virus.txt

并找到依次排列的“FIRST”“SECEND”“THIRD”三项

%windir%\nwnslop.exe
%windir%\qq.exe 
%windir%\qqtm.exe
%windir%\Realplayones.exe
%windir%\realupdate.exe
%windir%\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{19668ED0-5E6D-4522-82F9-8272DE3CD759}.crmlog
%windir%\rising102.exe
%windir%\rising433.exe
%windir%\rising727.exe
%windir%\rising816.exe
%windir%\rundl132.exe
%windir%\rx.exe
%windir%\rxs3.exe
%windir%\servere.exe
%windir%\servicer.exe
%windir%\Services.exe
%windir%\Shell.sys
%windir%\smss.exe
%windir%\svch0st.exe
%windir%\svchost.exe
%windir%\svhost32.exe
%windir%\swchost.exe
%windir%\sws.dll
%windir%\sws32.dll
%windir%\synu.exe
%windir%\syscfg32.exe
%windir%\system.ini
%windir%\system\1.exe 
%windir%\system\2.exe
%windir%\system\3.exe
%windir%\system\4.exe
%windir%\system\5.exe
%windir%\system\6.exe
%windir%\system\7.exe
%windir%\system\8.exe
%windir%\system\9.exe
%windir%\system\C.dll
%windir%\system\CMD.DLL
%windir%\system\conime.exe
%windir%\system\icedate.dat
%windir%\system\IceHBO.dll
%windir%\system\iexplorer.exe
%windir%\system\inetinf.exe
%windir%\system\internat.exe
%windir%\system\internat.exe.tmp
%windir%\system\logo_1.exe
%windir%\system\svchosi.exe
%windir%\system\svchost.exe
%windir%\system\SYSTEM32.vxd
%windir%\system\SYSTEM32.vxd
%windir%\system\taskmgr.exe
%windir%\system\taskmgr.exe.tmp
%windir%\system\updata1.exe
%windir%\system\userinit.exe
%windir%\system\wc1.exe
%windir%\system\wc2.exe
%windir%\system\winlogon.exe
%windir%\system\wo3.exe
%windir%\system\WPC..DLL
%windir%\SYSTEM32.vxd.dat
%windir%\system32\_mzu_stonedrv8.exe
%windir%\system32\0.exe
%windir%\system32\0sy.exe
%windir%\system32\1.exe
%windir%\system32\11.exe
%windir%\system32\1sy.exe
%windir%\system32\2.exe
%windir%\system32\2sy.exe
%windir%\system32\3.exe
%windir%\system32\3sy.exe
%windir%\system32\4.exe
%windir%\system32\4717967351.exe
%windir%\system32\4sy.exe
%windir%\system32\5.exe
%windir%\system32\5sy.exe
%windir%\system32\6.exe
%windir%\system32\6sy.exe
%windir%\system32\7.exe
%windir%\system32\7sy.exe
%windir%\system32\8.exe
%windir%\system32\8sy.exe
%windir%\system32\9.exe
%windir%\system32\9sy.exe
%windir%\system32\abc.exe
%windir%\system32\advport.dll
%windir%\system32\agetltfes.exe
%windir%\system32\alsmt.ex
%windir%\system32\annexpro.exe
%windir%\system32\AVPSrv.dll
%windir%\system32\avwgcmn.dll
%windir%\system32\avwlbmn.dll
%windir%\system32\avzxdmn.dll
%windir%\System32\big5_gb2312.exe
%windir%\system32\cdcd.sys
%windir%\system32\cdnns.dll
%windir%\system32\cdnprot.dat
%windir%\system32\cmdbcs.dll
%windir%\system32\cryptimg.dll
%windir%\system32\csa.exe
%windir%\system32\Death.exe
%windir%\system32\Death.SiShen
%windir%\system32\Death.SiShen.ini
%windir%\system32\dhapri.dll
%windir%\system32\DLMon.dll
%windir%\system32\dms.dll
%windir%\system32\drivers\00002568.SYS
%windir%\system32\drivers\acpidisk.sys
%windir%\system32\drivers\Albus.SYS
%windir%\System32\DRIVERS\azzawf66.sys
%windir%\system32\drivers\FuckJacks.exe
%windir%\system32\drivers\hidproc.sys
%windir%\system32\drivers\iexpl0re.exe
%windir%\system32\drivers\jhhyrg99.sys
%windir%\system32\drivers\npf
%windir%\system32\drivers\npf.sys
%windir%\system32\drivers\paraudio.sys
%windir%\system32\drivers\pcihdd.sys
%windir%\system32\drivers\r.sys
%windir%\system32\drivers\restore.dll
%windir%\system32\drivers\Rinld.sys
%windir%\System32\drivers\spcolsv.exe
%windir%\System32\drivers\spo0lsv.exe
%windir%\System32\drivers\spoclsv.exe
%windir%\system32\drivers\spoOlsv.exe
%windir%\system32\drivers\sppoolsv.exe
%windir%\system32\drivers\svchost.exe
%windir%\system32\drivers\syswav.sys
%windir%\system32\drivers\usbue.sys
%windir%\system32\drivers\userinit.sys
%windir%\system32\drivers\usrinit.dll
%windir%\system32\dt.dll
%windir%\system32\dwwin.exe
%windir%\system32\ef26ev.dll
%windir%\system32\epower.exe
%windir%\system32\FMLLWy.exe
%windir%\System32\g0ld.com
%windir%\System32\g0ld.exe
%windir%\system32\gg.exe
%windir%\system32\HomeServer.exe
%windir%\system32\IeBar1.dll
%windir%\system32\IEXP_LOG.TXT
%windir%\system32\iexp_version.txt
%windir%\system32\iexp1ore.exe
%windir%\system32\iexpl0re.exe
%windir%\system32\ijgctj.dll
%windir%\system32\ijgctj.exe
%windir%\system32\inetsrv\csrss.exe
%windir%\system32\ipci.exe
%windir%\system32\jetspeed.dll
%windir%\System32\jiang.exe
%windir%\system32\jvmlts.exe
%windir%\system32\kapjbzy.dll
%windir%\system32\kaqhezy.dll
%windir%\system32\kawdbzy.dll
%windir%\system32\KB9193316.LOG
%windir%\system32\killme.bat
%windir%\system32\kvdxcma.dll
%windir%\system32\kvdxsbma.dll
%windir%\system32\Kvsc3.dll
%windir%\system32\L_ry60.vbe
%windir%\system32\lexplore.exe
%windir%\system32\Logo1_.exe
%windir%\system32\logogo.exe
%windir%\system32\mainpro.exe
%windir%\system32\MDserivce\Svchost.dll
%windir%\system32\MDserivces\services\Svchost.dll
%windir%\system32\moyu102.dll
%windir%\system32\mppds.dll
%windir%\system32\mppds.dll
%windir%\system32\mrtserv.exe
%windir%\system32\mscat1.dll
%windir%\system32\msccrt.dll
%windir%\system32\msccrt.dll
%windir%\system32\MSDEG32.DLL
%windir%\system32\MsIMMs32.dll
%windir%\system32\MsServices
%windir%\system32\mssock.dll
%windir%\system32\msstart.exe
%windir%\system32\mswsock30.dll
%windir%\system32\mydata.exe
%windir%\system32\MZU_DRV.sys
%windir%\system32\net2.exe
%windir%\system32\netsrvcs.dll
%windir%\system32\netsystem.exe
%windir%\system32\nlsloop.exe
%windir%\system32\NPPTools.dll
%windir%\system32\nslookupi.exe
%windir%\system32\nslookupi.exe
%windir%\system32\NTdHcP.exe
%windir%\system32\ntsokele.exe
%windir%\system32\NTUP1.dll
%windir%\system32\ntworkstan.dll
%windir%\system32\nwizwmgjs.exe
%windir%\system32\perefic.ini
%windir%\system32\pic.gif
%windir%\system32\potian.exe
%windir%\system32\ppa.exe
%windir%\system32\ppb.exe
%windir%\system32\ProcSpy.dll
%windir%\system32\qq.exe
%windir%\system32\QQhx.dat
%windir%\system32\raqjbpi.dll
%windir%\system32\rarjbpi.dll
%windir%\system32\ratbfpi.dll
%windir%\System32\ravmon422.exe
%windir%\system32\rejoice.exe
%windir%\system32\RemoteDbg.dll
%windir%\system32\res.exe
%windir%\system32\retemp.exe
%windir%\System32\rhlamt.dll
%windir%\System32\rhlamt.exe
%windir%\system32\rose.exe
%windir%\system32\Rpcd.dll
%windir%\system32\rpce.exe
%windir%\system32\Rpcs11.exe
%windir%\system32\rpcsexe.exe
%windir%\system32\rsjzbpm.dll
%windir%\system32\rsmydpm.dll
%windir%\system32\rsztcpm.dll
%windir%\system32\run32.exe
%windir%\System32\rundl123.exe
%windir%\system32\rundll2000.exe
%windir%\system32\RUNDLLFOROUR.EXE
%windir%\system32\rundllfromwin2000.exe
%windir%\system32\rundllfromwin2003.exe
%windir%\system32\rundllfromwinxp.exe
%windir%\system32\scardsvr32.dll
%windir%\system32\scardsvr32.exe
%windir%\system32\SCIA.dll
%windir%\system32\serdst.exe
%windir%\system32\serverservice.dll
%windir%\system32\setupAD.exe
%windir%\system32\sidjazy.dll
%windir%\system32\sinaproc327.exe
%windir%\system32\soft.dll.exe
%windir%\system32\sptres.dll
%windir%\system32\SqlIDhelper.dll
%windir%\system32\sqlservech.dll
%windir%\system32\ss.exe
%windir%\system32\ssup.dll
%windir%\system32\stdupnet.dll
%windir%\system32\Supervise.exe
%windir%\System32\SVCH0ST.EXE
%windir%\system32\svchost.pif
%windir%\system32\svchosts.exe
%windir%\system32\svhost1.exe
%windir%\system32\svhost2.exe
%windir%\system32\svhost3.exe
%windir%\system32\svhost32.exe
%windir%\system32\svtpxi.exe
%windir%\system32\syscfg32.exe
%windir%\system32\syscpy.exe
%windir%\system32\syscpy1.exe
%windir%\system32\sysexplorer.exe
%windir%\system32\syslggo.exe
%windir%\system32\sysload3.exe
%windir%\system32\sysnet.exe
%windir%\system32\system.exe
%windir%\system32\system32.exe
%windir%\system32\SYSTEM64.vxd
%windir%\system32\Systemi.exe
%windir%\system32\systemwin.exe
%windir%\system32\systrect.exe
%windir%\system32\sysvem.dll
%windir%\system32\tcdex.exe
%windir%\system32\Temoece.dll
%windir%\system32\temp2.exe
%windir%\system32\temp3.exe
%windir%\system32\temphttp.dll
%windir%\system32\TheMatrixHasYou.exe
%windir%\system32\Tiegeom.dll
%windir%\system32\TIMHost.dll
%windir%\system32\twunk32.exe
%windir%\system32\update
%windir%\system32\update4.exe
%windir%\system32\upxdnd.dll
%windir%\system32\usrinit.exe
%windir%\system32\usrinit.ini
%windir%\system32\vktserv.exe
%windir%\system32\vmm32.vxd
%windir%\system32\wbem\ocmor.dll
%windir%\system32\wbem\rgpgsw23.dll
%windir%\system32\wbem\sojnwd85.dll
%windir%\system32\wc1.exe
%windir%\system32\wc2.exe
%windir%\system32\wdfmgr32.exe
%windir%\system32\wendao.exe
%windir%\system32\win.exe
%windir%\system32\win32smd.exe
%windir%\system32\win32usb.exe
%windir%\system32\winasse.exe
%windir%\system32\windds32.dll
%windir%\system32\windhcp.ocx
%windir%\system32\WinForm.dll
%windir%\system32\winhelp.exe
%windir%\system32\WINPNT.EXE
%windir%\system32\winrpc.exe
%windir%\system32\wins
%windir%\system32\winsocks.dll
%windir%\system32\winsym.exe
%windir%\system32\wla.exe
%windir%\system32\WmdmPmSp.dll
%windir%\system32\wn.exe
%windir%\system32\wniapsvr.exe
%windir%\system32\wnttech.dll
%windir%\system32\wowa.exe
%windir%\system32\WPRINT.EXE
%windir%\system32\ws2_64.dll
%windir%\system32\wsink.dll
%windir%\system32\wsttr.dll
%windir%\system32\wsttrs.dll
%windir%\system32\wsvs.dll
%windir%\system32\wuauc11.exe
%windir%\system32\wuauc1l.exe
%windir%\system32\wuaucl1.exe
%windir%\system32\wuaucll.exe
%windir%\system32\x.LOG
%windir%\system32\xpdhcp.dll
%windir%\system32\xydll.dll
%windir%\system32\zivfnl.exe
%windir%\system32\ztdll.dll
%windir%\system32\zvzwki82.dll
%windir%\system32\zzcoke.dll
%windir%\Systemt.exe
%windir%\temp\1.exe
%windir%\temp\1.vbs
%windir%\Temp\10581.exe
%windir%\Temp\ad4.exe
%windir%\Temp\oprar.exe
%windir%\TEMP\sna.exe
%windir%\Temp\soo2.exe
%windir%\TIMHost.exe
%windir%\uninstall
%windir%\uninstall\rundl132.exe
%windir%\update.exe
%windir%\upxdnd.exe
%windir%\UUUUU12999
%windir%\vbarun.dll
%windir%\vDll.dll
%windir%\vgxuninst.exe
%windir%\virDll.dll
%windir%\vlnenz.exe
%windir%\wc1.exe
%windir%\wc2.exe
%windir%\webwork
%windir%\wgs3.exe
%windir%\wiadebug.log
%windir%\wiaservc.log
%windir%\win.log
%windir%\winamps.exe
%windir%\wincdb.exe
%windir%\windows\g0ld.com
%windir%\windows\g0ld.exe
%windir%\WinForm.exe
%windir%\WinHttp.dll
%windir%\winlog0n.exe
%windir%\WINLOGON.EXE
%windir%\WinSxS\qq2.exe
%windir%\WinSxS\rxjh2.exe
%windir%\WinSxS\wow2.exe
%windir%\WinSxS\zt2.exe
%windir%\winsys.ini
%windir%\wl.exe
%windir%\wls3.exe
%windir%\wms3.exe
%windir%\wos3.exe
%windir%\wow.exe
%windir%\WPC..DLL
%windir%\wsttr.exe
%windir%\wsttrs.exe
%windir%\wsttrse.exe
%windir%\wsvs.exe
%windir%\wuaucll.exe 
%windir%\xye1.dat
%windir%\xye1.exe
%windir%\zaq2.exe
%windir%\zaq5.exe
%windir%\zt.exe
%windir%\zts3.exe
%windir%\system32\npptools.dll
%windir%\system32\runppc.exe
%windir%\system32\runpvc.exe
%windir%\system32\ppc.exe
%windir%\system32\pvc.exe
%windir%\system32\drivers\pcibus.sys
%windir%\system32\drivers\pcidisk.sys
%windir%\system32\drivers\usb32k.sys
%systemroot%\System32\Com\comrepl32.exe