Logfile of HijackThis v1.99.1Scan saved at 15:10:51, on 2006-10-10Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exeC:\WINDOWS\VM_STI.EXEC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exeC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Thunder\Program\Thunder5.exeE:\腾讯QQ\QQ\QQ.exeE:\腾讯QQ\QQ\TIMPlatform.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeE:\腾讯QQ\TT\TTraveler.exeE:\腾讯QQ\QQ\QQ.exeE:\HijackThis.exeO2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dllO4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /PreloadO4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera 301xO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [Thunder] "C:\Program Files\Thunder\Thunder.exe" /sO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder\Program\GetUrl.htmO8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder\Program\GetAllUrl.htmO9 - Extra button: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder\Thunder.exeO9 - Extra 'Tools' menuitem: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder\Thunder.exeO9 - Extra button: Web反病毒保护 - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dllO9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dllO21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dllO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: 卡巴斯基反病毒软件6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
2006-10-10,15:47:12System Repair Engineer 2.2.6.605Smallfrogs (http://www.KZTechs.com)Windows XP Professional Service Pack 2 (Build 2600)- 管理权限用户 - 完整功能以下内容被选中： 所有的启动项目（包括注册表、启动文件夹、服务等） 浏览器加载项 正在运行的进程（包括进程模块信息） 文件关联 Winsock 提供者 Autorun.inf HOSTS 文件启动项目注册表[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation] <Lava-Lava><; "E:\Lava-Lava\Lava-Lava.exe" /s> [N/A][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation] <kav><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"> [Kaspersky Lab] <BigDogPath><C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera 301x> [N/A] <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)NVIDIA Corporation] <Thunder><"C:\Program Files\Thunder\Thunder.exe" /s> [Thunder Networking Technologies,LTD] <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <KernelFaultCheck><; %systemroot%\system32\dumprep 0 -k> [N/A] <SoundMan><; SOUNDMAN.EXE> [(Verified)Realtek Semiconductor Corp.][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Corporation] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation] <UIHost><logonui.exe> [(Verified)Microsoft Corporation][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Corporation][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon] <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]==================================启动文件夹N/A==================================服务[Adobe LM Service / Adobe LM Service]<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>[卡巴斯基反病毒软件6.0 / AVP]<"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>[Human Interface Device Access / HidServ]<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>[Macromedia Licensing Service / Macromedia Licensing Service]<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>[NVIDIA Display Driver Service / NVSvc]<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>[Remote Packet Capture Protocol v.0 (experimental) / rpcapd]<"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>[Windows Media Connect Service / WMConnectCDS]<C:\Program Files\Windows Media Connect 2\wmccds.exe><Microsoft Corporation>==================================驱动程序[Service for Realtek AC97 Audio (WDM) / ALCXWDM]<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>[dump_wmimmc / dump_wmimmc]<\??\C:\WINDOWS\system32\drivers\dump_wmimmc.sys><N/A>[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS]<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>[VIA Rhine Family Fast Ethernet Adapter Driver Service / FETNDISB]<system32\DRIVERS\fetnd5b.sys><VIA Technologies, Inc.>[kl1 / kl1]<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>[klif / klif]<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>[NetGroup Packet Filter Driver / NPF]<system32\drivers\npf.sys><Politecnico di Torino>[npkcrypt / npkcrypt]<\??\E:\腾讯QQ\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>[nv / nv]<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>[p2pfilter / p2pfilter]<\??\E:\p2p\p2pfilter.sys><N/A>[PNP21483 / PNP21483]<\SystemRoot\system32\Drivers\pnp21382.sys><Anti Driver>[Direct Parallel Link Driver / Ptilink]<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>[Secdrv / Secdrv]<system32\DRIVERS\secdrv.sys><N/A>[TCP/IP Protocol Driver / Tcpip]<system32\DRIVERS\tcpip.sys><Microsoft Corporation>[VIA AGP Filter / viaagp1]<\SystemRoot\system32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>[ViaIde / ViaIde]<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>[viamraid / viamraid]<\SystemRoot\system32\DRIVERS\viamraid.sys><VIA Technologies inc,.ltd>[WmRegProDrv / WmRegProDrv]<System32\Drivers\WmRegProDrv.sys><N/A>==================================浏览器加载项[Thunder Browser Helper]{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>[启动迅雷]{0062C9BD-B349-40DE-91A0-755F37ACD559} <C:\Program Files\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>[Web反病毒保护]{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab>[信息检索(&R)]{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>[FlashGet]{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <, N/A>[Messenger]{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, N/A>[HTML Document]{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A>[HHCtrl Object]{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>[Windows Media Player]{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>[Thunder Browser Helper]{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>[VIDEO__X_MS_ASF Moniker Class]{CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>[RealPlayer G2 Control]{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>[Shockwave Flash Object]{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>[&使用迅雷下载]<C:\Program Files\Thunder\Program\GetUrl.htm, N/A>[&使用迅雷下载全部链接]<C:\Program Files\Thunder\Program\GetAllUrl.htm, N/A>[上传到QQ网络硬盘]<, N/A>==================================正在运行的进程[PID: 592][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)][PID: 676][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)][PID: 700][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 6.0.0.299][PID: 744][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)][PID: 756][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)][PID: 908][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)][PID: 972][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)][PID: 1064][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)][PID: 1112][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)][PID: 1208][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)][PID: 1460][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)][PID: 1700][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2] [C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.10.7184] [C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.7184] [C:\WINDOWS\system32\nvshell.dll] [NVIDIA Corporation, 6.14.10.10035] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299] [E:\腾讯QQ\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4] [E:\腾讯QQ\QQ\qdshm.dll] [, 1, 0, 101, 20] [C:\Program Files\WinRAR\rarext.dll] [N/A, N/A] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll] [Kaspersky Lab, 6.0.0.299][PID: 1868][C:\WINDOWS\VM_STI.EXE] [VM., 4.2.610.4] [C:\WINDOWS\system32\msdmo.dll] [N/A, N/A] [C:\WINDOWS\system32\VM31bPrp.Ax] [VM, 4.2.711.31][PID: 1892][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)][PID: 2028][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.7184] [C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.7184][PID: 484][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)][PID: 1804][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)][PID: 1792][C:\WINDOWS\system32\wscntfy.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)][PID: 1376][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)][PID: 168][C:\Program Files\Thunder\Program\Thunder5.exe] [Thunder Networking Technologies,LTD, 5.4.0.226] [C:\Program Files\Thunder\Program\UpdateDownload.dll] [Thunder Networking Technologies,LTD, 1, 0, 1, 8] [C:\Program Files\Thunder\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 2, 0, 0, 1] [C:\Program Files\Thunder\Program\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031] [C:\Program Files\Thunder\Program\log4cplus.dll] [, 1, 0, 2, 1] [C:\Program Files\Thunder\Program\asyn_dns.dll] [N/A, N/A] [C:\Program Files\Thunder\Program\msgmanage.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 15] [C:\Program Files\Thunder\Program\historyinfo_manage.dll] [Thunder Networking Technologies,LTD, 5, 2, 0, 148] [C:\Program Files\Thunder\Program\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 1, 0, 18] [C:\Program Files\Thunder\Program\FloatBar.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2] [C:\Program Files\Thunder\Components\InMedia\iEmbedShell.dll] [ , 1, 0, 0, 11] [C:\Program Files\Thunder\Components\InMedia\iEmbed04.dll] [ , 2, 3, 0, 37] [C:\Program Files\Thunder\Components\P4PClient\P4PClient.dll] [Thunder Networking Technologies,LTD, 1, 0, 4, 10] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl] [Kaspersky Lab, 6.0.0.299] [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl] [Kaspersky Lab, 6.0.0.299] [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl] [Kaspersky Lab, 6.0.0.299] [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl] [Kaspersky Lab, 6.0.0.299] [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\nfio.ppl] [Kaspersky Lab, 6.0.0.299] [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\fsdrvplgn.ppl] [Kaspersky Lab, 6.0.0.299] [C:\Program Files\Thunder\Program\iTargetAd.dll] [Thunder Networking Technologies,LTD, 1, 0, 1, 59] [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0][PID: 2088][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3292][PID: 2636][C:\Program Files\WinRAR\WinRAR.exe] [N/A, N/A][PID: 2980][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.031\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]==================================文件关联.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1].EXE OK. ["%1" %*].COM OK. ["%1" %*].PIF OK. ["%1" %*].REG OK. [regedit.exe "%1"].BAT OK. ["%1" %*].SCR OK. ["%1" /S].CHM OK. ["C:\WINDOWS\hh.exe" %1].HLP OK. [%SystemRoot%\system32\winhlp32.exe %1].INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1].INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1].VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*].JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*].LNK OK. [{00021401-0000-0000-C000-000000000046}]==================================Winsock 提供者N/A==================================Autorun.infN/A==================================HOSTS 文件127.0.0.1 localhost==================================
引用第6楼lengze于2006-10-10 16:46发表的“”:已经重启过了还是不行
网上找的资料:
CSRSS.exe病毒首先，结束病毒进程%Windows%\csrss.exe（不是%Windows%\System32\csrss.exe）然后，恢复EXE文件关联，接着直接从“我的电脑”或“资源管理器”中找到以下病毒文件，或者通过“搜索”找到它们，删除它们：%System%\dxdiag.com%System%\finder.com%System%\msconfig.comC:\autorun.inf%Programfiles%\Internet Explorer\iexplore.com%Programfiles%\Common Files\iexplore.pif%Windows%\1.com%Windows%\csrss.exe%Windows%\ExERoute.exe%Windows%\explorer1.com%Windows%\finder.com%Windows%\Debug\DebugProgram.exe%System%\command.pif%System%\regedit.com%System%\rundll32.com“开始”>>“程序”\安全测试.lnk“开始”>>“程序”\计算机安全中心.lnk“开始”>>“程序”\系统信息管理器.ink接下来，运行REGEDIT.EXE，打开注册表编辑器，分别查找以下内容并修改为相应的内容：(1)分别查找“finder.com”、“rundll32.com”、“command.pif”的信息，把找到值中的“finder.com”、“rundll32.com”、“command.pif”改为“rundll32.exe”(2)查找“iexplore.com”的信息，把找到值中的“iexplore.com”改为“iexplore.exe”；查找“iexplore.pif”的信息，把找到值中类似“%ProgramFiles%\Common Files\iexplore.pif”的信息改为类似“%ProgramFiles%\Internet Explorer\iexplore.exe”(3)查找“explorer1.com”的信息，把找到值中的“explorer1.com”改为“explorer.exe”最后删除病毒启动项：[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Torjan Program"="%Windows%\CSRSS.exe"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]"Torjan Program"="%Windows%\CSRSS.exe"在[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]把"Shell"="Explorer.exe 1"恢复为"Shell"="Explorer.exe"删除[HKEY_CLASSES_ROOT\Applications\iexplore.com]项和[HKEY_CLASSES_ROOT\winfiles]项基本就解决了。 但是最好用最新的病毒库全盘杀下！
