11、感染用户机器上的exe文件，但不感染以下文件夹中的文件:
system
system32
windows
Documents and settings
system Volume Information
Recycled
winnt
Program Files
Windows NT
WindowsUpdate
Windows Media Player
Outlook Express
Internet Explorer
ComPlus Applications
NetMeeting
Common Files
Messenger
Microsoft Office
InstallShield Installation Information
MSN
Microsoft Frontpage
Movie Maker
MSN Gaming Zone

12、枚举系统进程，尝试将病毒dll(vdll.dll)选择性注入以下进程名对应的进程:
Explorer
Iexplore
找到符合条件的进程后随机注入以上两个进程中的其中一个。

13、当外网可用时，被注入的dll文件尝试连接以下网站下载并运行相关程序:
http://www.17**.com/gua/zt.txt 保存为:c:1.txt
http://www.17**.com/gua/wow.txt 保存为:c:1.txt
http://www.17**.com/gua/mx.txt 保存为:c:1.txt

http://www.17**.com/gua/zt.exe 保存为:%SystemRoot%0Sy.exe
http://www.17**.com/gua/wow.exe 保存为:%SystemRoot%1Sy.exe
http://www.17**.com/gua/mx.exe 保存为:%SystemRoot%2Sy.exe
注：三个程序都为木马程序

14、病毒会将下载后的"1.txt"的内容添加到以下相关注册表项：

[HKEY_LOCAL_MACHINESOFTWARESoftDownloadWWW]
"auto"="1"

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows]
"ver_down0"="[boot loader]+++++++++++++++++++++++"
"ver_down1"="[boot loader]
timeout=30
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)WINDOWS="Microsoft Windows XP Professional" ////"
"ver_down2"="default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)WINDOWS="Microsoft Windows XP Professional" /////"