不好意思，上面是还没写完手误发帖了。
mms.exe的路径是在system32里面。
在临时文件夹里面也有一个，不过好像一删它，它就消失。
这个木马是指向一个网站：
http://my.51robot.info/mms.exe从这个地址就可以下载到样本。各位小心。
PS: 不知道是哪个贱人注册的网址。NND，专门注册个网址来放病毒。
51robot.info的详细信息：
Access to INFO WHOIS information is provided to assist persons in
determining the contents of a domain name registration record in the
Afilias registry database. The data in this record is provided by
Afilias Limited for informational purposes only, and Afilias does not
guarantee its accuracy. This service is intended only for query-based
access. You agree that you will use this data only for lawful purposes
and that, under no circumstances will you use this data to: (a) allow,
enable, or otherwise support the transmission by e-mail, telephone, or
facsimile of mass unsolicited, commercial advertising or solicitations
to entities other than the data recipient's own existing customers; or
(b) enable high volume, automated, electronic processes that send
queries or data to the systems of Registry Operator, a Registrar, or
Afilias except as reasonably necessary to register domain names or
modify existing registrations. All rights reserved. Afilias reserves
the right to modify these terms at any time. By submitting this query,
you agree to abide by this policy.
Domain ID:D27374306-LRMS
Domain Name:51ROBOT.INFO
Created On:07-Jan-2009 16:23:27 UTC
Last Updated On:07-Jan-2009 16:23:29 UTC
Expiration Date:07-Jan-2010 16:23:27 UTC
Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:GODA-057754607
Registrant Name:Leefox Cao
Registrant Organization:
Registrant Street1:Weyi Road
Registrant Street2:
Registrant Street3:
Registrant City:Jinglan
Registrant State/Province:Joint
Registrant Postal Code:220099
Registrant Country:CN
Registrant Phone:+86.6028877663
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:leefox.s@gmail.com
Admin ID:GODA-257754607
Admin Name:Leefox Cao
Admin Organization:
Admin Street1:Weyi Road
Admin Street2:
Admin Street3:
Admin City:Jinglan
Admin State/Province:Joint
Admin Postal Code:220099
Admin Country:CN
Admin Phone:+86.6028877663
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:leefox.s@gmail.com
Billing ID:GODA-357754607
Billing Name:Leefox Cao
Billing Organization:
Billing Street1:Weyi Road
Billing Street2:
Billing Street3:
Billing City:Jinglan
Billing State/Province:Joint
Billing Postal Code:220099
Billing Country:CN
Billing Phone:+86.6028877663
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email:leefox.s@gmail.com
Tech ID:GODA-157754607
Tech Name:Leefox Cao
Tech Organization:
Tech Street1:Weyi Road
Tech Street2:
Tech Street3:
Tech City:Jinglan
Tech State/Province:Joint
Tech Postal Code:220099
Tech Country:CN
Tech Phone:+86.6028877663
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:leefox.s@gmail.com
Name Server:NS27.DOMAINCONTROL.COM
Name Server:NS28.DOMAINCONTROL.COM
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
