Readme.txt Pop-up free song Virus removal method _ virus killing

Virus name: TROJAN.DELF.RSD < rising ><macfee. Kabbah not reported >
MD5 216a3783443fc9c46fe4d32aa13c390f


After running the virus sample, automatically copy the copy to the%systemroot% directory
%systemroot%\flashplay.dll
%systemroot%\ge_1237.exe
X:\flashplay.dll
X:\readme.txt.exe
X:\autorun.inf
X refers to a non-system drive letter
%systemroot% is an environment variable,

What's inside Autorun.inf:
[Autorun]
Open=.\readme.txt.exe
Shell\1=open
Shell\1\command=.\readme.txt.exe
Shell\2\=browser
Shell\2\command=.\readme.txt.exe
Shellexecute=.\readme.txt.exe
[Autorun]
Open=.\readme.txt.exe
Shell\1=open
Shell\1\command=.\readme.txt.exe
Shell\2\=browser
Shell\2\command=.\readme.txt.exe
Shellexecute=.\readme.txt.exe


To run the Ie,%systemroot%\ge_1237.exe connection network:
IP Address: 125.91.104.177 port is: 80
IP Address: 59.45.180.5 port is: 37
IP Address: 221.238.249.18 port is: 80



About pop-up free song, point to URL: http://img2.uiuni.com/ivr/all/index.html?uid=2722


Workaround:

1. Run the IceSword---settings---prohibit thread creation---Force uninstall is inserted into the Explorer.exe process and the C:\WINDOWS\system32\flashplay.dll of the iexplore.exe process


Attached Sreng log:

Code:
[pid:4916] [C:\WINDOWS\explorer.exe]
[C:\WINDOWS\system32\flashplay.dll]
[pid:1508] [C:\Program files\internet Explorer\iexplore.exe]
[C:\WINDOWS\system32\flashplay.dll]



2. Use IceSword---file---delete:


%systemroot%\flashplay.dll
%systemroot%\ge_1237.exe
Remove the non-system drive letter
X:\flashplay.dll
X:\readme.txt.exe
X:\autorun.inf
Precautions:

When you use IceSword to remove the X:\readme.txt.exe, the desktop process is automatically aborted, after the deletion is complete, unblock the thread creation, use: Ctrl+ait+del pull out the Task Manager, select the file--new task--Bring up the desktop process: Explorer.exe