該病毒是一個(gè)木馬下載者。病毒運(yùn)行后會(huì)修改注冊(cè)表增加啟動(dòng)項(xiàng)，當(dāng)病毒運(yùn)行后會(huì)通過網(wǎng)絡(luò)下載其它的木馬文件至本機(jī)并執(zhí)行。

1.添加文件
%Windir%\syscheck.exe

2.修改注冊(cè)表增加啟動(dòng)項(xiàng)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KernelFailCheck "%Windir%\syscheck.exe"

3.創(chuàng)建和病毒源文件名字相同的進(jìn)程.

4.該病毒會(huì)從以下的地址當(dāng)中下載其他的木馬文件并運(yùn)行:
http://new.******99.com/ma/0.exe
http://new.******99.com/ma/1.exe
http://new.******99.com/ma/2.exe
http://new.******99.com/ma/3.exe
http://new.******99.com/ma/4.exe
http://new.******99.com/ma/5.exe
http://new.******99.com/ma/6.exe
http://new.******99.com/ma/7.exe
http://new.******99.com/ma/8.exe
http://new.******99.com/ma/9.exe
http://new.******99.com/ma/10.exe
http://new.******99.com/ma/11.exe
http://new.******99.com/ma/12.exe
http://new.******99.com/ma/13.exe
http://new.******99.com/ma/14.exe
http://new.******99.com/ma/15.exe
http://new.******99.com/ma/16.exe
http://new.******99.com/ma/17.exe
http://new.******99.com/ma/18.exe
http://new.******99.com/ma/19.exe