文件名：3.exe
摘要：
1自动运行
2安装BHO（浏览器辅助对象）
3在系统目录创建文件
4修改，删除文件
5修改注册表
线程1：
创建注册表键值
HKLM\SOFTWARE\Microsoft\IDSCNP
修改注册表键值
HKLM\SOFTWARE\Microsoft\IDSCNP
HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1094da8-30a0-11dd-817b-806d6172696f}\
HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1094daa-30a0-11dd-817b-806d6172696f}\
创建文件
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\165.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsi3.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsi3.tmp\System.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsm2.tmp
线程2：
创建注册表键值
HKLM\Software\Classes\CLSID\{296AB1C6-FB22-4D17-8834-064E2BA0A6F0}
HKLM\Software\Classes\CLSID\{296AB1C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32
HKLM\Software\Classes\CLSID\{296AB1C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{296AB1C6-FB22-4D17-8834-064E2BA0A6F0}
HKLM\Software\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}
HKLM\Software\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0
HKLM\Software\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\FLAGS
HKLM\Software\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\0
HKLM\Software\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\0\win32
HKLM\Software\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\HELPDIR
HKLM\Software\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}
HKLM\Software\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid
HKLM\Software\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32
HKLM\Software\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib
创建文件
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsm4.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsm5.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz6.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz6.tmp\System.dll
C:\WINDOWS\AMD
C:\WINDOWS\AMD\google.dll
删除文件
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsm4.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz6.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz6.tmp\
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz6.tmp\System.dll
线程3：
创建注册表键值
HKLM\Software\Classes\CLSID\{296AB1C6-FB22-4D17-8834-064E2BA0A6F0}
HKLM\Software\Classes\CLSID\{296AB1C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32
HKLM\Software\Classes\CLSID\{296AB1C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib
创建文件
C:\WINDOWS\AMD\google.dll
C:\WINDOWS\Registration\R000000000007.clb
C:\WINDOWS\system.ini
PIPE\lsarpc
创建互斥体
CTF.Asm.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500
CTF.Compart.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500
CTF.LBES.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500
CTF.Layouts.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500
CTF.TMD.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500
CTF.TimListCache.FMPDefaultS-1-5-21-842925246-1425521274-308236825-500MUTEX.DefaultS-1-5-21-842925246-1425521274-308236825-500
默认设置下的瑞星未拦截。高级别的系统加固和高级别的木马行为防御，只有报修改system,ini。
用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)
