Worm.Lemb.b，是病毒，發作條件是用戶誤運行。
基本介紹
- 中文名：雷暴變種B
- 外文名：Worm.Lemb.b
- 傳染條件：網路共享
- 發作條件：用戶誤運行
- 威脅級別：★★★
病毒別名,影響系統,病毒行為,
病毒別名
Worm.P2P.Lemb.b [AVP],W32/Lemb.worm!p2p [McAfee],W32.SillyP2P[Norton]
影響系統
Win9x/WinMe/WinNT/Win2000/WinXP/Win2003
病毒行為
編寫工具:
系統修改:
1複製病毒自身到
WINDOWS
un32.exe
WINDOWSWinstart.bat
WINDOWSsystem32 askmgr.exe
WINDOWSsystem32
egedit.exe
該病毒沒有判斷作業系統,強制拷貝到上述目錄,有可能會失敗
2.將病毒以下列名字
Rosy.exe
Pipponoto.exe
Anastacia - Left Outside Alone.mp3.exe
The Rasmus - In The Shadows.mp3.exe
50 Cent - In da Club.mp3.exe
Vanessa Carltron - OrdinaryDay.mp3.exe
Haiducii - Dragostea Din Tei.mp3.exe
Black Eyed Peas - Hey Mama.mp3.exe
Raf - In tutti i miei giorni.mp3.exe
Vasco Rossi - Buoni e cattivi.mp3.exe
Lionel Richie - Just For You.mp3.exe
複製到下列路徑:
progra~1WinMXShared
progra~1TeslaFiles
progra~1LimeWireShared
progra~1MorpheusMy Shared Folder
progra~1eMuleIncoming
progra~1eDonkey2000Incoming
progra~1BearshareShared
progra~1GroksterMy Grokster
progra~1ICQShared Folder
progra~1Kazaa Lite K++My Shared Folder
progra~1Kazaa LiteMy Shared Folder
progra~1KazaaMy Shared Folder
3.在檔案WINDOWSBlem.txt中寫入下列內容:
P2P Blem - Coded by Sarosoft
Gedzac Labs Group 2004 - http://www.gedzac.tk
Dedicated to my Love Rosy
Saro & Rosy Forever
Rosy Ti Amo
發作現象:病毒運行後會打開網站http://www.gedzac.tk
特別說明:
該病毒是利用
WinMX,Tesla,LimeWire,Morpheus,eMule,eDonkey2000,Bearshare,Grokster,ICQ,Kazaa Lite K++,Kazaa Lite,Kazaa
的共享網路來傳播,誘騙用戶下載並運行該病毒
