注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<wwcid><rundll32 "C:\WINDOWS\Downlo~1\wwcid.dll",Run> [Microsoft Corporation]
<emq6><rundll32 "C:\WINDOWS\Downlo~1\emq6.dll",start> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Winlogon]
<WinlogonNotify: Winlogon><C:\WINDOWS\system32\Winlogon.dll> []
服务
[DCOM Service Process Manager / DCOMClient64][Running/Auto Start]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->c:\windows\inf\dvdromdrv.inf><Microsoft Corporation>
[Rereplay / Microsoft Releplay][Stopped/Auto Start]
<C:\WINDOWS\system32\a.exe><N/A>
驱动程序
[203015 / 203015][Running/Manual Start]
<2 - 系统找不到指定的文件。><N/A>
C:\Autorun.inf
C:\calc.exe
D:\Autorun.inf
D:\calc.exe
E:\calc.exe
E:\calc.exe
F:\Autorun.inf
F:\calc.exe