D 使用安装设备驱动程序功能搜索services.exe 进程，掺入病毒模块
E 隐藏设备驱动和相关模块
F 根据系统情况，第一次安装后可能重启计算机
G 生成以下配置文件
peers.ini
wincom32.ini
H 打开UDP端口 4000、7871 和 11271，和其他计算机进行加密通信
I 注册本机作为端点进行点对点通信
J 搜索点对点网络中的的一个哈希值，找到后进行下载执行
K 收集本地信息通过点对点网络发布，进行自身更新等
L 下载执行以下文件
http://217.107.217.187/[已删除]/game0.exe
http://81.177.3.169/[已删除]/game1.exe
http://81.177.3.169/[已删除]/game2.exe
http://81.177.3.169/[已删除]/game4.exe
M 通过邮件传播，特征如下
主题（以下之一）：
A killer at 11, he's free at 21 and kill again!
U.S. Secretary of State Condoleezza Rice has kicked German Chancellor Angela Merkel
British Muslims Genocide
Naked teens attack home director.
230 dead as storm batters Europe.
Re: Your text
Radical Muslim drinking enemies's blood.
Chinese missile shot down Russian satellite
Chinese missile shot down Russian aircraft
Chinese missile shot down USA aircraft
Chinese missile shot down USA satellite
Russian missile shot down USA aircraft
Russian missile shot down USA satellite
Russian missile shot down Chinese aircraft
Russian missile shot down Chinese satellite
Saddam Hussein safe and sound!
Saddam Hussein alive!
Venezuelan leader: "Let's the War beginning".
Fidel Castro dead.

附件（以下之一）：
FullVideo.exe
Full Story.exe
Video.exe
Read More.exe
FullClip.exe
GreetingPostcard.exe
MoreHere.exe
FlashPostcard.exe
GreetingCard.exe
ClickHere.exe
ReadMore.exe
FlashPostcard.exe
FullNews.exe

　　光华反病毒软件已经对这种病毒进行了处理，请用户升级后，使用光华反病毒软件清除。

共2页　下一页