映像支持：
      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
          <AppInit_DLLs><WinFormA9.dll> [N/A]
      执行挂勾：
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
          
      <{1D47B341-43DF-4563-753F-345FFA3157D1}><C:\WINDOWS\system32\kvmxama.dll> 
      [N/A]
          
      <{134345F1-DACF-3452-CB7D-4620F34A1531}><C:\WINDOWS\system32\rsztapm.dll> 
      []
          
      <{1C87A354-ABC3-DEDE-FF33-3213FD7447C1}><C:\WINDOWS\system32\kvdxama.dll> 
      [N/A]
          
      <{1598FF45-DA60-F48A-BC43-10AC47853D51}><C:\WINDOWS\system32\rarjapi.dll> 
      []
          
      <{12FAACDE-34DA-CCD4-AB4D-DA34485A3421}><C:\WINDOWS\system32\rsjzapm.dll> 
      [N/A]
          
      <{1859245F-345D-BC13-AC4F-145D47DA34F1}><C:\WINDOWS\system32\avzxamn.dll> 
      [N/A]
          
      <{1E32FA58-3453-FA2D-BC49-F340348ACCE1}><C:\WINDOWS\system32\rsmyapm.dll> 
      []
          
      <{2D47B341-43DF-4563-753F-345FFA3157D2}><C:\WINDOWS\system32\kvmxbma.dll> 
      []
          
      <{1960356A-458E-DE24-BD50-268F589A56A1}><C:\WINDOWS\system32\avwlamn.dll> 
      []
          
      <{37D81718-1314-5200-2597-587901018073}><C:\WINDOWS\system32\kaqhczy.dll> 
      [N/A]
          
      <{1A321487-4977-D98A-C8D5-6488257545A1}><C:\WINDOWS\system32\kapjazy.dll> 
      [N/A]
          
      <{E3F426F6-8634-42A5-A29E-BC694A88FB7D}><C:\WINDOWS\system32\xyupri2.dll> 
      []
          
      <{6E1ADD5A-DA47-4BDB-B38C-846973DC1D93}><C:\WINDOWS\system32\zxavast0.dll> 
      []
          
      <{D12BC423-3713-224D-3F55-32B35C62B11D}><C:\WINDOWS\system32\WinFormA9.dll> 
      []
          <{798977F1-34FC-4DDD-AF6D-1B5C196B4EB4}><C:\Program Files\Common 
      Files\Microsoft Shared\MSINFO\System6.ins> [N/A]

      服务：
      [systems / systems][Running/Auto Start]
      <C:\WINDOWS\system32\126.exe><Microsoft Corporatio>（这个病毒伪造了微软的签名）

      病毒注入了多个正常程序的线程，以Explorer.exe为例：
      [PID: 1768 / new][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 
      6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]
          [C:\WINDOWS\system32\kvmxbma.dll] [N/A, ]
          [C:\WINDOWS\system32\rsztapm.dll] [N/A, ]
          [C:\WINDOWS\system32\rarjapi.dll] [N/A, ]
          [C:\WINDOWS\system32\rsmyapm.dll] [N/A, ]
          [C:\WINDOWS\system32\avwlamn.dll] [N/A, ]
          [C:\WINDOWS\system32\xyupri2.dll] [N/A, ]
          [C:\WINDOWS\system32\zxavast0.dll] [N/A, ]
          [C:\WINDOWS\system32\WinFormA9.dll] [N/A, ]
          [C:\WINDOWS\system32\yfmrafjoty.dll] [N/A, ]
          [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 
      (xpclient.010817-1148)]
          [C:\WINDOWS\system32\nvshell.dll] [, ]
          [C:\WINDOWS\system32\isapir.dll] [N/A, ]
          [C:\WINDOWS\system32\DbgHlp32.dll] [N/A, ]

      修改winsock
      ==================================
      Winsock 提供者
      MSAFD ICMP
          C:\WINDOWS\system32\isapir.dll(, N/A)
      MSAFD ICMP
          C:\WINDOWS\system32\isapir.dll(, N/A)

; 执行挂钩（ShellExecuteHooks）
      70 - C:\WINDOWS\system32\kafyczy.dll - (NULL) - 0.0.0.0
      70 - C:\WINDOWS\system32\avwlamn.dll - (NULL) - 0.0.0.0
      70 - C:\WINDOWS\system32\kafybzy.dll - (NULL) - 0.0.0.0
      70 - C:\WINDOWS\system32\rarjapi.dll - (NULL) - 0.0.0.0
      70 - C:\WINDOWS\system32\kvmxbma.dll - (NULL) - 0.0.0.0
      70 - C:\WINDOWS\system32\rsjzapm.dll - (NULL) - 0.0.0.0
      70 - C:\WINDOWS\system32\kvdxbma.dll - (NULL) - 0.0.0.0
      70 - C:\WINDOWS\system32\avzxamn.dll - (NULL) - 0.0.0.0
      70 - C:\WINDOWS\system32\rsztapm.dll - (NULL) - 0.0.0.0
      70 - C:\Program Files\Common Files\Microsoft Shared\MSINFO\System6.ins - 
      (NULL) - 0.0.0.0

      ; 映像劫持（Image File Execution Options）

      ; 开机自启动程序
      38 - ; D:\Program Files\flyer\flyer.exe - (NULL) - 0.0.0.0

      ; 系统服务
      60 - C:\WINDOWS\system32\systems.exe - Microsoft Corporatio - 
5.1.2600.2180

      ; 当前进程
      50 - C:\WINDOWS\system32\systems.exe - Microsoft Corporatio - 
5.1.2600.2180
      51 - C:\WINDOWS\system32\avwlast.exe - (NULL) - 0.0.0.0
      51 - C:\WINDOWS\system32\kafyczy.dll - (NULL) - 0.0.0.0
      50 - C:\WINDOWS\system32\kafycaz.exe - (NULL) - 0.0.0.0
      50 - C:\WINDOWS\system32\rsjzasp.exe - (NULL) - 0.0.0.0
      51 - C:\WINDOWS\system32\avzxamn.dll - (NULL) - 0.0.0.0
      50 - C:\WINDOWS\system32\avzxast.exe - (NULL) - 0.0.0.0
      51 - C:\WINDOWS\system32\rsztapm.dll - (NULL) - 0.0.0.0
      50 - C:\WINDOWS\system32\rsztasp.exe - (NULL) - 0.0.0.0