生成但不限于以下病毒
c:\program files\internet explorer\plugins\winsys84.sys
c:\program files\internet explorer\plugins\newtemp.dll
c:\windows\system32\drivers\scvhost.exe
c:\program files\common files\system\yifdeml.exe
c:\windows\system32\sidjazy.dll
c:\windows\system32\drivers\svchost.exe
c:\windows\avpsrv.exe
c:\docume~1\admini~1\locals~1\temp\a17.exe
c:\windows\msimms32.exe
c:\windows\upxdnd.exe
c:\program files\common files\microsoft shared\tiqrpep.exe
c:\windows\system32a2.sys
c:\windows\\systemroot\system32\drivers\kimejg.sys
此程序进行映像劫持
c:\program files\common files\microsoft shared\tiqrpep.exe
HOSTS文件被改得乱七八糟
127.0.0.1 localhost
0.0.0.0 182838.com
0.0.0.0 204.177.92.68
0.0.0.0 asiafriendfinder.com
0.0.0.0 asqin123.51.net
0.0.0.0 babe520.5188.org
0.0.0.0 music.feifa.com
0.0.0.0 music.v111.com
0.0.0.0 www.jpbeauty.com
0.0.0.0 beautishow.com
0.0.0.0 goodmovies88.com
0.0.0.0 hothack.home.chinaren.com
0.0.0.0 hualiao.net
0.0.0.0 iplus.allyes.com
0.0.0.0 jjkafei.longcity.net
0.0.0.0 kaomm.8m.cn
0.0.0.0 l3iaoliao.com
0.0.0.0 lingaonbvm.myrice.com
0.0.0.0 lovejava.boy.net.cn
0.0.0.0 love7liao.com
0.0.0.0 asqin123.51.net
0.0.0.0 babe520.5188.org
0.0.0.0 music.feifa.com
0.0.0.0 jjkafei.longcity.net
0.0.0.0 kaomm.8m.cn
0.0.0.0 l3iaoliao.com
0.0.0.0 l3iaoliao.com
0.0.0.0 lingaonbvm.myrice.com
0.0.0.0 lovejava.boy.net.cn
0.0.0.0 love7liao.com
0.0.0.0 babe520.5188.org
0.0.0.0 music.feifa.com
0.0.0.0 music.v111.com
0.0.0.0 babe520.5188.org
0.0.0.0 music.feifa.com
0.0.0.0 jjkafei.longcity.net
0.0.0.0 kaomm.8m.cn
0.0.0.0 l3iaoliao.com
0.0.0.0 l3iaoliao.com
0.0.0.0 lingaonbvm.myrice.com
0.0.0.0 lovejava.boy.net.cn
0.0.0.0 love7liao.com
0.0.0.0 babe520.5188.org
0.0.0.0 music.feifa.com
0.0.0.0 music.v111.com
219.153.32.215 auto.search.msn.com
每个盘下有以下文件
bpvrgut.exe
PegeFile.pif
病毒搞出几个隐藏进程
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\TIQRPEP.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\TIQRPEP.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\SCVHOST.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\SCVHOST.EXE
C:\PROGRAM FILES\COMMON FILES\SYSTEM\YIFDEML.EXE
C:\PROGRAM FILES\COMMON FILES\SYSTEM\YIFDEML.EXE
C:\PROGRAM FILES\THUNDER\PROGRAM\THUNDER5.EXE
winsock又被强奸了
C:\WINDOWS\system32\msrav.dll
