System Volume Information是滋生病毒的溫牀

 

前段時間下了個病毒樣本在虛擬機裏測試了一下，它首先幹掉了我的安全模式，由於我事先將
安全模式相關註冊表項備份了，所以導入reg文件後恢復了安全模式。你可以在註冊表中的這個
位置找到它：

HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot

將它導出後，可以看到以下內容：

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot]
"AlternateShell"="cmd.exe"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal]

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmserver]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/EventLog]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/PNP Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Primary disk]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/SCSI Class]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/sermouse.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/SRService]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/System Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/vds]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/vga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/WinMgmt]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network]

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/AFD]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Browser]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Dhcp]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/dmserver]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/DnsCache]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/EventLog]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/ip6fw.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/ipnat.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/LanmanServer]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/LanmanWorkstation]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/LmHosts]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Messenger]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NDIS]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NDIS Wrapper]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Ndisuio]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NetBIOS]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NetBIOSGroup]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NetBT]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NetDDEGroup]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NetMan]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Network]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NetworkProvider]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NtLmSsp]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/PNP Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/PNP_TDI]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Primary disk]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/rdpcdd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/rdpdd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/rdpwd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/rdsessmgr]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/SCSI Class]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/sermouse.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/SharedAccess]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/SRService]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Streams Drivers]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/System Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Tcpip]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/TDI]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/tdpipe.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/tdtcp.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/termservice]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/vga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/WinMgmt]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/WZCSVC]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E972-E325-11CE-BFC1-08002BE10318}]
@="Net"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E973-E325-11CE-BFC1-08002BE10318}]
@="NetClient"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E974-E325-11CE-BFC1-08002BE10318}]
@="NetService"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E975-E325-11CE-BFC1-08002BE10318}]
@="NetTrans"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"

你可以複製上面的代碼，粘貼到記事本中，將其保存爲一個reg文件就可以以防不測（我發現這個病毒不一直監視安全模式的相關鍵值，
在中了病毒重啓計算機後，我雙擊reg文件導入之就可以恢復安全模式了）。

在虛擬機安全模式下向XP虛擬機拖入一些安全軟件，開始查殺病毒。居然在C盤的System Volume Information文件夾下檢測到100多個
病毒。System Volume Information是Windows XP系統還原備份的文件夾，它的默認權限是SYSTEM完全控制，也就是說除SYSTEM以外
其他用戶都拒絕訪問，如圖：

有時殺毒軟件沒有這個權限也無法進入查殺。既然這個System Volume Information一般是刪除不掉的，我們
可以給它設置everyone完全控制，讓一些不嚴謹的安全軟件可以進入System Volume Information查殺病毒。
當然，如果我們不使用系統還原還可以大膽地手動將其下的所有文件手動刪除，刪不掉可以用文件粉碎機解決。