Worm.P2P.Astef.c_病毒数据库

病毒名称: Worm.P2P.Astef.c 类别：蠕虫病毒资料：      破坏方法：

    蠕虫病毒。

    一、拷贝自身为系统目录的文件，修改注册表以自启动。

    windows_critical_update.exe
    windowsupdate.exe
    svchost.exe
    windll32.exe
    ocx32.exe

    1 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run
    "windll" : ％WINDOWS％\WINDLL32.EXE

    2 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run
    "ocx32" : ％WINDOWS％\OCX32.EXE

    3 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run
    "microsoft" : ％WINDOWS％\SVCHOST.EXE

    4 HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run
    "WindowsCriticalUpdate" : ％WINDOWS％\WINDOWS_CRITICAL_UPDATE.EXE

    5 HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run
    "WindowsUpdate" : ％WINDOWS％\SVCHOST.EXE


    二、查找下列路径，如果存在，释放自身拷贝。

    \Kazaa Lite K++\my shared folder\kazaa lite\my shared folder\kazaa\my shared folder
    \kmd\my shared folder\grokster\my grokster\bearshare\shared\edonkey2000\incoming\morpheus\my shared folder\limewire\shared\winmx\sharedc:\my shared folderc:
    \program files\ICQ\Shared Folder
    c:\program files\overnet\incomingc:\My Downloads\Rapigator\Share\XoloX\Downloads
    \Tesla\Files\WinMX\My Shared Folder\Shareaza\Downloads\GnUCleus\Downloads
    病毒采用下列文件名

    eBook-Robbin Tungett_eBay-Ecourse(Full).exe
    eBook-AuctionHints_2(Full).exe
    eBook-Sidney_Johnston-Make_Your_Net_Auctions_Sell.exe
    eBook-9.11_probe(Full_Report-UnCensored).exe
    eBook-Atkins Diet No and Low Carb Recipes.exe

    eBook-How to make money in Real Estate.exe
    eBook-Real Estate Millionaires Secrets.exe
    eBook-2004 Blue Book and Search Guide.exe
    Nero Ultra Edition Package-KEYGEN.exe
    DivX Video Bundle(Full_Retail).exe
    SnagIt(Full_Retail).exe
    American Juniors game.exe
    SolSuite 2003: Solitaire Card Games Suite(FULL).exe
    Hoyles Card Games Deluxe 2004(FULL).exe
    Britney spears stripping game.exe
    Survivor Panama game.exe
    American Idol game.exe
    eBook-9-11_probe_report.exe
    IBM Via voiceZIP.exe
    AddWeb Website Promoter(Retail-FULL).exe
    Sygate Personal Firewall(FULL).exe
    Bikini Playbabes-windows theme.exe
    Matrix Reloaded 3D-Screensaver.exe
    ZoneAlarm Pro-KEYGEN(All Versions-08/01/2003).exe
    Microsoft_Windows_XP_SP1.exe
    Adobe Premiere 7 'Bible' e-book.exe
    Vegas Video 3.0 FINAL (with Crack).exe
    Family Tree Maker v9.0.exe
    Visual Studio Keygen.exe
    Visual C++ Keygen.exe
    Visual Basic 6 Keygen.exe
    AdAware 6.0 pro Keygen.exe
    Sports-Illustrated-Babes.exe
    Business Card Designer Pro.exe
    Logo Creator - Corporate Set 1(FULL).exe
    FlashGet(Full_Retail).exe
    eBook-Legal Forms (Contracts + More).exe
    eBook-Secrets of Winning at Gambling.exe
    eBook-Gambling Secrets of the Professionals.exe
    eBook-Card Games 2004.exe
    eBook Karma Sutra.exe

    三、偷偷连接“http://***shopping.togetherhost.com/favorites.htm”
病毒的清除法：使用光华反病毒软件，彻底删除。病毒演示：病毒FAQ：      Windows下的PE病毒。
发现日期： 2004-2-6