病毒名称:
Worm.P2P.Astef.c
类别： 蠕虫
病毒资料：
破坏方法：
蠕虫病毒。
一、拷贝自身为系统目录的文件，修改注册表以自启动。
windows_critical_update.exe
windowsupdate.exe
svchost.exe
windll32.exe
ocx32.exe
1 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run
"windll" : ％WINDOWS％\WINDLL32.EXE
2 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run
"ocx32" : ％WINDOWS％\OCX32.EXE
3 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run
"microsoft" : ％WINDOWS％\SVCHOST.EXE
4 HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run
"WindowsCriticalUpdate" : ％WINDOWS％\WINDOWS_CRITICAL_UPDATE.EXE
5 HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run
"WindowsUpdate" : ％WINDOWS％\SVCHOST.EXE
二、查找下列路径，如果存在，释放自身拷贝。
\Kazaa Lite K++\my shared folder\kazaa lite\my shared folder\kazaa\my shared folder
\kmd\my shared folder\grokster\my grokster\bearshare\shared\edonkey2000\incoming\morpheus\my shared folder\limewire\shared\winmx\sharedc:\my shared folderc:
\program files\ICQ\Shared Folder
c:\program files\overnet\incomingc:\My Downloads\Rapigator\Share\XoloX\Downloads
\Tesla\Files\WinMX\My Shared Folder\Shareaza\Downloads\GnUCleus\Downloads
病毒采用下列文件名
eBook-Robbin Tungett_eBay-Ecourse(Full).exe
eBook-AuctionHints_2(Full).exe
eBook-Sidney_Johnston-Make_Your_Net_Auctions_Sell.exe
eBook-9.11_probe(Full_Report-UnCensored).exe
eBook-Atkins Diet No and Low Carb Recipes.exe
eBook-How to make money in Real Estate.exe
eBook-Real Estate Millionaires Secrets.exe
eBook-2004 Blue Book and Search Guide.exe
Nero Ultra Edition Package-KEYGEN.exe
DivX Video Bundle(Full_Retail).exe
SnagIt(Full_Retail).exe
American Juniors game.exe
SolSuite 2003: Solitaire Card Games Suite(FULL).exe
Hoyles Card Games Deluxe 2004(FULL).exe
Britney spears stripping game.exe
Survivor Panama game.exe
American Idol game.exe
eBook-9-11_probe_report.exe
IBM Via voiceZIP.exe
AddWeb Website Promoter(Retail-FULL).exe
Sygate Personal Firewall(FULL).exe
Bikini Playbabes-windows theme.exe
Matrix Reloaded 3D-Screensaver.exe
ZoneAlarm Pro-KEYGEN(All Versions-08/01/2003).exe
Microsoft_Windows_XP_SP1.exe
Adobe Premiere 7 'Bible' e-book.exe
Vegas Video 3.0 FINAL (with Crack).exe
Family Tree Maker v9.0.exe
Visual Studio Keygen.exe
Visual C++ Keygen.exe
Visual Basic 6 Keygen.exe
AdAware 6.0 pro Keygen.exe
Sports-Illustrated-Babes.exe
Business Card Designer Pro.exe
Logo Creator - Corporate Set 1(FULL).exe
FlashGet(Full_Retail).exe
eBook-Legal Forms (Contracts + More).exe
eBook-Secrets of Winning at Gambling.exe
eBook-Gambling Secrets of the Professionals.exe
eBook-Card Games 2004.exe
eBook Karma Sutra.exe
三、偷偷连接“http://***shopping.togetherhost.com/favorites.htm”
病毒的清除法：
使用光华反病毒软件，彻底删除。
病毒演示：
病毒FAQ：
Windows下的PE病毒。
发现日期：
2004-2-6