C:\WINDOWS\system32\meassrv.exe
C:\WINDOWS\system32\mcvcea.exe
C:\WINDOWS\system32\msconfig.exe
http://www.qq5.com
http://www.97sky.cn
C:\WINDOWS\system32\meassrv.exe runsrv /name:”Remote Access” /prinum:”32″ /cmdline:”C:\WINDOWS\system32\mcvcea.exe”