AV终结者分析报告

scan32.exe;
shcfg32.exe;
SmartUp.exe;
SREng.exe;
symlcsvc.exe;
SysSafe.exe;
TrojanDetector.exe;
Trojanwall.exe;
TrojDie.kxp;
UIHost.exe;
UmxAgent.exe;
UmxAttachment.exe;
UmxCfg.exe;
UmxFwHlp.exe;
UmxPol.exe;
UpLive.EXE.exe;
WoptiClean.exe;
zxsweep.exe;

4.修改以下注册表，导致无法显示隐藏文件
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden dword:00000002
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL CheckedValue dword:00000000

5、修改以下服务的启动类型来禁止Windows的自更新和系统自带的防火墙。
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess Start dword:00000004
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv Start dword:00000004

6.删除以下注册表项，使用户无法进入安全模式
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}