P2P-Worm.Win32.Delf.ao简单分析及解决

●文件运行后在其所在目录复制自身，并命名为useit.exe，同时在目录%windir%\ssl下疯狂建立ZIP包裹文件复制自身，压缩方式采用为“存储”，这是最低的压缩格式，目的是迅速占用硬盘资源。 L%S,,dm-0  
生成的文件名可能为： *XUg2.mH   
Visual_C++_Crack.zip NG!$xRjs  
Kazaa_Plus.zip _h92*0p1  
Porn_Napster.zip ?v^st_/  
Mp3_Finder.zip NawR-.:u=  
Msn_Crack.zip A/z!A/$  
Yahoo_hacker.zip ^I=tYo~(  
Msn_Hacker.zip N0y9=&  
Delphi_7_Crack.zip 1WP7"\|  
Delphi_8_Crack.zip 8>d?M  
HalfLife_keygen.zip @aAHy"~U  
CounterStrike_Keygen.zip a La.q
  
WinXp_Crack.zip UF5?U/cB  
WinXp_keygen.zip ;["V;ek  
mirc_6.2_Patch.zip NFY[^T  
Email_Cracker.zip \,,+sVgz=  
Maria_Carey.zip %=UCa@w~  
Jeniifer_Lopez.zip T0+vl:9  
Fifa_2005_Demo.zip sb;xUS e  
Mailbomber.zip F4,G0U--  
Email_harvester.zip SM$M:>H_)  
Spam_Blocker.zip RvU D$K  
Mail_Spammer.zip vJ\017+  
Half_Life_2_Keygen.zip p*.oM  
Mirc_Scripter.zip XaXwds+.  
Mp3_Search.zip S'>83nk3  
Sex_Harvester.zip ]rtLj/]\bQ  
ZoneAlaram_Crack.zip x kt`l12  
Sygate_Crack.zip ?7C _Kkj  
Kaspersky_Crack.zip C'
A>bCV]I  
Mcafee_8_Crack.zip )At}%e_  
Mcafee_7_Crack.zip {4 Um"|E  
Norton_Antivirus_Crack.zip ?4"
H_Q  
NAV_2004_Crack.zip ; Eg1Z  
Pcillin_Crack.zip Ee-
vr?+  
RPC_Patch.zip 46)5]fA[  
Hack_mail.zip TY/ 1c  
Registry_Fixer.zip O_9uLO]S  
Adobe_Photoshop_Keygen.zip 1DEsd{a  
Adobe_All_versions_keygen.zip G aUmZ3  
Windows_All_versions_keygen.zip Z>}=cn`l|/  
Lesbian_Stars.zip IUV0qgv
 
britney_Spears_Screen.zip : w 6  
Celebrities_Screensaver.zip <2LVl%r  
Pamela_Anderson_Screen.zip Z/"Q  
Mirc_Flooder.zip _^+gnO  
Hack_Networks.zip ]5nG@)-09O  
Webcam_Napster.zip sj@&U?)U  
Yahoo_Flooder.zip $$by(pTtG  
Msn_Crasher.zip X=E3X8^=  
Yahoo_crasher.zip }K$fz=R  
Call_of_duty_crack.zip b-YoXcm:  
Red_Alert_3_Cheats.zip xH%%CWy|  
AIM_Cracker.zip *R?&b
z>m  
Credit_Cards_Generator.zip -U\
c[rb
 
Photo_Impact_Crack.zip hSglaB@7  
Acdsee_Crack.zip s$.m$  
host_faker.zip `6@U1 l^H  
host_spoofer.zip uK7w|A  
ip_spoofer.zip e8zT(?Q!  
ip_faker.zip d1'(iC~H@  
ident_spoofer.zip @`HLP{|U  
ident_faker.zip )neF0A 5E  
tripod_hacker.zip <NjlxaH  
tripod_cracker.zip iL7[(YG %  
hotmailhacker.zip ZTR='` 0Y@  
hotmailcracker.zip cV[e89  
hotmail_account_sniffer.zip g{~M)zq  
aimhacker.zip :Y $=  
aimcracker.zip KKLf0T  
icqhacker.zip yb,AuG%  
icqcracker.zip @T7vD
2  
msnhacker.zip bP|y%`%A  
msncracker.zip {3Ack9c  
winxp_hacker_.zip Mef(&-  
winxp_cracker.zip ~5d^'1
C  
winxphack.zip  S*P,$2g  
win2k_serial.zip U_OLQa4  
yahoo_cracker.zip !p"3/
1Ss^  
divx_fix.zip %#Fu+UH"  
divx_repair.zip
q[/&4<  
ftp_hacker.zip BO-N@+#i]  
ftp_cracker.zip SBRcaA  
porn_account_hacker.zip oh/(,B  
porn_account_cracker.zip ]"\_}ub^  
catherine_zeta_jones_nude.zip R~cmX!"  
catherine_zeta_jones_naked.zip HW\aNRXSP  
catherine_zeta_jones_anal.zip 4DEhM  
pamela_anderson_anal.zip 8cTVBE  
pamela_anderson_nude.zip /nqNjnz  
pamela_anderson_naked.zip dLg#,ZGd  
buttman.zip MBrI85y@  
sarah_michelle_gellar_nude.zip 74jfh-h%  
sarah_michelle_gellar_naked.zip l|Ufcta  
sandra_bullock_nude.zip ( P(m7,N`  
sandra_bullock_naked.zip wv)*6C7  
anastasia_anal.zip {Q[LnN  
anastasia_naked.zip +~90S[Yer  
anastasia_nude.zip )upo?~V  
shakira_anal_.zip 2$8x-xHU  
shakira_assfucked.zip #H?jnvfdd  
shakira_naked.zip Q)~$*Gr8  
shakira_nude.zip 6 {%j3086  
shakira_paparazzi_collection.zip =p_WsHc1>  
XP_keygen.zip a+c7!iH  
PS2_emulator_bleem.zip UjMH;  
xbox_emulator_beta.zip bdtIm@(  
linux_root.zip %3qS\jM2  
win2k_pass_decryptor.zip e Yh"`Y:\  
Win2k_reboot_exploit.zip Dh0Gz@=v  
IIS_shellbind_exploit.zip ~]*`O.V  
AdvZip_Recovery.zip 9o5x):F  
AIM_Pass_stealer.zip
i,fXtia  
AMI_BIOS_Cracker.zip t
~MA]cy  
Counter_Strike_CD_Keygen.zip  mxp}zn  
Delphi_5_Keygen.zip 29h]BK1`  
Delphi_6_Keygen.zip #%,]Ya5  
Half_life_Cd_keygen.zip U+H*TGb[  
Hotmail_Hacker.zip I
85\R ge  
ICQ_Hackingtools.zip Ht}@'HaP  
invisible_IP.zip yvQk&I  
kazaa.zip zy;x;BK1  
edonkey_serverlist.zip grt4b3wC  
kmd151_en.zip ]v 1N!e4l  
Linux_rootaccess.zip Y3"8^A/  
msn_IP_finder.zip *|FZieG^  
Office_key_Gen.zip p6 %E  
Autocad_2002_Crack.zip g%z;aM  
HttpTunnel_Keygen.zip }}HYrAY  
Winrar_Crack.zip <fukiKf6p  
Winrar_Keygen.zip .{$(+yt=  
Winzip_Keygen.zip c0!A]=A1  
Winzip_Crack.zip kaW?>ZZ  
Mirc_Crack.zip RzfX).  
mydoom_Scanner.zip cph&`$S  
Netbios_Cracker.zip
`V]Wey}m  
Irc_Flooder.zip FFcCUivV_  
MSN_7.3.zip TXmT0[s#  
MSN_PLUS_3.zip [aPA%ufET  
filename.exe 6WjI2"y2  
useit.exe   Mx*|D!Xz  
|Iic!!-  
●程序试图连接网络 Hjg`$S7q3  

weL3MU
  
|t?`w wg  
●更改注册表 ~cvyKI0#_  
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'W7]vC`  
"startup"="C:\\WINXP\\ssl\\filename.exe" M_Rv\rOg  
Q>>][-c2|  
清除方法： l(3jXj  
使用Ctrl+Alt+Del终止filename进程，清理注册表，删除SSL目录即可。 sMHXj7|  
"gMqK
3  
相关链接： (AAV/0OE  
http://avfbbs.80port.net/read.php?tid=1221&fpage=2&toread=1