运行样本后生成文件
C:\Downloads
C:\WINDOWS\system32\AddrConfig.bin
C:\WINDOWS\system32\oobe\data\dbisam.lck
C:\WINDOWS\system32\oobe\data\DownFileList.blb
C:\WINDOWS\system32\oobe\data\DownFileList.dat
C:\WINDOWS\system32\oobe\data\DownFileList.idx
C:\WINDOWS\system32\oobe\data\ShareFileList.dat
C:\WINDOWS\system32\oobe\data\ShareFileList.idx
C:\WINDOWS\system32\oobe\data\Users.dat
C:\WINDOWS\system32\oobe\data\Users.idx
C:\WINDOWS\system32\wbem\ddes
C:\WINDOWS\system32\wbem\kbd101ab.dll
C:\WINDOWS\system32\wbem\SysOption.bin
C:\WINDOWS\system32\wbem\winlogon.exe
添加注册表
HKCR\CLSID\{881F6F06-4620-4070-AD05-BD77D4C56661}
HKCR\Interface\{468262B9-8400-4A49-B2E5-CE8550EB1347}
HKCR\TypeLib\{F63B08CD-3645-474F-8872-BA4293251FF9}\1.0
HKCR\VCFIWZDY32.VCFIWZDY
HKCU\Software\Microsoft\MediaPlayer\Player\Extensions
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\System32\WBEM\winlogon.exe
查杀方法..
安全模式下操作.
删除文件
C:\Downloads
C:\WINDOWS\system32\AddrConfig.bin
C:\WINDOWS\system32\oobe\data
C:\WINDOWS\system32\wbem\ddes
C:\WINDOWS\system32\wbem\kbd101ab.dll
C:\WINDOWS\system32\wbem\SysOption.bin
C:\WINDOWS\system32\wbem\winlogon.exe
删除注册表
HKCR\CLSID\{881F6F06-4620-4070-AD05-BD77D4C56661}
HKCR\Interface\{468262B9-8400-4A49-B2E5-CE8550EB1347}
HKCR\TypeLib\{F63B08CD-3645-474F-8872-BA4293251FF9}\1.0
HKCR\VCFIWZDY32.VCFIWZDY
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\System32\WBEM\winlogon.exe
HKCU\Software\Microsoft\MediaPlayer\Player\Extensions
重启回正常模式即可..
