virus.txt

并找到依次排列的“FIRST”“SECEND”“THIRD”三项

'%ALLUSERSPROFILE%=C:\Documents and Settings\All Users
'%APPDATA%=C:\Documents and Settings\Administrator\Application Data
'%CommonProgramFiles%=C:\Program Files\Common Files
'%ProgramFiles%=C:\Program Files
'%SystemDrive%=C:
'%TEMP%=C:\Documents and Settings\Administrator\Local Settings\Temp
'%USERPROFILE%=C:\Documents and Settings\Administrator
'%windir%=C:\windows
%ALLUSERSPROFILE%\Application Data\Microsoft\win1ogon.exe
%ALLUSERSPROFILE%\Templates\temp.exe
%CommonProgramFiles%\{2A1D0905-06A3-2052-0514-030807030056}\Update.exe
%CommonProgramFiles%\{38A4DA07-0648-2052-0403-060602150056}
%CommonProgramFiles%\iexplore.com
%CommonProgramFiles%\Microsoft Shared\kplqtjg.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\872A00AC.dat
%CommonProgramFiles%\Microsoft Shared\MSInfo\872A00AC.dll
%CommonProgramFiles%\Microsoft Shared\MSInfo\Sysrema.exe
%CommonProgramFiles%\svhost32.exe 
%CommonProgramFiles%\System\Explorernew.exe
%CommonProgramFiles%\System\temp[1].exe
%CommonProgramFiles%\System\temp[2].exe
%CommonProgramFiles%\System\temp[3].exe
%CommonProgramFiles%\System\temp[4].exe
%CommonProgramFiles%\System\temp[5].exe
%CommonProgramFiles%\System\temp[6].exe
%CommonProgramFiles%\System\temp[7].exe
%CommonProgramFiles%\System\update.dat
%CommonProgramFiles%\System\update.exe
%CommonProgramFiles%\System\Updaterun.exe
%CommonProgramFiles%\System\updskl.bat
%ProgramFiles%\1qq.exe
%ProgramFiles%\3721
%ProgramFiles%\baidu
%ProgramFiles%\biget\bigetloader.exe
%ProgramFiles%\CNNIC
%ProgramFiles%\Common Files\Microsoft Shared\MSInfo\IEINF05.DLL
%ProgramFiles%\Common Files\Microsoft Shared\MSINFO\Network.exe
%ProgramFiles%\Common Files\Microsoft Shared\MSInfo\system.2dt
%ProgramFiles%\Common Files\Microsoft Shared\nuygtvw.exe
%ProgramFiles%\Common Files\Services\svchost.exe
%ProgramFiles%\Common Files\System\d1.exe
%ProgramFiles%\Common Files\System\d2.exe
%ProgramFiles%\Common Files\System\d3.exe
%ProgramFiles%\Common Files\System\terebmi.exe
%ProgramFiles%\Common Files\System\Updaterun.exe
%ProgramFiles%\coolsign
%ProgramFiles%\Deepdo
%ProgramFiles%\DeskAdTop
%ProgramFiles%\Eset
%ProgramFiles%\Internet Explorer\0.exe
%ProgramFiles%\Internet Explorer\0sy.exe
%ProgramFiles%\Internet Explorer\1.exe
%ProgramFiles%\Internet Explorer\1sy.exe
%ProgramFiles%\Internet Explorer\2.exe
%ProgramFiles%\Internet Explorer\2sy.exe
%ProgramFiles%\Internet Explorer\3.exe
%ProgramFiles%\Internet Explorer\3sy.exe
%ProgramFiles%\Internet Explorer\4.exe
%ProgramFiles%\Internet Explorer\4sy.exe
%ProgramFiles%\Internet Explorer\5.exe
%ProgramFiles%\Internet Explorer\5sy.exe
%ProgramFiles%\Internet Explorer\6.exe
%ProgramFiles%\Internet Explorer\6sy.exe
%ProgramFiles%\Internet Explorer\7.exe
%ProgramFiles%\Internet Explorer\7sy.exe
%ProgramFiles%\Internet Explorer\8.exe
%ProgramFiles%\Internet Explorer\8sy.exe
%ProgramFiles%\Internet Explorer\9.exe
%ProgramFiles%\Internet Explorer\9sy.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\isignup.dll
%ProgramFiles%\Internet Explorer\PLUGINS\system.jmp
%ProgramFiles%\Internet Explorer\PLUGINS\system16.sys
%ProgramFiles%\Internet Explorer\PLUGINS\system32.jmp
%ProgramFiles%\Internet Explorer\PLUGINS\System64.Jmp
%ProgramFiles%\Internet Explorer\PLUGINS\System64.Sys
%ProgramFiles%\Internet Explorer\rundll32.exe
%ProgramFiles%\Internet Explorer\services.exe
%ProgramFiles%\Internet Explorer\smss.exe
%ProgramFiles%\Internet Explorer\winlogon.exe
%ProgramFiles%\Internet Explorer\xye1.dat
%ProgramFiles%\Internet Explorer\xye1.exe
%ProgramFiles%\j11.exe
%ProgramFiles%\j22.exe
%ProgramFiles%\j33.exe
%ProgramFiles%\Kav\Kav.dll
%ProgramFiles%\Microsoft
%ProgramFiles%\Microsoft\svhost32.exe
%ProgramFiles%\Microsoft\svhost32.exe 
%ProgramFiles%\pcast
%ProgramFiles%\pplive
%ProgramFiles%\svhost32.exe
%ProgramFiles%\svhost32.exe
%ProgramFiles%\vagaa
%ProgramFiles%\WindowsUpdate
%ProgramFiles%\windowsupdate\7.exe
%ProgramFiles%\wpss\awsg.dll
%SystemDrive%\_.de
%SystemDrive%\5006kala.exe
%SystemDrive%\ads.exe
%SystemDrive%\gh0st.exe
%SystemDrive%\igm.exe
%SystemDrive%\igw.exe
%SystemDrive%\jpgijf.exe
%SystemDrive%\myDelm.bat
%SystemDrive%\nwod.exe
%SystemDrive%\pophit.exe
%SystemDrive%\seep.exe
%SystemDrive%\serdst.exe
%SystemDrive%\serdst.exe
%SystemDrive%\setupcmd.exe
%SystemDrive%\svchost.exe
%SystemDrive%\swchost.exe
%SystemDrive%\swchost.exe
%SystemDrive%\update.bat
%SystemDrive%\wc1.exe
%SystemDrive%\wc2.exe
%SystemDrive%\winla
%SystemDrive%\wn.exe
%Systemroot%\system32\DocProp1.dll
%Systemroot%\system32\msv1_1.dll
%Systemroot%\system32\packet.dll
%Systemroot%\system32\pthreadVC.dll
%Systemroot%\system32\servers.ini
%Systemroot%\system32\wpcap.dll
%TEMP%\0.exe
%temp%\008.exe
%temp%\1.exe 
%temp%\11.exe
%TEMP%\1126.exe
%temp%\188.exe
%temp%\199019005.exe
%temp%\2.exe 
%temp%\2005r.exe
%TEMP%\2183tempbak.exe
%temp%\3.exe 
%TEMP%\35569000.exe
%temp%\4.exe 
%temp%\5007kala.exe
%temp%\5156.exe
%TEMP%\7i.dll
%TEMP%\8-1a.exe
%TEMP%\888sky.exe
%TEMP%\999sky.exe
%temp%\ah.bat
%temp%\an85.com
%temp%\autou1.exe
%TEMP%\b.dll
%TEMP%\bhrrin.dll
%TEMP%\bind.exe
%temp%\bind_40094.exe
%TEMP%\bind_40314.exe
%TEMP%\bind_50202.pif
%temp%\bizA.exe
%temp%\Cn911.exe
%TEMP%\Cn911.vbe
%TEMP%\config.ini
%TEMP%\conime.exe
%TEMP%\cs.exe
%TEMP%\csrss.exe
%TEMP%\dai2.exe
%temp%\daso.exe
%temp%\dns.exe 
%temp%\downloader.exe
%TEMP%\drsmartload.exe
%temp%\e4dt954o.dll
%TEMP%\emtv.com
%temp%\expones.exe
%TEMP%\g0ld.com
%TEMP%\gg.exe
%temp%\gold.com
%temp%\h.dll
%temp%\heng.com
%temp%\HttpGet.exe
%TEMP%\HttpGet16bt8.exe
%temp%\hyjl2.exe
%temp%\iexplore.exe
%TEMP%\iexplore1.exe
%temp%\iexplore2.exe
%TEMP%\iexplore3.exe
%temp%\iexplore4.exe
%TEMP%\iexplore5.exe
%temp%\iexplore6.exe
%temp%\iexplore7.exe
%TEMP%\iexplore8.exe
%temp%\iexplore9.exe
%temp%\inst018.exe
%temp%\j.exe
%temp%\j5kfa.dll
%TEMP%\JDYF.exe
%TEMP%\jh.exe
%temp%\js.dll 
%temp%\killer.exe
%temp%\loadadv579.exe
%temp%\loadadv660.exe
%TEMP%\ly.ini
%TEMP%\ma000.exe
%temp%\mccrar.exe
%TEMP%\mh.exe
%temp%\mhs.exe
%TEMP%\mhs0.dll
%TEMP%\mhs1.dll
%TEMP%\mhs2.exe
%TEMP%\mhsystem.exe
%temp%\mlnmqqbu
%TEMP%\mutou.exe
%TEMP%\my.exe
%temp%\myself.exe
%TEMP%\mytsf.dll
%TEMP%\newweb10557.exe
%TEMP%\npf.sys
%TEMP%\npptools.dll
%TEMP%\oCOGx.exe
%temp%\oprar.exe
%TEMP%\packet.dll
%TEMP%\QHylC.exe
%temp%\qq2.exe
%temp%\ravmond.exe
%temp%\realupdate.exe
%TEMP%\relpop.exe
%TEMP%\run.vbs
%TEMP%\rxjh2.exe
%temp%\rxm.exe
%TEMP%\rxs0.dll
%temp%\s38sdf.exe
%temp%\s38sll.exe
%TEMP%\scvhost.exe
%temp%\server.exe
%temp%\service_lina_ruanzhong.exe
%TEMP%\setup2.exe
%TEMP%\smss.exe
%temp%\ss10333.exe
%TEMP%\stdwin.dll
%TEMP%\svch0st.exe
%TEMP%\svchost.exe
%TEMP%\svchost.vbs
%TEMP%\svchost32.exe
%TEMP%\svchoste.exe
%temp%\sysonling.exe
%TEMP%\Systemt0.dll
%TEMP%\tdsetup.exe
%TEMP%\temp.exe
%TEMP%\tempbak.exe
%TEMP%\ThankYou.exe
%temp%\theopen.exe
%TEMP%\tubar1232.exe
%temp%\u.dll
%TEMP%\up.asp
%temp%\uprar.exe
%TEMP%\upxdn.dll
%TEMP%\upxdn.exe
%temp%\upxdnd.dll
%temp%\upxdnd.exe
%temp%\userinit.exe
%temp%\vv964.exe
%TEMP%\wanpacket.dll
%TEMP%\wd2_051117_NAV062_mini.exe
%TEMP%\win1.exe
%TEMP%\win2.exe
%TEMP%\win3.exe
%TEMP%\win4.exe
%TEMP%\win5.exe
%TEMP%\winA.exe
%TEMP%\winB.exe
%TEMP%\winC.exe
%TEMP%\wincabb.exe
%TEMP%\winD.exe
%TEMP%\winE.exe
%TEMP%\wingoin.exe
%temp%\winlogse.exe
%temp%\winmgmt.exe
%temp%\WINPNT.EXE
%temp%\WINPNT.VBE
%TEMP%\wl.exe
%temp%\Wl2
%TEMP%\wls0.dll
%temp%\wlzs.dll
%TEMP%\wlzs.exe
%temp%\wm.exe
%TEMP%\wmbose.exe
%temp%\wow.exe
%TEMP%\wow2.exe
%temp%\xxx79.tmp
%temp%\yqr.exe
%temp%\yz29zsa.dll
%TEMP%\zj1244.com
%temp%\Zt2
%temp%\zt2.exe
%temp%\zts.exe
%TEMP%\zts2.exe
%windir%\  .exe
%windir%\~tmp1589.exe
%windir%\0.exe
%windir%\0.log
%windir%\0Sy.exe
%windir%\1.com
%windir%\1.exe
%windir%\1Sy.exe
%windir%\2.exe
%windir%\2Sy.exe
%windir%\3.exe
%windir%\3Sy.exe
%windir%\4.exe
%windir%\4Sy.exe
%windir%\5.exe
%windir%\5Sy.exe
%windir%\6.exe
%windir%\6Sy.exe
%windir%\7.exe
%windir%\756731WO.DLL
%windir%\7Sy.exe
%windir%\8.exe
%windir%\888
%windir%\896588M.BMP
%windir%\8Sy.exe
%windir%\9.exe
%windir%\919331.DLL
%windir%\919331M.BMP
%windir%\9Sy.exe
%windir%\abc.exe
%windir%\alga.exe
%windir%\arjcyf.exe
%windir%\ati3evx.exe
%windir%\auto.exe
%windir%\AVPSrv.exe
%windir%\C.dll
%windir%\c0nime.exe
%windir%\CMD.DLL
%windir%\cmdbcs.exe
%windir%\command\rundll32.exe
%windir%\crasos.exe
%windir%\CSC
%windir%\csrss.exe
%windir%\cye1.exe
%windir%\Dll.dll
%windir%\down\rundll32.exe
%windir%\Download\svhost32.exe
%windir%\Downloaded Program Files\851895
%windir%\Downloaded Program Files\neo.exe
%windir%\driver.exe
%windir%\ef26ev.dll
%windir%\ExERoute.exe
%windir%\exerouter.exe
%windir%\EXP10RER.com
%windir%\feige.exe
%windir%\finder.com
%windir%\finders.com
%windir%\GenProtect.exe
%windir%\ginstall.dll
%windir%\iexp1ore.exe
%windir%\iexpiore.exe
%windir%\iexpl0re.exe
%windir%\IG.exe
%windir%\IGM.exe
%windir%\IGW.exe
%windir%\Intel\rundll32.exe
%windir%\itemabay.exe
%windir%\itembay.exe
%windir%\jautoexp.dat
%windir%\jautoexp.exe
%windir%\Kernelmh.exe
%windir%\KILL.exe
%windir%\kktvte.exe
%windir%\Kvsc3.exe
%windir%\Kvsc3.exe
%windir%\logo_1.exe
%windir%\logo1.exe
%windir%\Logo1_.exe
%windir%\logogo.exe
%windir%\maoxiandao.exe
%windir%\mhs2.exe
%windir%\mhs3.exe
%windir%\mhs4.exe
%windir%\mhs5.exe
%windir%\mppds.exe
%windir%\msagent
%windir%\msagent\svchost.exe
%windir%\mscci.exe
%windir%\msccrt.exe
%windir%\mshosts.exe
%windir%\MsIMMs32.exe
%windir%\MsPrint32D.exe
%windir%\MSroot.exe
%windir%\mtmp.exe
%windir%\mx.exe
%windir%\my.exe
%windir%\mywinsys.ini
%windir%\nslookupi.exe
%windir%\NVDispDrv.exe
%windir%\nwbkgw.exe