P2P-Worm.Win32.Delf.ao简单分析及解决

●文件运行后在其所在目录复制自身，并命名为useit.exe，同时在目录%windir%\ssl下疯狂建立ZIP包裹文件复制自身，压缩方式采用为“存储”，这是最低的压缩格式，目的是迅速占用硬盘资源。 $Zcoap  
生成的文件名可能为： 21{vldh  
Visual_C++_Crack.zip 1xyox}%Ek  
Kazaa_Plus.zip 0O9~0Z-  
Porn_Napster.zip kL_<7'Cw  
Mp3_Finder.zip -_w5W.!;  
Msn_Crack.zip X5%j(AMB-+  
Yahoo_hacker.zip g I^\C  
Msn_Hacker.zip 2\s`w.H  
Delphi_7_Crack.zip sTdW[T  
Delphi_8_Crack.zip <b='kz<&  
HalfLife_keygen.zip /i7@OW&  
CounterStrike_Keygen.zip A>0"6%  
WinXp_Crack.zip 3ig)FsV};  
WinXp_keygen.zip 1O|*DRUJ  
mirc_6.2_Patch.zip 8-Z{}7^3  
Email_Cracker.zip Eg8+  
Maria_Carey.zip )B/W,J6Oq  
Jeniifer_Lopez.zip `^Pyv|NE  
Fifa_2005_Demo.zip ]'W^t@2&  
Mailbomber.zip 2.uMY$2~+"  
Email_harvester.zip t;DW6Pw
 
Spam_Blocker.zip GW3kfqJ  
Mail_Spammer.zip KZ|TQxmQ  
Half_Life_2_Keygen.zip Y5#@G/  
Mirc_Scripter.zip .<=xt<k)\  
Mp3_Search.zip Xtx"d2/  
Sex_Harvester.zip 5^U*[(211  
ZoneAlaram_Crack.zip -Z 6d  
Sygate_Crack.zip >b)h:F'ei  
Kaspersky_Crack.zip M,d{=R8  
Mcafee_8_Crack.zip A
B<ak  
Mcafee_7_Crack.zip RO)MVRdiF  
Norton_Antivirus_Crack.zip VpuPO\VQ  
NAV_2004_Crack.zip aO}2Cq2r  
Pcillin_Crack.zip V>3c}Sz9  
RPC_Patch.zip ^MUcpP,f  
Hack_mail.zip LuBe$7{  
Registry_Fixer.zip %qZG6-}l  
Adobe_Photoshop_Keygen.zip 083pR&.  
Adobe_All_versions_keygen.zip CRz51 =M  
Windows_All_versions_keygen.zip EO|z9V,jTQ  
Lesbian_Stars.zip ?15LeK{HJ  
britney_Spears_Screen.zip $IBGflkd  
Celebrities_Screensaver.zip t\;F8<t  
Pamela_Anderson_Screen.zip + @(5L1  
Mirc_Flooder.zip ^bQ79(K  
Hack_Networks.zip Xkwk FQ;r  
Webcam_Napster.zip 5Ciy_/d  
Yahoo_Flooder.zip G1WC)+Z;  
Msn_Crasher.zip |Qm/N  
Yahoo_crasher.zip O-+5 *T$  
Call_of_duty_crack.zip SG|/+oMAM  
Red_Alert_3_Cheats.zip 0kw(Jp  
AIM_Cracker.zip D5r?aD  
Credit_Cards_Generator.zip #S6%f
U%  
Photo_Impact_Crack.zip UO[m/3Fs  
Acdsee_Crack.zip OLySArtx  
host_faker.zip 7??,KZe#  
host_spoofer.zip ad S
'V*  
ip_spoofer.zip k%E-0@7  
ip_faker.zip [jvt@{  
ident_spoofer.zip x4/T.C_"C  
ident_faker.zip TDq"An4U  
tripod_hacker.zip >c>*.qdp  
tripod_cracker.zip t [[V4  
hotmailhacker.zip N7,a7:o~l  
hotmailcracker.zip ]-+guV  
hotmail_account_sniffer.zip /=-B, /Fn  
aimhacker.zip L|2ZC  
aimcracker.zip +0XkK  
icqhacker.zip I:NIKtw  
icqcracker.zip b?NxJ  
msnhacker.zip mpZ_ `l7Q  
msncracker.zip }5A"HPovx  
winxp_hacker_.zip *t{J$'xy  
winxp_cracker.zip Ie" @2?t7  
winxphack.zip [LUyHu~B  
win2k_serial.zip 3qrJ*Xvd  
yahoo_cracker.zip &htNnse(  
divx_fix.zip ml`>x^*W  
divx_repair.zip Q52)a`(  
ftp_hacker.zip E*;G.XE$N  
ftp_cracker.zip I%t}"&ria  
porn_account_hacker.zip (L~U]_Im  
porn_account_cracker.zip 5~7(y6  
catherine_zeta_jones_nude.zip oQ%K/~P
 
catherine_zeta_jones_naked.zip ?u@W2}8ph3  
catherine_zeta_jones_anal.zip iIlq?Z=  
pamela_anderson_anal.zip KY4e*<rV  
pamela_anderson_nude.zip >Kmj0  
pamela_anderson_naked.zip Tf+$w>CI^  
buttman.zip 3uzkd1 j9q  
sarah_michelle_gellar_nude.zip )Zx$5zXr  
sarah_michelle_gellar_naked.zip 5*z*(WtvV  
sandra_bullock_nude.zip \2*&BqpV;  
sandra_bullock_naked.zip Q_h!JPr"  
anastasia_anal.zip uNSDs6 ~!q  
anastasia_naked.zip }}!`]h[!L4  
anastasia_nude.zip g[* |  
shakira_anal_.zip S20}M}v.1  
shakira_assfucked.zip Qp`H0]  
shakira_naked.zip hz NdsP+  
shakira_nude.zip ^Sk]6l38  
shakira_paparazzi_collection.zip -$JK,~i  
XP_keygen.zip l2clHBr  
PS2_emulator_bleem.zip 3 rJnw  
xbox_emulator_beta.zip Y\XIBIAW  
linux_root.zip kLh -z[i  
win2k_pass_decryptor.zip %(H
s\  
Win2k_reboot_exploit.zip vX;=T3DA  
IIS_shellbind_exploit.zip 0je\G}B)@  
AdvZip_Recovery.zip AP_Z'1j  
AIM_Pass_stealer.zip OMZXww2W"  
AMI_BIOS_Cracker.zip }lT@{RsX  
Counter_Strike_CD_Keygen.zip BGT_UPTK-  
Delphi_5_Keygen.zip Rq^@mP  
Delphi_6_Keygen.zip nW{fHnCQa  
Half_life_Cd_keygen.zip <:5#DJCU  
Hotmail_Hacker.zip I1aM5  
ICQ_Hackingtools.zip @{g<gJ ]  
invisible_IP.zip ]6vq$YKUg  
kazaa.zip M0YkohP-C/  
edonkey_serverlist.zip 5 C*1ch  
kmd151_en.zip BJ/HuB  
Linux_rootaccess.zip _>Z<1Ko  
msn_IP_finder.zip %0j2 d  
Office_key_Gen.zip kBb@mY7<  
Autocad_2002_Crack.zip >=bOMY-E
%  
HttpTunnel_Keygen.zip E`v^6,>  
Winrar_Crack.zip @Mg:
+n:  
Winrar_Keygen.zip QvC!9L(J  
Winzip_Keygen.zip ryU}jBr))  
Winzip_Crack.zip ](
09?|  
Mirc_Crack.zip KPGcAkzpU  
mydoom_Scanner.zip R+1+2z  
Netbios_Cracker.zip ($^"ltr  
Irc_Flooder.zip 0&:J#\%iW  
MSN_7.3.zip @V/C8c<m  
MSN_PLUS_3.zip {J0Cq<  
filename.exe <)'d&x_  
useit.exe   VS;hKJ2R  
b'#S$sPsO  
●程序试图连接网络 I:#I%bI  

&[73.%  
]l6<k Ji-  
●更改注册表 `{zst\zL?C  
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] T?@ir`ad  
"startup"="C:\\WINXP\\ssl\\filename.exe" |qos(e3WN  
~
_Z$|Ya  
清除方法： hyIOEF/&  
使用Ctrl+Alt+Del终止filename进程，清理注册表，删除SSL目录即可。 z<ChZ0uxz  
6Ku+]F)TL  
相关链接： 4QvyKf  
http://avfbbs.80port.net/read.php?tid=1221&fpage=2&toread=1