Behavior:
1. Release the file:
C:\WINDOWS\system\ 65536 bytes
C:\WINDOWS\system\ 65536 bytes
C:\WINDOWS\system\ 976896 bytes
2. Delete the backup file:
C:\WINDOWS\system32\dllcache\
3. Overwrite system files: C:\WINDOWS\
When the system starts, execute the virus body first, and then execute C:\WINDOWS\system\.
4. Rename the file as: explorer.exe608924508094788, as a backup
5. Try the USB flash drive to propagate and modify the system's hidden file option, but it is not implemented.
Solution:
1. Delete:
C:\WINDOWS\ 65536 bytes
C:\WINDOWS\system\ 65536 bytes
C:\WINDOWS\system\ 65536 bytes
2. Rename explorer.exe608924508094788 to
Or copy from C:\WINDOWS\system\ to C:\WINDOWS\