P2P-Worm.Win32.Delf.ao简单分析及解决

●文件运行后在其所在目录复制自身，并命名为useit.exe，同时在目录%windir%\ssl下疯狂建立ZIP包裹文件复制自身，压缩方式采用为“存储”，这是最低的压缩格式，目的是迅速占用硬盘资源。 y7puXH[<  
生成的文件名可能为： kv>3"q<i:  
Visual_C++_Crack.zip zLN_h$.g  
Kazaa_Plus.zip V%u2O*j  
Porn_Napster.zip ]|[Ulei  
Mp3_Finder.zip xEW)9  
Msn_Crack.zip VH R<@~]  
Yahoo_hacker.zip PWo[!4YJ1  
Msn_Hacker.zip J:D'N~4  
Delphi_7_Crack.zip +&xx$^Q  
Delphi_8_Crack.zip |.-qTHd(Vg  
HalfLife_keygen.zip Ova#\K="-  
CounterStrike_Keygen.zip ^m${{ih  
WinXp_Crack.zip )<2-OoN}  
WinXp_keygen.zip 9(xeJyz  
mirc_6.2_Patch.zip ydCV
1  
Email_Cracker.zip IY: [ed?t  
Maria_Carey.zip >trw/5}_  
Jeniifer_Lopez.zip z&eQ
~!J  
Fifa_2005_Demo.zip cBE1P3J  
Mailbomber.zip WxXV{9-  
Email_harvester.zip am$5 :  
Spam_Blocker.zip 9iFP#ZZ  
Mail_Spammer.zip fsk*20;0  
Half_Life_2_Keygen.zip /(9`E7f  
Mirc_Scripter.zip ?<aE%*+/C  
Mp3_Search.zip !o$_-qXS  
Sex_Harvester.zip QZ m=$%"  
ZoneAlaram_Crack.zip ~9QUu7XI  
Sygate_Crack.zip 7Q{{'Pi4  
Kaspersky_Crack.zip 5+6mK)l  
Mcafee_8_Crack.zip f1)y\k#8C  
Mcafee_7_Crack.zip oKx -G@  
Norton_Antivirus_Crack.zip NXF$]!N'  
NAV_2004_Crack.zip }yD6;Q[)S  
Pcillin_Crack.zip u M$cpx  
RPC_Patch.zip x`?i*>X`  
Hack_mail.zip ?tc.-BC)\  
Registry_Fixer.zip ua]4<&  
Adobe_Photoshop_Keygen.zip w}l}hb7u  
Adobe_All_versions_keygen.zip E/a0Y OE  
Windows_All_versions_keygen.zip YdNI+;ag  
Lesbian_Stars.zip <I/h>h9  
britney_Spears_Screen.zip q,'Xc'n?  
Celebrities_Screensaver.zip  9FB  
Pamela_Anderson_Screen.zip oSjLyr\Qh  
Mirc_Flooder.zip <GoI2CjD  
Hack_Networks.zip xb[[6*[  
Webcam_Napster.zip D7,!m-5  
Yahoo_Flooder.zip ckU4D>Rt  
Msn_Crasher.zip v&:4ZO_/  
Yahoo_crasher.zip |,hur8BE\  
Call_of_duty_crack.zip c/2N1x"t#  
Red_Alert_3_Cheats.zip n"5Kx5]f  
AIM_Cracker.zip /SR*<yI7f  
Credit_Cards_Generator.zip <B<l%:l,  
Photo_Impact_Crack.zip 6:s#E?X2Z  
Acdsee_Crack.zip 7Y ZujzkT  
host_faker.zip a%qa"y0BW%  
host_spoofer.zip "y,;Xe [  
ip_spoofer.zip kF.5qt {Dc  
ip_faker.zip n[%sE  
ident_spoofer.zip 4ziO5rWGH  
ident_faker.zip
<0 9s  
tripod_hacker.zip Qo)5P~h*-  
tripod_cracker.zip Aq{igAqx'  
hotmailhacker.zip *;A2muHYV  
hotmailcracker.zip .dPnY?c  
hotmail_account_sniffer.zip ~_>:9^<  
aimhacker.zip ^p
12]Qc  
aimcracker.zip +VV_)^(2!  
icqhacker.zip l;C8BFpd  
icqcracker.zip >r6}~jN8  
msnhacker.zip ru!M]pY;  
msncracker.zip 4m?#\BdK  
winxp_hacker_.zip &)r+:!&l  
winxp_cracker.zip oQFL=#P6  
winxphack.zip ?&Zs5o  
win2k_serial.zip :MRxSl  
yahoo_cracker.zip %[Drzi9;  
divx_fix.zip &0k^Sf|S  
divx_repair.zip Te~wu*I6  
ftp_hacker.zip 9=CBs9v?  
ftp_cracker.zip ">1NongKGj  
porn_account_hacker.zip OHQ>0_:  
porn_account_cracker.zip .9n3>vl78  
catherine_zeta_jones_nude.zip M,-#n=@  
catherine_zeta_jones_naked.zip 0pLIO  
catherine_zeta_jones_anal.zip eZOs^ rQ}%  
pamela_anderson_anal.zip =i68{vj"  
pamela_anderson_nude.zip *E(DJXp  
pamela_anderson_naked.zip V3<6{ue*@  
buttman.zip e\t\7U8  
sarah_michelle_gellar_nude.zip h[ym5tm  
sarah_michelle_gellar_naked.zip g3fI-F$  
sandra_bullock_nude.zip |).Ma.bk@  
sandra_bullock_naked.zip :.EQB|  
anastasia_anal.zip QJCB`f  
anastasia_naked.zip 7Iwn)17
  
anastasia_nude.zip rb*%9A  
shakira_anal_.zip Q"/1Y|H  
shakira_assfucked.zip EWVC:o-  
shakira_naked.zip ^"sgC.Nu  
shakira_nude.zip h>_ENe\  
shakira_paparazzi_collection.zip >B>3f  
XP_keygen.zip eBqaZ@=  
PS2_emulator_bleem.zip orLGM/4O<W  
xbox_emulator_beta.zip v{HOO B  
linux_root.zip jYIZfZcC%  
win2k_pass_decryptor.zip I+{4_wKog  
Win2k_reboot_exploit.zip /j@9&\ .v  
IIS_shellbind_exploit.zip |[cJ!V;Ds[  
AdvZip_Recovery.zip Ll%]g)oHj  
AIM_Pass_stealer.zip j W_q?hi8  
AMI_BIOS_Cracker.zip 0?J{9?O  
Counter_Strike_CD_Keygen.zip $`@ fXs  
Delphi_5_Keygen.zip l1eN,e&  
Delphi_6_Keygen.zip (
$W  
Half_life_Cd_keygen.zip h!m6 5E3  
Hotmail_Hacker.zip Uqn?@&K}  
ICQ_Hackingtools.zip DEG2cZU"  
invisible_IP.zip &j#lTFWhU6  
kazaa.zip U
W67$n<  
edonkey_serverlist.zip uEgx"_Gs;  
kmd151_en.zip =gF.(%p  
Linux_rootaccess.zip wed[s)3w  
msn_IP_finder.zip mN,nQt9P|  
Office_key_Gen.zip Y7C\(9s  
Autocad_2002_Crack.zip %LZAT4-  
HttpTunnel_Keygen.zip 424/p6l-H  
Winrar_Crack.zip xTj~*Z@.<j  
Winrar_Keygen.zip  D/FX  
Winzip_Keygen.zip !U5>$h  
Winzip_Crack.zip 5]]I
]$8  
Mirc_Crack.zip - sLBn  
mydoom_Scanner.zip =;6nlrX  
Netbios_Cracker.zip N,77?IiH._  
Irc_Flooder.zip ]8L4\*c~  
MSN_7.3.zip &RW> ={ypW  
MSN_PLUS_3.zip QN|4La~  
filename.exe O)WuK>;;  
useit.exe   B4&%)2  
,!#>{Z0  
●程序试图连接网络 !jq'=;(R  

9ePz5  
h4%:zzv
 
●更改注册表 i \q$Z  
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] dOpyhL  
"startup"="C:\\WINXP\\ssl\\filename.exe" /\ k6FbSZ  
#6ag)M))  
清除方法： =JmLQR9Vn  
使用Ctrl+Alt+Del终止filename进程，清理注册表，删除SSL目录即可。 ]cxM:ME  
6R-D].@F  
相关链接： q.'It$</V  
http://avfbbs.80port.net/read.php?tid=1221&fpage=2&toread=1