启动项出现 乱码项，如何删除
启动项目，命令 都是乱码:口口...之类的乱码
位置是:HKCU\SOFTWARE\Microsoft\Windows NT\CurrenVersion\Windows:Load
如何底清除？？
??
我用的win2000
问题点数：100、回复次数：14Top
1 楼gxl123（苛夲另手我蔷薇彦觚你遥）回复于 2006-10-08 21:26:59 得分 0
如果把那乱码启动项禁用后，重启会生成另一乱码启动项Top
2 楼xyxfly（All things are difficult before they are easy.）回复于 2006-10-08 21:52:28 得分 10
注册表里面对应的键值也删掉试试Top
3 楼xyxfly（All things are difficult before they are easy.）回复于 2006-10-08 21:52:57 得分 20
或者用第3方软件 比如优化大师试试Top
4 楼gxl123（苛夲另手我蔷薇彦觚你遥）回复于 2006-10-08 22:19:08 得分 0
试过了/run之类的注册表里没可疑的东西
在HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg 有那乱码项
但删除后，重启又自动生成Top
5 楼gxl123（苛夲另手我蔷薇彦觚你遥）回复于 2006-10-08 22:50:51 得分 0
用优化大师无法查看到这乱码项Top
6 楼xch1967（）回复于 2006-10-08 23:14:26 得分 5
贴个日志上来Top
7 楼gxl123（苛夲另手我蔷薇彦觚你遥）回复于 2006-10-09 08:06:45 得分 0
Logfile of HijackThis v1.99.0
Scan saved at 8:03:56, on 2006-10-9
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\winasse.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\Tencent\QQ\TIMPlatfrom.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\System\msconfig.exe
C:\WINNT\system32\taskmgr.exe
C:\WINNT\system32\msiexec.exe
E:\黑客工具\hijackthis汉化版\20050222HijackThis\HijackThis V1.99.0汉化版\HijackThis.exe
C:\WINNT\SoftwareDistribution\Download\S-1-5-18\b3473af52ce9c93650dd4a2e044d3459\update\update.exe
R3 - URLSearchHook: bho Class - {ED8DFC5C-10EF-45AB-9DC2-0639AFF5A270} - C:\PROGRA~1\COMMON~1\Wnwb\wnwbio.dll
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\WINNT\system32\zzcoke.dll
O2 - BHO: update wnwb - {ED8DFC5C-10EF-45AB-9DC2-0639AFF5A270} - C:\PROGRA~1\COMMON~1\Wnwb\wnwbio.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [WlN32] regedit -s C:\$NtUninstallQ887678$\WINSYS.cer
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\RunOnce: [WlN32] C:\$NtUninstallQ887678$\WINSYS.vbs
O4 - HKCU\..\Run: [] regedit -s C:\$NtUninstallQ887678$\WINSYS.cer
O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\flashget\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\flashget\FlashGet\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1160306889503
O17 - HKLM\System\CCS\Services\Tcpip\..\{10A9C04D-E969-4DF2-B097-F55BF8998166}: NameServer = 210.52.149.2,210.53.31.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{10A9C04D-E969-4DF2-B097-F55BF8998166}: NameServer = 210.52.149.2,210.53.31.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{10A9C04D-E969-4DF2-B097-F55BF8998166}: NameServer = 210.52.149.2,210.53.31.2
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
Top
8 楼liangqingzhi（老之）回复于 2006-10-09 08:45:22 得分 10
winasse.exe
清除方法见：http://www.cnhx.com.cn/showart.asp?id=235Top
9 楼gxl123（苛夲另手我蔷薇彦觚你遥）回复于 2006-10-09 13:57:52 得分 0
试了，那winasse.exe在注册表上删了又恢复
还有一个病毒vpcrm.exe,在正常模式了，找到了，却删不了
在安全模式下却根本找不到（所有文件都已设为可视了）Top
10 楼gxl123（苛夲另手我蔷薇彦觚你遥）回复于 2006-10-09 15:15:29 得分 0
又少扫描了一遍
大家再帮我看看，多谢了，各位
Logfile of HijackThis v1.99.1
Scan saved at 15:10:29, on 2006-10-9
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\黑客工具\hijackthis_16091\hijackthis_16091\HijackThis.exe
R3 - URLSearchHook: bho Class - {ED8DFC5C-10EF-45AB-9DC2-0639AFF5A270} - C:\PROGRA~1\COMMON~1\Wnwb\wnwbio.dll
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\WINNT\system32\zzcoke.dll
O2 - BHO: update wnwb - {ED8DFC5C-10EF-45AB-9DC2-0639AFF5A270} - C:\PROGRA~1\COMMON~1\Wnwb\wnwbio.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\flashget\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\flashget\FlashGet\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1160306889503
O17 - HKLM\System\CCS\Services\Tcpip\..\{10A9C04D-E969-4DF2-B097-F55BF8998166}: NameServer = 210.52.149.2,210.53.31.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{10A9C04D-E969-4DF2-B097-F55BF8998166}: NameServer = 210.52.149.2,210.53.31.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{10A9C04D-E969-4DF2-B097-F55BF8998166}: NameServer = 210.52.149.2,210.53.31.2
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - Protocol: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\System32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - Protocol: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINNT\System32\inetcomm.dll
O18 - Protocol: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\System32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINNT\System32\mshtml.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINNT\System32\msdxm.ocx
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
Top
11 楼gxl123（苛夲另手我蔷薇彦觚你遥）回复于 2006-10-09 15:34:07 得分 0
对于这个vpcrm.exe，我把它在注册表中找到的全删了，在文件夹里的也删了，
但为什么重启后又都恢复了呢
不解？？
有谁能告诉我呢？？？
多谢了！！！！Top
12 楼huangwc（地主）回复于 2006-10-09 20:48:12 得分 10
说明还有别的进程启动了它
你可以用Icesword的process creation观察一下
看是哪个进程干的.Top
13 楼xch1967（）回复于 2006-10-09 23:45:53 得分 45
启动注册表，找到HKCU\SOFTWARE\Microsoft\Windows NT\CurrenVersion\Windows项，在右边有个load值，把它删除了。试试。Top
14 楼gxl123（苛夲另手我蔷薇彦觚你遥）回复于 2006-10-10 12:13:18 得分 0
终于搞定了，苦，整整搞了两天，不知以后还会不会再出现
xch1967() ( ) 信誉：100 Blog
说的对，删了后，启动项那乱码没了
不情愿的动用360查出了不少毒，感觉还不错，姓周的还算不点娘心
Top
