病毒别名：Worm.P2P.Lemb.b [AVP],W32/Lemb.worm!p2p [McAfee],W32.SillyP2P[Norton]

处理时间：

威胁级别：★★★

中文名称：雷暴变种B

病毒类型：蠕虫

影响系统：Win9x/WinMe/WinNT/Win2000/WinXP/Win2003

病毒行为:

编写工具:

传染条件:网络共享

发作条件:用户误运行

系统修改:

1复制病毒自身到

WINDOWS

un32.exe

WINDOWSWinstart.bat

WINDOWSsystem32 askmgr.exe

WINDOWSsystem32

egedit.exe

该病毒没有判断操作系统,强制拷贝到上述目录,有可能会失败

2.将病毒以下列名字

Rosy.exe

Pipponoto.exe

Anastacia - Left Outside Alone.mp3.exe

The Rasmus - In The Shadows.mp3.exe

50 Cent - In da Club.mp3.exe

Vanessa Carltron - OrdinaryDay.mp3.exe

Haiducii - Dragostea Din Tei.mp3.exe

Black Eyed Peas - Hey Mama.mp3.exe

Raf - In tutti i miei giorni.mp3.exe

Vasco Rossi - Buoni e cattivi.mp3.exe

Lionel Richie - Just For You.mp3.exe

复制到下列路径:

progra~1WinMXShared

progra~1TeslaFiles

progra~1LimeWireShared

progra~1MorpheusMy Shared Folder

progra~1eMuleIncoming

progra~1eDonkey2000Incoming

progra~1BearshareShared

progra~1GroksterMy Grokster

progra~1ICQShared Folder

progra~1Kazaa Lite K++My Shared Folder

progra~1Kazaa LiteMy Shared Folder

progra~1KazaaMy Shared Folder

3.在文件WINDOWSBlem.txt中写入下列内容:

P2P Blem - Coded by Sarosoft

Gedzac Labs Group 2004 - http://www.gedzac.tk

Dedicated to my Love Rosy

Saro & Rosy Forever

Rosy Ti Amo

发作现象:病毒运行后会打开网站http://www.gedzac.tk

特别说明:

该病毒是利用

WinMX,Tesla,LimeWire,Morpheus,eMule,eDonkey2000,Bearshare,Grokster,ICQ,Kazaa Lite K++,Kazaa Lite,Kazaa

的共享网络来传播,诱骗用户下载并运行该病毒