没什么,我那个变种的,只要见到"杀毒"都要关

C:\WINDOWS\system32\crsss.exe



open=niu.exe
shell\open=打开(&O)
shell\open\Command=niu.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=niu.EXE

【回复“北极大白熊”的帖子】
建议用IceSword手工杀毒。操作流程如下：

1、禁止进程创建。
2、结束下列进程：
[PID: 1552 / Administrator][C:\WINDOWS\system32\crsss.exe] [N/A, ]
[PID: 1688 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1748 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2004 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2036 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 152 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 176 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 248 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1784 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 360 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1204 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1324 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1696 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1736 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1872 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1120 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1880 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1940 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1508 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1992 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 980 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1168 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1248 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1428 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1732 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1316 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1240 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1892 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 420 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1292 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1904 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1308 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1808 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2076 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2112 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2144 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2176 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2200 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2224 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2248 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2280 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2304 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2328 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2352 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2396 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2432 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2464 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2500 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2524 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2548 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2572 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2596 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2636 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2660 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2696 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2728 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2752 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2792 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2844 / Administrator][C:\WINDOWS\system32\REG.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
3、删除下列文件：
C:\WINDOWS\system32\crsss.exe
CDE分区根目录下的Autorun.inf和niu.exe
4、删除下列注册表项：
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]分支下的：
crsss（指向C:\WINDOWS\system32\crsss.exe）
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options分支下的所有指向C:\WINDOWS\system32\crsss.exe的子键。
5、取消IceSword的“禁止进程创建”。

禽兽病毒
参考http://hi.baidu.com/newcenturysun/blog/item/19c2bf64d3fc41f3f7365482.html

哈哈，有了冰刃，那还不迎刃而解，手到擒来。2天来总算有个满意的结局。

LZ各位辛苦！

【回复“baohe”的帖子】

对，文件夹选项改写成：禽兽尚且有半点怜悯之心，而我没有，所以我不是禽兽

我把我的两块硬盘拔下来到别人的电脑中杀毒，然后删除盘中的那两个该死的文件，再重装系统才好使。

这样的垃圾,怎么不被抓起来判个几年呢?祝福他全家,男的出门被卡车压死,女的被鸡吧乱棍操死!多行不义必自毙,不是不报,时候未到!
禽兽病毒太夸张啊！
学好本领，什么也不怕了　！