Trojan.PWS.QQPass

1.?

2.?

1)?QQQQ?

2)ADSL?QQ

3.?

1)

2QQQQQQ?QQ?

3)WMFWMFHELPMSXP+SP1?

4.?

1X?

EXE?WMF?JPG?GIF?

2)?

3)MS?FLASH?

*^_^*

1?

IP?->->?cmd?netstat -anIP?protolocal address?foreign address?state

2?

->->?cmdnet start?

3

->->?regedit?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion?runHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion?runHKEY-USERS\.Default\Software\Microsoft\Windows\CurrentVersion?run

Windows?System.ini?[boot]shell=Explorer.exe file.exe?file.exe

4

->->?cmdnet usernet user Administrator?administratorsadministratorsadministratorsnet user/del?

1

2RUN?RUNSERVEICE

3?

4?WINNT?SYSTEM?SYSTEM32?C?D?E?.exe?.com?.bat?

5?HKEY_LOCAL_MACHINE?HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main?Local Page

6HKEY_CLASSES_ROOT\txtfile\shell\open\command? HKEY_CLASSES_ROOTxtfileshellopencommand?.txt?

LockDown?The Clean