編寫(xiě)工具:

傳染條件:
通過(guò)p2p共享傳播。

發(fā)作條件:

系統(tǒng)修改:
A、將自身復(fù)制到"%System%Rubyexe"
B、在注冊(cè)表主鍵HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun下添加鍵值：
"Ruby12"="%System%Rubyexe"
C、創(chuàng)建目錄"%System%sysnet",向這個(gè)目錄復(fù)制大量自身副本，文件名為：
A+CertificationTest.exe
AdobePhotoshopCSandImageReadyCS8.0Keygen.exe
AirportTycoonII-NoCD.exeCrack.exe
AllAdobeProductsKeygen.exe
AllMacromediaProductsKeygen.exe
AllMicrosoftProductsKeygen.exe
AmericanConquest-NoCD.exeCrack.exe
ApacheAH-64AirAssault-NoCD.exeCrack.exe
Battlefield1942TheRoadtoRome-NoCD.exeCrack.exe
BattlefieldVietnam-NoCD.exeCrack.exe
BitDefenderKeygen.exe
BorlandKeyGens.exe
BridgeBaron13NoCD.exeCrack.exe
BurnDvds.exe
CiscoCertificationTest.exe
CommandandConquerGeneralsNoCD.exeCrack.exe
Counterstrikeaimhack.exe
Counterstrikehacks.exe
Counter-Strike,ConditionZero-ActivationKey.exe
CrackMcAfee7.exe
CrackNorton3000.exe
DeusEx-NoCD.exeCrack.exe
Diablo2maphack.exe
Diablo2no-cdhack.exe
DivxPro5.1Serial.exe
Doom3-NoCD.exeCrack.exe
DvdPlusCrack.exe
DvdRipper.exe
DvdToVcd.exe
DvdWizardProCrack.exe
DvdXcopyCrack.exe
DvdCopyOneCrack.exe
DvdToVcdCrack.exe
EasyDvdcreatorCrack.exe
EasyDvdRipper.exe
EonixRealmOfHepmia-NoCD.exeCrack.exe
EZDvdRipper.exe
FetishFighters-NoCD.exeCrack.exe
ForbiddenSiren-NoCD.exeCrack.exe
Freelancer-NoCD.exeCrack.exe
Grom-NoCD.exeCrack.exe
HarryPotterandthePrisonerofAzkabanKeyGenandSerial.exe
HarryPotterundderGefangenevonAskabanNoCD.exeCrack.exe
IWasAnAtomicMutant-NoCD.exeCrack.exe
icqbomber.exe
IGI-2CovertStrike-NoCD.exeCrack.exe
ImpossibleCreatures-NoCD.exeCrack.exe
IpswichTownOfficialManagementGame-NoCD.exeCrack.exe
Jamella大Diablo2heroeditor.exe
KazaaallCrack.exe
MicrosoftWindowsXPProfessionalKeygen.exe
MP3encoderdecoderV1.8.exe
MSCECertificationTest.exe
NascarRacing2003SeasonNoCD.exeCrack.exe
NeroBurningRomCrack.exe
NeroBurningROMv6.3Ultra-Enterpriseeditionkey.exe
NimoCodecPackUpdater.exe
Nod32Crack.exe
NortonAntiVirus2004ProActivationKey&Serial.exe
NortonAntiVirus2005Serial.exe
NortonInternetSecurity2004Keygen&Serial.exe
NortonInternetSecurity2004ProSerial.exe
NortonInternetSecurity2005ProSerial.exe
OfficeXPUniversalCrack.exe
PANDA.AVers.lusers.exe
PANDA.lusers.exe
PrivateNurse-NoCD.exeCrack.exe
RobotArenaDesignAndDestroy-NoCD.exeCrack.exe
SeriousSam-GoldEdition-NoCD.exeCrack.exe
ShadowofMemories-NoCD.exeCrack.exe
Shrek2Serial.exeCrack.exe
SimCity4-NoCD.exeCrack.exe
SlotCity3NoCD.exeCrack.exe
SophosCrackAllVersion.exe
Spellforce-BreathofWinterCrack.exe
Spider-Man2Crack.exe
Starcraft+Broodwar1.10maphack.exe
Starcraft+Broodwar1.10no-cdhack.exe
SymantecAntivirus2005Serial.exe
SymantecInternetSecutiy2005Serial.exe
TestDrive-NoCD.exeCrack.exe
TheCampaignsofLaGrandeArmee-NoCD.exeCrack.exe
TheEmperorsMahjong-NoCD.exeCrack.exe
TheFrozenThronemaphack.exe
TomClancysSplinterCell-NoCD.exeCrack.exe
Tombstone1882-NoCD.exeCrack.exe
UnrealIITheAwakening-NoCD.exeCrack.exe
Warcraft3FrozenThronecd-cdhack.exe
Warcraft3FrozenThronemaphack.exe
Warcraft3maphack.exe
Warcraft3no-cdhack.exe
Warcraft3stathack.exe
WinACECrack.exe
WindowsNtCertificationTest.exe
WindowsServer2003Crack.exe
WinRAR3Crack.exe
WinZIP9Crack.exe
WorldOfOutlawsSprintCarRacing2002-NoCD.exeCrack.exe
XBOXX-FerRipperandTransfer.exe
XvidCodecInstaller.exe
ZoneAlarm5.0proSerial.exe
D、在注冊(cè)表主鍵
HKEY_CURRENT_USERSoftwareiMeshClientLocalContent
HKEY_CURRENT_USERSoftwareKazaaLocalContent
HKEY_CURRENT_USERSoftwareKazaaTransfer
下添加鍵值
"dir0"="012345:C:WINNTSystem32sysnet"
通過(guò)這個(gè)鍵值，將病毒剛才創(chuàng)建的包含有大量病毒副本的文件夾設(shè)置為p2p軟件的共享目錄。

發(fā)作現(xiàn)象:
病毒運(yùn)行的時(shí)候會(huì)彈出一個(gè)對(duì)話框，如圖<20040917_Worm.Rudyjpg>
p2p軟件中多了一個(gè)共享

非凡說(shuō)明:
這個(gè)軟件通過(guò)P2P共享傳播，它會(huì)在本機(jī)創(chuàng)建一個(gè)目錄，里面的文件名為許多流行軟件的破解程序、注冊(cè)機(jī)。然后該軟件會(huì)修改p2p軟件的設(shè)置，在用戶(hù)不知情的情況下，靜靜將病毒創(chuàng)建的目錄共享出去。
所以，建議廣大用戶(hù)盡可能不要用p2p下載軟件，不要到來(lái)歷不明的地方下載軟件，假如萬(wàn)不得以要這么做，對(duì)下載下來(lái)的文件一定要用毒霸進(jìn)行查毒。