概述
病毒別名：Worm.P2P.Lemb.b 【AVP】,W32/Lemb.worm!p2p 【McAfee】,W32.SillyP2P【Norton】處理時間：
威脅級別：★★★
中文名稱：雷暴變種B
病毒類型：蠕蟲
影響系統：Win9x/WinMe/WinNT/Win2000/WinXP/Win2003
病毒行為:
編寫工具:
傳染條件:網路共享
發作條件:用戶誤運行
系統修改:
1複製病毒自身到WINDOWS
un32.exe
WINDOWSWinstart.bat
WINDOWSsystem32 askmgr.exe
WINDOWSsystem32
egedit.exe
該病毒沒有判斷作業系統,強制拷貝到上述目錄,有可能會失敗
2.將病毒以下列名字
Rosy.exe
Pipponoto.exe
Anastacia - Left Outside Alone.mp3.exe
The Rasmus - In The Shadows.mp3.exe
50 Cent - In da Club.mp3.exe
Vanessa Carltron - OrdinaryDay.mp3.exe
Haiducii - Dragostea Din Tei.mp3.exe
Black Eyed Peas - Hey Mama.mp3.exe
Raf - In tutti i miei giorni.mp3.exe
Vasco Rossi - Buoni e cattivi.mp3.exe
Lionel Richie - Just For You.mp3.exe
複製到下列路徑:
progra~1WinMXShared
progra~1TeslaFiles
progra~1LimeWireShared
progra~1MorpheusMy Shared Folder
progra~1eMuleIncoming
progra~1eDonkey2000Incoming
progra~1BearshareShared
progra~1GroksterMy Grokster
progra~1ICQShared Folder
progra~1Kazaa Lite K++My Shared Folder
progra~1Kazaa LiteMy Shared Folder
progra~1KazaaMy Shared Folder
3.在檔案WINDOWSBlem.txt中寫入下列內容:
P2P Blem - Coded by Sarosoft
Gedzac Labs Group 2004 - http://www.gedzac.tk
Dedicated to my Love Rosy
Saro & Rosy Forever
Rosy Ti Amo
發作現象:
病毒運行後會打開網站http://www.gedzac.tk特別說明:
該病毒是利用WinMX,Tesla,LimeWire,Morpheus,eMule,eDonkey2000,Bearshare,Grokster,ICQ,Kazaa Lite K++,Kazaa Lite,Kazaa
的共享網路來傳播,誘騙用戶下載並運行該病毒
