病毒行为：
该病毒是一个下载木马。它会下载并安广告软件。建议电脑用户升级病毒库查杀该病毒，以免中毒受害。

1、生成的文件
C:\Documents and Settings\All Users\Templates\temp.exe
C:\Program Files\Common Files\System\Update.dat
C:\Program Files\Common Files\System\Update.exe
C:\WINNT\system32\rundllfromwin2000.exe
C:\WINNT\system32\wbem\ocmor.dll
C:\WINNT\system32\wbem\mnevno40.dll
C:\WINNT\system32\Score.txt
C:\WINNT\system32\advport.dll
C:\WINNT\system32\tbcaqm26.dll
C:\Documents and Settings\administrator\Favorites\多特软件站-最安全放心的软件站.url

2、添加注册表启动项
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"System" = "C:\Program Files\Common Files\System\Update.exe"

3、添加伪系统服务和驱动
HKLM\System\CurrentControlSet\Services\DATEING
"Type" = "0x10"
HKLM\System\CurrentControlSet\Services\DATEING
"Start" = "0x2"
HKLM\System\CurrentControlSet\Services\DATEING
"ImagePath" = "C:\WINNT\SYSTEM32\RUNDLLFROMWIN2000.EXE C:\WINNT\SYSTEM32\WBEM\MNEVNO40.DLL,Export 1087"

HKLM\System\CurrentControlSet\Services\paraudio
"Type" = "0x1"
HKLM\System\CurrentControlSet\Services\paraudio
"Start" = "0x2"
HKLM\System\CurrentControlSet\Services\paraudio
"ImagePath" = "\??\C:\WINNT\system32\drivers\paraudio.sys"
HKLM\System\CurrentControlSet\Services\paraudio
"DisplayName" = "paraudio"

HKLM\System\CurrentControlSet\Services\License
"Type" = "0x20"
HKLM\System\CurrentControlSet\Services\License
"Start" = "0x2"
HKLM\System\CurrentControlSet\Services\License
"ImagePath" = "%SystemRoot%\System32\svchost.exe -k netsvcs"
HKLM\SYSTEM\CurrentControlSet\Services\License
"DisplayName" = "Windows Gateway"
HKLM\SYSTEM\CurrentControlSet\Services\License
"Description" = "防火墙保护机制，为 Internet 连接共享和 Windows 防火墙提供高效的保护支持。无法终止此服务。"
HKLM\SYSTEM\CurrentControlSet\Services\License
"Parameters" = ServiceDll"C:\WINNT\system32\tbcaqm26.dll"

5、添加注册表信息
HKCU\SOFTWARE\Microsoft\Internet Explorer\typedUrls
"url5" = "http://www.3839.com/index.html"

6、添加卸载程序，实则并不存在卸载
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\coolsign
"DisplayName" = "CoolSign"
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\coolsign
"UninstallString" = "C:\Program Files\coolsign\uninst.exe"