这次新变种folderopen.exe Worm.Win32.AutoRun.lre,增强了对反病毒软件与专杀工具的对抗,与早期版本不同的之处在于,这个变种增加了移动存储设备方式的传播与驱动的保护,另外在Hosts文件中也增加了对[url]www.usbcleaner.cn[/url]的屏蔽,
和myPhotokiller.exe的拦截.

生成文件:

C:\WINDOWS\system32\drivers\Ahn17.sys (这个驱动名称是随机的)30,848
C:\WINDOWS\system32\symdebugs.exe 55,808
C:\WINDOWS\system32\crypts.dll 32,768(Trojan-Downloader.Win32.Satray.ce)

U:\RECYCLERS-1-6-21-1257894210-1075856346-012573477-2315\folderopen.exe

U:\autorun.inf

内容:
[autorun]
open=RECYCLERS-1-6-21-1257894210-1075856346-012573477-2315\folderopen.exe
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Open folder to view files
shell\open=Open
shell\open\command=RECYCLERS-1-6-21-1257894210-1075856346-012573477-2315\folderopen.exe
shell\open\default=1

与旧变种相似,病毒还具有破坏系统以下功能,不再赘述
禁用注册表编辑器，禁用任务管理器，禁止关闭系统,破坏安全模式

修改HOSTS

C:\WINDOWS\system32\drivers\etc\Hosts
127.0.0.1 msnfix.changelog.fr
127.0.0.1 [url]www.incodesolutions.com[/url]
127.0.0.1 baike.360.cn
127.0.0.1 virusinfo.prevx.com
127.0.0.1 download.bleepingcomputer.com
127.0.0.1 [url]www.dazhizhu.cn[/url]
127.0.0.1 [url]www.nabble.com[/url]
127.0.0.1 lurker.clamav.net
127.0.0.1 lexikon.ikarus.at
127.0.0.1 research.sunbelt-software.com
127.0.0.1 [url]www.virusdoctor.jp[/url]
127.0.0.1 [url]www.elitepvpers.de[/url]
127.0.0.1 [url]www.superuser.co.kr[/url]
127.0.0.1 ntfaq.co.kr
127.0.0.1 v.dreamwiz.com
127.0.0.1 cit.kookmin.ac.kr
127.0.0.1 forums.whatthetech.com
127.0.0.1 forum.hijackthis.de
127.0.0.1 [url]www.huaifai.go.th[/url]
127.0.0.1 [url]www.mostz.com[/url]
127.0.0.1 [url]www.krupunmai.com[/url]
127.0.0.1 [url]www.cddchiangmai.net[/url]
127.0.0.1 forum.malekal.com
127.0.0.1 tech.pantip.com
127.0.0.1 [url]www.247fixes.com[/url]
127.0.0.1 forum.sysinternals.com
127.0.0.1 forum.telecharger.01net.com
127.0.0.1 sophos.com
127.0.0.1 [url]www.f-secure.com[/url]
127.0.0.1 [url]www.chkrootkit.org[/url]
127.0.0.1 diamondcs.com.au
127.0.0.1 [url]www.rootkit.nl[/url]
127.0.0.1 [url]www.sysinternals.com[/url]
127.0.0.1 [url]www.castlecrops.com[/url]
127.0.0.1 [url]www.misec.net[/url]
127.0.0.1 safecomputing.umn.edu
127.0.0.1 [url]www.antirootkit.com[/url]
127.0.0.1 [url]www.greatis.com[/url]
127.0.0.1 [url]www.rootkit.com[/url]
127.0.0.1 [url]www.pctools.com[/url]
127.0.0.1 [url]www.pcsupportadvisor.com[/url]
127.0.0.1 [url]www.resplendence.com[/url]
127.0.0.1 [url]www.personal.psu.edu[/url]
127.0.0.1 vil.nail.comm
127.0.0.1 search.mcafee.com
127.0.0.1 wwww.mcafee.com
127.0.0.1 download.nai.com
127.0.0.1 wwww.experts-exchange.com
127.0.0.1 [url]www.Merijn.org[/url]
127.0.0.1 [url]www.spywareinfo.com[/url]
127.0.0.1 [url]www.spybot.info[/url]
127.0.0.1 [url]www.viruslist.com[/url]
127.0.0.1 [url]www.hijackthis.de[/url]
127.0.0.1 [url]www.f-secure.com[/url]
127.0.0.1 majorgeeks.com
127.0.0.1 [url]www.avp.com[/url]
127.0.0.1 [url]www.virustotal.com[/url]
127.0.0.1 [url]www.sophos.com[/url]
127.0.0.1 [url]www.avg-antivirus.net[/url]
127.0.0.1 [url]www.kaspersky-labs.com[/url]
127.0.0.1 [url]www.kaspersky.com[/url]
127.0.0.1 [url]www.bleepingcomputer.com[/url]
127.0.0.1 [url]www.free.grisoft.com[/url]
127.0.0.1 securityresponse.symantec.com
127.0.0.1 [url]www.analysis.seclab.tuwien.ac.at[/url]
127.0.0.1 [url]www.symantec.com[/url]
127.0.0.1 [url]www.kztechs.com[/url]
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 [url]www.mcafee.com[/url]
127.0.0.1 [url]www.free.avg.com[/url]
127.0.0.1 download.mcafee.com
127.0.0.1 mast.mcafee.com
127.0.0.1 guru0.grisoft.cz
127.0.0.1 guru1.grisoft.cz
127.0.0.1 guru2.grisoft.cz
127.0.0.1 guru3.grisoft.cz
127.0.0.1 guru4.grisoft.cz
127.0.0.1 guru5.grisoft.cz
127.0.0.1 [url]www.virusspy.com[/url]
127.0.0.1 [url]www.download.f-secure.com[/url]
127.0.0.1 [url]www.housecall.trendmicro.com[/url]
127.0.0.1 [url]www.avast.com[/url]
127.0.0.1 [url]www.free.avg.com[/url]
127.0.0.1 [url]www.onlinescan.avast.com[/url]
127.0.0.1 [url]www.futurenow.bitdefender.com[/url]
127.0.0.1 [url]www.bitdefender.com[/url]
127.0.0.1 [url]www.f-prot.com[/url]
127.0.0.1 [url]www.trendsecure.com[/url]
127.0.0.1 [url]www.avira.com[/url]
127.0.0.1 [url]www.eset.com[/url]
127.0.0.1 [url]www.free.avg.com[/url]
127.0.0.1 [url]www.free-av.com[/url]
127.0.0.1 [url]www.2-spyware.com[/url]
127.0.0.1 [url]www.antivir.es[/url]
127.0.0.1 [url]www.prevx.com[/url]
127.0.0.1 [url]www.ikarus.net[/url]
127.0.0.1 [url]www.forums.majorgeeks.com[/url]
127.0.0.1 [url]www.castlecops.com[/url]
127.0.0.1 [url]www.virusspy.com[/url]
127.0.0.1 andymanchesta.com
127.0.0.1 [url]www.trendmicro.com[/url]
127.0.0.1 [url]www.fortinet.com[/url]
127.0.0.1 [url]www.safer-networking.org[/url]
127.0.0.1 [url]www.fortiguardcenter.com[/url]
127.0.0.1 [url]www.firewallguide.com[/url]
127.0.0.1 [url]www.auditmypc.com[/url]
127.0.0.1 [url]www.spywaredb.com[/url]
127.0.0.1 [url]www.mxttchina.com[/url]
127.0.0.1 [url]www.antivirus.comodo.com[/url]
127.0.0.1 [url]www.spywareterminator.com[/url]
127.0.0.1 [url]www.eradicatespyware.net[/url]
127.0.0.1 [url]www.freespywareremoval.info[/url]
127.0.0.1 [url]www.clamav.net[/url]
127.0.0.1 [url]www.antivirus.about.com[/url]
127.0.0.1 [url]www.pandasecurity.com[/url]
127.0.0.1 [url]www.webphand.com[/url]
127.0.0.1 [url]www.sandboxie.com[/url]
127.0.0.1 [url]www.clamwin.com[/url]
127.0.0.1 [url]www.cwsandbox.org[/url]
127.0.0.1 [url]www.ca.com[/url]
127.0.0.1 [url]www.networkworld.com[/url]
127.0.0.1 [url]www.cddchiangmai.net[/url]
127.0.0.1 [url]www.threatexpert.com[/url]
127.0.0.1 [url]www.norman.com[/url]
127.0.0.1 virscan.org
127.0.0.1 [url]www.viruschief.com[/url]
127.0.0.1 scanner.virus.org
127.0.0.1 [url]www.hijackthis.de[/url]
127.0.0.1 hjt.networktechs.com
127.0.0.1 [url]www.techsupportforum.com[/url]
127.0.0.1 [url]www.whatthetech.com[/url]
127.0.0.1 [url]www.soccersuck.com[/url]
127.0.0.1 forum.piriform.com
127.0.0.1 [url]www.tweaksforgeeks.com[/url]
127.0.0.1 [url]www.daniweb.com[/url]
127.0.0.1 [url]www.geekstogo.com[/url]
127.0.0.1 [url]www.pchell.com[/url]
127.0.0.1 [url]www.spyany.com[/url]
127.0.0.1 forums.techguy.org
127.0.0.1 [url]www.experts-exchange.com[/url]
127.0.0.1 forum.tweaks.com
127.0.0.1 [url]www.wilderssecurity.com[/url]
127.0.0.1 [url]www.techspot.com[/url]
127.0.0.1 [url]www.thecomputerpitstop.com[/url]
127.0.0.1 [url]www.computing.net[/url]
127.0.0.1 discussions.virtualdr.com
127.0.0.1 forum.securitycadets.com
127.0.0.1 [url]www.techimo.com[/url]
127.0.0.1 [url]www.infosecpodcast.com[/url]
127.0.0.1 [url]www.usbcleaner.cn[/url]
127.0.0.1 [url]www.net-security.org[/url]
127.0.0.1 [url]www.bleedingthreats.net[/url]
127.0.0.1 zhidao.baidu.com
127.0.0.1 bbs.360safe.com
127.0.0.1 hjt-data.trend-braintree.com
127.0.0.1 [url]www.360.cn[/url]
127.0.0.1 [url]www.baidu.com[/url]
127.0.0.1 [url]www.360safe.com[/url]
127.0.0.1 [url]www.lavasoft.com[/url]
127.0.0.1 [url]www.virscan.org[/url]
127.0.0.1 file.ikaka.com
127.0.0.1 [url]www.pantip.com[/url]
127.0.0.1 secubox.aldria.com
127.0.0.1 [url]www.forospyware.com[/url]
127.0.0.1 [url]www.siteadvisor.com[/url]
127.0.0.1 blog.threatfire.com
127.0.0.1 [url]www.threatexpert.com[/url]
127.0.0.1 blog.hispasec.com
127.0.0.1 bbs.ikaka.com
127.0.0.1 [url]www.ikaka.com[/url]
127.0.0.1 bbs.cfan.com.cn
127.0.0.1 [url]www.cfan.com.cn[/url]
127.0.0.1 mailcenter.rising.com.cn
127.0.0.1 mailcenter.rising.com
127.0.0.1 [url]www.rising.com.cn[/url]
127.0.0.1 [url]www.rising.com[/url]
127.0.0.1 sosvirus.changelog.fr
127.0.0.1 upload.changelog.fr
127.0.0.1 [url]www.raymond.cc[/url]
127.0.0.1 changelog.fr
127.0.0.1 [url]www.final4ever.com[/url]
127.0.0.1 files.filefont.com
127.0.0.1 [url]www.infos-du-net.com[/url]
127.0.0.1 [url]www.trendsecure.com[/url]
127.0.0.1 [url]www.spychecker.com[/url]
127.0.0.1 [url]www.geekstogo.com[/url]
127.0.0.1 forums.maddoktor2.com
127.0.0.1 [url]www.smokey-services.eu[/url]
127.0.0.1 download.sysinternals.com
127.0.0.1 [url]www.pcguide.com[/url]
127.0.0.1 [url]www.thetechguide.com[/url]
127.0.0.1 [url]www.ozzu.com[/url]
127.0.0.1 down.360safe.com
127.0.0.1 baike.360.cn
127.0.0.1 kaba.360.cn
127.0.0.1 hi.baidu.com
127.0.0.1 bbs.kafan.cn
127.0.0.1 bbs.kpfans.com
127.0.0.1 bbs.taisha.org
127.0.0.1 [url]www.baidu.cn[/url]
127.0.0.1 dl.360safe.cn
127.0.0.1 updatem.360safe.com
127.0.0.1 update.360safe.com
127.0.0.1 dl.360safe.com
127.0.0.1 community.thaiware.com
127.0.0.1 x.360safe.com
127.0.0.1 x.360safe.cn
127.0.0.1 [url]www.avpclub.ddns.info[/url]
127.0.0.1 [url]www.msnvirusremoval.com[/url]
127.0.0.1 [url]www.cisrt.org[/url]
127.0.0.1 fixmyim.com
127.0.0.1 samroeng.hi5.com
127.0.0.1 forums.techguy.org
127.0.0.1 [url]www.incodesolutions.com[/url]
127.0.0.1 hijackthis.download3000.com
127.0.0.1 [url]www.cybertechhelp.com[/url]
127.0.0.1 downloads.andymanchesta.com
127.0.0.1 andymanchesta.com
127.0.0.1 info.prevx.com
127.0.0.1 aknow.prevx.com
127.0.0.1 [url]www.offensivecomputing.net[/url]
127.0.0.1 [url]www.grisoft.com[/url]

下载病毒更新副本地址又作变更:

http://milson.net/instal**/s2.exe
http://maxmurdok.com/i**/d2.exe
http://www.studiegroepmetselen.nl/components/com_sef/c***/0x04.exe