症状:隔段时间自动跳出网页,IE首页被改成http://vod.mmdy.org/,注册表编辑被禁

用ULTRAEDIT搜索http://vod.mmdy.org/后查到一个winpub.reg文件,安全模式删除掉winpub.reg和systems.exe文件,手动注册表解禁后,修复04.06.07.23各项重启后问题依旧,2个文件仍旧存在.

winpub.reg文件内容

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="http://vod.mmdy.org/"
"Start Page"="http://vod.mmdy.org/"
"Search Page"="http://vod.mmdy.org/"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000001
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"HomePage"=dword:00000001
"Settings"=dword:00000001
"Links"=dword:00000001
"SecAddSites"=dword:00000001

Hijackthis扫描日志如下


Logfile of HijackThis v1.99.1
Scan saved at 14:32:17, on 2006-8-22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\crypserv.exe(这个进程是干吗的)
d:\Program Files\ewido anti-spyware 4.0\guard.exe
D:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\myie32c\MyIE.exe
C:\WINDOWS\system32\conime.exe
D:\Download\系统\HijackThis.exe

O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [!ewido] "D:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [webService] systems.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Ekna.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: 金银岛 - {06926B30-424E-4f1c-8EE3-543CD96573DC} - D:\Program Files\Netcert\NCOnlineClt.exe
O9 - Extra 'Tools' menuitem: 金银岛 - {06926B30-424E-4f1c-8EE3-543CD96573DC} - D:\Program Files\Netcert\NCOnlineClt.exe
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra 'Tools' menuitem: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\FLASHGET.EXE
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\FLASHGET.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{224FAEFC-4D46-4291-BE8E-72152F5D4D10}: NameServer = 218.85.157.99 202.101.110.55
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: TrkWky (Distributed Link Tracking Clin) - Unknown owner - C:\WINDOWS\TrkWky.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - d:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Remote Managements Instrumenta (Remss_Ser) - Unknown owner - C:\WINDOWS\system32\netstart.exe
O23 - Service: svchost (svchist) - Unknown owner - C:\WINDOWS\G_Server2006.exe (file missing)

crypserv.exe是Kenonic控制加密软件的主程序。


注册表被锁定，以下三项修复不了
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1


O23 - Service: TrkWky (Distributed Link Tracking Clin) - Unknown owner - C:\WINDOWS\TrkWky.exe (file missing)
O23 - Service: svchost (svchist) - Unknown owner - C:\WINDOWS\G_Server2006.exe (file missing)
这二项到安全模式用HIJACKTHIS


O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
控制面板---管理工具---服务--查找Crypkey License 禁止这个服务，到安全模式下删除C:\WINDOWS\SYSTEM32\crypserv.exe

引用:

【秋日里的蓝天的贴子】crypserv.exe是Kenonic控制加密软件的主程序。 注册表被锁定，以下三项修复不了 O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

我已经用手动解禁了,这3项能修复,问题是重启后又跟没修一样

引用:

O23 - Service: TrkWky (Distributed Link Tracking Clin) - Unknown owner - C:\WINDOWS\TrkWky.exe (file missing) O23 - Service: svchost (svchist) - Unknown owner - C:\WINDOWS\G_Server2006.exe (file missing) 这二项到安全模式用HIJACKTHIS

这二项修复没反应,在安全模式也一样....

引用:

O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe 控制面板---管理工具---服务--查找Crypkey License 禁止这个服务，到安全模式下删除C:\WINDOWS\SYSTEM32\crypserv.exe ………………

这文件删了,服务器也停止了,可是问题依旧,...这文件是无辜的...
我觉得问题是出在systems和winpub.cfg是哪里生成出来的,大哥你再看看日志哪里有可疑的地方,以下日志是我照着你说的全做完了以后重启进系统扫描下来的

Logfile of HijackThis v1.99.1
Scan saved at 15:28:39, on 2006-8-22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
d:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
D:\Program Files\myie32c\MyIE.exe
D:\Download\系统\HijackThis.exe

O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [!ewido] "D:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [webService] systems.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Ekna.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: 金银岛 - {06926B30-424E-4f1c-8EE3-543CD96573DC} - D:\Program Files\Netcert\NCOnlineClt.exe
O9 - Extra 'Tools' menuitem: 金银岛 - {06926B30-424E-4f1c-8EE3-543CD96573DC} - D:\Program Files\Netcert\NCOnlineClt.exe
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra 'Tools' menuitem: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\FLASHGET.EXE
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\FLASHGET.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{224FAEFC-4D46-4291-BE8E-72152F5D4D10}: NameServer = 218.85.157.99 202.101.110.55
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: TrkWky (Distributed Link Tracking Clin) - Unknown owner - C:\WINDOWS\TrkWky.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - d:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Remote Managements Instrumenta (Remss_Ser) - Unknown owner - C:\WINDOWS\system32\netstart.exe
O23 - Service: svchost (svchist) - Unknown owner - C:\WINDOWS\G_Server2006.exe (file missing)

在线等救命啊...

参考023项的
http://forum.ikaka.com/topic.asp?board=28&artid=7713905

1、点击"开始"菜单，从"程序"->"附件"中找到"记事本"命令,并执行它。

2、在记事本窗口中输入以下内容：

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\System]
DisableRegistryTools=dword:00000000

3、从"文件"菜单上选择"保存"命令，以"C:\reg.reg"名称存盘.

4、打开"资源管理器"，切换到 C 盘，双点"reg.reg"文件

5、这时系统弹出"是否确认要将 C:\reg.reg 中的信息添加进注册表？"的对话框，点按"是"。随后弹出对话框"C:\reg.reg 里的信息已被成功地输入注册表。"表明导入成功。点按"确定"关闭对话框

O4 - HKLM\..\Run: [webService] systems.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
这4项解禁注册表后修复成功但重启后又恢复原样
========================

O23 - Service: TrkWky (Distributed Link Tracking Clin) - Unknown owner - C:\WINDOWS\TrkWky.exe (file missing)
O23 - Service: svchost (svchist) - Unknown owner - C:\WINDOWS\G_Server2006.exe (file missing)
这两项修复成功了
===================

以下是最新的扫描日志

Logfile of HijackThis v1.99.1
Scan saved at 16:18:07, on 2006-8-22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
d:\Program Files\ewido anti-spyware 4.0\guard.exe
D:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\devldr32.exe
D:\Download\系统\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [!ewido] "D:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [webService] systems.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Ekna.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: 金银岛 - {06926B30-424E-4f1c-8EE3-543CD96573DC} - D:\Program Files\Netcert\NCOnlineClt.exe
O9 - Extra 'Tools' menuitem: 金银岛 - {06926B30-424E-4f1c-8EE3-543CD96573DC} - D:\Program Files\Netcert\NCOnlineClt.exe
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra 'Tools' menuitem: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\FLASHGET.EXE
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\FLASHGET.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - d:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Remote Managements Instrumenta (Remss_Ser) - Unknown owner - C:\WINDOWS\system32\netstart.exe

打开注册表，O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
按顺序打开，把 DisableRegedit=1的值修改成 DisableRegedit=0

http://forum.ikaka.com/topic.asp?board=67&artid=8136489
http://forum.ikaka.com/topic.asp?board=67&artid=8141714&page=1
这两个帖说的事和我的是一样的情况...最终好象也没解决?蓝天,全看你的了

引用:

【秋日里的蓝天的贴子】打开注册表，O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 按顺序打开，把 DisableRegedit=1的值修改成 DisableRegedit=0 ………………

大哥,我不是修改不了注册表,我知道怎么手动解禁,CMD窗口打reg import unlock.reg,注册表我要怎么改都可以有办法的,现在问题是systems.exe这文件删不掉,重启就有,另外的winpub.reg就是它生出来的

我在网上找的一篇贴子

如何查杀systems.exe病毒

该程序在以下几个地方有据点：
1。HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\Userinit
2。c:\recycled(回收站)
3。c:\windows\systems32\systems.exe
4。c:\windows\temp

其中解决1，2，3处即可在windows下kill掉该程序
解决方法：进入安全模式下.
1。定位到HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\Userinit
打开后看到explorer.exe后面有个“,c:\recycled\xxx.exe”,删掉除explorer.exe以外的东西
2。删掉recycled里面隐藏的程序和相关文件
3。删掉c:\windows\systems32\systems.exe，注意需要在关掉systems进程后才能删掉，顺便也删掉c:\windows\temp下所有内容，虽然这部分并没有危害，但是存了程序的备份


至于想看看回收站里到底存了什么东西
执行attrib c:\recycled -r -a -s -h即可

也可以在安全模式下运行如下文件来删除病毒:


你试试，如果解决了请将答案贴出来