我去试试！以为不是自己的机器，要等明天，我会及时告诉你们的！
谢谢，无邪兄和mopery

我也是这个问题！貌似是中了落雪木马的后遗症，98下通过在注册表下找INTEXPLORE.com改回iexplore.exe就解决了，但XP下就是搞不定啊。
有没有人知道啊

我也一样`~

我也是这样，期待老大的文章。

我用卡巴把这个病毒监视了一遍
得到以下恢复文件，显示了病毒修改了注册表的哪些地方，可惜键值是我原来的键值
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HTTP\shell\open\command]
@="\"D:\\Program Files\\Maxthon\\Maxthon.exe\" \"%1\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\opennew\command]
@="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ftp\shell\open\command]
@="\"D:\\Program Files\\Maxthon\\Maxthon.exe\" \"%1\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command]
@=hex(2):22,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,\
  00,69,00,6c,00,65,00,73,00,5c,00,49,00,6e,00,74,00,65,00,72,00,6e,00,65,00,74,\
  00,20,00,45,00,78,00,70,00,6c,00,6f,00,72,00,65,00,72,00,5c,00,69,00,65,00,78,\
  00,70,00,6c,00,6f,00,72,00,65,00,2e,00,65,00,78,00,65,00,22,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command]
@="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,\
  00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,6e,00,64,\
  00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,25,00,53,00,79,00,73,\
  00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,\
  00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,65,00,6c,00,6c,00,33,00,32,00,2e,\
  00,64,00,6c,00,6c,00,2c,00,4f,00,70,00,65,00,6e,00,41,00,73,00,5f,00,52,00,75,\
  00,6e,00,44,00,4c,00,4c,00,20,00,25,00,31,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\telnet\shell\open\command]
@="rundll32.exe url.dll,TelnetProtocolHandler %l"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Generate Typelib\command]
@="\"C:\\WINDOWS\\system32\\RUNDLL32.EXE\" C:\\WINDOWS\\system32\\scrobj.dll,GenerateTypeLib \"%1\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install\command]
@="rundll32.exe desk.cpl,InstallScreenSaver %l"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\open\command]
@="\"D:\\Program Files\\Maxthon\\Maxthon.exe\" \"%1\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\Install\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,\
  00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,6e,00,64,\
  00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,73,00,65,00,74,00,75,\
  00,70,00,61,00,70,00,69,00,2c,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,48,\
  00,69,00,6e,00,66,00,53,00,65,00,63,00,74,00,69,00,6f,00,6e,00,20,00,44,00,65,\
  00,66,00,61,00,75,00,6c,00,74,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,20,\
  00,31,00,33,00,32,00,20,00,25,00,31,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command]
@="\"D:\\Program Files\\Microsoft Office\\OFFICE11\\msohtmed.exe\" /p %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\dunfile\shell\open\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,\
  00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,52,00,55,00,4e,00,44,\
  00,4c,00,4c,00,33,00,32,00,2e,00,45,00,58,00,45,00,20,00,4e,00,45,00,54,00,53,\
  00,48,00,45,00,4c,00,4c,00,2e,00,44,00,4c,00,4c,00,2c,00,49,00,6e,00,76,00,6f,\
  00,6b,00,65,00,44,00,75,00,6e,00,46,00,69,00,6c,00,65,00,20,00,25,00,31,00,00,\
  00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cplfile\shell\cplopen\command]
@="rundll32.exe shell32.dll,Control_RunDLL \"%1\",%*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bfc\ShellNew]
"command"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,\
  00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,6e,00,64,\
  00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,25,00,53,00,79,00,73,\
  00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,\
  00,65,00,6d,00,33,00,32,00,5c,00,73,00,79,00,6e,00,63,00,75,00,69,00,2e,00,64,\
  00,6c,00,6c,00,2c,00,42,00,72,00,69,00,65,00,66,00,63,00,61,00,73,00,65,00,5f,\
  00,43,00,72,00,65,00,61,00,74,00,65,00,20,00,25,00,32,00,21,00,64,00,21,00,20,\
  00,25,00,31,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\ShellNew]
"command"="rundll32.exe appwiz.cpl,NewLinkHere %1"

这时病毒释放的文件
:: This file generated by Kaspersky Anti-Virus ::
del "C:\WINDOWS\1.com"
del "C:\WINDOWS\EXP10RER.com"
copy "C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP6\PdmHist\b54.FC74D6F001C6EF78.history\\00000000.bak" "C:\WINDOWS\WmFirewall.LOG"
del "C:\progra~1\common~1\inexplore.pif"
del "C:\progra~1\intern~1\inexplore.com"
del "C:\WINDOWS\smss.exe"
del "C:\WINDOWS\system32\command.pif"
del "C:\WINDOWS\finders.com"
del "C:\WINDOWS\system32\rund1132.com"
del "C:\DOCUME~1\he\LOCALS~1\Temp\~DFCEDD.tmp"
start restore.reg