¼ÐÃD:
¡e¨D§U¡ftemp2.exe
[¥´¦L¥»¶]
§@ªÌ:
eddie55c
®É¶¡:
2007-5-14 09:38 PM
¼ÐÃD:
¡e¨D§U¡ftemp2.exe
temp2.exe¸g±`¥X²{©ówindow ¶}¾÷«á, ¦³¤°»ò¿ë¿ìªk¥hºû×,
¹Á¸Õ«¸Ëwindow³£·|¥X²{³oÓ°ÝÃD, ½Ð«ü±Ð, Thank
§@ªÌ:
bigcaps
®É¶¡:
2007-5-15 01:39 PM
¬y¦æ¯f¬rtemp1.exe,temp2.exe §R°£µoªk¡A°Ñ¦Ò¥H¤U¨BÆJ¡G
1¡B«±ÒF8¶i¤J¦w¥þ¼Ò¦¡¡F
2¡B«öCtrl+Alt+Del¡A½Õ¥X¤u§@ºÞ²zû¡Aµ²§ôtemp1,temp2(¤@¯ë±¡ªp¤U¥i¯à¤u§@ºÞ²zû¤¤¨S¦³¡A¤]´N¬O¨S¦³¸ü¤J¡A¥i¥H¸õ¹L³o¤@¶µ)¡F
3¡B¦b±±¨î¥x¡X¡X¸ê®Æ§¨¿ï¶µ¡X¡XÀ˵ø¡A¥h±¼¡§ÁôÂëOÅ@§@·~¨t²ÎÀɮס¨©M¿ï¨ú¡§Åã¥Ü©Ò¦³ÀɮשM¸ê®Æ§¨¡¨¡F
4¡BÂIÀ»¥kÁä¿ï¾Ü¥´¶}¶i¤J©Ò¦³µwºÐ¡A§R±¼¡§autorun.inf¡Acopy.exe¡Ahost.exe¤TÓ ¤å¥ó¡¨¡F
5¡B¶i¤Jc:windows¡A§R±¼xcopy.exe©Msvchost.exe¡A¤j®a¤£n¾á¤ß¡A³o¨âÓ¤£¬O¨t²ÎÀÉ ¡]¹ê¬°¯f¬r¡^¡A¯u¥¿ªºÀɦbsystem32ùØ¡F
6¡B¶i¤Jc:windowssystem32¡A§R°£ temp1.exe©Mtemp2.exe¡F
7¡B¡]ÃöÁä¤@¨B¡^ÂIÀ»¡§¶}©l¡¨¡X¡X¡§°õ¦æ¡¨¡A¿é¤J¡§regedit¡¨¡A¥´¶}µù¥Uªí½s¿è¾¹¡A¶i
¤J¡§HKEY_CURRENT_USERSoftwareMicosoftWindows NTCurrent VersionWindows¡¨¡A
§R°£ Load¦r¦êÈ¡A©Î¥´¶}²MªÅùرªº¤º®e¡§c:windowssvchost.exe¡¨¡C
¦Ü¦¹¡A¯f¬r§¹¥þ²M²z§¹²¦¡A¨þ¨þ¡I¡I¡I
§@ªÌ:
eddie55c
®É¶¡:
2007-5-16 01:18 AM
Thanks for bigcaps
Åwªï¥úÁ{ ºô»Ú½×¾Â (http://centurys.net/)
Powered by Discuz! 2.5