System Volume Information是滋生病毒的温床

 

前段时间下了个病毒样本在虚拟机里测试了一下，它首先干掉了我的安全模式，由于我事先将
安全模式相关注册表项备份了，所以导入reg文件后恢复了安全模式。你可以在注册表中的这个
位置找到它：

HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot

将它导出后，可以看到以下内容：

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot]
"AlternateShell"="cmd.exe"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal]

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmserver]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/EventLog]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/PNP Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Primary disk]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/SCSI Class]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/sermouse.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlS