Wei Jin variant rundl132.exe richdll.dll,f1.exe,f2.exe,f3.exe,f4,exe,f5.exe,f11.exe Solution

Weijin variant rundl132.exe richdll. dll Solution
This variant has not been detected and killed by Jiang min and Kabbah. After several excludes, you can find one to kill and repair the EXE file!
After the virus runs, access the network to download multiple Trojans Program Running) and running! Generate the following Virus File (the current virus is abnormal ):
C: \ Documents and Settings \ your USERNAME \ Local Settings \ temp \ jts0.dll
C: \ Documents and Settings \ your USERNAME \ Local Settings \ temp \ mhso.exe
C: \ Documents and Settings \ your USERNAME \ Local Settings \ temp \ mhso0.dll
C: \ Documents and Settings \ your USERNAME \ Local Settings \ temp \ myso.exe
C: \ Documents and Settings \ your USERNAME \ Local Settings \ temp \ myso0.dll
C: \ Documents and Settings \ your USERNAME \ Local Settings \ temp \ qqs0.dll
C: \ Documents and Settings \ your USERNAME \ Local Settings \ temp \ rxso.exe
C: \ Documents and Settings \ your USERNAME \ Local Settings \ temp \ rxso0.dll
C: \ Documents and Settings \ your USERNAME \ Local Settings \ temp \ wgs0.dll
C: \ Documents and Settings \ your USERNAME \ Local Settings \ temp \ wls0.dll
C: \ Documents and Settings \ your USERNAME \ Local Settings \ temp \ wms0.dll
C: \ Documents and Settings \ your USERNAME \ Local Settings \ temp \ wos0.dll
C: \ Documents and Settings \ your USERNAME \ Local Settings \ temp \ ztso.exe
C: \ Documents and Settings \ your USERNAME \ Local Settings \ temp \ ztso0.dll
C: \ Program Files \ Internet Explorer \ rundll32.exe
C: \ Program Files \ Internet Explorer \ SMSs. exe
C: \ windows \ jts3.exe
C: \ windows \ qqs3.exe
C: \ windows \ richdll. dll
C: \ windows \ Uninstall \ rundl132.exe
C: \ windows \ wgs3.exe
C: \ windows \ wls3.exe
C: \ windows \ wms3.exe
C: \ windows \ wos3.exe
Add a registry key:
HKEY_LOCAL_MACHINE \ SOFTWARE \ soft \ downloadwww
Auto = "1"
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run
Process File
Load = "C: \ WINDOWS \ Uninstall \ rundl132.exe"
Wos3 = "C: \ WINDOWS \ wos3.exe"
Ztsa = "C: \ docume ~ 1 \ your USERNAME \ locals ~ 1 \ temp \ ztso.exe"
Rxsa = "C: \ release E ~ 1 \ your USERNAME \ locals ~ 1 \ temp \ rxso.exe"
Mhsa = "C: \ w.e ~ 1 \ your USERNAME \ locals ~ 1 \ temp \ mhso.exe"
Wls3 = "C: \ WINDOWS \ wls3.exe"
Mysa = "C: \ docume ~ 1 \ admin \ locals ~ 1 \ temp \ myso.exe"
Wgs3 = "C: \ WINDOWS \ wgs3.exe"
Wms3 = "C: \ WINDOWS \ wms3.exe"
Jts3 = "C: \ WINDOWS \ jts3.exe"
Qqs3 = "C: \ WINDOWS \ qqs3.exe"
Infected with all. EXE files except the system file, the size is 72418 bytes!