/XP/NT/Me/2003
TrojanDownloader.Small.kx至少有兩個檔案組成，一個是4,096 位元組的下載部分，一個是27,136 位元組的木馬部分。下載部分將首先進入系統，並從預定的網站下載該木馬程式的木馬部分，它是經過UPX壓縮的。
木馬通過電子郵件進行傳播，該郵件聲稱是來自微軟公司的關於Windows XP作業系統的補丁程式，附屬檔案的檔案名稱為winxp_sp1.exe(4,096 KB)當附屬檔案中的winxp_sp1.exe檔案被執行後，它將到預定的網站下載並執行木馬程式部分。
傳播過程及特徵
1.在系統目錄下生成一個名為msvchost.exe的木馬檔案，該檔案的作用是傳遞系統信息、從預定的網站下載並執行另一個檔案。
2.修改註冊表：
在系統註冊表添加鍵值以使木馬檔案可以在每次Windows系統啟動後自動運行
【HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run】"msvcc" = "%system%\msvchost.exe"
3.攜帶木馬程式的電子郵件的特徵如下：
發件人: [email protected]主題: Windows XP Service Pack 1 (Express) - Critical Update.
正文:
Window Update has determined that you are running
a beta version of Windows XP Service Pack 1
(SP1). To help improve the stability of your
computer, Microsoft recommends that you remove
the beta version of Windows XP SP1 and re-install
Windows XP SP1. If you cannot remove the beta
version, you should still reinstall Windows XP
SP1.
Windows XP SP1 provides the latest security,
reliability, and performance updates to the
Windows XP family of operating systems. Windows
XP SP1 is designed to ensure Windows XP platform
compatibility with newly released software and
hardware, and includes updates to resolve issues discovered by customers or by Microsoft's
internal testing team.
The maximum download size is approximately 3 MB,
however the size of the download and time
required may be less for computers that have had
updates previously installed.
To minimize the download time needed for
installation, setup will only download those
files which are required to bring your computer
up to date. Windows XP SP1 includes Internet
Explorer 6 SP1. Anti-virus software programs may
interfere with the installation of Windows XP
SP1. Please disable anti-virus software while
installing the service pack.
Just run the file winxp_sp1.exe in attach and
make sure to restart your PC after installation
will be completed.
?2004 Microsoft Corporation. All rights reserved.
Terms of Use
<http://www.microsoft.com/info/cpyright.htm>
Privacy Statement
<http://www.microsoft.com/info/privacy.htm>
附屬檔案: winxp_sp1.exe (4,096 位元組)
