System Volume Information是滋生病毒的温床

关注

原创最新推荐文章于 2026-01-04 17:38:18 发布 3.8k 阅读 AI 写同款· GEO 优化 ›

“System Volume Information”文件夹里的NTFS木马（安全问题）病毒保护伞原因：由于NTFS的分区里该目录只有SYSTEM权限，导致杀毒软件没有权限查杀藏匿于该目录的病毒。(现在大多数软件都能查杀) 解决方案：阻止“System Volume Information”文件夹的自动生成。 1、参考原理：在一个NTFS分区里，把分区权限删到只剩EVERYONE权限，并只设一个“列出文件夹的目录”权限，其他复选框都去钩。在这种情况下，该分区是没有写权限的... 阅读详情

前段时间下了个病毒样本在虚拟机里测试了一下，它首先干掉了我的安全模式，由于我事先将
安全模式相关注册表项备份了，所以导入reg文件后恢复了安全模式。你可以在注册表中的这个
位置找到它：

HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot

将它导出后，可以看到以下内容：

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot]
"AlternateShell"="cmd.exe"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal]

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/dmserver]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/EventLog]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/PNP Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/Primary disk]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/SCSI Class]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/sermouse.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/SRService]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/System Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/vds]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/vga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/WinMgmt]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network]

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/AFD]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Browser]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Dhcp]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/dmserver]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/DnsCache]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/EventLog]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/ip6fw.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/ipnat.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/LanmanServer]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/LanmanWorkstation]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/LmHosts]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Messenger]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NDIS]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NDIS Wrapper]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Ndisuio]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NetBIOS]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NetBIOSGroup]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NetBT]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NetDDEGroup]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NetMan]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Network]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NetworkProvider]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/NtLmSsp]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/PNP Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/PNP_TDI]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Primary disk]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/rdpcdd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/rdpdd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/rdpwd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/rdsessmgr]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/SCSI Class]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/sermouse.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/SharedAccess]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/SRService]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Streams Drivers]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/System Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/Tcpip]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/TDI]
@="Driver Group"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/tdpipe.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/tdtcp.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/termservice]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/vga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/WinMgmt]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/WZCSVC]
@="Service"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E972-E325-11CE-BFC1-08002BE10318}]
@="Net"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E973-E325-11CE-BFC1-08002BE10318}]
@="NetClient"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E974-E325-11CE-BFC1-08002BE10318}]
@="NetService"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E975-E325-11CE-BFC1-08002BE10318}]
@="NetTrans"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"

你可以复制上面的代码，粘贴到记事本中，将其保存为一个reg文件就可以以防不测（我发现这个病毒不一直监视安全模式的相关键值，
在中了病毒重启计算机后，我双击reg文件导入之就可以恢复安全模式了）。

在虚拟机安全模式下向XP虚拟机拖入一些安全软件，开始查杀病毒。居然在C盘的System Volume Information文件夹下检测到100多个
病毒。System Volume Information是Windows XP系统还原备份的文件夹，它的默认权限是SYSTEM完全控制，也就是说除SYSTEM以外
其他用户都拒绝访问，如图：

有时杀毒软件没有这个权限也无法进入查杀。既然这个System Volume Information一般是删除不掉的，我们
可以给它设置everyone完全控制，让一些不严谨的安全软件可以进入System Volume Information查杀病毒。
当然，如果我们不使用系统还原还可以大胆地手动将其下的所有文件手动删除，删不掉可以用文件粉碎机解决。

收录于