1ï¼é¦å
è¿å
¥å®å
¨æ¨¡å¼ï¼æå¼ä»»ææ件夹ï¼éæ©âå·¥å
·â--âæ件夹âé项--âæ¥çâ--å¨âæ¾ç¤ºç³»ç»æ件âåâæ¾ç¤ºéèæ件åæ件夹âåé¢ä¿è¯å·²å¾éã
2ï¼æ£æ¥åºä»¥ä¸ä¸æç³»ç»æå¡ï¼ä¸å
¨é¨èªå¨è¿è¡ï¼æ¹ä¸ºâç¦æ¢è¿è¡ï¼å¹¶å é¤å¯¹åºçæ件â
Medie Sariel Number Services
C:\WINDOWS\system32\moviemk.exe
Media Sariel Number Services
C:\WINDOWS\system32\notaped.exe
RPCS2
C:\WINDOWS\system32\RPCS2
Windows DHCP Service(windhcpsvc)
C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start
WindowsNt Network Engine(wnttech)
C:\WINDOWS\System32\svchost.exe -k wnttech
3ï¼åæ¶å é¤ä»¥ä¸æ件ï¼ä½äºsystem32ç®å½
moviemk.exe
NOTEPAD.EXE
ï¼æ³¨æï¼ä»¥ä¸ä¸¤ä¸ªæ件åæ¬æ¯ç³»ç»èªå¸¦æ件ï¼ä½ä½ç½®å¹¶ä¸å¨æ£ç¡®ä½ç½®ï¼ç°å¨å¾å¤ç
æ¯é½æ¯å©ç¨è¿æ ·ç伪è£
è¿·æç¨æ·ï¼å¸¸è§çè¿æ诸å¦svchost.exeãrund1132.exeãexplorer.exeãcsrss.exeãsmss.exeçç³»ç»æ件ï¼
vdmop.dll
RPCS2
real.exe
Update.exe
ad812.exe
NTWorkStan.dll
advwhes.dll
d3d1caps.SRG
(好象è¿ææ´å¤æ件ï¼æ²¡è¯¦ç»copyæ件åï¼å¯ä»¥ç¨â详ç»å表âçå½¢å¼æ¥çsyste32ç®å½ï¼ç¶å以âä¿®æ¹æ¶é´â为åºï¼æåå¾æ ï¼æ¾å°ç¸è¿æ¶é´çæ件ï¼å
¨é¨å é¤ãï¼
4ï¼ä»¥ä¸æ件ä½äºwindowsæ ¹ç®å½ã
rxdll.dll
391231.DLL
real.exe
update.exe
hosts
5ï¼å é¤windowsæ ¹ç®å½ä¸ç
downlad ,down ,intelä¸ä¸ªç®å½ã
ç®å½ä¸åå«æ
svchost.exeãrund1132.exeæ件ã
6ï¼æ£æ¥æ³¨å表å¯å¨é¡¹ï¼æ¸
é¤ä¸æå¯å¨é¡¹ãï¼åªéè¦ä¿çææ¯è½¯ä»¶ï¼è¾å
¥æ³çå³å¯ï¼,xpç¨æ·ä¹å¯ä»¥è¿è¡msconfigæ¥æ¸
çå¯å¨é¡¹ã
7ï¼å¨æ§è¡ä»¥ä¸æä½æ¶ï¼è¯·ä¸è¦åå»æå¼Cçï¼Dçï¼Eççç符ãï¼æ±ï¼è¿ä¸æ¡åºè¯¥åå¨ç¬¬ä¸çï¼æå¾åä¿®æ¹äºã主è¦æ¯ä¸æ¸
é¤ä»¥ä¸å 个æå¡åè¿ç¨ï¼å³ä½¿æ¸
é¤äºç£çæ ¹ç®å½ä¸é¢çæ件ï¼ä»ä¹ä¼åèªå¨çæãï¼
ç¼è¾æ³¨å表ï¼
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
å±å¼æ¤é¡¹ï¼æA B C D E..çå 个å项ãï¼ä»£è¡¨å 个ç符ï¼ï¼ä»¥Cç为ä¾ï¼å±å¼C项ï¼å é¤AutoRun以ä¸çææ项ç®ï¼å
æ¬AutoRun项ãéå¤æ§è¡DãEãF.....
ç¼è¾å¥½æ³¨å表以åï¼æå³é®åå»Cçï¼éæ©âæå¼âèåãï¼å次注æï¼ä¸è¦åå»é¼ æ ç´æ¥æå¼ç符ï¼ï¼å é¤ç£çæ ¹ç®å½ä¸é¢çxiaoshen.exe,autorun.infæ件ã注æéå¤æä½å é¤æ¯ä¸ªç符éé¢æ件ã
8ï¼å¾éè¦çä¸æ¥ï¼æ¸
空临æ¶æ件夹ï¼å
æ¬IE临æ¶æ件夹ï¼ç³»ç»ä¸´æ¶æ件夹ï¼RAR解å临æ¶æ件夹ççãå¦æä¸çæçï¼å¯ä»¥ä½¿ç¨windowsä¼å大å¸çè¾
å©è½¯ä»¶æ¸
ç临æ¶æ件
温馨提示:内容为网友见解,仅供参考