P2P-Worm.Win32.Delf.ao简单分析及解决

●文件运行后在其所在目录复制自身，并命名为useit.exe，同时在目录%windir%\ssl下疯狂建立ZIP包裹文件复制自身，压缩方式采用为“存储”，这是最低的压缩格式，目的是迅速占用硬盘资源。 M 91{
5h3  
生成的文件名可能为： yVX~@+TD(n  
Visual_C++_Crack.zip ^"'dY4go  
Kazaa_Plus.zip Bo ~~ R!  
Porn_Napster.zip q]1wj9l1:M  
Mp3_Finder.zip rog>~})  
Msn_Crack.zip n:di7BW  
Yahoo_hacker.zip bK6NL6w  
Msn_Hacker.zip Cs)9 *HKGQ  
Delphi_7_Crack.zip YG2+H.D'u  
Delphi_8_Crack.zip "!c6-#QX  
HalfLife_keygen.zip D1)NLI-+  
CounterStrike_Keygen.zip _m' U*C8}  
WinXp_Crack.zip I~Atc
8  
WinXp_keygen.zip 8&m\QD!'B  
mirc_6.2_Patch.zip =RfXU'p"~  
Email_Cracker.zip kS3P` j_  
Maria_Carey.zip dKzs1[  
Jeniifer_Lopez.zip -P=CxxQQ[  
Fifa_2005_Demo.zip y{K2I  
Mailbomber.zip ,e;h >N  
Email_harvester.zip d#")AVtP  
Spam_Blocker.zip BE+Sbloc  
Mail_Spammer.zip 9G)/ xAra  
Half_Life_2_Keygen.zip =E+.GI  
Mirc_Scripter.zip z5@] I  
Mp3_Search.zip kFPw.)}  
Sex_Harvester.zip P%%Ej&@  
ZoneAlaram_Crack.zip ?7$J)P  
Sygate_Crack.zip 'U[!D&NYcM  
Kaspersky_Crack.zip 5v<ixK  
Mcafee_8_Crack.zip \rJ=<S%H  
Mcafee_7_Crack.zip ,Q
<R5uf  
Norton_Antivirus_Crack.zip -_S;@75@  
NAV_2004_Crack.zip Ox:z55jsJ>  
Pcillin_Crack.zip aXt`  
RPC_Patch.zip ~ x.((h  
Hack_mail.zip !lD$V  
Registry_Fixer.zip fDPfqy)1U  
Adobe_Photoshop_Keygen.zip 4~fm7&z  
Adobe_All_versions_keygen.zip |>c8lB  
Windows_All_versions_keygen.zip 9q"zw
8  
Lesbian_Stars.zip pd ;tsy }  
britney_Spears_Screen.zip D3=J]:CjM  
Celebrities_Screensaver.zip \>Z\G<  
Pamela_Anderson_Screen.zip oVaq||?6  
Mirc_Flooder.zip tI}m'>u  
Hack_Networks.zip r2fU`LaKil  
Webcam_Napster.zip S1?>@CEo  
Yahoo_Flooder.zip rm1rm*  
Msn_Crasher.zip ]{jQ[qFf*  
Yahoo_crasher.zip eHoKGF)YuR  
Call_of_duty_crack.zip p11UIwk?  
Red_Alert_3_Cheats.zip (]Urr  
AIM_Cracker.zip q.SHe</jB  
Credit_Cards_Generator.zip 8x#_>xU  
Photo_Impact_Crack.zip *H0?YI86  
Acdsee_Crack.zip wx8uQ +  
host_faker.zip chf9NB~uU  
host_spoofer.zip >.=+S>giL  
ip_spoofer.zip '&R"D,|g,  
ip_faker.zip KR>}A1uj  
ident_spoofer.zip wqCl  
ident_faker.zip c_g(mpYI  
tripod_hacker.zip tOe=Ymg  
tripod_cracker.zip qehLe#aCk  
hotmailhacker.zip 2sVIttFg  
hotmailcracker.zip q8_  
hotmail_account_sniffer.zip +-0TDD[  
aimhacker.zip }}0VRI  
aimcracker.zip y/2$k]_  
icqhacker.zip W[I.9H4E>  
icqcracker.zip eC)GBH83n  
msnhacker.zip N $Il'^7  
msncracker.zip 69m3m!Sw1  
winxp_hacker_.zip GTkA/  
winxp_cracker.zip J18aW`L7_O  
winxphack.zip 8 SLY~  
win2k_serial.zip {{Bm^AlY  
yahoo_cracker.zip 0*c//DR|  
divx_fix.zip 7=| ~f1  
divx_repair.zip X;3|)  
ftp_hacker.zip O*F']G=  
ftp_cracker.zip *a4_`KASg  
porn_account_hacker.zip zC[{5H|0  
porn_account_cracker.zip 8]*J+DhxA  
catherine_zeta_jones_nude.zip am~y)Jh  
catherine_zeta_jones_naked.zip 'B;b u2\r;  
catherine_zeta_jones_anal.zip MoMh!Rd  
pamela_anderson_anal.zip {@iN,d  
pamela_anderson_nude.zip E9/-paD$j  
pamela_anderson_naked.zip +@#=
N8  
buttman.zip D6I/X;c  
sarah_michelle_gellar_nude.zip z%S"91[  
sarah_michelle_gellar_naked.zip kc
f.>tj,  
sandra_bullock_nude.zip _%rtC  
sandra_bullock_naked.zip l65#*   
anastasia_anal.zip )YyhCav  
anastasia_naked.zip c3GX7x  
anastasia_nude.zip z$Htz+Cu  
shakira_anal_.zip B#@<LJ  
shakira_assfucked.zip P6!]
lm)  
shakira_naked.zip 3-'+kI?ebY  
shakira_nude.zip 'wJ]+uY  
shakira_paparazzi_collection.zip 0lS=%_Is)  
XP_keygen.zip D:(ac WEz  
PS2_emulator_bleem.zip }LIRr%  
xbox_emulator_beta.zip %u9re  
linux_root.zip Tmd"lk7=$  
win2k_pass_decryptor.zip -0LmiHf  
Win2k_reboot_exploit.zip O{h6l|#  
IIS_shellbind_exploit.zip Ad (Ps@SG  
AdvZip_Recovery.zip <e/x:!3]p*  
AIM_Pass_stealer.zip nIcYJH  
AMI_BIOS_Cracker.zip :q)&&Z,O  
Counter_Strike_CD_Keygen.zip =Tnw[2qt  
Delphi_5_Keygen.zip A>S>dTBE  
Delphi_6_Keygen.zip z-H @  
Half_life_Cd_keygen.zip @ CZNiTF  
Hotmail_Hacker.zip ivnLyC'7Dv  
ICQ_Hackingtools.zip oz%W>`}V  
invisible_IP.zip w[nF!f  
kazaa.zip [^A&DyoHz[  
edonkey_serverlist.zip 1lKX E|E  
kmd151_en.zip `GE7j@W  
Linux_rootaccess.zip %:-){5WRF  
msn_IP_finder.zip Oee=W<^k  
Office_key_Gen.zip h@~}QMD  
Autocad_2002_Crack.zip  9!ii7^  
HttpTunnel_Keygen.zip ~>F<d}A-  
Winrar_Crack.zip ="[UAX. y  
Winrar_Keygen.zip _&ol~  
Winzip_Keygen.zip eB4~Ea;,  
Winzip_Crack.zip zI$z# KM  
Mirc_Crack.zip wTGXYaz52  
mydoom_Scanner.zip ZeQfEpR  
Netbios_Cracker.zip ;e|hpOQT.  
Irc_Flooder.zip o# (V+F  
MSN_7.3.zip g101cOfp  
MSN_PLUS_3.zip *tcdU  
filename.exe  p~:9dL?  
useit.exe   j)-|k:5  
z5,L!  
●程序试图连接网络 X|d$gO\  

_E;;Nk2  
;Q?/-HV  
●更改注册表 r/UnXJ;7  
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] CyUB@UGR  
"startup"="C:\\WINXP\\ssl\\filename.exe" .?
 'CU  
KGv"S`."  
清除方法： g9-5L+>*  
使用Ctrl+Alt+Del终止filename进程，清理注册表，删除SSL目录即可。 16Qp@C,g  
6nX\ v?a  
相关链接： FqI>YT~  
http://avfbbs.80port.net/read.php?tid=1221&fpage=2&toread=1