救命呀!!pkeusvq.exe ngpycxm.exe

显示全部楼层 · 发表于 2007-5-24 13:53:15

先说情况.
早上上网卡巴提示有木马然后没有提示可选择选项.(删除跳过什么的) 用瑞星专杀橙色八月专用提取清除工具提示这两个文件病毒类型未知杀毒显示ok 重起. 卡巴无法自启动.手都启动同样不行一闪而过.想进入安全模式发现进不去机子自动重起.反复十几次.网上有类似文章
http://bbs.cfanclub.net/simple/index.php?t36109.html
按照高手所说的方法无效
现在上传sreng2 的扫描报告请高手支着...另外 sreng2是修改了名字以后才能启动的删除启动选项是没有用的.

---------------------------------------------------------------------------------------------------------------------------------------------------------------------
2007-05-24,13:39:33

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目

注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
(ctfmon.exe)(C:\WINDOWS\system32\ctfmon.exe) [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
(load)() [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
(IMJPMIG8.1)("C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32) [(Verified)Microsoft Windows Publisher]
(PHIME2002ASync)(C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC) [(Verified)Microsoft Windows Publisher]
(PHIME2002A)(C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName) [(Verified)Microsoft Windows Publisher]
(High Definition Audio 属性页快捷方式)(HDAShCut.exe) [(Verified)Microsoft Windows XP Publisher]
(Cmaudio)(RunDll32 cmicnfg.cpl,CMICtrlWnd) [N/A]
(NvCplDaemon)(RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup) [NVIDIA Corporation]
(nwiz)(nwiz.exe /install) []
(NvMediaCenter)(RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit) [NVIDIA Corporation]
(AVPSrv)(C:\WINDOWS\AVPSrv.exe) []
(cmdbcs)(C:\WINDOWS\cmdbcs.exe) []
(omwmstj)(C:\WINDOWS\system32\pkeusvq.exe) []
(fmvluab)(C:\WINDOWS\system32\ngpycxm.exe) []
(kav)("D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe") [Kaspersky Lab]
(upxdnd)(C:\DOCUME~1\lp\LOCALS~1\Temp\upxdnd.exe) []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
(avp6_post_uninstall)() [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(shell)(EXPLORER.EXE) [(Verified)Microsoft Windows Publisher]
(Userinit)(C:\WINDOWS\system32\userinit.exe,) [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
(AppInit_DLLs)() [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(UIHost)(logonui.exe) [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
(WinlogonNotify: klogon)(C:\WINDOWS\system32\klogon.dll) [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\({12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
(IE7 Uninstall Stub)(C:\WINDOWS\system32\ieudinit.exe) [(Verified)Microsoft Windows Component Publisher]

--------------------------------------------------------------------------------

启动文件夹

N/A

--------------------------------------------------------------------------------

服务

[Human Interface Device Access / HidServ][Stopped/Disabled]
(C:\WINDOWS\System32\svchost.exe -k netsvcs--)%SystemRoot%\System32\hidserv.dll)(N/A)
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
(C:\WINDOWS\system32\nvsvc32.exe)(NVIDIA Corporation)
[卡巴斯基反病毒6.0 / AVP][Stopped/Auto Start]
("D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r)(Kaspersky Lab)

--------------------------------------------------------------------------------
驱动程序

[C-Media High Definition Audio Interface / cmudax][Running/Manual Start]
(system32\drivers\cmudax.sys)(C-Media Inc.)
[Microsoft 用于 High Definition Audio 服务的 UAA 功能驱动程序 / HdAudAddService][Stopped/Manual Start]
(system32\drivers\HdAudio.sys)(Windows (R) Server 2003 DDK provider)
[Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus][Running/Manual Start]
(system32\DRIVERS\HDAudBus.sys)(Windows (R) Server 2003 DDK provider)
[ATK0110 ACPI UTILITY / MTsensor][Running/Manual Start]
(system32\DRIVERS\ASACPI.sys)()
[nv / nv][Running/Manual Start]
(system32\DRIVERS\nv4_mini.sys)(NVIDIA Corporation)
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
(system32\DRIVERS\ptilink.sys)(Parallel Technologies, Inc.)
[Secdrv / Secdrv][Stopped/Manual Start]
(system32\DRIVERS\secdrv.sys)(N/A)
[NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller / yukonwxp][Running/Manual Start]
(system32\DRIVERS\yk51x86.sys)(Marvell)
[klif / klif][Running/System Start]
(\??\C:\WINDOWS\system32\drivers\klif.sys)(Kaspersky Lab)
[kl1 / kl1][Stopped/Boot Start]
(\SystemRoot\system32\drivers\kl1.sys)(Kaspersky Lab)

--------------------------------------------------------------------------------

浏览器加载项

[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} (d:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, N/A)
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} (D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab)
[]
{e2e2dd38-d088-4134-82b7-f2ba38496583} (%windir%\Network Diagnostic\xpnetdiag.exe, N/A)
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} (d:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, N/A)
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} (C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation)
[XML DOM Document]
{2933BF90-7B36-11D2-B20E-00C04F983E60} (%SystemRoot%\system32\msxml3.dll, N/A)
[Thunder Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} (d:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll, N/A)
[Microsoft Web Browser]
{8856F961-340A-11D0-A96B-00C04FD705A2} (C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation)
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} (C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation)
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} (C:\WINDOWS\system32\Macromed\Flash\Flash6.ocx, Macromedia, Inc.)
[XML DOM Document 3.0]
{F5078F32-C551-11D3-89B9-0000F81FE221} (%SystemRoot%\system32\msxml3.dll, N/A)
[XML HTTP]
{F6D90F16-9C73-11D3-B32E-00C04F990BB4} (%SystemRoot%\system32\msxml3.dll, N/A)
[上传到QQ网络硬盘]
(D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A)
[添加到QQ自定义面板]
(D:\Program Files\Tencent\QQ\AddPanel.htm, N/A)
[添加到QQ表情]
(D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A)
[用QQ彩信发送该图片]
(D:\Program Files\Tencent\QQ\SendMMS.htm, N/A)

--------------------------------------------------------------------------------

正在运行的进程

[PID: 568][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 628][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 652][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 696][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)]
[PID: 708][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 876][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 944][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1040][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16441 (vista_gdr.070219-1500)]
[C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 1164][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1236][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16441 (vista_gdr.070219-1500)]
[PID: 1356][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1980][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.9147]
[C:\WINDOWS\system32\nvapi.dll] [N/A, ]
[PID: 1988][C:\WINDOWS\system32\RunDll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system\cmicnfg.cpl] [C-Media Corporation, 1. 0. 47.9]
[C:\WINDOWS\System32\udaprop.dll] [C-Media Corporation, 1.0.2.3]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 232][C:\WINDOWS\system32\RUNDLL32.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\NvMcTray.dll] [NVIDIA Corporation, 6.14.10.9147]
[C:\WINDOWS\system32\nvapi.dll] [N/A, ]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.9147]
[PID: 280][C:\WINDOWS\system32\pkeusvq.exe] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16441 (vista_gdr.070219-1500)]
[PID: 288][C:\WINDOWS\system32\ngpycxm.exe] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16441 (vista_gdr.070219-1500)]
[PID: 300][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1616][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1764][C:\WINDOWS\system32\wscntfy.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1936][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 172][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 7.00.6000.16441 (vista_gdr.070219-1500)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16441 (vista_gdr.070219-1500)]
[C:\WINDOWS\system32\IEFRAME.dll] [Microsoft Corporation, 7.00.6000.16441 (vista_gdr.070219-1500)]
[C:\WINDOWS\system32\IEUI.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[C:\WINDOWS\system32\xmllite.dll] [Microsoft Corporation, 1.00.1018.0]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\Program Files\Internet Explorer\ieproxy.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[C:\WINDOWS\system32\ieapfltr.dll] [Microsoft Corporation, 7.0.6000.16461]
[D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\Macromed\Flash\Flash6.ocx] [Macromedia, Inc., 6,0,88,0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\AVPSrv.dll] [N/A, ]
[C:\WINDOWS\system32\cmdbcs.dll] [N/A, ]
[PID: 180][C:\Documents and Settings\lp\桌面\sreng2\SR1Eng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16441 (vista_gdr.070219-1500)]
[C:\WINDOWS\system32\AVPSrv.dll] [N/A, ]
[PID: 1860][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16441 (vista_gdr.070219-1500)]
[C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16441 (vista_gdr.070219-1500)]
[C:\WINDOWS\system32\AVPSrv.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\nwizAsktao.dll] [N/A, ]
[C:\WINDOWS\system32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\system32\moyu102.dll] [N/A, ]

--------------------------------------------------------------------------------

文件关联

.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

--------------------------------------------------------------------------------

Winsock 提供者

N/A

--------------------------------------------------------------------------------

Autorun.inf

[D:\]
[AutoRun]
open=fmvluab.exe
shell\open=打开(&O)
shell\open\Command=fmvluab.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=fmvluab.exe
[E:\]
[AutoRun]
open=fmvluab.exe
shell\open=打开(&O)
shell\open\Command=fmvluab.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=fmvluab.exe
[F:\]
[AutoRun]
open=fmvluab.exe
shell\open=打开(&O)
shell\open\Command=fmvluab.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=fmvluab.exe

--------------------------------------------------------------------------------

HOSTS 文件

127.0.0.1 localhost

--------------------------------------------------------------------------------

API HOOK

RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xB99DAB25)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xB99DAD67)
RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xB99DAF0B)
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xB99DAC49)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xB99DAE8F)

--------------------------------------------------------------------------------

隐藏进程

[848] C:\WINDOWS\system32\55.exe

显示全部楼层 · 发表于 2007-5-24 14:56:02

能不能直接把日志文件传上来。

显示全部楼层 · 发表于 2007-5-24 15:09:12

(AVPSrv)(C:\WINDOWS\AVPSrv.exe) []
(cmdbcs)(C:\WINDOWS\cmdbcs.exe) []
(omwmstj)(C:\WINDOWS\system32\pkeusvq.exe) []
(fmvluab)(C:\WINDOWS\system32\ngpycxm.exe) []
(upxdnd)(C:\DOCUME~1\lp\LOCALS~1\Temp\upxdnd.exe) []
(avp6_post_uninstall)() [N/A]
这些注册表启动项删除，病毒文件按路径删除。

[C:\WINDOWS\system32\AVPSrv.dll] [N/A, ]
[C:\WINDOWS\system32\cmdbcs.dll] [N/A, ]
C:\WINDOWS\system32\moyu102.dll
C:\WINDOWS\system32\55.exe
按路径删除

以上所有文件都可以按路径用冰刃删除

最后用这个清理

[ 本帖最后由 wangjay1980 于 2007-5-24 15:10 编辑 ]

显示全部楼层 · 发表于 2007-5-24 15:47:36

老大你高估了我的能力了....我在冰刃启动组里只能发现刷新列表再没有其他功能了

显示全部楼层 · 发表于 2007-5-24 16:05:33

老大我没有办法只能用msconfig打开启动项关掉了你说那些个启动另外还有个
ppds.exe 也让我关了没有找到(avp6_post_uninstall)() [N/A] 只有一个没有名字的我也关了应用确定退出不重起再打开pkeusvq.exe ngpycxm.exe 又出来了. 用冰刃强制删除第二段路径下的文件没有55.exe了多了个77.exe 我把他强制删除了.目前这个情况

显示全部楼层 · 发表于 2007-5-24 16:10:19

启动项可以用SRENG来删除！你试试删除把！

显示全部楼层 · 发表于 2007-5-24 16:18:51

启动项pkeusvq.exe ngpycxm.exe删除后马上再生 .而且重起后 pkeusvq.exe ngpycxm.exe 依旧存在 .windows清理助手扫描提示正常

显示全部楼层 · 发表于 2007-5-24 16:24:54

用这个删除

显示全部楼层 · 发表于 2007-5-24 16:25:54

现在启动项有这些是删除不了的 msconfig omwmstj fmvluab upxdnd avpsrv cmdbcs mppds desktop.ini 两个

显示全部楼层 · 发表于 2007-5-24 16:26:39

Autorun.inf

[D:\]
[AutoRun]
open=fmvluab.exe
shell\open=打开(&O)
shell\open\Command=fmvluab.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=fmvluab.exe
[E:\]
[AutoRun]
open=fmvluab.exe
shell\open=打开(&O)
shell\open\Command=fmvluab.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=fmvluab.exe
[F:\]
[AutoRun]
open=fmvluab.exe
shell\open=打开(&O)
shell\open\Command=fmvluab.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=fmvluab.exe

这些用冰刃删除

[友情提醒] 救命呀!!pkeusvq.exe ngpycxm.exe