000.exe都市传说病毒_kavsetup.exe_teniodl.exe是什么进程(3)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}

破坏安全模式

修改

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue值

为0x00000000

HKU\S-1-5-21-1085031214-1078145449-839522115-500

\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden为0x00000002

HKU\S-1-5-21-1085031214-1078145449-839522115-500

\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SuperHidden为0x00000001

屏蔽显示隐藏文件

修改常见杀毒软件服务的start键值为0x00000004

如HKLM\SYSTEM\ControlSet001\Services\RfwService\Start: 0x00000004

修改HKLM\SYSTEM\CurrentControlSet\Services\wuauserv\Start

和HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\start键值为0x00000004

关闭自动更新

添加IFEO映像劫持项

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe

本文来自电脑杂谈，转载请注明本文网址：
https://www.pc-fly.com/a/jisuanjixue/article-34849-3.html