Iprep.exe virus can effectively solve the virus phenomenon: iprep.exe will be generated in c:\windows\ directory, and some dll files will be generated under system32: fsutk.dll, liprip.dll and rimon.dll. Write down the key value in the registry: HKEY _ local _ machine \ software \ Microsoft \ Windows \ current version \ run, the key value is c:\windows\iprep.exe, and the key name has been forgotten. I think it is a safe thing. . . . There may be other phenomena, but I didn't find them. There is no iprep.exe process in the process, which shows that there is such a possibility: process injection; DLL virus injected into the process will continuously monitor the existence of registry and iprep.exe files. The interval between two inspections is uncertain. It may be a second or a millisecond. This caused the registry to delete his startup and then search again, which also caused the file to be generated immediately after deletion. I used doit (download address, see my forum signature) to kill this virus, from the last process to the end (the program enumerates the processes in the starting order, not in alphabetical order). When there are only about 13- 14 processes left, there are only two svchost.exe processes (in the process of ending, if you encounter a one-minute countdown restart, you can use the DOS command shutdown -a to cancel the restart). When I used doit to delete the virus from the registry, I found that it didn't appear after the repair, so I deleted the file immediately. After restarting, use 360 security guards to check the bad review software and delete the dll files used in the injection process. Another time I didn't start with iprep.exe, I found the virus dll file with 360 security guards. After I found it, I changed my name because I couldn't delete it. Success. Then, because I haven't finished writing the new version of the immunization tool, the old one only produces immunization, and I haven't done anything about the virus files to be immunized, so the time is not as fast as the virus, so I can't be immunized. Because I know the principle of immunity (I wrote the program). So I wrote a batch as follows: delc: \ Windows \ iprep. Exemdc: \ Windows \ iprep。 Exemdc: \ Windows \ iprep.Exe \ anti ... \ Save the batch file in the root directory of disk D, and open the cmd window to run a.bat once, so that we can create the immunization file in the future. (Better hurry) File immunization succeeded. Hehehe. In fact, we have won in this respect. Because there is no startup item, no matter how many DLLs he has, they are still dead horses. Use 360 or antivirus software to search, delete or rename one by one.