加强对恶意程序的查杀力度
文件名：7.exe
运行后，会修改注册表：
注册表键： HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
注册表值： CPushSetup
类型: REG_SZ
值： "C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files\Common Files\PushWare\cpush.dll"
使用瑞星最新版本的无法检测到，运行未拦截。
360有提示。
文件名：9[1].exe
该程序创建注册表：
| HKLM\SOFTWARE\IETimber |
| HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess |
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\IETimber
|
修改注册表：
| HKLM\SOFTWARE\IETimber | AgentID | -33554342 |
| HKLM\SOFTWARE\IETimber | Install_Dir | C:\Program Files\Internet Explorer\IETimber |
| HKLM\SOFTWARE\IETimber | TM | 0 |
| HKLM\SOFTWARE\IETimber | ToolBarVer | 2.0.0.9 |
| HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess | BrowseNewProcess | yes |
| HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\IETimber | ie | |
| HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess | BrowseNewProcess | yes |
| HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1094da8-30a0-11dd-817b-806d6172696f}\ | BaseClass | Drive |
| HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1094daa-30a0-11dd-817b-806d6172696f}\ | BaseClass | Drive |
多引擎分析结果：
http://www.virscan.org/report/56d945c61fa75233a08fa0c6269c7ba6.html用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)
