1、运行冰刃,选择文件,未发现其他分区的msdos.bat，也未发现可疑文件。
2、运行SREngPS.EXE（或改名后）立即退出并被删除。
3、联网后不久，C:\WINDOWS\system32\drivers\etc\hosts的内容被改成如下：
127.0.0.1 localhost
219.235.3.16 search.114.vnet.cn
219.235.3.16 keyword.vnet.cn
219.235.3.16 auto.search.msn.com
219.235.3.16 search.msn.com
219.235.3.16 cnweb.search.live.com
219.235.3.16 www.360safe.com
219.235.3.16 www.k369.com
219.235.3.16 www.5566.net
219.235.3.16 360safe.com
202.165.102.243 update.360safe.com
219.235.3.16 dl.360safe.com
219.235.3.16 down.360safe.com
219.235.3.16 bbs.360safe.com
219.235.3.16 kaba.360safe.com
219.235.3.16 baike.360safe.com
219.235.3.16 www.360.cn
219.235.3.16 360.cn
202.165.102.243 update.360.cn
219.235.3.16 dl.360.cn
219.235.3.16 down.360.cn
219.235.3.16 bbs.360.cn
219.235.3.16 kaba.360.cn
219.235.3.16 baike.360.cn
219.235.3.16 360.qihoo.com
219.235.3.16 360safe.qihoo.com
219.235.3.16 forum.ikaka.com
219.235.3.16 www.ikaka.com
202.165.102.243 update.ikaka.com
219.235.3.16 forum.jiangmin.com
202.165.102.243 update.jiangmin.com
219.235.3.16 tieba.baidu.com
202.165.102.243 update.rising.com.cn
219.235.3.16 online.rising.com.cn
202.165.102.243 center.rising.com.cn
219.235.3.16 up.duba.net
219.235.3.16 shadu.baidu.com
219.235.3.16 du.baidu.com
219.235.3.16 security.symantec.com
219.235.3.16 shadu.duba.net
219.235.3.16 bbs.duba.net
219.235.3.16 www.duba.net
219.235.3.16 online.jiangmin.com
219.235.3.16 cn.mcafee.com
219.235.3.16 www.ahn.com.cn
219.235.3.16 www.kaspersky.com.cn
219.235.3.16 www.pcav.cn
219.235.3.16 www.luosoft.com
219.235.3.16 www.im286.com
219.235.3.16 an.baidu.com
219.235.3.16 ma.baidu.com
219.235.3.16 bbs.htmlman.net
202.165.102.243 download.rising.com.cn
202.165.102.243 rsup08.rising.com.cn
219.235.3.16 10000.286er.com
219.235.3.16 im286.net
219.235.3.16 ju.qihoo.com
219.235.3.16 bbs.chinaz.com
219.235.3.16 www.qihoo.com
202.165.102.243 dnl-cn1.kaspersky-labs.com
202.165.102.243 dnl-cn2.kaspersky-labs.com
202.165.102.243 dnl-cn3.kaspersky-labs.com
202.165.102.243 dnl-cn15.kaspersky-labs.com
202.165.102.243 dnl-eu1.kaspersky-labs.com
202.165.102.243 dnl-eu2.kaspersky-labs.com
202.165.102.243 dnl-eu15.kaspersky-labs.com
202.165.102.243 dnl-us1.kaspersky-labs.com
202.165.102.243 dnl-us2.kaspersky-labs.com
202.165.102.243 dnl-us3.kaspersky-labs.com
202.165.102.243 dnl-us4.kaspersky-labs.com
202.165.102.243 dnl-ru14.kaspersky-labs.com
202.165.102.243 dnl-ru15.kaspersky-labs.com
202.165.102.243 dnl-jp1.kaspersky-labs.com
202.165.102.243 dnl-jp2.kaspersky-labs.com
202.165.102.243 dnl-jp3.kaspersky-labs.com
202.165.102.243 dnl-jp4.kaspersky-labs.com
2
202.165.102.243 dnl-jp14.kaspersky-labs.com
202.165.102.243 dnl-jp15.kaspersky-labs.com
202.165.102.243 dnl-kr1.kaspersky-labs.com
202.165.102.243 dnl-kr2.kaspersky-labs.com
202.165.102.243 dnl-kr3.kaspersky-labs.com
202.165.102.243 dnl-kr14.kaspersky-labs.com
202.165.102.243 dnl-kr15.kaspersky-labs.com
202.165.102.243 dnl-cd1.kaspersky-labs.com
202.165.102.243 dnl-cd2.kaspersky-labs.com
202.165.102.243 dnl-cd14.kaspersky-labs.com
202.165.102.243 dnl-cd15.kaspersky-labs.com
202.165.102.243 downloads1.kaspersky-labs.com
202.165.102.243 downloads2.kaspersky-labs.com
202.165.102.243 downloads3.kaspersky-labs.com
202.165.102.243 downloads4.kaspersky-labs.com
202.165.102.243 downloads5.kaspersky-labs.com
219.235.3.16 rss.360safe.com
219.235.3.16 x.360safe.com
219.235.3.16 d.360safe.com
219.235.3.16 updatem.360safe.com
219.235.3.16 softm.360safe.com
219.235.3.16 ishare.sina.com.cn
219.235.3.16 search.cn.yahoo.com
219.235.3.16 www.google.com
219.235.3.16 google.com
219.235.3.16 www.google.cn
219.235.3.16 www.sogou.com
219.235.3.16 www.yahoo.com.cn
219.235.3.16 cn.yahoo.com
219.235.3.16 search.tom.com
219.235.3.16 zhuansha.duba.net
219.235.3.16 buy.duba.net
219.235.3.16 page.so.163.com
219.235.3.16 www.soso.com
219.235.3.16 sou.china.com
219.235.3.16 test.591jx.com
219.235.3.16 a.topxxxx.cn
219.235.3.16 picon.chinaren.com
4、用GHOST恢复到比半年前更早的镜像，系统正常，也可升级瑞星，在D:\RECYCLER\__96.tmp查到病毒。
清除病毒种类列表：
病毒： Trojan.Win32.Undef.cnf
软件版本：20.41.12
5、问题可能在于半年前的镜像文件已经包含病毒，或者当时未发作。
