在查杀之前，瑞星杀毒已被禁用！并无法扫描日志
症状如下
打开要运行longo.exe的进程时，弹出longo.exe不可用
之后强制重启
每个文件夹都创建出一个.exe(90,112 字节)的可执行程序，如d:/downloads 里出现downloads.exe
不显示后缀名，整个文件夹选项消失！！！
运行如下程序会自动重启（都是管理的``汗）
msconfig.exe regedit.exe taskmgr.exe cmd.exe ntvdm.exe setup.exe x-raypc.exe
rx box.exe processxp.exe hijackthis.exe sysmech6.exe rstrui.exe mmc.exe
winamp.exe r
应该还有很多一运行就自动重启
运行任何涉及注册表的程序（如***.reg）都会重启
在屏幕保护页面中`选择屏保时，多了一个不知名的屏保（什么名字忘记了）
痛苦，想修复都不能，一运行管理器之类的就重启！！
补充：在另一台电脑好不容易复制出来的未知病毒，自动隐藏（阿门！！好在有还原精灵）还是自动删除了，而且是在接通网洛后消失的，不能上传一份上来
只好将用UltraEdit-32记录的一部分拿出来給大家看；顺便问句，用UltraEdit-32打开，算不算运行了它```，sorry。
记录内容如下
A*\AD:\VB\02 Apr 06_01\PatahHati\Patahhati.vbp
ISASS )O?檉?? ?`訐& C:\WINDOWS\security 6 C:\WINDOWS\system\ISASS.exe GetCurrentProcess < C:\WINDOWS\security\krnl32.bat X Software\Microsoft\Windows NT\CurrentVersion , RegisteredOrganization mr.abram's , (4$
userenv.dll GetUserProfileDirectoryA 怶@ 燱@ 8A A 纓糤@ ?@ kernel32 鬢@ 0V@ DA A 纓 X@ ?@ advapi32 OpenProcessToken DX@ TX@ PA A 纓hX@ ?@ GetComputerNameA 鬢@ 燲@ \A A 纓碭@ ?@ GetDiskFreeSpaceA 鬢@ 靀@ hA A 纓 Y@ ?@ CreateToolhelp32Snapshot 鬢@ 8Y@ tA A 纓TY@ ?@ Process32First 鬢@ 孻@ € A 纓淵@ ?@ Process32Next 鬢@ 訷@ ?A A 纓鋂@ ?@ CloseHandle 鬢@ Z@ ?A A 纓(Z@ ?@ OpenProcess 鬢@ `Z@ ?A ‖A 纓lZ@ ?@
advapi32.dll RegCreateKeyA @ 竄@ ?A 「A 纓萙@ ?@ RegSetValueExA @ [@ ?A ∧A 纓[@ ?@ RegQueryValueExA @ H[@ ?A ⌒A 纓\[@ ?@ RegOpenKeyA @ 擺@ ?A ≤A 纓燵@ ?@ RegCloseKey @ 豙@ ?A ¤A 纓鋄@ ?@ LookupPrivilegeValueA DX@ \@ ?A ◆A 纓4\@ ?@ AdjustTokenPrivileges DX@ l\@ ?A ?A 纓刓@ ?@ user32 ExitWindowsEx 糪@ 萛@ A ?A 纓豛@ ?@ GetVersionExA 鬢@ ]@ A ?A 纓 ]@ ?@
krnl32 LNETINFO X O?檉?? ?`訐" \My Documents\*.* . .. < C:\WINDOWS\system\LNETINFO.exe \My Documents\ \ .exe D:\ D:\*.* x C:\Documents and Settings\All Users\Desktop\My Documents.exe isass.exe ? C:\Documents and Settings\All Users\Start Menu\Programs\My Documents.exe C:\WINDOWS system * C:\WINDOWS\system.exe
hkcmd ( C:\WINDOWS\hkcmd.exe B C:\Program Files\Microsoft Office Temp . C:\WINDOWS\Explorer.exe I:\ T C:\Program Files\Microsoft Office\Temp.exe ~ C:\Documents and Settings\All Users\Start Menu\Programs\Startup ? c:\Documents and Settings\All Users\Start Menu\Programs\Startup\system startup.pif " C:\WINDOWS\system C:\WINDOWS\Help J:\ < C:\WINDOWS\Help\user logon.exe & \My Documents\Data D:\Data 6 C:\WINDOWS\system32\Patah_0 L C:\WINDOWS\system\Tak Seperti Dulu.exe H C:\WINDOWS\system\Sejauh Mungkin.exe L C:\WINDOWS\system\Aku Bisa Tanpamu.exe G:\ H:\ T C:\WINDOWS\system\Dibalas Dengan Dusta.exe ` C:\WINDOWS\system\Kau Pikir Kaulah Segalanya.exe @ C:\WINDOWS\system\Aku Kecewa.exe D C:\WINDOWS\system\Viva Elektro.exe @ C:\WINDOWS\system\mr.abram's.exe PatahHati.A.. E:\ F:\ J Tuhan tolonglah aku sedang Patah Hati
0 Yang baru sekaliku alami N Oh Tuhan ternyata rasa ini memang pedih : Benar apa yang mereka katakan F Tak pernah Kusangka apa yang kurasa ` Ternyata tak sama dengan apa yang dia rasakan... & Manado,02 April '06 by_mr.abram's " C:\Patah Hati.txt ? Software\Microsoft\Windows\CurrentVersion\Run Patah Hati user logon HotKeysCmds j Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell Explorer.exe K:\ L:\ M:\ N:\ Z:\
Data *.* msconfig.exe regedit.exe taskmgr.exe cmd.exe ntvdm.exe setup.exe x-raypc.exe rx box.exe processxp.exe hijackthis.exe sysmech6.exe rstrui.exe mmc.exe winamp.exe r Software\Microsoft\Windows\CurrentVersion\Policies\System DisableCMD 0 ( DisableRegistryTools DisableTaskMgr v Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced HideFileExt Hidden 1 v Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoRun x Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ x Software\Policies\Microsoft\CurrentVersion\Policies\Explorer NoFind NoFolderOptions VBA6.DLL __vbaInStr __vbaVarTstLt __vbaVarCat __vbaFileClose __vbaPrintFile __vbaFileOpen __vbaStrI2 __vbaFPInt __vbaFpI2 __vbaR8IntI2 __vbaUI1I2 __vbaErrorOverflow __vbaVarTstGt __vbaVarTstNe __vbaVarMul __vbaVarCopy __vbaI4Var __vbaFreeObjList __vbaVarTstEq __vbaStrVarVal __vbaStrCat __vbaStrToUnicode __vbaStrToAnsi __vbaSetSystemError __vbaFreeVarList __vbaStrVarMove __vbaFreeStrList __vbaStrI4 __vbaVarDup __vbaStrCopy __vbaVarMove __vbaFreeVar __vbaStrMove __vbaObjSet __vbaFreeStr __vbaStrCmp __vbaEnd __vbaFreeObj __vbaHresultCheckObj __vbaNew2 \U@ A __vba
OnError & SeShutdownPrivilege __vbaI4Str __vbaLsetFixstr __vbaStrFixstr __vbaLenBstr __vbaCopyBytes __vbaGenerateBoundsError __vbaRecAnsiToUni __vbaRecUniToAnsi 躷@ ╱@ `
FileVersion 1.00 0
ProductVersion 1.00 8InternalName File Folder H OriginalFilename File Folder.exe 00 ? 1u ? 2u h 3u( y?y?y?y?y?y?y?y?y?y?y?y?y? 幍幍幍幍幍幍幍幍幍幍幍幍幍幍y?灲c?幍?k?k?k?k?k?k?k?9厕滙?y?灲c?幍?{?{?{?{?{?{?{?B掇??y?灲c?幍?勭勭勭勲蕙?幍y?灲c?幍?旣旣旣岓??y?灲k?幍??????y?灲{?幍?鼷鼷?幍y?灲勲幍幍幍幍幍幍幍幍幍幍幍幍 1灲滙岓岓}? 1灲幍幍幍幍幍}? 1灲1灲 1灲1灲1灲1灲 ? € ? ? ( @
在线等待答案！！！
