运行后  释放C:\Documents and Settings\Administrator\Local Settings\Temp\(病毒名字)+xck.dll
注入病毒进程
然后调用 C:\WINDOWS\explorer.exe中止病毒进程
之后C:\Documents and Settings\Administrator\Local Settings\Temp\(病毒名字)xck.dll 注入explorer.exe进程
HKCR\CLSID\{13BA17A5-1B99-1F84-235B-27482B3A2F26}\InProcSERVER32
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks  {13BA17A5-1B99-1F84-235B-27482B3A2F26}
最后释放  C:\windows\system32\$FG25FG5DFG23.bat删除本身
教程下载地址:http://www.liemozu.com/donghua/2007/0730/down_13.html
附件过大 传不上来.管理见谅

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GreenBrowser)