Win32.troj.gamania.a

Virus name (in Chinese):

Virus alias:

Threat Level: ★☆☆☆☆

Virus type: Trojan Horse program

Virus Length: 36352

Impact System: WIN9X\WINME\WINNT\WIN2000\WINXP\WIN2003

Virus behavior:

The virus is a Trojan carrier, it runs the first release to steal the Heaven password Trojan win32.troj.lineage.be.20480, and every time the boot, load run the Trojan, to bring serious losses to users. The virus runs a characteristic: it shuts down some antivirus software and firewalls that are running.

1, generating files

%system%\msdns.exe

%system%\htdll.dll

2, add a registry key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Windowsautoupdata= "%system%\msdns.exe"

3, shutting down the process

Skynet Firewall Personal Edition

Skynet Firewall Enterprise Edition

Phage

ZoneAlarm

Eghost. Exe

Mailmon. Exe

Kavpfw. Exe

Iparmor. Exe

RavMon.exe