修改了一下的文件
c:\Inetpub\wwwroot\readme.eml
[pathname with a string SHARE]\readme.eml
%ProgramFiles%\Common Files\System\ado\readme.eml
%ProgramFiles%\NetMeeting\readme.eml
c:\readme.eml
修改以下文件：
c:\contacts.html
c:\Inetpub\wwwroot\index.html
[pathname with a string SHARE]\DW20.EXE
[pathname with a string SHARE]\DWTRIG20.EXE
[pathname with a string SHARE]\msinfo32.exe
[pathname with a string SHARE]\sapisvr.exe
[pathname with a string SHARE]\Blank.htm
[pathname with a string SHARE]\Citrus Punch.htm
[pathname with a string SHARE]\Clear Day.htm
[pathname with a string SHARE]\Fiesta.htm
[pathname with a string SHARE]\Glacier.htm
[pathname with a string SHARE]\Ivy.htm
[pathname with a string SHARE]\Leaves.htm
[pathname with a string SHARE]\Maize.htm
[pathname with a string SHARE]\Nature.htm
[pathname with a string SHARE]\Network Blitz.htm
[pathname with a string SHARE]\Pie Charts.htm
[pathname with a string SHARE]\Sunflower.htm
[pathname with a string SHARE]\Sweets.htm
[pathname with a string SHARE]\Technical.htm
%ProgramFiles%\Common Files\System\ado\MDACReadme.htm
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwrmind.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwtutor.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\isignup.exe
%ProgramFiles%\Internet Explorer\iedw.exe
%ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe
%ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe
%ProgramFiles%\MSN\MSNCoreFiles\Install\msnsusii.exe
%ProgramFiles%\MSN\MSNIA\msniasvc.exe
%ProgramFiles%\MSN\MSNIA\prestp.exe
%ProgramFiles%\MSN\MsnInstaller\msninst.exe
%ProgramFiles%\NetMeeting\cb32.exe
%ProgramFiles%\NetMeeting\conf.exe
%ProgramFiles%\NetMeeting\netmeet.htm
%ProgramFiles%\NetMeeting\wb32.exe
%ProgramFiles%\Outlook Express\msimn.exe
%ProgramFiles%\Outlook Express\oemig50.exe
%ProgramFiles%\Outlook Express\setup50.exe
%ProgramFiles%\Outlook Express\wab.exe
%ProgramFiles%\Outlook Express\wabmig.exe
%ProgramFiles%\Web Publish\WPWIZ.EXE
%ProgramFiles%\WinPcap\rpcapd.exe
%ProgramFiles%\WinPcap\Uninstall.exe
创建一个进程
runouce.exe %System%\runouce.exe
注册表键值
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Runonce = "%System%\runouce.exe"
%System%\runouce.exe
