Vista,XP雙系統(tǒng)中重裝XP后雙啟動菜單不見的解決.doc

病毒癥狀：explorer核心啟動中附帶有木馬C:WINDOWSKesenjanganSosial注冊表被鎖、文件夾選項消失等等。病毒添加啟動項：開始程序啟動 Empty.pifBron-Spizaetus C:WINDOWSShellNewRakyatKelaparan.exeTok-CirrhatusTok-Cirrhatus-969 C:Documents and SettingsUsersLocal SettingsApplication Databr2961on.exe (數(shù)字有可能不是2961)病毒文件：C:Documents and Settings用戶名Application Data和C:Documents and Settings用戶名Local SettingsApplication Data中有大量病毒程序，比如csrss.exe、inetinfo.exe、winlogon.exe、services.exe、smss.exe、 lsass.exe、svchost.exe、Bron.tok-17-x.exe(x為數(shù)字)、以及帶有“Bron tok”名字的文件，Users是指每一個用戶名。 準(zhǔn)備工具：最新版木馬殺客或者惡意軟件清理助手。殺毒步驟：1、進(jìn)安全模式，用木馬殺客或者惡意軟件清理助手結(jié)束所有帶有Application Data路徑的進(jìn)程。C:Documents and Settings用戶名LocalSettingsApplicationDatacsrss.exeC:Documents and Settings用戶名LocalSettingsApplicationDatainetinfo.exeC:Documents and Settings用戶名LocalSettingsApplicationDataservices.exeC:Documents and Settings用戶名LocalSettingsApplicationDatasmss.exeC:Documents and Settings用戶名LocalSettingsApplicationDatasvchost.exeC:Documents and Settings用戶名LocalSettingsApplicationDatalsass.exeC:Documents and Settings用戶名LocalSettingsApplicationDatawinlogon.exe2、在記事本里面輸入以下內(nèi)容(如果禁止了右鍵，我們可以從“文件”這里新建一個)：dim wshset wsh=wscript.createobject(wscript.shell)wsh.regwrite HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesWinOldAppDisabled,wsh.regwrite HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools,0wsh.popup (已經(jīng)成功解開注冊表)另存為1.vbs或者1.vbe 運(yùn)行這個文件，注冊表就解開了。3、文件夾選項消失，無法顯示隱藏文件、擴(kuò)展名解決方法，用記事本寫以下內(nèi)容：Windows Registry Editor Version 5.00HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALLRegPath=SoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedText=shell32.dll,-30500Type=radioCheckedValue=dword:00000001ValueName=HiddenDefaultValue=dword:00000002HKeyRoot=dword:80000001HelpID=shell.hlp#51105另存為2.reg文件然后雙擊運(yùn)行這個文件。4、恢復(fù)顯示“文件夾選項”，以便查看隱藏文件即文件擴(kuò)展名：運(yùn)行g(shù)pedit.msc按回車啟動“組策略”，展開用戶配置管理模板系統(tǒng)，找到“阻止訪問注冊表編輯工具”，右鍵單擊將它禁止。同時將 “阻止訪問命令提示符”也禁止。回到“管理模板”，展開windows組件windows資源管理器，找到“工具菜單刪除文件夾選項菜單”，選擇已禁用即可。5、開始運(yùn)行輸入regedit確定進(jìn)入注冊表修改HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogon為HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogon修改HKLMSYSTEMCurrentControlSetControlSafeBootAlternateShell = cmd-brontok.exe為HKLMSYSTEMCurrentControlSetControlSafeBootAlternateShell = cmd.exe修改HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionexploreradvancedHidden=0為HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionexploreradvancedHidden=1修改HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionexploreradvancedShowSuperHidden = 0為HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionexploreradvancedShowSuperHidden = 1修改HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionexploreradvancedHideFileExt=1為HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionexploreradvancedHideFileExt=0修改HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoFolderOptions1 為HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoFolderOptions0 以上數(shù)值請對照仔細(xì)修改，如果正確則不用修改刪除如下自啟動項：HKLMsoftwaremicrosoftwindowscurrentversionrunBron-Spizaetus = C:WINDOWSShellNewRakyatKelaparan.exeHKCUsoftwaremicrosoftwindowscurrentversionrunTok-Cirrhatus-1464 = C:Documents and Settings用戶名Local SettingsApplication Databr3951on.exe HKCUsoftwaremicrosoftwindowscurrentversionrunTok-Cirrhatus = HKLMSoftWareMicrosoftWindowsCurrentVersionWinlogonShellBron-Spizaetus=C:WINDOWSShellNewRakyatKelaparan.exe6、注冊表中搜索含有“Bron”“Tok-Cirrhatus” 字符的所有項目，然后刪除，保存退出。7、刪除如下文件：C:Documents and Settings用戶名LocalSettingsApplicationDatacsrss.exeC:Documents and Settings用戶名LocalSettingsApplicationDatainetinfo.exeC:Documents and Settings用戶名LocalSettingsApplicationDataservices.exeC:Documents and Settings用戶名LocalSettingsApplicationDatasmss.exeC:Documents and Settings用戶名LocalSettingsApplicationDatasvchost.exeC:Documents and Settings用戶名LocalSettingsApplicationDatalsass.exeC:Documents and Settings用戶名LocalSettingsApplicationDatawinlogon.exeC:Documents and Settings用戶名Local SettingsApplication Databr3951on.exeC:Documents and Settings用戶名開始菜單程序啟動empty.pifC:Documents and Settings用戶名TemplatesWowT C:WINDOWSSystem32用戶名ssetting.exeC:WINDOWSSystem32cmd-brontok.exeC:WINDOWSKesenjanganSosial.exeC:WINDOWSShellNewRakyatKelap