开始时使用了全盘杀毒但没杀出毒来，就没管它了。过了一段时间一些应用程序无法在auzd(power Users)下运行了，一定要用管理员帐号才行。现在是添加/删除程序打开就是一片空白了，而且winnt目录下的文件也看不见了，一定要用资源管理器才能看到下级的目录，无法看到文件。个别目录如此。
IE浏览器也无法打开一些网站了，如微软件的更新网页、QQ空间。

个人处理办法：在管理员用户下，删除了IE6后重装，然后运行regsvr32 vbscript.dll，regsvr32 jscript.dll两个命令。上述问题基本解决，然后切换到power Users用户，发现还是老样子，那两个命令也运行不了。于是又转到管理员帐号下，打开控制面板看到图标又到左边去了。再次运行那两个命令，添加/删除程序好了，但控制面板里的图标还在左边，郁闷，懒得管它了。把auzd转成管理员帐号后，注销切换到auzd下，运行regsvr32 vbscript.dll，regsvr32 jscript.dll，也都恢复了。auzd转成power Users用户就不行了，跟没处理之前一样。没办法了，求助大家来了。

其他帐户有问题么?
建议删除auzd,然后重新建立这个帐户.

如果桌面的链接想保留就先把那个用户名下的desktop文件夹***出去,
重建用户后***回去.

以前也这样试过，重装后没试。不知道情况如何，先试试在说。

还是一样。

用下面:
开始>运行
regsvr32 jscript.dll
regsvr32 vbscript.dll

没用，我处理时用过，运行不了。

有一种情况是“控制面板”打不开或者是所有里面的图标跑到左边，中间有一纵向的滚动条，而右边为空白，再双击添加/删除程序或管理工具，窗体内是空的，这是病毒文件winhlpp32.exe发作的特性。

如下办法解决：1、迅速用杀毒工具进行病毒查杀（我用的norton企业版，病毒库已经升级到了28号的）；2、关闭机器上所有的共享目录，即使要使用共享目录也一定要设置非常长的复杂口令；3、病毒都是通过微软的RPC漏洞进行传播，重要的一定要请专业的网络安全公司打“补丁”，如果操作不当，会造成宕机，反而造成更大的损失。
该病毒是“冲击波”的变种。

我查了这个病毒，也没有结果

同时按下CTRL+ALT+DELETE,进程中有无winhlpp32.exe?

有就可能中高波病毒（变种）

没有。
附上我的扫描日志：
Windows 2000 Professional Service Pack 4 (Build 2195)
- 非管理权限用户 - 受限功能

以下内容被选中：
  所有的启动项目（包括注册表、启动文件夹、服务等）
  浏览器加载项
  正在运行的进程（包括进程模块信息）
  文件关联
  Winsock 提供者
  Autorun.inf
  HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <Internat.exe><internat.exe> [(Verified)Microsoft Corporation]
  <DesktopSprite><C:\Program Files\SnowFox\DesktopSprite2\DesktopSprite.exe> [N/A]
  <Fetion><C:\Program Files\China Mobile\Fetion\Fetion.exe> [China Mobile]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <load><> [N/A]
  <run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <Synchronization Manager><mobsync.exe /logon> [(Verified)Microsoft Corporation]
  <NvCplDaemon><RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
  <RavTray><"D:\Program Files\Rising\Rav\RavTray.exe"> [Rising]
  <RavTask><"D:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
  <KsgUpdateRun><F:\fdd\软件\JSKY_2005\Common\kingsoft\KSG\client.exe> [N/A]
  <CnsMin><; Rundll32.exe C:\WINNT\downlo~1\CnsMin.dll,Rundll32> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe> [(Verified)Microsoft Corporation]
  <Userinit><C:\WINNT\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ImpsSensor]
  <WinlogonNotify: ImpsSensor><ImpsSensor.dll> [China Mobile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
  <WinlogonNotify: klogon><C:\WINNT\system32\klogon.dll> [Kaspersky Lab]
[HKEY_CURRENT_USER\Control Panel\Desktop]
  <SCRNSAVE.EXE><F:\fdd\mp3\王杰\ts300pb\唐诗三~1.SCR> [N/A]

==================================
启动文件夹
[Canon LASER SHOT LBP-1210 状态窗口]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Canon LASER SHOT LBP-1210 状态窗口.LNK --> C:\WINNT\system32\spool\drivers\w32x86\3\CAP2LAK.EXE [CANON INC.]><H>
[wnwb]
<C:\Documents and Settings\user\「开始」菜单\程序\启动\wnwb.lnk --> C:\PROGRA~1\wnwb2005\wnwb.exe [深圳世强软件开发部 www.wnwb.com ]><N>
[TM]
<C:\Documents and Settings\user\「开始」菜单\程序\启动\TM.lnk --> C:\PROGRA~1\Tencent\QQ\TMShell.exe [腾讯公司]><N>
[StudentEx]
<C:\Documents and Settings\user\「开始」菜单\程序\启动\StudentEx.lnk --> D:\PROGRA~1\TOPDOM~1\E-LEAR~1.00\STUDEN~1.EXE [Nanjing Universal Networks (U-NET) Co., LTD.]><N>

==================================
服务
[卡巴斯基反病毒6.0 / AVP][Stopped/Manual Start]
<"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>
[C-DillaCdaC11BA / C-DillaCdaC11BA][Running/Auto Start]
<C:\WINNT\system32\drivers\CDAC11BA.EXE><Macrovision>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[FLEXlm server for PTC / FLEXlm server for PTC][Running/Auto Start]
<"D:\Program Files\flexnet\i486_nt\obj\lmgrd.exe"><Macrovision Corporation>
[MPSVC Service / MPSVCService][Running/Auto Start]
<C:\Program Files\Micropoint\MPSVC.exe><Micropoint Corporation>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINNT\System32\nvsvc32.exe><NVIDIA Corporation>
[RavService / RavService][Running/Auto Start]
<"D:\Program Files\Rising\Rav\RavService.exe" /service><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE><Beijing Rising Technology Co., Ltd.>
[Student Service / STUDSRV][Stopped/Auto Start]
<D:\Program Files\TopDomain\e-Learning Class Standard 4.00\GATESRV.exe><N/A>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
<C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"D:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[3391421 / 3391421][Stopped/Boot Start]
<\SystemRoot\System32\drivers\3391421.sys><N/A>
[aeaudio / aeaudio][Running/Manual Start]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[BHAEFMWHSA / BHAEFMWHSA][Stopped/Manual Start]
<\??\C:\Program Files\Windows优化***\WoptiClean.sys><Wopti>
[CdaC15BA / CdaC15BA][Running/Auto Start]
<\??\C:\WINNT\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[dmboot / dmboot][Stopped/Disabled]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[GWIOPM / GWIOPM][Stopped/Manual Start]
<\??\C:\Program Files\Windows优化***\GWIOPM.sys><N/A>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
<\??\C:\WINNT\system32\drivers\klif.sys><Kaspersky Lab>
[mp110001 / mp110001][Running/Auto Start]
<system32\Drivers\mp110001.sys><MicroPoint Corporation>
[mp110002 / mp110002][Running/Auto Start]
<system32\Drivers\mp110002.sys><Micropoint Corporation>
[mp110003 / mp110003][Running/Boot Start]
<\SystemRoot\system32\Drivers\mp110003.sys><Micropoint Corporation>
[mp110004 / mp110004][Running/Auto Start]
<system32\Drivers\mp110004.sys><Micropoint Corporation>
[mp110005 / mp110005][Running/Manual Start]
<system32\Drivers\mp110005.sys><Micropoint Corporation>
[mp110006 / mp110006][Running/System Start]
<system32\Drivers\mp110006.sys><Micropoint Corporation>
[mp110007 / mp110007][Running/System Start]
<system32\Drivers\mp110007.sys><Micropoint Corporation>
[mp110008 / mp110008][Running/Auto Start]
<system32\Drivers\mp110008.sys><Micropoint Corporation>
[mp110009 / mp110009][Running/System Start]
<system32\Drivers\mp110009.sys><Micropoint Corporation>
[mp110010 / mp110010][Running/Boot Start]
<\SystemRoot\system32\Drivers\mp110010.sys><Micropoint Corporation>
[mp110011 / mp110011][Running/System Start]
<system32\Drivers\mp110011.sys><Micropoint Corporation>
[mp110012 / mp110012][Stopped/Manual Start]
<system32\Drivers\mp110012.sys><Micropoint Corporation>
[mp110013 / mp110013][Running/Boot Start]
<\SystemRoot\system32\Drivers\mp110013.sys><Micropoint Corporation>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
<System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Padus ASPI Shell / pfc][Stopped/Manual Start]
<system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[Samsung Mobile USB Device 1.0 driver (WDM) / ss_bus][Stopped/Manual Start]
<system32\DRIVERS\ss_bus.sys><MCCI>
[SAMSUNG Mobile USB Modem 1.0 Filter / ss_mdfl][Stopped/Manual Start]
<system32\DRIVERS\ss_mdfl.sys><MCCI>
[SAMSUNG Mobile USB Modem 1.0 Drivers / ss_mdm][Stopped/Manual Start]
<system32\DRIVERS\ss_mdm.sys><MCCI>
[TDVideo / TDVideo][Running/System Start]
<\??\C:\WINNT\system32\Drivers\TDVideo.sys><Nanjing Universal Networks (U-NET) Co., LTD.>
[TSP / TSP][Stopped/Manual Start]
<\??\C:\WINNT\system32\drivers\klif.sys><Kaspersky Lab>
[WmRegProDrv / WmRegProDrv][Stopped/Manual Start]
<System32\Drivers\WmRegProDrv.sys><N/A>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookSys / HookSys][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav\HookReg.sys><>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINNT\system32\xunleibho_v13.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_004.dll, Thunder Networking Technologies,LTD>
[bho Class]
{ED8DFC5C-10EF-45AB-9DC2-0639AFF5A270} <C:\PROGRA~1\COMMON~1\Wnwb\wnwbio.dll, 深圳世强软件开发部>
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[金山快译(&K)]
{6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <C:\Program Files\Kingsoft\FastAIT 2006\IEBand.dll, 金山软件股份有限公司>
[Tencent Safety Online Base Module]
{C09B522F-8AED-4E21-A65C-DC1AB652BAEE} <C:\WINNT\DOWNLO~1\TSOBase.ocx, Tencent Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[CPasswordEditCtrl Object]
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINNT\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 308][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690]
  [C:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10029]
  [C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
  [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
  [C:\Program Files\wnwb2005\WNMKEY.DLL] [深圳世强软件开发部 www.wnwb.com , 2005, 7, 5, 1]
  [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.0.2004121400]
[PID: 1952][D:\Program Files\Rising\Rav\RavTray.exe] [Rising, 19, 0, 0, 13]
  [D:\Program Files\Rising\Rav\RavUILib.dll] [, 18, 0, 0, 1]
  [D:\Program Files\Rising\Rav\RavTray936.dll] [Rising, 19, 0, 0, 13]
  [D:\Program Files\Rising\Rav\RsCommx.dll] [rising, 18, 0, 0, 1]
  [C:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10029]
[PID: 1700][C:\WINNT\system32\internat.exe] [Microsoft Corporation, 5.00.2920.0000]
  [C:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10029]
[PID: 1056][C:\Program Files\SnowFox\DesktopSprite2\DesktopSprite.exe] [N/A, N/A]
  [C:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10029]
  [C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[PID: 1060][C:\Program Files\wnwb2005\wnwb.exe] [深圳世强软件开发部 www.wnwb.com , 2005, 11, 19, 1]
  [C:\Program Files\wnwb2005\WNMKEY.DLL] [深圳世强软件开发部 www.wnwb.com , 2005, 7, 5, 1]
  [C:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10029]
[PID: 1600][D:\Program Files\TopDomain\e-Learning Class Standard 4.00\StudentEx.exe] [Nanjing Universal Networks (U-NET) Co., LTD., 1.00.1.299]
  [D:\Program Files\TopDomain\e-Learning Class Standard 4.00\TDMaster.dll] [Nanjing Universal Networks (U-NET) Co., LTD., 1.00.1.299]
  [C:\WINNT\system32\NFC10.dll] [N/A, N/A]
  [D:\Program Files\TopDomain\e-Learning Class Standard 4.00\Language\0804\StudentResEx.dll] [Nanjing Universal Networks (U-NET) Co., LTD., 1.00.1.299]
  [C:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10029]
  [C:\Program Files\Common Files\TopDomain\eXchange\ELCFpsv.dll] [Nanjing Universal Networks Co., LTD., 1, 0, 0, 1]
  [C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
  [C:\Program Files\Common Files\TopDomain\eXchange\Language\0804\ELCFpsvRes.dll] [Nanjing Universal Networks Co., LTD., 1, 0, 0, 1]
[PID: 1588][C:\DOCUME~1\user\LOCALS~1\Temp\Rar$EX00.750\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
  [C:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10029]
  [C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1     localhost

==================================
API HOOK
警告！System Repair Engineer 提醒
你下面的函数内容与预期值不符，他
们可能被一些恶意的软件所修改：
RVA 错误： LoadLibraryA
RVA 错误： LoadLibraryExA
RVA 错误： LoadLibraryExW
RVA 错误： LoadLibraryW

用的优化系统吧,建议重装系统吧