43F5D63E.exe是利用了IFEO劫持的变狂病毒
中毒现象：
劫持所有杀毒软件，包括网站，在所有盘符下 生成隐藏文件 auto.inf 和 43F5D63E.exe ，不能显示所有文件
病毒分析：
释放病毒副本如下:
C:\Program Files\Common Files\Macromedia Shared\msinfo\********.dll
C:\Program Files\Common Files\Macromedia Shared\msinfo\********.bat
在注册表中添加下列启动项：
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
XXXXXXXX.dll（本次感染为：43F5D63E.dll ）
在HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options分支添加N个劫持项，废掉多个杀软、防火墙以及常用手工杀毒工具软件
手工杀毒：
1。用进程工具禁止进程创建，如果不能运行请改名，结束除了系统进程外的所有进程
2.删除文件：
C:\Program Files\Common Files\Microsoft Shared\MSInfo文件夹中的：
XXXXXXXX.dll
XXXXXXXX.dat
C:\WINDOWS\system32文件夹中的verclsid.exe
3.请打开注册表编辑器，展开：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
将"CheckedValue"=dword:00000000改为"CheckedValue"=dword:00000001,先解决显示隐藏文件问题。
4.展开：HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
删除： XXXXXXXX.dll
将autoruns.exe改名为autorun.exe运行：
找到HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
删除：
360rpt.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
360Safe.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
360tray.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
adam.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
AgentSvr.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
AppSvc32.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
autoruns.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
avp.com File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
avp.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
CCenter.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
ccSvcHst.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
FileDsty.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
FTCleanerShell.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
HijackThis.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
IceSword.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
iparmo.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
Iparmor.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
isPwdSvc.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
kabaload.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KaScrScn.SCR File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KASMain.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KASTask.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KAV32.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KAVDX.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KAVPFW.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KAVStart.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KISLnchr.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KMailMon.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KMFilter.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KPFW32.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KPFW32X.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KPFWSvc.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KRegEx.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KRepair.COM File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KsLoader.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KVCenter.kxp File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KvDetect.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KvfwMcl.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KVMonXP.kxp File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KVMonXP_1.kxp File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
kvol.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
kvolself.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KvReport.kxp File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KVScan.kxp File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KVSrvXP.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KVStub.kxp File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
kvupload.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
kvwsc.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KvXP.kxp File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KvXP_1.kxp File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KWatch.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KWatch9x.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
KWatchX.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
loaddll.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
MagicSet.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
mcconsol.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
mmqczj.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
mmsk.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
nod32.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
nod32krn.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
nod32kui.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
PFW.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
PFWLiveUpdate.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
Ras.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
Rav.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
RavMon.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
RavMonD.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
RavStub.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
RavTask.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
RegClean.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
rfwcfg.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
RfwMain.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
rfwProxy.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
rfwsrv.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
RsAgent.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
Rsaupd.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
runiep.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
safelive.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
scan32.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
shcfg32.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
SmartUp.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
SREng.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
symlcsvc.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
TrojanDetector.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
Trojanwall.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
TrojDie.kxp File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
UIHost.exe File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
UpLive.EXE File not found: C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\423F27F3.dat
将C:\WINDOWS\system32文件夹中的verclsid.exe.bak改名为verclsid.exe
5.删除每个本地磁盘下的
*:\Autorun.inf
*:\********.exe
C:\DOCUME~1\你的用户名\LOCALS~1\Temp\dl1.exe
c:\program files\common files\microsoft shared\web server extensions\40\bots\vinavbar\svchost.exe
6.运行SREng2,使用：系统修复－－文件关联－－全选－－修复
