P2P-Worm.Win32.Delf.ao简单分析及解决

●文件运行后在其所在目录复制自身，并命名为useit.exe，同时在目录%windir%\ssl下疯狂建立ZIP包裹文件复制自身，压缩方式采用为“存储”，这是最低的压缩格式，目的是迅速占用硬盘资源。 i`@q a[w|  
生成的文件名可能为： v9_.i~Nl8  
Visual_C++_Crack.zip  u77/sj  
Kazaa_Plus.zip L&a2;u%t#'  
Porn_Napster.zip 'Ckv-<%%  
Mp3_Finder.zip Q2mRL- z  
Msn_Crack.zip fnmQEj/%2  
Yahoo_hacker.zip @>l88  
Msn_Hacker.zip p;p&)  
Delphi_7_Crack.zip ^4jf7GHWF  
Delphi_8_Crack.zip ()/"(Hz6S  
HalfLife_keygen.zip %$IeJqFE  
CounterStrike_Keygen.zip 9cJ'FrB  
WinXp_Crack.zip ^k_1lySm#  
WinXp_keygen.zip |@V$hz,:.  
mirc_6.2_Patch.zip
gRl7FL  
Email_Cracker.zip U!I.'6-x  
Maria_Carey.zip  NV ]N^N  
Jeniifer_Lopez.zip _;O#~!h*Oe  
Fifa_2005_Demo.zip M1:>0LrTCe  
Mailbomber.zip |sC3ocN0  
Email_harvester.zip >rP.jGr=/  
Spam_Blocker.zip 0t`:%Fk5  
Mail_Spammer.zip (v{~5%{S]  
Half_Life_2_Keygen.zip `,|:aXg  
Mirc_Scripter.zip p:F`K  
Mp3_Search.zip V\~w [(By  
Sex_Harvester.zip >vf)Er  
ZoneAlaram_Crack.zip wB%ADVH3  
Sygate_Crack.zip |phI 6T  
Kaspersky_Crack.zip Z`O`iG1vh  
Mcafee_8_Crack.zip .rHEW2 %  
Mcafee_7_Crack.zip PWuhBpU  
Norton_Antivirus_Crack.zip $'\5<L,AM  
NAV_2004_Crack.zip <&ixdVO
 
Pcillin_Crack.zip LqZY,  
RPC_Patch.zip v>o:EC  
Hack_mail.zip kF\'ab  
Registry_Fixer.zip ;c0E%vy  
Adobe_Photoshop_Keygen.zip t,'d/J ,  
Adobe_All_versions_keygen.zip $xfo!bi5  
Windows_All_versions_keygen.zip /8p(o 5EFf  
Lesbian_Stars.zip T0sRrlrG  
britney_Spears_Screen.zip &G&8zW8cu  
Celebrities_Screensaver.zip aMuhT  
Pamela_Anderson_Screen.zip V@&nS{~  
Mirc_Flooder.zip bd(YW+2NR^  
Hack_Networks.zip O ux"~H  
Webcam_Napster.zip 9yE80k_R  
Yahoo_Flooder.zip N)hayU"v(  
Msn_Crasher.zip [6mo !t4~  
Yahoo_crasher.zip `;eB'nZ  
Call_of_duty_crack.zip u}?`xf_!  
Red_Alert_3_Cheats.zip 1s#l\lnu[  
AIM_Cracker.zip wZzV.~U3;  
Credit_Cards_Generator.zip ~Hli<WrjgX  
Photo_Impact_Crack.zip 5whJzH  
Acdsee_Crack.zip ?08BL<B  
host_faker.zip U(9Wh-W  
host_spoofer.zip 3+PcU!1ZF  
ip_spoofer.zip F#gTG~W  
ip_faker.zip O/MoDy7/  
ident_spoofer.zip JH<f_a  
ident_faker.zip .~ x"$*  
tripod_hacker.zip >M"7daV  
tripod_cracker.zip qoWS48t;  
hotmailhacker.zip !T <FL
^9  
hotmailcracker.zip \zM]<Q`  
hotmail_account_sniffer.zip =82T`o}  
aimhacker.zip E$ez'u  
aimcracker.zip e/kyH  
icqhacker.zip }(}tMWmr  
icqcracker.zip "|T]na}  
msnhacker.zip :~!.}jMgr
 
msncracker.zip O/inHl^  
winxp_hacker_.zip
Xc_eg+Ub  
winxp_cracker.zip k ##Dl>ep  
winxphack.zip F*YB  
win2k_serial.zip ;!45T=S(2  
yahoo_cracker.zip wqo>"RRb  
divx_fix.zip (W
cQG$Ue=  
divx_repair.zip '/=2P]65  
ftp_hacker.zip I#cY:@/  
ftp_cracker.zip fr\NS<~u  
porn_account_hacker.zip v>J72RX?*  
porn_account_cracker.zip
c1qxY}a  
catherine_zeta_jones_nude.zip o/EZ;JJZg  
catherine_zeta_jones_naked.zip `S#){ #
?  
catherine_zeta_jones_anal.zip noONzR4d  
pamela_anderson_anal.zip /.~OZ}WV  
pamela_anderson_nude.zip TB-^Gl>f  
pamela_anderson_naked.zip (?Y,Jc?#  
buttman.zip p[h2?M  
sarah_michelle_gellar_nude.zip }c%p;,50  
sarah_michelle_gellar_naked.zip (4K
UFuXx  
sandra_bullock_nude.zip X nsW^6^  
sandra_bullock_naked.zip \!{U)2\(`  
anastasia_anal.zip {?Axkn)  
anastasia_naked.zip R'ZZ.|D{  
anastasia_nude.zip PoSCAdz  
shakira_anal_.zip O.4iPa8  
shakira_assfucked.zip X{4J~D*`_
 
shakira_naked.zip !'6@6D<.  
shakira_nude.zip *xOlRSIsT  
shakira_paparazzi_collection.zip ,XM=OFh^,  
XP_keygen.zip  yJa<D C  
PS2_emulator_bleem.zip PLH( `  
xbox_emulator_beta.zip w#&5Ntvms  
linux_root.zip e+^`wN\  
win2k_pass_decryptor.zip c IH=5>  
Win2k_reboot_exploit.zip /;}j6y^M  
IIS_shellbind_exploit.zip 4v&jqA  
AdvZip_Recovery.zip #-ve8/  
AIM_Pass_stealer.zip T`@K-wt}  
AMI_BIOS_Cracker.zip z2VTWHu  
Counter_Strike_CD_Keygen.zip Q_{9vP  
Delphi_5_Keygen.zip 8lJ2m<8  
Delphi_6_Keygen.zip d9d`?yf7  
Half_life_Cd_keygen.zip hiPi q  
Hotmail_Hacker.zip q~F,h}m  
ICQ_Hackingtools.zip ;"DaQOWg  
invisible_IP.zip Jt-KjWR  
kazaa.zip UqTLUT  
edonkey_serverlist.zip TPWu^{A  
kmd151_en.zip y?qt[qha  
Linux_rootaccess.zip f @A>o/P)  
msn_IP_finder.zip RDrDhDs  
Office_key_Gen.zip OeC?sS{R  
Autocad_2002_Crack.zip ')#j  
HttpTunnel_Keygen.zip 5j"FS-5  
Winrar_Crack.zip %`.<  
Winrar_Keygen.zip 9Rudu=~!Mr  
Winzip_Keygen.zip 9?)aI2hTc  
Winzip_Crack.zip Z.Q'9  
Mirc_Crack.zip c0cu9=(
N  
mydoom_Scanner.zip j]+d(PN3  
Netbios_Cracker.zip ,J~.8VQ
 
Irc_Flooder.zip  2xbVT:  
MSN_7.3.zip y,r89#X:@  
MSN_PLUS_3.zip p4?a-kD  
filename.exe @,QLZM'  
useit.exe   Gl;wy&]#  
`$e. O3  
●程序试图连接网络 .yzpMJ-"  

f{DK:Cd+6g  
pF((PCK  
●更改注册表 |,q7?"G7v  
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] #tM;fQ  
"startup"="C:\\WINXP\\ssl\\filename.exe" -4c2edW  
97C?m-  
清除方法： wkLZg4z_  
使用Ctrl+Alt+Del终止filename进程，清理注册表，删除SSL目录即可。 ajLREb-QO  
`YaLn,0F  
相关链接： pV4R  
http://avfbbs.80port.net/read.php?tid=1221&fpage=2&toread=1