标题：Worm.Rudy12
病毒简介
病毒别名：Worm.P2P.Rudy.a[AVP]
处理时间：
威胁级别：★★
中文名称：鲁迪破解
病毒类型：蠕虫
影响系统：Win9x/WinNT/Win2K/WinXP/Win2003
病毒行为:
编写工具:
传染条件:
通过p2p共享传播。
发作条件:
系统修改:
A、将自身复制到"%System%Rubyexe"
B、在注册表主键HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun下添加键值：
"Ruby 12" = "%System%Rubyexe"
C、创建目录"%System%sysnet",向这个目录复制大量自身副本，文件名为：
A+ Certification Test.exe
Adobe Photoshop CS and ImageReady CS 8.0 Keygen.exe
Airport Tycoon II - NoCD.exe Crack.exe
All Adobe Products Keygen.exe
All Macromedia Products Keygen.exe
All Microsoft Products Keygen.exe
American Conquest - NoCD.exe Crack.exe
Apache AH-64 Air Assault - NoCD.exe Crack.exe
Battlefield 1942 The Road to Rome - NoCD.exe Crack.exe
Battlefield Vietnam - NoCD.exe Crack.exe
BitDefender Keygen.exe
Borland KeyGens.exe
Bridge Baron 13 NoCD.exe Crack.exe
BurnDvds.exe
Cisco Certification Test.exe
Command and Conquer Generals NoCD.exe Crack.exe
Counterstrike aim hack.exe
Counterstrike hacks.exe
Counter-Strike, Condition Zero - Activation Key.exe
Crack McAfee 7.exe
Crack Norton 3000.exe
Deus Ex - NoCD.exe Crack.exe
Diablo 2 map hack.exe
Diablo 2 no-cd hack.exe
Divx Pro 5.1 Serial.exe
Doom 3 - NoCD.exe Crack.exe
Dvd Plus Crack.exe
Dvd Ripper.exe
Dvd To Vcd.exe
Dvd Wizard Pro Crack.exe
Dvd Xcopy Crack.exe
DvdCopyOne Crack.exe
DvdToVcd Crack.exe
Easy Dvd creator Crack.exe
Easy Dvd Ripper.exe
Eonix Realm Of Hepmia - NoCD.exe Crack.exe
EZ Dvd Ripper.exe
Fetish Fighters - NoCD.exe Crack.exe
Forbidden Siren - NoCD.exe Crack.exe
Freelancer - NoCD.exe Crack.exe
Grom - NoCD.exe Crack.exe
Harry Potter and the Prisoner of Azkaban KeyGen and Serial.exe
Harry Potter und der Gefangene von Askaban NoCD.exe Crack.exe
I Was An Atomic Mutant - NoCD.exe Crack.exe
icqbomber.exe
IGI-2 Covert Strike - NoCD.exe Crack.exe
Impossible Creatures - NoCD.exe Crack.exe
Ipswich Town Official Management Game - NoCD.exe Crack.exe
Jamella磗 Diablo 2 hero editor.exe
Kazaa all Crack.exe
Microsoft Windows XP Professional Keygen.exe
MP3 encoder decoder V1.8.exe
MSCE Certification Test.exe
Nascar Racing 2003 Season NoCD.exe Crack.exe
Nero Burning Rom Crack.exe
Nero Burning ROM v6.3 Ultra - Enterprise edition key.exe
Nimo Codec Pack Updater.exe
Nod32 Crack.exe
Norton AntiVirus 2004 Pro Activation Key & Serial.exe
Norton AntiVirus 2005 Serial.exe
Norton Internet Security 2004 Keygen & Serial.exe
Norton Internet Security 2004 Pro Serial.exe
Norton Internet Security 2005 Pro Serial.exe
Office XP Universal Crack.exe
PANDA.AVers.lusers.exe
PANDA.lusers.exe
Private Nurse - NoCD.exe Crack.exe
Robot Arena Design And Destroy - NoCD.exe Crack.exe
Serious Sam - Gold Edition - NoCD.exe Crack.exe
Shadow of Memories - NoCD.exe Crack.exe
Shrek 2 Serial.exe Crack.exe
Sim City 4 - NoCD.exe Crack.exe
Slot City 3 NoCD.exe Crack.exe
SophosCrackAllVersion.exe
Spellforce - Breath of Winter Crack.exe
Spider-Man 2 Crack.exe
Starcraft + Broodwar 1.10 map hack.exe
Starcraft + Broodwar 1.10 no-cd hack.exe
Symantec Antivirus 2005 Serial.exe
Symantec Internet Secutiy 2005 Serial.exe
Test Drive - NoCD.exe Crack.exe
The Campaigns of La Grande Armee - NoCD.exe Crack.exe
The Emperors Mahjong - NoCD.exe Crack.exe
The Frozen Throne map hack.exe
Tom Clancys Splinter Cell - NoCD.exe Crack.exe
Tombstone 1882 - NoCD.exe Crack.exe
Unreal II The Awakening - NoCD.exe Crack.exe
Warcraft 3 Frozen Throne cd-cd hack.exe
Warcraft 3 Frozen Throne map hack.exe
Warcraft 3 map hack.exe
Warcraft 3 no-cd hack.exe
Warcraft 3 stat hack.exe
WinACE Crack.exe
Windows Nt Certification Test.exe
Windows Server 2003 Crack.exe
WinRAR 3 Crack.exe
WinZIP 9 Crack.exe
World Of Outlaws Sprint Car Racing 2002 - NoCD.exe Crack.exe
XBOX X-Fer Ripper and Transfer.exe
Xvid Codec Installer.exe
Zone Alarm 5.0 pro Serial.exe
D、在注册表主键
HKEY_CURRENT_USERSoftwareiMeshClientLocalContent
HKEY_CURRENT_USERSoftwareKazaaLocalContent
HKEY_CURRENT_USERSoftwareKazaaTransfer
下添加键值
"dir0" = "012345:C:WINNTSystem32sysnet"
通过这个键值，将病毒刚才创建的包含有大量病毒副本的文件夹设置为p2p软件的共享目录。
发作现象
病毒运行的时候会弹出一个对话框，如图<20040917_Worm.Rudyjpg>
p2p软件中多了一个共享
特别说明
这个软件通过P2P共享传播，它会在本机创建一个目录，里面的文件名为许多流行软件的破解程序、注册机。然后该软件会修改p2p软件的设置，在用户不知情的情况下，悄悄将病毒创建的目录共享出去。
所以，建议广大用户尽可能不要用p2p下载软件，不要到来历不明的地方下载软件，如果万不得以要这么做，对下载下来的文件一定要用毒霸进行查毒。