Quote:

F3 - REG:win.ini: run=C:\WINDOWS\services.exe
O4 - HKLM\..\Run: [services] C:\WINDOWS\services.exe
O4 - HKLM\..\RunServices: [services] C:\WINDOWS\services.exe
O4 - HKCU\..\Run: [services] C:\WINDOWS\services.exe
O4 - HKCU\..\RunServices: [services] C:\WINDOWS\services.exe
services.exe应该在system32目录下，这个一看就知道是个伪装的恶意文件。