文件: setup.exe

　　大小: 364516 字节

　　修改时间: 2008年4月30日, 16:06:40

　　MD5: C02B797C6F3571E51F0291AD5A34BC88

　　SHA1: 4A4DF2AE026D288D44F680684ECB244F04A1B9B4

　　CRC32: 1F5D3EB4

　　1.释放文件C:tmp.tmp

　　C:Documents and SettingsuserLocal SettingsTempdodolook005.exe

　　C:Documents and SettingsuserLocal SettingsTempha_80040.exe

　　C:Documents and SettingsuserLocal SettingsTempmyse009.exe

　　最后删除C:tmp.tmp

　　2.调用cmd.exe

　　执行命令行:/c "C:DOCUME~1userLOCALS~1Tempdodolook005.exe

　　3.修改注册表：HKCUSoftwareMicrosoftWindowsCurrentVersionInternet

　　SettingsZoneMapProxyBypass

　　HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerShell FoldersCache

　　HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2

　　{73770403-ba37-11db-a75e-806d6172696f}BaseClass

　　myse009.exe运行后释放：C:WINDOWSsystem32infsvchosts.exe

　　C:windowssystem32lwfdfia16_080430.dll

　　C:windowspwisys.ini

　　C:windowssystemsgcxcxxaspf080430.exe

　　C:windowssystem32infsppdcrs080430.scr

　　C:windowssystem32mdccasys32_080430.dll

　　C:windowssystem32infscsys16_080430.dll

　　修改注册表：Count:1

　　HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerShell

　　FoldersPersonal

　　HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerShell FoldersCommon

　　Documents

　　HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerShell FoldersDesktop

　　HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerShell FoldersCommon

　　HKCUSoftwareMicrosoftWindowsShellNoRoamMUICacheC:windowssystem32infsvchosts.exe

　　删除注册表：HKCUSoftwareMicrosoftWindowsShellNoRoamMUICache@shell32.dll,-31233

　　myse009.exe载入C:WINDOWSsystem32infsvchosts.exe

　　解决方案：使用360文件粉碎工具删除文件：C:WINDOWSsystem32infsvchosts.exe

　　C:windowssystem32lwfdfia16_080430.dll

　　C:windowspwisys.ini

　　C:windowssystemsgcxcxxaspf080430.exe

　　C:windowssystem32infsppdcrs080430.scr

　　C:windowssystem32mdccasys32_080430.dll

　　C:windowssystem32infscsys16_080430.dll

　　C:Documents and SettingsuserLocal SettingsTempdodolook005.exe

　　C:Documents and SettingsuserLocal SettingsTempha_80040.exe

　　C:Documents and SettingsuserLocal SettingsTempmyse009.exe

　　修复注册表