病毒名称：Trojan-Downloader.Win32.Injecter.n（Kaspersky）
病毒别名：
病毒大小：60,928 字节
加壳方式：
样本MD5：b18cc1ed9eac567af78e58f769b2e813
样本SHA1：778ebe85b2c32020019484502489295991061286
发现时间：2007.9
更新时间：2007.9.27
关联病毒：
传播方式：通过MSN传播
MSN病毒变种很多，前面我们也分析了不少大家可以在www.newjian.com MSN病毒栏目搜索看看！
技术分析
==========
MSN蠕虫病毒变种，传播方式同以往相同，向MSN联系人发送诱惑文字消息和带毒压缩包，诱使联系人接收并打开。在病毒压缩包文件的生成位置等方面，这次有了新的变化。
病毒运行后在系统目录生成副本：
%System%\nvsvc64.exe
创建启动项：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nVidia Display Driver"="nvsvc64.exe"
访问网络下载自身更新并保存到临时目录%temp%下，并生成包含自身的zip压缩包，文件名格式为image{数字}.zip，比如：image41.zip，内含文件名image41.JPG-www.photosmart.com。
访问网络下载文本信息，文本信息的内容就是病毒向MSN联系人发送的诱惑文字信息：
QUOTE:
This picture isnt you... right?
Wow i think i found your pic on myspace!
hah I think I found an old pic of us!
haha lets hope your parents dont see this picture of you :D
hey did i ever show you this picture of me?
is it ok if I add this pic to my new slideshow?
can i up some of these pics of ya to my myspace profile?
you care if i put this pictuer of you in my new album?
sry about the messup i fixed the pic! Try it one more time pz
is this pic tooo sexy for photobucket??
wow I just dyed my hair... You will never believe the color it is now. lol And dont laugh
my crazy sister wants u to see these pics for some reason... take a look
OMFG!!!!!!!! :D
wow! look at this old picture i found....
wanna see this pic of my Boobs?
Can i put this pic of you into my new myspace album?
Take a look at the new pics already! :p
I cant believe they wanted me to upload this picture to facebook lol. Its terrible. Like my outfit tho?
Lmfao hey im sending my new pictures! Check em out!
I''ve been editing some pics you should def see em loL! accept :)
Can you believe somone actually wears this size bra? I could use it for a Tent.
haha, this guy up my street just slammed his $90k car into a telephone pole! I got a pic of it with my cellphone
dude i just got these pictures off my digital for you! Gimme a moment to find em and send
Wanna see my pics before i send em to facebook?
do you think this picture is too kinky for Myspace?
OMG just accept please its only some pics!!
Hey accept my pictures, i got a bunch from when i was like a toddler :X
I think this picture is terrible. but my friends on myspace want to see it. please dont show noone.
Hey just finished new myspace album! :) theres a few kinky ones in there!
OMG, i found ur pic on cuteornot.com! Check it out!!!
Have you seen me Naked Yet :D
ok, I DO NOT like my new hair color.. but people on facebook do. what do you think? And no laughing! lol
hey you got a myspace album? anyways heres my new myspace album :) accept k?
do I look dumb in this picture? I want to put it on myspace.
hey man accept my pics. :( i just edited it to look maad funny..
Dude i found your picture on hotornot.com! Take a look!
清除步骤
==========
1. 删除病毒创建的自启动项：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nVidia Display Driver"="nvsvc64.exe"
2. 重新启动计算机
3. 删除病毒文件：
%System%\nvsvc64.exe
%temp%\image??.zip
%temp%\??.exe
您的位置: