1、在主程序中要求将程序拷贝到系统盘\windows\目录下并更名为taskmgr.exe，同时复制第二份到系统盘\windows\system32目录下并更名为explorer.exe。用以混淆用户对病毒的第一判断。

2、程序建立两个windows进程，每个进程每一个时钟周期检查另外一个进程是否正在运行。如果存在弹出对话框“I’m still here!”,如果不存在启动另一个进程并弹出对话框“I’m still here!”。

3、将拷贝好的两个病毒程序添加到注册表起动项中。（oftware\\microsoft\\windows\\currentversion\\run）。每个时钟程序在运行的时候都要向注册表中添加此信息。

-1, in the main program the requested copies of the program to the system disk \ windows \ directory and renamed taskmgr.exe, while the second copy to the system drive \ windows \ system32 directory and renamed explorer.exe. To confuse the users first determine the virus. 2, the program process of the establishment of two windows, each process checks each clock cycle, another process is running. If there are pop-up dialog box " I' m still here!" , If there is no start another process and the pop-up dialog box " I' m still here!" . 3, the two-virus program will copy a good start to the registry key. (Oftware \ \ microsoft \ \ windows \ \ currentversion \ \ run). Each clock is running when the program should add this information to the registry.